lecodes-sdk 2.0.3 → 2.0.5

package/src/ui/UITabs.ts

@@ -12,14 +12,15 @@ import type { UIChildArg } from "./UINode"
 // config without screens, mounted per-file with a literal tab id. They share the constants and bar
 // geometry in this file, so a designed mockup and the built app render identically.
 
-/** Active/inactive/bar colors ride the theme — one `theme({ primaryColor, mutedColor, tabbarBg })`
- *  call restyles the bar app-wide; the fallbacks keep an unthemed app looking right. */
-const ACTIVE = "var(--primaryColor, #5b8cff)"
-const INACTIVE = "var(--mutedColor, #8a919e)"
-const BAR_BG = "var(--tabbarBg, #15171c)"
-const BAR_BORDER = "var(--tabbarBorder, #23262e)"
-const SCREEN_BG = "var(--screenBg, #101114)"
-const BADGE_BG = "var(--badgeColor, #ff453a)"
+/** The bar reads the theme's ROLES and nothing of its own — `theme({ accent, textMuted, surface,
+ *  border })` colors it with the rest of the app; `tabs.bar.theme({...})` gives one bar other
+ *  values. The fallbacks keep an unthemed app looking right: a dark bar (on the theme's `bg`
+ *  when only that is set), a hairline that reads on any background. */
+const ACTIVE = "var(--accent, #5b8cff)"
+const INACTIVE = "var(--textMuted, #8a919e)"
+const BAR_BG = "var(--surface, var(--bg, #15171c))"
+const BAR_BORDER = "var(--border, #80808040)"
+const BADGE_BG = "#ff453a"
 
 export type UITabDef = {
   label: string,
@@ -42,8 +43,9 @@ export type UITabDef = {
  * ```
  *
  * In-tab navigation stays the pager's: `UIPager.push(detail)` from any screen (bar stays);
- * `Router.push` opens above the shell (bar covered). Restyle via `theme()` (primaryColor,
- * mutedColor, tabbarBg, …) or the `bar` handle; for a fully custom bar build on `UIPager`.
+ * `Router.push` opens above the shell (bar covered). The bar is colored by the theme's roles
+ * (`accent`, `textMuted`, `surface`, `border`); `tabs.bar.theme({...})` overrides them for this
+ * bar alone, the `bar` handle restyles its box; for a fully custom bar build on `UIPager`.
  */
 export interface UITabs extends UIScreen {
   /** The active tab id. */
@@ -56,7 +58,8 @@ export interface UITabs extends UIScreen {
   badge(id: string, value: number | string | boolean | null): this,
   /** The pager under the bar — in-tab stacks (`push`/`pop`/`depth`). */
   readonly pager: UIPager,
-  /** The bar row (named "tabbar") — for restyling beyond the theme variables. */
+  /** The bar row (named "tabbar") — `bar.theme({ accent, textMuted, surface, border })` for this
+   *  bar's own colors, `bar.style({...})` for its box. */
   readonly bar: UIRowType,
 }
 
@@ -72,8 +75,7 @@ export class TabsElement extends ScreenElement {
   private readonly _selectListeners: ((id: string, index: number) => void)[] = []
 
   constructor(defs: Record<string, UITabDef>) {
-    super("screen", { bgColor: SCREEN_BG }, [])
-    this.style({ bgColor: SCREEN_BG })
+    super("screen", {}, [])
     this.ids = Object.keys(defs)
     if (this.ids.length === 0) console.warn("UITabs: no tabs declared")
 
@@ -208,9 +210,9 @@ export type TabsHandle<T extends Record<string, TabDef>> = {
  * export default () => mainTabs.screen("home", [ ...content ])
  * ```
  *
- * Restyle through the theme — `theme({ primaryColor, mutedColor, tabbarBg, screenBg })` recolors
- * every bar at once. The built app passes the same keys (plus each tab's root screen) to `UITabs`,
- * which renders the identical bar interactively.
+ * The bar reads the theme's roles (`accent`, `textMuted`, `surface`, `border`), the screen its
+ * `bg` — one `theme({...})` colors every bar at once. The built app passes the same keys (plus
+ * each tab's root screen) to `UITabs`, which renders the identical bar interactively.
  */
 export function defineTabs<T extends Record<string, TabDef>>(tabs: T): TabsHandle<T> {
   const ids = Object.keys(tabs) as (keyof T & string)[]
@@ -232,7 +234,7 @@ export function defineTabs<T extends Record<string, TabDef>>(tabs: T): TabsHandl
     UIScreen(
       UIColumn(...children).style({ flexGrow: 1, p: 16, pt: "safe-top" }),
       bar(active),
-    ).style({ bgColor: SCREEN_BG })
+    )
 
