@nerdsystem/sdk 0.0.7 → 0.0.9

package/README.md

@@ -14,3 +14,30 @@ export default app;
 `createNerdApp()` mounts session routes at `/api/auth` (signup, login, logout, me, forgot, reset), sets security headers on every response, and populates `c.var.user` from the httpOnly session cookie. Tokens are verified offline against the platform's JWKS.
 
 Start from the template with `npx nerdsystem init my-app`. Documentation lives in the template's `AGENTS.md` and `.claude/skills/nerdsystem/SKILL.md`.
+
+## Adding the SDK to an existing Vite + Hono app
+
+`nerd init` is the only scaffold and it refuses a folder that is not empty. A Vite client with a Hono server can be brought into the same shape by hand; `nerd check` refuses anything else; steps 1, 2, 4, 6, and 7 are its checks, and steps 3 and 5 are what the deploy relies on.
+
+1. `npm install @nerdsystem/sdk`. The check reads `package.json` and requires it under `dependencies`.
+2. The Worker entry is `src/server/index.ts`. In that file, replace the root `new Hono()` with `createNerdApp()` from `@nerdsystem/sdk` and end with `export default app`. Sub-routers in other files can stay `new Hono<NerdHonoEnv>()`.
+3. Mount every router under `/api/...`. Any other path is served from the static client and does not reach the Worker.
+4. `wrangler.jsonc` carries only three bindings, `DB`, `STORAGE`, and `ASSETS`, with `run_worker_first` set for `/api/*`. No other binding and no Durable Objects. The platform provisions `DB` and `STORAGE` at deploy time, so the local ids are placeholders:
+
+   ```jsonc
+   {
+     "name": "my-app",
+     "main": "src/server/index.ts",
+     "compatibility_date": "2026-11-02",
+     "compatibility_flags": ["nodejs_compat"],
+     "assets": { "binding": "ASSETS", "not_found_handling": "single-page-application", "run_worker_first": ["/api/*"] },
+     "d1_databases": [{ "binding": "DB", "database_name": "my-app", "database_id": "local", "migrations_dir": "migrations" }],
+     "r2_buckets": [{ "binding": "STORAGE", "bucket_name": "my-app" }]
+   }
+   ```
+
+5. Build with Vite and `@cloudflare/vite-plugin` (`plugins: [react(), cloudflare()]` in `vite.config.ts`). `nerd deploy` reads `dist/<worker>/wrangler.json`, which that plugin writes.
+6. No `package.json` script may run `wrangler deploy`, `wrangler secret`, or `wrangler d1 migrations apply` against Cloudflare; `nerd` does those.
+7. `nerd check` runs `tsc -b`, so keep a `tsconfig.json` that builds both the server and the client. A missing `.github/dependabot.yml` is reported as a warning, not a refusal.
+
+Then `nerd link --slug <project>`, which writes `nerd.json` and creates the project if it does not exist yet, and `nerd check`. Sign-in moves to the SDK's `/api/auth` routes, so delete any login, signup, or password code of your own; the app's users sign up again on the new login.

package/dist/auth/client.d.ts

@@ -28,6 +28,9 @@ export declare class AuthServiceClient {
     /** The visitor's address, forwarded so the platform rate-limits per person rather than per app. */
     clientIp?: string | undefined);
     get jwksUrl(): string;
+    private signature?;
+    /** HMAC of the visitor address keyed by SHA-256(tenant secret), which is what the platform stores; an unsigned address is ignored there. */
+    private signVisitor;
     private call;
     signup(input: {
         email: string;

package/dist/auth/client.js

@@ -28,13 +28,26 @@ export class AuthServiceClient {
     get jwksUrl() {
         return `${this.env.NERD_AUTH_URL.replace(/\/$/, "")}/.well-known/jwks.json`;
     }
+    signature;
+    /** HMAC of the visitor address keyed by SHA-256(tenant secret), which is what the platform stores; an unsigned address is ignored there. */
+    signVisitor(ip) {
+        this.signature ??= (async () => {
+            const enc = new TextEncoder();
+            const digest = await crypto.subtle.digest("SHA-256", enc.encode(this.env.NERD_AUTH_SECRET));
+            const keyHex = Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+            const key = await crypto.subtle.importKey("raw", enc.encode(keyHex), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+            return Array.from(new Uint8Array(await crypto.subtle.sign("HMAC", key, enc.encode(ip))), (b) => b.toString(16).padStart(2, "0")).join("");
+        })();
+        return this.signature;
+    }
     async call(method, path, body, auth) {
+        const visitor = this.clientIp && this.env.NERD_AUTH_SECRET ? { "x-nerd-client-ip": this.clientIp, "x-nerd-client-sig": await this.signVisitor(this.clientIp) } : {};
         const res = await this.fetchImpl(`${this.base}${path}`, {
             method,
             headers: {
                 ...(body !== undefined ? { "content-type": "application/json" } : {}),
                 ...(auth ? { authorization: `Bearer ${auth}` } : {}),
-                ...(this.clientIp ? { "x-nerd-client-ip": this.clientIp } : {}),
+                ...visitor,
             },
             body: body !== undefined ? JSON.stringify(body) : null,
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nerdsystem/sdk",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "description": "Runtime for apps deployed on nerdsystem: auth, authorization, and platform bindings.",
   "type": "module",
   "main": "./dist/index.js",