@run402/functions 2.9.0 → 3.0.0

package/dist/auth/index.js

@@ -0,0 +1,453 @@
+/**
+ * `auth.*` — the sole server-side auth namespace.
+ *
+ * The single import line for any consumer:
+ *
+ *     import { auth } from "@run402/functions";
+ *
+ * Surface (deliberately small):
+ *
+ *     auth.user()                          → Actor | null
+ *     auth.requireUser()                   → Actor (throws / 303 otherwise)
+ *     auth.requireRole(role)               → { user, role }
+ *     auth.requireMembership(membership)   → { user, membership }
+ *     auth.requireFresh({ maxAge, amr? })  → void (throws / 303 otherwise)
+ *     auth.identities.link({ ... })        → void
+ *     auth.fetch(input, init?)             → Response (same-origin only)
+ *     auth.csrfToken()                     → string
+ *     auth.csrfField()                     → "<input type=hidden ...>"
+ *     auth.sessions.createResponseFromIdentity({ ... }) → Response
+ *     auth.sessions.endResponse()          → Response
+ *
+ * Behaviour notes baked into the helpers:
+ *   - Calling any helper taints the cache (the response now depends on
+ *     per-request actor state). The taint is monotonic — once set, the
+ *     SSR cache layer treats the response as non-cacheable until the
+ *     request completes.
+ *   - HTML-vs-JSON failure decisions are made by the gateway middleware
+ *     (303 redirect for HTML, 401/403 envelope for JSON). The SDK throws
+ *     a typed Error subclass; framework code OR the gateway translates.
+ *   - `requireRole` / `requireMembership` always read fresh server-side
+ *     grant data — no positive cache (matches D8 + the "instant revocation"
+ *     contract). For now we route via `getRole` which the gateway sets
+ *     at the routed-function envelope; once the v1.60 grants table lands,
+ *     gate helpers will JOIN against it inside the same request.
+ *   - `requireFresh` consults the per-method `amr_times` on the Actor —
+ *     a recent password proof does NOT satisfy `{amr: ["passkey"]}`.
+ *
+ * @see openspec/changes/auth-aware-ssr/specs/auth-sdk-namespace/spec.md
+ */
+import { getCurrentContext, requireActiveContext, taintCacheBypass, } from "../runtime-context.js";
+import { config } from "../config.js";
+import jwt from "../lib/jwt.js";
+import { AuthRequiredError, FetchAbsoluteUrlError, FreshnessRequiredError, InsufficientMembershipError, InsufficientRoleError, UnknownExportError, } from "./errors.js";
+import { validateAuthFetchInput } from "./url-validation.js";
+import crypto from "node:crypto";
+// ---------------------------------------------------------------------------
+// Identity & authorization helpers
+// ---------------------------------------------------------------------------
+async function user() {
+    // Taint cache regardless of outcome — the response depends on actor
+    // state once any consumer asks. The taint is monotonic (D23).
+    taintCacheBypass();
+    const ctx = getCurrentContext();
+    if (ctx === undefined) {
+        // No active context — could be (a) module scope or (b) prerendered
+        // build. The runtime-context module distinguishes these via the
+        // `active` flag, but for `auth.user()` specifically we return null
+        // for module-scope while throwing R402_AUTH_PRERENDERED for the
+        // prerendered case. Without a context we can't tell, so return
+        // null — Astro's prerender detection runs upstream in @run402/astro.
+        return null;
+    }
+    // SSR / cookie-session path: actor populated from the verified
+    // gateway-signed envelope at runWithContext entry.
+    if (ctx.actor) {
+        return actorContextToPublicActor(ctx.actor, ctx.projectId);
+    }
+    // Direct function invocation path (Bearer JWT, no cookie envelope):
+    // fall back to decoding the Authorization header. This is the legacy
+    // getUser(req) contract — mobile / server-to-server callers send a
+    // signed JWT in the Authorization header, the function reads it.
+    // The gateway has already routed the request to this function and
+    // injected the Authorization header per the apikey/wallet-auth
+    // pipeline, so we can trust JWT_SECRET-signed claims here.
+    return actorFromAuthorizationHeader(ctx);
+}
+/** Read `Authorization: Bearer <jwt>` from the runtime context's
+ *  request headers and decode it via JWT_SECRET. Returns an `Actor`
+ *  populated from the JWT claims on success, `null` on absence /
+ *  malformed / wrong-project / verify-fail.
