@vendoai/vendo 0.4.0

package/dist/auth-presets/conformance.d.ts

@@ -0,0 +1,42 @@
+import { type AuthMaterial, type PermissionGrant } from "@vendoai/core";
+import type { ConformanceSuite } from "@vendoai/core/conformance";
+import type { HostAuthPreset } from "./shared.js";
+/**
+ * 09-vendo §2.1 — executable three-seam checks for a HostAuthPreset: the preset
+ * must behave exactly like the hand-written per-seam trio it replaces. Built on
+ * the core conformance kit's framework-agnostic shape (`@vendoai/core/conformance`),
+ * so every named preset (authJs today; clerk/supabase/auth0/jwt as they land)
+ * runs the SAME suite: mount with `for (const c of suite.cases) it(c.name, c.run)`
+ * or execute via `runConformance`.
+ *
+ * The suite asserts host-integrated behavior — the preset under test must be
+ * configured with a subject→user resolver (or provider-side equivalent) that
+ * knows `knownSubject` and has never issued `unknownSubject`.
+ */
+export interface HostAuthPresetConformanceOptions {
+    preset: HostAuthPreset;
+    /** Build a wire Request carrying a VALID host session for the subject. */
+    sessionRequest(subject: string): Request | Promise<Request>;
+    /** A request with no host session. Default: a bare GET with no credentials. */
+    anonymousRequest?(): Request;
+    /** A subject the host knows: sessions resolve, actAs mints, the door resolves. */
+    knownSubject: string;
+    /** A subject the host never issued: actAs declines, the door's lookup returns null. */
+    unknownSubject: string;
+    /** When set, principals resolved for `knownSubject` must carry exactly this display. */
+    expectedDisplay?: string;
+    /** The grant actAs minting is exercised with. Default: a standing tool grant
+        for the subject under test. */
+    grant?(subject: string): PermissionGrant;
+    /** Out-of-band verification for the actAs round-trip case. Cookie-minting
+        presets (authJs, supabase, jwt) mint AuthMaterial their own `principal`
+        resolver accepts, so the default round-trips through it — but
+        producer/verify-split systems (clerk/auth0, 04 §2.1) mint away-tokens whose
+        verifier is host-mounted middleware, not the preset. Supply the split
+        system's verify half here; return the verified subject, or null when
+        verification rejects the material. */
+    verifyActAs?(material: AuthMaterial): Promise<string | null> | string | null;
+}
+/** Executable HostAuthPreset checks from 09-vendo §2.1 (plus 01-core §13 for the
+    actAs half and 10-mcp §3 for the oauth half). */
+export declare function hostAuthPresetConformance(opts: HostAuthPresetConformanceOptions): ConformanceSuite;

