@run402/functions 3.1.0 → 3.2.1

package/dist/auth/errors.d.ts

@@ -9,7 +9,7 @@
  * the right thing. But framework code, middleware, and test harnesses
  * occasionally need typed catches; that's what these classes are for.
  */
-export type Run402AuthCode = "R402_AUTH_REQUIRED" | "R402_AUTH_INSUFFICIENT_ROLE" | "R402_AUTH_INSUFFICIENT_MEMBERSHIP" | "R402_AUTH_FRESHNESS_REQUIRED" | "R402_AUTH_PRERENDERED" | "R402_AUTH_FETCH_ABSOLUTE_URL" | "R402_AUTH_UNKNOWN_EXPORT" | "R402_AUTH_SESSION_BRIDGE_UNVERIFIED" | "R402_AUTH_IDENTITY_LINK_CONFLICT" | "R402_AUTH_UNKNOWN_IDENTITY" | "R402_AUTH_TENANT_SUFFIX_REQUIRED" | "R402_AUTH_RETURN_TO_INVALID" | "R402_AUTH_REDUNDANT_USER_FILTER" | "R402_AUTH_INVALID_CREDENTIALS" | "R402_AUTH_TENANT_SUBJECT_INVALID" | "R402_AUTH_UNTRUSTED_CONTEXT";
+export type Run402AuthCode = "R402_AUTH_REQUIRED" | "R402_AUTH_INSUFFICIENT_ROLE" | "R402_AUTH_INSUFFICIENT_MEMBERSHIP" | "R402_AUTH_FRESHNESS_REQUIRED" | "R402_AUTH_PRERENDERED" | "R402_AUTH_FETCH_ABSOLUTE_URL" | "R402_AUTH_UNKNOWN_EXPORT" | "R402_AUTH_SESSION_BRIDGE_UNVERIFIED" | "R402_AUTH_IDENTITY_LINK_CONFLICT" | "R402_AUTH_UNKNOWN_IDENTITY" | "R402_AUTH_TENANT_SUFFIX_REQUIRED" | "R402_AUTH_RETURN_TO_INVALID" | "R402_AUTH_REDUNDANT_USER_FILTER" | "R402_AUTH_INVALID_CREDENTIALS" | "R402_AUTH_TENANT_SUBJECT_INVALID" | "R402_AUTH_UNTRUSTED_CONTEXT" | "R402_AUTH_RENAMED_EXPORT";
 export declare class Run402AuthError extends Error {
     readonly code: Run402AuthCode;
     readonly status: number;
@@ -94,6 +94,18 @@ export declare class UnknownIdentityError extends Run402AuthError {
 export declare class InvalidCredentialsError extends Run402AuthError {
     constructor();
 }
+/** A shipped export that has been renamed/moved. Distinct from
+ *  `UnknownExportError` (never-existed names): this one teaches the specific
+ *  move for a name that used to work. Used for `auth.identities.link` →
+ *  `auth.account.identities.startLink`. */
+export declare class RenamedExportError extends Run402AuthError {
+    readonly oldName: string;
+    readonly newName: string;
+    constructor(opts: {
+        oldName: string;
+        newName: string;
+    });
+}
 /** Rejects a tenant-assertion mint whose `user` lacks a stable `id` (e.g. a
  *  bare email). The `fix` shows the required `{ tenant, user: { id, email, ... },
  *  method }` shape. SDK-side fast-feedback twin of the gateway's

package/dist/auth/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,6BAA6B,GAC7B,mCAAmC,GACnC,8BAA8B,GAC9B,uBAAuB,GACvB,8BAA8B,GAC9B,0BAA0B,GAC1B,qCAAqC,GACrC,kCAAkC,GAClC,4BAA4B,GAC5B,kCAAkC,GAClC,6BAA6B,GAC7B,iCAAiC,GACjC,+BAA+B,GAC/B,kCAAkC,GAClC,6BAA6B,CAAC;AAElC,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEX,IAAI,EAAE;QAChB,IAAI,EAAE,cAAc,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf;CASF;AAED;;kEAEkE;AAClE,qBAAa,iBAAkB,SAAQ,eAAe;gBACxC,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO;CAW7C;AAED,qBAAa,qBAAsB,SAAQ,eAAe;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;gBAClB,YAAY,EAAE,MAAM;CAUjC;AAED,qBAAa,2BAA4B,SAAQ,eAAe;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;gBACxB,kBAAkB,EAAE,MAAM;CAUvC;AAED,qBAAa,sBAAuB,SAAQ,eAAe;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;gBACX,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;CAWvE;AAED,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAWxD;AAED,qBAAa,gBAAiB,SAAQ,eAAe;gBACvC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE;CAW1C;AAED,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,IAAI,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;CAiBnE;AAED,qBAAa,4BAA6B,SAAQ,eAAe;gBACnD,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;CAWrC;AAED,qBAAa,yBAA0B,SAAQ,eAAe;gBAChD,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CASxD;AAED,qBAAa,oBAAqB,SAAQ,eAAe;gBAC3C,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAUxD;AAED;;;;sDAIsD;AACtD,qBAAa,uBAAwB,SAAQ,eAAe;;CAa3D;AAED;;;mDAGmD;AACnD,qBAAa,yBAA0B,SAAQ,eAAe;gBAChD,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;CAYrC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,6BAA6B,GAC7B,mCAAmC,GACnC,8BAA8B,GAC9B,uBAAuB,GACvB,8BAA8B,GAC9B,0BAA0B,GAC1B,qCAAqC,GACrC,kCAAkC,GAClC,4BAA4B,GAC5B,kCAAkC,GAClC,6BAA6B,GAC7B,iCAAiC,GACjC,+BAA+B,GAC/B,kCAAkC,GAClC,6BAA6B,GAC7B,0BAA0B,CAAC;AAE/B,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEX,IAAI,EAAE;QAChB,IAAI,EAAE,cAAc,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf;CASF;AAED;;kEAEkE;AAClE,qBAAa,iBAAkB,SAAQ,eAAe;gBACxC,IAAI,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO;CAW7C;AAED,qBAAa,qBAAsB,SAAQ,eAAe;IACxD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;gBAClB,YAAY,EAAE,MAAM;CAUjC;AAED,qBAAa,2BAA4B,SAAQ,eAAe;IAC9D,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;gBACxB,kBAAkB,EAAE,MAAM;CAUvC;AAED,qBAAa,sBAAuB,SAAQ,eAAe;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;gBACX,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE;CAWvE;AAED,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;CAWxD;AAED,qBAAa,gBAAiB,SAAQ,eAAe;gBACvC,IAAI,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE;CAW1C;AAED,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,IAAI,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE;CAiBnE;AAED,qBAAa,4BAA6B,SAAQ,eAAe;gBACnD,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;CAWrC;AAED,qBAAa,yBAA0B,SAAQ,eAAe;gBAChD,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CASxD;AAED,qBAAa,oBAAqB,SAAQ,eAAe;gBAC3C,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAUxD;AAED;;;;sDAIsD;AACtD,qBAAa,uBAAwB,SAAQ,eAAe;;CAa3D;AAED;;;2CAG2C;AAC3C,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBACb,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAavD;AAED;;;mDAGmD;AACnD,qBAAa,yBAA0B,SAAQ,eAAe;gBAChD,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE;CAYrC"}

