@wrelik/auth 0.2.2 → 3.0.0

package/.turbo/turbo-build.log

@@ -1,31 +1,27 @@
 
-> @wrelik/auth@0.2.2 build /home/runner/work/wrelik-kit/wrelik-kit/packages/auth
-> tsup src/index.ts src/next.ts src/react-native.ts --format cjs,esm --dts --clean
+> @wrelik/auth@3.0.0 build /Users/lee/Projects/wrelik-kit/packages/auth
+> tsup src/server/index.ts src/client/index.ts src/shared/index.ts --format cjs,esm --dts --clean
 
-CLI Building entry: src/index.ts, src/next.ts, src/react-native.ts
-CLI Using tsconfig: tsconfig.json
-CLI tsup v8.5.1
-CLI Target: es2019
-CLI Cleaning output folder
-CJS Build start
-ESM Build start
-CJS dist/index.js        2.28 KB
-CJS dist/next.js         1.61 KB
-CJS dist/react-native.js 2.36 KB
-CJS ⚡️ Build success in 60ms
-ESM dist/index.mjs          239.00 B
-ESM dist/next.mjs           255.00 B
-ESM dist/chunk-HWIZ2Q5U.mjs 391.00 B
-ESM dist/react-native.mjs   593.00 B
-ESM dist/chunk-TF32HGN2.mjs 799.00 B
-ESM ⚡️ Build success in 60ms
-DTS Build start
-DTS ⚡️ Build success in 4598ms
-DTS dist/index.d.ts            393.00 B
-DTS dist/next.d.ts             134.00 B
-DTS dist/react-native.d.ts     430.00 B
-DTS dist/shared-Z5LN5APr.d.ts  525.00 B
-DTS dist/index.d.mts           395.00 B
-DTS dist/next.d.mts            135.00 B
-DTS dist/react-native.d.mts    432.00 B
-DTS dist/shared-Z5LN5APr.d.mts 525.00 B
+CLI Building entry: src/server/index.ts, src/client/index.ts, src/shared/index.ts
+CLI Using tsconfig: tsconfig.json
+CLI tsup v8.5.1
+CLI Target: es2019
+CLI Cleaning output folder
+CJS Build start
+ESM Build start
+ESM dist/shared/index.mjs 0 B
+ESM dist/server/index.mjs 1.55 KB
+ESM dist/client/index.mjs 631.00 B
+ESM ⚡️ Build success in 287ms
+CJS dist/server/index.js 2.72 KB
+CJS dist/client/index.js 1.62 KB
+CJS dist/shared/index.js 767.00 B
+CJS ⚡️ Build success in 288ms
+DTS Build start
+DTS ⚡️ Build success in 3552ms
+DTS dist/server/index.d.ts  701.00 B
+DTS dist/client/index.d.ts  155.00 B
+DTS dist/shared/index.d.ts  479.00 B
+DTS dist/server/index.d.mts 702.00 B
+DTS dist/client/index.d.mts 156.00 B
+DTS dist/shared/index.d.mts 479.00 B

package/.turbo/turbo-lint.log

@@ -0,0 +1,11 @@
+
+> @wrelik/auth@0.2.2 lint /Users/lee/Projects/wrelik-kit/packages/auth
+> eslint src/
+
+Warning: React version was set to "detect" in eslint-plugin-react settings, but the "react" package is not installed. Assuming latest React version for linting.
+
+/Users/lee/Projects/wrelik-kit/packages/auth/src/server.ts
+  5:1  warning  '@clerk/backend' import is restricted from being used. Please use @wrelik/auth/server instead  no-restricted-imports
+
+✖ 1 problem (0 errors, 1 warning)
+

package/.turbo/turbo-test.log

@@ -0,0 +1,16 @@
+
+> @wrelik/auth@3.0.0 test /Users/lee/Projects/wrelik-kit/packages/auth
+> vitest run --passWithNoTests
+
+
+ RUN  v4.1.2 /Users/lee/Projects/wrelik-kit/packages/auth
+
+ ✓ src/client/index.test.ts (2 tests) 4ms
+ ✓ src/client/index.contract.test.ts (1 test) 4ms
+ ✓ src/server/index.test.ts (6 tests) 12ms
+
+ Test Files  3 passed (3)
+      Tests  9 passed (9)
+   Start at  20:04:59
+   Duration  877ms (transform 865ms, setup 0ms, import 1.09s, tests 20ms, environment 0ms)
+

package/.turbo/turbo-typecheck.log

@@ -0,0 +1,4 @@
+
+> @wrelik/auth@2.0.0 typecheck /Users/lee/Projects/wrelik-kit/packages/auth
+> tsc --noEmit
+

