@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/client/device-login.js

@@ -0,0 +1,196 @@
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { loadClientSettings } from '@vibesdotdev/client/config';
+import { attempt, failureLabel } from "../features/utils/attempt.js";
+import { carriedStatus, failureMessage, failureText } from "./request-failure.js";
+import { setCredentials } from "../features/services/credential-store.js";
+import { pollDeviceAuthorization, requestDeviceAuthorization, DeviceAuthorizationError } from "./device-authorization.js";
+import { GET_SESSION_PATH, readGetSessionAnswer } from "./session-identity.js";
+import { sessionAuthorizationHeader } from "./session-authorization.js";
+import { auditLog } from '@vibesdotdev/logging';
+function protocolErrorCode(message) {
+    for (const code of [
+        'authorization_pending',
+        'slow_down',
+        'expired_token',
+        'access_denied',
+        'invalid_client',
+        'invalid_grant'
+    ]) {
+        if (message.includes(code))
+            return code;
+    }
+    return 'unknown_error';
+}
+/** The JSON body a request carries: the shared core always sends `JSON.stringify` of a flat object. */
+const requestBodySchema = JsonValueSchema;
+/** Adapt the scoped runtime client to the shared fetch-shaped RFC 8628 core. */
+async function createContextFetcher(context) {
+    // Resolve through the caller's scoped runtime, never the ambient global.
+    const client = await context.createClient();
+    return async (input, init) => {
+        const url = new URL(String(input));
+        const path = `${url.pathname}${url.search}`;
+        const headers = Object.fromEntries(new Headers(init?.headers).entries());
+        const answer = await attempt(async () => {
+            if ((init?.method ?? 'GET').toUpperCase() !== 'POST')
+                return client.get(path, { headers });
+            const body = init?.body ? requestBodySchema.parse(JSON.parse(String(init.body))) : undefined;
+            return client.post(path, body, { headers });
+        });
+        if (answer.ok)
+            return Response.json(answer.value);
+        const message = failureMessage(answer.failure);
+        return Response.json({ error: protocolErrorCode(failureText(answer.failure)), error_description: message }, { status: carriedStatus(answer.failure) ?? 500 });
+    };
+}
+async function auditFailure(context, action, error, outcome = 'failure') {
+    await auditLog({
+        category: 'authentication',
+        severity: 'medium',
+        action,
+        actor: { id: 'cli', type: 'user' },
+        outcome,
+        context: { environment: context.environment.id },
+        error
+    }, context.runtime);
+}
+/**
+ * Handle device authorization through the package-owned RFC 8628 protocol
+ * engine while preserving the CLI surface's scoped runtime client and store.
+ */
+export async function activateDeviceSession(context, options = {}) {
+    const signal = options.signal ? AbortSignal.any([options.signal, context.runtime.lifecycle.signal]) : context.runtime.lifecycle.signal;
+    const checkCancelled = () => {
+        if (signal.aborted)
+            throw new CapabilityError('Device sign-in cancelled.', 'CANCELLED', {
+                reason: 'device-sign-in-cancelled', cause: CaughtFailureSchema.parse(signal.reason)
+            });
+    };
+    checkCancelled();
+    context.logger.info('Starting device authorization flow...');
+    const transport = await createContextFetcher(context);
+    const { timeoutMs } = await loadClientSettings(context.runtime);
+    const fetcher = (input, init) => context.runtime.lifecycle.wait(() => transport(input, init), { signal, timeoutMs, reason: 'auth device sign-in request' });
+    const requested = await attempt(() => requestDeviceAuthorization({
+        authOrigin: context.environment.apiUrl,
+        clientId: 'vibes-cli',
+        fetcher, signal
+    }));
+    if (!requested.ok) {
+        checkCancelled();
+        const message = failureMessage(requested.failure);
+        await auditFailure(context, 'device_code_request', `Failed to request device code: ${message}`);
+        return {
+            success: false,
+            message: `Failed to request device code: ${message}`,
+            token: null, cause: requested.failure
+        };
+    }
+    const code = requested.value;
+    context.logger.info(`Your device code: ${code.userCode}`);
+    context.logger.info(`Visit ${code.verificationUri} to approve this device.`);
+    if (code.verificationUriComplete) {
+        const externalUrl = context.externalUrl;
+        const opened = externalUrl ? await attempt(() => externalUrl.open(code.verificationUriComplete ?? '')) : null;
+        // No opener on this surface, or the opener failed: the user follows the URL printed above.
+        if (!opened?.ok) {
+            context.logger.warn(opened