package/dist/auth-presets/conformance.js

@@ -0,0 +1,139 @@
+import { authMaterialSchema, principalSchema } from "@vendoai/core";
+const assert = (condition, message) => {
+    if (!condition)
+        throw new Error(message);
+};
+const defaultAnonymousRequest = () => new Request("https://host.conformance.test/api/vendo/threads");
+/** The deployment's public origin, computed exactly the way the presets do:
+    the operator-set VENDO_BASE_URL when configured (empty string = unset, the
+    umbrella's `environment()` semantics), else the request's own origin. Kept
+    env-aware so the redirect case passes on CORRECT preset behavior whether or
+    not the suite's runner has VENDO_BASE_URL in its environment. */
+const publicOrigin = (request) => {
+    const base = typeof process === "undefined" ? undefined : process.env["VENDO_BASE_URL"];
+    if (base !== undefined && base.length > 0) {
+        try {
+            return new URL(base).origin;
+        }
+        catch {
+            // An unparseable base is an env misconfiguration; fall back to the
+            // request origin rather than failing the case on the harness's env.
+        }
+    }
+    return new URL(request.url).origin;
+};
+const defaultGrant = (subject) => ({
+    id: "grt_host_auth_preset_conformance",
+    subject,
+    tool: "host_conformance",
+    descriptorHash: "sha256:host-auth-preset-conformance",
+    scope: { kind: "tool" },
+    duration: "standing",
+    source: "automation",
+    grantedAt: "2026-07-18T00:00:00.000Z",
+});
+const assertKnownPrincipal = (resolved, opts, seam) => {
+    assert(resolved !== null, `${seam} returned null for the known subject`);
+    const parsed = principalSchema.safeParse(resolved);
+    assert(parsed.success, `${seam} returned an invalid Principal`);
+    assert(parsed.data.subject === opts.knownSubject, `${seam} resolved the wrong subject: ${parsed.data.subject}`);
+    if (opts.expectedDisplay !== undefined) {
+        assert(parsed.data.display === opts.expectedDisplay, `${seam} display was ${String(parsed.data.display)}, expected ${opts.expectedDisplay}`);
+    }
+};
+/** Executable HostAuthPreset checks from 09-vendo §2.1 (plus 01-core §13 for the
+    actAs half and 10-mcp §3 for the oauth half). */
+export function hostAuthPresetConformance(opts) {
+    const anonymousRequest = opts.anonymousRequest ?? defaultAnonymousRequest;
+    const grantFor = opts.grant ?? defaultGrant;
+    const requireActAs = () => {
+        assert(opts.preset.actAs !== undefined, "preset has no actAs half");
+        return opts.preset.actAs;
+    };
+    const requireOauth = () => {
+        assert(opts.preset.oauth !== undefined, "preset has no oauth half");
+        return opts.preset.oauth;
+    };
+    return {
+        seam: "HostAuthPreset",
+        cases: [
+            {
+                name: "09 §2.1 — principal resolves a live session request to the known subject",
+                async run() {
+                    const resolved = await opts.preset.principal(await opts.sessionRequest(opts.knownSubject));
+                    assertKnownPrincipal(resolved, opts, "principal");
+                },
+            },
+            {
+                name: "09 §2.1 — principal resolves a sessionless request to null (ephemeral anonymous)",
+                async run() {
+                    assert(await opts.preset.principal(anonymousRequest()) === null, "principal did not resolve a sessionless request to null");
+                },
+            },
+            {
+                name: "01-core §13 — actAs mints AuthMaterial the preset's verification accepts (round-trip)",
+                async run() {
+                    const material = await requireActAs()({ kind: "user", subject: opts.knownSubject }, grantFor(opts.knownSubject));
+                    assert(material !== null, "actAs declined the known subject");
+                    const parsed = authMaterialSchema.safeParse(material);
+                    assert(parsed.success, "actAs returned invalid AuthMaterial");
+                    if (opts.verifyActAs !== undefined) {
