@recursiv/sdk 0.5.8 → 0.6.0

package/README.md

@@ -81,6 +81,7 @@ for await (const chunk of r.agents.chatStream(agent.id, { message: 'Hello!' }))
 | Resource | Key methods |
 |----------|------------|
 | `r.auth` | `signUp`, `signIn`, `signOut`, `createApiKey` |
+| `@recursiv/sdk/next` | `createRecursivAuth` — cookie-session server auth for Next.js App Router (see below) |
 | `r.users` | `me`, `get` |
 | `r.organizations` | `create`, `members`, `addMember`, `invite` |
 | `r.profiles` | `me`, `get`, `search`, `follow`, `unfollow` |
@@ -240,6 +241,42 @@ function ChatRoom({ conversationId }) {
 }
 ```
 
+## Next.js server auth (`@recursiv/sdk/next`)
+
+Cookie-session helpers for the App Router (Next 14 and 15). Each user signs in once, gets a **project-scoped per-user API key** in an httpOnly cookie, and every request acts as that user — no platform key on the server.
+
+```typescript
+// src/lib/recursiv.ts (server-only module)
+import 'server-only';
+import { createRecursivAuth } from '@recursiv/sdk/next';
+
+export const auth = createRecursivAuth(); // RECURSIV_PROJECT_ID from env
+
+// src/actions/auth.ts ('use server')
+export async function signIn(input: { email: string; password: string }) {
+  const { user } = await auth.signIn(input); // mints key + sets session cookie
+  return user;
+}
+
+// any server component or route handler
+const sdk = await auth.getSdk(); // Recursiv acting as the signed-in user
+const { data: me } = await sdk.users.me();
+```
+
+Route handlers building their own response pass a cookie writer, and the cookie contract (name, lifetime, attributes) is fully configurable:
+
+```typescript
+const auth = createRecursivAuth({ cookie: { name: 'myapp_session', maxAge: 60 * 60 * 24 * 90 } });
+
+export async function POST(req: NextRequest) {
+  const res = NextResponse.json({ ok: true });
+  await auth.verifyOtp(await req.json(), { response: res.cookies });
+  return res;
+}
+```
+
+Server-side only — the `server-only` guard fails the build if it's ever imported into a client component. Keep it out of `middleware.ts` as well (edge bundle size); gate routes with a plain cookie-presence check on a shared constant.
+
 ## Error handling
 
 ```typescript
@@ -287,7 +324,7 @@ if (page1.meta.has_more) {
 | Environment | Status | Notes |
 |-------------|--------|-------|
 | Node.js >= 18 | Full support | ESM only. Uses native fetch. |
-| Next.js | Full support | Works in both server components and API routes |
+| Next.js | Full support | Server components, server actions, and route handlers. Use `@recursiv/sdk/next` for cookie-session auth (Next 14 and 15). |
 | React (Vite, CRA) | Full support | Bundle-friendly, zero dependencies |
 | React Native / Expo | Supported with caveats | `chatStream()` requires manual SSE handling. See [React Native guide](./docs/guide-react-native.md). |
 | Deno | Full support | ESM native, fetch native |

package/dist/next/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @recursiv/sdk/next — Next.js App Router server-auth helpers.
+ *
+ * Server-side only: `server-only` makes any import from a Client Component
+ * fail at build time. Requires Next 14+ (App Router).
+ */
+import 'server-only';
+export { createRecursivAuth, RecursivNextAuth } from './server-auth.js';
+export { DEFAULT_USER_KEY_SCOPES } from './scopes.js';
+export type { RecursivNextAuthConfig, SessionUser, AuthResult, WriteOptions, SessionCookieOptions, SessionCookieDescriptor, CookieWriter, RequestCookiesLike, } from './server-auth.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/next/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,YAAY,EACV,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,oBAAoB,EACpB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,GACnB,MAAM,kBAAkB,CAAC"}

package/dist/next/index.js

@@ -0,0 +1,10 @@
+/**
+ * @recursiv/sdk/next — Next.js App Router server-auth helpers.
+ *
+ * Server-side only: `server-only` makes any import from a Client Component
+ * fail at build time. Requires Next 14+ (App Router).
+ */
+import 'server-only';
+export { createRecursivAuth, RecursivNextAuth } from './server-auth.js';
+export { DEFAULT_USER_KEY_SCOPES } from './scopes.js';
+//# sourceMappingURL=index.js.map

package/dist/next/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/next/scopes.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Default scopes for per-user API keys minted at sign-up / sign-in.
+ *
+ * AUTH MODEL (post-Project-Membership rollout):
+ * Each user gets a project-scoped api-key (api_key.project_id is set, NOT
+ * api_key.organization_id). They become a `project_member` of the project,
+ * not an `organization_member` of the project's owning org. This keeps app
+ * customers separate from the team workspace — the org's `/settings/team`
+ * shows teammates only, not customers.
+ *
+ * See packages/server/src/db/CLAUDE.md in the Recursiv platform repo for
+ * the data model.
+ *
+ * SECURITY NOTE on `databases:*` and `storage:*`:
+ * These are project-level scopes. Granted on a per-user key, they let any
+ * signed-in user run raw SQL against the project DB or list any object in
+ * the project bucket directly via the API — bypassing any per-user guards
+ * your server code enforces (e.g. a `WHERE user_id` predicate).
+ *
+ * For a SHARED-DATA app (Twitter-style social) this is fine — members are
+ * expected to see each other's content. For a PRIVATE-DATA app (CRM, internal
+ * tool) you must tighten this before shipping. Two paths:
+ *   - Move DB and storage operations into server actions that hold a
+ *     project-scoped admin key (read it from a non-client env var) and pass
+ *     a narrower `scopes` list to `createRecursivAuth`.
+ *   - Or, if the app does need direct per-user DB access, enforce row-level
+ *     scoping via a request-level signed predicate the platform validates.
+ *
+ * Apps with their own scope needs should pass an explicit `scopes` array to
+ * `createRecursivAuth` instead of relying on this default — and note that
+ * existing users keep the scopes minted at their last sign-in until they
+ * re-authenticate.
+ */
+export declare const DEFAULT_USER_KEY_SCOPES: string[];
+//# sourceMappingURL=scopes.d.ts.map