+ *
+ *  This is the legacy `getUser(req)` shape adapted to the v3.0 `auth.*`
+ *  surface — it preserves the direct-function-invocation contract that
+ *  the platform's own E2E suite exercises and that mobile / CI callers
+ *  rely on. The cookie-session SSR path doesn't go through here (it
+ *  populates ctx.actor at runWithContext entry via the verified
+ *  envelope). */
+function actorFromAuthorizationHeader(ctx) {
+    if (!config.JWT_SECRET)
+        return null;
+    const headers = ctx.request.headers;
+    // The runtime-context wrapper accepts either a `Headers` instance
+    // (when the gateway's buildEntryWrapper passes a Request) or a plain
+    // header object. Handle both.
+    let authHeader;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const h = headers;
+    if (typeof h?.get === "function") {
+        authHeader = h.get("authorization") ?? h.get("Authorization") ?? undefined;
+    }
+    else {
+        const raw = h?.["authorization"] ?? h?.["Authorization"];
+        authHeader = Array.isArray(raw) ? raw[0] : raw;
+    }
+    if (!authHeader || !authHeader.startsWith("Bearer "))
+        return null;
+    const token = authHeader.slice(7);
+    try {
+        const payload = jwt.verify(token, config.JWT_SECRET);
+        if (payload.project_id !== ctx.projectId)
+            return null;
+        return {
+            id: payload.sub,
+            projectId: payload.project_id,
+            sessionId: payload.session_id ?? `bearer:${payload.sub}`,
+            email: payload.email ?? "",
+            emailVerified: false,
+            authTime: payload.auth_time ?? Math.floor(Date.now() / 1000),
+            amr: Array.isArray(payload.amr) ? [...payload.amr] : [],
+            amrTimes: {},
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function requireUser() {
+    const actor = await user();
+    if (actor === null) {
+        throw new AuthRequiredError({ returnTo: currentReturnTo() });
+    }
+    return actor;
+}
+async function requireRole(role) {
+    const actor = await requireUser();
+    // For v1A wiring: read the gate-resolved role from the routed-function
+    // envelope header set by the gateway middleware. When the v1.60
+    // platform-owned grants table lands, this swaps to a fresh DB read
+    // joined to internal.role_grants.
+    const ctx = requireActiveContext("auth.requireRole");
+    const headerRole = readHeader(ctx.request.headers, "x-run402-user-role");
+    if (headerRole === role) {
+        return { user: actor, role };
+    }
+    throw new InsufficientRoleError(role);
+}
+function readHeader(headers, name) {
+    const v = headers[name] ?? headers[name.toLowerCase()] ?? headers[name.toUpperCase()];
+    return Array.isArray(v) ? v[0] : v;
+}
+async function requireMembership(membership) {
+    const actor = await requireUser();
+    // Membership shape mirrors role for v1A. The grant table for membership
+    // lands in a separate change (auth-as-sdlc); meanwhile the gateway-side
+    // gate helpers populate `x-run402-user-membership` when configured.