+                        // Producer/verify-split systems (clerk/auth0): the mint is real iff
+                        // the host-mounted verify half accepts it and yields the subject.
+                        const subject = await opts.verifyActAs(parsed.data);
+                        assert(subject !== null, "actAs round-trip verification rejected the minted material");
+                        assert(subject === opts.knownSubject, `actAs round-trip verified the wrong subject: ${subject}`);
+                        return;
+                    }
+                    // The mint is real iff the preset's own session lookup accepts it —
+                    // the same round-trip the doctor actAs probe drives over the wire.
+                    const authed = new Request("https://host.conformance.test/api/vendo/doctor/act-as/echo", {
+                        headers: parsed.data.headers,
+                    });
+                    assertKnownPrincipal(await opts.preset.principal(authed), opts, "actAs round-trip principal");
+                },
+            },
+            {
+                name: "01-core §13 — actAs declines a subject the host never issued",
+                async run() {
+                    const material = await requireActAs()({ kind: "user", subject: opts.unknownSubject }, grantFor(opts.unknownSubject));
+                    assert(material === null, "actAs minted material for an unknown subject");
+                },
+            },
+            {
+                name: "10-mcp §3 — oauth.session returns the subject for a live session",
+                async run() {
+                    const returnTo = "https://host.conformance.test/api/vendo/mcp/authorize?state=xyz";
+                    const result = await requireOauth().session?.(await opts.sessionRequest(opts.knownSubject), { returnTo });
+                    assert(result !== undefined, "preset oauth half has no session lookup");
+                    assert(!(result instanceof Response), "oauth.session redirected a live session");
+                    assert(result.subject === opts.knownSubject, `oauth.session resolved the wrong subject: ${result.subject}`);
+                },
+            },
+            {
+                name: "10-mcp §3 — oauth.session redirects a sessionless request to login carrying returnTo",
+                async run() {
+                    const request = anonymousRequest();
+                    const returnTo = "https://host.conformance.test/api/vendo/mcp/authorize?state=xyz";
+                    const result = await requireOauth().session?.(request, { returnTo });
+                    assert(result !== undefined, "preset oauth half has no session lookup");
+                    assert(result instanceof Response, "oauth.session did not redirect a sessionless request");
+                    assert(result.status >= 300 && result.status < 400, `oauth.session returned status ${result.status}, not a redirect`);
+                    const location = result.headers.get("location");
+                    assert(location !== null, "oauth.session redirect carries no location");
+                    const target = new URL(location);
+                    assert(target.origin === publicOrigin(request), `oauth.session redirected off the deployment's public origin: ${target.origin}`);
+                    assert(target.searchParams.get("returnTo") === returnTo, "oauth.session redirect does not carry the returnTo that resumes authorization");
+                },
+            },
+            {
+                name: "10-mcp §3 — oauth.principal resolves the known subject and returns null for an unknown one",
+                async run() {
+                    const oauth = requireOauth();
+                    assertKnownPrincipal(await oauth.principal(opts.knownSubject), opts, "oauth.principal");
+                    assert(await oauth.principal(opts.unknownSubject) === null, "oauth.principal resolved a subject the host never issued");
+                },
+            },
+        ],
+    };
+}

