@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/client/mobile-auth.js

@@ -0,0 +1,137 @@
+/**
+ * RFC 8252 (OAuth 2.0 for Native Apps) and RFC 7636 (PKCE) mobile client primitives.
+ *
+ * Public native mobile apps cannot securely store client secrets. All native mobile
+ * authorization flows require PKCE with code_challenge_method=S256 and custom URI
+ * schemes or HTTPS Universal/App Links.
+ *
+ * Durable credentials are NEVER written to unencrypted browser local storage; they
+ * are delegated to native OS Keychain (iOS) / Keystore (Android) via MobileAuthStorageBridge.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { readJsonOrNull } from "./read-json-or-null.js";
+import { buildMobileAuthorizeUrlOptionsSchema, exchangeMobileAuthorizationCodeOptionsSchema, mobileTokenResponseSchema } from "../schemas/mobile-auth.js";
+import { MOBILE_AUTH_CLIENTS } from "../schemas/mobile.config.descriptor.js";
+export { MOBILE_AUTH_CLIENTS } from "../schemas/mobile.config.descriptor.js";
+async function mobileClients(runtime) {
+    const manifest = await runtime.query('config/manifest').withId('auth.mobile').resolve();
+    return (await manifest.load()).clients;
+}
+export function base64UrlEncode(buffer) {
+    let binary = '';
+    for (let i = 0; i < buffer.byteLength; i++) {
+        binary += String.fromCharCode(buffer[i]);
+    }
+    const base64 = btoa(binary);
+    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * Generate a cryptographically random PKCE code verifier and S256 code challenge.
+ */
+export async function generatePkceChallenge() {
+    const randomBytes = new Uint8Array(32);
+    crypto.getRandomValues(randomBytes);
+    const codeVerifier = base64UrlEncode(randomBytes);
+    const encoder = new TextEncoder();
+    const data = encoder.encode(codeVerifier);
+    const digest = await crypto.subtle.digest('SHA-256', data);
+    const codeChallenge = base64UrlEncode(new Uint8Array(digest));
+    return {
+        codeVerifier,
+        codeChallenge,
+        codeChallengeMethod: 'S256'
+    };
+}
+export function buildMobileAuthorizeUrl(options, runtime) {
+    if (runtime)
+        return mobileClients(runtime).then(clients => authorizeUrl(options, clients));
+    return authorizeUrl(options, MOBILE_AUTH_CLIENTS);
+}
+function registeredClient(options, clients) {
+    const client = Object.hasOwn(clients, options.clientId) ? clients[options.clientId] : undefined;
+    if (!client) {
+        throw new CapabilityError('The mobile client id is not registered.', 'INVALID_INPUT', {
+            reason: 'mobile-client-unknown',
+            retryable: false
+        });
+    }
+    const allowedUris = client.redirectUris;
+    if (!allowedUris.includes(options.redirectUri)) {
+        throw new CapabilityError(`Unauthorized redirect URI for ${options.clientId}.`, 'INVALID_INPUT', {
+            reason: 'mobile-redirect-uri-unauthorized',
+            retryable: false,
+            details: { clientId: options.clientId }
+        });
+    }
+    return client;
+}
+function authorizeUrl(input, clients) {
+    const options = buildMobileAuthorizeUrlOptionsSchema.parse(input);
+    const client = registeredClient(options, clients);
+    const scopes = options.scopes ?? client.scopes;
+    const url = new URL('/oauth/authorize', options.authOrigin);
+    url.searchParams.set('client_id', options.clientId);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('redirect_uri', options.redirectUri);
+    url.searchParams.set('code_challenge', options.codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('state', options.state);
+    url.searchParams.set('scope', scopes.join(' '));
+    return url.toString();
+}
+/**
+ * Exchanges the PKCE authorization code for session tokens via POST /oauth/token.
+ */
+export async function exchangeMobileAuthorizationCode(input, runtime) {
+    const options = exchangeMobileAuthorizationCodeOptionsSchema.parse(input);
+    registeredClient(options, runtime ? await mobileClients(runtime) : MOBILE_AUTH_CLIENTS);
+    const fetcher = options.fetcher ?? globalThis.fetch;
+    const url = new URL('/oauth/token', options.authOrigin);
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: options.clientId,
+        code: options.code,
+        redirect_uri: options.redirectUri,
+        code_verifier: options.codeVerifier
+    });
+    const res = await fetcher(url.toString(), {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json'
+        },
+        body: body.toString()
+    });
+    if (!res.ok) {
+        throw new CapabilityError(`Mobile PKCE token exchange failed (HTTP ${res.status}).`, res.status >= 500 ? 'UNAVAILABLE' : 'INVALID_INPUT', {
+            reason: 'mobile-token-exchange-failed',
+            retryable: false,
+            details: { status: res.status }
+        });
+    }
+    const token = mobileTokenResponseSchema.safeParse(await readJsonOrNull(res));
+    if (!token.success) {
+        throw new CapabilityError('The mobile token exchange answered with a body this client does not accept.', 'INTERNAL', {
+            reason: 'mobile-token-response-invalid',
+            retryable: false,
+            cause: token.error
+        });
+    }
+    return token.data;
+}
+/**
+ * In-memory fallback bridge for tests or environments without native secure storage.
+ */
+export class MemoryMobileAuthStorageBridge {
+    store = new Map();
+    async getSecureItem(key) {
+        return this.store.get(key) ?? null;
+    }
+    async setSecureItem(key, value) {
+        this.store.set(key, value);
+    }
+    async removeSecureItem(key) {
+        this.store.delete(key);
+    }
+}
+//# sourceMappingURL=mobile-auth.js.map

