@nebutra/identity 2.0.0 → 3.0.0

package/.turbo/turbo-build.log

@@ -1,37 +1,32 @@
 
-> @nebutra/identity@2.0.0 build /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/iam/identity
+> @nebutra/identity@3.0.0 build /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/iam/identity
 > tsup
 
-CLI Building entry: src/index.ts, src/registry.ts, src/types.ts, src/adapters/authjs.ts, src/adapters/clerk.ts
+CLI Building entry: src/index.ts, src/registry.ts, src/types.ts, src/adapters/nebutra.ts
 CLI Using tsconfig: tsconfig.json
 CLI tsup v8.5.1
 CLI Using tsup config: /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/iam/identity/tsup.config.ts
 CLI Target: es2022
 CLI Cleaning output folder
 ESM Build start
-ESM dist/index.js               480.00 B
-ESM dist/adapters/authjs.js     134.00 B
-ESM dist/registry.js            255.00 B
-ESM dist/chunk-DOCMMNRB.js      1.34 KB
-ESM dist/types.js               136.00 B
-ESM dist/chunk-MZKK4BRU.js      472.00 B
-ESM dist/chunk-ZERXN5CV.js      1.34 KB
-ESM dist/adapters/clerk.js      131.00 B
-ESM dist/chunk-QKUYKQO6.js      1018.00 B
-ESM dist/index.js.map           71.00 B
-ESM dist/adapters/authjs.js.map 71.00 B
-ESM dist/registry.js.map        71.00 B
-ESM dist/chunk-DOCMMNRB.js.map  3.24 KB
-ESM dist/types.js.map           71.00 B
-ESM dist/chunk-MZKK4BRU.js.map  1.22 KB
-ESM dist/chunk-ZERXN5CV.js.map  2.68 KB
-ESM dist/adapters/clerk.js.map  71.00 B
-ESM dist/chunk-QKUYKQO6.js.map  1.94 KB
-ESM ⚡️ Build success in 97ms
+ESM dist/index.js                344.00 B
+ESM dist/adapters/nebutra.js     137.00 B
+ESM dist/registry.js             225.00 B
+ESM dist/chunk-CAQ25QHX.js       415.00 B
+ESM dist/types.js                136.00 B
+ESM dist/chunk-VMSPQ5ZK.js       472.00 B
+ESM dist/chunk-LMFYKNSW.js       851.00 B
+ESM dist/index.js.map            71.00 B
+ESM dist/adapters/nebutra.js.map 71.00 B
+ESM dist/registry.js.map         71.00 B
+ESM dist/chunk-CAQ25QHX.js.map   524.00 B
+ESM dist/types.js.map            71.00 B
+ESM dist/chunk-VMSPQ5ZK.js.map   1.21 KB
+ESM dist/chunk-LMFYKNSW.js.map   2.51 KB
+ESM ⚡️ Build success in 80ms
 DTS Build start
-DTS ⚡️ Build success in 28124ms
-DTS dist/index.d.ts           1.17 KB
-DTS dist/registry.d.ts        216.00 B
-DTS dist/adapters/authjs.d.ts 301.00 B
-DTS dist/adapters/clerk.d.ts  298.00 B
-DTS dist/types.d.ts           605.00 B
+DTS ⚡️ Build success in 31675ms
+DTS dist/index.d.ts            252.00 B
+DTS dist/registry.d.ts         216.00 B
+DTS dist/adapters/nebutra.d.ts 918.00 B
+DTS dist/types.d.ts            596.00 B

package/.turbo/turbo-typecheck.log

@@ -1,4 +1,4 @@
 
-> @nebutra/identity@2.0.0 typecheck /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/iam/identity
+> @nebutra/identity@3.0.0 typecheck /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/iam/identity
 > tsc --noEmit
 

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @nebutra/identity
 
+## 3.0.0
+
+### Major Changes
+
+- [`6684e47`](https://github.com/Nebutra/Nebutra-Sailor/commit/6684e47930383dc572406c6f900827827375278b) Thanks [@TsekaLuk](https://github.com/TsekaLuk)! - One stack (ADR 2026-09-24 Sailor convergence, amended 2026-09-26). The
+  `@nebutra/*` packages now ship one provider per domain; everything else is
+  removed, not deprecated.
+  - `@nebutra/identity`: the Clerk and Auth.js adapters are gone; Better Auth is
+    the only identity source.
+  - `@nebutra/billing`: Polar and LemonSqueezy are gone. The card rail is Creem
+    (merchant of record) with WeChat Pay / Alipay for the mainland; Stripe stays
+    only to complete checkouts opened before the switch.
+  - `@nebutra/search`: Meilisearch, Typesense and Algolia are gone; search runs on
+    Postgres (pgvector + full-text).
+  - `@nebutra/permissions`: OpenFGA is gone; CASL is the engine.
+  - Also narrowed across the group: queue is QStash only (BullMQ/SQS removed),
+    notifications are built-in (Novu/Knock removed), webhooks are built-in (Svix
+    removed), uploads are S3-compatible (Vercel Blob removed), SMS is Twilio
+    Verify + Aliyun (Tencent removed), email is Resend (Nodemailer removed).
+
+  Migrating: drop the removed provider env vars, set the keys for the kept
+  provider, and run `nebutra status` to see what is live.
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @nebutra/contracts@3.0.0
+
 ## 2.0.0
 
 ### Patch Changes

package/README.md

@@ -4,9 +4,18 @@ Provider-agnostic identity adapter layer — maps auth-provider-specific session
 