package/dist/auth-presets/identity.d.ts

@@ -0,0 +1,56 @@
+import type { SecretSource } from "@vendoai/actions/presets";
+import type { ActAs, PermissionGrant, Principal } from "@vendoai/core";
+import type { HostAuthPreset, HostAuthPresetUser, HostAuthPresetUserResolver } from "./shared.js";
+/** Internal machinery shared by the named host-identity presets (09 §2.1).
+    authJs (the template preset) predates this file and keeps its own copy of
+    the same moves; the public surface stays the preset functions themselves. */
+export type JwtClaims = Record<string, unknown>;
+export declare function claimString(claims: JwtClaims, key: string): string | undefined;
+/** The presets' default claims→user mapping: display from the `name` claim,
+    falling back to `email`; email from `email` (feeds actAs claims only). */
+export declare function userFromNameEmailClaims(claims: JwtClaims): HostAuthPresetUser;
+/** One identity lookup for all three seams: the host's subject→user resolver
+    when configured (null = subject unknown → decline), else the system's
+    claims-derived defaults. `claims` is {} where no token exists (actAs
+    minting, the door's subject lookup). */
+export declare function makeUserResolver(user: HostAuthPresetUserResolver | undefined, defaults: (claims: JwtClaims) => HostAuthPresetUser): (subject: string, claims: JwtClaims) => Promise<HostAuthPresetUser | null>;
+/** Bridge the subject→user resolver into an actions-preset claims resolver:
+    null still declines the mint; display/email become session claims. */
+export declare function actAsClaimsFromUser(user: HostAuthPresetUserResolver, toClaims?: (resolved: HostAuthPresetUser) => JwtClaims): (principal: Principal, grant: PermissionGrant) => Promise<JwtClaims | null>;
+/** Per-call secret resolution (authJs's resolveAuthSecret pattern): default to
+    the system's own env variable, resolved lazily so composition order never
+    races env loading; absence fails loud with the fix in hand. */
+export declare function resolvePresetSecret(source: SecretSource | undefined, environmentName: string | undefined, missingMessage: string): Promise<string>;
+/** The operator-set public origin (VENDO_BASE_URL) or, failing that, the
+    request's own origin — mirrors authJs and how the door derives its URLs. */
+export declare function publicOrigin(request: Request): URL;
+export declare function requestCookies(request: Request): [name: string, value: string][];
+export declare function cookieValue(request: Request, name: string): string | undefined;
+export declare function bearerToken(request: Request): string | undefined;
+/** Optional-SDK loader mirroring authJs's loadGetToken: cached on success,
+    reset on failure so a later call retries after an install, and an import
+    failure surfaces the actionable install instruction, never a bare
+    module-not-found. */
+export declare function lazyModule<T>(load: () => Promise<T>, missingMessage: string): () => Promise<T>;
+/** ActAs built lazily on FIRST MINT and cached (authJs's pattern, its
+    TokenCache surviving across calls): env-dependent secrets and posture
+    resolve at use time, never racing env loading at composition. */
+export declare function lazyActAs(build: () => ActAs): ActAs;
+/** /login?returnTo= on the deployment's public origin (authJs parity). Systems
+    whose own convention demands it pass a different path (Clerk's /sign-in,
+    Auth0's /auth/login) or extra params — never a new preset option. */
+export declare function loginRedirect(request: Request, returnTo: string, path?: string, extraParams?: Record<string, string>): Response;
+export interface ComposeHostAuthPresetOptions {
+    /** Decode + verify the request's host session; null = no/invalid session. */
+    sessionClaims(request: Request): Promise<JwtClaims | null>;
+    /** One identity lookup for all three seams ({} claims where none exist). */
+    resolveUser(subject: string, claims: JwtClaims): Promise<HostAuthPresetUser | null>;
+    actAs: ActAs;
+    /** The sessionless-door redirect (10-mcp §3). */
+    login(request: Request, returnTo: string): Response;
+}
+/** The three-seam shape every named preset shares (authJs is the template):
+    only session decoding, identity defaults, the mint, and the login target
+    differ per system. The door's oauth half owns consent/CSRF/replay; this
+    only supplies session lookup + subject resolution (10-mcp §3). */
+export declare function composeHostAuthPreset(opts: ComposeHostAuthPresetOptions): HostAuthPreset;