package/dist/auth/errors.js

@@ -185,6 +185,27 @@ export class InvalidCredentialsError extends Run402AuthError {
         this.name = "InvalidCredentialsError";
     }
 }
+/** A shipped export that has been renamed/moved. Distinct from
+ *  `UnknownExportError` (never-existed names): this one teaches the specific
+ *  move for a name that used to work. Used for `auth.identities.link` →
+ *  `auth.account.identities.startLink`. */
+export class RenamedExportError extends Run402AuthError {
+    oldName;
+    newName;
+    constructor(opts) {
+        super({
+            code: "R402_AUTH_RENAMED_EXPORT",
+            status: 400,
+            message: `${opts.oldName} has moved to ${opts.newName}.`,
+            details: { old_name: opts.oldName, new_name: opts.newName },
+            suggestedFix: `Use: ${opts.newName}`,
+            docs: "https://run402.com/errors/#R402_AUTH_RENAMED_EXPORT",
+        });
+        this.name = "RenamedExportError";
+        this.oldName = opts.oldName;
+        this.newName = opts.newName;
+    }
+}
 /** Rejects a tenant-assertion mint whose `user` lacks a stable `id` (e.g. a
  *  bare email). The `fix` shows the required `{ tenant, user: { id, email, ... },
  *  method }` shape. SDK-side fast-feedback twin of the gateway's

package/dist/auth/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoBH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAiB;IACrB,MAAM,CAAS;IACf,OAAO,CAA0B;IACjC,YAAY,CAAU;IACtB,IAAI,CAAU;IAEvB,YAAY,IAOX;QACC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvC,CAAC;CACF;AAED;;kEAEkE;AAClE,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IACpD,YAAY,OAA8B,EAAE;QAC1C,KAAK,CAAC;YACJ,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,0BAA0B;YACnC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;YACzD,YAAY,EAAE,4CAA4C;YAC1D,IAAI,EAAE,+CAA+C;SACtD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IAC/C,YAAY,CAAS;IAC9B,YAAY,YAAoB;QAC9B,KAAK,CAAC;YACJ,IAAI,EAAE,6BAA6B;YACnC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,2CAA2C,YAAY,GAAG;YACnE,OAAO,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,eAAe;IACrD,kBAAkB,CAAS;IACpC,YAAY,kBAA0B;QACpC,KAAK,CAAC;YACJ,IAAI,EAAE,mCAAmC;YACzC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,iDAAiD,kBAAkB,GAAG;YAC/E,OAAO,EAAE,EAAE,mBAAmB,EAAE,kBAAkB,EAAE;SACrD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IAChD,MAAM,CAAS;IACf,GAAG,CAAW;IACvB,YAAY,IAA0D;QACpE,KAAK,CAAC;YACJ,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,uCAAuC,IAAI,CAAC,MAAM,qBAAqB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACtG,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;SAClF,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACtB,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IACxD,YAAY,IAA2C;QACrD,KAAK,CAAC;YACJ,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,2BAA2B,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,MAAM,EAAE;YACrE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YAC/D,YAAY,EAAE,kGAAkG;YAChH,IAAI,EAAE,yDAAyD;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IACnD,YAAY,IAA6B;QACvC,KAAK,CAAC;YACJ,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,qCAAqC;YACjE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE;YAC3C,YAAY,EAAE,8DAA8D;YAC5E,IAAI,EAAE,kDAAkD;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IAC5C,aAAa,CAAS;IACtB,aAAa,CAAS;IAC/B,YAAY,IAAsD;QAChE,KAAK,CAAC;YACJ,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,uBAAuB,IAAI,CAAC,aAAa,SAAS,IAAI,CAAC,aAAa,WAAW;YACxF,OAAO,EAAE;gBACP,cAAc,EAAE,IAAI,CAAC,aAAa;gBAClC,cAAc,EAAE,IAAI,CAAC,aAAa;gBAClC,WAAW,EAAE,0CAA0C;aACxD;YACD,YAAY,EAAE,QAAQ,IAAI,CAAC,aAAa,EAAE;YAC1C,IAAI,EAAE,qDAAqD;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,eAAe;IAC/D,YAAY,IAAwB;QAClC,KAAK,CAAC;YACJ,IAAI,EAAE,qCAAqC;YAC3C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,4CAA4C,IAAI,CAAC,MAAM,EAAE;YAClE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YAChC,YAAY,EAAE,oHAAoH;YAClI,IAAI,EAAE,gEAAgE;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IAC5D,YAAY,IAA2C;QACrD,KAAK,CAAC;YACJ,IAAI,EAAE,kCAAkC;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,sCAAsC;YAC1F,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IACvD,YAAY,IAA2C;QACrD,KAAK,CAAC;YACJ,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,cAAc;YAClE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YAC3D,YAAY,EAAE,8GAA8G;SAC7H,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