 ## Design Intent
 
-Nebutra supports multiple auth providers (Clerk, Auth.js, custom). Rather than leaking provider-specific types into application code, this package defines an `IdentityAdapter` interface and an `IdentityAdapterRegistry` that maps any provider's session data to the `CanonicalIdentity` schema from `@nebutra/contracts`. Application code always receives `CanonicalIdentity`; swapping auth providers requires only registering a new adapter.
-
-The Clerk adapter is the default production adapter. The Auth.js adapter provides a drop-in alternative. Both are tested against the same `CanonicalIdentity` schema.
+This package defines an `IdentityAdapter` interface and an `IdentityAdapterRegistry` that maps a provider's session data to the `CanonicalIdentity` schema from `@nebutra/contracts`, so application code always receives `CanonicalIdentity` regardless of the upstream provider.
+
+`@nebutra/auth` (Better Auth) is the kept, single production auth backend per
+ADR 2026-09-24 (Sailor Convergence); the built-in `clerk` and `authjs`
+adapters here are not that backend and are not currently wired to any caller
+in this monorepo — they exist for a consumer that talks to Clerk or Auth.js
+directly and needs to normalize its claims into the same canonical shape (for
+example, a future integration point for `apps/sleptons`'s own direct Clerk
+usage, which Nebutra keeps intentionally as its own product, stripped from
+the template). Swapping which adapter a given consumer uses requires only
+registering a new `IdentityAdapter`; none of this is a scaffold-time or
+`create-sailor` choice.
 
 ## Usage
 

package/dist/adapters/nebutra.d.ts

@@ -0,0 +1,30 @@
+import { CanonicalIdentity } from '@nebutra/contracts';
+import { IdentityAdapter } from '../types.js';
+
+/**
+ * Nebutra Identity Adapter
+ *
+ * Maps oidc-provider / Nebutra-issued OIDC tokens to CanonicalIdentity.
+ * Used when Nebutra acts as both the IdP AND the resource server —
+ * i.e., when a Nebutra service receives an access token issued by
+ * the Nebutra IdP and needs to resolve the user identity.
+ */
+
+interface NebutraOIDCClaims {
+    sub: string;
+    email?: string;
+    name?: string;
+    picture?: string;
+    "nebutra:organization_id"?: string;
+    "nebutra:role"?: string;
+    "nebutra:plan"?: string;
+    [key: string]: unknown;
+}
+declare class NebutraIdentityAdapter implements IdentityAdapter<NebutraOIDCClaims> {
+    readonly provider: "nebutra";
+    mapToCanonical(input: NebutraOIDCClaims): CanonicalIdentity | null;
+    private mapRole;
+    private mapPlan;
+}
+
+export { NebutraIdentityAdapter };

package/dist/adapters/nebutra.js

@@ -0,0 +1,7 @@
+import {
+  NebutraIdentityAdapter
+} from "../chunk-LMFYKNSW.js";
+export {
+  NebutraIdentityAdapter
+};
+//# sourceMappingURL=nebutra.js.map

package/dist/chunk-CAQ25QHX.js

@@ -0,0 +1,18 @@
+import {
+  IdentityAdapterRegistry
+} from "./chunk-VMSPQ5ZK.js";
+import {
+  NebutraIdentityAdapter
+} from "./chunk-LMFYKNSW.js";
+
+// src/registry.ts
+function createDefaultIdentityAdapterRegistry() {
+  const registry = new IdentityAdapterRegistry();
+  registry.register(new NebutraIdentityAdapter());
+  return registry;
+}
+
+export {
+  createDefaultIdentityAdapterRegistry
+};
+//# sourceMappingURL=chunk-CAQ25QHX.js.map

package/dist/chunk-CAQ25QHX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/registry.ts"],"sourcesContent":["import { NebutraIdentityAdapter } from \"./adapters/nebutra\";\nimport { IdentityAdapterRegistry } from \"./types\";\n\nexport function createDefaultIdentityAdapterRegistry(): IdentityAdapterRegistry {\n  const registry = new IdentityAdapterRegistry();\n  registry.register(new NebutraIdentityAdapter());\n  return registry;\n}\n"],"mappings":";;;;;;;;AAGO,SAAS,uCAAgE;AAC9E,QAAM,WAAW,IAAI,wBAAwB;AAC7C,WAAS,SAAS,IAAI,uBAAuB,CAAC;AAC9C,SAAO;AACT;","names":[]}

package/dist/{chunk-DOCMMNRB.js → chunk-LMFYKNSW.js}

@@ -1,13 +1,3 @@
-import {
-  IdentityAdapterRegistry
-} from "./chunk-MZKK4BRU.js";
-import {
-  AuthJsIdentityAdapter
-} from "./chunk-ZERXN5CV.js";
-import {
-  ClerkIdentityAdapter
-} from "./chunk-QKUYKQO6.js";
-
 // src/adapters/nebutra.ts
 var NebutraIdentityAdapter = class {
   provider = "nebutra";
@@ -39,17 +29,7 @@ var NebutraIdentityAdapter = class {
   }
 };
 