package/dist/auth-presets/identity.js

@@ -0,0 +1,152 @@
+import { environment } from "../wire/shared.js";
+export function claimString(claims, key) {
+    const value = claims[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+/** The presets' default claims→user mapping: display from the `name` claim,
+    falling back to `email`; email from `email` (feeds actAs claims only). */
+export function userFromNameEmailClaims(claims) {
+    const email = claimString(claims, "email");
+    const display = claimString(claims, "name") ?? email;
+    return {
+        ...(display === undefined ? {} : { display }),
+        ...(email === undefined ? {} : { email }),
+    };
+}
+/** One identity lookup for all three seams: the host's subject→user resolver
+    when configured (null = subject unknown → decline), else the system's
+    claims-derived defaults. `claims` is {} where no token exists (actAs
+    minting, the door's subject lookup). */
+export function makeUserResolver(user, defaults) {
+    return async (subject, claims) => (user !== undefined ? user(subject, claims) : defaults(claims));
+}
+/** Bridge the subject→user resolver into an actions-preset claims resolver:
+    null still declines the mint; display/email become session claims. */
+export function actAsClaimsFromUser(user, toClaims = (resolved) => ({
+    ...(resolved.display === undefined ? {} : { name: resolved.display }),
+    ...(resolved.email === undefined ? {} : { email: resolved.email }),
+})) {
+    return async (principal) => {
+        const resolved = await user(principal.subject, {});
+        return resolved === null ? null : toClaims(resolved);
+    };
+}
+/** Per-call secret resolution (authJs's resolveAuthSecret pattern): default to
+    the system's own env variable, resolved lazily so composition order never
+    races env loading; absence fails loud with the fix in hand. */
+export async function resolvePresetSecret(source, environmentName, missingMessage) {
+    const value = source === undefined
+        ? (environmentName === undefined ? undefined : environment(environmentName))
+        : typeof source === "function"
+            ? await source()
+            : source;
+    if (value === undefined || value.length === 0) {
+        throw new Error(missingMessage);
+    }
+    return value;
+}
+/** The operator-set public origin (VENDO_BASE_URL) or, failing that, the
+    request's own origin — mirrors authJs and how the door derives its URLs. */
+export function publicOrigin(request) {
+    return new URL(environment("VENDO_BASE_URL") ?? request.url);
+}
+export function requestCookies(request) {
+    const header = request.headers.get("cookie");
+    if (header === null)
+        return [];
+    const entries = [];
+    for (const part of header.split(";")) {
+        const separator = part.indexOf("=");
+        if (separator === -1)
+            continue;
+        const name = part.slice(0, separator).trim();
+        if (name.length === 0)
+            continue;
+        let value = part.slice(separator + 1).trim();
+        try {
+            value = decodeURIComponent(value);
+        }
+        catch {
+            // Not URI-encoded — keep the raw value.
+        }
+        entries.push([name, value]);
+    }
+    return entries;
+}
+export function cookieValue(request, name) {
+    return requestCookies(request).find(([cookieName]) => cookieName === name)?.[1];
+}
+export function bearerToken(request) {
+    const header = request.headers.get("authorization");
+    const match = header === null ? null : /^Bearer\s+(\S+)$/i.exec(header.trim());
+    return match?.[1];
+}
+/** Optional-SDK loader mirroring authJs's loadGetToken: cached on success,
+    reset on failure so a later call retries after an install, and an import
+    failure surfaces the actionable install instruction, never a bare
+    module-not-found. */
+export function lazyModule(load, missingMessage) {
+    let cached;
+    return () => {
+        cached ??= load().then((loaded) => loaded, (cause) => {
+            cached = undefined; // let a later call retry after an install
+            throw new Error(missingMessage, { cause: cause });
+        });
+        return cached;
+    };
+}
+/** ActAs built lazily on FIRST MINT and cached (authJs's pattern, its
+    TokenCache surviving across calls): env-dependent secrets and posture
+    resolve at use time, never racing env loading at composition. */
+export function lazyActAs(build) {
+    let mint;
+    return async (principal, grant) => (mint ??= build())(principal, grant);
+}
+/** /login?returnTo= on the deployment's public origin (authJs parity). Systems
+    whose own convention demands it pass a different path (Clerk's /sign-in,
+    Auth0's /auth/login) or extra params — never a new preset option. */
+export function loginRedirect(request, returnTo, path = "/login", extraParams = {}) {
+    const login = new URL(path, publicOrigin(request));
+    login.searchParams.set("returnTo", returnTo);
+    for (const [name, value] of Object.entries(extraParams)) {
+        login.searchParams.set(name, value);
+    }
+    return Response.redirect(login);
+}
+/** The three-seam shape every named preset shares (authJs is the template):
+    only session decoding, identity defaults, the mint, and the login target
+    differ per system. The door's oauth half owns consent/CSRF/replay; this
+    only supplies session lookup + subject resolution (10-mcp §3). */
+export function composeHostAuthPreset(opts) {
+    const principalFor = async (subject, claims) => {
+        const resolved = await opts.resolveUser(subject, claims);
+        if (resolved === null)
+            return null;
+        return {
+            kind: "user",
+            subject,
+            ...(resolved.display === undefined ? {} : { display: resolved.display }),
+        };
+    };
+    const principal = async (request) => {
+        const claims = await opts.sessionClaims(request);
+        if (claims === null)
+            return null;
+        const subject = claimString(claims, "sub");
+        return subject === undefined ? null : principalFor(subject, claims);
+    };
+    const oauth = {
+        async session(request, { returnTo }) {
+            const claims = await opts.sessionClaims(request);
+            const subject = claims === null ? undefined : claimString(claims, "sub");
+            if (subject !== undefined && claims !== null && await opts.resolveUser(subject, claims) !== null) {
+                return { subject };
+            }
+            return opts.login(request, returnTo);
+        },
+        async principal(subject) {
+            return principalFor(subject, {});
+        },
+    };
+    return { principal, actAs: opts.actAs, oauth };
+}