+                ? `Failed to open browser automatically (${failureLabel(opened.failure)}). Please visit the URL above.`
+                : 'Failed to open browser automatically. Please visit the URL above.');
+        }
+    }
+    const expiresAtMs = code.issuedAtMs + code.expiresInSeconds * 1_000;
+    let pollIntervalMs = code.intervalSeconds * 1_000;
+    while (Date.now() < expiresAtMs) {
+        await context.runtime.lifecycle.delay(pollIntervalMs, signal);
+        checkCancelled();
+        const step = await attempt(() => pollAndStore(context, code, fetcher, pollIntervalMs, signal, timeoutMs));
+        if (step.ok) {
+            if (step.value.kind === 'pending') {
+                pollIntervalMs = step.value.retryAfterMs;
+                context.logger.debug('Authorization pending...');
+                continue;
+            }
+            return step.value.result;
+        }
+        checkCancelled();
+        const failure = step.failure;
+        const protocolCode = failure instanceof DeviceAuthorizationError ? failure.legacyCode : 'unknown_error';
+        const message = failureMessage(failure);
+        if (protocolCode === 'expired_token') {
+            await auditFailure(context, 'device_token_poll', 'Device code expired');
+            return { success: false, message: 'Device code expired. Please try again.', token: null, cause: failure };
+        }
+        if (protocolCode === 'access_denied') {
+            await auditFailure(context, 'device_token_poll', 'Access denied by user');
+            return { success: false, message: 'Access denied by user.', token: null, cause: failure };
+        }
+        await auditFailure(context, 'device_token_poll', message, 'error');
+        return { success: false, message: `Token request failed: ${message}`, token: null, cause: failure };
+    }
+    await auditFailure(context, 'device_token_poll', 'Device code expired (loop exit)');
+    return { success: false, message: 'Device code expired. Please try again.', token: null, cause: new DeviceAuthorizationError('expired_token', 'Device code expired.') };
+}
+/** One poll of the device token endpoint; an approved one stores the session and reads who signed in. */
+async function pollAndStore(context, code, fetcher, pollIntervalMs, signal, timeoutMs) {
+    const result = await pollDeviceAuthorization({
+        authOrigin: context.environment.apiUrl,
+        clientId: 'vibes-cli',
+        code,
+        fetcher,
+        intervalMs: pollIntervalMs, signal
+    });
+    if (result.status === 'pending')
+        return { kind: 'pending', retryAfterMs: result.retryAfterMs };
+    signal.throwIfAborted();
+    const environmentName = context.environment.id;
+    const identity = await attempt(async () => {
+        const client = await context.createClient();
+        const answer = await context.runtime.lifecycle.wait(() => client.get(GET_SESSION_PATH, {
+            headers: sessionAuthorizationHeader(result.token.sessionToken)
+        }), { signal, timeoutMs, reason: 'auth device identity' });
+        return readGetSessionAnswer(answer);
+    });
+    if (identity.ok && identity.value.kind === 'unknown-session') {
+        await auditFailure(context, 'device_token_poll', 'Auth does not recognize the new session');
+        return {
+            kind: 'done',
+            result: { success: false, message: 'Auth does not recognize the new session. The previous login was preserved.', token: null, cause: new DeviceAuthorizationError('session_invalid', 'Auth does not recognize the new session.') }
+        };
+    }
+    signal.throwIfAborted();
+    const user = identity.ok && identity.value.kind === 'known' ? identity.value.user : undefined;
+    if (!user) {
+        context.logger.warn('Could not read the signed-in user after device authorization. The approved session was stored without an account identity.');
+    }
+    await setCredentials({
+        mode: 'replace-session',
+        sessionToken: result.token.sessionToken,
+        refreshToken: result.token.refreshToken,
+        expiresAt: result.token.expiresAt,
+        userId: user?.userId,
+        email: user?.email,
+        name: user?.name ?? undefined
+    }, environmentName, context.runtime);
+    await auditLog({
+        category: 'authentication',
+        severity: 'medium',
+        action: 'login',
+        actor: user
+            ? { id: user.userId, type: 'user', name: user.email }
+            : { id: 'cli', type: 'user' },
+        outcome: 'success',
+        context: { method: 'device_code', environment: environmentName }
+    }, context.runtime);
+    return {
+        kind: 'done',
+        result: {
+            success: true,
+            message: 'Successfully authenticated via device authorization',
+            token: result.token.sessionToken,
+            user
+        }
+    };
+}
+//# sourceMappingURL=device-login.js.map