;sDAIsD;AACtD,MAAM,OAAO,uBAAwB,SAAQ,eAAe;IAC1D;QACE,KAAK,CAAC;YACJ,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,sBAAsB;YAC/B,OAAO,EAAE,EAAE;YACX,YAAY,EACV,6EAA6E;YAC/E,IAAI,EAAE,0DAA0D;SACjE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;mDAGmD;AACnD,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IAC5D,YAAY,IAAwB;QAClC,KAAK,CAAC;YACJ,IAAI,EAAE,kCAAkC;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,qCAAqC,IAAI,CAAC,MAAM,EAAE;YAC3D,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YAChC,YAAY,EACV,uIAAuI;YACzI,IAAI,EAAE,6DAA6D;SACpE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqBH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAiB;IACrB,MAAM,CAAS;IACf,OAAO,CAA0B;IACjC,YAAY,CAAU;IACtB,IAAI,CAAU;IAEvB,YAAY,IAOX;QACC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvC,CAAC;CACF;AAED;;kEAEkE;AAClE,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IACpD,YAAY,OAA8B,EAAE;QAC1C,KAAK,CAAC;YACJ,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,0BAA0B;YACnC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;YACzD,YAAY,EAAE,4CAA4C;YAC1D,IAAI,EAAE,+CAA+C;SACtD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IAC/C,YAAY,CAAS;IAC9B,YAAY,YAAoB;QAC9B,KAAK,CAAC;YACJ,IAAI,EAAE,6BAA6B;YACnC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,2CAA2C,YAAY,GAAG;YACnE,OAAO,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;SACzC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,eAAe;IACrD,kBAAkB,CAAS;IACpC,YAAY,kBAA0B;QACpC,KAAK,CAAC;YACJ,IAAI,EAAE,mCAAmC;YACzC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,iDAAiD,kBAAkB,GAAG;YAC/E,OAAO,EAAE,EAAE,mBAAmB,EAAE,kBAAkB,EAAE;SACrD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,eAAe;IAChD,MAAM,CAAS;IACf,GAAG,CAAW;IACvB,YAAY,IAA0D;QACpE,KAAK,CAAC;YACJ,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,uCAAuC,IAAI,CAAC,MAAM,qBAAqB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACtG,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;SAClF,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACtB,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IACxD,YAAY,IAA2C;QACrD,KAAK,CAAC;YACJ,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,2BAA2B,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,MAAM,EAAE;YACrE,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YAC/D,YAAY,EAAE,kGAAkG;YAChH,IAAI,EAAE,yDAAyD;SAChE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IACnD,YAAY,IAA6B;QACvC,KAAK,CAAC;YACJ,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,qCAAqC;YACjE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE;YAC3C,YAAY,EAAE,8DAA8D;YAC5E,IAAI,EAAE,kDAAkD;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IAC5C,aAAa,CAAS;IACtB,aAAa,CAAS;IAC/B,YAAY,IAAsD;QAChE,KAAK,CAAC;YACJ,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,uBAAuB,IAAI,CAAC,aAAa,SAAS,IAAI,CAAC,aAAa,WAAW;YACxF,OAAO,EAAE;gBACP,cAAc,EAAE,IAAI,CAAC,aAAa;gBAClC,cAAc,EAAE,IAAI,CAAC,aAAa;gBAClC,WAAW,EAAE,0CAA0C;aACxD;YACD,YAAY,EAAE,QAAQ,IAAI,CAAC,aAAa,EAAE;YAC1C,IAAI,EAAE,qDAAqD;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,eAAe;IAC/D,YAAY,IAAwB;QAClC,KAAK,CAAC;YACJ,IAAI,EAAE,qCAAqC;YAC3C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,4CAA4C,IAAI,CAAC,MAAM,EAAE;YAClE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YAChC,YAAY,EAAE,oHAAoH;YAClI,IAAI,EAAE,gEAAgE;SACvE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IAC5D,YAAY,IAA2C;QACrD,KAAK,CAAC;YACJ,IAAI,EAAE,kCAAkC;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,sCAAsC;YAC1F,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IACvD,YAAY,IAA2C;QACrD,KAAK,CAAC;YACJ,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,cAAc;YAClE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YAC3D,YAAY,EAAE,8GAA8G;SAC7H,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;sDAIsD;AACtD,MAAM,OAAO,uBAAwB,SAAQ,eAAe;IAC1D;QACE,KAAK,CAAC;YACJ,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,sBAAsB;YAC/B,OAAO,EAAE,EAAE;YACX,YAAY,EACV,6EAA6E;YAC/E,IAAI,EAAE,0DAA0D;SACjE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;;2CAG2C;AAC3C,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IAC5C,OAAO,CAAS;IAChB,OAAO,CAAS;IACzB,YAAY,IAA0C;QACpD,KAAK,CAAC;YACJ,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB,IAAI,CAAC,OAAO,GAAG;YACxD,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE;YAC3D,YAAY,EAAE,QAAQ,IAAI,CAAC,OAAO,EAAE;YACpC,IAAI,EAAE,qDAAqD;SAC5D,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;CACF;AAED;;;mDAGmD;AACnD,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IAC5D,YAAY,IAAwB;QAClC,KAAK,CAAC;YACJ,IAAI,EAAE,kCAAkC;YACxC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,qCAAqC,IAAI,CAAC,MAAM,EAAE;YAC3D,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;YAChC,YAAY,EACV,uIAAuI;YACzI,IAAI,EAAE,6DAA6D;SACpE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF"}

package/dist/auth/index.d.ts

@@ -29,18 +29,26 @@
  *   - HTML-vs-JSON failure decisions are made by the gateway middleware
  *     (303 redirect for HTML, 401/403 envelope for JSON). The SDK throws
  *     a typed Error subclass; framework code OR the gateway translates.
