@spfn/auth 0.2.0-beta.90 → 0.2.0-beta.91

package/dist/{session-CFK4BT25.d.ts → session-DTHahDQ9.d.ts}

@@ -1,4 +1,4 @@
-import { K as KeyAlgorithmType } from './types-CD95yudz.js';
+import { K as KeyAlgorithmType } from './types-DYyhze28.js';
 
 /**
  * @spfn/auth - Client Session Management

package/dist/{types-CD95yudz.d.ts → types-DYyhze28.d.ts}

@@ -95,4 +95,4 @@ declare const PURGE_STRATEGIES: readonly ["anonymize", "hard-delete"];
  */
 type PurgeStrategy = typeof PURGE_STRATEGIES[number];
 
-export { ACCOUNT_DELETION_REQUEST_STATUSES as A, INVITATION_STATUSES as I, type KeyAlgorithmType as K, PURGE_STRATEGIES as P, SOCIAL_PROVIDERS as S, USER_STATUSES as U, KEY_ALGORITHM as a, ACCOUNT_DELETION_REQUESTED_BY as b, KEY_PLATFORM as c, type KeyPlatformType as d, KEY_DEVICE_NAME_MAX_LENGTH as e, type InvitationStatus as f, type UserStatus as g, type SocialProvider as h, type AccountDeletionRequestStatus as i, type AccountDeletionRequestedBy as j, type PurgeStrategy as k };
+export { ACCOUNT_DELETION_REQUESTED_BY as A, INVITATION_STATUSES as I, type KeyAlgorithmType as K, PURGE_STRATEGIES as P, SOCIAL_PROVIDERS as S, USER_STATUSES as U, ACCOUNT_DELETION_REQUEST_STATUSES as a, type AccountDeletionRequestStatus as b, type AccountDeletionRequestedBy as c, type InvitationStatus as d, KEY_ALGORITHM as e, KEY_DEVICE_NAME_MAX_LENGTH as f, KEY_PLATFORM as g, type KeyPlatformType as h, type PurgeStrategy as i, type SocialProvider as j, type UserStatus as k };