package/dist/client/device-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-login.js","sourceRoot":"","sources":["../../src/client/device-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EACN,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EAGxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIhD,SAAS,iBAAiB,CAAC,OAAe;IACzC,KAAK,MAAM,IAAI,IAAI;QAClB,uBAAuB;QACvB,WAAW;QACX,eAAe;QACf,eAAe;QACf,gBAAgB;QAChB,eAAe;KACf,EAAE,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,eAAe,CAAC;AACxB,CAAC;AAED,uGAAuG;AACvG,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,gFAAgF;AAChF,KAAK,UAAU,oBAAoB,CAAC,OAA4B;IAC/D,yEAAyE;IACzE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC5C,OAAO,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAE,EAAE;QAClE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;YACvC,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAU,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACpG,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,OAAO,MAAM,CAAC,IAAI,CAAU,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,KAAK,EAAE,iBAAiB,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,EACrF,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAChD,CAAC;IACH,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAC1B,OAA4B,EAC5B,MAAmD,EACnD,KAAa,EACb,UAA+B,SAAS;IAExC,MAAM,QAAQ,CAAC;QACd,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,MAAM;QACN,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QAClC,OAAO;QACP,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;QAChD,KAAK;KACL,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAA4B,EAC5B,UAA+C,EAAE;IAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;IACvI,MAAM,cAAc,GAAG,GAAG,EAAE;QAC3B,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE,WAAW,EAAE;gBACvF,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;aACnF,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,cAAc,EAAE,CAAC;IACjB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,OAAO,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CACzE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAC1F,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CACpC,0BAA0B,CAAC;QAC1B,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM;QACtC,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,MAAM;KACf,CAAC,CACF,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,cAAc,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,YAAY,CAAC,OAAO,EAAE,qBAAqB,EAAE,kCAAkC,OAAO,EAAE,CAAC,CAAC;QAChG,OAAO;YACN,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kCAAkC,OAAO,EAAE;YACpD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO;SACrC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC;IAE7B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,eAAe,0BAA0B,CAAC,CAAC;IAE7E,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9G,2FAA2F;QAC3F,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,IAAI,CAClB,MAAM;gBACL,CAAC,CAAC,yCAAyC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,gCAAgC;gBACvG,CAAC,CAAC,mEAAmE,CACtE,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;IACpE,IAAI,cAAc,GAAG,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;IAClD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAC9D,cAAc,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC1G,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACnC,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;gBACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBACjD,SAAS;YACV,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAC1B,CAAC;QACD,cAAc,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM,YAAY,GAAG,OAAO,YAAY,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC;QACxG,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,YAAY,KAAK,eAAe,EAAE,CAAC;YACtC,MAAM,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;YACxE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAwC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3G,CAAC;QACD,IAAI,YAAY,KAAK,eAAe,EAAE,CAAC;YACtC,MAAM,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;YAC1E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC3F,CAAC;QACD,MAAM,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,iCAAiC,CAAC,CAAC;IACpF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAwC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,wBAAwB,CAAC,eAAe,EAAE,sBAAsB,CAAC,EAAE,CAAC;AACzK,CAAC;AAMD,yGAAyG;AACzG,KAAK,UAAU,YAAY,CAC1B,OAA4B,EAC5B,IAA6B,EAC7B,OAAkB,EAClB,cAAsB,EACtB,MAAmB,EACnB,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;QAC5C,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM;QACtC,QAAQ,EAAE,WAAW;QACrB,IAAI;QACJ,OAAO;QACP,UAAU,EAAE,cAAc,EAAE,MAAM;KAClC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAE/F,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACzC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAClD,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAU,gBAAgB,EAAE;YAC3C,OAAO,EAAE,0BAA0B,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;SAC9D,CAAC,EACF,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,sBAAsB,EAAE,CACrD,CAAC;QACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC9D,MAAM,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;QAC5F,OAAO;YACN,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,4EAA4E,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,wBAAwB,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,EAAE;SAClO,CAAC;IACH,CAAC;IAED,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,IAAI,GACT,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,4HAA4H,CAAC,CAAC;IACnJ,CAAC;IACD,MAAM,cAAc,CACnB;QACC,IAAI,EAAE,iBAAiB;QACvB,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;QACvC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;QACvC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;QACjC,MAAM,EAAE,IAAI,EAAE,MAAM;QACpB,KAAK,EAAE,IAAI,EAAE,KAAK;QAClB,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS;KAC7B,EACD,eAAe,EACf,OAAO,CAAC,OAAO,CACf,CAAC;IAEF,MAAM,QAAQ,CAAC;QACd,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,IAAI;YACV,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;YACrD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9B,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE;KAChE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,OAAO;QACN,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE;YACP,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,qDAAqD;YAC9D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;YAChC,IAAI;SACJ;KACD,CAAC;AACH,CAAC"}

