Add TypeScript client SDK

.github/workflows/ci.yml

@@ -3,8 +3,12 @@ name: CI
 on:
   push:
     branches: [master]
+    paths-ignore:
+      - "clients/typescript/**"
   pull_request:
     branches: [master]
+    paths-ignore:
+      - "clients/typescript/**"
 
 permissions:
   contents: read

.github/workflows/ts-client-canary.yml

@@ -0,0 +1,52 @@
+name: TS Client Canary
+
+on:
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  id-token: write
+
+defaults:
+  run:
+    working-directory: clients/typescript
+
+jobs:
+  canary:
+    name: Publish canary
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: clients/typescript/package.json
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 26
+          cache: pnpm
+          cache-dependency-path: clients/typescript/pnpm-lock.yaml
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Version as a canary snapshot
+        run: |
+          # Ignore pre mode so canaries work from any branch (including next).
+          # This only affects the throwaway runner checkout — never a commit.
+          rm -f .changeset/pre.json
+          pnpm changeset version --snapshot canary
+
+      - name: Build
+        run: pnpm build
+
+      - name: Publish to the canary tag
+        run: pnpm changeset publish --tag canary --no-git-tag
+        env:
+          NPM_CONFIG_PROVENANCE: "true"

.github/workflows/ts-client-ci.yml

@@ -0,0 +1,55 @@
+name: TS Client CI
+
+on:
+  push:
+    branches: [master, next]
+    paths: ["clients/typescript/**"]
+  pull_request:
+    paths: ["clients/typescript/**"]
+
+# Cancel superseded runs on the same ref so rapid pushes don't pile up.
+concurrency:
+  group: ts-client-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    working-directory: clients/typescript
+
+jobs:
+  verify:
+    name: Verify
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: clients/typescript/package.json
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: clients/typescript/pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Run tests
+        run: pnpm test
+
+      - name: Build
+        run: pnpm build

.github/workflows/ts-client-release.yml

@@ -0,0 +1,93 @@
+name: TS Client Release
+
+on:
+  push:
+    branches: [master, next]
+    paths: ["clients/typescript/**"]
+
+concurrency:
+  group: ts-client-release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+
+defaults:
+  run:
+    working-directory: clients/typescript
+
+jobs:
+  release:
+    name: Version or publish limen-auth
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - name: Generate release app token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      # The prerelease line must never publish a stable version to @latest, so
+      # refuse to release from `next` unless it's in Changesets beta pre mode.
+      - name: Require beta pre mode on next
+        if: github.ref_name == 'next'
+        run: |
+          file=.changeset/pre.json
+          if [ ! -f "$file" ]; then
+            echo "::error::'next' must be in beta pre mode before releasing, but $file is missing. Run 'pnpm changeset pre enter beta'."
+            exit 1
+          fi
+          mode="$(jq -r '.mode // ""' "$file")"
+          tag="$(jq -r '.tag // ""' "$file")"
+          if [ "$mode" != "pre" ] || [ "$tag" != "beta" ]; then
+            echo "::error::'next' must be in beta pre mode (found mode='$mode', tag='$tag')."
+            exit 1
+          fi
+          echo "next is in beta pre mode."
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: clients/typescript/package.json
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 26
+          cache: pnpm
+          cache-dependency-path: clients/typescript/pnpm-lock.yaml
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Changesets release
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          cwd: clients/typescript
+          version: pnpm version-packages
+          publish: pnpm release
+          title: "chore(client-ts): release"
+          commit: "chore(client-ts): release"
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          NPM_CONFIG_PROVENANCE: "true"
+
+      - name: Stamp release PR title with the version
+        if: steps.changesets.outputs.pullRequestNumber
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          version="$(jq -r '.version' packages/client/package.json)"
+          gh pr edit "${{ steps.changesets.outputs.pullRequestNumber }}" \
+            --title "chore(client-ts): release v${version}"

clients/go.mod

@@ -0,0 +1,3 @@
+module github.com/thecodearcher/limen/clients
+
+go 1.25.0

clients/typescript/.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets).
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md).

