@vibesdotdev/account 0.0.0-stage → 1.0.0-rc.3

package/dist/client/rbac-client.js

@@ -0,0 +1,209 @@
+import * as z from 'zod/v4';
+import { CapabilityError, CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { resolveAccountOrigin } from "../config/origins.js";
+import { resolveCatalogAccountOrigin, resolveLocalAccountOrigin } from "../config/origins.js";
+import { AccountClientCache, CACHE_KEYS } from "./cache.js";
+import { PermissionEvaluator } from "../permissions/evaluator.js";
+/** The runtime-ref shape the SvelteKit surface sets on `event.locals.runtime`. */
+const runtimeRefContract = z.object({ hasKind: z.function(), query: z.function() }).loose();
+/** What these helpers read from `event.locals`: the request runtime and an optional session token. */
+const eventLocalsSchema = z
+    .object({
+    runtime: z.custom((value) => runtimeRefContract.safeParse(value).success).optional(),
+    sessionToken: z.string().optional()
+})
+    .loose();
+async function settleCheck(work) {
+    try {
+        return { ok: true, value: await work() };
+    }
+    catch (failure) {
+        return { ok: false, failure };
+    }
+}
+class AccountHttpClient {
+    accountOrigin;
+    headers;
+    logger;
+    constructor(event, accountOrigin, runtime) {
+        this.accountOrigin = accountOrigin;
+        this.logger = getLogger('account.client', runtime);
+        const locals = eventLocalsSchema.safeParse(event.locals);
+        const sessionToken = locals.success ? locals.data.sessionToken?.trim() : undefined;
+        const inboundAuthorization = event.request.headers.get('authorization')?.trim();
+        const authorization = sessionToken ? `Bearer ${sessionToken}` : inboundAuthorization;
+        this.headers = new Headers();
+        if (authorization)
+            this.headers.set('authorization', authorization);
+    }
+    async getContext() {
+        const response = await fetch(`${this.accountOrigin}/api/account/context`, {
+            headers: this.headers,
+        });
+        if (!response.ok) {
+            // Status only: a reason phrase can echo credentials.
+            throw new Error(`Account context fetch failed: ${response.status}`);
+        }
+        return response.json();
+    }
+    async checkPermissions(tags, opts) {
+        const checked = await settleCheck(() => this.requestPermissionCheck(tags, opts));
+        if (checked.ok)
+            return checked.value;
+        // Fail-open is the caller's explicit policy: the failure is logged by class, then allowed.
+        if (!opts.failOpen)
+            throw checked.failure;
+        this.logger.warn('Permission check fail-open: error', {
+            tags,
+            error: valueFreeFailure(CaughtFailureSchema.parse(checked.failure))
+        });
+        return { allowed: true, reason: 'failOpen:error' };
+    }
+    async requestPermissionCheck(tags, opts) {
+        const headers = new Headers(this.headers);
+        headers.set('Content-Type', 'application/json');
+        const response = await fetch(`${this.accountOrigin}/api/account/permissions/check`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ tags, failOpen: opts.failOpen }),
+        });
+        if (!response.ok) {
+            if (opts.failOpen) {
+                this.logger.warn('Permission check fail-open: non-ok response', { tags, status: response.status });
+                return { allowed: true, reason: 'failOpen' };
+            }
+            throw new Error(`Permission check failed: ${response.status}`);
+        }
+        return response.json();
+    }
+}
+/**
+ * Create an account client with RBAC permission checking.
+ *
+ * The account client is the single source of truth for permission decisions
+ * across all Vibes applications. It caches user context with configurable TTL
+ * and falls back to HTTP API when cache is stale or missing.
+ *
+ * @example
+ * ```ts
+ * const account = await createAccountClient({ event });
+ * const canAdmin = await account.permissions.check(['org:admin:*']);
+ * ```
+ */
+export async function createAccountClient(options) {
+    const locals = eventLocalsSchema.safeParse(options.event.locals);
+    const runtime = locals.success ? locals.data.runtime : undefined;
+    if (!runtime) {
+        throw new CapabilityError('Account client requires event.locals.runtime.', 'UNAVAILABLE', {
+            reason: 'runtime-unavailable'
+        });
+    }