package/dist/next/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/next/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,uBAAuB,UAanC,CAAC"}

package/dist/next/scopes.js

@@ -0,0 +1,48 @@
+/**
+ * Default scopes for per-user API keys minted at sign-up / sign-in.
+ *
+ * AUTH MODEL (post-Project-Membership rollout):
+ * Each user gets a project-scoped api-key (api_key.project_id is set, NOT
+ * api_key.organization_id). They become a `project_member` of the project,
+ * not an `organization_member` of the project's owning org. This keeps app
+ * customers separate from the team workspace — the org's `/settings/team`
+ * shows teammates only, not customers.
+ *
+ * See packages/server/src/db/CLAUDE.md in the Recursiv platform repo for
+ * the data model.
+ *
+ * SECURITY NOTE on `databases:*` and `storage:*`:
+ * These are project-level scopes. Granted on a per-user key, they let any
+ * signed-in user run raw SQL against the project DB or list any object in
+ * the project bucket directly via the API — bypassing any per-user guards
+ * your server code enforces (e.g. a `WHERE user_id` predicate).
+ *
+ * For a SHARED-DATA app (Twitter-style social) this is fine — members are
+ * expected to see each other's content. For a PRIVATE-DATA app (CRM, internal
+ * tool) you must tighten this before shipping. Two paths:
+ *   - Move DB and storage operations into server actions that hold a
+ *     project-scoped admin key (read it from a non-client env var) and pass
+ *     a narrower `scopes` list to `createRecursivAuth`.
+ *   - Or, if the app does need direct per-user DB access, enforce row-level
+ *     scoping via a request-level signed predicate the platform validates.
+ *
+ * Apps with their own scope needs should pass an explicit `scopes` array to
+ * `createRecursivAuth` instead of relying on this default — and note that
+ * existing users keep the scopes minted at their last sign-in until they
+ * re-authenticate.
+ */
+export const DEFAULT_USER_KEY_SCOPES = [
+    'users:read',
+    'posts:read', 'posts:write',
+    'communities:read', 'communities:write',
+    'chat:read', 'chat:write',
+    'agents:read', 'agents:write',
+    'tags:read', 'tags:write',
+    'commands:read', 'commands:write',
+    'organizations:read',
+    'memory:read', 'memory:write',
+    // ⚠️  Tighten when the app holds private per-user data — see note above.
+    'databases:read', 'databases:write',
+    'storage:read', 'storage:write',
+];
+//# sourceMappingURL=scopes.js.map

package/dist/next/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/next/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,YAAY;IACZ,YAAY,EAAE,aAAa;IAC3B,kBAAkB,EAAE,mBAAmB;IACvC,WAAW,EAAE,YAAY;IACzB,aAAa,EAAE,cAAc;IAC7B,WAAW,EAAE,YAAY;IACzB,eAAe,EAAE,gBAAgB;IACjC,oBAAoB;IACpB,aAAa,EAAE,cAAc;IAC7B,yEAAyE;IACzE,gBAAgB,EAAE,iBAAiB;IACnC,cAAc,EAAE,eAAe;CAChC,CAAC"}