- *   - `requireRole` / `requireMembership` always read fresh server-side
- *     grant data — no positive cache (matches D8 + the "instant revocation"
- *     contract). For now we route via `getRole` which the gateway sets
- *     at the routed-function envelope; once the v1.60 grants table lands,
- *     gate helpers will JOIN against it inside the same request.
+ *   - `requireRole` reads the gate-resolved role from the routed-function
+ *     envelope header (`x-run402-user-role`) that the gateway's
+ *     `function-role-gates` middleware sets after resolving the caller
+ *     against the project's OWN role table — the one named in that
+ *     function's deploy-spec `requireRole` gate. It therefore REQUIRES the
+ *     deploy-spec gate: with no gate declared the header is absent and
+ *     `requireRole` throws (fail-closed, indistinguishable from a real
+ *     role mismatch). The gateway role lookup is TTL-cached (default 60s;
+ *     set the gate's `cacheTtl: 0` for a fresh read per request), so
+ *     revocation lag is bounded by that TTL — it is NOT instant.
+ *   - `requireMembership` reads `x-run402-user-membership` symmetrically,
+ *     but the gateway producer for that header is not shipped yet, so it
+ *     currently always throws. Forward API surface only.
  *   - `requireFresh` consults the per-method `amr_times` on the Actor —
  *     a recent password proof does NOT satisfy `{amr: ["passkey"]}`.
  *
  * @see openspec/changes/auth-aware-ssr/specs/auth-sdk-namespace/spec.md
  */
 import { InvalidCredentialsError } from "./errors.js";
-import type { Actor, CreateResponseFromIdentityOptions, CreateResponseFromTenantAssertionOptions, IdentityLinkOptions } from "./types.js";
+import type { AccountSecurity, Actor, CreateResponseFromIdentityOptions, CreateResponseFromTenantAssertionOptions, IdentityLinkOptions } from "./types.js";
 interface RequireFreshOptions {
     /** Human-friendly window expression. Accepted forms: `"10m"`, `"1h"`,
      *  `"5m30s"`, integer seconds (`"600"`). Anything that fails to parse
@@ -76,6 +84,50 @@ interface AuthNamespace {
     /** Canonical invalid-credentials failure for the tenant-owned credential
      *  case. A function (not a constructor): `throw auth.invalidCredentials()`. */
     invalidCredentials(): InvalidCredentialsError;
+    /** Account security (§4). `getSecurity`/`requireSecurity` are the everyday
+     *  rich read; the §4.4 advanced mutation tier (callee-enforced freshness,
+     *  context-actor only) backs the same flows as `<AccountSecurity>`. */
+    account: {
+        getSecurity(): Promise<AccountSecurity | null>;
+        requireSecurity(): Promise<AccountSecurity>;
+        setPassword(newPassword: string, opts?: {
+            maxAge?: string;
+        }): Promise<void>;
+        signOutEverywhere(): Promise<{
+            revoked_count: number;
+        }>;
+        passkeys: {
+            list(): Promise<unknown[]>;
+            remove(passkeyId: string): Promise<void>;
+            add(): never;
+        };
+        identities: {
+            list(): Promise<unknown[]>;
+            /** §4.5 — begin the OAuth link-to-existing-account ceremony for the
+             *  context actor. Mints a short-lived actor JWT and asks the gateway
+             *  (`intent:"link"`) for a provider authorization URL bound to the
+             *  signed-in user; the caller redirects the browser there. After the
+             *  provider round-trip the identity is written against THIS account
+             *  (not a new sign-in). `redirectUrl` must be an allowed origin for the
+             *  project. This is link-to-existing — distinct from sign-in-with. */
+            startLink(opts: {
+                provider: string;
+                redirectUrl: string;
+                mode?: "redirect" | "popup";
+            }): Promise<{
+                authorizationUrl: string;
+                expiresIn: number;
+            }>;
+            unlink(opts: {
+                provider: string;
+                subject: string;
+            }): Promise<void>;
+        };
+        sessions: {
+            list(): Promise<unknown[]>;
+            revoke(sessionId: string): Promise<void>;
+        };
+    };
     identities: {
         link(opts: IdentityLinkOptions): Promise<void>;
     };
@@ -107,6 +159,6 @@ export declare function currentUser(): never;
 export declare function getCurrentUser(): never;
 /** @deprecated Use `auth.user()`. */
 export declare function getServerSession(): never;
-export type { Actor, IdentityProof, TenantUser, CreateResponseFromTenantAssertionOptions, } from "./types.js";
-export { AuthRequiredError, InsufficientRoleError, InsufficientMembershipError, FreshnessRequiredError, FetchAbsoluteUrlError, PrerenderedError, UnknownExportError, SessionBridgeUnverifiedError, IdentityLinkConflictError, UnknownIdentityError, InvalidCredentialsError, TenantSubjectInvalidError, Run402AuthError, } from "./errors.js";
+export type { Actor, IdentityProof, TenantUser, CreateResponseFromTenantAssertionOptions, AccountSecurity, Run402Identity, TenantAssertionRef, } from "./types.js";
