@rkat/web 0.5.2 → 0.6.0

package/dist/auth.d.ts

@@ -0,0 +1,181 @@
+/**
+ * Web SDK auth bindings — plan §4c.10 + §4d.wasm.3.
+ *
+ * This module provides:
+ *   - `Auth` — TypeScript wrapper for the generated `auth/*` RPC method
+ *     family. Surfaces targeting the JSON-RPC stdio server or the REST API
+ *     over fetch should instantiate this class with the appropriate
+ *     transport.
+ *   - `registerExternalAuthResolver` — wraps the WASM-bundled
+ *     `register_external_auth_resolver` binding so a browser host page
+ *     can install an OAuth-backed resolver callback that hands Meerkat a
+ *     typed lease envelope per structural auth binding reference.
+ *   - `withAuthBinding` — convenience helper that wires an existing
+ *     session config with an auth binding reference for `createSession`.
+ *
+ * The WASM runtime's session-creation path (plan §4d.wasm.2) takes
+ * credentials either from bootstrap-time realm config (populated via
+ * `initRuntimeFromConfig`) or from a host-registered external-auth
+ * resolver. Per-session `apiKey` is deleted.
+ */
+import type { AuthRpcMethod, CreateProfileParams, DeviceCompleteParams, DeviceStartParams, LoginCompleteParams, LoginStartParams, ProvisionApiKeyParams, WireAuthMethod, WireAuthProfile, WireAuthProfileCleared, WireAuthProfileCreated, WireAuthProfileDetail, WireAuthProfilesList, WireAuthStatusDetail, WireBackendKind, WireBindingIdentity, WireDeviceCompleteResult, WireDeviceStart, WireLoginReady, WireLoginStart, WireProvisionApiKeyResult } from './generated/auth.js';
+import type { AuthBindingRef, SessionConfig } from './types.js';
+export type { WireAuthMethod, WireAuthProvider, WireBackendKind, WireCredentialSourceKind, WireAuthStatusState, } from './generated/auth.js';
+/** Canonical WASM external-auth resolver handle for host-owned browser auth. */
+export declare const WASM_EXTERNAL_AUTH_RESOLVER_HANDLE: "wasm_host";
+/** Non-secret metadata attached to a resolved host-owned auth lease. */
+export interface ExternalAuthMetadata {
+    account_id?: string;
+    workspace_id?: string;
+    organization_id?: string;
+    user_id?: string;
+    plan?: string;
+    route_hints?: unknown;
+    provider_metadata?: unknown;
+}
+/** Typed auth lease shape accepted by the WASM external-auth resolver. */
+export type ExternalAuthLease = {
+    kind: 'inline_secret';
+    secret: string;
+    metadata: ExternalAuthMetadata;
+    expires_at?: string | null;
+} | {
+    kind: 'static_headers';
+    headers: Array<[string, string]>;
+    metadata: ExternalAuthMetadata;
+    expires_at?: string | null;
+} | {
+    kind: 'dynamic_authorizer';
+    metadata: ExternalAuthMetadata;
+    expires_at?: string | null;
+} | {
+    kind: 'none';
+    metadata: ExternalAuthMetadata;
+};
+/** Structured auth failure shape that host resolvers may reject with. */
+export type ExternalAuthFailure = {
+    kind: 'missing_secret';
+} | {
+    kind: 'unsupported_combination';
+    backend: WireBackendKind;
+    auth: WireAuthMethod;
+} | {
+    kind: 'missing_required_metadata';
+    field: string;
+} | {
+    kind: 'workspace_mismatch';
+} | {
+    kind: 'expired';
+} | {
+    kind: 'refresh_failed';
+    detail: string;
+} | {
+    kind: 'interactive_login_required';
+} | {
+    kind: 'host_owned_unavailable';
+} | {
+    kind: 'io';
+    detail: string;
+} | {
+    kind: 'other';
+    detail: string;
+};
+/** Successful resolver result. Leases preserve expiration and metadata across
+ * the WASM boundary by using a structured envelope. */
+export type ExternalAuthResolverResult = ExternalAuthLease;
+/** Host-page resolver callback that the WASM runtime invokes when the
+ * selected binding's credential source is `external_resolver`. Takes a
+ * structural auth binding reference, and returns a typed lease envelope. Reject
+ * the returned promise with `ExternalAuthFailure` to preserve stable failure
+ * truth. */
+export type ExternalAuthResolver = (authBinding: AuthBindingRef) => ExternalAuthResolverResult | Promise<ExternalAuthResolverResult>;
+/** JSON-RPC-style transport used by the `Auth` class. Minimal: just
+ * async request/response of (method, params) -> result. */
+export interface AuthTransport {
+    request<P = unknown, R = unknown>(method: AuthRpcMethod, params?: P): Promise<R>;
+}
+/** Wire projection of a configured auth profile. */
+export type AuthProfile = WireAuthProfile;
+/** Binding-scoped identity returned by auth write/status calls. */
+export type AuthBindingIdentity = WireBindingIdentity & {
+    profile_id: string;
+};
+/** Auth profile list result returned by `auth/profile/list`. */
+export type AuthProfilesList = WireAuthProfilesList;
+/** Result returned by `auth/profile/get`. */
+export type AuthProfileDetail = WireAuthProfileDetail;
+/** Result returned by profile creation. */
+export type AuthProfileCreated = WireAuthProfileCreated;
+/** Result returned by profile deletion / logout. */
+export type AuthCredentialsCleared = WireAuthProfileCleared;
+/** OAuth credential persistence result returned by login completion calls. */
+export type AuthLoginReady = WireLoginReady;
+/** Binding credential status. */
+export type AuthStatus = WireAuthStatusDetail;
+/** OAuth login-start payload. */
+export type OAuthLoginStart = WireLoginStart;
+/** Device-code login start payload returned by `auth/login/device_start`. */
+export type AuthDeviceStart = WireDeviceStart;
+/** Device-code login poll result returned by `auth/login/device_complete`. */
+export type AuthDeviceCompleteResult = WireDeviceCompleteResult;
+/** Anthropic Console-OAuth to API-key provisioning result. */
+export type AuthProvisionApiKeyResult = WireProvisionApiKeyResult;
+/**
+ * Typed wrapper over the meerkat RPC `auth/*` method family. Works
+ * against any transport that speaks `(method, params) -> result`
+ * (the stdio RPC binary, a REST-backed adapter, an in-process shim,
+ * etc.).