+    const origin = (await resolveAccountOrigin(runtime)) ?? await resolveCatalogAccountOrigin(runtime);
+    if (!origin) {
+        throw new CapabilityError('Account service origin is not declared in this runtime.', 'NOT_FOUND', {
+            reason: 'service-undeclared',
+            details: { serviceId: 'account' }
+        });
+    }
+    const cacheOptions = {
+        defaultTTL: options.cacheTTL ?? 60 * 60 * 1000, // 60 minutes
+        maxSize: 1000,
+    };
+    const contextCache = new AccountClientCache(cacheOptions);
+    const orgListCache = new AccountClientCache(cacheOptions);
+    const httpClient = new AccountHttpClient(options.event, resolveLocalAccountOrigin(origin), runtime);
+    const evaluator = new PermissionEvaluator();
+    const defaultFailOpen = options.failOpen ?? false;
+    /**
+     * Get or fetch user context
+     */
+    async function getUserContext() {
+        // Try cache first
+        const cachedContext = contextCache.get(CACHE_KEYS.USER_CONTEXT('current'));
+        if (cachedContext) {
+            return cachedContext;
+        }
+        // Fetch from account-web
+        const context = await httpClient.getContext();
+        contextCache.set(CACHE_KEYS.USER_CONTEXT('current'), context);
+        return context;
+    }
+    /**
+     * Get or fetch organization list
+     */
+    async function getOrgList() {
+        const cachedOrgs = orgListCache.get(CACHE_KEYS.ORG_LIST('current'));
+        if (cachedOrgs) {
+            return cachedOrgs;
+        }
+        const context = await getUserContext();
+        orgListCache.set(CACHE_KEYS.ORG_LIST('current'), context.organizations);
+        return context.organizations;
+    }
+    return {
+        permissions: {
+            async check(tags, opts) {
+                // Validate tags
+                for (const tag of tags) {
+                    if (!evaluator.validateTag(tag)) {
+                        throw new Error(`Invalid permission tag: ${tag}`);
+                    }
+                }
+                const failOpen = opts?.failOpen ?? defaultFailOpen;
+                const context = await getUserContext();
+                // Evaluate locally
+                const allowed = evaluator.evaluate(tags, context, true);
+                if (!allowed && !failOpen) {
+                    // Fall back to HTTP check for fresh data
+                    const result = await httpClient.checkPermissions(tags, { failOpen });
+                    return result.allowed;
+                }
+                return allowed;
+            },
+            async checkAny(tags, opts) {
+                // Validate tags
+                for (const tag of tags) {
+                    if (!evaluator.validateTag(tag)) {
+                        throw new Error(`Invalid permission tag: ${tag}`);
+                    }
+                }
+                const failOpen = opts?.failOpen ?? defaultFailOpen;
+                const context = await getUserContext();
+                // Evaluate locally
+                const allowed = evaluator.evaluate(tags, context, false);
+                if (!allowed && !failOpen) {
+                    // Fall back to HTTP check for fresh data
+                    const result = await httpClient.checkPermissions(tags, { failOpen });
+                    return result.allowed;
+                }
+                return allowed;
+            },
+            async refresh() {
+                // Clear all cached data for current user
+                contextCache.delete(CACHE_KEYS.USER_CONTEXT('current'));
+                orgListCache.delete(CACHE_KEYS.ORG_LIST('current'));
+                contextCache.delete(CACHE_KEYS.PERMISSIONS('current'));
+                // Force fresh fetch
+                await getUserContext();
+            },
+            async getContext() {
+                return getUserContext();
+            },
+        },
+        organizations: {
+            async list() {
+                return getOrgList();
+            },
+            async get(id) {
+                const orgs = await getOrgList();
+                return orgs.find((org) => org.id === id) ?? null;
+            },
+            async getContext(id) {
+                const orgs = await getOrgList();
+                return orgs.find((org) => org.id === id) ?? null;
+            },
+        },
+    };
+}
+//# sourceMappingURL=rbac-client.js.map