-// src/registry.ts
-function createDefaultIdentityAdapterRegistry() {
-  const registry = new IdentityAdapterRegistry();
-  registry.register(new ClerkIdentityAdapter());
-  registry.register(new AuthJsIdentityAdapter());
-  registry.register(new NebutraIdentityAdapter());
-  return registry;
-}
-
 export {
-  NebutraIdentityAdapter,
-  createDefaultIdentityAdapterRegistry
+  NebutraIdentityAdapter
 };
-//# sourceMappingURL=chunk-DOCMMNRB.js.map
+//# sourceMappingURL=chunk-LMFYKNSW.js.map

package/dist/chunk-LMFYKNSW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/nebutra.ts"],"sourcesContent":["/**\n * Nebutra Identity Adapter\n *\n * Maps oidc-provider / Nebutra-issued OIDC tokens to CanonicalIdentity.\n * Used when Nebutra acts as both the IdP AND the resource server —\n * i.e., when a Nebutra service receives an access token issued by\n * the Nebutra IdP and needs to resolve the user identity.\n */\n\nimport type { CanonicalIdentity } from \"@nebutra/contracts\";\nimport type { IdentityAdapter } from \"../types\";\n\ninterface NebutraOIDCClaims {\n  sub: string;\n  email?: string;\n  name?: string;\n  picture?: string;\n  \"nebutra:organization_id\"?: string;\n  \"nebutra:role\"?: string;\n  \"nebutra:plan\"?: string;\n  [key: string]: unknown;\n}\n\nexport class NebutraIdentityAdapter implements IdentityAdapter<NebutraOIDCClaims> {\n  readonly provider = \"nebutra\" as const;\n\n  mapToCanonical(input: NebutraOIDCClaims): CanonicalIdentity | null {\n    if (!input.sub) return null;\n\n    return {\n      provider: \"nebutra\",\n      userId: input.sub,\n      organizationId: input[\"nebutra:organization_id\"],\n      role: this.mapRole(input[\"nebutra:role\"]),\n      plan: this.mapPlan(input[\"nebutra:plan\"]),\n      email: input.email,\n      claimsVersion: \"v1\",\n    };\n  }\n\n  private mapRole(role?: string): \"OWNER\" | \"ADMIN\" | \"MEMBER\" | \"VIEWER\" | undefined {\n    const validRoles = [\"OWNER\", \"ADMIN\", \"MEMBER\", \"VIEWER\"] as const;\n    if (role && validRoles.includes(role as (typeof validRoles)[number])) {\n      return role as (typeof validRoles)[number];\n    }\n    return undefined;\n  }\n\n  private mapPlan(plan?: string): \"FREE\" | \"PRO\" | \"ENTERPRISE\" | undefined {\n    const validPlans = [\"FREE\", \"PRO\", \"ENTERPRISE\"] as const;\n    if (plan && validPlans.includes(plan as (typeof validPlans)[number])) {\n      return plan as (typeof validPlans)[number];\n    }\n    return undefined;\n  }\n}\n"],"mappings":";AAuBO,IAAM,yBAAN,MAA2E;AAAA,EACvE,WAAW;AAAA,EAEpB,eAAe,OAAoD;AACjE,QAAI,CAAC,MAAM,IAAK,QAAO;AAEvB,WAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ,MAAM;AAAA,MACd,gBAAgB,MAAM,yBAAyB;AAAA,MAC/C,MAAM,KAAK,QAAQ,MAAM,cAAc,CAAC;AAAA,MACxC,MAAM,KAAK,QAAQ,MAAM,cAAc,CAAC;AAAA,MACxC,OAAO,MAAM;AAAA,MACb,eAAe;AAAA,IACjB;AAAA,EACF;AAAA,EAEQ,QAAQ,MAAoE;AAClF,UAAM,aAAa,CAAC,SAAS,SAAS,UAAU,QAAQ;AACxD,QAAI,QAAQ,WAAW,SAAS,IAAmC,GAAG;AACpE,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,QAAQ,MAA0D;AACxE,UAAM,aAAa,CAAC,QAAQ,OAAO,YAAY;AAC/C,QAAI,QAAQ,WAAW,SAAS,IAAmC,GAAG;AACpE,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-MZKK4BRU.js → chunk-VMSPQ5ZK.js}

@@ -19,4 +19,4 @@ var IdentityAdapterRegistry = class {
 export {
   IdentityAdapterRegistry
 };
-//# sourceMappingURL=chunk-MZKK4BRU.js.map
+//# sourceMappingURL=chunk-VMSPQ5ZK.js.map