+export { AuthRequiredError, InsufficientRoleError, InsufficientMembershipError, FreshnessRequiredError, FetchAbsoluteUrlError, PrerenderedError, UnknownExportError, SessionBridgeUnverifiedError, IdentityLinkConflictError, UnknownIdentityError, InvalidCredentialsError, TenantSubjectInvalidError, RenamedExportError, Run402AuthError, } from "./errors.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAUH,OAAO,EAML,uBAAuB,EAIxB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,KAAK,EACL,iCAAiC,EACjC,wCAAwC,EACxC,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAsJpB,UAAU,mBAAmB;IAC3B;;2DAEuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf;;qBAEiB;IACjB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AA8JD;;;;;yCAKyC;AACzC,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AA2K/D,UAAU,aAAa;IACrB,IAAI,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC9B,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAChF,iBAAiB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EACtC,UAAU,EAAE,CAAC,GACZ,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAC3C,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,SAAS,IAAI,MAAM,CAAC;IACpB,SAAS,IAAI,MAAM,CAAC;IACpB;mFAC+E;IAC/E,kBAAkB,IAAI,uBAAuB,CAAC;IAC9C,UAAU,EAAE;QACV,IAAI,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAChD,CAAC;IACF,QAAQ,EAAE;QACR,0BAA0B,CAAC,IAAI,EAAE,iCAAiC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvF,iCAAiC,CAC/B,IAAI,EAAE,wCAAwC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrB,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;KAClC,CAAC;CACH;AAoDD;;;gEAGgE;AAChE,eAAO,MAAM,IAAI,EAAE,aAiBjB,CAAC;AAEH;;;;;;;;GAQG;AAEH,6DAA6D;AAC7D,wBAAgB,UAAU,IAAI,KAAK,CAElC;AAED,qCAAqC;AACrC,wBAAgB,WAAW,IAAI,KAAK,CAEnC;AAED,qCAAqC;AACrC,wBAAgB,cAAc,IAAI,KAAK,CAEtC;AAED,qCAAqC;AACrC,wBAAgB,gBAAgB,IAAI,KAAK,CAKxC;AA8BD,YAAY,EACV,KAAK,EACL,aAAa,EACb,UAAU,EACV,wCAAwC,GACzC,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,GAChB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAUH,OAAO,EAML,uBAAuB,EAKxB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,eAAe,EACf,KAAK,EACL,iCAAiC,EACjC,wCAAwC,EACxC,mBAAmB,EACpB,MAAM,YAAY,CAAC;AA0JpB,UAAU,mBAAmB;IAC3B;;2DAEuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf;;qBAEiB;IACjB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AA8JD;;;;;yCAKyC;AACzC,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAyb/D,UAAU,aAAa;IACrB,IAAI,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC9B,WAAW,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,WAAW,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAChF,iBAAiB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EACtC,UAAU,EAAE,CAAC,GACZ,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,UAAU,EAAE,CAAC,CAAA;KAAE,CAAC,CAAC;IAC3C,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,SAAS,IAAI,MAAM,CAAC;IACpB,SAAS,IAAI,MAAM,CAAC;IACpB;mFAC+E;IAC/E,kBAAkB,IAAI,uBAAuB,CAAC;IAC9C;;2EAEuE;IACvE,OAAO,EAAE;QACP,WAAW,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;QAC/C,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5C,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5E,iBAAiB,IAAI,OAAO,CAAC;YAAE,aAAa,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxD,QAAQ,EAAE;YACR,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3B,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACzC,GAAG,IAAI,KAAK,CAAC;SACd,CAAC;QACF,UAAU,EAAE;YACV,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3B;;;;;;kFAMsE;YACtE,SAAS,CAAC,IAAI,EAAE;gBACd,QAAQ,EAAE,MAAM,CAAC;gBACjB,WAAW,EAAE,MAAM,CAAC;gBACpB,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;aAC7B,GAAG,OAAO,CAAC;gBAAE,gBAAgB,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAA;aAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SACpE,CAAC;QACF,QAAQ,EAAE;YACR,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3B,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SAC1C,CAAC;KACH,CAAC;IACF,UAAU,EAAE;QACV,IAAI,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAChD,CAAC;IACF,QAAQ,EAAE;QACR,0BAA0B,CAAC,IAAI,EAAE,iCAAiC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvF,iCAAiC,CAC/B,IAAI,EAAE,wCAAwC,GAC7C,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrB,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;KAClC,CAAC;CACH;AAqDD;;;gEAGgE;AAChE,eAAO,MAAM,IAAI,EAAE,aAiBjB,CAAC;AAEH;;;;;;;;GAQG;AAEH,6DAA6D;AAC7D,wBAAgB,UAAU,IAAI,KAAK,CAElC;AAED,qCAAqC;AACrC,wBAAgB,WAAW,IAAI,KAAK,CAEnC;AAED,qCAAqC;AACrC,wBAAgB,cAAc,IAAI,KAAK,CAEtC;AAED,qCAAqC;AACrC,wBAAgB,gBAAgB,IAAI,KAAK,CAKxC;AA8BD,YAAY,EACV,KAAK,EACL,aAAa,EACb,UAAU,EACV,wCAAwC,EACxC,eAAe,EACf,cAAc,EACd,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,4BAA4B,EAC5B,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,eAAe,GAChB,MAAM,aAAa,CAAC"}

package/dist/auth/index.js

@@ -29,11 +29,19 @@
  *   - HTML-vs-JSON failure decisions are made by the gateway middleware
  *     (303 redirect for HTML, 401/403 envelope for JSON). The SDK throws
  *     a typed Error subclass; framework code OR the gateway translates.
- *   - `requireRole` / `requireMembership` always read fresh server-side
- *     grant data — no positive cache (matches D8 + the "instant revocation"
- *     contract). For now we route via `getRole` which the gateway sets
- *     at the routed-function envelope; once the v1.60 grants table lands,
- *     gate helpers will JOIN against it inside the same request.