package/dist/next/server-auth.d.ts

@@ -0,0 +1,187 @@
+import { Recursiv } from '../index.js';
+import type { AuthSession, SignUpInput, SignInInput, SendOtpInput, VerifyOtpInput } from '../resources/auth.js';
+export interface SessionUser {
+    id: string;
+    name: string;
+    email: string;
+    image: string | null;
+}
+export interface SessionCookieOptions {
+    /** Cookie name. Default: `'recursiv_session'`. */
+    name?: string;
+    /** Lifetime in seconds. Default: 30 days. */
+    maxAge?: number;
+    /** Default: `'/'`. */
+    path?: string;
+    /** Default: `'lax'`. */
+    sameSite?: 'lax' | 'strict' | 'none';
+    /** Default: `process.env.NODE_ENV === 'production'`. */
+    secure?: boolean;
+    domain?: string;
+    /** Default: `true`. Only disable if you fully understand the XSS exposure. */
+    httpOnly?: boolean;
+}
+export interface RecursivNextAuthConfig {
+    /**
+     * Project the per-user keys are scoped to. Default:
+     * `process.env.RECURSIV_PROJECT_ID`. The project must have
+     * `project_settings.allow_public_signup=true` (provision_app sets this
+     * automatically) so new users are auto-added as project_members.
+     * Mutually exclusive with `organizationId`.
+     */
+    projectId?: string;
+    /**
+     * Org-scoped keys instead (teammates managing the workspace, not app
+     * customers). Mutually exclusive with `projectId`.
+     */
+    organizationId?: string;
+    /** Default: `process.env.RECURSIV_API_BASE_URL` or the SDK default. */
+    baseUrl?: string;
+    /**
+     * Optional project API key used ONLY to brand auth emails (sign-in OTP,
+     * password reset) for your org — the per-user pattern needs no server key
+     * otherwise. Default: `process.env.RECURSIV_API_KEY` when set (the SDK
+     * constructor picks it up); keyless requests get platform branding.
+     */
+    apiKey?: string;
+    /** Scopes minted onto per-user keys. Default: `DEFAULT_USER_KEY_SCOPES`. */
+    scopes?: string[];
+    /** Name given to minted keys. Default: `` () => `app-session-${Date.now()}` ``. */
+    keyName?: () => string;
+    cookie?: SessionCookieOptions;
+    /** Passed through to every `Recursiv` instance. */
+    timeout?: number;
+    /**
+     * Passed through to every `Recursiv` instance. NOTE the SDK default (2)
+     * retries 429/5xx on ALL methods including POST — set 0 if duplicate
+     * side effects (OTP emails, checkout sessions) are worse than a retry.
+     */
+    maxRetries?: number;
+}
+/** A fully-resolved Set-Cookie payload, for callers that write cookies themselves. */
+export interface SessionCookieDescriptor {
+    name: string;
+    value: string;
+    options: {
+        httpOnly: boolean;
+        sameSite: 'lax' | 'strict' | 'none';
+        secure: boolean;
+        path: string;
+        maxAge: number;
+        domain?: string;
+    };
+}
+/** Structurally matches both `(await cookies())` and `NextResponse.cookies`. */
+export interface CookieWriter {
+    set(name: string, value: string, options?: Record<string, unknown>): unknown;
+}
+/** Structurally matches `NextRequest` (and anything else exposing request cookies). */
+export interface RequestCookiesLike {
+    cookies: {
+        get(name: string): {
+            value: string;
+        } | undefined;
+    };
+}
+export interface WriteOptions {
+    /**
+     * Write the session cookie onto this instead of `cookies()` — pass
+     * `response.cookies` from a route handler building a `NextResponse`.
+     */
+    response?: CookieWriter;
+    /** Set to `false` to skip cookie writing entirely (descriptor is still returned). */
+    setCookie?: boolean;
+}
+export interface AuthResult {
+    user: SessionUser;
+    /** The per-user API key. Also written to the session cookie unless opted out. */
+    apiKey: string;
+    /** Public key prefix, for display / account-linking records. */
+    keyPrefix: string | null;
+    session: AuthSession;
+    /** The exact cookie that was (or would be) written. */
+    cookie: SessionCookieDescriptor;
+}
+export declare class RecursivNextAuth {
+    readonly cookieName: string;
+    private readonly cookieOptions;
+    private readonly config;
+    constructor(config?: RecursivNextAuthConfig);
+    /** Keyless SDK for pre-auth calls. Picks up `RECURSIV_API_KEY` from env when set (email branding). */
+    anonSdk(): Recursiv;
+    /** SDK bound to an explicit per-user key. */
+    sdkFor(apiKey: string): Recursiv;
+    private sdkOptions;
+    /** The signed-in user's API key from the session cookie, or null. */
+    getSessionKey(): Promise<string | null>;
+    /** SDK acting as the signed-in user. Throws `AuthenticationError` when signed out. */
+    getSdk(): Promise<Recursiv>;
+    /** Like `getSdk()` but resolves null instead of throwing when signed out. */
+    trySdk(): Promise<Recursiv | null>;
+    /** The signed-in user's profile, or null when signed out / the key no longer validates. */
+    getUser(): Promise<SessionUser | null>;
+    /** Email+password sign-up → per-user key → session cookie. */
+    signUp(input: SignUpInput, opts?: WriteOptions): Promise<AuthResult>;
+    /** Email+password sign-in → per-user key → session cookie. */
+    signIn(input: SignInInput, opts?: WriteOptions): Promise<AuthResult>;
+    /**
+     * Send a sign-in OTP. Branding follows the API key on the request
+     * (`config.apiKey` / env `RECURSIV_API_KEY`); keyless → platform branding.
+     */
+    sendOtp(input: SendOtpInput): Promise<{
+        success: boolean;
+    }>;
+    /** Verify a sign-in OTP (auto-creates the user) → per-user key → session cookie. */
+    verifyOtp(input: VerifyOtpInput, opts?: WriteOptions): Promise<AuthResult>;
+    /**
+     * Clear the session cookie. NOTE: the per-user API key itself is NOT
+     * revoked (we hold no session token to revoke it with) — it simply ages
+     * out. Matches the template/app behavior this replaces.
+     */
+    signOut(opts?: {
+        response?: CookieWriter;
+    }): Promise<void>;
+    /** Session key from a request-shaped object (`NextRequest`), no `next/headers` needed. */
+    sessionKeyFromRequest(req: RequestCookiesLike): string | null;
+    /** SDK for the request's session, or null when it has none. */
+    sdkFromRequest(req: RequestCookiesLike): Recursiv | null;
+    /** The Set-Cookie payload for a given key, for callers that write cookies themselves. */
+    sessionCookie(apiKey: string): SessionCookieDescriptor;
+    /** An expired Set-Cookie payload that clears the session. */
+    clearSessionCookie(): SessionCookieDescriptor;
+    private requireScope;
+    private mintKeyAndSetCookie;
+    private writeCookie;
+}
+/**
+ * Create the app's auth singleton. Configure once (usually in a
+ * `server-only` lib module) and import everywhere server-side:
+ *
+ * ```ts
+ * // src/lib/recursiv.ts
+ * import 'server-only';
+ * import { createRecursivAuth } from '@recursiv/sdk/next';
+ * export const auth = createRecursivAuth(); // RECURSIV_PROJECT_ID from env
+ *
+ * // a server component
+ * const sdk = await auth.trySdk();
+ * const feed = sdk ? await sdk.posts.list() : null;
+ *
+ * // a server action
+ * 'use server';
+ * export async function signIn(input: { email: string; password: string }) {
+ *   const { user } = await auth.signIn(input);
+ *   return user;
+ * }
+ *
+ * // a route handler with a custom cookie contract
+ * const auth = createRecursivAuth({ cookie: { name: 'myapp_key', maxAge: 60 * 60 * 24 * 90 } });
+ * export async function POST(req: NextRequest) {
+ *   const res = NextResponse.json({ ok: true });
+ *   await auth.verifyOtp(await req.json(), { response: res.cookies });
+ *   return res;
+ * }
+ * ```
+ */
+export declare function createRecursivAuth(config?: RecursivNextAuthConfig): RecursivNextAuth;
+//# sourceMappingURL=server-auth.d.ts.map