   return { ids, bar, screen }
 }

package/src/ui/styleColor.ts

@@ -30,17 +30,26 @@ export const wireColor = (key: string, v: unknown): unknown => {
  *  `background` is one; a string stays (the core's shorthand tells a color from a width, an image,
  *  a gradient — same grammar) and a number under `border*` is a width. Every other key as is. */
 export const wireValue = (key: string, v: unknown): unknown => {
+  // An SVG source (`asset("./x.svg")`, `assetIcon`) as a background: the wire spelling an image
+  // node's src has, "svg:<markup>". (A fetch response / a file goes as it is: the runtime reads
+  // its handle.) The source's own tint is an image node's — a background has none.
+  if (isSvgSource(v)) return IMAGE_KEYS.has(key) ? "svg:" + v.svg : v
   if (COLOR_SHORTHAND_KEYS.has(key)) {
     return key === "background" && (typeof v === "number" || Array.isArray(v)) ? wireColor(key, v) : v
   }
   return COLOR_KEYS.has(key) ? wireColor(key, v) : v
 }
 
+const IMAGE_KEYS = new Set(["backgroundImage", "bgImage"])
+
+const isSvgSource = (v: unknown): v is { svg: string } =>
+  typeof v === "object" && v !== null && typeof (v as { svg?: unknown }).svg === "string"
+
 // A nested state block (a `$class`: `$pressed`, `$landscape`, `$checked`, …): a plain object that is
 // not a host handle — a backgroundImage FetchResponse / File carries `_h` (the runtime's
 // own rule, presentation/tree.cpp mergeStyleLayer).
 const isBlock = (v: unknown): v is Record<string, unknown> =>
-  typeof v === "object" && v !== null && !Array.isArray(v) && !("_h" in v)
+  typeof v === "object" && v !== null && !Array.isArray(v) && !("_h" in v) && !isSvgSource(v)
 
 /** @internal A style bag → its wire form: {@link wireValue} per key, nested state blocks
  *  recursively. Copy on write: the SAME object comes back when nothing changed. */

package/src/ui/theme.ts

@@ -1,30 +1,78 @@
-// theme() — app theme variables (docs/ui-theme-plan.md). One global var table lives in the UI
-// core; `var(--key)` references resolve at style-apply time, so re-calling theme() re-styles the
-// LIVE UI. Bare style tokens (`pt: "comfort-top"`) are keywords that may expand to formulas
+// theme() — app theme variables. One var table lives in the UI core; `var(--key)` references
+// resolve at style-apply time, so re-calling theme() re-styles the LIVE UI. A node may carry
+// variables of its own (`el.theme({...})`): a SCOPE its subtree reads before the app's table.
+// Bare style tokens (`pt: "comfort-top"`) are keywords that may expand to formulas
 // (max(safe-top, knob)); `var(--comfort-top)` always reads the raw table value.
 
 import type { Transition } from "./presentable"
 
 export type ThemeValues = Record<string, string | number | null>
 
+/** The keys the SDK itself reads — the ROLES of a theme. An app's own keys sit beside them in the
+ *  same call; kit components (`UITabs`) and the defaults of screens and text read these and nothing
+ *  else, so one palette colors the app and the kit alike. A color is a string, never a number. */
+export type ThemeRoles = {
+  /** The background of every screen. */
+  bg?: string | null
+  /** A raised surface — cards, bars, sheets. The tab bar's background (without it: `bg`). */
+  surface?: string | null
+  /** Hairlines and outlines. The tab bar's top line. */
+  border?: string | null
+  /** Text that names no `color` of its own. */
+  text?: string | null
+  /** Secondary text and inactive controls. The tab bar's inactive tabs. */
+  textMuted?: string | null
+  /** The brand / active color. The tab bar's active tab. */
+  accent?: string | null
+  /** The font of text that names no `fontFamily` of its own. */
+  fontFamily?: string | null
+}
+
+/** What only the app-wide `theme()` takes: the comfort knobs (logical px) and the Router's default
+ *  `replace` transition. */
+export type ThemeAppKeys = {
+  "comfort-top"?: number | string | null
+  "comfort-bottom"?: number | string | null
+  "comfort-left"?: number | string | null
+  "comfort-right"?: number | string | null
+  replaceTransition?: Transition | null
+}
+
 /** @internal Navigation defaults the theme owns; the router reads them at call time.
  *  (SDK-side state, deliberately NOT in the host var table — `var(--replaceTransition)`
  *  is not a style value.) */
 export const _navDefaults: { replace: Transition } = { replace: "none" }
 
