@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/client/device-authorization.d.ts

@@ -0,0 +1,120 @@
+import type { AuthFetch } from '../schemas/consumer-auth.ts';
+import { CapabilityError, valueFreeFailure, type RuntimeRef } from '@vibesdotdev/kernel';
+export declare const DEVICE_AUTHORIZATION_GRANT_TYPE: "urn:ietf:params:oauth:grant-type:device_code";
+export declare const DEVICE_AUTHORIZATION_CLIENTS: {
+    readonly 'vibes-cli': {
+        readonly name: "Vibes CLI";
+        readonly scopes: readonly ["profile:read", "agents:read", "agents:run", "knowledge:read", "knowledge:create", "knowledge:update", "knowledge:delete"];
+    };
+    readonly 'vessel-desktop': {
+        readonly name: "Vessel Desktop";
+        readonly scopes: readonly ["profile:read", "agents:read", "agents:run", "knowledge:read", "knowledge:create", "knowledge:update", "knowledge:delete", "chat:read", "chat:write", "project:read", "project:write"];
+    };
+    readonly 'bridge-desktop': {
+        readonly name: "Vibes Desktop";
+        readonly scopes: readonly ["profile:read", "agents:read", "agents:run", "knowledge:read", "knowledge:create", "knowledge:update", "knowledge:delete", "chat:read", "chat:write", "project:read", "project:write"];
+    };
+    readonly 'vibes-mobile-ios': {
+        readonly name: "Vibes Mobile (iOS)";
+        readonly scopes: readonly ["profile:read", "agents:read", "agents:run", "knowledge:read", "knowledge:create", "knowledge:update", "knowledge:delete", "chat:read", "chat:write", "project:read", "project:write", "notifications:read", "notifications:write"];
+    };
+    readonly 'vibes-mobile-android': {
+        readonly name: "Vibes Mobile (Android)";
+        readonly scopes: readonly ["profile:read", "agents:read", "agents:run", "knowledge:read", "knowledge:create", "knowledge:update", "knowledge:delete", "chat:read", "chat:write", "project:read", "project:write", "notifications:read", "notifications:write"];
+    };
+};
+export type DeviceAuthorizationClientId = keyof typeof DEVICE_AUTHORIZATION_CLIENTS;
+export interface DeviceAuthorizationCode {
+    deviceCode: string;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+    expiresInSeconds: number;
+    intervalSeconds: number;
+    issuedAtMs: number;
+}
+export interface DeviceAuthorizationToken {
+    sessionToken: string;
+    tokenType: string;
+    refreshToken?: string;
+    expiresAt?: string;
+}
+export interface DeviceAuthorizationUser {
+    userId: string;
+    email: string;
+    name?: string | null;
+}
+export type DeviceAuthorizationPollResult = {
+    status: 'pending';
+    retryAfterMs: number;
+} | {
+    status: 'authorized';
+    token: DeviceAuthorizationToken;
+};
+export type DeviceAuthorizationErrorCode = 'access_denied' | 'expired_token' | 'invalid_client' | 'invalid_grant' | 'invalid_response' | 'network_error' | 'session_invalid' | 'unknown_error';
+/**
+ * A device-authorization failure: a `CapabilityError` whose `reason` is the
+ * RFC 8628 code in kebab form (`session-invalid`); `legacyCode` keeps the
+ * protocol spelling (`session_invalid`) for readers of the old `code` field.
+ * A transport failure's `cause` is its value-free facts, never the request.