+ */
+export declare class Auth {
+    private readonly transport;
+    constructor(transport: AuthTransport);
+    /** Persist credentials for a managed-store binding. */
+    createProfile(params: CreateProfileParams): Promise<AuthProfileCreated>;
+    /** Enumerate configured auth profiles for a realm. */
+    listProfiles(realm_id: string): Promise<AuthProfilesList>;
+    /** Fetch the profile resolved by a binding. */
+    getProfile(realm_id: string, binding_id: string): Promise<AuthProfileDetail>;
+    /** Clear credentials for a binding. */
+    deleteProfile(realm_id: string, binding_id: string): Promise<AuthCredentialsCleared>;
+    /** Begin an OAuth browser flow. */
+    loginStart(params: LoginStartParams): Promise<OAuthLoginStart>;
+    /** Finalize an OAuth browser flow. */
+    loginComplete(params: LoginCompleteParams): Promise<AuthLoginReady>;
+    /** Start a device-code flow for keyboardless hosts. */
+    loginDeviceStart(params: DeviceStartParams): Promise<AuthDeviceStart>;
+    /** Single-poll completion leg for the device-code flow. */
+    loginDeviceComplete(params: DeviceCompleteParams): Promise<AuthDeviceCompleteResult>;
+    /** Anthropic Console-OAuth to API-key provisioning. */
+    loginProvisionApiKey(params: ProvisionApiKeyParams): Promise<AuthProvisionApiKeyResult>;
+    /** Current status for a binding's stored credentials. */
+    status(realm_id: string, binding_id: string, profile_id?: string): Promise<AuthStatus>;
+    /** Revoke and delete credentials for a binding. */
+    logout(realm_id: string, binding_id: string, profile_id?: string): Promise<AuthCredentialsCleared>;
+}
+/**
+ * Install a host-page external-auth resolver in the loaded WASM
+ * runtime. The resolver is consulted per-session when the binding's
+ * credential source is `external_resolver`.
+ *
+ * Plan §4d.wasm.1 + §4d.wasm.3: browser OAuth flows run in the host
+ * page; the resolver hands Meerkat a structured `ExternalAuthLease` on
+ * demand. Meerkat never touches the host's refresh token. Reject with
+ * `ExternalAuthFailure` to preserve denial, refresh, or missing-credential
+ * truth across the WASM boundary.
+ */
+export declare function registerExternalAuthResolver(wasm: {
+    register_external_auth_resolver: (cb: unknown) => void;
+}, resolver: ExternalAuthResolver): void;
+/**
+ * Clear the previously-registered external-auth resolver. Subsequent
+ * session creations will fall back to the realm config's default
+ * credential source.
