@urun-sh/next 0.2.37 → 0.2.39

package/dist/index.d.cts

@@ -55,9 +55,13 @@ declare function resolveCredential(env?: Record<string, string | undefined>): Pr
  * SECURITY MODEL of the per-request body: the browser may only NARROW the
  * scope your options configured — request a SUBSET of a configured function /
  * origin allowlist, LOWER the expiry, and maxSessionS folds by MIN. It can
- * never widen anything, and it can never choose its own `subject` (identity
- * is server-derived via `options.subject`, defaulting to a random subject per
- * token so distinct end-users never share a session).
+ * never widen anything, and it can never choose its own `subject`. Identity
+ * is server-derived: `options.subject` when configured, otherwise the ONE
+ * fixed {@link DEFAULT_ONRAMP_SUBJECT} — the dev/single-identity setup, where
+ * every tab and browser is the SAME user sharing ONE session. Real multi-user
+ * identity comes from your own auth provider: derive per-user subjects in
+ * `options.subject` from your auth session, or set up your own JWTs via the
+ * org trusted-JWKS path and skip the onramp mint entirely.
  *
  * SECURITY MODEL of the route itself: `options.authorize` is required and
  * must return true before the route mints a token.
@@ -65,6 +69,21 @@ declare function resolveCredential(env?: Record<string, string | undefined>): Pr
 
 /** The standard env secret the route reads the org API key from. */
 declare const URUN_API_KEY_ENV = "URUN_API_KEY";
+/**
+ * The subject every token carries when `options.subject` is absent (or
+ * returns undefined): ONE fixed, deterministic identity — never random.
+ * Owner ruling 2026-07-17: "not per browser SINGLE SUBJECT, full stop. this
+ * is a dev setup. user wants > 1 user? setup the proper auth provider with
+ * your own jwts and trust them."
+ *
+ * The platform enforces one session per user per app function keyed on the
+ * token subject; a random per-token subject made two dials from the SAME
+ * browser look like different users, so the reconnect invariant could never
+ * fire. With this constant, every tab/browser hitting the onramp route is the
+ * SAME user: a dev app has ONE session and every dial reconnects to it.
+ * Tokens are org-scoped, so the literal constant never collides across orgs.
+ */
+declare const DEFAULT_ONRAMP_SUBJECT = "onramp";
 /**
  * Canonical env var names carrying a frontend's session-plane config — the
  * values `urun deploy` writes into `frontend/.env.local` and `urun dev`
@@ -116,9 +135,14 @@ interface UrunTokenRouteOptions extends Omit<CreateClientTokenOptions, 'fetch' |
     authorize: (request: Request | UrunTokenPagesRequest) => boolean | Promise<boolean>;
     /**
      * Derive a STABLE per-end-user subject from the request (e.g. your auth
-     * session). A stable subject coalesces one user's tabs into one session;
-     * omitted, every token gets a random subject (users never share sessions).
-     * The browser body can never set this.
+     * session). A stable subject coalesces one user's tabs into one session.
+     * Omitted (or returning undefined), the route sends the ONE fixed
+     * {@link DEFAULT_ONRAMP_SUBJECT}: the dev/single-identity setup — every
+     * tab and browser is the SAME user, sharing ONE session. Real multi-user
+     * identity comes from your own auth provider: derive per-user subjects
+     * here from your auth session, or set up your own JWTs via the org
+     * trusted-JWKS path and skip the onramp mint entirely. The browser body
+     * can never set this.
      */
     subject?: (request: Request) => string | undefined | Promise<string | undefined>;
     /** Fetch override (tests / custom agents). */
@@ -200,4 +224,4 @@ declare function createTokenRoute(options?: CreateTokenRouteOptions): (request:
  */
 declare function urunTokenPagesHandler(options: UrunTokenRouteOptions): (req: UrunTokenPagesRequest, res: UrunTokenPagesResponse) => Promise<void>;
 
-export { type CreateTokenRouteOptions, type CreateTokenRouteResponseBody, MissingCredentialError, URUN_API_KEY_ENV, URUN_API_URL_ENV, URUN_APP_ENV, URUN_FUNCTION_ENV, URUN_GATEWAY_URL_ENV, type UrunSessionConfig, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, createTokenRoute, resolveCredential, urunSessionConfig, urunTokenPagesHandler, urunTokenRoute };
+export { type CreateTokenRouteOptions, type CreateTokenRouteResponseBody, DEFAULT_ONRAMP_SUBJECT, MissingCredentialError, URUN_API_KEY_ENV, URUN_API_URL_ENV, URUN_APP_ENV, URUN_FUNCTION_ENV, URUN_GATEWAY_URL_ENV, type UrunSessionConfig, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, createTokenRoute, resolveCredential, urunSessionConfig, urunTokenPagesHandler, urunTokenRoute };

package/dist/index.d.ts

@@ -15,6 +15,8 @@ declare function resolveCredential(env?: Record<string, string | undefined>): Pr
 
 declare const URUN_API_KEY_ENV = "URUN_API_KEY";
 
+declare const DEFAULT_ONRAMP_SUBJECT = "onramp";
+
 declare const URUN_GATEWAY_URL_ENV = "URUN_GATEWAY_URL";
 
 declare const URUN_API_URL_ENV = "URUN_API_URL";
@@ -73,4 +75,4 @@ declare function createTokenRoute(options?: CreateTokenRouteOptions): (request:
 
 declare function urunTokenPagesHandler(options: UrunTokenRouteOptions): (req: UrunTokenPagesRequest, res: UrunTokenPagesResponse) => Promise<void>;
 
-export { type CreateTokenRouteOptions, type CreateTokenRouteResponseBody, MissingCredentialError, URUN_API_KEY_ENV, URUN_API_URL_ENV, URUN_APP_ENV, URUN_FUNCTION_ENV, URUN_GATEWAY_URL_ENV, type UrunSessionConfig, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, createTokenRoute, resolveCredential, urunSessionConfig, urunTokenPagesHandler, urunTokenRoute };
+export { type CreateTokenRouteOptions, type CreateTokenRouteResponseBody, DEFAULT_ONRAMP_SUBJECT, MissingCredentialError, URUN_API_KEY_ENV, URUN_API_URL_ENV, URUN_APP_ENV, URUN_FUNCTION_ENV, URUN_GATEWAY_URL_ENV, type UrunSessionConfig, type UrunTokenPagesRequest, type UrunTokenPagesResponse, type UrunTokenResponseBody, type UrunTokenRouteOptions, createTokenRoute, resolveCredential, urunSessionConfig, urunTokenPagesHandler, urunTokenRoute };