package/dist/client/factory.d.ts

@@ -0,0 +1,18 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type ApiClientConfig } from '@vibesdotdev/client/factory';
+import type { ApiClientImplementation } from '@vibesdotdev/client/schemas';
+/**
+ * Create a pre-configured auth API client.
+ *
+ * Convenience wrapper that defaults baseUrl to the auth service origin. The
+ * origin resolves lazily on first request (see {@link LazyAuthClient}) so this
+ * stays synchronous for callers while never freezing an origin at construction.
+ *
+ * @example
+ * ```ts
+ * const auth = vibesAuthClient(runtime);
+ * const session = await auth.get('/api/session');
+ * ```
+ */
+export declare function vibesAuthClient(runtime: RuntimeRef, overrides?: Partial<ApiClientConfig>): ApiClientImplementation;
+//# sourceMappingURL=factory.d.ts.map

package/dist/client/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/client/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAkB,MAAM,6BAA6B,CAAC;AAoE3F;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,GAAE,OAAO,CAAC,eAAe,CAAM,GAAG,uBAAuB,CAGtH"}

package/dist/client/factory.js

@@ -0,0 +1,79 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { vibesApiClient } from '@vibesdotdev/client/factory';
+import { resolveAuthApiBaseUrl } from "../features/config/auth-api.js";
+/**
+ * Lazy auth API client: resolves the auth origin on FIRST request, not at
+ * construction (A5 acceptance #9). The origin comes from the canonical
+ * infra/service resolver via `resolveAuthApiBaseUrl`, which THROWS on an
+ * uncomposed runtime rather than inventing a bare-domain fallback — so an
+ * eagerly-constructed client neither freezes the wrong origin nor fails until a
+ * request is actually made (by which point the runtime is composed).
+ *
+ * Unlike the runtime `AuthApiClient` impl, this forwards the FULL override
+ * config (including `auth`) so callers passing e.g. `auth: { type: 'none' }`
+ * keep their semantics. Memoized: the origin resolves once.
+ */
+class LazyAuthClient {
+    runtime;
+    overrides;
+    clientPromise;
+    constructor(runtime, overrides) {
+        this.runtime = runtime;
+        this.overrides = overrides;
+    }
+    ensureClient() {
+        if (!this.clientPromise) {
+            this.clientPromise = (async () => {
+                const baseUrl = this.overrides.baseUrl ?? (await resolveAuthApiBaseUrl(this.runtime));
+                return vibesApiClient({
+                    id: 'auth',
+                    runtime: this.runtime,
+                    ...this.overrides,
+                    baseUrl
+                });
+            })();
+        }
+        return this.clientPromise;
+    }
+    async get(endpoint, options) {
+        return (await this.ensureClient()).get(endpoint, options);
+    }
+    async post(endpoint, body, options) {
+        return (await this.ensureClient()).post(endpoint, body, options);
+    }
+    async put(endpoint, body, options) {
+        return (await this.ensureClient()).put(endpoint, body, options);
+    }
+    async patch(endpoint, body, options) {
+        return (await this.ensureClient()).patch(endpoint, body, options);
+    }
+    async delete(endpoint, options) {
+        return (await this.ensureClient()).delete(endpoint, options);
+    }
+    async request(endpoint, options) {
+        return (await this.ensureClient()).request(endpoint, options);
+    }
+    async *stream(endpoint, options) {
+        const client = await this.ensureClient();
+        yield* client.stream(endpoint, options);
+    }
+}
+/**
+ * Create a pre-configured auth API client.
+ *
+ * Convenience wrapper that defaults baseUrl to the auth service origin. The
+ * origin resolves lazily on first request (see {@link LazyAuthClient}) so this
+ * stays synchronous for callers while never freezing an origin at construction.
+ *
+ * @example
+ * ```ts
+ * const auth = vibesAuthClient(runtime);
+ * const session = await auth.get('/api/session');
+ * ```
+ */
+export function vibesAuthClient(runtime, overrides = {}) {
+    if (!runtime)
+        throw new CapabilityError('Auth client requires a caller runtime.', 'INVALID_INPUT', { reason: 'runtime-required', retryable: false });
+    return new LazyAuthClient(runtime, overrides);
+}
+//# sourceMappingURL=factory.js.map

package/dist/client/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../src/client/factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAwB,MAAM,6BAA6B,CAAC;AAEnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,MAAM,cAAc;IAGU;IAAsC;IAF3D,aAAa,CAAoC;IAEzD,YAA6B,OAAmB,EAAmB,SAAmC;QAAzE,YAAO,GAAP,OAAO,CAAY;QAAmB,cAAS,GAAT,SAAS,CAA0B;IAAG,CAAC;IAElG,YAAY;QACnB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACzB,IAAI,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;gBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtF,OAAO,cAAc,CAAC;oBACrB,EAAE,EAAE,MAAM;oBACV,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,GAAG,IAAI,CAAC,SAAS;oBACjB,OAAO;iBACP,CAAC,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,QAAgB,EAAE,OAAuD;QAC/F,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,IAAI,CAAc,QAAgB,EAAE,IAAqD,EAAE,OAAwD;QACxJ,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,QAAgB,EAAE,IAAoD,EAAE,OAAuD;QACrJ,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,KAAK,CAAc,QAAgB,EAAE,IAAsD,EAAE,OAAyD;QAC3J,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,MAAM,CAAc,QAAgB,EAAE,OAA0D;QACrG,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,OAAO,CAAc,QAAgB,EAAE,OAA2D;QACvG,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CACZ,QAAgB,EAChB,OAA0D;QAE1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACzC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmB,EAAE,YAAsC,EAAE;IAC5F,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,wCAAwC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACrJ,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAC/C,CAAC"}

package/dist/client/gateway.d.ts

@@ -0,0 +1,26 @@
+import { type AuthClientId, type AuthGateway, type AuthGatewayClient, type GatewayClientDefinition } from './schemas.ts';
+declare const DEFAULT_CLIENT_DEFINITIONS: GatewayClientDefinition[];
+export { DEFAULT_CLIENT_DEFINITIONS };
+export declare function createAuthGatewayClient(input: Omit<GatewayClientDefinition, 'subdomain'> & {
+    origin: string;
+}): AuthGatewayClient;
+/**
+ * Build the auth gateway contract for a base domain.
+ *
+ * `baseDomain` is REQUIRED and has no default. It is the root of the entire
+ * trust topology — `authOrigin`, `cookieDomain`, every client origin, and the
+ * gateway `issuer` all derive from it — so a default here is not a convenience,
+ * it is an invented trust anchor (corpus v2 class M5; this line was the M5 root).
+ * The caller knows its environment; this function must not guess it.
+ *
+ * Callers resolve it from `config/environment` and pass it in. Omitting it is a
+ * COMPILE error; the runtime throw is the belt for untyped/JS consumers.
+ */
+export declare function createDefaultAuthGateway(options: {
+    baseDomain: string;
+    authOrigin?: string;
+    cookieDomain?: string;
+    includeInternal?: boolean;
+    clients?: readonly AuthClientId[];
+}): AuthGateway;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/client/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/client/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,MAAM,cAAc,CAAC;AAEtB,QAAA,MAAM,0BAA0B,EAAE,uBAAuB,EAkExD,CAAC;AAEF,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAMtC,wBAAgB,uBAAuB,CACtC,KAAK,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,CAAC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GACpE,iBAAiB,CAQnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CAClC,GAAG,WAAW,CAwCd"}