-// (Unconstrained: it also maps inputs whose `replaceTransition` key was carved out.)
+/** The `var(--key)` strings of the keys a `theme()` call defined — plain strings, so a helper's
+ *  `(color = colors.accent)` parameter takes any color. */
 export type ThemeAccessors<T> = {
-  readonly [K in keyof T]: K extends string ? `var(--${K})` : never
+  readonly [K in Exclude<keyof T, "replaceTransition">]: string
 }
 
 const RESERVED = ["safe-top", "safe-bottom", "safe-left", "safe-right", "vw", "vh", "vmin", "vmax"]
+const APP_ONLY = ["comfort-top", "comfort-bottom", "comfort-left", "comfort-right", "replaceTransition"]
+
+// The keys of `values` that go to the var table (a copy only when one is held back).
+const tableValues = (values: Record<string, unknown>, held: (key: string) => boolean): ThemeValues => {
+  let send = values as ThemeValues
+  for (const key of Object.keys(values)) {
+    if (!held(key)) continue
+    if (send === values) send = { ...values } as ThemeValues
+    delete send[key]
+  }
+  return send
+}
 
 /**
- * Merge app theme variables into the live table and get typed `var(--key)` accessors back:
+ * Merge app theme variables into the live table and get their `var(--key)` accessors back:
  *
  * ```ts
- * export const T = theme({ primaryColor: "#0A84FF", cardBg: "#1C1C1E" })
- * card.style({ bgColor: T.cardBg })   // T.cardBg === "var(--cardBg)"
+ * export const colors = theme({
+ *   bg: "#F4F6F5", surface: "#FFFFFF", border: "#E4E8E6",     // the roles the SDK reads too
+ *   text: "#131A17", textMuted: "#606B65", accent: "#15A34A",
+ *   accentSoft: "#E7F6ED",                                    // the app's own keys
+ * })
+ * card.style({ bgColor: colors.surface })   // colors.surface === "var(--surface)"
  * ```
  *
  * Strings pass through as written (colors — the core parses CSS —, fonts, expressions like
@@ -34,47 +82,54 @@ const RESERVED = ["safe-top", "safe-bottom", "safe-left", "safe-right", "vw", "v
  * `replaceTransition` — the app-wide default transition for `Router.replace` (consumed SDK-side,
  * never sent to the host table).
  */
-const setTheme = <T extends Record<string, string | number | Transition | null>>(
+const setTheme = <T extends ThemeRoles & ThemeAppKeys & Record<string, string | number | Transition | null>>(
   // Only `replaceTransition` may carry a Transition — every other key is a style value.
   values: T & { [K in Exclude<keyof T, "replaceTransition">]: string | number | null }
-): ThemeAccessors<Omit<T, "replaceTransition">> => {
+): ThemeAccessors<T> => {
+  if ("replaceTransition" in values) _navDefaults.replace = (values.replaceTransition ?? "none") as Transition
+  const send = tableValues(values, (key) => {
+    if (key === "replaceTransition") return true   // SDK-consumed, no accessor: it isn't a style var
+    if (!RESERVED.includes(key)) return false
+    console.warn(`theme(): "${key}" is an environment value (host-owned) — ignored`)
+    return true
+  })
   const accessors: Record<string, string> = {}
-  let send = values as ThemeValues
-  const own = () => { if (send === values) send = { ...values } as ThemeValues }
-  const strip = (key: string) => {
-    own()
-    delete send[key]
-  }
-  for (const key of Object.keys(values)) {
-    if (key === "replaceTransition") {
-      _navDefaults.replace = (values[key] ?? "none") as Transition
-      strip(key)   // SDK-consumed, no accessor: it isn't a style var
-      continue
-    }
-    if (RESERVED.includes(key)) {
-      console.warn(`theme(): "${key}" is an environment value (host-owned) — ignored`)
-      strip(key)
-      continue
-    }
-    accessors[key] = `var(--${key})`
-  }
+  for (const key of Object.keys(send)) accessors[key] = `var(--${key})`
   if (Object.keys(send).length > 0) _creatorTree.setTheme(send)
-  return accessors as ThemeAccessors<Omit<T, "replaceTransition">>
+  return accessors as ThemeAccessors<T>
+}
+
+/** @internal `el.theme(values)`: the same variables for ONE node's subtree. */
+export const _setNodeTheme = (id: number, values: Record<string, string | number | null>): void => {
+  const send = tableValues(values, (key) => {
+    const appOnly = APP_ONLY.includes(key)
+    if (!appOnly && !RESERVED.includes(key)) return false
+    console.warn(appOnly
+      ? `el.theme(): "${key}" is app-wide — set it with theme()`
+      : `el.theme(): "${key}" is an environment value (host-owned) — ignored`)
+    return true
+  })
+  if (id !== 0 && Object.keys(send).length > 0) _creatorTree.setNodeTheme(id, send)
 }
 
