feat: centralize application framework primitives

packages/auth/src/middleware.ts

@@ -79,6 +79,23 @@ export function getAuthUser(ctx: Context): AuthPublicUser | null {
   );
 }
 
+/** Return a typed authenticated user or fail closed for direct handler use. */
+export function requireAuthUser(ctx: Context): AuthPublicUser {
+  const user = getAuthUser(ctx);
+  if (!user) throw new AuthRequiredError();
+  return user;
+}
+
+export class AuthRequiredError extends Error {
+  readonly code = "WRN-AUTH-REQUIRED";
+  readonly status = 401;
+
+  constructor() {
+    super("Authentication is required");
+    this.name = "AuthRequiredError";
+  }
+}
+
 export function getAuthSession(ctx: Context): AuthSession | null {
   return (ctx.locals.authSession as AuthSession | undefined) ?? null;
 }