+ *   - `requireRole` reads the gate-resolved role from the routed-function
+ *     envelope header (`x-run402-user-role`) that the gateway's
+ *     `function-role-gates` middleware sets after resolving the caller
+ *     against the project's OWN role table — the one named in that
+ *     function's deploy-spec `requireRole` gate. It therefore REQUIRES the
+ *     deploy-spec gate: with no gate declared the header is absent and
+ *     `requireRole` throws (fail-closed, indistinguishable from a real
+ *     role mismatch). The gateway role lookup is TTL-cached (default 60s;
+ *     set the gate's `cacheTtl: 0` for a fresh read per request), so
+ *     revocation lag is bounded by that TTL — it is NOT instant.
+ *   - `requireMembership` reads `x-run402-user-membership` symmetrically,
+ *     but the gateway producer for that header is not shipped yet, so it
+ *     currently always throws. Forward API surface only.
  *   - `requireFresh` consults the per-method `amr_times` on the Actor —
  *     a recent password proof does NOT satisfy `{amr: ["passkey"]}`.
  *
@@ -42,7 +50,7 @@
 import { getCurrentContext, requireActiveContext, taintCacheBypass, } from "../runtime-context.js";
 import { config } from "../config.js";
 import jwt from "../lib/jwt.js";
-import { AuthRequiredError, FetchAbsoluteUrlError, FreshnessRequiredError, InsufficientMembershipError, InsufficientRoleError, InvalidCredentialsError, TenantSubjectInvalidError, UnknownExportError, } from "./errors.js";
+import { AuthRequiredError, FetchAbsoluteUrlError, FreshnessRequiredError, InsufficientMembershipError, InsufficientRoleError, InvalidCredentialsError, RenamedExportError, TenantSubjectInvalidError, UnknownExportError, } from "./errors.js";
 import { validateAuthFetchInput } from "./url-validation.js";
 import crypto from "node:crypto";
 // ---------------------------------------------------------------------------
@@ -144,10 +152,13 @@ async function requireUser() {
 }
 async function requireRole(role) {
     const actor = await requireUser();
-    // For v1A wiring: read the gate-resolved role from the routed-function
-    // envelope header set by the gateway middleware. When the v1.60
-    // platform-owned grants table lands, this swaps to a fresh DB read
-    // joined to internal.role_grants.
+    // Read the gate-resolved role from the routed-function envelope header the
+    // gateway's `function-role-gates` middleware (gateway middleware/role-gate.ts)
+    // sets after resolving the caller against the project's OWN role table.
+    // This header is present ONLY when the function declares a `requireRole`
+    // deploy-spec gate; without it `headerRole` is undefined and we throw below
+    // (fail-closed). There is no `internal.role_grants` table — the role lives
+    // in the tenant's own schema, named by the gate spec.
     const ctx = requireActiveContext("auth.requireRole");
     const headerRole = readHeader(ctx.request.headers, "x-run402-user-role");
     if (headerRole === role) {
@@ -161,9 +172,10 @@ function readHeader(headers, name) {
 }
 async function requireMembership(membership) {
     const actor = await requireUser();
-    // Membership shape mirrors role for v1A. The grant table for membership
-    // lands in a separate change (auth-as-sdlc); meanwhile the gateway-side
-    // gate helpers populate `x-run402-user-membership` when configured.
+    // Symmetric to requireRole, reading `x-run402-user-membership`. NOTE: the
+    // gateway producer for this header is not shipped yet, so the header is
+    // always absent and this helper always throws today. Forward API surface;
+    // don't build on it until the membership gate lands.
     const ctx = requireActiveContext("auth.requireMembership");
     const headerMembership = readHeader(ctx.request.headers, "x-run402-user-membership");
     if (headerMembership === membership) {
@@ -415,31 +427,272 @@ async function endResponse() {
 // ---------------------------------------------------------------------------
 // Identity linking.
 // ---------------------------------------------------------------------------
-async function linkIdentity(opts) {
-    const ctx = requireActiveContext("auth.identities.link");
-    await requireUser();
-    const origin = `https://${ctx.host}`;
-    const res = await fetch(`${origin}/auth/v1/identities/link`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(opts),
-        redirect: "manual",
+/** §4.5: the shipped top-level `auth.identities.link` is renamed/moved to
+ *  `auth.account.identities.startLink` (the redirect+proof ceremony that links
+ *  an OAuth identity to the already-signed-in account). Throws
+ *  `R402_AUTH_RENAMED_EXPORT` teaching the move. (It also fetched a gateway
+ *  route that never existed — see #429 — so it was non-functional regardless.) */
+async function linkIdentity(_opts) {
+    throw new RenamedExportError({
+        oldName: "auth.identities.link",
+        newName: "auth.account.identities.startLink",
     });
-    if (res.status === 409) {
-        // The platform route maps unique_violation on
-        // internal.identities (project_id, provider, subject) to 409.
-        throw new (await import("./errors.js")).IdentityLinkConflictError({
-            provider: opts.provider,
-            subject: opts.subject,
+}
+// ---------------------------------------------------------------------------
+// Account security (§4). `getSecurity()` is the everyday rich read; the
+// advanced mutation tier (setPassword / passkeys / sessions / identities) is
+// demoted and lands in a follow-up increment.
+// ---------------------------------------------------------------------------
+/**
+ * The rich settings/security read for the current actor (§4.3). Distinct from
+ * the cheap per-request `auth.user()` — returns the ownership-qualified
+ * `AccountSecurity` projection (has_run402_password, run402_passkey_count,
+ * run402_identities, tenant_assertions, …) or `null` when anonymous.
+ *
+ * Resolves the actor exactly like `auth.user()` (cookie envelope on browser
+ * SSR; Bearer on direct/machine — §4.7/D15), mints a short-lived actor JWT
+ * (the same channel `db()` uses), and fetches the gateway projection route.