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @wrelik/auth
 
+## 3.0.0
+
+### Major Changes
+
+- 3262454: Upgrade runtime SDK and workspace tooling dependencies to latest compatible versions, including Clerk, Sentry, AWS SDK, Inngest, Resend, Upstash, Zod, TypeScript, Turbo, Vitest, TSUP, and ESLint.
+
+  Adopt root ESLint flat config and align wrapper peer ranges for updated SDK majors while preserving package export paths. Also apply a patched transitive Next.js resolution to close audit findings and keep production audit clean.
+
+  Note: Vite is pinned to the latest 7.x line for runtime compatibility in this environment; this avoids current rolldown native-binding failures seen with Vite 8 under Node 20.18.0.
+
+  Breaking change: `@wrelik/auth` and `@wrelik/clerk-next` now require `@clerk/nextjs@7.x` via updated peer ranges (`>=7 <8`). Consumers on Clerk v4-v6 must upgrade to Clerk v7 before adopting these versions.
+
+### Patch Changes
+
+- Updated dependencies [3262454]
+  - @wrelik/errors@2.0.1
+
+## 2.0.0
+
+### Major Changes
+
+- 818ed58: Refactor runtime packages to strict subpath exports (`/server`, `/client`, `/shared`) with side-effect free entrypoints and hard CI/runtime boundary enforcement.
+
+### Patch Changes
+
+- Updated dependencies [818ed58]
+  - @wrelik/errors@2.0.0
+
 ## 0.2.2
 
 ### Patch Changes

package/dist/client/index.d.mts

@@ -0,0 +1,5 @@
+import { WorkflowSession } from '../shared/index.mjs';
+
+declare function mapClerkToSession(input: unknown): WorkflowSession;
+
+export { mapClerkToSession };

package/dist/client/index.d.ts

@@ -0,0 +1,5 @@
+import { WorkflowSession } from '../shared/index.js';
+
+declare function mapClerkToSession(input: unknown): WorkflowSession;
+
+export { mapClerkToSession };

package/dist/{next.js → client/index.js}

@@ -17,37 +17,31 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/next.ts
-var next_exports = {};
-__export(next_exports, {
-  getSession: () => getSession
+// src/client/index.ts
+var client_exports = {};
+__export(client_exports, {
+  mapClerkToSession: () => mapClerkToSession
 });
-module.exports = __toCommonJS(next_exports);
-var import_nextjs = require("@clerk/nextjs");
-
-// src/shared.ts
-var import_errors = require("@wrelik/errors");
-
-// src/index.ts
-function fromClerkAuth(auth2) {
-  var _a, _b;
-  if (!auth2 || !auth2.userId) {
+module.exports = __toCommonJS(client_exports);
+function normalizeRoles(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter((role) => typeof role === "string");
+}
+function mapClerkToSession(input) {
+  var _a, _b, _c, _d;
+  const auth = input != null ? input : {};
+  if (!auth.userId) {
     return { userId: null, tenantId: null, roles: [] };
   }
-  const roles = ((_b = (_a = auth2.sessionClaims) == null ? void 0 : _a.publicMetadata) == null ? void 0 : _b.roles) || [];
   return {
-    userId: auth2.userId,
-    tenantId: auth2.orgId || null,
-    roles
+    userId: auth.userId,
+    tenantId: (_a = auth.orgId) != null ? _a : null,
+    roles: normalizeRoles((_d = (_c = (_b = auth.session) == null ? void 0 : _b.user) == null ? void 0 : _c.publicMetadata) == null ? void 0 : _d.roles)
   };
 }
-
-// src/next.ts
-function getSession() {
-  const clerkAuth = (0, import_nextjs.auth)();
-  return fromClerkAuth(clerkAuth);
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  getSession
+  mapClerkToSession
 });

package/dist/client/index.mjs

@@ -0,0 +1,22 @@
+// src/client/index.ts
+function normalizeRoles(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter((role) => typeof role === "string");
+}
+function mapClerkToSession(input) {
+  var _a, _b, _c, _d;
+  const auth = input != null ? input : {};
+  if (!auth.userId) {
+    return { userId: null, tenantId: null, roles: [] };
+  }
+  return {
+    userId: auth.userId,
+    tenantId: (_a = auth.orgId) != null ? _a : null,
+    roles: normalizeRoles((_d = (_c = (_b = auth.session) == null ? void 0 : _b.user) == null ? void 0 : _c.publicMetadata) == null ? void 0 : _d.roles)
+  };
+}
+export {
+  mapClerkToSession
+};

package/dist/server/index.d.mts

@@ -0,0 +1,15 @@
+import { WorkflowSession } from '../shared/index.mjs';
+
+type ClerkAuthLike = {
+    userId: string | null;
+    orgId?: string | null;
+    sessionClaims?: unknown;
+};
+declare function fromClerkAuth(clerkAuth: ClerkAuthLike | null): WorkflowSession;
+declare function getSession(): Promise<WorkflowSession>;
+declare function requireUser(session: WorkflowSession | null): string;
+declare function requireTenant(session: WorkflowSession | null): string;
+declare function hasRole(session: WorkflowSession | null, role: string): boolean;
+declare function requireRole(session: WorkflowSession | null, role: string): void;
+
+export { fromClerkAuth, getSession, hasRole, requireRole, requireTenant, requireUser };

package/dist/server/index.d.ts

@@ -0,0 +1,15 @@
+import { WorkflowSession } from '../shared/index.js';
+
+type ClerkAuthLike = {
+    userId: string | null;
+    orgId?: string | null;
+    sessionClaims?: unknown;
+};
+declare function fromClerkAuth(clerkAuth: ClerkAuthLike | null): WorkflowSession;
+declare function getSession(): Promise<WorkflowSession>;
+declare function requireUser(session: WorkflowSession | null): string;
+declare function requireTenant(session: WorkflowSession | null): string;
+declare function hasRole(session: WorkflowSession | null, role: string): boolean;
+declare function requireRole(session: WorkflowSession | null, role: string): void;
+
+export { fromClerkAuth, getSession, hasRole, requireRole, requireTenant, requireUser };

