@zackbart/connecta 0.34.1 → 0.35.0

package/dist/auth/clerk-transport.js

@@ -1,12 +1,79 @@
-import { createClerkClient as createIsolatedClerkClient } from "./clerk-sdk/client.js";
 import { byteReadResponse } from "../byte-read-response.js";
 import { failureRecord, logFailure } from "../operator-record.js";
+import { runEdge } from "../runtime/run.js";
+import { createClerkClient as createIsolatedClerkClient } from "./clerk-sdk/client.js";
+import { authCatch, authFetch, authFlow, authInvoke, authMethod, authProgram, authValue, registerAuth, } from "./native.js";
+// Bound even an SDK path that ignores a body (204/errors), or reads a clone.
+// Only buffered bytes reach the SDK; no upstream body escapes this transport.
+const MAX_SDK_RESPONSE_BYTES = 1_048_576;
+function sdkFetch(input, init, owner) {
+    return runEdge(authProgram(sdkFetchNative, [input, init, owner]));
+}
+const sdkFetchNative = /* @__PURE__ */ registerAuth(sdkFetch, function (input, init, owner) {
+    return authFlow(function* () {
+        const ended = new AbortController();
+        const signal = AbortSignal.any([
+            ended.signal,
+            ...(owner ? [owner] : []),
+            ...(init?.signal ? [init.signal] : []),
+            ...(input instanceof Request ? [input.signal] : []),
+        ]);
+        const timer = setTimeout(() => ended.abort(new Error("Clerk SDK request timed out")), 10000);
+        let response;
+        let reader;
+        const cancel = () => {
+            void reader?.cancel().catch(() => { });
+        };
+        try {
+            signal.throwIfAborted();
+            response = (yield authFetch(input, { ...init, signal }));
+            reader = response.body?.getReader();
+            void reader?.closed.catch(() => { });
+            signal.addEventListener("abort", cancel, { once: true });
+            const chunks = [];
+            let size = 0;
+            while (reader) {
+                signal.throwIfAborted();
+                const { done, value } = (yield authInvoke(reader, "read", []));
+                signal.throwIfAborted();
+                if (done)
+                    break;
+                size += value.byteLength;
+                if (size > MAX_SDK_RESPONSE_BYTES)
+                    throw new Error("Clerk SDK response too large");
+                chunks.push(value);
+            }
+            const bytes = new Uint8Array(size);
+            let offset = 0;
+            for (const chunk of chunks) {
+                bytes.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            return byteReadResponse(new Response(response.body ? bytes : null, response));
+        }
+        finally {
+            clearTimeout(timer);
+            ended.abort();
+            signal.removeEventListener("abort", cancel);
+            (yield authCatch(authInvoke(reader, "cancel", []), () => { }));
+            reader?.releaseLock();
+            (yield authCatch(authInvoke(response?.body, "cancel", []), () => { }));
+        }
+    });
+});
 /** All SDK network paths, including fresh opaque-verification clients. */
-export function createByteReadingClerkClient(options) {
+export function createByteReadingClerkClient(options, signal, pending) {
     const client = createIsolatedClerkClient({
         ...options,
         telemetry: { disabled: true },
-        fetch: async (input, init) => byteReadResponse(await fetch(input, init)),
+        fetch: authMethod((input, init) => {
+            return authFlow(function* () {
+                const operation = sdkFetch(input, init, signal);
+                pending?.add(operation);
+                void operation.finally(() => pending?.delete(operation)).catch(() => { });
+                return (yield authValue(() => operation));
+            });
+        }),
     });
     // The upstream disabled flag does not cover recordLog or debug output.
     client.telemetry.record = () => { };

package/dist/auth/clerk.d.ts

@@ -17,6 +17,19 @@ export interface ClerkAuthOptions {
      * narrow access; the fallback client list applies to every pool.
      */
     allowedOAuthClientIds?: readonly string[];
+    /**
+     * The one Clerk Organization this deployment admits, as its `org_…` ID,
+     * so one Clerk instance can serve many deployments. Every admitted Clerk
+     * user must be a member: connecta asks Clerk's Backend API and caches the
+     * answer per organization and user for 60 seconds from the start of the
+     * lookup (30 for a non-member). Organization claims in tokens and sessions
+     * are never read. A failed or timed-out lookup refuses admission. Requires
+     * resource-bound tokens, so it cannot be
+     * combined with a nonempty `allowedOAuthClientIds`. Organization roles grant
+     * nothing; `maintainers` and pool `members` still decide what an admitted
+     * user reaches.
+     */
+    organizationId?: string;
     /**
      * Email domains this deployment admits, e.g. `["acme.com"]`. An
      * authenticated user whose verified primary email is not on one of them is