+    const ctx = requireActiveContext("auth.requireMembership");
+    const headerMembership = readHeader(ctx.request.headers, "x-run402-user-membership");
+    if (headerMembership === membership) {
+        return { user: actor, membership };
+    }
+    throw new InsufficientMembershipError(membership);
+}
+async function requireFresh(opts) {
+    taintCacheBypass();
+    const actor = await requireUser();
+    const maxAgeSec = parseMaxAge(opts.maxAge);
+    const nowSec = Math.floor(Date.now() / 1000);
+    if (opts.amr && opts.amr.length > 0) {
+        const ok = opts.amr.some((method) => {
+            const ts = actor.amrTimes[method];
+            return typeof ts === "number" && nowSec - ts <= maxAgeSec;
+        });
+        if (!ok) {
+            throw new FreshnessRequiredError({
+                maxAge: opts.maxAge,
+                amr: opts.amr,
+                returnTo: currentReturnTo(),
+            });
+        }
+        return;
+    }
+    if (nowSec - actor.authTime <= maxAgeSec)
+        return;
+    throw new FreshnessRequiredError({
+        maxAge: opts.maxAge,
+        amr: [],
+        returnTo: currentReturnTo(),
+    });
+}
+function parseMaxAge(raw) {
+    if (/^\d+$/.test(raw))
+        return Number(raw);
+    let total = 0;
+    const re = /(\d+)\s*([smhd])/gi;
+    let m;
+    while ((m = re.exec(raw)) !== null) {
+        const v = Number(m[1]);
+        switch (m[2].toLowerCase()) {
+            case "s":
+                total += v;
+                break;
+            case "m":
+                total += v * 60;
+                break;
+            case "h":
+                total += v * 3600;
+                break;
+            case "d":
+                total += v * 86400;
+                break;
+        }
+    }
+    return total;
+}
+// ---------------------------------------------------------------------------
+// auth.fetch — relative-only with manual-redirect default
+// ---------------------------------------------------------------------------
+async function authFetch(input, init) {
+    const ctx = requireActiveContext("auth.fetch");
+    const origin = `https://${ctx.host}`;
+    const result = validateAuthFetchInput(input, { requestOrigin: origin });
+    if (!result.ok) {
+        throw new FetchAbsoluteUrlError({
+            attempted: typeof input === "string" ? input : (input instanceof URL ? input.toString() : input.url),
+            reason: result.reason,
+        });
+    }
+    // The validated URL is same-origin. Default redirect: "manual" so
+    // follow-cross-origin redirects don't smuggle our actor context to
+    // hostile hops. If the caller opts in via init.redirect: "follow",
+    // we still re-validate each hop — but native fetch doesn't expose
+    // hop-by-hop hooks, so we emulate by doing manual redirects.
+    const headers = new Headers(init?.headers);
+    // Forward only headers the gateway expects from a same-origin SSR
+    // fetch. Actor-context propagation is automatic (the inbound envelope
+    // is propagated as a header; the SSR runtime already verified it).
+    // Cookies are NEVER forwarded — never set the Cookie header here.
+    headers.delete("cookie");
+    headers.delete("Cookie");
+    const requestInit = {
+        ...init,
+        headers,
+        redirect: init?.redirect ?? "manual",
+    };
+    return fetch(result.normalized, requestInit);
+}
+// ---------------------------------------------------------------------------
+// CSRF token helpers (double-submit token bound to the active session).
+// ---------------------------------------------------------------------------
+function csrfToken() {
+    const ctx = getCurrentContext();
+    if (!ctx || !ctx.actor) {
+        // No session ⇒ no CSRF token. Returning an empty string would let
+        // the form submit with no token at all; instead throw so the page
+        // author knows the helper should be inside `<SignedIn>`-style
+        // conditional rendering.
+        throw new AuthRequiredError();
+    }
+    // The token derivation is HMAC(session_secret, "csrf") truncated to
+    // 32 hex chars. Browsers double-submit; the gateway re-derives and
+    // compares constant-time. We use the session_id + auth_time as the
+    // poor-man's MAC input since the SDK doesn't have access to the
+    // pepper; the gateway is the authoritative verifier (cross-checks
+    // against internal.sessions via session_id). This is double-submit
+    // CSRF, not a primary control — the Origin check is.
+    const input = `${ctx.actor.sessionId}:${ctx.actor.authTime}:csrf`;
+    return crypto.createHash("sha256").update(input, "utf8").digest("hex").slice(0, 32);
+}
+function csrfField() {
+    return `<input type="hidden" name="_csrf" value="${escapeHtml(csrfToken())}">`;
+}
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+// ---------------------------------------------------------------------------
+// Session bridge — createResponseFromIdentity / endResponse.
+//
+// These delegate to the platform routes; the SDK never holds raw secrets.
+// The session-minting route lives at POST /auth/v1/sessions/from-identity
+// (gateway-internal). The endResponse helper just emits the clear-cookie
+// Set-Cookie + body and lets the gateway-side mounted CSRF/origin check
+// run on the calling capability's response.
+// ---------------------------------------------------------------------------
+async function createResponseFromIdentity(opts) {
+    const ctx = requireActiveContext("auth.sessions.createResponseFromIdentity");
+    const origin = `https://${ctx.host}`;
+    // Delegate to the platform route. The route verifies the proof
+    // against the project's registered verifier (wallet/oidc/custom) and
+    // mints the session via the internal-only primitive. The Response
+    // already carries Set-Cookie and the canonical {ok, user} body.