+ */
+export declare function clearExternalAuthResolver(wasm: {
+    register_external_auth_resolver: (cb: unknown) => void;
+}): void;
+/** Return a session config with an explicit auth auth binding. */
+export declare function withAuthBinding<T extends SessionConfig>(authBinding: AuthBindingRef, config: T): T & {
+    authBinding: AuthBindingRef;
+};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAuBH,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EAEpB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,eAAe,EACf,cAAc,EACd,cAAc,EACd,yBAAyB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,gFAAgF;AAChF,eAAO,MAAM,kCAAkC,EAAG,WAAoB,CAAC;AAEvE,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GACzB;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;CAChC,CAAC;AAEN,yEAAyE;AACzE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,yBAAyB,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACnF;IAAE,IAAI,EAAE,2BAA2B,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,4BAA4B,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,wBAAwB,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC;uDACuD;AACvD,MAAM,MAAM,0BAA0B,GAAG,iBAAiB,CAAC;AAE3D;;;;YAIY;AACZ,MAAM,MAAM,oBAAoB,GAAG,CACjC,WAAW,EAAE,cAAc,KACxB,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;AAEtE;2DAC2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAClF;AAED,oDAAoD;AACpD,MAAM,MAAM,WAAW,GAAG,eAAe,CAAC;AAC1C,mEAAmE;AACnE,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/E,gEAAgE;AAChE,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AACpD,6CAA6C;AAC7C,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AACtD,2CAA2C;AAC3C,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AACxD,oDAAoD;AACpD,MAAM,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AAC5D,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GAAG,cAAc,CAAC;AAC5C,iCAAiC;AACjC,MAAM,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAC9C,iCAAiC;AACjC,MAAM,MAAM,eAAe,GAAG,cAAc,CAAC;AAC7C,6EAA6E;AAC7E,MAAM,MAAM,eAAe,GAAG,eAAe,CAAC;AAC9C,8EAA8E;AAC9E,MAAM,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AAChE,8DAA8D;AAC9D,MAAM,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAElE;;;;;GAKG;AACH,qBAAa,IAAI;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,aAAa;IAErD,uDAAuD;IACjD,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ7E,sDAAsD;IAChD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQ/D,+CAA+C;IACzC,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAWlF,uCAAuC;IACjC,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,CAAC;IAWlC,mCAAmC;IAC7B,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAQpE,sCAAsC;IAChC,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAQzE,uDAAuD;IACjD,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAQ3E,2DAA2D;IACrD,mBAAmB,CACvB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,wBAAwB,CAAC;IAQpC,uDAAuD;IACjD,oBAAoB,CACxB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,yBAAyB,CAAC;IAQrC,yDAAyD;IACnD,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC;IAgBtB,mDAAmD;IAC7C,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,sBAAsB,CAAC;CAenC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE;IAAE,+BAA+B,EAAE,CAAC,EAAE,EAAE,OAAO,KAAK,IAAI,CAAA;CAAE,EAChE,QAAQ,EAAE,oBAAoB,GAC7B,IAAI,CAMN;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,+BAA+B,EAAE,CAAC,EAAE,EAAE,OAAO,KAAK,IAAI,CAAC;CACxD,GAAG,IAAI,CAEP;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,CAAC,SAAS,aAAa,EACrD,WAAW,EAAE,cAAc,EAC3B,MAAM,EAAE,CAAC,GACR,CAAC,GAAG;IAAE,WAAW,EAAE,cAAc,CAAA;CAAE,CAKrC"}

package/dist/auth.js

@@ -0,0 +1,134 @@
+/**
+ * Web SDK auth bindings — plan §4c.10 + §4d.wasm.3.
+ *
+ * This module provides:
+ *   - `Auth` — TypeScript wrapper for the generated `auth/*` RPC method
+ *     family. Surfaces targeting the JSON-RPC stdio server or the REST API
+ *     over fetch should instantiate this class with the appropriate
+ *     transport.
+ *   - `registerExternalAuthResolver` — wraps the WASM-bundled
+ *     `register_external_auth_resolver` binding so a browser host page
+ *     can install an OAuth-backed resolver callback that hands Meerkat a
+ *     typed lease envelope per structural auth binding reference.
+ *   - `withAuthBinding` — convenience helper that wires an existing
+ *     session config with an auth binding reference for `createSession`.
+ *
+ * The WASM runtime's session-creation path (plan §4d.wasm.2) takes
+ * credentials either from bootstrap-time realm config (populated via
+ * `initRuntimeFromConfig`) or from a host-registered external-auth
+ * resolver. Per-session `apiKey` is deleted.
+ */
+/* eslint-disable @typescript-eslint/no-explicit-any */
+import { AUTH_RPC_METHODS, parseCreateProfileParams, parseDeviceCompleteParams, parseDeviceStartParams, parseLoginCompleteParams, parseLoginStartParams, parseProvisionApiKeyParams, parseWireAuthProfileCleared, parseWireAuthProfileCreated, parseWireAuthProfileDetail, parseWireAuthProfilesList, parseWireAuthStatusDetail, parseWireDeviceCompleteResult, parseWireDeviceStart, parseWireLoginReady, parseWireLoginStart, parseWireProvisionApiKeyResult, } from './generated/auth.js';
+/** Canonical WASM external-auth resolver handle for host-owned browser auth. */
+export const WASM_EXTERNAL_AUTH_RESOLVER_HANDLE = 'wasm_host';
+/**
+ * Typed wrapper over the meerkat RPC `auth/*` method family. Works
+ * against any transport that speaks `(method, params) -> result`
+ * (the stdio RPC binary, a REST-backed adapter, an in-process shim,
+ * etc.).