package/dist/client/gateway.js

@@ -0,0 +1,129 @@
+import { authGatewayClientSchema, authGatewaySchema } from "./schemas.js";
+const DEFAULT_CLIENT_DEFINITIONS = [
+    { id: 'account', name: 'Account', subdomain: 'account', scopes: ['identity', 'billing'] },
+    { id: 'app', name: 'App', subdomain: 'app', scopes: ['identity', 'workspace'] },
+    { id: 'hq', name: 'HQ', subdomain: 'hq', scopes: ['identity', 'workspace'] },
+    { id: 'ai', name: 'AI', subdomain: 'ai', scopes: ['identity', 'ai'] },
+    { id: 'chat', name: 'Chat', subdomain: 'chat', scopes: ['identity', 'chat'] },
+    {
+        id: 'casework',
+        name: 'Casework',
+        subdomain: 'casework',
+        scopes: ['identity', 'casework']
+    },
+    {
+        id: 'knowledge',
+        name: 'Knowledge',
+        subdomain: 'knowledge',
+        scopes: ['identity', 'knowledge']
+    },
+    {
+        id: 'dossier',
+        name: 'Dossier',
+        subdomain: 'dossier',
+        scopes: ['identity', 'knowledge', 'workspace']
+    },
+    { id: 'creative', name: 'Creative', subdomain: 'creative', scopes: ['identity', 'media'] },
+    {
+        id: 'workbench',
+        name: 'Workbench',
+        subdomain: 'workbench',
+        scopes: ['identity', 'automation']
+    },
+    { id: 'runnable', name: 'Runnable', subdomain: 'runnable', scopes: ['identity', 'companion'] },
+    {
+        id: 'platform',
+        name: 'Platform',
+        subdomain: 'platform',
+        scopes: ['identity', 'integrations']
+    },
+    {
+        id: 'system',
+        name: 'System',
+        subdomain: 'system',
+        scopes: ['identity', 'admin'],
+        audience: 'internal'
+    },
+    { id: 'docs', name: 'Docs', subdomain: 'docs', scopes: ['read:docs'] },
+    {
+        id: 'desktop',
+        name: 'Vibes Desktop',
+        subdomain: 'desktop',
+        scopes: ['identity', 'voice']
+    },
+    {
+        id: 'mcp',
+        name: 'MCP',
+        subdomain: 'mcp',
+        scopes: ['identity', 'mcp', 'tools', 'workspace']
+    },
+    // Forge's canonical UI origin is forge.<domain>. git.<domain> is the SAME
+    // worker under its conventional clone/push name and is deliberately NOT a
+    // client: sign-in always returns to the forge origin. Registering this is
+    // what puts forge.<domain> in the redirect allowlist — without it
+    // validateRedirectUrl returns null, auth silently renders the app picker
+    // instead of returning an already-signed-in caller, and Forge is missing
+    // from the connected-apps list.
+    { id: 'forge', name: 'Forge', subdomain: 'forge', scopes: ['identity', 'workspace'] }
+];
+export { DEFAULT_CLIENT_DEFINITIONS };
+function createOrigin(subdomain, baseDomain) {
+    return `https://${subdomain}.${baseDomain}`;
+}
+export function createAuthGatewayClient(input) {
+    return authGatewayClientSchema.parse({
+        callbackPath: '/callback',
+        logoutPath: '/',
+        scopes: [],
+        audience: 'public',
+        ...input
+    });
+}
+/**
+ * Build the auth gateway contract for a base domain.
+ *
+ * `baseDomain` is REQUIRED and has no default. It is the root of the entire
+ * trust topology — `authOrigin`, `cookieDomain`, every client origin, and the
+ * gateway `issuer` all derive from it — so a default here is not a convenience,
+ * it is an invented trust anchor (corpus v2 class M5; this line was the M5 root).
+ * The caller knows its environment; this function must not guess it.
+ *
+ * Callers resolve it from `config/environment` and pass it in. Omitting it is a
+ * COMPILE error; the runtime throw is the belt for untyped/JS consumers.
+ */
+export function createDefaultAuthGateway(options) {
+    const baseDomain = options?.baseDomain;
+    if (!baseDomain) {
+        throw new Error('createDefaultAuthGateway: baseDomain is required — it roots the auth trust topology ' +
+            '(authOrigin, cookieDomain, client origins, issuer). Resolve it from config/environment ' +
+            'and pass it explicitly; this function will not invent one.');
+    }
+    const authOrigin = options.authOrigin ?? createOrigin('auth', baseDomain);
+    const cookieDomain = options.cookieDomain ?? `.${baseDomain}`;
+    const includeInternal = options.includeInternal ?? true;
+    const requestedClients = options.clients ? new Set(options.clients) : null;
+    const clients = DEFAULT_CLIENT_DEFINITIONS.filter((definition) => {
+        if (!includeInternal && definition.audience === 'internal') {
+            return false;
+        }
+        if (!requestedClients) {
+            return true;
+        }
+        return requestedClients.has(definition.id);
+    }).map((definition) => createAuthGatewayClient({
+        id: definition.id,
+        name: definition.name,
+        origin: createOrigin(definition.subdomain, baseDomain),
+        callbackPath: definition.callbackPath,
+        logoutPath: definition.logoutPath,
+        scopes: definition.scopes,
+        audience: definition.audience
+    }));
+    return authGatewaySchema.parse({
+        issuer: `${authOrigin}/api/session`,
+        authOrigin,
+        cookieDomain,
+        clients
+    });
+}
+//# sourceMappingURL=gateway.js.map