package/dist/{index.js → server/index.js}

@@ -17,59 +17,66 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
+// src/server/index.ts
+var server_exports = {};
+__export(server_exports, {
   fromClerkAuth: () => fromClerkAuth,
+  getSession: () => getSession,
   hasRole: () => hasRole,
   requireRole: () => requireRole,
   requireTenant: () => requireTenant,
   requireUser: () => requireUser
 });
-module.exports = __toCommonJS(index_exports);
-
-// src/shared.ts
-var import_errors = require("@wrelik/errors");
+module.exports = __toCommonJS(server_exports);
+var import_server = require("@clerk/nextjs/server");
+var import_shared = require("@wrelik/errors/shared");
+function normalizeRoles(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter((role) => typeof role === "string");
+}
+function fromClerkAuth(clerkAuth) {
+  var _a, _b, _c;
+  if (!(clerkAuth == null ? void 0 : clerkAuth.userId)) {
+    return { userId: null, tenantId: null, roles: [] };
+  }
+  const authLike = clerkAuth;
+  const claims = (_a = authLike.sessionClaims) != null ? _a : {};
+  return {
+    userId: clerkAuth.userId,
+    tenantId: (_b = clerkAuth.orgId) != null ? _b : null,
+    roles: normalizeRoles((_c = claims.publicMetadata) == null ? void 0 : _c.roles)
+  };
+}
+async function getSession() {
+  return fromClerkAuth(await (0, import_server.auth)());
+}
 function requireUser(session) {
-  if (!session || !session.userId) {
-    throw new import_errors.AuthRequiredError();
+  if (!(session == null ? void 0 : session.userId)) {
+    throw new import_shared.AuthRequiredError();
   }
   return session.userId;
 }
 function requireTenant(session) {
   requireUser(session);
-  if (!session || !session.tenantId) {
-    throw new import_errors.TenantRequiredError();
+  if (!(session == null ? void 0 : session.tenantId)) {
+    throw new import_shared.TenantRequiredError();
   }
   return session.tenantId;
 }
 function hasRole(session, role) {
-  if (!session || !session.userId) return false;
-  if (!Array.isArray(session.roles)) return false;
-  return session.roles.includes(role);
+  return Boolean((session == null ? void 0 : session.userId) && Array.isArray(session.roles) && session.roles.includes(role));
 }
 function requireRole(session, role) {
   if (!hasRole(session, role)) {
-    throw new import_errors.PermissionDeniedError(`Role ${role} required`);
+    throw new import_shared.PermissionDeniedError(`Role ${role} required`);
   }
 }
-
-// src/index.ts
-function fromClerkAuth(auth) {
-  var _a, _b;
-  if (!auth || !auth.userId) {
-    return { userId: null, tenantId: null, roles: [] };
-  }
-  const roles = ((_b = (_a = auth.sessionClaims) == null ? void 0 : _a.publicMetadata) == null ? void 0 : _b.roles) || [];
-  return {
-    userId: auth.userId,
-    tenantId: auth.orgId || null,
-    roles
-  };
-}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   fromClerkAuth,
+  getSession,
   hasRole,
   requireRole,
   requireTenant,

package/dist/server/index.mjs

@@ -0,0 +1,58 @@
+// src/server/index.ts
+import { auth } from "@clerk/nextjs/server";
+import {
+  AuthRequiredError,
+  PermissionDeniedError,
+  TenantRequiredError
+} from "@wrelik/errors/shared";
+function normalizeRoles(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter((role) => typeof role === "string");
+}
+function fromClerkAuth(clerkAuth) {
+  var _a, _b, _c;
+  if (!(clerkAuth == null ? void 0 : clerkAuth.userId)) {
+    return { userId: null, tenantId: null, roles: [] };
+  }
+  const authLike = clerkAuth;
+  const claims = (_a = authLike.sessionClaims) != null ? _a : {};
+  return {
+    userId: clerkAuth.userId,
+    tenantId: (_b = clerkAuth.orgId) != null ? _b : null,
+    roles: normalizeRoles((_c = claims.publicMetadata) == null ? void 0 : _c.roles)
+  };
+}
+async function getSession() {
+  return fromClerkAuth(await auth());
+}
+function requireUser(session) {
+  if (!(session == null ? void 0 : session.userId)) {
+    throw new AuthRequiredError();
+  }
+  return session.userId;
+}
+function requireTenant(session) {
+  requireUser(session);
+  if (!(session == null ? void 0 : session.tenantId)) {
+    throw new TenantRequiredError();
+  }
+  return session.tenantId;
+}
+function hasRole(session, role) {
+  return Boolean((session == null ? void 0 : session.userId) && Array.isArray(session.roles) && session.roles.includes(role));
+}
+function requireRole(session, role) {
+  if (!hasRole(session, role)) {
+    throw new PermissionDeniedError(`Role ${role} required`);
+  }
+}
+export {
+  fromClerkAuth,
+  getSession,
+  hasRole,
+  requireRole,
+  requireTenant,
+  requireUser
+};