+ */
+export declare class DeviceAuthorizationError extends CapabilityError {
+    readonly legacyCode: DeviceAuthorizationErrorCode;
+    readonly status?: number;
+    constructor(code: DeviceAuthorizationErrorCode, message: string, status?: number, failure?: ReturnType<typeof valueFreeFailure>);
+}
+export interface DeviceAuthorizationRequestOptions {
+    authOrigin: string;
+    clientId: DeviceAuthorizationClientId;
+    scopes?: readonly string[];
+    fetcher?: AuthFetch;
+    signal?: AbortSignal;
+    now?: () => number;
+}
+export interface DeviceAuthorizationPollOptions {
+    authOrigin: string;
+    clientId: DeviceAuthorizationClientId;
+    code: DeviceAuthorizationCode;
+    fetcher?: AuthFetch;
+    signal?: AbortSignal;
+    intervalMs?: number;
+}
+export declare function isDeviceAuthorizationClient(clientId: string): clientId is DeviceAuthorizationClientId;
+export declare function getDeviceAuthorizationClient(clientId: DeviceAuthorizationClientId): {
+    readonly name: "Vibes CLI";
+    readonly scopes: readonly ["profile:read", "agents:read", "agents:run", "knowledge:read", "knowledge:create", "knowledge:update", "knowledge:delete"];
+} | {
+    readonly name: "Vessel Desktop";
+    readonly scopes: readonly ["profile:read", "agents:read", "agents:run", "knowledge:read", "knowledge:create", "knowledge:update", "knowledge:delete", "chat:read", "chat:write", "project:read", "project:write"];
+} | {
+    readonly name: "Vibes Desktop";
+    readonly scopes: readonly ["profile:read", "agents:read", "agents:run", "knowledge:read", "knowledge:create", "knowledge:update", "knowledge:delete", "chat:read", "chat:write", "project:read", "project:write"];
+} | {
+    readonly name: "Vibes Mobile (iOS)";
+    readonly scopes: readonly ["profile:read", "agents:read", "agents:run", "knowledge:read", "knowledge:create", "knowledge:update", "knowledge:delete", "chat:read", "chat:write", "project:read", "project:write", "notifications:read", "notifications:write"];
+} | {
+    readonly name: "Vibes Mobile (Android)";
+    readonly scopes: readonly ["profile:read", "agents:read", "agents:run", "knowledge:read", "knowledge:create", "knowledge:update", "knowledge:delete", "chat:read", "chat:write", "project:read", "project:write", "notifications:read", "notifications:write"];
+};
+export declare function requestDeviceAuthorization(options: DeviceAuthorizationRequestOptions): Promise<DeviceAuthorizationCode>;
+export declare function pollDeviceAuthorization(options: DeviceAuthorizationPollOptions): Promise<DeviceAuthorizationPollResult>;
+export declare function getDeviceAuthorizationUser(options: {
+    authOrigin: string;
+    sessionToken: string;
+    fetcher?: AuthFetch;
+    signal?: AbortSignal;
+}): Promise<DeviceAuthorizationUser>;
+export declare function exchangeDeviceSessionForAppJwt(options: {
+    authOrigin: string;
+    sessionToken: string;
+    fetcher?: AuthFetch;
+    signal?: AbortSignal;
+}): Promise<string>;
+export declare function revokeDeviceAuthorizationSession(options: {
+    runtime: RuntimeRef;
+    authOrigin: string;
+    sessionToken: string;
+    fetcher?: AuthFetch;
+    signal?: AbortSignal;
+}): Promise<boolean>;
+//# sourceMappingURL=device-authorization.d.ts.map

package/dist/client/device-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization.d.ts","sourceRoot":"","sources":["../../src/client/device-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAU7D,OAAO,EACN,eAAe,EACf,gBAAgB,EAIhB,KAAK,UAAU,EACf,MAAM,qBAAqB,CAAC;AAM7B,eAAO,MAAM,+BAA+B,EAC3C,8CAAuD,CAAC;AAEzD,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;CAiF/B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GAAG,MAAM,OAAO,4BAA4B,CAAC;AAEpF,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,MAAM,6BAA6B,GACtC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAE7D,MAAM,MAAM,4BAA4B,GACrC,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,kBAAkB,GAClB,eAAe,GACf,iBAAiB,GACjB,eAAe,CAAC;AAcnB;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,eAAe;IAC5D,QAAQ,CAAC,UAAU,EAAE,4BAA4B,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAGxB,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC;CAS9C;AAED,MAAM,WAAW,iCAAiC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,2BAA2B,CAAC;IACtC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,8BAA8B;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,2BAA2B,CAAC;IACtC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAwGD,wBAAgB,2BAA2B,CAC1C,QAAQ,EAAE,MAAM,GACd,QAAQ,IAAI,2BAA2B,CAEzC;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,2BAA2B;;;;;;;;;;;;;;;EAEjF;AAED,wBAAsB,0BAA0B,CAC/C,OAAO,EAAE,iCAAiC,GACxC,OAAO,CAAC,uBAAuB,CAAC,CAkClC;AAED,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,8BAA8B,GACrC,OAAO,CAAC,6BAA6B,CAAC,CA+CxC;AAkBD,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAsBnC;AAED,wBAAsB,8BAA8B,CAAC,OAAO,EAAE;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED,wBAAsB,gCAAgC,CAAC,OAAO,EAAE;IAC/D,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,GAAG,OAAO,CAAC,OAAO,CAAC,CAoDnB"}

package/dist/client/device-authorization.js

@@ -0,0 +1,352 @@
+/**
+ * OAuth 2.0 Device Authorization Grant (RFC 8628) client primitives.