package/dist/client/rbac-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-client.js","sourceRoot":"","sources":["../../src/client/rbac-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAMlE,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAE5F,sGAAsG;AACtG,MAAM,iBAAiB,GAAG,CAAC;KACzB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAa,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAChG,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,KAAK,EAAE,CAAC;AAKV,KAAK,UAAU,WAAW,CAAI,IAAsB;IACnD,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;AACF,CAAC;AA0BD,MAAM,iBAAiB;IACd,aAAa,CAAS;IACtB,OAAO,CAAU;IACR,MAAM,CAA+B;IAEtD,YAAY,KAAmB,EAAE,aAAqB,EAAE,OAAmB;QAC1E,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;QAChF,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,CAAC,UAAU,YAAY,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACrF,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,aAAa;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,UAAU;QACf,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE;YACzE,OAAO,EAAE,IAAI,CAAC,OAAO;SACrB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,qDAAqD;YACrD,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,gBAAgB,CACrB,IAAc,EACd,IAA4B;QAE5B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC;QACrC,2FAA2F;QAC3F,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,OAAO,CAAC,OAAO,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;YACrD,IAAI;YACJ,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;SACnE,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,sBAAsB,CACnC,IAAc,EACd,IAA4B;QAE5B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC3B,GAAG,IAAI,CAAC,aAAa,gCAAgC,EACrD;YACC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;SACvD,CACD,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CACf,6CAA6C,EAC7C,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CACjC,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAC9C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;CACD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAA6B;IAE7B,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,+CAA+C,EAAE,aAAa,EAAE;YACzF,MAAM,EAAE,qBAAqB;SAC7B,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACX,CAAC,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC,IAAI,MAAM,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,yDAAyD,EAAE,WAAW,EAAE;YACjG,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;SACjC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG;QACpB,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;QAC7D,OAAO,EAAE,IAAI;KACb,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,kBAAkB,CAAqB,YAAY,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,IAAI,kBAAkB,CAA+B,YAAY,CAAC,CAAC;IAExF,MAAM,UAAU,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,yBAAyB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACpG,MAAM,SAAS,GAAG,IAAI,mBAAmB,EAAE,CAAC;IAC5C,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC;IAElD;;OAEG;IACH,KAAK,UAAU,cAAc;QAC5B,kBAAkB;QAClB,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,IAAI,aAAa,EAAE,CAAC;YACnB,OAAO,aAAa,CAAC;QACtB,CAAC;QAED,yBAAyB;QACzB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC;QAC9C,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QAE9D,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,UAAU;QACxB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACpE,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;QACvC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QAExE,OAAO,OAAO,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,OAAO;QACN,WAAW,EAAE;YACZ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI;gBACrB,gBAAgB;gBAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACxB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;oBACnD,CAAC;gBACF,CAAC;gBAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,eAAe,CAAC;gBACnD,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;gBAEvC,mBAAmB;gBACnB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBAExD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC3B,yCAAyC;oBACzC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACrE,OAAO,MAAM,CAAC,OAAO,CAAC;gBACvB,CAAC;gBAED,OAAO,OAAO,CAAC;YAChB,CAAC;YAED,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI;gBACxB,gBAAgB;gBAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACxB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;oBACnD,CAAC;gBACF,CAAC;gBAED,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,eAAe,CAAC;gBACnD,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;gBAEvC,mBAAmB;gBACnB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;gBAEzD,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC3B,yCAAyC;oBACzC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;oBACrE,OAAO,MAAM,CAAC,OAAO,CAAC;gBACvB,CAAC;gBAED,OAAO,OAAO,CAAC;YAChB,CAAC;YAED,KAAK,CAAC,OAAO;gBACZ,yCAAyC;gBACzC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBACxD,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpD,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;gBAEvD,oBAAoB;gBACpB,MAAM,cAAc,EAAE,CAAC;YACxB,CAAC;YAED,KAAK,CAAC,UAAU;gBACf,OAAO,cAAc,EAAE,CAAC;YACzB,CAAC;SACD;QAED,aAAa,EAAE;YACd,KAAK,CAAC,IAAI;gBACT,OAAO,UAAU,EAAE,CAAC;YACrB,CAAC;YAED,KAAK,CAAC,GAAG,CAAC,EAAE;gBACX,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;YAClD,CAAC;YAED,KAAK,CAAC,UAAU,CAAC,EAAE;gBAClB,MAAM,IAAI,GAAG,MAAM,UAAU,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;YAClD,CAAC;SACD;KACD,CAAC;AACH,CAAC"}