+ */
+export class Auth {
+    transport;
+    constructor(transport) {
+        this.transport = transport;
+    }
+    /** Persist credentials for a managed-store binding. */
+    async createProfile(params) {
+        const result = await this.transport.request(AUTH_RPC_METHODS.profileCreate, parseCreateProfileParams(params));
+        return parseWireAuthProfileCreated(result);
+    }
+    /** Enumerate configured auth profiles for a realm. */
+    async listProfiles(realm_id) {
+        const result = await this.transport.request(AUTH_RPC_METHODS.profileList, { realm_id });
+        return parseWireAuthProfilesList(result);
+    }
+    /** Fetch the profile resolved by a binding. */
+    async getProfile(realm_id, binding_id) {
+        const result = await this.transport.request(AUTH_RPC_METHODS.profileGet, { realm_id, binding_id });
+        return parseWireAuthProfileDetail(result);
+    }
+    /** Clear credentials for a binding. */
+    async deleteProfile(realm_id, binding_id) {
+        const result = await this.transport.request(AUTH_RPC_METHODS.profileDelete, { realm_id, binding_id });
+        return parseWireAuthProfileCleared(result);
+    }
+    /** Begin an OAuth browser flow. */
+    async loginStart(params) {
+        const result = await this.transport.request(AUTH_RPC_METHODS.loginStart, parseLoginStartParams(params));
+        return parseWireLoginStart(result);
+    }
+    /** Finalize an OAuth browser flow. */
+    async loginComplete(params) {
+        const result = await this.transport.request(AUTH_RPC_METHODS.loginComplete, parseLoginCompleteParams(params));
+        return parseWireLoginReady(result);
+    }
+    /** Start a device-code flow for keyboardless hosts. */
+    async loginDeviceStart(params) {
+        const result = await this.transport.request(AUTH_RPC_METHODS.loginDeviceStart, parseDeviceStartParams(params));
+        return parseWireDeviceStart(result);
+    }
+    /** Single-poll completion leg for the device-code flow. */
+    async loginDeviceComplete(params) {
+        const result = await this.transport.request(AUTH_RPC_METHODS.loginDeviceComplete, parseDeviceCompleteParams(params));
+        return parseWireDeviceCompleteResult(result);
+    }
+    /** Anthropic Console-OAuth to API-key provisioning. */
+    async loginProvisionApiKey(params) {
+        const result = await this.transport.request(AUTH_RPC_METHODS.loginProvisionApiKey, parseProvisionApiKeyParams(params));
+        return parseWireProvisionApiKeyResult(result);
+    }
+    /** Current status for a binding's stored credentials. */
+    async status(realm_id, binding_id, profile_id) {
+        const params = {
+            realm_id,
+            binding_id,
+        };
+        if (profile_id !== undefined)
+            params.profile_id = profile_id;
+        const result = await this.transport.request(AUTH_RPC_METHODS.statusGet, params);
+        return parseWireAuthStatusDetail(result);
+    }
+    /** Revoke and delete credentials for a binding. */
+    async logout(realm_id, binding_id, profile_id) {
+        const params = {
+            realm_id,
+            binding_id,
+        };
+        if (profile_id !== undefined)
+            params.profile_id = profile_id;
+        const result = await this.transport.request(AUTH_RPC_METHODS.logout, params);
+        return parseWireAuthProfileCleared(result);
+    }
+}
+/**
+ * Install a host-page external-auth resolver in the loaded WASM
+ * runtime. The resolver is consulted per-session when the binding's
+ * credential source is `external_resolver`.
+ *
+ * Plan §4d.wasm.1 + §4d.wasm.3: browser OAuth flows run in the host
+ * page; the resolver hands Meerkat a structured `ExternalAuthLease` on
+ * demand. Meerkat never touches the host's refresh token. Reject with
+ * `ExternalAuthFailure` to preserve denial, refresh, or missing-credential
+ * truth across the WASM boundary.
+ */
+export function registerExternalAuthResolver(wasm, resolver) {
+    const adapter = (authBinding) => Promise.resolve(resolver(authBinding));
+    wasm.register_external_auth_resolver(adapter);
+}
+/**
+ * Clear the previously-registered external-auth resolver. Subsequent
+ * session creations will fall back to the realm config's default
+ * credential source.
+ */
+export function clearExternalAuthResolver(wasm) {
+    wasm.register_external_auth_resolver(undefined);
+}
+/** Return a session config with an explicit auth auth binding. */
+export function withAuthBinding(authBinding, config) {
+    return {
+        ...config,
+        authBinding,