+ */
+async function getSecurity() {
+    const ctx = getCurrentContext();
+    if (!ctx)
+        return null;
+    const actor = await user();
+    if (!actor)
+        return null;
+    if (!config.JWT_SECRET)
+        return null;
+    const nowSec = Math.floor(Date.now() / 1000);
+    let token;
+    try {
+        token = jwt.sign({
+            sub: actor.id,
+            role: "authenticated",
+            email: actor.email,
+            project_id: actor.projectId,
+            iss: "agentdb",
+            iat: nowSec,
+            exp: nowSec + 60,
+        }, config.JWT_SECRET);
+    }
+    catch {
+        return null;
+    }
+    // Fetch the gateway (config.API_BASE = RUN402_API_BASE) directly — NOT the
+    // public tenant subdomain (ctx.host). The /auth/v1/account/* routes live on
+    // the gateway; a Lambda-to-subdomain round-trip via CloudFront does not reach
+    // them. `app_origin` still carries the tenant host for rpId validation.
+    const appOrigin = `https://${ctx.host}`;
+    let res;
+    try {
+        res = await fetch(`${config.API_BASE}/auth/v1/account/security?app_origin=${encodeURIComponent(appOrigin)}`, {
+            headers: {
+                apikey: config.ANON_KEY ?? "",
+                authorization: `Bearer ${token}`,
+                accept: "application/json",
+            },
+            redirect: "manual",
         });
     }
+    catch {
+        return null;
+    }
+    if (!res.ok)
+        return null;
+    const data = (await res.json().catch(() => null));
+    if (!data)
+        return null;
+    // The route returns a `user` projection; the SDK overlays the richer Actor.
+    return { ...data, user: actor };
+}
+/** Throwing variant of `getSecurity()` (§4.3). */
+async function requireSecurity() {
+    const security = await getSecurity();
+    if (!security)
+        throw new AuthRequiredError();
+    return security;
+}
+// ---------------------------------------------------------------------------
+// §4.4 advanced account-security mutation tier. Server-side, context-actor
+// only. Each method mints a short-lived actor JWT (same channel as
+// getSecurity) — including `auth_time` so the gateway can enforce freshness
+// callee-side — and calls the Bearer-authed /auth/v1/account/* routes. NOT in
+// the everyday docs; the everyday path is the <AccountSecurity> component.
+// ---------------------------------------------------------------------------
+/** Mint a short-lived actor JWT for an advanced-tier account call. Includes
+ *  `auth_time` (the actor's last-auth from the verified browser-session
+ *  envelope) so the gateway's sensitive-mutation freshness gate can read it. */
+function mintAdvancedActorToken(actor) {
+    if (!config.JWT_SECRET)
+        return null;
+    const nowSec = Math.floor(Date.now() / 1000);
+    try {
+        return jwt.sign({
+            sub: actor.id,
+            role: "authenticated",
+            email: actor.email,
+            project_id: actor.projectId,
+            iss: "agentdb",
+            iat: nowSec,
+            exp: nowSec + 60,
+            auth_time: actor.authTime,
+        }, config.JWT_SECRET);
+    }
+    catch {
+        return null;
+    }
+}
+/** Call a Bearer-authed /auth/v1/account/* route with the context actor's
+ *  minted JWT. Throws AuthRequiredError when anonymous / outside a request,
+ *  FreshnessRequiredError on a freshness 401, and a generic error otherwise. */
+async function accountAdvancedFetch(path, init) {
+    const ctx = getCurrentContext();
+    const actor = ctx ? await user() : null;
+    if (!ctx || !actor)
+        throw new AuthRequiredError();
+    const token = mintAdvancedActorToken(actor);
+    if (!token)
+        throw new AuthRequiredError();
+    // Gateway directly (config.API_BASE), NOT the tenant subdomain (ctx.host) —
+    // the /auth/v1/account/* routes live on the gateway and a Lambda-to-subdomain
+    // round-trip via CloudFront does not reach them (see getSecurity).
+    const res = await fetch(`${config.API_BASE}${path}`, {
+        method: init.method,
+        headers: {
+            apikey: config.ANON_KEY ?? "",
+            authorization: `Bearer ${token}`,
+            accept: "application/json",
+            ...(init.body !== undefined ? { "content-type": "application/json" } : {}),
+        },
+        body: init.body !== undefined ? JSON.stringify(init.body) : undefined,
+        redirect: "manual",
+    });
+    if (res.status === 401) {
+        const data = (await res.json().catch(() => null));
+        if (data?.code === "R402_AUTH_FRESHNESS_REQUIRED") {
+            throw new FreshnessRequiredError({ maxAge: "5m", amr: [] });
+        }
+        throw new AuthRequiredError();
+    }
     if (!res.ok) {
-        const body = await res.json().catch(() => ({}));
-        throw new (await import("./errors.js")).SessionBridgeUnverifiedError({
-            reason: body.code ?? `link failed: ${res.status}`,
-        });
+        throw new Error(`auth.account.* request to ${path} failed: ${res.status}`);
     }
+    return (await res.json().catch(() => ({})));
 }
+/** §4.4 — set or change the signed-in user's Run402 password. Callee-enforced
+ *  freshness (re-auth within 5 min) — throws FreshnessRequiredError otherwise.