package/dist/shared/index.d.mts

@@ -0,0 +1,21 @@
+interface WorkflowSession {
+    userId: string | null;
+    tenantId: string | null;
+    roles: string[];
+}
+interface ClerkSessionLike {
+    userId?: string | null;
+    orgId?: string | null;
+    sessionClaims?: unknown;
+}
+interface ClerkClientSessionLike {
+    userId?: string | null;
+    orgId?: string | null;
+    session?: {
+        user?: {
+            publicMetadata?: unknown;
+        };
+    };
+}
+
+export type { ClerkClientSessionLike, ClerkSessionLike, WorkflowSession };

package/dist/shared/index.d.ts

@@ -0,0 +1,21 @@
+interface WorkflowSession {
+    userId: string | null;
+    tenantId: string | null;
+    roles: string[];
+}
+interface ClerkSessionLike {
+    userId?: string | null;
+    orgId?: string | null;
+    sessionClaims?: unknown;
+}
+interface ClerkClientSessionLike {
+    userId?: string | null;
+    orgId?: string | null;
+    session?: {
+        user?: {
+            publicMetadata?: unknown;
+        };
+    };
+}
+
+export type { ClerkClientSessionLike, ClerkSessionLike, WorkflowSession };

package/dist/shared/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/shared/index.ts
+var shared_exports = {};
+module.exports = __toCommonJS(shared_exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrelik/auth",
-  "version": "0.2.2",
+  "version": "3.0.0",
   "publishConfig": {
     "access": "public"
   },
@@ -9,29 +9,53 @@
     "url": "https://github.com/lwhite702/wrelik-kit.git",
     "directory": "packages/auth"
   },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "sideEffects": false,
   "exports": {
-    ".": "./dist/index.js",
-    "./next": "./dist/next.js",
-    "./react-native": "./dist/react-native.js"
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "import": "./dist/server/index.mjs",
+      "require": "./dist/server/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.mjs",
+      "require": "./dist/client/index.js"
+    },
+    "./shared": {
+      "types": "./dist/shared/index.d.ts",
+      "import": "./dist/shared/index.mjs",
+      "require": "./dist/shared/index.js"
+    },
+    "./package.json": "./package.json"
   },
   "dependencies": {
-    "@clerk/backend": "^0.38.0",
-    "@wrelik/errors": "0.2.1"
+    "@clerk/backend": "^3.2.4",
+    "@wrelik/errors": "2.0.1"
   },
   "peerDependencies": {
-    "@clerk/nextjs": "^4.29.0"
+    "@clerk/nextjs": ">=7 <8"
   },
   "devDependencies": {
-    "tsup": "^8.0.1",
-    "vitest": "^1.2.2",
-    "@wrelik/eslint-config": "0.1.1",
-    "@wrelik/tsconfig": "0.1.1"
+    "@clerk/nextjs": "^7.0.8",
+    "@types/node": "^25.5.2",
+    "next": "15.5.14",
+    "tsup": "^8.5.1",
+    "vite": "^7.3.1",
+    "vitest": "^4.1.2",
+    "@wrelik/eslint-config": "0.1.2",
+    "@wrelik/tsconfig": "0.1.2"
+  },
+  "wrelik": {
+    "runtimes": [
+      "server",
+      "client",
+      "shared"
+    ]
   },
   "scripts": {
-    "build": "tsup src/index.ts src/next.ts src/react-native.ts --format cjs,esm --dts --clean",
+    "build": "tsup src/server/index.ts src/client/index.ts src/shared/index.ts --format cjs,esm --dts --clean",
     "lint": "eslint src/",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests"
   }
 }

package/src/client/index.contract.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest';
+import { mapClerkToSession } from './index';
+
+describe('@wrelik/auth/client contract', () => {
+  it('normalizes mixed roles from Clerk client payload', () => {
+    const session = mapClerkToSession({
+      userId: 'u1',
+      orgId: 't1',
+      session: {
+        user: {
+          publicMetadata: {
+            roles: ['admin', 42, 'owner'],
+          },
+        },
+      },
+    });
+
+    expect(session).toEqual({
+      userId: 'u1',
+      tenantId: 't1',
+      roles: ['admin', 'owner'],
+    });
+  });
+});

package/src/client/index.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest';
+import { mapClerkToSession } from './index';
+
+describe('@wrelik/auth/client', () => {
+  it('maps unknown auth input to a safe empty session', () => {
+    expect(mapClerkToSession(null)).toEqual({ userId: null, tenantId: null, roles: [] });
+  });
+
+  it('maps role metadata without permission checks', () => {
+    const session = mapClerkToSession({
+      userId: 'u1',
+      orgId: 'o1',
+      session: { user: { publicMetadata: { roles: ['admin', 1] } } },
+    });
+
+    expect(session).toEqual({ userId: 'u1', tenantId: 'o1', roles: ['admin'] });
+  });
+});