+    const res = await fetch(`${origin}/auth/v1/sessions/from-identity`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(opts),
+        redirect: "manual",
+    });
+    return res;
+}
+async function endResponse() {
+    const ctx = requireActiveContext("auth.sessions.endResponse");
+    const origin = `https://${ctx.host}`;
+    const res = await fetch(`${origin}/auth/v1/sessions/end`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        redirect: "manual",
+    });
+    return res;
+}
+// ---------------------------------------------------------------------------
+// Identity linking.
+// ---------------------------------------------------------------------------
+async function linkIdentity(opts) {
+    const ctx = requireActiveContext("auth.identities.link");
+    await requireUser();
+    const origin = `https://${ctx.host}`;
+    const res = await fetch(`${origin}/auth/v1/identities/link`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(opts),
+        redirect: "manual",
+    });
+    if (res.status === 409) {
+        // The platform route maps unique_violation on
+        // internal.identities (project_id, provider, subject) to 409.
+        throw new (await import("./errors.js")).IdentityLinkConflictError({
+            provider: opts.provider,
+            subject: opts.subject,
+        });
+    }
+    if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        throw new (await import("./errors.js")).SessionBridgeUnverifiedError({
+            reason: body.code ?? `link failed: ${res.status}`,
+        });
+    }
+}
+// ---------------------------------------------------------------------------
+// SDK proxy intercepting hallucinated names.
+// ---------------------------------------------------------------------------
+const HALLUCINATED_NAMES = {
+    session: "auth.user() then read .sessionId / .amr / etc.",
+    getSession: "auth.user()",
+    currentUser: "auth.user()",
+    currentSession: "auth.user()",
+    requireAuth: "auth.requireUser()",
+    middleware: "auth.csrfField() / @run402/astro middleware",
+    signIn: "POST /auth/sign-in (browser form) or auth.sessions.createResponseFromIdentity({...})",
+    signout: "auth.sessions.endResponse()",
+    signOut: "auth.sessions.endResponse()",
+    logout: "auth.sessions.endResponse()",
+    login: "auth.sessions.createResponseFromIdentity({...})",
+    redirectToSignIn: "auth.requireUser() — platform redirects",
+    getUser: "auth.user()",
+    getToken: "auth.requireUser() then user.sessionId (tokens are not exposed)",
+    protect: "auth.requireUser() / auth.requireRole(...)",
+};
+const baseAuth = {
+    user,
+    requireUser,
+    requireRole,
+    requireMembership,
+    requireFresh,
+    fetch: authFetch,
+    csrfToken,
+    csrfField,
+    identities: {
+        link: linkIdentity,
+    },
+    sessions: {
+        createResponseFromIdentity,
+        endResponse,
+    },
+};
+/** Hallucinated-name proxy. Property access for a name not in
+ *  `baseAuth` throws `R402_AUTH_UNKNOWN_EXPORT` with the canonical
+ *  replacement. Hot-path access (existing keys) returns the actual
+ *  helper — proxy overhead is one Reflect.has + Reflect.get. */
+export const auth = new Proxy(baseAuth, {
+    get(target, prop, receiver) {
+        if (typeof prop === "string" && !(prop in target)) {
+            const replacement = HALLUCINATED_NAMES[prop];
+            if (replacement) {
+                throw new UnknownExportError({
+                    attemptedName: `auth.${prop}`,
+                    canonicalName: replacement,
+                });
+            }
+            throw new UnknownExportError({
+                attemptedName: `auth.${prop}`,
+                canonicalName: "auth.user / auth.requireUser / auth.requireRole / auth.requireMembership",
+            });
+        }
+        return Reflect.get(target, prop, receiver);
+    },
+});
+/** Throwing-sentinel exports for the top hallucinated *bare* names.
+ *  ESM `import { getUser } from "@run402/functions"` can be intercepted
+ *  only by a real export — so we ship these as exported throwing
+ *  functions. They're marked `@deprecated` in the type JSDoc; the SDK
+ *  proxy + lint registry + `run402 doctor` scan all flag the import
+ *  before runtime if the user is running the tooling.
+ *
+ *  Excluded from public docs and AGENTS.md per the spec.