package/dist/wire-version-CtzMKvBB.d.ts

@@ -0,0 +1,134 @@
+/** The six wire codes. The SDKs classify by code, never HTTP status. */
+type ClientProofErrorCode = 'PROOF_INVALID' | 'PROOF_REPLAYED' | 'PROOF_EXPIRED' | 'SESSION_REVOKED' | 'PROFILE_REJECTED' | 'CONTRACT_UNSUPPORTED';
+/** 128 random bits as lowercase base16 — request ids and control tokens. */
+declare function newHexId(): string;
+declare class ClientProofRefusal {
+    readonly code: ClientProofErrorCode;
+    readonly message: string;
+    constructor(code: ClientProofErrorCode, message: string);
+    get httpStatus(): number;
+    /** The canonical bytes of `{"error":{"code":…,"message":…,"requestId":…}}`. */
+    envelopeBytes(requestId: string): Uint8Array;
+    /** Nothing request-derived reaches a log through this. */
+    toString(): string;
+    static unroutable(): ClientProofRefusal;
+    static malformedHeaders(): ClientProofRefusal;
+    static missingContentType(): ClientProofRefusal;
+    static bodyTooLarge(): ClientProofRefusal;
+    /**
+     * The body parsed but its bytes are not the canonical form of what it
+     * parsed to. Not PROOF_INVALID even though it is discovered next to the
+     * proof: the proof over these bytes verifies perfectly well, and an
+     * auth-family answer would tell the client to re-handshake and send the
+     * same non-canonical bytes again.
+     */
+    static bodyNotCanonical(): ClientProofRefusal;
+    static bodyNotTheDeclaredType(): ClientProofRefusal;
+    static sessionHeaderMisplaced(): ClientProofRefusal;
+    static unprocessable(): ClientProofRefusal;
+    /**
+     * A client that ships separately from the server said nothing about which
+     * contract it was built against. Without it the server cannot tell whether
+     * the two ends agree, and answering as though they do is what produces the
+     * undecodable body this check exists to replace.
+     */
+    static contractVersionMissing(): ClientProofRefusal;
+    static contractVersionUnsupported(): ClientProofRefusal;
+    static profileRejected(): ClientProofRefusal;
+    /**
+     * A request that names a profile and presents Bearer credentials as well.
+     * The profile named is a real one, so this is not a shape the two ends
+     * disagree about: the request asked to be authenticated two ways at once
+     * and the profile it named is the one refused.
+     */
+    static credentialsMixed(): ClientProofRefusal;
+    static sessionRevoked(): ClientProofRefusal;
+    static proofExpired(): ClientProofRefusal;
+    static proofReplayed(): ClientProofRefusal;
+    static proofInvalid(): ClientProofRefusal;
+}
+
+/**
+ * The header names each end announces itself under.
+ *
+ * Separated from the logic that reads them so the contract bundle can name them
+ * without importing the version comparison, which reads the bundle back. These
+ * are declarations and depend on nothing.
+ *
+ * @module server/client-proof/wire-headers
+ */
+/** What a client says about itself, one header each. */
+declare const CLIENT_IDENTITY_HEADERS: {
+    readonly kind: "x-spfn-client-kind";
+    readonly version: "x-spfn-client-version";
+    readonly contractVersion: "x-spfn-client-contract-version";
+};
+/**
+ * What the server says about itself, on every response.
+ *
+ * Distinct names from the request headers on purpose: a proxy that echoes a
+ * request header into the response would otherwise make the client's own
+ * version look like the server's.
+ */
+declare const SERVER_CONTRACT_HEADERS: {
+    readonly version: "x-spfn-server-contract-version";
+    readonly supportedRange: "x-spfn-supported-contract-range";
+};
+/**
+ * The client kinds the server distinguishes.
+ *
+ * `web` is separated from the two app kinds because it carries no contract
+ * version: a browser bundle is deployed with the server that serves it, so
+ * there is no second version to reconcile.
+ */
+declare const CLIENT_KINDS: readonly ["web", "ios", "android"];
+type ClientKind = typeof CLIENT_KINDS[number];
+/** A kind that ships independently of the server, so its contract version matters. */
+declare function isAppKind(kind: ClientKind): boolean;
+
+/** What one request announced about the client that sent it. */
+interface ClientIdentity {
+    kind: ClientKind;
+    /** The client's own release — a store version, or a bundle build. */
+    version: string | null;
+    /** The contract version the client was generated from. Never set for `web`. */
+    contractVersion: string | null;
+}
+/**
+ * Reads the identity headers, or null when the kind is absent or unrecognised.
+ *
+ * Null is not by itself a refusal — a request from something that predates
+ * these headers reaches here too. `judgeClientIdentity` decides.
+ */
+declare function readClientIdentity(headers: Headers): ClientIdentity | null;
+/**
+ * Whether the server serves what the client was generated against.
+ *
+ * Under 0.x the minor carries breaking changes, so a supported client agrees on
+ * major and minor. From 1.0.0 the major alone decides. This is the rule
+ * `CONTRACT_SUPPORTED_RANGE` spells out; keeping it as a comparison rather than
+ * parsing that string leaves one place to change when the line reaches 1.0.0.
+ */
+declare function isContractVersionSupported(clientVersion: string): boolean;
+/**
+ * The refusal a request's announced identity earns, or null to let it through.
+ *
+ * An app kind must state a contract version this server serves. A version it
+ * does not serve, and the absence of one, are the same answer: the two ends do
+ * not agree on what the contract is, which is what CONTRACT_UNSUPPORTED means.
+ * The response carries the server's version and range, so the client can say
+ * which way the gap runs.
+ *
+ * `web` is exempt from the contract check by construction, not by leniency.
+ *
+ * A request with no recognised kind passes. The check is on what a client says
+ * about itself, and a caller that says nothing — a curl, a health probe, a
+ * server-to-server call — is not a deployed client this rule is about.
+ */
+declare function judgeClientIdentity(identity: ClientIdentity | null): ClientProofRefusal | null;
+/** Writes the server's own announcement onto a response's headers. */
+declare function applyServerContractHeaders(headers: Headers): void;
+/** The same announcement as a plain object, for a response built from one. */
+declare function serverContractHeaders(): Record<string, string>;
+
+export { ClientProofRefusal as C, SERVER_CONTRACT_HEADERS as S, CLIENT_IDENTITY_HEADERS as a, CLIENT_KINDS as b, type ClientIdentity as c, type ClientKind as d, type ClientProofErrorCode as e, applyServerContractHeaders as f, isContractVersionSupported as g, isAppKind as i, judgeClientIdentity as j, newHexId as n, readClientIdentity as r, serverContractHeaders as s };

package/migrations/20260805143152_vengeful_ravenous/migration.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "spfn_auth"."user_public_keys" ADD COLUMN "client_kind" text;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_public_keys" ADD COLUMN "client_version" text;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_public_keys" ADD COLUMN "client_contract_version" text;--> statement-breakpoint
+ALTER TABLE "spfn_auth"."user_public_keys" ADD COLUMN "client_seen_at" timestamp with time zone;