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,uDAAuD;AAEvD,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAmC7B,gFAAgF;AAChF,MAAM,CAAC,MAAM,kCAAkC,GAAG,WAAoB,CAAC;AA8FvE;;;;;GAKG;AACH,MAAM,OAAO,IAAI;IACc;IAA7B,YAA6B,SAAwB;QAAxB,cAAS,GAAT,SAAS,CAAe;IAAG,CAAC;IAEzD,uDAAuD;IACvD,KAAK,CAAC,aAAa,CAAC,MAA2B;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CACzC,gBAAgB,CAAC,aAAa,EAC9B,wBAAwB,CAAC,MAAM,CAAC,CACjC,CAAC;QACF,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CACzC,gBAAgB,CAAC,WAAW,EAC5B,EAAE,QAAQ,EAAE,CACb,CAAC;QACF,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,UAAU,CAAC,QAAgB,EAAE,UAAkB;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAIzC,gBAAgB,CAAC,UAAU,EAC3B,EAAE,QAAQ,EAAE,UAAU,EAAE,CACzB,CAAC;QACF,OAAO,0BAA0B,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,UAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAIzC,gBAAgB,CAAC,aAAa,EAC9B,EAAE,QAAQ,EAAE,UAAU,EAAE,CACzB,CAAC;QACF,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CACzC,gBAAgB,CAAC,UAAU,EAC3B,qBAAqB,CAAC,MAAM,CAAC,CAC9B,CAAC;QACF,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,aAAa,CAAC,MAA2B;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CACzC,gBAAgB,CAAC,aAAa,EAC9B,wBAAwB,CAAC,MAAM,CAAC,CACjC,CAAC;QACF,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,gBAAgB,CAAC,MAAyB;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CACzC,gBAAgB,CAAC,gBAAgB,EACjC,sBAAsB,CAAC,MAAM,CAAC,CAC/B,CAAC;QACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,mBAAmB,CACvB,MAA4B;QAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CACzC,gBAAgB,CAAC,mBAAmB,EACpC,yBAAyB,CAAC,MAAM,CAAC,CAClC,CAAC;QACF,OAAO,6BAA6B,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,uDAAuD;IACvD,KAAK,CAAC,oBAAoB,CACxB,MAA6B;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CACzC,gBAAgB,CAAC,oBAAoB,EACrC,0BAA0B,CAAC,MAAM,CAAC,CACnC,CAAC;QACF,OAAO,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,UAAkB,EAClB,UAAmB;QAEnB,MAAM,MAAM,GAAkE;YAC5E,QAAQ;YACR,UAAU;SACX,CAAC;QACF,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAIzC,gBAAgB,CAAC,SAAS,EAC1B,MAAM,CACP,CAAC;QACF,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,UAAkB,EAClB,UAAmB;QAEnB,MAAM,MAAM,GAAkE;YAC5E,QAAQ;YACR,UAAU;SACX,CAAC;QACF,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAIzC,gBAAgB,CAAC,MAAM,EACvB,MAAM,CACP,CAAC;QACF,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAgE,EAChE,QAA8B;IAE9B,MAAM,OAAO,GAAG,CACd,WAA2B,EACU,EAAE,CACvC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAEzC;IACC,IAAI,CAAC,+BAA+B,CAAC,SAAS,CAAC,CAAC;AAClD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAC7B,WAA2B,EAC3B,MAAS;IAET,OAAO;QACL,GAAG,MAAM;QACT,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/events.d.ts

@@ -5,7 +5,7 @@ export declare class EventSubscription<T> {
     private readonly closeSource;
     private readonly parseEvents;
     /** @internal — use Session.subscribe(), Member.subscribe(), Mob.subscribeMemberEvents(), or Mob.subscribeEvents(). */
-    constructor(pollSource: () => string, parseEvents: (raw: unknown) => T[], closeSource?: () => void);
+    constructor(pollSource: () => string, parseEvents: (raw: unknown[]) => T[], closeSource?: () => void);
     /** Poll for new events. Returns an empty array when no events are available. */
     poll(): T[];
     /** Close the subscription and release the underlying source if needed. */

package/dist/events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,qBAAa,iBAAiB,CAAC,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwB;IAEpD,sHAAsH;gBAEpH,UAAU,EAAE,MAAM,MAAM,EACxB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,CAAC,EAAE,EAClC,WAAW,GAAE,MAAM,IAAe;IAOpC,gFAAgF;IAChF,IAAI,IAAI,CAAC,EAAE;IAOX,0EAA0E;IAC1E,KAAK,IAAI,IAAI;IAMb,iDAAiD;IACjD,IAAI,QAAQ,IAAI,OAAO,CAEtB;CACF"}
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,qBAAa,iBAAiB,CAAC,CAAC;IAC9B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAa;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;IAEtD,sHAAsH;gBAEpH,UAAU,EAAE,MAAM,MAAM,EACxB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EACpC,WAAW,GAAE,MAAM,IAAe;IAOpC,gFAAgF;IAChF,IAAI,IAAI,CAAC,EAAE;IAUX,0EAA0E;IAC1E,KAAK,IAAI,IAAI;IAMb,iDAAiD;IACjD,IAAI,QAAQ,IAAI,OAAO,CAEtB;CACF"}

package/dist/events.js

@@ -16,6 +16,9 @@ export class EventSubscription {
             return [];
         const json = this.pollSource();
         const parsed = JSON.parse(json);
+        if (!Array.isArray(parsed)) {
+            throw new Error('Invalid subscription poll response: expected event array');
+        }
         return this.parseEvents(parsed);
     }
     /** Close the subscription and release the underlying source if needed. */

package/dist/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,MAAM,OAAO,iBAAiB;IACpB,MAAM,GAAG,KAAK,CAAC;IACN,UAAU,CAAe;IACzB,WAAW,CAAa;IACxB,WAAW,CAAwB;IAEpD,sHAAsH;IACtH,YACE,UAAwB,EACxB,WAAkC,EAClC,cAA0B,GAAG,EAAE,GAAE,CAAC;QAElC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,gFAAgF;IAChF,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,0EAA0E;IAC1E,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED,iDAAiD;IACjD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,MAAM,OAAO,iBAAiB;IACpB,MAAM,GAAG,KAAK,CAAC;IACN,UAAU,CAAe;IACzB,WAAW,CAAa;IACxB,WAAW,CAA0B;IAEtD,sHAAsH;IACtH,YACE,UAAwB,EACxB,WAAoC,EACpC,cAA0B,GAAG,EAAE,GAAE,CAAC;QAElC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,gFAAgF;IAChF,IAAI;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,0EAA0E;IAC1E,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED,iDAAiD;IACjD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}

package/dist/generated/auth.d.ts

@@ -0,0 +1,247 @@
+export declare const WIRE_AUTH_PROVIDERS: readonly ["anthropic", "openai", "gemini", "self_hosted"];
+export type WireAuthProvider = typeof WIRE_AUTH_PROVIDERS[number];
+export declare const WIRE_BACKEND_KINDS: readonly ["openai_api", "chatgpt_backend", "anthropic_api", "bedrock", "vertex", "foundry", "google_genai", "vertex_ai", "google_code_assist", "self_hosted", "openai_compatible"];