+ *
+ * This is the shared native/external-app protocol surface. Consumers provide a
+ * fetch implementation and own presentation/persistence; this module never
+ * stores, logs, or exposes a durable credential beyond its typed result.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, valueFreeFailure } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { attempt, failureLabel, rethrowFailure } from "../features/utils/attempt.js";
+import { readJsonOrNull } from "./read-json-or-null.js";
+import { failureMessage } from "./request-failure.js";
+export const DEVICE_AUTHORIZATION_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+export const DEVICE_AUTHORIZATION_CLIENTS = {
+    'vibes-cli': {
+        name: 'Vibes CLI',
+        scopes: [
+            'profile:read',
+            'agents:read',
+            'agents:run',
+            'knowledge:read',
+            'knowledge:create',
+            'knowledge:update',
+            'knowledge:delete'
+        ]
+    },
+    'vessel-desktop': {
+        name: 'Vessel Desktop',
+        scopes: [
+            'profile:read',
+            'agents:read',
+            'agents:run',
+            'knowledge:read',
+            'knowledge:create',
+            'knowledge:update',
+            'knowledge:delete',
+            'chat:read',
+            'chat:write',
+            'project:read',
+            'project:write'
+        ]
+    },
+    'bridge-desktop': {
+        name: 'Vibes Desktop',
+        scopes: [
+            'profile:read',
+            'agents:read',
+            'agents:run',
+            'knowledge:read',
+            'knowledge:create',
+            'knowledge:update',
+            'knowledge:delete',
+            'chat:read',
+            'chat:write',
+            'project:read',
+            'project:write'
+        ]
+    },
+    'vibes-mobile-ios': {
+        name: 'Vibes Mobile (iOS)',
+        scopes: [
+            'profile:read',
+            'agents:read',
+            'agents:run',
+            'knowledge:read',
+            'knowledge:create',
+            'knowledge:update',
+            'knowledge:delete',
+            'chat:read',
+            'chat:write',
+            'project:read',
+            'project:write',
+            'notifications:read',
+            'notifications:write'
+        ]
+    },
+    'vibes-mobile-android': {
+        name: 'Vibes Mobile (Android)',
+        scopes: [
+            'profile:read',
+            'agents:read',
+            'agents:run',
+            'knowledge:read',
+            'knowledge:create',
+            'knowledge:update',
+            'knowledge:delete',
+            'chat:read',
+            'chat:write',
+            'project:read',
+            'project:write',
+            'notifications:read',
+            'notifications:write'
+        ]
+    }
+};
+/** The `CapabilityError` code each device-authorization failure belongs to. */
+const DEVICE_AUTHORIZATION_CODE = {
+    access_denied: 'PERMISSION_DENIED',
+    expired_token: 'AUTH_REQUIRED',
+    invalid_client: 'INVALID_INPUT',
+    invalid_grant: 'INVALID_INPUT',
+    invalid_response: 'INTERNAL',
+    network_error: 'UNAVAILABLE',
+    session_invalid: 'AUTH_REQUIRED',
+    unknown_error: 'INTERNAL'
+};
+/**
+ * A device-authorization failure: a `CapabilityError` whose `reason` is the
+ * RFC 8628 code in kebab form (`session-invalid`); `legacyCode` keeps the
+ * protocol spelling (`session_invalid`) for readers of the old `code` field.