package/dist/client/runtime-client.d.ts

@@ -0,0 +1,19 @@
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import type { AccountApiClient } from '../api/account.api-client.types.ts';
+/**
+ * Get the canonical account runtime client for permission checking,
+ * organization reads, and account data operations.
+ *
+ * This resolves the registered `runtime/client` for `id: 'account'` (the
+ * consumer implementation composed via `@vibesdotdev/account/api-client-plugin`),
+ * so the resolved contract always agrees with the registered implementation.
+ *
+ * @example
+ * ```ts
+ * const accountClient = await getVibesAccountClient(runtime);
+ * const canAdmin = await accountClient.permissions.check(['org:admin:*']);
+ * const orgs = await accountClient.organizations.list();
+ * ```
+ */
+export declare function getVibesAccountClient(runtime: RuntimeRef): Promise<AccountApiClient>;
+//# sourceMappingURL=runtime-client.d.ts.map

package/dist/client/runtime-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-client.d.ts","sourceRoot":"","sources":["../../src/client/runtime-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAE3E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE1F"}

package/dist/client/runtime-client.js

@@ -0,0 +1,20 @@
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+/**
+ * Get the canonical account runtime client for permission checking,
+ * organization reads, and account data operations.
+ *
+ * This resolves the registered `runtime/client` for `id: 'account'` (the
+ * consumer implementation composed via `@vibesdotdev/account/api-client-plugin`),
+ * so the resolved contract always agrees with the registered implementation.
+ *
+ * @example
+ * ```ts
+ * const accountClient = await getVibesAccountClient(runtime);
+ * const canAdmin = await accountClient.permissions.check(['org:admin:*']);
+ * const orgs = await accountClient.organizations.list();
+ * ```
+ */
+export async function getVibesAccountClient(runtime) {
+    return getVibesClient('account', runtime);
+}
+//# sourceMappingURL=runtime-client.js.map

package/dist/client/runtime-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-client.js","sourceRoot":"","sources":["../../src/client/runtime-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAmB;IAC9D,OAAO,cAAc,CAAmB,SAAS,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC"}

package/dist/config/account-api.d.ts

@@ -0,0 +1,12 @@
+import type { ApiClientConfig } from '@vibesdotdev/client';
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+/**
+ * Normalize an explicitly selected origin without inventing a hostname mapping.
+ */
+export declare function normalizeAccountClientBaseUrl(origin: string): string;
+/**
+ * The handed runtime's account service owns its internal transport origin.
+ * Missing composition and provider failures remain typed errors.
+ */
+export declare function resolveAccountClientBaseUrl(runtime: RuntimeRef, overrides?: Partial<ApiClientConfig>): Promise<string>;
+//# sourceMappingURL=account-api.d.ts.map

package/dist/config/account-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-api.d.ts","sourceRoot":"","sources":["../../src/config/account-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,UAAU,EACnB,SAAS,GAAE,OAAO,CAAC,eAAe,CAAM,GACtC,OAAO,CAAC,MAAM,CAAC,CAGjB"}

package/dist/config/account-api.js

@@ -0,0 +1,17 @@
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+/**
+ * Normalize an explicitly selected origin without inventing a hostname mapping.
+ */
+export function normalizeAccountClientBaseUrl(origin) {
+    return origin.replace(/\/$/, '');
+}
+/**
+ * The handed runtime's account service owns its internal transport origin.
+ * Missing composition and provider failures remain typed errors.
+ */
+export async function resolveAccountClientBaseUrl(runtime, overrides = {}) {
+    if (overrides.baseUrl)
+        return overrides.baseUrl;
+    return normalizeAccountClientBaseUrl(await serviceOrigin(runtime, 'account', 'internal'));
+}
+//# sourceMappingURL=account-api.js.map