+export type WireBackendKind = typeof WIRE_BACKEND_KINDS[number];
+export declare const WIRE_AUTH_METHODS: readonly ["api_key", "static_bearer", "managed_chatgpt_oauth", "external_chatgpt_tokens", "external_authorizer", "claude_ai_oauth", "oauth_to_api_key", "bedrock_bearer", "bedrock_aws_sigv4", "vertex_google_auth", "foundry_api_key", "foundry_azure_ad", "bearer_api_key", "adc", "api_key_express", "google_oauth", "compute_adc", "none"];
+export type WireAuthMethod = typeof WIRE_AUTH_METHODS[number];
+export declare const WIRE_PROVIDER_BACKEND_KINDS: {
+    readonly anthropic: readonly ["anthropic_api", "bedrock", "vertex", "foundry"];
+    readonly openai: readonly ["openai_api", "chatgpt_backend"];
+    readonly gemini: readonly ["google_genai", "vertex_ai", "google_code_assist"];
+    readonly self_hosted: readonly ["self_hosted", "openai_compatible"];
+};
+export declare const WIRE_PROVIDER_AUTH_METHODS: {
+    readonly anthropic: readonly ["api_key", "static_bearer", "claude_ai_oauth", "oauth_to_api_key", "external_authorizer", "bedrock_bearer", "bedrock_aws_sigv4", "vertex_google_auth", "foundry_api_key", "foundry_azure_ad"];
+    readonly openai: readonly ["api_key", "static_bearer", "managed_chatgpt_oauth", "external_chatgpt_tokens", "external_authorizer"];
+    readonly gemini: readonly ["api_key", "bearer_api_key", "external_authorizer", "adc", "api_key_express", "google_oauth", "compute_adc"];
+    readonly self_hosted: readonly ["api_key", "static_bearer", "none"];
+};
+export declare const WIRE_CREDENTIAL_SOURCE_KINDS: readonly ["inline_secret", "managed_store", "env", "external_resolver", "platform_default", "command", "file_descriptor"];
+export type WireCredentialSourceKind = typeof WIRE_CREDENTIAL_SOURCE_KINDS[number];
+export declare const WIRE_AUTH_STATUS_STATES: readonly ["valid", "expiring", "expired", "reauth_required", "refresh_failed", "unknown"];
+export type WireAuthStatusState = typeof WIRE_AUTH_STATUS_STATES[number];
+export declare const WIRE_DEVICE_COMPLETE_STATES: readonly ["pending", "slow_down", "access_denied", "expired", "ready"];
+export type WireDeviceCompleteState = typeof WIRE_DEVICE_COMPLETE_STATES[number];
+export declare const WIRE_LOGIN_READY_STATE: "ready";
+export declare const AUTH_RPC_METHODS: {
+    readonly profileList: "auth/profile/list";
+    readonly profileGet: "auth/profile/get";
+    readonly profileCreate: "auth/profile/create";
+    readonly profileDelete: "auth/profile/delete";
+    readonly loginStart: "auth/login/start";
+    readonly loginComplete: "auth/login/complete";
+    readonly loginDeviceStart: "auth/login/device_start";
+    readonly loginDeviceComplete: "auth/login/device_complete";
+    readonly loginProvisionApiKey: "auth/login/provision_api_key";
+    readonly statusGet: "auth/status/get";
+    readonly logout: "auth/logout";
+};
+export type AuthRpcMethod = typeof AUTH_RPC_METHODS[keyof typeof AUTH_RPC_METHODS];
+export interface WireAuthBindingRef {
+    realm: string;
+    binding: string;
+    profile?: string | null;
+}
+export interface RealmIdParams {
+    realm_id: string;
+}
+export interface BindingIdParams {
+    realm_id: string;
+    binding_id: string;
+    profile_id?: string | null;
+}
+export interface CreateProfileParams extends BindingIdParams {
+    auth_method: WireAuthMethod;
+    secret: string;
+}
+export interface LoginStartParams extends BindingIdParams {
+    provider: WireAuthProvider;
+    redirect_uri: string;
+}
+export interface LoginCompleteParams extends BindingIdParams {
+    provider: WireAuthProvider;
+    code: string;
+    state: string;
+    redirect_uri: string;
+}
+export interface DeviceStartParams extends BindingIdParams {
+    provider: WireAuthProvider;
+}
+export interface DeviceCompleteParams extends BindingIdParams {
+    provider: WireAuthProvider;
+    device_code: string;
+}
+export interface ProvisionApiKeyParams {
+    access_token: string;
+    realm_id?: string | null;
+    binding_id?: string | null;
+    profile_id?: string | null;
+}
+export interface WireBackendProfile {
+    id: string;
+    provider: WireAuthProvider;
+    backend_kind: WireBackendKind;
+    base_url?: string | null;
+    options?: unknown;
+}
+export interface WireAuthProfile {
+    id: string;
+    provider: WireAuthProvider;
+    auth_method: WireAuthMethod;
+    source_kind: WireCredentialSourceKind;
+}
+export interface WireProviderBinding {
+    id: string;
+    backend_profile: string;
+    auth_profile: string;
+    default_model?: string | null;
+    allow_auth_override?: boolean;
+    require_metadata_account?: boolean;
+    require_metadata_workspace?: boolean;
+}
+export interface WireRealmConnectionSet {
+    realm_id: string;
+    backends: Record<string, WireBackendProfile>;
+    auth_profiles: Record<string, WireAuthProfile>;
+    bindings: Record<string, WireProviderBinding>;
+    default_binding?: string | null;
+}
+export interface WireBindingIdentity {
+    realm_id: string;
+    binding_id: string;
+    auth_binding: WireAuthBindingRef;
+}
+export interface WireAuthProfileCreated extends WireBindingIdentity {
+    profile_id: string;
+    provider: WireAuthProvider;
+    auth_method: WireAuthMethod;
+    stored: boolean;
+}
+export interface WireAuthProfileDetail {