 /** App theme: callable to merge variables (`theme({...})` — re-calling re-styles the live UI, so
- *  dark mode is just a second call), with the system vars as static properties
- *  (`theme.primaryColor`, `theme["comfort-top"]`, …). */
+ *  dark mode is just a second call), with the roles as static properties (`theme.accent`,
+ *  `theme["comfort-top"]`, …) for code that has no tokens module to import. */
 export const theme = Object.assign(setTheme, {
-  /** The app accent color. Kit components will read it via `var(--primaryColor, <fallback>)`. */
-  primaryColor: "var(--primaryColor)",
-  /** Secondary / inactive content color for kit components. */
-  mutedColor: "var(--mutedColor)",
-  /** DEFAULT text color — text without an explicit `color` follows it (hosts source their
-   *  default from the theme; unset = the host default, white on dark screens). Set it once for
-   *  a light theme instead of `color: "black"` on every label. */
-  color: "var(--color)",
-  /** DEFAULT text font — text without an explicit `fontFamily` follows it. */
+  /** The background of every screen. */
+  bg: "var(--bg)",
+  /** A raised surface — cards, bars, sheets. */
+  surface: "var(--surface)",
+  /** Hairlines and outlines. */
+  border: "var(--border)",
+  /** DEFAULT text color — text without a `color` of its own follows it (unset = the host's
+   *  default: white). Set it once for a light theme instead of a color on every label. */
+  text: "var(--text)",
+  /** Secondary text and inactive controls. */
+  textMuted: "var(--textMuted)",
+  /** The brand / active color. */
+  accent: "var(--accent)",
+  /** DEFAULT text font — text without a `fontFamily` of its own follows it. */
   fontFamily: "var(--fontFamily)",
   /** Raw comfort knobs (logical px). The bare `comfort-top` style TOKEN applies the safe-area
    *  formula — these accessors read the knob value itself, for manual composition. */

package/src/version.ts

@@ -4,7 +4,7 @@
 // same manifest). Its MAJOR is the bundle ↔ runtime contract: a bundle's `// sdk:` header line
 // and a host's embedded version must agree on the major for the host to run the bundle; minor
 // and patch never gate anything (features are detected, never versioned).
-export const SDK_VERSION = "2.0.3"
+export const SDK_VERSION = "2.0.5"
 
 /** The major of a semver string, or null when it is not one. */
 export const sdkMajor = (version: string | null | undefined): number | null => {

package/tests/helpers/fakeTree.ts

@@ -117,6 +117,7 @@ export class FakeTree {
     if (enabled) n.classes.add(name); else n.classes.delete(name)
   }
   setTheme = (values: Record<string, any>): void => { this.rec("setTheme", values) }
+  setNodeTheme = (id: number, values: Record<string, any>): void => { this.rec("setNodeTheme", id, values) }
 