package/dist/config/account-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-api.js","sourceRoot":"","sources":["../../src/config/account-api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAmB,EACnB,YAAsC,EAAE;IAExC,IAAI,SAAS,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC;IAChD,OAAO,6BAA6B,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3F,CAAC"}

package/dist/config/account.config.descriptor.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Account origin overlays — config/manifest.
+ *
+ * Previous env keys `VIBES_ACCOUNT_API_URL` / `PUBLIC_VIBES_ACCOUNT_ORIGIN`
+ * (both optional). When unset, origin resolution uses the environment catalog.
+ */
+declare const descriptor: {
+    kind: "config/manifest";
+    id: string;
+    name: string;
+    namespace: string;
+    description: string;
+    schema: import("zod/v4").ZodObject<{
+        vibesAccountApiUrl: import("zod/v4").ZodPipe<import("zod/v4").ZodOptional<import("zod/v4").ZodString>, import("zod/v4").ZodTransform<string | undefined, string | undefined>>;
+        publicVibesAccountOrigin: import("zod/v4").ZodPipe<import("zod/v4").ZodOptional<import("zod/v4").ZodString>, import("zod/v4").ZodTransform<string | undefined, string | undefined>>;
+    }, import("zod/v4/core").$strip>;
+    scope: "global";
+    tier: "user";
+    storedLayer: "none";
+    allowedAdapters: string[];
+    fields: {
+        vibesAccountApiUrl: {
+            ui: {
+                label: string;
+                component: "input";
+            };
+        };
+        publicVibesAccountOrigin: {
+            ui: {
+                label: string;
+                component: "input";
+            };
+        };
+    };
+    customTables: false;
+    version: number;
+    internal: false;
+};
+export default descriptor;
+//# sourceMappingURL=account.config.descriptor.d.ts.map

package/dist/config/account.config.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.config.descriptor.d.ts","sourceRoot":"","sources":["../../src/config/account.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBoB,CAAC;AAErC,eAAe,UAAU,CAAC"}

package/dist/config/account.config.descriptor.js

@@ -0,0 +1,28 @@
+/**
+ * Account origin overlays — config/manifest.
+ *
+ * Previous env keys `VIBES_ACCOUNT_API_URL` / `PUBLIC_VIBES_ACCOUNT_ORIGIN`
+ * (both optional). When unset, origin resolution uses the environment catalog.
+ */
+import { ACCOUNT_CONFIG_MANIFEST_ID, AccountConfigSchema } from "./account.config.schema.js";
+const descriptor = {
+    kind: 'config/manifest',
+    id: ACCOUNT_CONFIG_MANIFEST_ID,
+    name: 'Account',
+    namespace: 'account',
+    description: 'Account API origin overlays',
+    schema: AccountConfigSchema,
+    scope: 'global',
+    tier: 'user',
+    storedLayer: 'none',
+    allowedAdapters: ['storage.json', 'storage.localdb'],
+    fields: {
+        vibesAccountApiUrl: { ui: { label: 'Account API URL', component: 'input' } },
+        publicVibesAccountOrigin: { ui: { label: 'Public account origin', component: 'input' } }
+    },
+    customTables: false,
+    version: 1,
+    internal: false
+};
+export default descriptor;
+//# sourceMappingURL=account.config.descriptor.js.map

package/dist/config/account.config.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.config.descriptor.js","sourceRoot":"","sources":["../../src/config/account.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAE7F,MAAM,UAAU,GAAG;IAClB,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,0BAA0B;IAC9B,IAAI,EAAE,SAAS;IACf,SAAS,EAAE,SAAS;IACpB,WAAW,EAAE,6BAA6B;IAC1C,MAAM,EAAE,mBAAmB;IAC3B,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,MAAM;IACnB,eAAe,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;IACpD,MAAM,EAAE;QACP,kBAAkB,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QAC5E,wBAAwB,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;KACxF;IACD,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,KAAK;CACoB,CAAC;AAErC,eAAe,UAAU,CAAC"}