+ * A transport failure's `cause` is its value-free facts, never the request.
+ */
+export class DeviceAuthorizationError extends CapabilityError {
+    legacyCode;
+    status;
+    constructor(code, message, status, failure) {
+        const options = { reason: code.replaceAll('_', '-'), cause: failure };
+        if (status !== undefined)
+            options.details = { status };
+        super(message, DEVICE_AUTHORIZATION_CODE[code], options);
+        this.name = 'DeviceAuthorizationError';
+        this.legacyCode = code;
+        if (status !== undefined)
+            this.status = status;
+    }
+}
+/** A field read as its type or not at all: a field of another type is absent, as `stringField`/`numberField` read it. */
+const optionalText = z.string().min(1).optional().catch(undefined);
+const optionalNumber = z.number().optional().catch(undefined);
+const protocolErrorBodySchema = z.looseObject({
+    error: optionalText,
+    error_description: optionalText,
+    message: optionalText
+});
+const deviceCodeBodySchema = z.looseObject({
+    device_code: optionalText,
+    user_code: optionalText,
+    verification_uri: optionalText,
+    verification_uri_complete: optionalText,
+    expires_in: optionalNumber,
+    interval: optionalNumber
+});
+const deviceTokenBodySchema = z.looseObject({
+    error: optionalText,
+    access_token: optionalText,
+    token_type: optionalText,
+    refresh_token: optionalText,
+    expires_in: optionalNumber
+});
+const profileBodySchema = z.looseObject({ id: optionalText, email: optionalText, name: optionalText });
+const sessionBodySchema = z.looseObject({
+    user: z.looseObject({ id: optionalText, email: optionalText, name: optionalText }).optional().catch(undefined)
+});
+const mintBodySchema = z.looseObject({ token: optionalText });
+/** A response body read through `schema`; a body that is not an object (or not JSON) contributes no fields. */
+function readBody(schema, json) {
+    const parsed = schema.safeParse(json);
+    return parsed.success ? parsed.data : schema.parse({});
+}
+function normalizeOrigin(origin) {
+    return origin.endsWith('/') ? origin.slice(0, -1) : origin;
+}
+const PROTOCOL_ERROR_CODES = ['access_denied', 'expired_token', 'invalid_client', 'invalid_grant'];
+function protocolError(body, status) {
+    const rawCode = body.error ?? 'unknown_error';
+    const code = PROTOCOL_ERROR_CODES.find((known) => known === rawCode) ?? 'unknown_error';
+    const description = body.error_description ?? body.message ?? rawCode;
+    return new DeviceAuthorizationError(code, description, status);
+}
+/** An aborted request is the caller's own cancellation: it is rethrown, never reported as a network failure. */
+function rethrowAbort(failure) {
+    if (failure instanceof Error && failure.name === 'AbortError')
+        rethrowFailure(failure);
+}
+/** A request that got no HTTP answer: `network_error`, with the failure's one-line message and its value-free facts as cause. */
+function networkFailure(failure) {
+    return new DeviceAuthorizationError('network_error', failureMessage(failure), undefined, valueFreeFailure(failure));
+}
+async function send(url, init, options) {
+    const fetcher = options.fetcher ?? globalThis.fetch.bind(globalThis);
+    const sent = await attempt(() => fetcher(url, init));
+    if (sent.ok)
+        return sent.value;
+    rethrowAbort(sent.failure);
+    throw networkFailure(sent.failure);
+}
+async function postJson(url, body, options = {}) {
+    const response = await send(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify(body),
+        signal: options.signal
+    }, options);
+    return { response, json: await readJsonOrNull(response) };
+}
+export function isDeviceAuthorizationClient(clientId) {
+    return Object.hasOwn(DEVICE_AUTHORIZATION_CLIENTS, clientId);
+}
+export function getDeviceAuthorizationClient(clientId) {
+    return DEVICE_AUTHORIZATION_CLIENTS[clientId];
+}
+export async function requestDeviceAuthorization(options) {
+    const client = getDeviceAuthorizationClient(options.clientId);
+    const { response, json } = await postJson(`${normalizeOrigin(options.authOrigin)}/api/auth/device/code`, {
+        client_id: options.clientId,
+        scope: (options.scopes ?? client.scopes).join(' ')
+    }, options);
+    if (!response.ok)
+        throw protocolError(readBody(protocolErrorBodySchema, json), response.status);
+    const body = readBody(deviceCodeBodySchema, json);
+    const deviceCode = body.device_code;
+    const userCode = body.user_code;