package/dist/next/server-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-auth.d.ts","sourceRoot":"","sources":["../../src/next/server-auth.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,WAAW,EACX,YAAY,EACZ,cAAc,EACf,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,wDAAwD;IACxD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sFAAsF;AACtF,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE;QACP,QAAQ,EAAE,OAAO,CAAC;QAClB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QACpC,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;CAC9E;AAED,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAA;KAAE,CAAC;CAC/D;AAED,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,qFAAqF;IACrF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,WAAW,CAAC;IACrB,uDAAuD;IACvD,MAAM,EAAE,uBAAuB,CAAC;CACjC;AAKD,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;gBAEpC,MAAM,GAAE,sBAA2B;IAsB/C,sGAAsG;IACtG,OAAO,IAAI,QAAQ;IAQnB,6CAA6C;IAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ;IAIhC,OAAO,CAAC,UAAU;IAWlB,qEAAqE;IAC/D,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAK7C,sFAAsF;IAChF,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC;IAYjC,6EAA6E;IACvE,MAAM,IAAI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAKxC,2FAA2F;IACrF,OAAO,IAAI,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAmB5C,8DAA8D;IACxD,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;IAO1E,8DAA8D;IACxD,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;IAO1E;;;OAGG;IACG,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAIjE,oFAAoF;IAC9E,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;IAOhF;;;;OAIG;IACG,OAAO,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAMhE,0FAA0F;IAC1F,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI;IAI7D,+DAA+D;IAC/D,cAAc,CAAC,GAAG,EAAE,kBAAkB,GAAG,QAAQ,GAAG,IAAI;IAOxD,yFAAyF;IACzF,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB;IAItD,6DAA6D;IAC7D,kBAAkB,IAAI,uBAAuB;IAU7C,OAAO,CAAC,YAAY;YAWN,mBAAmB;YA2BnB,WAAW;CAgB1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,sBAA2B,GAAG,gBAAgB,CAExF"}