package/dist/config/account.config.schema.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Account origin overlays — config schema.
+ *
+ * Previous env keys `VIBES_ACCOUNT_API_URL` / `PUBLIC_VIBES_ACCOUNT_ORIGIN`
+ * (both optional). When unset, origin resolution uses the environment catalog.
+ *
+ * Zod only: unit tests exercise this module without touching the
+ * config/manifest descriptor (which binds the host-side manifest type).
+ */
+import * as z from 'zod/v4';
+export declare const AccountConfigSchema: z.ZodObject<{
+    vibesAccountApiUrl: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string | undefined, string | undefined>>;
+    publicVibesAccountOrigin: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string | undefined, string | undefined>>;
+}, z.core.$strip>;
+export type AccountConfig = z.infer<typeof AccountConfigSchema>;
+export declare const ACCOUNT_CONFIG_MANIFEST_ID = "account";
+//# sourceMappingURL=account.config.schema.d.ts.map

package/dist/config/account.config.schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.config.schema.d.ts","sourceRoot":"","sources":["../../src/config/account.config.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAQ5B,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,0BAA0B,YAAY,CAAC"}

package/dist/config/account.config.schema.js

@@ -0,0 +1,21 @@
+/**
+ * Account origin overlays — config schema.
+ *
+ * Previous env keys `VIBES_ACCOUNT_API_URL` / `PUBLIC_VIBES_ACCOUNT_ORIGIN`
+ * (both optional). When unset, origin resolution uses the environment catalog.
+ *
+ * Zod only: unit tests exercise this module without touching the
+ * config/manifest descriptor (which binds the host-side manifest type).
+ */
+import * as z from 'zod/v4';
+/** An optional origin overlay: an empty or whitespace-only value counts as unset. */
+const optionalOriginOverlay = z
+    .string()
+    .optional()
+    .transform((value) => (value?.trim() === '' ? undefined : value));
+export const AccountConfigSchema = z.object({
+    vibesAccountApiUrl: optionalOriginOverlay,
+    publicVibesAccountOrigin: optionalOriginOverlay
+});
+export const ACCOUNT_CONFIG_MANIFEST_ID = 'account';
+//# sourceMappingURL=account.config.schema.js.map

package/dist/config/account.config.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.config.schema.js","sourceRoot":"","sources":["../../src/config/account.config.schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,qFAAqF;AACrF,MAAM,qBAAqB,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,kBAAkB,EAAE,qBAAqB;IACzC,wBAAwB,EAAE,qBAAqB;CAC/C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,SAAS,CAAC"}

package/dist/config/load.d.ts

@@ -0,0 +1,7 @@
+import type { RuntimeRef, VibesRuntime } from '@vibesdotdev/kernel';
+import { type AccountConfig } from './account.config.schema.ts';
+export type AccountConfigRuntime = RuntimeRef;
+export declare function loadAccountConfig(runtime: AccountConfigRuntime): Promise<AccountConfig>;
+/** Overlay from the account manifest, else the environment catalog. */
+export declare function resolveAccountEnvOrigin(runtime: VibesRuntime): Promise<string | null>;
+//# sourceMappingURL=load.d.ts.map

package/dist/config/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/config/load.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAGN,KAAK,aAAa,EAClB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE9C,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC,CAK7F;AAED,uEAAuE;AACvE,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO3F"}