package/dist/client/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/client/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EAKjB,MAAM,cAAc,CAAC;AAEtB,MAAM,0BAA0B,GAA8B;IAC7D,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE;IACzF,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE;IAC/E,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE;IAC5E,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE;IACrE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE;IAC7E;QACC,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC;KAChC;IACD;QACC,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,WAAW;QACtB,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;KACjC;IACD;QACC,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC;KAC9C;IACD,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE;IAC1F;QACC,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,WAAW;QACtB,MAAM,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;KAClC;IACD,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE;IAC9F;QACC,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;KACpC;IACD;QACC,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;QAC7B,QAAQ,EAAE,UAAU;KACpB;IACD,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;IACtE;QACC,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;KAC7B;IACD;QACC,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;KACjD;IACD,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,yEAAyE;IACzE,yEAAyE;IACzE,gCAAgC;IAChC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE;CACrF,CAAC;AAEF,OAAO,EAAE,0BAA0B,EAAE,CAAC;AAEtC,SAAS,YAAY,CAAC,SAAiB,EAAE,UAAkB;IAC1D,OAAO,WAAW,SAAS,IAAI,UAAU,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,KAAsE;IAEtE,OAAO,uBAAuB,CAAC,KAAK,CAAC;QACpC,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,QAAQ;QAClB,GAAG,KAAK;KACR,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAMxC;IACA,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACd,sFAAsF;YACrF,yFAAyF;YACzF,4DAA4D,CAC7D,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,UAAU,EAAE,CAAC;IAC9D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC;IACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QAChE,IAAI,CAAC,eAAe,IAAI,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CACrB,uBAAuB,CAAC;QACvB,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC;QACtD,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;KAC7B,CAAC,CACF,CAAC;IAEF,OAAO,iBAAiB,CAAC,KAAK,CAAC;QAC9B,MAAM,EAAE,GAAG,UAAU,cAAc;QACnC,UAAU;QACV,YAAY;QACZ,OAAO;KACP,CAAC,CAAC;AACJ,CAAC"}