package/dist/auth-presets/index.d.ts

@@ -0,0 +1,14 @@
+/** 09-vendo §2.1 — host-identity presets: one config key (`createVendo({ auth })`)
+    filling the principal, actAs, and oauth seams from a single identity story.
+    The five zero-arg preset FUNCTIONS do NOT ship from this barrel — each has
+    its own subpath (@vendoai/vendo/auth/<name>) instead. A bundler resolves
+    every `export ... from` target in a barrel file regardless of which named
+    export a consumer actually uses, so combining all five here (as before
+    corpus-triage Task 9) meant any host importing even one preset — or none —
+    forced every preset's optional peer dep (jose/@auth/core/@clerk/backend) to
+    resolve, breaking builds for hosts lacking one. Only the conformance kit and
+    the shared types (erased before any bundler sees them) stay on this barrel;
+    server.ts re-exports both from here unchanged. */
+export { hostAuthPresetConformance, type HostAuthPresetConformanceOptions, } from "./conformance.js";
+export type { HostAuthPreset, HostAuthPresetOptions, HostAuthPresetUser, HostAuthPresetUserResolver, } from "./shared.js";
+export type { SupabaseHostAuthPresetOptions } from "./supabase.js";

package/dist/auth-presets/index.js

@@ -0,0 +1,12 @@
+/** 09-vendo §2.1 — host-identity presets: one config key (`createVendo({ auth })`)
+    filling the principal, actAs, and oauth seams from a single identity story.
+    The five zero-arg preset FUNCTIONS do NOT ship from this barrel — each has
+    its own subpath (@vendoai/vendo/auth/<name>) instead. A bundler resolves
+    every `export ... from` target in a barrel file regardless of which named
+    export a consumer actually uses, so combining all five here (as before
+    corpus-triage Task 9) meant any host importing even one preset — or none —
+    forced every preset's optional peer dep (jose/@auth/core/@clerk/backend) to
+    resolve, breaking builds for hosts lacking one. Only the conformance kit and
+    the shared types (erased before any bundler sees them) stay on this barrel;
+    server.ts re-exports both from here unchanged. */
+export { hostAuthPresetConformance, } from "./conformance.js";

package/dist/auth-presets/jwt.d.ts

@@ -0,0 +1,16 @@
+import type { HostAuthPreset, HostAuthPresetOptions } from "./shared.js";
+/**
+ * 09-vendo §2.1 — the host-generic JWT host-identity preset, pairing the
+ * docs' generic recipe (docs/act-as-presets.md) with a matching session
+ * resolver: the host API's own HS256 bearer JWT, verified with the same
+ * shared secret the actAs half (`genericJwtPreset`, 04 §2.1) signs with.
+ *
+ * Unlike the vendor presets this one is NOT zero-argument by nature: there is
+ * no vendor-owned env variable a generic scheme could read (AUTH_SECRET
+ * belongs to Auth.js, SUPABASE_JWT_SECRET to Supabase — a host's own secret
+ * name is unknowable), so `secret` is required and construction fails loud
+ * without it. Sessions arrive as `Authorization: Bearer <jwt>`; display
+ * derives from name/email claims; the optional subject→user resolver has the
+ * same semantics as authJs (null = subject unknown → decline/null).
+ */
+export declare function jwt(options?: HostAuthPresetOptions): HostAuthPreset;