package/dist/config/load.js

@@ -0,0 +1,19 @@
+import { ConfigManifest } from '@vibesdotdev/config/manifest/config-manifest';
+import { ACCOUNT_CONFIG_MANIFEST_ID, AccountConfigSchema } from "./account.config.schema.js";
+import { resolveCatalogAccountOrigin, resolveLocalAccountOrigin } from "./origins.js";
+export async function loadAccountConfig(runtime) {
+    return runtime.hasKind('config/manifest') &&
+        runtime.query('config/manifest').withId(ACCOUNT_CONFIG_MANIFEST_ID).descriptors().length > 0
+        ? await ConfigManifest.forRuntime(runtime, ACCOUNT_CONFIG_MANIFEST_ID).load()
+        : AccountConfigSchema.parse({});
+}
+/** Overlay from the account manifest, else the environment catalog. */
+export async function resolveAccountEnvOrigin(runtime) {
+    const config = await loadAccountConfig(runtime);
+    const fromConfig = config.vibesAccountApiUrl ?? config.publicVibesAccountOrigin;
+    if (fromConfig && fromConfig.trim().length > 0) {
+        return resolveLocalAccountOrigin(fromConfig.replace(/\/$/, ''));
+    }
+    return resolveCatalogAccountOrigin(runtime);
+}
+//# sourceMappingURL=load.js.map

package/dist/config/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/config/load.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAE9E,OAAO,EACN,0BAA0B,EAC1B,mBAAmB,EAEnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,2BAA2B,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAItF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA6B;IACpE,OAAO,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,GAAG,CAAC;QAC5F,CAAC,CAAC,MAAM,cAAc,CAAC,UAAU,CAAgB,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE;QAC5F,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAqB;IAClE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,wBAAwB,CAAC;IAChF,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,yBAAyB,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,2BAA2B,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/config/origins.d.ts

@@ -0,0 +1,30 @@
+import { type RuntimeRef, type VibesRuntime } from '@vibesdotdev/kernel';
+/** The runtime port that resolves the active environment and service descriptors. */
+export type AccountOriginRuntime = RuntimeRef;
+/** Map the local vanity origin to the account dev server without affecting deployed origins. */
+export declare function resolveLocalAccountOrigin(origin: string): string;
+/**
+ * Resolve the account origin. A runtime that declares the `account`
+ * `infra/service` reads it in its configured service environment
+ * (`infra.services`), like every other service client: the host's own tier
+ * says where the host runs, not which services it addresses, so a `local`
+ * CLI still reaches production account. Runtimes without the service
+ * declaration fall back to the environment catalog, honoring an explicit
+ * host tier.
+ */
+export declare function resolveCatalogAccountOrigin(runtime: AccountOriginRuntime): Promise<string | null>;
+/** Production account origin for consumers that explicitly target production. */
+export declare function defaultAccountOrigin(runtime: RuntimeRef): Promise<string>;
+/**
+ * Resolve the account API origin via config/environment.
+ * Returns `null` when no environment descriptor is available.
+ */
+export declare function resolveAccountOrigin(runtime: AccountOriginRuntime): Promise<string | null>;
+/**
+ * The caller's bearer for account requests, chosen by the host's declared
+ * bearer capability (rc05 §2.2).
+ *
+ * NEVER log the returned value.
+ */
+export declare function resolveAccountCallerBearer(runtime: VibesRuntime): Promise<string | null>;
+//# sourceMappingURL=origins.d.ts.map

package/dist/config/origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.d.ts","sourceRoot":"","sources":["../../src/config/origins.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAK1F,qFAAqF;AACrF,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE9C,gGAAgG;AAChG,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQhE;AAID;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUvG;AAED,iFAAiF;AACjF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/E;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,oBAAoB,GAC3B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;AAMD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAI9F"}