+    const verificationUri = body.verification_uri;
+    const expiresInSeconds = body.expires_in;
+    if (!deviceCode || !userCode || !verificationUri || expiresInSeconds === undefined) {
+        throw new DeviceAuthorizationError('invalid_response', 'Auth returned an incomplete device authorization response', response.status);
+    }
+    return {
+        deviceCode,
+        userCode,
+        verificationUri,
+        verificationUriComplete: body.verification_uri_complete,
+        expiresInSeconds,
+        intervalSeconds: body.interval ?? 5,
+        issuedAtMs: (options.now ?? Date.now)()
+    };
+}
+export async function pollDeviceAuthorization(options) {
+    const { response, json } = await postJson(`${normalizeOrigin(options.authOrigin)}/api/auth/device/token`, {
+        grant_type: DEVICE_AUTHORIZATION_GRANT_TYPE,
+        device_code: options.code.deviceCode,
+        client_id: options.clientId
+    }, options);
+    const body = readBody(deviceTokenBodySchema, json);
+    const error = body.error;
+    if (error === 'authorization_pending') {
+        return {
+            status: 'pending',
+            retryAfterMs: options.intervalMs ?? options.code.intervalSeconds * 1_000
+        };
+    }
+    if (error === 'slow_down') {
+        return {
+            status: 'pending',
+            retryAfterMs: (options.intervalMs ?? options.code.intervalSeconds * 1_000) + 5_000
+        };
+    }
+    if (!response.ok || error)
+        throw protocolError(readBody(protocolErrorBodySchema, json), response.status);
+    const sessionToken = body.access_token;
+    if (!sessionToken) {
+        throw new DeviceAuthorizationError('invalid_response', 'Auth returned no access token after device approval', response.status);
+    }
+    const expiresInSeconds = body.expires_in;
+    return {
+        status: 'authorized',
+        token: {
+            sessionToken,
+            tokenType: body.token_type ?? 'Bearer',
+            refreshToken: body.refresh_token,
+            expiresAt: expiresInSeconds
+                ? new Date(Date.now() + expiresInSeconds * 1_000).toISOString()
+                : undefined
+        }
+    };
+}
+async function getJson(url, headers, options = {}) {
+    const response = await send(url, {
+        headers: { accept: 'application/json', ...headers },
+        signal: options.signal
+    }, options);
+    return { response, json: await readJsonOrNull(response) };
+}
+export async function getDeviceAuthorizationUser(options) {
+    const origin = normalizeOrigin(options.authOrigin);
+    const headers = { Authorization: `Bearer ${options.sessionToken}` };
+    const profile = await getJson(`${origin}/api/user/me`, headers, options);
+    if (profile.response.ok) {
+        const body = readBody(profileBodySchema, profile.json);
+        if (body.id && body.email) {
+            return { userId: body.id, email: body.email, name: body.name };
+        }
+    }
+    const session = await getJson(`${origin}/api/auth/get-session`, headers, options);
+    const user = readBody(sessionBodySchema, session.json).user;
+    if (session.response.ok && user?.id && user.email) {
+        return { userId: user.id, email: user.email, name: user.name };
+    }
+    throw new DeviceAuthorizationError('session_invalid', 'The device session is no longer valid', session.response.status);
+}
+export async function exchangeDeviceSessionForAppJwt(options) {
+    const origin = normalizeOrigin(options.authOrigin);
+    const result = await getJson(`${origin}/api/auth/token`, { Authorization: `Bearer ${options.sessionToken}` }, options);
+    const jwt = readBody(mintBodySchema, result.json).token;
+    if (result.response.ok && jwt && jwt.split('.').length === 3)
+        return jwt;
+    throw new DeviceAuthorizationError('session_invalid', 'Auth could not mint an app session for this device', result.response.status);
+}
+export async function revokeDeviceAuthorizationSession(options) {
+    const logger = getLogger('auth.device-authorization', options.runtime);
+    const origin = normalizeOrigin(options.authOrigin);
+    const fetcher = options.fetcher ?? globalThis.fetch.bind(globalThis);
+    const authorization = { Authorization: `Bearer ${options.sessionToken}` };
+    // Receiver: Better Auth POST /api/auth/sign-out (auth-web bearer plugin
+    // enabled). The device `access_token` is a raw `generateId(32)` session
+    // token. The bearer plugin HMAC-signs that raw token into the session
+    // cookie; signOut then getSignedCookie + deleteSession.