package/src/client/index.ts

@@ -0,0 +1,23 @@
+import type { ClerkClientSessionLike, WorkflowSession } from '../shared';
+
+function normalizeRoles(value: unknown): string[] {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+
+  return value.filter((role): role is string => typeof role === 'string');
+}
+
+export function mapClerkToSession(input: unknown): WorkflowSession {
+  const auth = (input ?? {}) as ClerkClientSessionLike;
+
+  if (!auth.userId) {
+    return { userId: null, tenantId: null, roles: [] };
+  }
+
+  return {
+    userId: auth.userId,
+    tenantId: auth.orgId ?? null,
+    roles: normalizeRoles((auth.session?.user?.publicMetadata as { roles?: unknown } | undefined)?.roles),
+  };
+}

package/src/server/index.test.ts

@@ -0,0 +1,61 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { AuthRequiredError, PermissionDeniedError, TenantRequiredError } from '@wrelik/errors/shared';
+import { fromClerkAuth, hasRole, requireRole, requireTenant, requireUser } from './index';
+
+afterEach(() => {
+  vi.resetModules();
+  vi.clearAllMocks();
+});
+
+describe('@wrelik/auth/server', () => {
+  it('requires authenticated users and tenant contexts', () => {
+    expect(() => requireUser(null)).toThrow(AuthRequiredError);
+    expect(() => requireTenant({ userId: 'u1', tenantId: null, roles: [] })).toThrow(TenantRequiredError);
+  });
+
+  it('checks role membership with runtime-shape safety', () => {
+    expect(hasRole({ userId: 'u1', tenantId: 't1', roles: ['admin'] }, 'admin')).toBe(true);
+    expect(() => requireRole({ userId: 'u1', tenantId: 't1', roles: [] }, 'admin')).toThrow(
+      PermissionDeniedError,
+    );
+  });
+
+  it('maps Clerk auth payloads defensively', () => {
+    const session = fromClerkAuth({
+      userId: 'u1',
+      orgId: 'o1',
+      sessionClaims: { publicMetadata: { roles: ['admin', 1] } },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any);
+
+    expect(session).toEqual({ userId: 'u1', tenantId: 'o1', roles: ['admin'] });
+  });
+
+  it('retrieves and normalizes sessions from Clerk auth()', async () => {
+    vi.resetModules();
+    vi.doMock('@clerk/nextjs/server', () => ({
+      auth: () => ({
+        userId: 'u1',
+        orgId: 'o1',
+        sessionClaims: { publicMetadata: { roles: ['admin', 123] } },
+      }),
+    }));
+
+    const mod = await import('./index');
+    await expect(mod.getSession()).resolves.toEqual({ userId: 'u1', tenantId: 'o1', roles: ['admin'] });
+  });
+
+  it('returns anonymous session when Clerk auth() is signed out', async () => {
+    vi.resetModules();
+    vi.doMock('@clerk/nextjs/server', () => ({
+      auth: () => ({ userId: null, orgId: null, sessionClaims: {} }),
+    }));
+
+    const mod = await import('./index');
+    await expect(mod.getSession()).resolves.toEqual({ userId: null, tenantId: null, roles: [] });
+  });
+
+  it('does not expose a root package import', () => {
+    expect(() => require.resolve('@wrelik/auth')).toThrow();
+  });
+});

package/src/server/index.ts

@@ -0,0 +1,71 @@
+import { auth } from '@clerk/nextjs/server';
+import {
+  AuthRequiredError,
+  PermissionDeniedError,
+  TenantRequiredError,
+} from '@wrelik/errors/shared';
+import type { ClerkSessionLike, WorkflowSession } from '../shared';
+
+function normalizeRoles(value: unknown): string[] {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+
+  return value.filter((role): role is string => typeof role === 'string');
+}
+
+type ClerkAuthLike = {
+  userId: string | null;
+  orgId?: string | null;
+  sessionClaims?: unknown;
+};
+
+export function fromClerkAuth(
+  clerkAuth: ClerkAuthLike | null,
+): WorkflowSession {
+  if (!clerkAuth?.userId) {
+    return { userId: null, tenantId: null, roles: [] };
+  }
+
+  const authLike: ClerkSessionLike = clerkAuth;
+  const claims =
+    (authLike.sessionClaims as { publicMetadata?: { roles?: unknown } } | undefined) ?? {};
+
+  return {
+    userId: clerkAuth.userId,
+    tenantId: clerkAuth.orgId ?? null,
+    roles: normalizeRoles(claims.publicMetadata?.roles),
+  };
+}
+
+export async function getSession(): Promise<WorkflowSession> {
+  return fromClerkAuth(await auth());
+}
+
+export function requireUser(session: WorkflowSession | null): string {
+  if (!session?.userId) {
+    throw new AuthRequiredError();
+  }
+
+  return session.userId;
+}
+
+export function requireTenant(session: WorkflowSession | null): string {
+  requireUser(session);
+
+  if (!session?.tenantId) {
+    throw new TenantRequiredError();
+  }
+
+  return session.tenantId;
+}
+
+export function hasRole(session: WorkflowSession | null, role: string): boolean {
+  return Boolean(session?.userId && Array.isArray(session.roles) && session.roles.includes(role));
+}
+
+export function requireRole(session: WorkflowSession | null, role: string): void {
+  if (!hasRole(session, role)) {
+    throw new PermissionDeniedError(`Role ${role} required`);
+  }
+}