package/dist/chunk-VMSPQ5ZK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type { CanonicalIdentity } from \"@nebutra/contracts\";\n\nexport type IdentityProvider = \"nebutra\" | \"custom\";\n\nexport interface IdentityAdapter<TInput = unknown> {\n  provider: IdentityProvider | string;\n  mapToCanonical(input: TInput): CanonicalIdentity | null;\n}\n\nexport class IdentityAdapterRegistry {\n  private readonly adapters = new Map<string, IdentityAdapter>();\n\n  register(adapter: IdentityAdapter): void {\n    this.adapters.set(adapter.provider, adapter);\n  }\n\n  get(provider: string): IdentityAdapter | undefined {\n    return this.adapters.get(provider);\n  }\n\n  map<TInput = unknown>(provider: string, input: TInput): CanonicalIdentity | null {\n    const adapter = this.get(provider);\n    if (!adapter) {\n      return null;\n    }\n    return adapter.mapToCanonical(input);\n  }\n}\n"],"mappings":";AASO,IAAM,0BAAN,MAA8B;AAAA,EAClB,WAAW,oBAAI,IAA6B;AAAA,EAE7D,SAAS,SAAgC;AACvC,SAAK,SAAS,IAAI,QAAQ,UAAU,OAAO;AAAA,EAC7C;AAAA,EAEA,IAAI,UAA+C;AACjD,WAAO,KAAK,SAAS,IAAI,QAAQ;AAAA,EACnC;AAAA,EAEA,IAAsB,UAAkB,OAAyC;AAC/E,UAAM,UAAU,KAAK,IAAI,QAAQ;AACjC,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,eAAe,KAAK;AAAA,EACrC;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,34 +1,4 @@
-export { AuthJsIdentityAdapter } from './adapters/authjs.js';
-export { ClerkIdentityAdapter } from './adapters/clerk.js';
-import { CanonicalIdentity } from '@nebutra/contracts';
-import { IdentityAdapter } from './types.js';
-export { IdentityAdapterRegistry, IdentityProvider } from './types.js';
+export { NebutraIdentityAdapter } from './adapters/nebutra.js';
 export { createDefaultIdentityAdapterRegistry } from './registry.js';
-
-/**
- * Nebutra Identity Adapter
- *
- * Maps oidc-provider / Nebutra-issued OIDC tokens to CanonicalIdentity.
- * Used when Nebutra acts as both the IdP AND the resource server —
- * i.e., when a Nebutra service receives an access token issued by
- * the Nebutra IdP and needs to resolve the user identity.
- */
-
-interface NebutraOIDCClaims {
-    sub: string;
-    email?: string;
-    name?: string;
-    picture?: string;
-    "nebutra:organization_id"?: string;
-    "nebutra:role"?: string;
-    "nebutra:plan"?: string;
-    [key: string]: unknown;
-}
-declare class NebutraIdentityAdapter implements IdentityAdapter<NebutraOIDCClaims> {
-    readonly provider: "nebutra";
-    mapToCanonical(input: NebutraOIDCClaims): CanonicalIdentity | null;
-    private mapRole;
-    private mapPlan;
-}
-
-export { IdentityAdapter, NebutraIdentityAdapter };
+export { IdentityAdapter, IdentityAdapterRegistry, IdentityProvider } from './types.js';
+import '@nebutra/contracts';

package/dist/index.js

@@ -1,19 +1,13 @@
 import {
-  NebutraIdentityAdapter,
   createDefaultIdentityAdapterRegistry
-} from "./chunk-DOCMMNRB.js";
+} from "./chunk-CAQ25QHX.js";
 import {
   IdentityAdapterRegistry
-} from "./chunk-MZKK4BRU.js";
-import {
-  AuthJsIdentityAdapter
-} from "./chunk-ZERXN5CV.js";
+} from "./chunk-VMSPQ5ZK.js";
 import {
-  ClerkIdentityAdapter
-} from "./chunk-QKUYKQO6.js";
+  NebutraIdentityAdapter
+} from "./chunk-LMFYKNSW.js";
 export {
-  AuthJsIdentityAdapter,
-  ClerkIdentityAdapter,
   IdentityAdapterRegistry,
   NebutraIdentityAdapter,
   createDefaultIdentityAdapterRegistry

package/dist/registry.js

@@ -1,9 +1,8 @@
 import {
   createDefaultIdentityAdapterRegistry
-} from "./chunk-DOCMMNRB.js";
-import "./chunk-MZKK4BRU.js";
-import "./chunk-ZERXN5CV.js";
-import "./chunk-QKUYKQO6.js";
+} from "./chunk-CAQ25QHX.js";
+import "./chunk-VMSPQ5ZK.js";
+import "./chunk-LMFYKNSW.js";
 export {
   createDefaultIdentityAdapterRegistry
 };

package/dist/types.d.ts

@@ -1,6 +1,6 @@
 import { CanonicalIdentity } from '@nebutra/contracts';
 
-type IdentityProvider = "clerk" | "authjs" | "custom";
+type IdentityProvider = "nebutra" | "custom";
 interface IdentityAdapter<TInput = unknown> {
     provider: IdentityProvider | string;
     mapToCanonical(input: TInput): CanonicalIdentity | null;

package/dist/types.js

@@ -1,6 +1,6 @@
 import {
   IdentityAdapterRegistry
-} from "./chunk-MZKK4BRU.js";
+} from "./chunk-VMSPQ5ZK.js";
 export {
   IdentityAdapterRegistry
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nebutra/identity",
-  "version": "2.0.0",
-  "description": "Provider-agnostic identity adapter layer (Clerk-first, Auth.js-ready)",
+  "version": "3.0.0",
+  "description": "Provider-agnostic identity adapter layer (Nebutra-issued OIDC claims by default)",
   "private": false,
   "nebutra": {
     "status": "foundation",
@@ -16,19 +16,11 @@
     ".": {
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
-    },
-    "./adapters/clerk": {
-      "import": "./dist/adapters/clerk.js",
-      "types": "./dist/adapters/clerk.d.ts"
-    },
-    "./adapters/authjs": {
-      "import": "./dist/adapters/authjs.js",
-      "types": "./dist/adapters/authjs.d.ts"
     }
   },
   "dependencies": {
     "zod": "^4.3.6",
-    "@nebutra/contracts": "2.0.0"
+    "@nebutra/contracts": "3.0.0"
   },
   "devDependencies": {
     "@types/node": "^22.19.15",

package/src/index.ts

@@ -1,5 +1,3 @@
-export { AuthJsIdentityAdapter } from "./adapters/authjs";
-export { ClerkIdentityAdapter } from "./adapters/clerk";
 export { NebutraIdentityAdapter } from "./adapters/nebutra";
 export { createDefaultIdentityAdapterRegistry } from "./registry";
 export type { IdentityAdapter, IdentityProvider } from "./types";

package/src/registry.ts

@@ -1,12 +1,8 @@
-import { AuthJsIdentityAdapter } from "./adapters/authjs";
-import { ClerkIdentityAdapter } from "./adapters/clerk";
 import { NebutraIdentityAdapter } from "./adapters/nebutra";
 import { IdentityAdapterRegistry } from "./types";
 
 export function createDefaultIdentityAdapterRegistry(): IdentityAdapterRegistry {
   const registry = new IdentityAdapterRegistry();
-  registry.register(new ClerkIdentityAdapter());
-  registry.register(new AuthJsIdentityAdapter());
   registry.register(new NebutraIdentityAdapter());
   return registry;
 }

package/src/types.ts

@@ -1,6 +1,6 @@
 import type { CanonicalIdentity } from "@nebutra/contracts";
 