package/dist/client/index.d.ts

@@ -0,0 +1,18 @@
+export { bindBrowserSession, authReturnPath } from './browser-session.ts';
+export { BROWSER_SESSION_CODE_PATH, browserSessionCodeAuthorizeQuerySchema, browserSessionCodeAuthorizeUrl, browserSessionCodeChallenge, browserSessionCodeExchangeRequestSchema, browserSessionCodeExchangeResponseSchema, exchangeBrowserSessionCode, NATIVE_BROWSER_SESSION_CLIENTS, nativeBrowserSessionClientFor, nativeBrowserSessionClientSchema, pkceCodeVerifierSchema } from './browser-session-code.ts';
+export type { NativeBrowserSessionClient, BrowserSessionCodeAuthorizeQuery, BrowserSessionCodeExchangeRequest, BrowserSessionCodeExchangeResponse } from './browser-session-code.ts';
+export { buildAuthSignInUrl, createAuthClient } from './auth-client.ts';
+export type { AuthClientConfig, AuthRedirectOptions } from './auth-client.ts';
+export { createAuthAdminClient } from './admin.ts';
+export type { AuthAdminClient, AuthAdminClientOptions, AuthAdminCreateUserInput, AuthAdminCreateUserResult, AuthAdminSecurityApiKeyRecord, AuthAdminSecurityApiKeyStatus, AuthAdminSecurityApiKeysPage, AuthAdminSecurityPagination, AuthAdminSecuritySessionRecord, AuthAdminSecuritySessionStatus, AuthAdminSecuritySessionsPage, AuthAdminUserDetail, AuthAdminUserListItem, AuthAdminOperatorUserRecord, AuthAdminUserProfileRecord, AuthAdminUserRecord, AuthAdminUserRoleFilter, AuthAdminUsersPage } from './admin.ts';
+export { vibesAuthClient } from './factory.ts';
+export type { ApiClientConfig } from '@vibesdotdev/client';
+export { createDefaultAuthGateway, createAuthGatewayClient } from './gateway.ts';
+export { DEVICE_AUTHORIZATION_CLIENTS, DEVICE_AUTHORIZATION_GRANT_TYPE, DeviceAuthorizationError, exchangeDeviceSessionForAppJwt, getDeviceAuthorizationClient, getDeviceAuthorizationUser, isDeviceAuthorizationClient, pollDeviceAuthorization, requestDeviceAuthorization, revokeDeviceAuthorizationSession } from './device-authorization.ts';
+export type { DeviceAuthorizationClientId, DeviceAuthorizationCode, DeviceAuthorizationErrorCode, DeviceAuthorizationPollOptions, DeviceAuthorizationPollResult, DeviceAuthorizationRequestOptions, DeviceAuthorizationToken, DeviceAuthorizationUser } from './device-authorization.ts';
+export { authAppRoutes } from './routes.ts';
+export { authClientIdSchema, authGatewayAudienceSchema, authGatewayClientSchema, authGatewaySchema, authSessionUserSchema, authSessionSchema, authSessionStateSchema, apiKeyScopeSchema, createApiKeyInputSchema, createdApiKeySchema, apiKeyValidationResultSchema, gatewayClientDefinitionSchema } from './schemas.ts';
+export type { AuthClientId, AuthGatewayAudience, AuthGatewayClient, AuthGateway, AuthSessionUser, AuthSession, AuthSessionState, ApiKeyScope, CreateApiKeyInput, CreatedApiKey, ApiKeyValidationResult, GatewayClientDefinition } from './schemas.ts';
+export { MOBILE_AUTH_CLIENTS, MemoryMobileAuthStorageBridge, base64UrlEncode, buildMobileAuthorizeUrl, exchangeMobileAuthorizationCode, generatePkceChallenge } from './mobile-auth.ts';
+export type { BuildMobileAuthorizeUrlOptions, ExchangeMobileAuthorizationCodeOptions, MobileAuthClientId, MobileAuthStorageBridge, MobileAuthTokenResponse, PkceChallenge } from './mobile-auth.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EACN,yBAAyB,EACzB,sCAAsC,EACtC,8BAA8B,EAC9B,2BAA2B,EAC3B,uCAAuC,EACvC,wCAAwC,EACxC,0BAA0B,EAC1B,8BAA8B,EAC9B,6BAA6B,EAC7B,gCAAgC,EAChC,sBAAsB,EACtB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACX,0BAA0B,EAC1B,gCAAgC,EAChC,iCAAiC,EACjC,kCAAkC,EAClC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACxE,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACnD,YAAY,EACX,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EACN,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,gCAAgC,EAChC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACX,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,8BAA8B,EAC9B,6BAA6B,EAC7B,iCAAiC,EACjC,wBAAwB,EACxB,uBAAuB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACN,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,cAAc,CAAC;AACtB,YAAY,EACX,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,mBAAmB,EACnB,6BAA6B,EAC7B,eAAe,EACf,uBAAuB,EACvB,+BAA+B,EAC/B,qBAAqB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACX,8BAA8B,EAC9B,sCAAsC,EACtC,kBAAkB,EAClB,uBAAuB,EACvB,uBAAuB,EACvB,aAAa,EACb,MAAM,kBAAkB,CAAC"}

package/dist/client/index.js

@@ -0,0 +1,11 @@
+export { bindBrowserSession, authReturnPath } from "./browser-session.js";
+export { BROWSER_SESSION_CODE_PATH, browserSessionCodeAuthorizeQuerySchema, browserSessionCodeAuthorizeUrl, browserSessionCodeChallenge, browserSessionCodeExchangeRequestSchema, browserSessionCodeExchangeResponseSchema, exchangeBrowserSessionCode, NATIVE_BROWSER_SESSION_CLIENTS, nativeBrowserSessionClientFor, nativeBrowserSessionClientSchema, pkceCodeVerifierSchema } from "./browser-session-code.js";
+export { buildAuthSignInUrl, createAuthClient } from "./auth-client.js";
+export { createAuthAdminClient } from "./admin.js";
+export { vibesAuthClient } from "./factory.js";
+export { createDefaultAuthGateway, createAuthGatewayClient } from "./gateway.js";
+export { DEVICE_AUTHORIZATION_CLIENTS, DEVICE_AUTHORIZATION_GRANT_TYPE, DeviceAuthorizationError, exchangeDeviceSessionForAppJwt, getDeviceAuthorizationClient, getDeviceAuthorizationUser, isDeviceAuthorizationClient, pollDeviceAuthorization, requestDeviceAuthorization, revokeDeviceAuthorizationSession } from "./device-authorization.js";
+export { authAppRoutes } from "./routes.js";
+export { authClientIdSchema, authGatewayAudienceSchema, authGatewayClientSchema, authGatewaySchema, authSessionUserSchema, authSessionSchema, authSessionStateSchema, apiKeyScopeSchema, createApiKeyInputSchema, createdApiKeySchema, apiKeyValidationResultSchema, gatewayClientDefinitionSchema } from "./schemas.js";
+export { MOBILE_AUTH_CLIENTS, MemoryMobileAuthStorageBridge, base64UrlEncode, buildMobileAuthorizeUrl, exchangeMobileAuthorizationCode, generatePkceChallenge } from "./mobile-auth.js";
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EACN,yBAAyB,EACzB,sCAAsC,EACtC,8BAA8B,EAC9B,2BAA2B,EAC3B,uCAAuC,EACvC,wCAAwC,EACxC,0BAA0B,EAC1B,8BAA8B,EAC9B,6BAA6B,EAC7B,gCAAgC,EAChC,sBAAsB,EACtB,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAExE,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAqBnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EACN,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,EACxB,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,gCAAgC,EAChC,MAAM,2BAA2B,CAAC;AAWnC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACN,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,6BAA6B,EAC7B,MAAM,cAAc,CAAC;AAetB,OAAO,EACN,mBAAmB,EACnB,6BAA6B,EAC7B,eAAe,EACf,uBAAuB,EACvB,+BAA+B,EAC/B,qBAAqB,EACrB,MAAM,kBAAkB,CAAC"}