package/src/shared/index.ts

@@ -0,0 +1 @@
+export type { WorkflowSession, ClerkSessionLike, ClerkClientSessionLike } from './types';

package/src/shared/types.ts

@@ -0,0 +1,21 @@
+export interface WorkflowSession {
+  userId: string | null;
+  tenantId: string | null;
+  roles: string[];
+}
+
+export interface ClerkSessionLike {
+  userId?: string | null;
+  orgId?: string | null;
+  sessionClaims?: unknown;
+}
+
+export interface ClerkClientSessionLike {
+  userId?: string | null;
+  orgId?: string | null;
+  session?: {
+    user?: {
+      publicMetadata?: unknown;
+    };
+  };
+}

package/tsconfig.json

@@ -2,7 +2,9 @@
   "extends": "@wrelik/tsconfig/next.json",
   "compilerOptions": {
     "incremental": false,
-    "outDir": "dist", "skipLibCheck": true
+    "outDir": "dist",
+    "skipLibCheck": true,
+    "types": ["node"]
   },
   "include": ["src"]
 }

package/dist/chunk-HWIZ2Q5U.mjs

@@ -1,17 +0,0 @@
-// src/index.ts
-function fromClerkAuth(auth) {
-  var _a, _b;
-  if (!auth || !auth.userId) {
-    return { userId: null, tenantId: null, roles: [] };
-  }
-  const roles = ((_b = (_a = auth.sessionClaims) == null ? void 0 : _a.publicMetadata) == null ? void 0 : _b.roles) || [];
-  return {
-    userId: auth.userId,
-    tenantId: auth.orgId || null,
-    roles
-  };
-}
-
-export {
-  fromClerkAuth
-};

package/dist/chunk-TF32HGN2.mjs

@@ -1,32 +0,0 @@
-// src/shared.ts
-import { AuthRequiredError, PermissionDeniedError, TenantRequiredError } from "@wrelik/errors";
-function requireUser(session) {
-  if (!session || !session.userId) {
-    throw new AuthRequiredError();
-  }
-  return session.userId;
-}
-function requireTenant(session) {
-  requireUser(session);
-  if (!session || !session.tenantId) {
-    throw new TenantRequiredError();
-  }
-  return session.tenantId;
-}
-function hasRole(session, role) {
-  if (!session || !session.userId) return false;
-  if (!Array.isArray(session.roles)) return false;
-  return session.roles.includes(role);
-}
-function requireRole(session, role) {
-  if (!hasRole(session, role)) {
-    throw new PermissionDeniedError(`Role ${role} required`);
-  }
-}
-
-export {
-  requireUser,
-  requireTenant,
-  hasRole,
-  requireRole
-};

package/dist/index.d.mts

@@ -1,7 +0,0 @@
-import { SignedInAuthObject, SignedOutAuthObject } from '@clerk/backend';
-import { W as WorkflowSession } from './shared-Z5LN5APr.mjs';
-export { h as hasRole, r as requireRole, a as requireTenant, b as requireUser } from './shared-Z5LN5APr.mjs';
-
-declare function fromClerkAuth(auth: SignedInAuthObject | SignedOutAuthObject | null): WorkflowSession;
-
-export { WorkflowSession, fromClerkAuth };

package/dist/index.d.ts

@@ -1,7 +0,0 @@
-import { SignedInAuthObject, SignedOutAuthObject } from '@clerk/backend';
-import { W as WorkflowSession } from './shared-Z5LN5APr.js';
-export { h as hasRole, r as requireRole, a as requireTenant, b as requireUser } from './shared-Z5LN5APr.js';
-
-declare function fromClerkAuth(auth: SignedInAuthObject | SignedOutAuthObject | null): WorkflowSession;
-
-export { WorkflowSession, fromClerkAuth };

package/dist/index.mjs

@@ -1,16 +0,0 @@
-import {
-  fromClerkAuth
-} from "./chunk-HWIZ2Q5U.mjs";
-import {
-  hasRole,
-  requireRole,
-  requireTenant,
-  requireUser
-} from "./chunk-TF32HGN2.mjs";
-export {
-  fromClerkAuth,
-  hasRole,
-  requireRole,
-  requireTenant,
-  requireUser
-};

package/dist/next.d.mts

@@ -1,5 +0,0 @@
-import { W as WorkflowSession } from './shared-Z5LN5APr.mjs';
-
-declare function getSession(): WorkflowSession;
-
-export { getSession };

package/dist/next.d.ts

@@ -1,5 +0,0 @@
-import { W as WorkflowSession } from './shared-Z5LN5APr.js';
-
-declare function getSession(): WorkflowSession;
-
-export { getSession };

package/dist/next.mjs

@@ -1,14 +0,0 @@
-import {
-  fromClerkAuth
-} from "./chunk-HWIZ2Q5U.mjs";
-import "./chunk-TF32HGN2.mjs";
-
-// src/next.ts
-import { auth } from "@clerk/nextjs";
-function getSession() {
-  const clerkAuth = auth();
-  return fromClerkAuth(clerkAuth);
-}
-export {
-  getSession
-};