package/dist/auth-presets/jwt.js

@@ -0,0 +1,54 @@
+import { genericJwtPreset, verifyHs256 } from "@vendoai/actions/presets";
+import { actAsClaimsFromUser, bearerToken, composeHostAuthPreset, lazyActAs, loginRedirect, makeUserResolver, userFromNameEmailClaims, } from "./identity.js";
+const MISSING_SECRET_OPTION_MESSAGE = "jwt() is not zero-argument: a host-generic JWT scheme has no vendor-owned env variable to read. Pass jwt({ secret }) — e.g. jwt({ secret: () => process.env.HOST_API_JWT_SECRET }).";
+const EMPTY_SECRET_MESSAGE = "jwt() has no session secret: the { secret } source resolved empty.";
+/**
+ * 09-vendo §2.1 — the host-generic JWT host-identity preset, pairing the
+ * docs' generic recipe (docs/act-as-presets.md) with a matching session
+ * resolver: the host API's own HS256 bearer JWT, verified with the same
+ * shared secret the actAs half (`genericJwtPreset`, 04 §2.1) signs with.
+ *
+ * Unlike the vendor presets this one is NOT zero-argument by nature: there is
+ * no vendor-owned env variable a generic scheme could read (AUTH_SECRET
+ * belongs to Auth.js, SUPABASE_JWT_SECRET to Supabase — a host's own secret
+ * name is unknowable), so `secret` is required and construction fails loud
+ * without it. Sessions arrive as `Authorization: Bearer <jwt>`; display
+ * derives from name/email claims; the optional subject→user resolver has the
+ * same semantics as authJs (null = subject unknown → decline/null).
+ */
+export function jwt(options = {}) {
+    const { secret, user } = options;
+    if (secret === undefined) {
+        throw new Error(MISSING_SECRET_OPTION_MESSAGE);
+    }
+    const resolveSecret = async () => {
+        const value = typeof secret === "function" ? await secret() : secret;
+        if (value === undefined || value.length === 0) {
+            throw new Error(EMPTY_SECRET_MESSAGE);
+        }
+        return value;
+    };
+    const sessionClaims = async (request) => {
+        const token = bearerToken(request);
+        if (token === undefined)
+            return null;
+        const resolved = await resolveSecret();
+        try {
+            return (await verifyHs256(token, resolved)).payload;
+        }
+        catch {
+            return null; // unverifiable/expired token = no session, mirroring authJs
+        }
+    };
+    return composeHostAuthPreset({
+        sessionClaims,
+        resolveUser: makeUserResolver(user, userFromNameEmailClaims),
+        // Away + MCP execution: the shipped generic HS256 minting preset (04
+        // §2.1), fed the same secret this preset verifies sessions with.
+        actAs: lazyActAs(() => genericJwtPreset({
+            secret,
+            ...(user === undefined ? {} : { claims: actAsClaimsFromUser(user) }),
+        })),
+        login: (request, returnTo) => loginRedirect(request, returnTo),
+    });
+}

package/dist/auth-presets/shared.d.ts

@@ -0,0 +1,35 @@
+import type { SecretSource } from "@vendoai/actions/presets";
+import type { ActAs, Principal } from "@vendoai/core";
+import type { HostOAuthAdapter } from "@vendoai/mcp";
+/** 09-vendo §2.1 — one host-identity story, three seams. A HostAuthPreset fills
+    the request→Principal resolver, the away/MCP actAs seam, and the door's
+    HostOAuthAdapter from one config key. Passed as `createVendo({ auth })`;
+    mutually exclusive with the per-seam `principal`/`actAs`/`oauth` trio. */
+export interface HostAuthPreset {
+    principal: (req: Request) => Promise<Principal | null>;
+    /** Absent → away/MCP execution cleanly unavailable, as ever (01-core §13). */
+    actAs?: ActAs;
+    /** Absent → the MCP door cannot open (`mcp: true` still requires an adapter, 09 §2). */
+    oauth?: HostOAuthAdapter;
+}
+/** What a host's subject→user resolver returns. `display` names the resolved
+    Principal; `email` only feeds actAs session claims (Principal has no email). */
+export interface HostAuthPresetUser {
+    display?: string;
+    email?: string;
+}
+/** Optional subject→user resolver for custom logic (09 §2.1). `claims` carries
+    the decoded session-token claims where a token exists ({} where none does —
+    actAs minting and the door's subject lookup). Returning null means "subject
+    unknown to host": the principal resolver treats the session as absent, actAs
+    declines the mint, and the door's principal lookup returns null. */
+export type HostAuthPresetUserResolver = (subject: string, claims: Record<string, unknown>) => HostAuthPresetUser | null | Promise<HostAuthPresetUser | null>;
+export interface HostAuthPresetOptions {
+    /** The preset's shared session secret (or system-equivalent). Default: the
+        provider's own env variable — AUTH_SECRET for Auth.js, SUPABASE_JWT_SECRET
+        for Supabase, VENDO_AWAY_TOKEN_SECRET (the away-token secret) for
+        Clerk/Auth0 — resolved lazily per call so composition order never races
+        env loading. jwt() has no vendor env to read: its secret is required. */
+    secret?: SecretSource;
+    user?: HostAuthPresetUserResolver;
+}