   // ---- presentation ----------------------------------------------------------------------------------
   private present(d: Dest, transition: number): void {

package/dist/types/plugins/oauth.d.ts

@@ -1,25 +0,0 @@
-export type OAuthProviderName = "google" | "apple" | "yandex" | "vk";
-/** What a native provider SDK yields — pass it verbatim to your endpoint / `auth.oauth.signIn`. */
-export type OAuthCredential = {
-    provider: OAuthProviderName;
-    /** OAuth access token (Yandex, VK ID). */
-    accessToken?: string;
-    /** OpenID identity token (Google, Apple). */
-    idToken?: string;
-    /** Apple only sends the name once, on the first sign-in — forward it so the server can store it. */
-    name?: string;
-    email?: string;
-};
-/**
- * Native provider sign-in. `OAuth.isSupported` reports whether this host registered the service;
- * `OAuth.providers()` which providers it has SDKs for. Otherwise open `auth.oauth.url(provider)` (server)
- * with `openURL` — the browser broker.
- */
-export declare const OAuth: {
-    /** Whether this host registered an "oauth" service. */
-    readonly isSupported: boolean;
-    /** The providers this host can sign in with natively. */
-    providers(): Promise<OAuthProviderName[]>;
-    /** Run the provider's native sheet; resolves with the credential for `auth.oauth.signIn`. Rejects "cancelled" / "unavailable". */
-    signIn(provider: OAuthProviderName): Promise<OAuthCredential>;
-};

package/dist/types/server/auth/global.d.ts

@@ -1,56 +0,0 @@
-/**
- * The `auth` server global (docs/backend-plan.md §3.4) — the BUNDLE side. State (`auth.user`,
- * `auth.session`) is read from the current request, which the host resolved before the endpoint ran;
- * operations (`auth.email.*`, `auth.oauth.url`, `signIn/signOut`, `sessions`) forward to the host's
- * `AuthOps` on `globalThis.__lecodesAuth` (a seam: the compiled bundle carries its own SDK copy). Nothing
- * here touches the db or a secret; `auth.model.*` are pure schema factories.
- */
-import type { Model, Query } from "../db/types";
-import { type AuthProvider, type SessionFields, type UserFields } from "./models";
-import type { AuthUser, OAuthCredential } from "./types";
-/** The schema of the two built-in models, for typing `auth.sessions` (developer extras aren't visible here). */
-type AuthSchema = {
-    User: Model<UserFields>;
-    Session: Model<SessionFields>;
-};
-export declare const auth: {
-    /** The signed-in user (built-in fields; custom ones via `db.user`) or `null`. Request-scoped. */
-    readonly user: AuthUser | null;
-    /** The device session — exists from the first request, before any login. */
-    readonly session: {
-        readonly id: number;
-    };
-    /**
-     * The signed-in user, or `throw new ApiError(401)`; with `match`, every given field must equal the user's
-     * (`{ role: "admin" }`, `{ plan: "pro" }`) or it's a 403.
-     */
-    requireUser(match?: Record<string, unknown>): AuthUser;
-    email: {
-        /** Emails a 6-digit code to `email` (always resolves — no "email exists" oracle; rate-limited). Needs `"email"` in app.json providers. */
-        sendCode: (email: string) => Promise<void>;
-        /** The only email sign-in: checks the code sent to this device session, finds/creates the `User`, binds the session. */
-        verify: (email: string, code: string) => Promise<AuthUser>;
-    };
-    oauth: {
-        /** A one-time sign-in URL for the platform's OAuth broker (`"google" | "apple" | "yandex" | "vk"`), bound to this device session — open it in the browser. */
-        url: (provider: Exclude<AuthProvider, "email">) => Promise<string>;
-        /**
-         * Sign in with a credential a NATIVE provider SDK produced in the app (client `OAuth.signIn(provider)`):
-         * the platform verifies it with the provider, finds/links/creates the `User`, binds this session. The
-         * in-app counterpart of the browser broker — same accounts either way.
-         */
-        signIn: (provider: Exclude<AuthProvider, "email">, credential: OAuthCredential) => Promise<AuthUser>;
-    };
-    /** Escape hatch for developer-verified identities (Telegram initData, SSO): binds this session to `userId`. */
-    signIn: (userId: number) => Promise<AuthUser>;
-    /** Unbinds the user; the device stays a guest with the same `session.id` (token rotated). */
-    signOut: () => Promise<void>;
-    /** The current user's sessions ("my devices"): a `db.session` query — `await`, `.select()`, `.where(...).updateMany({ revoked: true })`. */
-    readonly sessions: Query<AuthSchema, "Session">;
-    /** Schema-time factories — see ./models.ts. */
-    model: {
-        user: <E extends import("../db/types").Fields = {}>(extra?: E) => import("./models").AuthModel<UserFields & E>;
-        session: <E extends import("../db/types").Fields = {}>(extra?: E) => import("./models").AuthModel<SessionFields & E>;
-    };
-};
-export type { AuthUser };