package/dist/config/origins.js

@@ -0,0 +1,66 @@
+import { resolveVibesAppOrigin, resolveVibesAppOriginForEnvironment } from '@vibesdotdev/config/environment/resolve-app-origin';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+const LOCAL_ACCOUNT_HOST = 'account.vibes.local';
+/** Map the local vanity origin to the account dev server without affecting deployed origins. */
+export function resolveLocalAccountOrigin(origin) {
+    if (!URL.canParse(origin))
+        return origin;
+    const url = new URL(origin);
+    if (url.protocol !== 'https:' || url.hostname !== LOCAL_ACCOUNT_HOST)
+        return origin;
+    url.protocol = 'http:';
+    url.hostname = '127.0.0.1';
+    url.port = '8421';
+    return url.origin;
+}
+/**
+ * Resolve the account origin. A runtime that declares the `account`
+ * `infra/service` reads it in its configured service environment
+ * (`infra.services`), like every other service client: the host's own tier
+ * says where the host runs, not which services it addresses, so a `local`
+ * CLI still reaches production account. Runtimes without the service
+ * declaration fall back to the environment catalog, honoring an explicit
+ * host tier.
+ */
+export async function resolveCatalogAccountOrigin(runtime) {
+    if (runtime.hasKind('infra/service') && runtime.query('infra/service').withId('account').descriptors().length > 0) {
+        return resolveLocalAccountOrigin(await serviceOrigin(runtime, 'account'));
+    }
+    const tier = runtime.scope?.qualifiers?.environmentTier;
+    const origin = tier === 'local' || tier === 'staging' || tier === 'production'
+        ? await resolveVibesAppOriginForEnvironment('account', tier, runtime)
+        : await resolveVibesAppOrigin('account', runtime);
+    return origin ? resolveLocalAccountOrigin(origin) : null;
+}
+/** Production account origin for consumers that explicitly target production. */
+export async function defaultAccountOrigin(runtime) {
+    const origin = await resolveVibesAppOriginForEnvironment('account', 'production', runtime);
+    if (!origin) {
+        throw new CapabilityError('Account origin is not declared in the environment catalog.', 'NOT_FOUND', {
+            reason: 'service-undeclared',
+            details: { serviceId: 'account' }
+        });
+    }
+    return origin;
+}
+/**
+ * Resolve the account API origin via config/environment.
+ * Returns `null` when no environment descriptor is available.
+ */
+export async function resolveAccountOrigin(runtime) {
+    return resolveVibesAppOrigin('account', runtime);
+}
+/**
+ * The caller's bearer for account requests, chosen by the host's declared
+ * bearer capability (rc05 §2.2).
+ *
+ * NEVER log the returned value.
+ */
+export async function resolveAccountCallerBearer(runtime) {
+    if (runtime.declaredScope.surface === 'browser')
+        return null;
+    const bearer = await runtime.context('auth/caller-bearer');
+    return bearer.resolve();
+}
+//# sourceMappingURL=origins.js.map

package/dist/config/origins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"origins.js","sourceRoot":"","sources":["../../src/config/origins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,mCAAmC,EAAE,MAAM,oDAAoD,CAAC;AAChI,OAAO,EAAE,eAAe,EAAsC,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAKjD,gGAAgG;AAChG,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACvD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB;QAAE,OAAO,MAAM,CAAC;IACpF,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC;IACvB,GAAG,CAAC,QAAQ,GAAG,WAAW,CAAC;IAC3B,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;IAClB,OAAO,GAAG,CAAC,MAAM,CAAC;AACnB,CAAC;AAID;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAA6B;IAC9E,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnH,OAAO,yBAAyB,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,eAAe,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY;QAC7E,CAAC,CAAC,MAAM,mCAAmC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC;QACrE,CAAC,CAAC,MAAM,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAmB;IAC7D,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,4DAA4D,EAAE,WAAW,EAAE;YACpG,MAAM,EAAE,oBAAoB;YAC5B,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE;SACjC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAA6B;IAE7B,OAAO,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAMD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAAqB;IACrE,IAAI,OAAO,CAAC,aAAa,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAsB,oBAAoB,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC;AACzB,CAAC"}

package/dist/docs/account.organizations.docs.descriptor.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Descriptor for account.organizations
+ */
+declare const descriptor: {
+    kind: "docs/topic";
+    id: string;
+    title: string;
+    summary: string;
+    body: {
+        type: "markdown";
+        sourceType: "raw";
+        source: string;
+    };
+    parent: string;
+    order: number;
+    tags: string[];
+    surfaces: readonly ["cli", "web", "in-app"];
+    hardware: readonly ["consumer"];
+    enabled: boolean;
+};
+export default descriptor;
+//# sourceMappingURL=account.organizations.docs.descriptor.d.ts.map

package/dist/docs/account.organizations.docs.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.organizations.docs.descriptor.d.ts","sourceRoot":"","sources":["../../src/docs/account.organizations.docs.descriptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAuDH,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;CAgBf,CAAC;AAEF,eAAe,UAAU,CAAC"}