clients/typescript/.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "master",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

clients/typescript/.changeset/pre.json

@@ -0,0 +1,10 @@
+{
+  "mode": "pre",
+  "tag": "beta",
+  "initialVersions": {
+    "limen-auth": "0.0.1"
+  },
+  "changesets": [
+    "sour-cars-kiss"
+  ]
+}

clients/typescript/.changeset/sour-cars-kiss.md

@@ -0,0 +1,5 @@
+---
+"limen-auth": patch
+---
+
+Testing CI

clients/typescript/.gitignore

@@ -0,0 +1,12 @@
+node_modules/
+dist/
+coverage/
+*.tsbuildinfo
+.DS_Store
+.env
+.env.local
+.idea/
+.vscode/
+.cursor/
+.claude/
+.npmrc

clients/typescript/.prettierrc.json

@@ -0,0 +1,7 @@
+{
+  "semi": true,
+  "singleQuote": false,
+  "trailingComma": "all",
+  "printWidth": 120,
+  "arrowParens": "always"
+}

clients/typescript/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Brian Iyoha
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

clients/typescript/README.md

@@ -0,0 +1,7 @@
+# Typescript Clients SDKs
+
+TypeScript client SDKs for [Limen](https://github.com/thecodearcher/limen) — a modern, composable authentication library for Go.
+
+## Packages
+
+- [`limen-auth`](./packages/client) — framework-agnostic core

clients/typescript/eslint.config.js

@@ -0,0 +1,32 @@
+// @ts-check
+import js from "@eslint/js";
+import { defineConfig } from "eslint/config";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default defineConfig([
+  {
+    ignores: [
+      "**/dist/**",
+      "**/node_modules/**",
+      "**/*.config.{ts,js,mjs,cjs}",
+    ],
+  },
+  js.configs.recommended,
+  tseslint.configs.recommended,
+  {
+    languageOptions: {
+      ecmaVersion: 2022,
+      sourceType: "module",
+      globals: { ...globals.browser, ...globals.node },
+    },
+    rules: {
+      "@typescript-eslint/consistent-type-imports": "error",
+      "curly": ["error", "all"],
+      "@typescript-eslint/no-unused-vars": [
+        "error",
+        { argsIgnorePattern: "^_", varsIgnorePattern: "^_" },
+      ],
+    },
+  },
+]);

clients/typescript/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@limenauth/root",
+  "private": true,
+  "type": "module",
+  "engines": {
+    "node": ">=20",
+    "pnpm": ">=10"
+  },
+  "packageManager": "pnpm@10.15.0",
+  "scripts": {
+    "build": "pnpm -r --filter './packages/*' run build",
+    "typecheck": "pnpm -r --filter './packages/*' run typecheck",
+    "lint": "eslint packages",
+    "format": "prettier --write \"packages/**/*.{ts,tsx,md}\"",
+    "format:check": "prettier --check \"packages/**/*.{ts,tsx,md}\"",
+    "test": "pnpm -r --filter './packages/*' run test",
+    "changeset": "changeset",
+    "version-packages": "changeset version",
+    "release": "pnpm build && changeset publish --no-git-tag"
+  },
+  "devDependencies": {
+    "@changesets/cli": "^2.31.0",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^25.9.1",
+    "eslint": "^10.4.0",
+    "globals": "^17.6.0",
+    "prettier": "^3.8.3",
+    "tsdown": "^0.22.2",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.59.4"
+  }
+}

clients/typescript/packages/client/CHANGELOG.md

@@ -0,0 +1,13 @@
+# limen-auth
+
+## 0.0.2-beta.0
+
+### Patch Changes
+
+- a0779e1: Testing CI
+
+## 0.0.1
+
+### Patch Changes
+
+- Pre-release test