lakebed 0.0.3-alpha.0 → 0.0.3

package/README.md

@@ -55,6 +55,37 @@ export default capsule({
 });
 ```
 
+## Auth
+
+Every app starts with local guest auth. To let users sign in with Google, render the built-in button. Lakebed always asks Shoo for profile fields so the app can show a useful identifier like `auth.email` or `auth.displayName`.
+
+```tsx
+import { SignInWithGoogle, signOut, useAuth } from "lakebed/client";
+
+export function App() {
+  const auth = useAuth();
+  const authLabel = auth.email ?? auth.displayName;
+
+  return auth.isGuest ? (
+    <SignInWithGoogle />
+  ) : (
+    <button type="button" onClick={() => signOut()}>
+      Sign out {authLabel}
+    </button>
+  );
+}
+```
+
+After sign-in, server handlers receive the verified Google identity through `ctx.auth`:
+
+```ts
+mutations: {
+  save: mutation((ctx) => {
+    ctx.log.info("signed in user", { userId: ctx.auth.userId, email: ctx.auth.email });
+  });
+}
+```
+
 ## Commands
 
 ```sh
@@ -62,7 +93,7 @@ lakebed new <name> [--template todo]
 lakebed dev <capsule-dir> [--port 3000]
 lakebed build <capsule-dir> --target anonymous [--out .lakebed/artifacts/app.json] [--json]
 lakebed deploy [capsule-dir] [--ttl 7d] [--api <url>] [--json]
-lakebed anonymous-server [--port 8787] [--public-root-url <url>]
+lakebed anonymous-server [--port 8787] [--public-root-url <url>] [--app-base-domain <domain>]
 lakebed inspect <deploy-id-or-url> [--api <url>] [--json]
 lakebed db list [deploy-id-or-url] [--port 3000]
 lakebed db dump [deploy-id-or-url] [--port 3000]
@@ -75,7 +106,7 @@ lakebed logs [deploy-id-or-url] [--port 3000]
 - Arbitrary npm imports inside capsules are not supported yet.
 - Node built-ins are not available inside capsule modules.
 - Tailwind classes in JSX are the only styling path in v0.
-- Guest auth is the only auth mode.
+- Guest auth works by default. Google sign-in is built in through Shoo and exposes verified identity on `ctx.auth`.
 - Anonymous deploys disable outbound `fetch`.
 
 ## Hosted Deploys
@@ -94,3 +125,26 @@ lakebed anonymous-server --port 8787
 cd my-app
 lakebed deploy --api http://localhost:8787
 ```
+
+In production, set `PUBLIC_ROOT_URL` to the deploy API origin and `LAKEBED_APP_BASE_DOMAIN` to the app domain without the wildcard prefix:
+
+```sh
+PUBLIC_ROOT_URL=https://api.lakebed.app
+LAKEBED_APP_BASE_DOMAIN=lakebed.app
+```
+
+With a verified `*.lakebed.app` custom domain on the runner, deploy responses use `https://<slug>.lakebed.app`.
+
+Deploy responses include a claim URL. Configure GitHub OAuth on the runner, then open that claim URL to attach the anonymous deploy to a developer account:
+
+```sh
+LAKEBED_GITHUB_CLIENT_ID=...
+LAKEBED_GITHUB_CLIENT_SECRET=...
+LAKEBED_SESSION_SECRET=...
+```
+
+Claimed deploys are listed at `/deploys` on the deploy API origin. They keep the same resource limits as anonymous deploys. The current hosted runner still uses the anonymous interpreter artifact, so outbound `fetch` remains blocked until Lakebed has a claimed runtime target that can safely execute server code.
+
+## Admin Dashboard
+
+Set `LAKEBED_ADMIN_PASSWORD` on the anonymous deploy runner, then open `/admin` on the runner origin. The password is exchanged for an HttpOnly cookie so the dashboard stays unlocked until the cookie expires or the password changes. The resource table can terminate active deploys while preserving their resource history.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lakebed",
-  "version": "0.0.3-alpha.0",
+  "version": "0.0.3",
   "description": "Agent-native CLI and runtime for building and deploying Lakebed capsules.",
   "license": "UNLICENSED",
   "type": "module",
@@ -22,6 +22,7 @@
   "files": [
     "src/anonymous-server.js",
     "src/anonymous.js",
+    "src/auth.js",
     "src/cli.js",
     "src/client.d.ts",
     "src/client.js",
@@ -47,9 +48,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "check": "node --check src/cli.js && node --check src/runtime.js && node --check src/server.js && node --check src/client.js && node --check src/source-store.js && node --check src/anonymous.js && node --check src/anonymous-server.js"
-  },
   "dependencies": {
     "esbuild": "^0.27.1",
     "pg": "^8.16.3",
@@ -58,5 +56,8 @@
   },
   "devDependencies": {
     "@types/ws": "^8.18.1"
+  },
+  "scripts": {
+    "check": "node --check src/cli.js && node --check src/runtime.js && node --check src/server.js && node --check src/client.js && node --check src/source-store.js && node --check src/anonymous.js && node --check src/anonymous-server.js && node --check src/auth.js"
   }
-}
+}