+    // Auth-web `/signout` cannot: readPresentedJwt treats any bearer as a JWT
+    // (token-exp-missing) and an unsigned Cookie fails getSignedCookie, while
+    // Better Auth still returns 200 and the route 303s.
+    const signOut = await attempt(() => fetcher(`${origin}/api/auth/sign-out`, {
+        method: 'POST',
+        headers: {
+            ...authorization,
+            accept: 'application/json',
+            'content-type': 'application/json'
+        },
+        body: JSON.stringify({}),
+        signal: options.signal
+    }));
+    if (!signOut.ok) {
+        rethrowAbort(signOut.failure);
+        logger.warn('Device session revocation transport failed', { failure: failureLabel(signOut.failure) });
+        return false;
+    }
+    if (!signOut.value.ok) {
+        logger.warn('Device session revocation was not confirmed');
+        return false;
+    }
+    // signOut returns 200 even when getSignedCookie misses and deleteSession
+    // never runs. Confirm the row is gone the same way device identity already
+    // reads it: bearer GET /api/auth/get-session (findSession after delete).
+    const check = await attempt(() => getJson(`${origin}/api/auth/get-session`, authorization, options));
+    if (!check.ok) {
+        rethrowAbort(check.failure);
+        logger.warn('Device session revocation transport failed', { failure: failureLabel(check.failure) });
+        return false;
+    }
+    const session = check.value;
+    if (session.response.status === 401 || session.response.status === 403)
+        return true;
+    if (!session.response.ok) {
+        logger.warn('Device session revocation was not confirmed');
+        return false;
+    }
+    if (!readBody(sessionBodySchema, session.json).user?.id)
+        return true;
+    logger.warn('Device session revocation was not confirmed');
+    return false;
+}
+//# sourceMappingURL=device-authorization.js.map

package/dist/client/device-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-authorization.js","sourceRoot":"","sources":["../../src/client/device-authorization.ts"],"names":[],"mappings":"AACA;;;;;;GAMG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,eAAe,EACf,gBAAgB,EAKhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,+BAA+B,GAC3C,8CAAuD,CAAC;AAEzD,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC3C,WAAW,EAAE;QACZ,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE;YACP,cAAc;YACd,aAAa;YACb,YAAY;YACZ,gBAAgB;YAChB,kBAAkB;YAClB,kBAAkB;YAClB,kBAAkB;SAClB;KACD;IACD,gBAAgB,EAAE;QACjB,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE;YACP,cAAc;YACd,aAAa;YACb,YAAY;YACZ,gBAAgB;YAChB,kBAAkB;YAClB,kBAAkB;YAClB,kBAAkB;YAClB,WAAW;YACX,YAAY;YACZ,cAAc;YACd,eAAe;SACf;KACD;IACD,gBAAgB,EAAE;QACjB,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE;YACP,cAAc;YACd,aAAa;YACb,YAAY;YACZ,gBAAgB;YAChB,kBAAkB;YAClB,kBAAkB;YAClB,kBAAkB;YAClB,WAAW;YACX,YAAY;YACZ,cAAc;YACd,eAAe;SACf;KACD;IACD,kBAAkB,EAAE;QACnB,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE;YACP,cAAc;YACd,aAAa;YACb,YAAY;YACZ,gBAAgB;YAChB,kBAAkB;YAClB,kBAAkB;YAClB,kBAAkB;YAClB,WAAW;YACX,YAAY;YACZ,cAAc;YACd,eAAe;YACf,oBAAoB;YACpB,qBAAqB;SACrB;KACD;IACD,sBAAsB,EAAE;QACvB,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE;YACP,cAAc;YACd,aAAa;YACb,YAAY;YACZ,gBAAgB;YAChB,kBAAkB;YAClB,kBAAkB;YAClB,kBAAkB;YAClB,WAAW;YACX,YAAY;YACZ,cAAc;YACd,eAAe;YACf,oBAAoB;YACpB,qBAAqB;SACrB;KACD;CACQ,CAAC;AAyCX,+EAA+E;AAC/E,MAAM,yBAAyB,GAAG;IACjC,aAAa,EAAE,mBAAmB;IAClC,aAAa,EAAE,eAAe;IAC9B,cAAc,EAAE,eAAe;IAC/B,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,UAAU;IAC5B,aAAa,EAAE,aAAa;IAC5B,eAAe,EAAE,eAAe;IAChC,aAAa,EAAE,UAAU;CACoD,