package/dist/auth-presets/shared.js

@@ -0,0 +1 @@
+export {};

package/dist/auth-presets/supabase.d.ts

@@ -0,0 +1,42 @@
+import type { HostAuthPreset, HostAuthPresetOptions } from "./shared.js";
+export interface SupabaseHostAuthPresetOptions extends HostAuthPresetOptions {
+    /** GoTrue's JWKS URL for ES256 session verification. Default: derived from
+        SUPABASE_URL as `<url>/auth/v1/.well-known/jwks.json` (GoTrue's own
+        well-known path); pass this to point somewhere else. The thunk form
+        resolves lazily per call (the SecretSource pattern), so composition
+        order never races env loading. */
+    jwks?: string | URL | (() => string | URL | undefined);
+}
+/**
+ * 09-vendo §2.1 — the Supabase Auth host-identity preset. Zero-argument in
+ * the standard case: it reads Supabase's own env, the session resolves off a
+ * plain Request per Supabase's own formats (Authorization: Bearer, or the
+ * `sb-*-auth-token` cookie — @supabase/ssr's `base64-`/chunked shape, the
+ * legacy JSON shapes, and the raw access token), and display derives from
+ * user_metadata.name/full_name/email. The optional subject→user resolver has
+ * the same semantics as authJs (null = subject unknown → decline/null).
+ *
+ * Session verification is Supabase's documented HYBRID (the same one a
+ * project with JWT signing keys needs), routed by the token's own `alg`:
+ *
+ * 1. HS256 first — the project's legacy JWT secret (SUPABASE_JWT_SECRET or
+ *    `secret`), verified OFFLINE through the SAME shared `verifyHs256` the
+ *    minting half targets: no network, no optional SDK, and every actAs-minted
+ *    away token stays verifiable with no Supabase stack running.
+ * 2. ES256 fallback — what `supabase start` ≥ v2.71 and hosted projects on
+ *    the new key system sign interactive logins with, verified against
+ *    GoTrue's JWKS (SUPABASE_URL → /auth/v1/.well-known/jwks.json, or the
+ *    `jwks` option) through a lazily-imported jose (optional peer, cached
+ *    remote key set per URL).
+ *
+ * Both paths enforce Supabase's `authenticated` audience, which is also what
+ * keeps the project's API keys (anon/service_role — HS256 JWTs under the same
+ * secret, but without that audience) from ever counting as a signed-in user.
+ * Tokens neither path can verify resolve to null (no session); construction
+ * with NEITHER a secret NOR a JWKS source fails loud, naming both.
+ *
+ * The actAs half IS the shipped `@vendoai/actions/presets` supabasePreset —
+ * one minting story (04 §2.1), configured from these same options. Tokens
+ * mint (and verify) under Supabase's `authenticated` audience convention.
+ */
+export declare function supabase(options?: SupabaseHostAuthPresetOptions): HostAuthPreset;