package/dist/react-native.d.mts

@@ -1,14 +0,0 @@
-import { W as WorkflowSession } from './shared-Z5LN5APr.mjs';
-export { h as hasRole, r as requireRole, a as requireTenant, b as requireUser } from './shared-Z5LN5APr.mjs';
-
-declare function mapClerkToSession(auth: {
-    userId?: string | null;
-    orgId?: string | null;
-    session?: {
-        user?: {
-            publicMetadata?: any;
-        };
-    };
-} | null): WorkflowSession;
-
-export { WorkflowSession, mapClerkToSession };

package/dist/react-native.d.ts

@@ -1,14 +0,0 @@
-import { W as WorkflowSession } from './shared-Z5LN5APr.js';
-export { h as hasRole, r as requireRole, a as requireTenant, b as requireUser } from './shared-Z5LN5APr.js';
-
-declare function mapClerkToSession(auth: {
-    userId?: string | null;
-    orgId?: string | null;
-    session?: {
-        user?: {
-            publicMetadata?: any;
-        };
-    };
-} | null): WorkflowSession;
-
-export { WorkflowSession, mapClerkToSession };

package/dist/react-native.js

@@ -1,77 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/react-native.ts
-var react_native_exports = {};
-__export(react_native_exports, {
-  hasRole: () => hasRole,
-  mapClerkToSession: () => mapClerkToSession,
-  requireRole: () => requireRole,
-  requireTenant: () => requireTenant,
-  requireUser: () => requireUser
-});
-module.exports = __toCommonJS(react_native_exports);
-
-// src/shared.ts
-var import_errors = require("@wrelik/errors");
-function requireUser(session) {
-  if (!session || !session.userId) {
-    throw new import_errors.AuthRequiredError();
-  }
-  return session.userId;
-}
-function requireTenant(session) {
-  requireUser(session);
-  if (!session || !session.tenantId) {
-    throw new import_errors.TenantRequiredError();
-  }
-  return session.tenantId;
-}
-function hasRole(session, role) {
-  if (!session || !session.userId) return false;
-  if (!Array.isArray(session.roles)) return false;
-  return session.roles.includes(role);
-}
-function requireRole(session, role) {
-  if (!hasRole(session, role)) {
-    throw new import_errors.PermissionDeniedError(`Role ${role} required`);
-  }
-}
-
-// src/react-native.ts
-function mapClerkToSession(auth) {
-  var _a, _b, _c;
-  if (!auth || !auth.userId) {
-    return { userId: null, tenantId: null, roles: [] };
-  }
-  const roles = ((_c = (_b = (_a = auth.session) == null ? void 0 : _a.user) == null ? void 0 : _b.publicMetadata) == null ? void 0 : _c.roles) || [];
-  return {
-    userId: auth.userId,
-    tenantId: auth.orgId || null,
-    roles
-  };
-}
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  hasRole,
-  mapClerkToSession,
-  requireRole,
-  requireTenant,
-  requireUser
-});

package/dist/react-native.mjs

@@ -1,27 +0,0 @@
-import {
-  hasRole,
-  requireRole,
-  requireTenant,
-  requireUser
-} from "./chunk-TF32HGN2.mjs";
-
-// src/react-native.ts
-function mapClerkToSession(auth) {
-  var _a, _b, _c;
-  if (!auth || !auth.userId) {
-    return { userId: null, tenantId: null, roles: [] };
-  }
-  const roles = ((_c = (_b = (_a = auth.session) == null ? void 0 : _a.user) == null ? void 0 : _b.publicMetadata) == null ? void 0 : _c.roles) || [];
-  return {
-    userId: auth.userId,
-    tenantId: auth.orgId || null,
-    roles
-  };
-}
-export {
-  hasRole,
-  mapClerkToSession,
-  requireRole,
-  requireTenant,
-  requireUser
-};

package/dist/shared-Z5LN5APr.d.mts

@@ -1,11 +0,0 @@
-interface WorkflowSession {
-    userId: string | null;
-    tenantId: string | null;
-    roles: string[];
-}
-declare function requireUser(session: WorkflowSession | null): string;
-declare function requireTenant(session: WorkflowSession | null): string;
-declare function hasRole(session: WorkflowSession | null, role: string): boolean;
-declare function requireRole(session: WorkflowSession | null, role: string): void;
-
-export { type WorkflowSession as W, requireTenant as a, requireUser as b, hasRole as h, requireRole as r };

package/dist/shared-Z5LN5APr.d.ts

@@ -1,11 +0,0 @@
-interface WorkflowSession {
-    userId: string | null;
-    tenantId: string | null;
-    roles: string[];
-}
-declare function requireUser(session: WorkflowSession | null): string;
-declare function requireTenant(session: WorkflowSession | null): string;
-declare function hasRole(session: WorkflowSession | null, role: string): boolean;
-declare function requireRole(session: WorkflowSession | null, role: string): void;
-
-export { type WorkflowSession as W, requireTenant as a, requireUser as b, hasRole as h, requireRole as r };