package/dist/client/mobile-auth.d.ts

@@ -0,0 +1,47 @@
+/**
+ * RFC 8252 (OAuth 2.0 for Native Apps) and RFC 7636 (PKCE) mobile client primitives.
+ *
+ * Public native mobile apps cannot securely store client secrets. All native mobile
+ * authorization flows require PKCE with code_challenge_method=S256 and custom URI
+ * schemes or HTTPS Universal/App Links.
+ *
+ * Durable credentials are NEVER written to unencrypted browser local storage; they
+ * are delegated to native OS Keychain (iOS) / Keystore (Android) via MobileAuthStorageBridge.
+ */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import { type PkceChallenge, type BuildMobileAuthorizeUrlOptions, type ExchangeMobileAuthorizationCodeOptions, type MobileAuthTokenResponse } from '../schemas/mobile-auth.ts';
+export { MOBILE_AUTH_CLIENTS } from '../schemas/mobile.config.descriptor.ts';
+export type { MobileAuthClientId, PkceChallenge, BuildMobileAuthorizeUrlOptions, ExchangeMobileAuthorizationCodeOptions, MobileAuthTokenResponse } from '../schemas/mobile-auth.ts';
+export declare function base64UrlEncode(buffer: Uint8Array): string;
+/**
+ * Generate a cryptographically random PKCE code verifier and S256 code challenge.
+ */
+export declare function generatePkceChallenge(): Promise<PkceChallenge>;
+/** Existing synchronous callers use declared defaults. Hand a runtime to load overrides. */
+export declare function buildMobileAuthorizeUrl(options: BuildMobileAuthorizeUrlOptions): string;
+export declare function buildMobileAuthorizeUrl(options: BuildMobileAuthorizeUrlOptions, runtime: RuntimeRef): Promise<string>;
+/**
+ * Exchanges the PKCE authorization code for session tokens via POST /oauth/token.
+ */
+export declare function exchangeMobileAuthorizationCode(input: ExchangeMobileAuthorizationCodeOptions, runtime?: RuntimeRef): Promise<MobileAuthTokenResponse>;
+/**
+ * Mobile secure storage bridge contract.
+ *
+ * Concrete implementations delegate to native OS Keychain (iOS) or
+ * Keystore (Android) via Tauri plugin bindings.
+ */
+export interface MobileAuthStorageBridge {
+    getSecureItem(key: string): Promise<string | null>;
+    setSecureItem(key: string, value: string): Promise<void>;
+    removeSecureItem(key: string): Promise<void>;
+}
+/**
+ * In-memory fallback bridge for tests or environments without native secure storage.
+ */
+export declare class MemoryMobileAuthStorageBridge implements MobileAuthStorageBridge {
+    private readonly store;
+    getSecureItem(key: string): Promise<string | null>;
+    setSecureItem(key: string, value: string): Promise<void>;
+    removeSecureItem(key: string): Promise<void>;
+}
+//# sourceMappingURL=mobile-auth.d.ts.map

package/dist/client/mobile-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mobile-auth.d.ts","sourceRoot":"","sources":["../../src/client/mobile-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAGiB,KAAK,aAAa,EAAE,KAAK,8BAA8B,EAC9E,KAAK,sCAAsC,EAAE,KAAK,uBAAuB,EACzE,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,YAAY,EACX,kBAAkB,EAAE,aAAa,EAAE,8BAA8B,EACjE,sCAAsC,EAAE,uBAAuB,EAC/D,MAAM,2BAA2B,CAAC;AAOnC,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAO1D;AAED;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,aAAa,CAAC,CAepE;AAED,4FAA4F;AAC5F,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,8BAA8B,GAAG,MAAM,CAAC;AACzF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,8BAA8B,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AA2CvH;;GAEG;AACH,wBAAsB,+BAA+B,CACpD,KAAK,EAAE,sCAAsC,EAC7C,OAAO,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,uBAAuB,CAAC,CAwClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnD,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED;;GAEG;AACH,qBAAa,6BAA8B,YAAW,uBAAuB;IAC5E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IAE7C,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIlD,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGlD"}