package/src/plugins/oauth.ts

@@ -1,61 +0,0 @@
-// OAuth — native provider sign-in as a typed service plugin (docs/backend-plan.md §3.4). The
-// browser broker (`auth.oauth.url()` on the server + `openURL` in the app) works everywhere; on
-// hosts that ship a provider SDK (Yandex LoginSDK, VK ID, Sign in with Apple, Google Sign-In) the
-// user shouldn't leave the app — the host registers an "oauth" service that runs the native sheet
-// and hands back the provider's CREDENTIAL. The app then calls its own endpoint, which does
-// `auth.oauth.signIn(provider, credential)`: the server verifies the credential with the provider
-// (audience = the platform's app ids) and binds the device session. No token is ever trusted
-// client-side; the credential is opaque to the app.
-//
-// Host-OPTIONAL — gate on `OAuth.isSupported(provider)`; fall back to the browser broker otherwise.
-//
-// Service contract ("oauth"): call `signIn(provider) → OAuthCredential` (rejects "cancelled" /
-// "unavailable"), call `providers() → string[]` (which providers this host has SDKs for).
-
-import { ServiceClient } from "../runtime/service"
-
-export type OAuthProviderName = "google" | "apple" | "yandex" | "vk"
-
-/** What a native provider SDK yields — pass it verbatim to your endpoint / `auth.oauth.signIn`. */
-export type OAuthCredential = {
-  provider: OAuthProviderName
-  /** OAuth access token (Yandex, VK ID). */
-  accessToken?: string
-  /** OpenID identity token (Google, Apple). */
-  idToken?: string
-  /** Apple only sends the name once, on the first sign-in — forward it so the server can store it. */
-  name?: string
-  email?: string
-}
-
-/**
- * Native provider sign-in. `OAuth.isSupported` reports whether this host registered the service;
- * `OAuth.providers()` which providers it has SDKs for. Otherwise open `auth.oauth.url(provider)` (server)
- * with `openURL` — the browser broker.
- */
-// PURE IIFE so an app that never uses it tree-shakes the plugin away (see Geolocation).
-export const OAuth: {
-  /** Whether this host registered an "oauth" service. */
-  readonly isSupported: boolean
-  /** The providers this host can sign in with natively. */
-  providers(): Promise<OAuthProviderName[]>
-  /** Run the provider's native sheet; resolves with the credential for `auth.oauth.signIn`. Rejects "cancelled" / "unavailable". */
-  signIn(provider: OAuthProviderName): Promise<OAuthCredential>
-} = /*#__PURE__*/ (() => {
-  let client: ServiceClient | null = null
-  const service = (): ServiceClient => client ??= new ServiceClient("oauth")
-  const assertSupported = (): void => {
-    if (!ServiceClient.isSupported("oauth")) {
-      throw new Error("OAuth isn't available on this host — it needs a registered \"oauth\" service; open auth.oauth.url(provider) in the browser instead.")
-    }
-  }
-  return {
-    get isSupported() { return ServiceClient.isSupported("oauth") },
-    providers: async () => { assertSupported(); const p = await service().call("providers"); return Array.isArray(p) ? p : [] },
-    signIn: async (provider) => {
-      assertSupported()
-      const r = await service().call("signIn", provider)
-      return { provider, ...(r ?? {}) }
-    },
-  }
-})()