package/dist/next/server-auth.js

@@ -0,0 +1,249 @@
+/**
+ * Next.js App Router server-auth helpers for the per-user API key pattern.
+ *
+ * The model (same as the nextjs template, Kempt, Alua, Minds):
+ *  - sign-up / sign-in / OTP verify mints a PROJECT-SCOPED per-user API key
+ *    (the user becomes a `project_member`, never an `organization_member`),
+ *  - that key lives in an httpOnly cookie,
+ *  - every request rebuilds a `Recursiv` bound to the caller's own key.
+ *  There is deliberately no storage abstraction beyond the cookie and no
+ *  god/platform key required at runtime.
+ *
+ * Works on both Next 14 and Next 15 App Router: `cookies()` is sync in 14
+ * and a Promise in 15 — every access goes through `await cookies()`, which
+ * is a no-op await on 14. Public signatures use local structural types so
+ * the emitted .d.ts never references Next's own types.
+ *
+ * This module must only run on the server. The public entry (`./index.ts`)
+ * enforces that with `import 'server-only'`; the implementation lives here
+ * so unit tests can import it directly (the `server-only` package throws
+ * under Node's default export condition, i.e. in vitest).
+ */
+import { cookies } from 'next/headers';
+import { Recursiv } from '../index.js';
+import { AuthenticationError } from '../errors.js';
+import { DEFAULT_USER_KEY_SCOPES } from './scopes.js';
+const DEFAULT_COOKIE_NAME = 'recursiv_session';
+const DEFAULT_MAX_AGE = 60 * 60 * 24 * 30; // 30 days
+export class RecursivNextAuth {
+    cookieName;
+    cookieOptions;
+    config;
+    constructor(config = {}) {
+        if (config.projectId && config.organizationId) {
+            throw new Error('createRecursivAuth: pass projectId (app customers) OR organizationId (team keys), not both.');
+        }
+        this.config = config;
+        this.cookieName = config.cookie?.name ?? DEFAULT_COOKIE_NAME;
+        this.cookieOptions = {
+            httpOnly: config.cookie?.httpOnly ?? true,
+            sameSite: config.cookie?.sameSite ?? 'lax',
+            secure: config.cookie?.secure ??
+                (typeof process !== 'undefined' && process.env?.NODE_ENV === 'production'),
+            path: config.cookie?.path ?? '/',
+            maxAge: config.cookie?.maxAge ?? DEFAULT_MAX_AGE,
+            ...(config.cookie?.domain ? { domain: config.cookie.domain } : {}),
+        };
+    }
+    // ---------------------------------------------------------------- SDK factories
+    /** Keyless SDK for pre-auth calls. Picks up `RECURSIV_API_KEY` from env when set (email branding). */
+    anonSdk() {
+        return new Recursiv({
+            allowNoKey: true,
+            ...(this.config.apiKey ? { apiKey: this.config.apiKey } : {}),
+            ...this.sdkOptions(),
+        });
+    }
+    /** SDK bound to an explicit per-user key. */
+    sdkFor(apiKey) {
+        return new Recursiv({ apiKey, ...this.sdkOptions() });
+    }
+    sdkOptions() {
+        const { baseUrl, timeout, maxRetries } = this.config;
+        return {
+            ...(baseUrl ? { baseUrl } : {}),
+            ...(timeout !== undefined ? { timeout } : {}),
+            ...(maxRetries !== undefined ? { maxRetries } : {}),
+        };
+    }
+    // ------------------------------------------------- cookie-store-bound (next/headers)
+    /** The signed-in user's API key from the session cookie, or null. */
+    async getSessionKey() {
+        const store = await cookies();
+        return store.get(this.cookieName)?.value ?? null;
+    }
+    /** SDK acting as the signed-in user. Throws `AuthenticationError` when signed out. */
+    async getSdk() {
+        const key = await this.getSessionKey();
+        if (!key) {
+            throw new AuthenticationError({
+                type: 'auth_error',
+                message: `Not signed in: no '${this.cookieName}' session cookie. Redirect the user to your sign-in page, or use trySdk() for optional-auth paths.`,
+                code: 'session_required',
+            });
+        }
+        return this.sdkFor(key);
+    }
+    /** Like `getSdk()` but resolves null instead of throwing when signed out. */
+    async trySdk() {
+        const key = await this.getSessionKey();
+        return key ? this.sdkFor(key) : null;
+    }
+    /** The signed-in user's profile, or null when signed out / the key no longer validates. */
+    async getUser() {
+        try {
+            const sdk = await this.trySdk();
+            if (!sdk)
+                return null;
+            const { data } = await sdk.users.me();
+            if (!data)
+                return null;
+            return {
+                id: data.id,
+                name: data.name,
+                email: data.email ?? '',
+                image: data.image ?? null,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    // ------------------------------------------------------------------- auth flows
+    /** Email+password sign-up → per-user key → session cookie. */
+    async signUp(input, opts) {
+        const scope = this.requireScope();
+        const sdk = this.anonSdk();
+        const session = await sdk.auth.signUp(input, scope);
+        return this.mintKeyAndSetCookie(sdk, session, opts);
+    }
+    /** Email+password sign-in → per-user key → session cookie. */
+    async signIn(input, opts) {
+        this.requireScope();
+        const sdk = this.anonSdk();
+        const session = await sdk.auth.signIn(input);
+        return this.mintKeyAndSetCookie(sdk, session, opts);
+    }
+    /**
+     * Send a sign-in OTP. Branding follows the API key on the request
+     * (`config.apiKey` / env `RECURSIV_API_KEY`); keyless → platform branding.
+     */
+    async sendOtp(input) {
+        return this.anonSdk().auth.sendOtp(input);
+    }
+    /** Verify a sign-in OTP (auto-creates the user) → per-user key → session cookie. */
+    async verifyOtp(input, opts) {
+        const scope = this.requireScope();
+        const sdk = this.anonSdk();
+        const session = await sdk.auth.verifyOtp(input, scope);
+        return this.mintKeyAndSetCookie(sdk, session, opts);
+    }
+    /**
+     * Clear the session cookie. NOTE: the per-user API key itself is NOT
+     * revoked (we hold no session token to revoke it with) — it simply ages
+     * out. Matches the template/app behavior this replaces.
+     */
+    async signOut(opts) {
+        await this.writeCookie(this.clearSessionCookie(), opts);
+    }
+    // ------------------------------------------- request-bound (NextRequest / middleware)
+    /** Session key from a request-shaped object (`NextRequest`), no `next/headers` needed. */
+    sessionKeyFromRequest(req) {
+        return req.cookies.get(this.cookieName)?.value ?? null;
+    }
+    /** SDK for the request's session, or null when it has none. */
+    sdkFromRequest(req) {
+        const key = this.sessionKeyFromRequest(req);
+        return key ? this.sdkFor(key) : null;
+    }
+    // --------------------------------------------------------------- manual plumbing
+    /** The Set-Cookie payload for a given key, for callers that write cookies themselves. */
+    sessionCookie(apiKey) {
+        return { name: this.cookieName, value: apiKey, options: { ...this.cookieOptions } };
+    }
+    /** An expired Set-Cookie payload that clears the session. */
+    clearSessionCookie() {
+        return {
+            name: this.cookieName,
+            value: '',
+            options: { ...this.cookieOptions, maxAge: 0 },
+        };
+    }
+    // ------------------------------------------------------------------------ internals
+    requireScope() {
+        const projectId = this.config.projectId ??
+            (typeof process !== 'undefined' ? process.env?.RECURSIV_PROJECT_ID : undefined);
+        if (this.config.organizationId)
+            return { organizationId: this.config.organizationId };
+        if (projectId)
+            return { projectId };
+        throw new Error('createRecursivAuth: no key scope configured. Pass projectId (or set RECURSIV_PROJECT_ID) so per-user keys bind users as project_members — or organizationId for team-scoped keys.');
+    }
+    async mintKeyAndSetCookie(sdk, session, opts) {
+        const scope = this.requireScope();
+        // Two-step (not *AndCreateKey) so the key prefix survives — apps use it
+        // for account-linking records and display.
+        const key = await sdk.auth.createApiKey({
+            name: this.config.keyName?.() ?? `app-session-${Date.now()}`,
+            scopes: this.config.scopes ?? DEFAULT_USER_KEY_SCOPES,
+            ...scope,
+        }, session.token);
+        const cookie = this.sessionCookie(key.key);
+        await this.writeCookie(cookie, opts);
+        return {
+            user: session.user,
+            apiKey: key.key,
+            keyPrefix: key.prefix ?? null,
+            session,
+            cookie,
+        };
+    }
+    async writeCookie(descriptor, opts) {
+        if (opts?.setCookie === false)
+            return;
+        if (opts?.response) {
+            opts.response.set(descriptor.name, descriptor.value, descriptor.options);
+            return;
+        }
+        // Next 15 returns a Promise; Next 14 returns the store directly — await
+        // covers both. Writing requires a Server Action or Route Handler context
+        // (Next enforces this); pass `opts.response` from route handlers that
+        // build their own NextResponse.
+        const store = (await cookies());
+        store.set(descriptor.name, descriptor.value, descriptor.options);
+    }
+}
+/**
+ * Create the app's auth singleton. Configure once (usually in a
+ * `server-only` lib module) and import everywhere server-side:
+ *
+ * ```ts
+ * // src/lib/recursiv.ts
+ * import 'server-only';
+ * import { createRecursivAuth } from '@recursiv/sdk/next';
+ * export const auth = createRecursivAuth(); // RECURSIV_PROJECT_ID from env
+ *
+ * // a server component
+ * const sdk = await auth.trySdk();
+ * const feed = sdk ? await sdk.posts.list() : null;
+ *
+ * // a server action
+ * 'use server';
+ * export async function signIn(input: { email: string; password: string }) {
+ *   const { user } = await auth.signIn(input);
+ *   return user;
+ * }
+ *
+ * // a route handler with a custom cookie contract
+ * const auth = createRecursivAuth({ cookie: { name: 'myapp_key', maxAge: 60 * 60 * 24 * 90 } });
+ * export async function POST(req: NextRequest) {
+ *   const res = NextResponse.json({ ok: true });
+ *   await auth.verifyOtp(await req.json(), { response: res.cookies });
+ *   return res;
+ * }
+ * ```
+ */
+export function createRecursivAuth(config = {}) {
+    return new RecursivNextAuth(config);
+}
+//# sourceMappingURL=server-auth.js.map