+ */
+/** @deprecated Use `auth.user()` or `auth.requireUser()`. */
+export function getSession() {
+    throw new UnknownExportError({ attemptedName: "getSession", canonicalName: "auth.user()" });
+}
+/** @deprecated Use `auth.user()`. */
+export function currentUser() {
+    throw new UnknownExportError({ attemptedName: "currentUser", canonicalName: "auth.user()" });
+}
+/** @deprecated Use `auth.user()`. */
+export function getCurrentUser() {
+    throw new UnknownExportError({ attemptedName: "getCurrentUser", canonicalName: "auth.user()" });
+}
+/** @deprecated Use `auth.user()`. */
+export function getServerSession() {
+    throw new UnknownExportError({
+        attemptedName: "getServerSession",
+        canonicalName: "auth.user()",
+    });
+}
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+function actorContextToPublicActor(ctxActor, projectId) {
+    if (!ctxActor)
+        return null;
+    return {
+        id: ctxActor.id,
+        projectId,
+        sessionId: ctxActor.sessionId,
+        email: ctxActor.email,
+        emailVerified: ctxActor.emailVerified,
+        authTime: ctxActor.authTime,
+        amr: [...ctxActor.amr],
+        amrTimes: { ...ctxActor.amrTimes },
+    };
+}
+function currentReturnTo() {
+    const ctx = getCurrentContext();
+    if (!ctx)
+        return undefined;
+    return ctx.request.url;
+}
+export { AuthRequiredError, InsufficientRoleError, InsufficientMembershipError, FreshnessRequiredError, FetchAbsoluteUrlError, PrerenderedError, UnknownExportError, SessionBridgeUnverifiedError, IdentityLinkConflictError, UnknownIdentityError, Run402AuthError, } from "./errors.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,GAAG,MAAM,eAAe,CAAC;AAChC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EAErB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,KAAK,UAAU,IAAI;IACjB,oEAAoE;IACpE,8DAA8D;IAC9D,gBAAgB,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,mEAAmE;QACnE,gEAAgE;QAChE,mEAAmE;QACnE,gEAAgE;QAChE,+DAA+D;QAC/D,qEAAqE;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,+DAA+D;IAC/D,mDAAmD;IACnD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7D,CAAC;IACD,oEAAoE;IACpE,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,kEAAkE;IAClE,+DAA+D;IAC/D,2DAA2D;IAC3D,OAAO,4BAA4B,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;iBAUiB;AACjB,SAAS,4BAA4B,CACnC,GAAsD;IAEtD,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;IACpC,kEAAkE;IAClE,qEAAqE;IACrE,8BAA8B;IAC9B,IAAI,UAA8B,CAAC;IACnC,8DAA8D;IAC9D,MAAM,CAAC,GAAG,OAAc,CAAC;IACzB,IAAI,OAAO,CAAC,EAAE,GAAG,KAAK,UAAU,EAAE,CAAC;QACjC,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;QACzD,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CASvB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,UAAU,KAAK,GAAG,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,GAAG;YACf,SAAS,EAAE,OAAO,CAAC,UAAU;YAC7B,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,UAAU,OAAO,CAAC,GAAG,EAAE;YACxD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;YAC1B,aAAa,EAAE,KAAK;YACpB,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC5D,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;YACvD,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;IAC3B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,iBAAiB,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAO;IAEP,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;IAClC,uEAAuE;IACvE,gEAAgE;IAChE,mEAAmE;IACnE,kCAAkC;IAClC,MAAM,GAAG,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IACzE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CACjB,OAAsD,EACtD,IAAY;IAEZ,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAa;IAEb,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;IAClC,wEAAwE;IACxE,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,GAAG,GAAG,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACrF,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACpD,CAAC;AAaD,KAAK,UAAU,YAAY,CAAC,IAAyB;IACnD,gBAAgB,EAAE,CAAC;IACnB,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAClC,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,SAAS,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,sBAAsB,CAAC;gBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,QAAQ,EAAE,eAAe,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS;QAAE,OAAO;IACjD,MAAM,IAAI,sBAAsB,CAAC;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,EAAE,EAAE;QACP,QAAQ,EAAE,eAAe,EAAE;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,EAAE,GAAG,oBAAoB,CAAC;IAChC,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5B,KAAK,GAAG;gBACN,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,KAAK,GAAG;gBACN,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM;YACR,KAAK,GAAG;gBACN,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC;gBAClB,MAAM;YACR,KAAK,GAAG;gBACN,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC;gBACnB,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,KAAK,UAAU,SAAS,CACtB,KAAwB,EACxB,IAAkB;IAElB,MAAM,GAAG,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,qBAAqB,CAAC;YAC9B,SAAS,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACpG,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,kEAAkE;IAClE,6DAA6D;IAC7D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,kEAAkE;IAClE,sEAAsE;IACtE,mEAAmE;IACnE,kEAAkE;IAClE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzB,MAAM,WAAW,GAAgB;QAC/B,GAAG,IAAI;QACP,OAAO;QACP,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,QAAQ;KACrC,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAE9E,SAAS,SAAS;IAChB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACvB,kEAAkE;QAClE,kEAAkE;QAClE,8DAA8D;QAC9D,yBAAyB;QACzB,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAChC,CAAC;IACD,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,mEAAmE;IACnE,qDAAqD;IACrD,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,OAAO,CAAC;IAClE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,4CAA4C,UAAU,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,EAAE;AACF,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,wEAAwE;AACxE,4CAA4C;AAC5C,8EAA8E;AAE9E,KAAK,UAAU,0BAA0B,CACvC,IAAuC;IAEvC,MAAM,GAAG,GAAG,oBAAoB,CAAC,0CAA0C,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC;IACrC,+DAA+D;IAC/D,qEAAqE;IACrE,kEAAkE;IAClE,gEAAgE;IAChE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,iCAAiC,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,GAAG,oBAAoB,CAAC,2BAA2B,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,uBAAuB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,KAAK,UAAU,YAAY,CAAC,IAAyB;IACnD,MAAM,GAAG,GAAG,oBAAoB,CAAC,sBAAsB,CAAC,CAAC;IACzD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,0BAA0B,EAAE;QAC3D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,8CAA8C;QAC9C,8DAA8D;QAC9D,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC;YAChE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,4BAA4B,CAAC;YACnE,MAAM,EAAG,IAA0B,CAAC,IAAI,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE;SACzE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAE9E,MAAM,kBAAkB,GAA2B;IACjD,OAAO,EAAE,gDAAgD;IACzD,UAAU,EAAE,aAAa;IACzB,WAAW,EAAE,aAAa;IAC1B,cAAc,EAAE,aAAa;IAC7B,WAAW,EAAE,oBAAoB;IACjC,UAAU,EAAE,6CAA6C;IACzD,MAAM,EAAE,sFAAsF;IAC9F,OAAO,EAAE,6BAA6B;IACtC,OAAO,EAAE,6BAA6B;IACtC,MAAM,EAAE,6BAA6B;IACrC,KAAK,EAAE,iDAAiD;IACxD,gBAAgB,EAAE,yCAAyC;IAC3D,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,iEAAiE;IAC3E,OAAO,EAAE,4CAA4C;CACtD,CAAC;AA2BF,MAAM,QAAQ,GAAkB;IAC9B,IAAI;IACJ,WAAW;IACX,WAAW;IACX,iBAAiB;IACjB,YAAY;IACZ,KAAK,EAAE,SAAS;IAChB,SAAS;IACT,SAAS;IACT,UAAU,EAAE;QACV,IAAI,EAAE,YAAY;KACnB;IACD,QAAQ,EAAE;QACR,0BAA0B;QAC1B,WAAW;KACZ;CACF,CAAC;AAEF;;;gEAGgE;AAChE,MAAM,CAAC,MAAM,IAAI,GAAkB,IAAI,KAAK,CAAC,QAAQ,EAAE;IACrD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;QACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,IAAI,kBAAkB,CAAC;oBAC3B,aAAa,EAAE,QAAQ,IAAI,EAAE;oBAC7B,aAAa,EAAE,WAAW;iBAC3B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,aAAa,EAAE,QAAQ,IAAI,EAAE;gBAC7B,aAAa,EAAE,0EAA0E;aAC1F,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;CACF,CAAC,CAAC;AAEH;;;;;;;;GAQG;AAEH,6DAA6D;AAC7D,MAAM,UAAU,UAAU;IACxB,MAAM,IAAI,kBAAkB,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,kBAAkB,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,kBAAkB,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,kBAAkB,CAAC;QAC3B,aAAa,EAAE,kBAAkB;QACjC,aAAa,EAAE,aAAa;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,yBAAyB,CAChC,QAA6B,EAC7B,SAAiB;IAEjB,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,SAAS;QACT,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,EAAE,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC;QACtB,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;AACzB,CAAC;AAID,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Public types for the `auth.*` namespace.