+    auth_binding: WireAuthBindingRef;
+    binding_id: string;
+    profile_id: string;
+    auth_profile: WireAuthProfile;
+}
+export interface WireAuthProfileCleared extends WireBindingIdentity {
+    profile_id: string;
+    cleared: boolean;
+}
+export interface WireLoginStart {
+    authorize_url: string;
+    state: string;
+    redirect_uri: string;
+    provider: WireAuthProvider;
+}
+export interface WireLoginReady extends WireBindingIdentity {
+    state?: typeof WIRE_LOGIN_READY_STATE | null;
+    profile_id: string;
+    provider: WireAuthProvider;
+    expires_at?: string | null;
+    has_refresh_token: boolean;
+    scopes: string[];
+}
+export interface WireDeviceStart {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string | null;
+    expires_in: number;
+    interval: number;
+    provider: WireAuthProvider;
+}
+export type WireDeviceCompletePending = {
+    state: "pending";
+};
+export type WireDeviceCompleteSlowDown = {
+    state: "slow_down";
+};
+export type WireDeviceCompleteAccessDenied = {
+    state: "access_denied";
+};
+export type WireDeviceCompleteExpired = {
+    state: "expired";
+};
+export type WireDeviceCompleteReady = WireLoginReady & {
+    state: typeof WIRE_LOGIN_READY_STATE;
+};
+export type WireDeviceCompleteResult = WireDeviceCompletePending | WireDeviceCompleteSlowDown | WireDeviceCompleteAccessDenied | WireDeviceCompleteExpired | WireDeviceCompleteReady;
+export interface WireProvisionApiKeyResult extends WireBindingIdentity {
+    profile_id: string;
+    provider: WireAuthProvider;
+    auth_mode: WireAuthMethod;
+    has_api_key: boolean;
+    scopes: string[];
+}
+export interface WireRealmSummary {
+    realm_id: string;
+    default_binding?: string | null;
+    backend_count: number;
+    auth_profile_count: number;
+    binding_count: number;
+}
+export interface WireRealmList {
+    realms: WireRealmSummary[];
+}
+export interface WireAuthProfilesList {
+    realm_id: string;
+    auth_profiles: WireAuthProfile[];
+    backend_profiles: WireBackendProfile[];
+    bindings: WireProviderBinding[];
+}
+export interface WireAuthError {
+    kind: string;
+    [key: string]: unknown;
+}
+export interface WireAuthStatus {
+    profile_id: string;
+    provider: WireAuthProvider;
+    auth_method: WireAuthMethod;
+    state: WireAuthStatusState;
+    expires_at?: string | null;
+    last_refresh_at?: string | null;
+    account_id?: string | null;
+    last_error?: WireAuthError | null;
+}
+export interface WireAuthStatusDetail extends WireBindingIdentity {
+    profile_id: string;
+    provider: WireAuthProvider;
+    auth_method: WireAuthMethod;
+    state: WireAuthStatusState;
+    expires_at?: string | null;
+    last_refresh_at?: string | null;
+    account_id?: string | null;
+    has_refresh_token: boolean;
+}
+export declare class WebAuthContractError extends TypeError {
+    constructor(message: string);
+}
+export declare function parseWireAuthProvider(value: unknown, path?: string): WireAuthProvider;
+export declare function parseWireBackendKind(value: unknown, path?: string): WireBackendKind;
+export declare function parseWireAuthMethod(value: unknown, path?: string): WireAuthMethod;
+export declare function parseWireCredentialSourceKind(value: unknown, path?: string): WireCredentialSourceKind;
+export declare function parseWireAuthStatusState(value: unknown, path?: string): WireAuthStatusState;
+export declare function parseWireAuthBindingRef(value: unknown, path?: string): WireAuthBindingRef;
+export declare function parseWireBackendProfile(value: unknown, path?: string): WireBackendProfile;
+export declare function parseWireAuthProfile(value: unknown, path?: string): WireAuthProfile;
+export declare function parseWireProviderBinding(value: unknown, path?: string): WireProviderBinding;
+export declare function parseWireRealmConnectionSet(value: unknown, path?: string): WireRealmConnectionSet;
+export declare function parseWireAuthProfileCreated(value: unknown, path?: string): WireAuthProfileCreated;
+export declare function parseWireAuthProfileDetail(value: unknown, path?: string): WireAuthProfileDetail;
+export declare function parseWireAuthProfileCleared(value: unknown, path?: string): WireAuthProfileCleared;
+export declare function parseWireLoginStart(value: unknown, path?: string): WireLoginStart;
+export declare function parseWireLoginReady(value: unknown, path?: string): WireLoginReady;
+export declare function parseWireDeviceStart(value: unknown, path?: string): WireDeviceStart;
+export declare function parseWireDeviceCompleteResult(value: unknown, path?: string): WireDeviceCompleteResult;
+export declare function parseWireProvisionApiKeyResult(value: unknown, path?: string): WireProvisionApiKeyResult;
+export declare function parseWireAuthProfilesList(value: unknown, path?: string): WireAuthProfilesList;
+export declare function parseWireAuthError(value: unknown, path?: string): WireAuthError;
+export declare function parseWireAuthStatus(value: unknown, path?: string): WireAuthStatus;
+export declare function parseWireAuthStatusDetail(value: unknown, path?: string): WireAuthStatusDetail;
+export declare function parseCreateProfileParams(params: CreateProfileParams): CreateProfileParams;