package/dist/next/server-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-auth.js","sourceRoot":"","sources":["../../src/next/server-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAQnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AA4GtD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAC/C,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAErD,MAAM,OAAO,gBAAgB;IAClB,UAAU,CAAS;IACX,aAAa,CAAqC;IAClD,MAAM,CAAyB;IAEhD,YAAY,SAAiC,EAAE;QAC7C,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,mBAAmB,CAAC;QAC7D,IAAI,CAAC,aAAa,GAAG;YACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI;YACzC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,KAAK;YAC1C,MAAM,EACJ,MAAM,CAAC,MAAM,EAAE,MAAM;gBACrB,CAAC,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC;YAC5E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,GAAG;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,eAAe;YAChD,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,iFAAiF;IAEjF,sGAAsG;IACtG,OAAO;QACL,OAAO,IAAI,QAAQ,CAAC;YAClB,UAAU,EAAE,IAAI;YAChB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,IAAI,CAAC,UAAU,EAAE;SACrB,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,MAAM,CAAC,MAAc;QACnB,OAAO,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IAEO,UAAU;QAChB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACrD,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,sFAAsF;IAEtF,qEAAqE;IACrE,KAAK,CAAC,aAAa;QACjB,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,mBAAmB,CAAC;gBAC5B,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,sBAAsB,IAAI,CAAC,UAAU,oGAAoG;gBAClJ,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,OAAO;QACX,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAG,IAA2B,CAAC,KAAK,IAAI,EAAE;gBAC/C,KAAK,EAAG,IAAkC,CAAC,KAAK,IAAI,IAAI;aACzD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,iFAAiF;IAEjF,8DAA8D;IAC9D,KAAK,CAAC,MAAM,CAAC,KAAkB,EAAE,IAAmB;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,MAAM,CAAC,KAAkB,EAAE,IAAmB;QAClD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,KAAmB;QAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,SAAS,CAAC,KAAqB,EAAE,IAAmB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,IAAkC;QAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,uFAAuF;IAEvF,0FAA0F;IAC1F,qBAAqB,CAAC,GAAuB;QAC3C,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;IACzD,CAAC;IAED,+DAA+D;IAC/D,cAAc,CAAC,GAAuB;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,kFAAkF;IAElF,yFAAyF;IACzF,aAAa,CAAC,MAAc;QAC1B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,6DAA6D;IAC7D,kBAAkB;QAChB,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE;SAC9C,CAAC;IACJ,CAAC;IAED,qFAAqF;IAE7E,YAAY;QAClB,MAAM,SAAS,GACb,IAAI,CAAC,MAAM,CAAC,SAAS;YACrB,CAAC,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QACtF,IAAI,SAAS;YAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,mLAAmL,CACpL,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,GAAa,EACb,OAAoB,EACpB,IAAmB;QAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,wEAAwE;QACxE,2CAA2C;QAC3C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CACrC;YACE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,eAAe,IAAI,CAAC,GAAG,EAAE,EAAE;YAC5D,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,uBAAuB;YACrD,GAAG,KAAK;SACT,EACD,OAAO,CAAC,KAAK,CACd,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,GAAG,CAAC,GAAG;YACf,SAAS,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;YAC7B,OAAO;YACP,MAAM;SACP,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,UAAmC,EACnC,IAAmB;QAEnB,IAAI,IAAI,EAAE,SAAS,KAAK,KAAK;YAAE,OAAO;QACtC,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,EAAE,CAA4B,CAAC;QAC3D,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiC,EAAE;IACpE,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/resources/app-subscriptions.d.ts

@@ -3,6 +3,12 @@ export interface AppSubscriptionCheckoutResult {
     /** Stripe Checkout URL to redirect the user to. */
     url: string;
 }
+export interface AppSubscriptionStatusResult {
+    tier: string;
+    status: 'active' | 'past_due' | 'canceled' | 'none';
+    active: boolean;
+    currentPeriodEnd: string | null;
+}
 /**
  * Per-app-user consumer subscriptions (e.g. Plus/Pro) billed through the app's
  * own Stripe account + products. Drives the tier the video primitive gates on.
@@ -17,5 +23,9 @@ export declare class AppSubscriptionsResource {
     }): Promise<{
         data: AppSubscriptionCheckoutResult;
     }>;
+    /** Read the current user's app-subscription status for this project-scoped key. */
+    status(): Promise<{
+        data: AppSubscriptionStatusResult;
+    }>;
 }
 //# sourceMappingURL=app-subscriptions.d.ts.map

package/dist/resources/app-subscriptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-subscriptions.d.ts","sourceRoot":"","sources":["../../src/resources/app-subscriptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,WAAW,6BAA6B;IAC5C,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,qBAAa,wBAAwB;IACvB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEtC,iGAAiG;IACjG,QAAQ,CAAC,KAAK,EAAE;QACd,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,6BAA6B,CAAA;KAAE,CAAC;CAGrD"}
+{"version":3,"file":"app-subscriptions.d.ts","sourceRoot":"","sources":["../../src/resources/app-subscriptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,WAAW,6BAA6B;IAC5C,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;IACpD,MAAM,EAAE,OAAO,CAAC;IAChB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;GAGG;AACH,qBAAa,wBAAwB;IACvB,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEtC,iGAAiG;IACjG,QAAQ,CAAC,KAAK,EAAE;QACd,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,6BAA6B,CAAA;KAAE,CAAC;IAIpD,mFAAmF;IACnF,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,2BAA2B,CAAA;KAAE,CAAC;CAGzD"}

package/dist/resources/app-subscriptions.js

@@ -11,5 +11,9 @@ export class AppSubscriptionsResource {
     checkout(input) {
         return this.client.post('/app-subscriptions/checkout', input);
     }
+    /** Read the current user's app-subscription status for this project-scoped key. */
+    status() {
+        return this.client.get('/app-subscriptions/status');
+    }
 }
 //# sourceMappingURL=app-subscriptions.js.map