+ *
+ * The canonical actor shape used everywhere `auth.user()` /
+ * `auth.requireUser()` / `auth.requireRole()` etc. resolve to a user.
+ * Note that `id` (not `userId`) is the canonical public field — matches
+ * Supabase / Clerk / Auth.js / NextAuth so coding-agent generated code
+ * gets it right on the first try.
+ *
+ * @see openspec/changes/auth-aware-ssr/specs/auth-sdk-namespace/spec.md
+ */
+export interface Actor {
+    /** Canonical public user-id. Matches `internal.users.id` UUID. */
+    id: string;
+    projectId: string;
+    sessionId: string;
+    email: string;
+    emailVerified: boolean;
+    /** Last any-method auth proof, seconds-since-epoch. */
+    authTime: number;
+    amr: string[];
+    /** Per-AMR last-verified UNIX seconds. */
+    amrTimes: Record<string, number>;
+}
+/** Provider-shaped identity proof. The `wallet` shape carries an SIWX
+ *  signature + message; `oidc` carries a JWT bound to a project-configured
+ *  issuer; `custom` requires admin-registered project-side verifier and
+ *  carries provider-specific bytes. */
+export type IdentityProof = {
+    kind: "siwx";
+    signature: string;
+    message: string;
+    nonce?: string;
+} | {
+    kind: "oidc_jwt";
+    token: string;
+    nonce?: string;
+} | {
+    kind: "custom";
+    payload: unknown;
+    nonce?: string;
+};
+export interface CreateResponseFromIdentityOptions {
+    provider: "wallet" | "oidc" | "custom";
+    subject: string;
+    proof: IdentityProof;
+    amr: string[];
+    /** When `false` (default), unknown identities cause
+     *  `R402_AUTH_UNKNOWN_IDENTITY`. When `true`, the platform creates the
+     *  user + identity link in the same transaction as the session. */
+    createUser?: boolean;
+}
+export interface IdentityLinkOptions {
+    provider: string;
+    subject: string;
+    proof: IdentityProof;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,KAAK;IACpB,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;IACvB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;uCAGuC;AACvC,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,iCAAiC;IAChD,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,CAAC;IACrB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd;;uEAEmE;IACnE,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,CAAC;CACtB"}

package/dist/auth/types.js

@@ -0,0 +1,13 @@
+/**
+ * Public types for the `auth.*` namespace.
+ *
+ * The canonical actor shape used everywhere `auth.user()` /
+ * `auth.requireUser()` / `auth.requireRole()` etc. resolve to a user.
+ * Note that `id` (not `userId`) is the canonical public field — matches
+ * Supabase / Clerk / Auth.js / NextAuth so coding-agent generated code
+ * gets it right on the first try.
+ *
+ * @see openspec/changes/auth-aware-ssr/specs/auth-sdk-namespace/spec.md
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/auth/url-validation.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `auth.fetch` URL validation.
+ *
+ * Synchronous before-network checks: the URL is rejected (sync throw)
+ * before any network I/O if it's not safely same-origin. The set of
+ * rejected shapes is enumerated by the spec — we mirror it verbatim:
+ *
+ *   - Cross-origin absolute URLs
+ *   - URLs with embedded credentials (`http://user:pass@host/...`)
+ *   - Non-HTTP(S) schemes (`javascript:`, `data:`, `file:`, etc.)
+ *   - Protocol-relative URLs (`//evil.example/...`)
+ *   - Subdomain-spoof patterns (`https://app.run402.app.evil.example/...`)
+ *   - Port-mismatch against the current request origin
+ *
+ * Same-origin normalisation: scheme, host, and default-port comparisons
+ * use `URL.origin`, which strips `:80` for http and `:443` for https.
+ *
+ * @see openspec/changes/auth-aware-ssr/specs/auth-sdk-namespace/spec.md
+ */
+export interface UrlValidationContext {
+    requestOrigin: string;
+}
+export type UrlValidationResult = {
+    ok: true;
+    normalized: URL;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function validateAuthFetchInput(input: RequestInfo | URL, ctx: UrlValidationContext): UrlValidationResult;
+//# sourceMappingURL=url-validation.d.ts.map

package/dist/auth/url-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-validation.d.ts","sourceRoot":"","sources":["../../src/auth/url-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,GAAG,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAIlC,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,GAAG,EAAE,oBAAoB,GACxB,mBAAmB,CAiErB"}