+export declare function parseLoginStartParams(params: LoginStartParams): LoginStartParams;
+export declare function parseLoginCompleteParams(params: LoginCompleteParams): LoginCompleteParams;
+export declare function parseDeviceStartParams(params: DeviceStartParams): DeviceStartParams;
+export declare function parseDeviceCompleteParams(params: DeviceCompleteParams): DeviceCompleteParams;
+export declare function parseProvisionApiKeyParams(params: ProvisionApiKeyParams): ProvisionApiKeyParams;
+//# sourceMappingURL=auth.d.ts.map

package/dist/generated/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/generated/auth.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,mBAAmB,2DAKtB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB,oLAYrB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,gVAmBpB,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAE9D,eAAO,MAAM,2BAA2B;;;;;CAoBiC,CAAC;AAE1E,eAAO,MAAM,0BAA0B;;;;;CAkCiC,CAAC;AAEzE,eAAO,MAAM,4BAA4B,2HAQ/B,CAAC;AAEX,MAAM,MAAM,wBAAwB,GAAG,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;AAEnF,eAAO,MAAM,uBAAuB,2FAO1B,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,2BAA2B,wEAM9B,CAAC;AAEX,MAAM,MAAM,uBAAuB,GAAG,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC;AAEjF,eAAO,MAAM,sBAAsB,EAAG,OAAgB,CAAC;AAEvD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;CAYnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,OAAO,gBAAgB,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEnF,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,WAAW,EAAE,cAAc,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACvD,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,eAAe;IACxD,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAqB,SAAQ,eAAe;IAC3D,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,cAAc,CAAC;IAC5B,WAAW,EAAE,wBAAwB,CAAC;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC7C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,kBAAkB,CAAC;CAClC;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,cAAc,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,kBAAkB,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,eAAe,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,cAAe,SAAQ,mBAAmB;IACzD,KAAK,CAAC,EAAE,OAAO,sBAAsB,GAAG,IAAI,CAAC;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,MAAM,yBAAyB,GAAG;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAC7D,MAAM,MAAM,0BAA0B,GAAG;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AAChE,MAAM,MAAM,8BAA8B,GAAG;IAAE,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AACxE,MAAM,MAAM,yBAAyB,GAAG;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAC7D,MAAM,MAAM,uBAAuB,GAAG,cAAc,GAAG;IAAE,KAAK,EAAE,OAAO,sBAAsB,CAAA;CAAE,CAAC;AAChG,MAAM,MAAM,wBAAwB,GAChC,yBAAyB,GACzB,0BAA0B,GAC1B,8BAA8B,GAC9B,yBAAyB,GACzB,uBAAuB,CAAC;AAE5B,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,EAAE,cAAc,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,gBAAgB,EAAE,kBAAkB,EAAE,CAAC;IACvC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,cAAc,CAAC;IAC5B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,cAAc,CAAC;IAC5B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,OAAO,EAAE,MAAM;CAI5B;AA2ED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAa,GAAG,gBAAgB,CAEzF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAiB,GAAG,eAAe,CAE3F;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAgB,GAAG,cAAc,CAExF;AAwBD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,IAAI,SAAgB,GACnB,wBAAwB,CAE1B;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAU,GAAG,mBAAmB,CAE5F;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAiB,GAAG,kBAAkB,CAMjG;AAUD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAoB,GAAG,kBAAkB,CAQpG;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAiB,GAAG,eAAe,CAQ3F;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAY,GAAG,mBAAmB,CAU9F;AAkCD,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,IAAI,SAAyB,GAC5B,sBAAsB,CAaxB;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,IAAI,SAAyB,GAC5B,sBAAsB,CASxB;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,EACd,IAAI,SAAwB,GAC3B,qBAAqB,CAQvB;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,IAAI,SAAyB,GAC5B,sBAAsB,CAMxB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAgB,GAAG,cAAc,CAOxF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAgB,GAAG,cAAc,CAYxF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAiB,GAAG,eAAe,CAU3F;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,EACd,IAAI,SAAoB,GACvB,wBAAwB,CAO1B;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,EACd,IAAI,SAAsB,GACzB,yBAAyB,CAU3B;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,IAAI,SAAuB,GAC1B,oBAAoB,CAkBtB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAe,GAAG,aAAa,CAwBrF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAgB,GAAG,cAAc,CAcxF;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,IAAI,SAAuB,GAC1B,oBAAoB,CAatB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,CAQzF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CAQhF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,mBAAmB,GAAG,mBAAmB,CAUzF;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAOnF;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,oBAAoB,GAC3B,oBAAoB,CAQtB;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,qBAAqB,GAC5B,qBAAqB,CAOvB"}