-export type IdentityProvider = "clerk" | "authjs" | "custom";
+export type IdentityProvider = "nebutra" | "custom";
 
 export interface IdentityAdapter<TInput = unknown> {
   provider: IdentityProvider | string;

package/tsup.config.ts

@@ -1,13 +1,7 @@
 import { defineConfig } from "tsup";
 
 export default defineConfig({
-  entry: [
-    "src/index.ts",
-    "src/types.ts",
-    "src/registry.ts",
-    "src/adapters/clerk.ts",
-    "src/adapters/authjs.ts",
-  ],
+  entry: ["src/index.ts", "src/types.ts", "src/registry.ts", "src/adapters/nebutra.ts"],
   format: ["esm"],
   dts: true,
   sourcemap: true,

package/dist/adapters/authjs.d.ts

@@ -1,9 +0,0 @@
-import { CanonicalIdentity } from '@nebutra/contracts';
-import { IdentityAdapter } from '../types.js';
-
-declare class AuthJsIdentityAdapter implements IdentityAdapter<unknown> {
-    provider: "authjs";
-    mapToCanonical(input: unknown): CanonicalIdentity | null;
-}
-
-export { AuthJsIdentityAdapter };

package/dist/adapters/authjs.js

@@ -1,7 +0,0 @@
-import {
-  AuthJsIdentityAdapter
-} from "../chunk-ZERXN5CV.js";
-export {
-  AuthJsIdentityAdapter
-};
-//# sourceMappingURL=authjs.js.map

package/dist/adapters/clerk.d.ts

@@ -1,9 +0,0 @@
-import { CanonicalIdentity } from '@nebutra/contracts';
-import { IdentityAdapter } from '../types.js';
-
-declare class ClerkIdentityAdapter implements IdentityAdapter<unknown> {
-    provider: "clerk";
-    mapToCanonical(input: unknown): CanonicalIdentity | null;
-}
-
-export { ClerkIdentityAdapter };

package/dist/adapters/clerk.js

@@ -1,7 +0,0 @@
-import {
-  ClerkIdentityAdapter
-} from "../chunk-QKUYKQO6.js";
-export {
-  ClerkIdentityAdapter
-};
-//# sourceMappingURL=clerk.js.map

package/dist/adapters/clerk.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-DOCMMNRB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/adapters/nebutra.ts","../src/registry.ts"],"sourcesContent":["/**\n * Nebutra Identity Adapter\n *\n * Maps oidc-provider / Nebutra-issued OIDC tokens to CanonicalIdentity.\n * Used when Nebutra acts as both the IdP AND the resource server —\n * i.e., when a Nebutra service receives an access token issued by\n * the Nebutra IdP and needs to resolve the user identity.\n */\n\nimport type { CanonicalIdentity } from \"@nebutra/contracts\";\nimport type { IdentityAdapter } from \"../types\";\n\ninterface NebutraOIDCClaims {\n  sub: string;\n  email?: string;\n  name?: string;\n  picture?: string;\n  \"nebutra:organization_id\"?: string;\n  \"nebutra:role\"?: string;\n  \"nebutra:plan\"?: string;\n  [key: string]: unknown;\n}\n\nexport class NebutraIdentityAdapter implements IdentityAdapter<NebutraOIDCClaims> {\n  readonly provider = \"nebutra\" as const;\n\n  mapToCanonical(input: NebutraOIDCClaims): CanonicalIdentity | null {\n    if (!input.sub) return null;\n\n    return {\n      provider: \"nebutra\",\n      userId: input.sub,\n      organizationId: input[\"nebutra:organization_id\"],\n      role: this.mapRole(input[\"nebutra:role\"]),\n      plan: this.mapPlan(input[\"nebutra:plan\"]),\n      email: input.email,\n      claimsVersion: \"v1\",\n    };\n  }\n\n  private mapRole(role?: string): \"OWNER\" | \"ADMIN\" | \"MEMBER\" | \"VIEWER\" | undefined {\n    const validRoles = [\"OWNER\", \"ADMIN\", \"MEMBER\", \"VIEWER\"] as const;\n    if (role && validRoles.includes(role as (typeof validRoles)[number])) {\n      return role as (typeof validRoles)[number];\n    }\n    return undefined;\n  }\n\n  private mapPlan(plan?: string): \"FREE\" | \"PRO\" | \"ENTERPRISE\" | undefined {\n    const validPlans = [\"FREE\", \"PRO\", \"ENTERPRISE\"] as const;\n    if (plan && validPlans.includes(plan as (typeof validPlans)[number])) {\n      return plan as (typeof validPlans)[number];\n    }\n    return undefined;\n  }\n}\n","import { AuthJsIdentityAdapter } from \"./adapters/authjs\";\nimport { ClerkIdentityAdapter } from \"./adapters/clerk\";\nimport { NebutraIdentityAdapter } from \"./adapters/nebutra\";\nimport { IdentityAdapterRegistry } from \"./types\";\n\nexport function createDefaultIdentityAdapterRegistry(): IdentityAdapterRegistry {\n  const registry = new IdentityAdapterRegistry();\n  registry.register(new ClerkIdentityAdapter());\n  registry.register(new AuthJsIdentityAdapter());\n  registry.register(new NebutraIdentityAdapter());\n  return registry;\n}\n"],"mappings":";;;;;;;;;;;AAuBO,IAAM,yBAAN,MAA2E;AAAA,EACvE,WAAW;AAAA,EAEpB,eAAe,OAAoD;AACjE,QAAI,CAAC,MAAM,IAAK,QAAO;AAEvB,WAAO;AAAA,MACL,UAAU;AAAA,MACV,QAAQ,MAAM;AAAA,MACd,gBAAgB,MAAM,yBAAyB;AAAA,MAC/C,MAAM,KAAK,QAAQ,MAAM,cAAc,CAAC;AAAA,MACxC,MAAM,KAAK,QAAQ,MAAM,cAAc,CAAC;AAAA,MACxC,OAAO,MAAM;AAAA,MACb,eAAe;AAAA,IACjB;AAAA,EACF;AAAA,EAEQ,QAAQ,MAAoE;AAClF,UAAM,aAAa,CAAC,SAAS,SAAS,UAAU,QAAQ;AACxD,QAAI,QAAQ,WAAW,SAAS,IAAmC,GAAG;AACpE,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,QAAQ,MAA0D;AACxE,UAAM,aAAa,CAAC,QAAQ,OAAO,YAAY;AAC/C,QAAI,QAAQ,WAAW,SAAS,IAAmC,GAAG;AACpE,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;;;AClDO,SAAS,uCAAgE;AAC9E,QAAM,WAAW,IAAI,wBAAwB;AAC7C,WAAS,SAAS,IAAI,qBAAqB,CAAC;AAC5C,WAAS,SAAS,IAAI,sBAAsB,CAAC;AAC7C,WAAS,SAAS,IAAI,uBAAuB,CAAC;AAC9C,SAAO;AACT;","names":[]}