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,eAAe;IACnD,UAAU,CAA+B;IACzC,MAAM,CAAU;IAEzB,YACC,IAAkC,EAClC,OAAe,EACf,MAAe,EACf,OAA6C;QAE7C,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC9F,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC;QACvD,KAAK,CAAC,OAAO,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IAChD,CAAC;CACD;AAoBD,yHAAyH;AACzH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACnE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAE9D,MAAM,uBAAuB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC7C,KAAK,EAAE,YAAY;IACnB,iBAAiB,EAAE,YAAY;IAC/B,OAAO,EAAE,YAAY;CACrB,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC1C,WAAW,EAAE,YAAY;IACzB,SAAS,EAAE,YAAY;IACvB,gBAAgB,EAAE,YAAY;IAC9B,yBAAyB,EAAE,YAAY;IACvC,UAAU,EAAE,cAAc;IAC1B,QAAQ,EAAE,cAAc;CACxB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3C,KAAK,EAAE,YAAY;IACnB,YAAY,EAAE,YAAY;IAC1B,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,YAAY;IAC3B,UAAU,EAAE,cAAc;CAC1B,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAEvG,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAC9G,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;AAE9D,+GAA+G;AAC/G,SAAS,QAAQ,CAAsB,MAAS,EAAE,IAAa;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5D,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,eAAe,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,CAAU,CAAC;AAE5G,SAAS,aAAa,CACrB,IAA8C,EAC9C,MAAe;IAEf,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC;IAC9C,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,eAAe,CAAC;IACxF,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IACtE,OAAO,IAAI,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,gHAAgH;AAChH,SAAS,YAAY,CAAC,OAAsB;IAC3C,IAAI,OAAO,YAAY,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY;QAAE,cAAc,CAAC,OAAO,CAAC,CAAC;AACxF,CAAC;AAED,iIAAiI;AACjI,SAAS,cAAc,CAAC,OAAsB;IAC7C,OAAO,IAAI,wBAAwB,CAClC,eAAe,EACf,cAAc,CAAC,OAAO,CAAC,EACvB,SAAS,EACT,gBAAgB,CAAC,OAAO,CAAC,CACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAClB,GAAW,EACX,IAAiB,EACjB,OAAgC;IAEhC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC/B,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,QAAQ,CACtB,GAAW,EACX,IAA4B,EAC5B,UAAyD,EAAE;IAE3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAC1B,GAAG,EACH;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,EACD,OAAO,CACP,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,QAAgB;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAAqC;IACjF,OAAO,4BAA4B,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,OAA0C;IAE1C,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CACxC,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,uBAAuB,EAC7D;QACC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KAClD,EACD,OAAO,CACP,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,uBAAuB,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEhG,MAAM,IAAI,GAAG,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC;IACzC,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,wBAAwB,CACjC,kBAAkB,EAClB,2DAA2D,EAC3D,QAAQ,CAAC,MAAM,CACf,CAAC;IACH,CAAC;IAED,OAAO;QACN,UAAU;QACV,QAAQ;QACR,eAAe;QACf,uBAAuB,EAAE,IAAI,CAAC,yBAAyB;QACvD,gBAAgB;QAChB,eAAe,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;QACnC,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;KACvC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAuC;IAEvC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CACxC,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,wBAAwB,EAC9D;QACC,UAAU,EAAE,+BAA+B;QAC3C,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;QACpC,SAAS,EAAE,OAAO,CAAC,QAAQ;KAC3B,EACD,OAAO,CACP,CAAC;IAEF,MAAM,IAAI,GAAG,QAAQ,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