package/src/server/auth/global.ts

@@ -1,80 +0,0 @@
-/**
- * The `auth` server global (docs/backend-plan.md §3.4) — the BUNDLE side. State (`auth.user`,
- * `auth.session`) is read from the current request, which the host resolved before the endpoint ran;
- * operations (`auth.email.*`, `auth.oauth.url`, `signIn/signOut`, `sessions`) forward to the host's
- * `AuthOps` on `globalThis.__lecodesAuth` (a seam: the compiled bundle carries its own SDK copy). Nothing
- * here touches the db or a secret; `auth.model.*` are pure schema factories.
- */
-
-import { currentRequest, type RequestContext } from "../context"
-import type { Model, Query } from "../db/types"
-import { ApiError } from "../errors"
-import { authSessionModel, authUserModel, type AuthProvider, type SessionFields, type UserFields } from "./models"
-import type { AuthOps, AuthState, AuthUser, OAuthCredential } from "./types"
-
-const seam = globalThis as unknown as { __lecodesAuth?: AuthOps }
-const ops = (): AuthOps => {
-  const o = seam.__lecodesAuth
-  if (!o) throw new Error("auth: not available — the host did not install the auth runtime (globalThis.__lecodesAuth)")
-  return o
-}
-const ctx = (): RequestContext => {
-  const c = currentRequest()
-  if (!c) throw new Error("auth: no current request — auth.* is only available while handling an endpoint or a channel join")
-  return c
-}
-const state = (): AuthState => {
-  const c = ctx()
-  const s = c.auth as AuthState | undefined
-  if (!s) throw new Error("auth: this project has no database — sessions need a defineDb() (auth.model.* are optional, Session is added for you)")
-  return s
-}
-
-/** The schema of the two built-in models, for typing `auth.sessions` (developer extras aren't visible here). */
-type AuthSchema = { User: Model<UserFields>, Session: Model<SessionFields> }
-
-export const auth = {
-  /** The signed-in user (built-in fields; custom ones via `db.user`) or `null`. Request-scoped. */
-  get user(): AuthUser | null { return state().user },
-  /** The device session — exists from the first request, before any login. */
-  get session(): { readonly id: number } { return { id: state().sessionId } },
-  /**
-   * The signed-in user, or `throw new ApiError(401)`; with `match`, every given field must equal the user's
-   * (`{ role: "admin" }`, `{ plan: "pro" }`) or it's a 403.
-   */
-  requireUser(match?: Record<string, unknown>): AuthUser {
-    const u = state().user
-    if (!u) throw new ApiError(401, "Sign in required")
-    if (match) for (const [k, v] of Object.entries(match)) if ((u as Record<string, unknown>)[k] !== v) throw new ApiError(403, "Forbidden")
-    return u
-  },
-  email: {
-    /** Emails a 6-digit code to `email` (always resolves — no "email exists" oracle; rate-limited). Needs `"email"` in app.json providers. */
-    sendCode: (email: string): Promise<void> => ops().email.sendCode(ctx(), email),
-    /** The only email sign-in: checks the code sent to this device session, finds/creates the `User`, binds the session. */
-    verify: (email: string, code: string): Promise<AuthUser> => ops().email.verify(ctx(), email, code),
-  },
-  oauth: {
-    /** A one-time sign-in URL for the platform's OAuth broker (`"google" | "apple" | "yandex" | "vk"`), bound to this device session — open it in the browser. */
-    url: (provider: Exclude<AuthProvider, "email">): Promise<string> => ops().oauth.url(ctx(), provider),
-    /**
-     * Sign in with a credential a NATIVE provider SDK produced in the app (client `OAuth.signIn(provider)`):
-     * the platform verifies it with the provider, finds/links/creates the `User`, binds this session. The
-     * in-app counterpart of the browser broker — same accounts either way.
-     */
-    signIn: (provider: Exclude<AuthProvider, "email">, credential: OAuthCredential): Promise<AuthUser> => ops().oauth.signIn(ctx(), provider, credential),
-  },
-  /** Escape hatch for developer-verified identities (Telegram initData, SSO): binds this session to `userId`. */
-  signIn: (userId: number): Promise<AuthUser> => ops().signIn(ctx(), userId),
-  /** Unbinds the user; the device stays a guest with the same `session.id` (token rotated). */
-  signOut: (): Promise<void> => ops().signOut(ctx()),
-  /** The current user's sessions ("my devices"): a `db.session` query — `await`, `.select()`, `.where(...).updateMany({ revoked: true })`. */
-  get sessions(): Query<AuthSchema, "Session"> { return ops().sessions(ctx()) },
-  /** Schema-time factories — see ./models.ts. */
-  model: {
-    user: authUserModel,
-    session: authSessionModel,
-  },
-}
-
-export type { AuthUser }