package/dist/chunk-MZKK4BRU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type { CanonicalIdentity } from \"@nebutra/contracts\";\n\nexport type IdentityProvider = \"clerk\" | \"authjs\" | \"custom\";\n\nexport interface IdentityAdapter<TInput = unknown> {\n  provider: IdentityProvider | string;\n  mapToCanonical(input: TInput): CanonicalIdentity | null;\n}\n\nexport class IdentityAdapterRegistry {\n  private readonly adapters = new Map<string, IdentityAdapter>();\n\n  register(adapter: IdentityAdapter): void {\n    this.adapters.set(adapter.provider, adapter);\n  }\n\n  get(provider: string): IdentityAdapter | undefined {\n    return this.adapters.get(provider);\n  }\n\n  map<TInput = unknown>(provider: string, input: TInput): CanonicalIdentity | null {\n    const adapter = this.get(provider);\n    if (!adapter) {\n      return null;\n    }\n    return adapter.mapToCanonical(input);\n  }\n}\n"],"mappings":";AASO,IAAM,0BAAN,MAA8B;AAAA,EAClB,WAAW,oBAAI,IAA6B;AAAA,EAE7D,SAAS,SAAgC;AACvC,SAAK,SAAS,IAAI,QAAQ,UAAU,OAAO;AAAA,EAC7C;AAAA,EAEA,IAAI,UAA+C;AACjD,WAAO,KAAK,SAAS,IAAI,QAAQ;AAAA,EACnC;AAAA,EAEA,IAAsB,UAAkB,OAAyC;AAC/E,UAAM,UAAU,KAAK,IAAI,QAAQ;AACjC,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,eAAe,KAAK;AAAA,EACrC;AACF;","names":[]}

package/dist/chunk-QKUYKQO6.js

@@ -1,35 +0,0 @@
-// src/adapters/clerk.ts
-import { CanonicalIdentitySchema } from "@nebutra/contracts";
-import { z } from "zod";
-var ClerkPayloadSchema = z.object({
-  sub: z.string().min(1),
-  org_id: z.string().min(1).optional(),
-  org_role: z.enum(["OWNER", "ADMIN", "MEMBER", "VIEWER"]).optional(),
-  sid: z.string().min(1).optional(),
-  email: z.string().email().optional()
-});
-var ClerkIdentityAdapter = class {
-  provider = "clerk";
-  mapToCanonical(input) {
-    const parsed = ClerkPayloadSchema.safeParse(input);
-    if (!parsed.success) {
-      return null;
-    }
-    const candidate = {
-      provider: "clerk",
-      userId: parsed.data.sub,
-      organizationId: parsed.data.org_id,
-      role: parsed.data.org_role,
-      email: parsed.data.email,
-      sessionId: parsed.data.sid,
-      claimsVersion: "v1"
-    };
-    const canonical = CanonicalIdentitySchema.safeParse(candidate);
-    return canonical.success ? canonical.data : null;
-  }
-};
-
-export {
-  ClerkIdentityAdapter
-};
-//# sourceMappingURL=chunk-QKUYKQO6.js.map