+ *  On success the gateway rotates (revokes) the user's other sessions. */
+async function setPassword(newPassword, _opts) {
+    await accountAdvancedFetch("/auth/v1/account/password", {
+        method: "POST",
+        body: { new_password: newPassword },
+    });
+}
+/** §4.4 — sign out of every browser session for the context actor. */
+async function signOutEverywhere() {
+    const out = (await accountAdvancedFetch("/auth/v1/account/sign-out-everywhere", {
+        method: "POST",
+        body: {},
+    }));
+    return { revoked_count: typeof out.revoked_count === "number" ? out.revoked_count : 0 };
+}
+const accountPasskeys = {
+    list: async () => {
+        const out = (await accountAdvancedFetch("/auth/v1/account/passkeys", { method: "GET" }));
+        return out.passkeys ?? [];
+    },
+    remove: async (passkeyId) => {
+        await accountAdvancedFetch("/auth/v1/account/passkeys/remove", {
+            method: "POST",
+            body: { passkey_id: passkeyId },
+        });
+    },
+    /** Passkey registration is a browser WebAuthn ceremony — it cannot run
+     *  server-side. Use `<AccountSecurity sections={["passkeys"]}/>` or the
+     *  hosted `/auth/passkeys/register` flow. */
+    add: () => {
+        throw new Error("auth.account.passkeys.add() can't run server-side: passkey registration is a browser WebAuthn ceremony. Use <AccountSecurity sections={[\"passkeys\"]}/> or the hosted /auth/passkeys/register flow.");
+    },
+};
+const accountIdentities = {
+    list: async () => {
+        const out = (await accountAdvancedFetch("/auth/v1/account/identities", { method: "GET" }));
+        return out.identities ?? [];
+    },
+    /** §4.5 — begin the OAuth link-to-existing-account ceremony. Mints the
+     *  context actor's JWT and calls the gateway `intent:"link"` start route,
+     *  returning the provider authorization URL for the caller to redirect to.
+     *  The resulting identity is written against the signed-in account (NOT a
+     *  new sign-in). `redirectUrl` must be a project-allowed origin. */
+    startLink: async (opts) => {
+        if (!opts?.provider)
+            throw new Error("auth.account.identities.startLink: provider is required");
+        if (!opts?.redirectUrl)
+            throw new Error("auth.account.identities.startLink: redirectUrl is required");
+        const out = (await accountAdvancedFetch(`/auth/v1/oauth/${opts.provider}/start`, {
+            method: "POST",
+            body: { intent: "link", redirect_url: opts.redirectUrl, mode: opts.mode ?? "redirect" },
+        }));
+        if (!out.authorization_url) {
+            throw new Error("auth.account.identities.startLink: gateway returned no authorization_url");
+        }
+        return {
+            authorizationUrl: out.authorization_url,
+            expiresIn: typeof out.expires_in === "number" ? out.expires_in : 600,
+        };
+    },
+    unlink: async (opts) => {
+        await accountAdvancedFetch("/auth/v1/account/identities/unlink", {
+            method: "POST",
+            body: { provider: opts.provider, subject: opts.subject },
+        });
+    },
+};
+const accountSessions = {
+    list: async () => {
+        const out = (await accountAdvancedFetch("/auth/v1/account/sessions", { method: "GET" }));
+        return out.sessions ?? [];
+    },
+    revoke: async (sessionId) => {
+        await accountAdvancedFetch("/auth/v1/account/sessions/revoke", {
+            method: "POST",
+            body: { session_id: sessionId },
+        });
+    },
+};
+/** `auth.account.*` proxy — `getSecurity`/`requireSecurity` (everyday read) +
+ *  the §4.4 advanced mutation members (`setPassword`, `passkeys`, `identities`,
+ *  `sessions`, `signOutEverywhere`) are the real members; the shipped throwing
+ *  names (`get`, `signIn`, `login`, `currentUser`) and typos throw the
+ *  structured unknown-export error (§4.6). */
+const ACCOUNT_HALLUCINATED_NAMES = {
+    get: "auth.account.getSecurity() / auth.account.requireSecurity()",
+    signIn: "auth.sessions.createResponseFromTenantAssertion({...}) / createResponseFromIdentity({...})",
+    login: "auth.sessions.createResponseFromTenantAssertion({...})",
+    currentUser: "auth.user()",
+    user: "auth.user()",
+};
+const baseAccount = {
+    getSecurity,
+    requireSecurity,
+    setPassword,
+    signOutEverywhere,
+    passkeys: accountPasskeys,
+    identities: accountIdentities,
+    sessions: accountSessions,
+};
+const account = new Proxy(baseAccount, {
+    get(target, prop, receiver) {
+        if (typeof prop === "string" && !(prop in target)) {
+            throw new UnknownExportError({
+                attemptedName: `auth.account.${prop}`,
+                canonicalName: ACCOUNT_HALLUCINATED_NAMES[prop] ??
+                    "auth.account.getSecurity() / auth.account.requireSecurity()",
+            });
+        }
+        return Reflect.get(target, prop, receiver);
+    },
+});
 // ---------------------------------------------------------------------------
 // SDK proxy intercepting hallucinated names.
 // ---------------------------------------------------------------------------
@@ -503,6 +756,7 @@ const baseAuth = {
     csrfToken,
     csrfField,
     invalidCredentials,
+    account,
     identities: {
         link: linkIdentity,
     },
@@ -581,5 +835,5 @@ function currentReturnTo() {
         return undefined;
     return ctx.request.url;
 }
-export { AuthRequiredError, InsufficientRoleError, InsufficientMembershipError, FreshnessRequiredError, FetchAbsoluteUrlError, PrerenderedError, UnknownExportError, SessionBridgeUnverifiedError, IdentityLinkConflictError, UnknownIdentityError, InvalidCredentialsError, TenantSubjectInvalidError, Run402AuthError, } from "./errors.js";
+export { AuthRequiredError, InsufficientRoleError, InsufficientMembershipError, FreshnessRequiredError, FetchAbsoluteUrlError, PrerenderedError, UnknownExportError, SessionBridgeUnverifiedError, IdentityLinkConflictError, UnknownIdentityError, InvalidCredentialsError, TenantSubjectInvalidError, RenamedExportError, Run402AuthError, } from "./errors.js";
 //# sourceMappingURL=index.js.map