@isomorph.ai/app-sdk 1.13.1 → 1.13.2-rc.2026101101

package/README.md

@@ -183,6 +183,10 @@ and no second GET is sent. When the refresh fails, `identity.current()`
 answers `null` and listeners hear `null`, as before. On the page's own origin
 the identity GET is never renewed (it is the renewal). (1.5.3)
 
+## External OTP users
+
+Use `user.id` for ownership and database row rules. External users can sign in with a phone number and have no email. `user.name`, `user.phone`, `user.email` and the `emailVerified`/`phoneVerified` flags describe their profile; an optional contact is not verified automatically. `user.directory` identifies `company` or `external`. Database transactions also expose `current_setting('harbour.directory', true)` when a row rule needs that distinction.
+
 ## The signed-in user's groups
 
 `user.groups` — the company groups your identity provider sent at sign-in; use

package/dist/index.d.ts

@@ -13,7 +13,12 @@ export declare class IsomorphError extends Error {
 }
 export interface IsomorphUser {
     id: string;
-    email: string;
+    email?: string;
+    name?: string;
+    phone?: string;
+    directory?: 'company' | 'external';
+    emailVerified?: boolean;
+    phoneVerified?: boolean;
     /**
      * The company groups your identity provider sent at sign-in, `[]` when it
      * sent none. Use them for in-app roles: who may open the app at all is

package/dist/runtime.d.ts

@@ -11,7 +11,7 @@ export declare const GET_RUN_ACTION = "isomorph-jobs-get";
 export declare const CANCEL_RUN_ACTION = "isomorph-jobs-cancel";
 export interface ActionContext {
     signal: AbortSignal;
-    user: Pick<IsomorphUser, 'id' | 'email' | 'groups' | 'role'>;
+    user: IsomorphUser;
     tenant: string;
     app: string;
     requestId: string;

package/dist/runtime.js

@@ -489,11 +489,16 @@ export class Runtime {
         const controller = new AbortController();
         const abort = () => controller.abort();
         response.once('close', abort);
+        const directory = header(request, 'X-Harbour-Verified-Directory');
         const user = {
             id: header(request, 'X-Harbour-Verified-User-ID'),
             email: header(request, 'X-Harbour-Verified-User-Email'),
             groups: userGroupsFromHeader(header(request, 'X-Harbour-Verified-User-Groups')),
             role: userRole(header(request, 'X-Harbour-Verified-User-Role')),
+            ...(directory === 'company' || directory === 'external' ? { directory } : {}),
+            ...(header(request, 'X-Harbour-Verified-User-Name') ? { name: header(request, 'X-Harbour-Verified-User-Name') } : {}),
+            ...(header(request, 'X-Harbour-Verified-User-Phone') ? { phone: header(request, 'X-Harbour-Verified-User-Phone') } : {}),
+            ...(directory === 'external' ? { emailVerified: header(request, 'X-Harbour-Verified-Email-Verified') === 'true', phoneVerified: header(request, 'X-Harbour-Verified-Phone-Verified') === 'true' } : {}),
         };
         const streams = header(request, 'accept').toLowerCase().includes(PROGRESS_MEDIA_TYPE);
         let steps = 0;

package/dist/supabase-compat.d.ts

@@ -130,7 +130,7 @@ export declare class SupabaseCompatQueryBuilder<T, Result = T[], Head extends bo
 }
 export interface SupabaseCompatUser {
     id: string;
-    email: string;
+    email?: string;
     app_metadata: Record<string, unknown>;
     /** Isomorph's per-app user record (`IsomorphUser.appUser`) when it is an object. */
     user_metadata: Record<string, unknown>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/app-sdk",
-  "version": "1.13.1",
+  "version": "1.13.2-rc.2026101101",
   "type": "module",
   "repository": {
     "type": "git",