package/dist/chunk-QKUYKQO6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/adapters/clerk.ts"],"sourcesContent":["import { type CanonicalIdentity, CanonicalIdentitySchema } from \"@nebutra/contracts\";\nimport { z } from \"zod\";\n\nimport type { IdentityAdapter } from \"../types\";\n\nconst ClerkPayloadSchema = z.object({\n  sub: z.string().min(1),\n  org_id: z.string().min(1).optional(),\n  org_role: z.enum([\"OWNER\", \"ADMIN\", \"MEMBER\", \"VIEWER\"]).optional(),\n  sid: z.string().min(1).optional(),\n  email: z.string().email().optional(),\n});\n\nexport class ClerkIdentityAdapter implements IdentityAdapter<unknown> {\n  provider = \"clerk\" as const;\n\n  mapToCanonical(input: unknown): CanonicalIdentity | null {\n    const parsed = ClerkPayloadSchema.safeParse(input);\n    if (!parsed.success) {\n      return null;\n    }\n\n    const candidate = {\n      provider: \"clerk\" as const,\n      userId: parsed.data.sub,\n      organizationId: parsed.data.org_id,\n      role: parsed.data.org_role,\n      email: parsed.data.email,\n      sessionId: parsed.data.sid,\n      claimsVersion: \"v1\" as const,\n    };\n\n    const canonical = CanonicalIdentitySchema.safeParse(candidate);\n    return canonical.success ? canonical.data : null;\n  }\n}\n"],"mappings":";AAAA,SAAiC,+BAA+B;AAChE,SAAS,SAAS;AAIlB,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,UAAU,QAAQ,CAAC,EAAE,SAAS;AAAA,EAClE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AACrC,CAAC;AAEM,IAAM,uBAAN,MAA+D;AAAA,EACpE,WAAW;AAAA,EAEX,eAAe,OAA0C;AACvD,UAAM,SAAS,mBAAmB,UAAU,KAAK;AACjD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO;AAAA,IACT;AAEA,UAAM,YAAY;AAAA,MAChB,UAAU;AAAA,MACV,QAAQ,OAAO,KAAK;AAAA,MACpB,gBAAgB,OAAO,KAAK;AAAA,MAC5B,MAAM,OAAO,KAAK;AAAA,MAClB,OAAO,OAAO,KAAK;AAAA,MACnB,WAAW,OAAO,KAAK;AAAA,MACvB,eAAe;AAAA,IACjB;AAEA,UAAM,YAAY,wBAAwB,UAAU,SAAS;AAC7D,WAAO,UAAU,UAAU,UAAU,OAAO;AAAA,EAC9C;AACF;","names":[]}

package/dist/chunk-ZERXN5CV.js

@@ -1,46 +0,0 @@
-// src/adapters/authjs.ts
-import { CanonicalIdentitySchema } from "@nebutra/contracts";
-import { z } from "zod";
-var AuthJsSessionSchema = z.object({
-  user: z.object({
-    id: z.string().min(1).optional(),
-    email: z.string().email().optional()
-  }).optional(),
-  token: z.object({
-    sub: z.string().min(1).optional(),
-    orgId: z.string().min(1).optional(),
-    orgRole: z.enum(["OWNER", "ADMIN", "MEMBER", "VIEWER"]).optional(),
-    sid: z.string().min(1).optional(),
-    plan: z.enum(["FREE", "PRO", "ENTERPRISE"]).optional()
-  }).optional()
-});
-var AuthJsIdentityAdapter = class {
-  provider = "authjs";
-  mapToCanonical(input) {
-    const parsed = AuthJsSessionSchema.safeParse(input);
-    if (!parsed.success) {
-      return null;
-    }
-    const userId = parsed.data.user?.id ?? parsed.data.token?.sub;
-    if (!userId) {
-      return null;
-    }
-    const candidate = {
-      provider: "authjs",
-      userId,
-      organizationId: parsed.data.token?.orgId,
-      role: parsed.data.token?.orgRole,
-      plan: parsed.data.token?.plan,
-      email: parsed.data.user?.email,
-      sessionId: parsed.data.token?.sid,
-      claimsVersion: "v1"
-    };
-    const canonical = CanonicalIdentitySchema.safeParse(candidate);
-    return canonical.success ? canonical.data : null;
-  }
-};
-
-export {
-  AuthJsIdentityAdapter
-};
-//# sourceMappingURL=chunk-ZERXN5CV.js.map