package/dist/resources/app-subscriptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-subscriptions.js","sourceRoot":"","sources":["../../src/resources/app-subscriptions.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,MAAM,OAAO,wBAAwB;IACf;IAApB,YAAoB,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAAG,CAAC;IAE1C,iGAAiG;IACjG,QAAQ,CAAC,KAGR;QACC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;CACF"}
+{"version":3,"file":"app-subscriptions.js","sourceRoot":"","sources":["../../src/resources/app-subscriptions.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,MAAM,OAAO,wBAAwB;IACf;IAApB,YAAoB,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAAG,CAAC;IAE1C,iGAAiG;IACjG,QAAQ,CAAC,KAGR;QACC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAED,mFAAmF;IACnF,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACtD,CAAC;CACF"}

package/dist/resources/organization-settings.d.ts

@@ -9,6 +9,8 @@ export interface OrganizationSettingsData {
     /** When true, POST /api-keys auto-adds new signups as org members. */
     allow_public_signup: boolean;
     preferred_contact_email: string | null;
+    /** Brand name used for project/org-scoped auth OTP emails. */
+    auth_email_brand_name: string | null;
     github_connected: boolean;
     github_owner: string | null;
     github_connected_at: string | null;
@@ -52,6 +54,15 @@ export interface PreferredContactEmailResult {
     preferred_contact_email: string | null;
     updated_at: string;
 }
+export interface SetAuthEmailBrandInput {
+    auth_email_brand_name: string | null;
+}
+export interface AuthEmailBrandResult {
+    id: string;
+    organization_id: string;
+    auth_email_brand_name: string | null;
+    updated_at: string;
+}
 export interface ValidateTemplateInput {
     url: string;
 }
@@ -90,6 +101,8 @@ export declare class OrganizationSettingsResource {
     setAllowPublicSignup(organizationId: string, input: SetAllowPublicSignupInput): Promise<SingleResponse<AllowPublicSignupResult>>;
     /** Set preferred contact email for agent outreach and operational alerts */
     setPreferredContactEmail(organizationId: string, input: SetPreferredContactEmailInput): Promise<SingleResponse<PreferredContactEmailResult>>;
+    /** Set the brand name used by project/org-scoped auth OTP emails */
+    setAuthEmailBrandName(organizationId: string, input: SetAuthEmailBrandInput): Promise<SingleResponse<AuthEmailBrandResult>>;
     /** Validate a template URL */
     validateTemplateUrl(organizationId: string, input: ValidateTemplateInput): Promise<SingleResponse<ValidateTemplateResult>>;
     /** Connect a GitHub account to the organization */

package/dist/resources/organization-settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization-settings.d.ts","sourceRoot":"","sources":["../../src/resources/organization-settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIlD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,EAAE,OAAO,CAAC;IAChC,sEAAsE;IACtE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,OAAO,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,IAAI,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEtC,gCAAgC;IAChC,GAAG,CACD,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAM3D,gDAAgD;IAChD,kBAAkB,CAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;IAOjD,qDAAqD;IACrD,sBAAsB,CACpB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IAO/C;;;;;;;;;OASG;IACH,oBAAoB,CAClB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;IAOnD,4EAA4E;IAC5E,wBAAwB,CACtB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,CAAC;IAOvD,8BAA8B;IAC9B,mBAAmB,CACjB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;IAOlD,mDAAmD;IACnD,aAAa,CACX,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IAO/C,0DAA0D;IAC1D,gBAAgB,CACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CAK9C"}
+{"version":3,"file":"organization-settings.d.ts","sourceRoot":"","sources":["../../src/resources/organization-settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAIlD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,EAAE,OAAO,CAAC;IAChC,sEAAsE;IACtE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,8DAA8D;IAC9D,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,sBAAsB,EAAE,OAAO,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B;IAC5C,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,IAAI,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,4BAA4B;IAC3B,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,UAAU;IAEtC,gCAAgC;IAChC,GAAG,CACD,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAM3D,gDAAgD;IAChD,kBAAkB,CAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;IAOjD,qDAAqD;IACrD,sBAAsB,CACpB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IAO/C;;;;;;;;;OASG;IACH,oBAAoB,CAClB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;IAOnD,4EAA4E;IAC5E,wBAAwB,CACtB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,cAAc,CAAC,2BAA2B,CAAC,CAAC;IAOvD,oEAAoE;IACpE,qBAAqB,CACnB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAOhD,8BAA8B;IAC9B,mBAAmB,CACjB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;IAOlD,mDAAmD;IACnD,aAAa,CACX,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IAO/C,0DAA0D;IAC1D,gBAAgB,CACd,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CAK9C"}

package/dist/resources/organization-settings.js

@@ -32,6 +32,10 @@ export class OrganizationSettingsResource {
     setPreferredContactEmail(organizationId, input) {
         return this.client.put(`/organization-settings/${organizationId}/settings/preferred-contact`, input);
     }
+    /** Set the brand name used by project/org-scoped auth OTP emails */
+    setAuthEmailBrandName(organizationId, input) {
+        return this.client.put(`/organization-settings/${organizationId}/settings/auth-email-brand`, input);
+    }
     /** Validate a template URL */
     validateTemplateUrl(organizationId, input) {
         return this.client.post(`/organization-settings/${organizationId}/settings/validate-template`, input);

