@zeyolabs/kit 2026.11.6 → 2026.11.7

package/README.md

@@ -18,13 +18,11 @@ Peer dependencies: `@sveltejs/kit` 3, `drizzle-orm`, `zod`, `@sentry/sveltekit`;
 
 ## Versions
 
-Date versions: `YYYY.M.D` (the release day in London; semver forbids leading zeros, so
-`2026.11.5`). One release per day.
-
-```
-pnpm release                     # sets the version, commits, tags vYYYY.M.D
-git push origin HEAD vYYYY.M.D   # the tag publishes to npm (publish.yaml)
-```
+Every merge to `main` publishes a new version (`.github/workflows/publish.yaml`). There is no
+release step. Versions are `YYYY.M.N` in London time: `N` counts that month's releases and resets
+each month (`2026.11.7`, `2026.11.8`, then `2026.12.0`). CI sets the version and pushes the
+`vYYYY.M.N` tag; `package.json`'s version in the repo is not updated. Changes to only docs or CI
+don't publish.
 
 Publishing uses npm trusted publishing: the package's npmjs.com settings trust this repo's
 `publish.yaml`, so no npm token is stored anywhere.

package/auth/config.ts

@@ -22,6 +22,11 @@ export type AuthConfig = {
 	accounts: PermissionCatalogue;
 	/** Shown by the browser's passkey prompt and in the magic-link email. */
 	appName: string;
+	/** Share the session cookie with every subdomain of this domain (e.g. `example.com` for
+	 *  `app.example.com` and `mcp.example.com`), so one sign-in covers them all. Every subdomain's
+	 *  server then receives the cookie, so only set it when you control all of them. Default:
+	 *  host-only. Changing it signs everyone out once (the old cookie no longer matches). */
+	cookieDomain?: string;
 	db: () => AuthDb;
 	/** Sends the sign-in email (`magicLinkEmail`): any `IEmailClient`, e.g. `SmtpClient`, or
 	 *  `DevEmailClient` locally (it prints the link). Called per request. */

package/auth/sessions/handle.ts

@@ -93,12 +93,13 @@ function createAuthHandle(options: AuthHandleOptions = {}): Handle {
 					locals.session = { ...live.session, expiresAt };
 					event.cookies.set(config.cookieName, token, {
 						...Sessions.cookieAttributes,
+						domain: config.cookieDomain,
 						expires: new Date(expiresAt),
 					});
 				}
 			} else {
 				if (live) await Sessions.delete(db, live.session.id);
-				event.cookies.delete(config.cookieName, { path: '/' });
+				event.cookies.delete(config.cookieName, { domain: config.cookieDomain, path: '/' });
 			}
 		}
 

package/auth/sessions/sessions.ts

@@ -13,7 +13,8 @@ import { sessions, users } from '../schema';
 const SESSION_LIFETIME_MS = 30 * 24 * 60 * 60 * 1000;
 const SESSION_RENEW_BELOW_MS = 15 * 24 * 60 * 60 * 1000;
 
-/** Session cookie: host-only (no `domain`), `secure` always (browsers treat localhost as secure). */
+/** Session cookie: host-only unless the app sets `cookieDomain`, `secure` always (browsers treat
+ *  localhost as secure). */
 const sessionCookieAttributes = {
 	httpOnly: true,
 	path: '/',

package/auth/sveltekit/routes.ts

@@ -73,6 +73,7 @@ async function signIn(event: RequestEvent, user: AuthUser): Promise<void> {
 	const { expiresAt, token } = await Sessions.create(Auth.config().db(), user.id);
 	event.cookies.set(Auth.config().cookieName, token, {
 		...Sessions.cookieAttributes,
+		domain: Auth.config().cookieDomain,
 		expires: new Date(expiresAt),
 	});
 	await Auth.config().onSignIn?.(user);
@@ -154,7 +155,7 @@ async function verifyLink(event: RequestEvent): Promise<never> {
 async function logout(event: RequestEvent): Promise<never> {
 	const { session } = AuthHandle.locals(event);
 	if (session) await Sessions.delete(Auth.config().db(), session.id);
-	event.cookies.delete(Auth.config().cookieName, { path: '/' });
+	event.cookies.delete(Auth.config().cookieName, { domain: Auth.config().cookieDomain, path: '/' });
 	redirect(303, Auth.config().loginPath);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeyolabs/kit",
-	"version": "2026.11.6",
+	"version": "2026.11.7",
 	"description": "Shared SvelteKit-on-Cloudflare server toolkit: remote-function wrappers, passwordless auth (magic link + passkeys), email over a send_email binding or SMTP, Cloudflare context, monitoring, storage clients, utils and the ESLint config.",
 	"type": "module",
 	"repository": {
@@ -38,8 +38,7 @@
 		"test": "vitest run",
 		"test:integration": "vitest run --config vitest.config.integration.ts",
 		"check": "prettier --check . && pnpm lint && pnpm typecheck && pnpm test",
-		"fmt": "prettier --write .",
-		"release": "node scripts/release.mjs"
+		"fmt": "prettier --write ."
 	},
 	"exports": {
 		"./eslint-config": "./eslint-config.js",