,KAAK,KAAK,uBAAuB,EAAE,CAAC;QACvC,OAAO;YACN,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe,GAAG,KAAK;SACxE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO;YACN,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,GAAG,KAAK;SAClF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,KAAK;QAAE,MAAM,aAAa,CAAC,QAAQ,CAAC,uBAAuB,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzG,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,IAAI,wBAAwB,CACjC,kBAAkB,EAClB,qDAAqD,EACrD,QAAQ,CAAC,MAAM,CACf,CAAC;IACH,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC;IACzC,OAAO;QACN,MAAM,EAAE,YAAY;QACpB,KAAK,EAAE;YACN,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,gBAAgB;gBAC1B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;gBAC/D,CAAC,CAAC,SAAS;SACZ;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CACrB,GAAW,EACX,OAA+B,EAC/B,UAAyD,EAAE;IAE3D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAC1B,GAAG,EACH;QACC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;QACnD,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,EACD,OAAO,CACP,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAKhD;IACA,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QAChE,CAAC;IACF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,uBAAuB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,wBAAwB,CACjC,iBAAiB,EACjB,uCAAuC,EACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAKpD;IACA,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAC3B,GAAG,MAAM,iBAAiB,EAC1B,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE,EAAE,EACnD,OAAO,CACP,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;IACxD,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACzE,MAAM,IAAI,wBAAwB,CACjC,iBAAiB,EACjB,oDAAoD,EACpD,MAAM,CAAC,QAAQ,CAAC,MAAM,CACtB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,OAMtD;IACA,MAAM,MAAM,GAAG,SAAS,CAAC,2BAA2B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;IAC1E,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,wDAAwD;IACxD,0EAA0E;IAC1E,0EAA0E;IAC1E,oDAAoD;IACpD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAClC,OAAO,CAAC,GAAG,MAAM,oBAAoB,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,GAAG,aAAa;YAChB,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,kBAAkB;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CACF,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtG,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,MAAM,uBAAuB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;IACrG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5B,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/client/device-login.d.ts

@@ -0,0 +1,9 @@
+import type { DeviceSignInOptions, DeviceLoginResult } from '../schemas/consumer-auth.ts';
+import type { AuthConsumerContext } from './consumer-context.types.ts';
+export type { DeviceLoginResult } from '../schemas/consumer-auth.ts';
+/**
+ * Handle device authorization through the package-owned RFC 8628 protocol
+ * engine while preserving the CLI surface's scoped runtime client and store.
+ */
+export declare function activateDeviceSession(context: AuthConsumerContext, options?: Pick<DeviceSignInOptions, 'signal'>): Promise<DeviceLoginResult>;
+//# sourceMappingURL=device-login.d.ts.map

package/dist/client/device-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.d.ts","sourceRoot":"","sources":["../../src/client/device-login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAa,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAevE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AA0DrE;;;GAGG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAM,GAC/C,OAAO,CAAC,iBAAiB,CAAC,CAkF5B"}