package/dist/chunk-ZERXN5CV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/adapters/authjs.ts"],"sourcesContent":["import { type CanonicalIdentity, CanonicalIdentitySchema } from \"@nebutra/contracts\";\nimport { z } from \"zod\";\n\nimport type { IdentityAdapter } from \"../types\";\n\nconst AuthJsSessionSchema = z.object({\n  user: z\n    .object({\n      id: z.string().min(1).optional(),\n      email: z.string().email().optional(),\n    })\n    .optional(),\n  token: z\n    .object({\n      sub: z.string().min(1).optional(),\n      orgId: z.string().min(1).optional(),\n      orgRole: z.enum([\"OWNER\", \"ADMIN\", \"MEMBER\", \"VIEWER\"]).optional(),\n      sid: z.string().min(1).optional(),\n      plan: z.enum([\"FREE\", \"PRO\", \"ENTERPRISE\"]).optional(),\n    })\n    .optional(),\n});\n\nexport class AuthJsIdentityAdapter implements IdentityAdapter<unknown> {\n  provider = \"authjs\" as const;\n\n  mapToCanonical(input: unknown): CanonicalIdentity | null {\n    const parsed = AuthJsSessionSchema.safeParse(input);\n    if (!parsed.success) {\n      return null;\n    }\n\n    const userId = parsed.data.user?.id ?? parsed.data.token?.sub;\n    if (!userId) {\n      return null;\n    }\n\n    const candidate = {\n      provider: \"authjs\" as const,\n      userId,\n      organizationId: parsed.data.token?.orgId,\n      role: parsed.data.token?.orgRole,\n      plan: parsed.data.token?.plan,\n      email: parsed.data.user?.email,\n      sessionId: parsed.data.token?.sid,\n      claimsVersion: \"v1\" as const,\n    };\n\n    const canonical = CanonicalIdentitySchema.safeParse(candidate);\n    return canonical.success ? canonical.data : null;\n  }\n}\n"],"mappings":";AAAA,SAAiC,+BAA+B;AAChE,SAAS,SAAS;AAIlB,IAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,MAAM,EACH,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACrC,CAAC,EACA,SAAS;AAAA,EACZ,OAAO,EACJ,OAAO;AAAA,IACN,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAChC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,KAAK,CAAC,SAAS,SAAS,UAAU,QAAQ,CAAC,EAAE,SAAS;AAAA,IACjE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAChC,MAAM,EAAE,KAAK,CAAC,QAAQ,OAAO,YAAY,CAAC,EAAE,SAAS;AAAA,EACvD,CAAC,EACA,SAAS;AACd,CAAC;AAEM,IAAM,wBAAN,MAAgE;AAAA,EACrE,WAAW;AAAA,EAEX,eAAe,OAA0C;AACvD,UAAM,SAAS,oBAAoB,UAAU,KAAK;AAClD,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,OAAO,KAAK,MAAM,MAAM,OAAO,KAAK,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,IACT;AAEA,UAAM,YAAY;AAAA,MAChB,UAAU;AAAA,MACV;AAAA,MACA,gBAAgB,OAAO,KAAK,OAAO;AAAA,MACnC,MAAM,OAAO,KAAK,OAAO;AAAA,MACzB,MAAM,OAAO,KAAK,OAAO;AAAA,MACzB,OAAO,OAAO,KAAK,MAAM;AAAA,MACzB,WAAW,OAAO,KAAK,OAAO;AAAA,MAC9B,eAAe;AAAA,IACjB;AAEA,UAAM,YAAY,wBAAwB,UAAU,SAAS;AAC7D,WAAO,UAAU,UAAU,UAAU,OAAO;AAAA,EAC9C;AACF;","names":[]}

package/src/adapters/authjs.ts

@@ -1,52 +0,0 @@
-import { type CanonicalIdentity, CanonicalIdentitySchema } from "@nebutra/contracts";
-import { z } from "zod";
-
-import type { IdentityAdapter } from "../types";
-
-const AuthJsSessionSchema = z.object({
-  user: z
-    .object({
-      id: z.string().min(1).optional(),
-      email: z.string().email().optional(),
-    })
-    .optional(),
-  token: z
-    .object({
-      sub: z.string().min(1).optional(),
-      orgId: z.string().min(1).optional(),
-      orgRole: z.enum(["OWNER", "ADMIN", "MEMBER", "VIEWER"]).optional(),
-      sid: z.string().min(1).optional(),
-      plan: z.enum(["FREE", "PRO", "ENTERPRISE"]).optional(),
-    })
-    .optional(),
-});
-
-export class AuthJsIdentityAdapter implements IdentityAdapter<unknown> {
-  provider = "authjs" as const;
-
-  mapToCanonical(input: unknown): CanonicalIdentity | null {
-    const parsed = AuthJsSessionSchema.safeParse(input);
-    if (!parsed.success) {
-      return null;
-    }
-
-    const userId = parsed.data.user?.id ?? parsed.data.token?.sub;
-    if (!userId) {
-      return null;
-    }
-
-    const candidate = {
-      provider: "authjs" as const,
-      userId,
-      organizationId: parsed.data.token?.orgId,
-      role: parsed.data.token?.orgRole,
-      plan: parsed.data.token?.plan,
-      email: parsed.data.user?.email,
-      sessionId: parsed.data.token?.sid,
-      claimsVersion: "v1" as const,
-    };
-
-    const canonical = CanonicalIdentitySchema.safeParse(candidate);
-    return canonical.success ? canonical.data : null;
-  }
-}

package/src/adapters/clerk.ts

@@ -1,36 +0,0 @@
-import { type CanonicalIdentity, CanonicalIdentitySchema } from "@nebutra/contracts";
-import { z } from "zod";
-
-import type { IdentityAdapter } from "../types";
-
-const ClerkPayloadSchema = z.object({
-  sub: z.string().min(1),
-  org_id: z.string().min(1).optional(),
-  org_role: z.enum(["OWNER", "ADMIN", "MEMBER", "VIEWER"]).optional(),
-  sid: z.string().min(1).optional(),
-  email: z.string().email().optional(),
-});
-
-export class ClerkIdentityAdapter implements IdentityAdapter<unknown> {
-  provider = "clerk" as const;
-
-  mapToCanonical(input: unknown): CanonicalIdentity | null {
-    const parsed = ClerkPayloadSchema.safeParse(input);
-    if (!parsed.success) {
-      return null;
-    }
-
-    const candidate = {
-      provider: "clerk" as const,
-      userId: parsed.data.sub,
-      organizationId: parsed.data.org_id,
-      role: parsed.data.org_role,
-      email: parsed.data.email,
-      sessionId: parsed.data.sid,
-      claimsVersion: "v1" as const,
-    };
-
-    const canonical = CanonicalIdentitySchema.safeParse(candidate);
-    return canonical.success ? canonical.data : null;
-  }
-}