package/dist/resources/organization-settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization-settings.js","sourceRoot":"","sources":["../../src/resources/organization-settings.ts"],"names":[],"mappings":"AAsFA,MAAM,OAAO,4BAA4B;IACnB;IAApB,YAAoB,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAAG,CAAC;IAE1C,gCAAgC;IAChC,GAAG,CACD,cAAsB;QAEtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,WAAW,CACpD,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,kBAAkB,CAChB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,4BAA4B,EACpE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,sBAAsB,CACpB,cAAsB,EACtB,KAA4B;QAE5B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,0BAA0B,EAClE,KAAK,CACN,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAClB,cAAsB,EACtB,KAAgC;QAEhC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,+BAA+B,EACvE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,wBAAwB,CACtB,cAAsB,EACtB,KAAoC;QAEpC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,6BAA6B,EACrE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,mBAAmB,CACjB,cAAsB,EACtB,KAA4B;QAE5B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,0BAA0B,cAAc,6BAA6B,EACrE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,aAAa,CACX,cAAsB,EACtB,KAAyB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,0BAA0B,cAAc,0BAA0B,EAClE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,gBAAgB,CACd,cAAsB;QAEtB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,0BAA0B,cAAc,6BAA6B,CACtE,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"organization-settings.js","sourceRoot":"","sources":["../../src/resources/organization-settings.ts"],"names":[],"mappings":"AAmGA,MAAM,OAAO,4BAA4B;IACnB;IAApB,YAAoB,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAAG,CAAC;IAE1C,gCAAgC;IAChC,GAAG,CACD,cAAsB;QAEtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,WAAW,CACpD,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,kBAAkB,CAChB,cAAsB,EACtB,KAA8B;QAE9B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,4BAA4B,EACpE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,sBAAsB,CACpB,cAAsB,EACtB,KAA4B;QAE5B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,0BAA0B,EAClE,KAAK,CACN,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAClB,cAAsB,EACtB,KAAgC;QAEhC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,+BAA+B,EACvE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,wBAAwB,CACtB,cAAsB,EACtB,KAAoC;QAEpC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,6BAA6B,EACrE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,qBAAqB,CACnB,cAAsB,EACtB,KAA6B;QAE7B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CACpB,0BAA0B,cAAc,4BAA4B,EACpE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,mBAAmB,CACjB,cAAsB,EACtB,KAA4B;QAE5B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,0BAA0B,cAAc,6BAA6B,EACrE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,aAAa,CACX,cAAsB,EACtB,KAAyB;QAEzB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,0BAA0B,cAAc,0BAA0B,EAClE,KAAK,CACN,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,gBAAgB,CACd,cAAsB;QAEtB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CACrB,0BAA0B,cAAc,6BAA6B,CACtE,CAAC;IACJ,CAAC;CACF"}

package/llm.md

@@ -326,6 +326,37 @@ Available scopes: `posts:read`, `posts:write`, `users:read`, `users:write`, `com
 
 **Scope enforcement:** Every API call checks scopes. A 403 `AuthorizationError` means your key is missing the required scope. Grant only the scopes your app needs (least privilege). The `admin` scope can only be created by platform administrators — attempting to self-grant it returns 403.
 
+### @recursiv/sdk/next — Next.js App Router server auth
+
+Server-only sub-path (Next 14+, both 14 and 15). Per-user-key pattern: auth flows mint a project-scoped key and store it in an httpOnly cookie; every request rebuilds an SDK bound to the caller's own key. No platform key needed at runtime.
+
+```typescript
+// src/lib/recursiv.ts
+import 'server-only';
+import { createRecursivAuth } from '@recursiv/sdk/next';
+export const auth = createRecursivAuth(); // RECURSIV_PROJECT_ID + RECURSIV_API_BASE_URL from env
+
+// server action ('use server')
+const { user } = await auth.signIn({ email, password }); // mints key + sets cookie
+await auth.signOut();
+
+// server component / route handler
+const sdk = await auth.getSdk();      // throws AuthenticationError when signed out
+const maybe = await auth.trySdk();    // null when signed out
+const me = await auth.getUser();      // SessionUser | null
+
+// route handler writing its own response (custom cookie contract)
+const auth = createRecursivAuth({ cookie: { name: 'myapp_key', maxAge: 60 * 60 * 24 * 90 } });
+const res = NextResponse.json({ ok: true });
+await auth.verifyOtp({ email, otp }, { response: res.cookies });
+
+// request-bound, e.g. a route handler that already holds a NextRequest
+const key = auth.sessionKeyFromRequest(req);
+const sdk2 = auth.sdkFromRequest(req); // Recursiv | null
+```
+
+Config: `projectId` (default env `RECURSIV_PROJECT_ID`) XOR `organizationId`; `scopes` (default `DEFAULT_USER_KEY_SCOPES` — pass your own for least privilege); `cookie: { name, maxAge, sameSite, secure, domain, httpOnly, path }`; `apiKey` (only for branded auth emails); `baseUrl`, `timeout`, `maxRetries` (set `maxRetries: 0` if duplicate OTP/checkout POSTs are worse than a retry). Auth results include `keyPrefix` for account-linking records. Never import this sub-path in client components (`server-only` enforces it). Keep it out of `middleware.ts` too (it drags the whole SDK into the edge bundle) — middleware should do a plain presence check on a shared cookie-name constant and redirect.
+
 ### r.users
 
 ```typescript

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@recursiv/sdk",
-  "version": "0.5.8",
+  "version": "0.6.0",
   "description": "TypeScript SDK for the Recursiv API",
   "license": "FSL-1.1-ALv2",
   "type": "module",
@@ -17,6 +17,11 @@
       "types": "./dist/react/index.d.ts",
       "import": "./dist/react/index.js",
       "default": "./dist/react/index.js"
+    },
+    "./next": {
+      "types": "./dist/next/index.d.ts",
+      "import": "./dist/next/index.js",
+      "default": "./dist/next/index.js"
     }
   },
   "files": [
@@ -42,21 +47,31 @@
     "registry": "https://registry.npmjs.org/",
     "access": "public"
   },
-  "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "tsc",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run"
-  },
   "devDependencies": {
     "@types/react": "^19.2.14",
+    "next": "^15.5.20",
     "typescript": "~5.9.2",
     "vitest": "^4.1.0"
   },
   "dependencies": {
+    "server-only": "^0.0.1",
     "socket.io-client": "^4.8.3"
   },
   "peerDependencies": {
+    "next": ">=14.0.0 <16",
     "react": "^18.3.1 || ^19.0.0"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
   }
-}
+}