package/src/index.test.ts

@@ -1,29 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { requireUser, fromClerkAuth } from './index';
-import { AuthRequiredError } from '@wrelik/errors';
-
-describe('@wrelik/auth', () => {
-  it('should throw AuthRequiredError if user is null', () => {
-    const session = { userId: null, tenantId: null, roles: [] };
-    expect(() => requireUser(session)).toThrow(AuthRequiredError);
-  });
-
-  it('should return userId if session is valid', () => {
-    const session = { userId: 'user_123', tenantId: null, roles: [] };
-    expect(requireUser(session)).toBe('user_123');
-  });
-
-  it('should correctly parse Clerk auth object', () => {
-    const clerkAuth = {
-      userId: 'user_123',
-      orgId: 'org_456',
-      sessionClaims: { publicMetadata: { roles: ['admin'] } },
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    } as any;
-
-    const session = fromClerkAuth(clerkAuth);
-    expect(session.userId).toBe('user_123');
-    expect(session.tenantId).toBe('org_456');
-    expect(session.roles).toContain('admin');
-  });
-});

package/src/index.ts

@@ -1,21 +0,0 @@
-import type { SignedInAuthObject, SignedOutAuthObject } from '@clerk/backend';
-import { type WorkflowSession } from './shared';
-
-export * from './shared';
-
-export function fromClerkAuth(
-  auth: SignedInAuthObject | SignedOutAuthObject | null,
-): WorkflowSession {
-  if (!auth || !auth.userId) {
-    return { userId: null, tenantId: null, roles: [] };
-  }
-
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const roles = ((auth.sessionClaims?.publicMetadata as any)?.roles as string[]) || [];
-
-  return {
-    userId: auth.userId,
-    tenantId: auth.orgId || null,
-    roles,
-  };
-}

package/src/next.ts

@@ -1,8 +0,0 @@
-/* eslint-disable no-restricted-imports */
-import { auth } from '@clerk/nextjs';
-import { fromClerkAuth, type WorkflowSession } from './index';
-
-export function getSession(): WorkflowSession {
-  const clerkAuth = auth();
-  return fromClerkAuth(clerkAuth);
-}

package/src/react-native.ts

@@ -1,28 +0,0 @@
-import { type WorkflowSession } from './shared';
-
-export * from './shared';
-
-// We accept the `useAuth` or `useUser` return value or similar from Clerk Expo
-// but to be loose coupling, we defined it as any with some shape checks if needed.
-// However, the requirement says "converts the Clerk Expo session/user representation".
-export function mapClerkToSession(
-  auth: {
-    userId?: string | null;
-    orgId?: string | null;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    session?: { user?: { publicMetadata?: any } };
-  } | null,
-): WorkflowSession {
-  if (!auth || !auth.userId) {
-    return { userId: null, tenantId: null, roles: [] };
-  }
-
-  // The roles might be in publicMetadata of the user object in session
-  const roles = (auth.session?.user?.publicMetadata?.roles as string[]) || [];
-
-  return {
-    userId: auth.userId,
-    tenantId: auth.orgId || null,
-    roles,
-  };
-}

package/src/shared.test.ts

@@ -1,40 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { requireUser, requireTenant, hasRole } from './shared';
-
-describe('Auth Shared', () => {
-  it('requireUser throws if no user', () => {
-    expect(() => requireUser(null)).toThrow('Authentication required');
-    expect(() => requireUser({ userId: null, tenantId: null, roles: [] })).toThrow(
-      'Authentication required',
-    );
-  });
-
-  it('requireUser returns userId', () => {
-    expect(requireUser({ userId: 'u1', tenantId: null, roles: [] })).toBe('u1');
-  });
-
-  it('requireTenant throws if no tenant', () => {
-    expect(() => requireTenant({ userId: 'u1', tenantId: null, roles: [] })).toThrow(
-      'Tenant context required',
-    );
-  });
-
-  it('hasRole checks roles', () => {
-    const session = { userId: 'u1', tenantId: 't1', roles: ['admin'] };
-    expect(hasRole(session, 'admin')).toBe(true);
-    expect(hasRole(session, 'user')).toBe(false);
-  });
-
-  it('does not grant role access when roles has invalid runtime shape', () => {
-    const malformedSession = {
-      userId: 'u1',
-      tenantId: 't1',
-      // Simulates untrusted runtime payload, despite the TypeScript type.
-      roles: 'admin',
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    } as any;
-
-    expect(hasRole(malformedSession, 'admin')).toBe(false);
-    expect(hasRole(malformedSession, 'min')).toBe(false);
-  });
-});

package/src/shared.ts

@@ -1,34 +0,0 @@
-import { AuthRequiredError, PermissionDeniedError, TenantRequiredError } from '@wrelik/errors';
-
-export interface WorkflowSession {
-  userId: string | null;
-  tenantId: string | null;
-  roles: string[];
-}
-
-export function requireUser(session: WorkflowSession | null): string {
-  if (!session || !session.userId) {
-    throw new AuthRequiredError();
-  }
-  return session.userId;
-}
-
-export function requireTenant(session: WorkflowSession | null): string {
-  requireUser(session);
-  if (!session || !session.tenantId) {
-    throw new TenantRequiredError();
-  }
-  return session.tenantId;
-}
-
-export function hasRole(session: WorkflowSession | null, role: string): boolean {
-  if (!session || !session.userId) return false;
-  if (!Array.isArray(session.roles)) return false;
-  return session.roles.includes(role);
-}
-
-export function requireRole(session: WorkflowSession | null, role: string) {
-  if (!hasRole(session, role)) {
-    throw new PermissionDeniedError(`Role ${role} required`);
-  }
-}