package/dist/client/mobile-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mobile-auth.js","sourceRoot":"","sources":["../../src/client/mobile-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAGxD,OAAO,EACN,oCAAoC,EACpC,4CAA4C,EAAE,yBAAyB,EAGvE,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAM7E,KAAK,UAAU,aAAa,CAAC,OAAmB;IAC/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAA+C,iBAAiB,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC;IACtI,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAkB;IACjD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAC,CAAC,GAAG,MAAM,CAAC,UAAU,EAAC,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IAC1C,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9D,OAAO;QACN,YAAY;QACZ,aAAa;QACb,mBAAmB,EAAE,MAAM;KAC3B,CAAC;AACH,CAAC;AAKD,MAAM,UAAU,uBAAuB,CAAC,OAAuC,EAAE,OAAoB;IACpG,IAAI,OAAO;QAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3F,OAAO,YAAY,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAyE,EAAE,OAAoC;IACxI,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,yCAAyC,EAAE,eAAe,EAAE;YACrF,MAAM,EAAE,uBAAuB;YAC/B,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAsB,MAAM,CAAC,YAAY,CAAC;IAC3D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,iCAAiC,OAAO,CAAC,QAAQ,GAAG,EAAE,eAAe,EAAE;YAChG,MAAM,EAAE,kCAAkC;YAC1C,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;SACvC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAqC,EAAE,OAAoC;IAChG,MAAM,OAAO,GAAG,oCAAoC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,KAA6C,EAC7C,OAAoB;IAEpB,MAAM,OAAO,GAAG,4CAA4C,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1E,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAExD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,aAAa,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;QACzC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,mCAAmC;YACnD,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACrB,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,2CAA2C,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,EAAE;YACzI,MAAM,EAAE,8BAA8B;YACtC,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;SAC/B,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,yBAAyB,CAAC,SAAS,CAAC,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,6EAA6E,EAAE,UAAU,EAAE;YACpH,MAAM,EAAE,+BAA+B;YACvC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC;AACnB,CAAC;AAcD;;GAEG;AACH,MAAM,OAAO,6BAA6B;IACxB,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEnD,KAAK,CAAC,aAAa,CAAC,GAAW;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,KAAa;QAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,GAAW;QACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;CACD"}

package/dist/client/provider-compat.d.ts

@@ -0,0 +1,24 @@
+import { type KindContext, type RuntimeDescriptor } from '@vibesdotdev/kernel';
+import { type AuthProviderDescriptor, type AuthProviderImplementation } from '../schemas/provider.ts';
+/** @deprecated Resolve auth/provider through the handed runtime. */
+export declare class DefaultAuthProvider implements AuthProviderImplementation {
+    private readonly context;
+    readonly descriptor: AuthProviderDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
+    get type(): "api" | "db";
+    private provider;
+    isAvailable(): Promise<boolean>;
+    getAuthContext(): Promise<{
+        isAuthenticated: boolean;
+        userId?: string | undefined;
+        token?: string | undefined;
+        headers?: Record<string, string> | undefined;
+        error?: string | undefined;
+    }>;
+    validateCredentials(): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    dispose(): Promise<void>;
+}
+//# sourceMappingURL=provider-compat.d.ts.map

package/dist/client/provider-compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-compat.d.ts","sourceRoot":"","sources":["../../src/client/provider-compat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAgC,KAAK,sBAAsB,EAAE,KAAK,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpI,oEAAoE;AACpE,qBAAa,mBAAoB,YAAW,0BAA0B;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IADnE,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;gBAChC,UAAU,EAAE,iBAAiB,EAAmB,OAAO,EAAE,WAAW;IAGhF,IAAI,IAAI,iBAAmC;YAC7B,QAAQ;IAKhB,WAAW;IACX,cAAc;;;;;;;IACd,mBAAmB;;;;IACnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAC9B"}

package/dist/client/provider-compat.js

@@ -0,0 +1,23 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { AuthProviderDescriptorSchema } from "../schemas/provider.js";
+/** @deprecated Resolve auth/provider through the handed runtime. */
+export class DefaultAuthProvider {
+    context;
+    descriptor;
+    constructor(descriptor, context) {
+        this.context = context;
+        this.descriptor = AuthProviderDescriptorSchema.parse(descriptor);
+    }
+    get type() { return this.descriptor.type; }
+    async provider() {
+        const provider = await this.context.runtime.query('auth/provider').withId(this.descriptor.id).resolve();
+        if (!provider)
+            throw new CapabilityError('Auth provider is not registered.', 'NOT_FOUND', { reason: 'auth-provider-unregistered' });
+        return provider;
+    }
+    async isAvailable() { return (await this.provider()).isAvailable(); }
+    async getAuthContext() { return (await this.provider()).getAuthContext(); }
+    async validateCredentials() { return (await this.provider()).validateCredentials(); }
+    async dispose() { }
+}
+//# sourceMappingURL=provider-compat.js.map

package/dist/client/provider-compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-compat.js","sourceRoot":"","sources":["../../src/client/provider-compat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA4C,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAgE,MAAM,wBAAwB,CAAC;AAEpI,oEAAoE;AACpE,MAAM,OAAO,mBAAmB;IAE6B;IADnD,UAAU,CAAyB;IAC5C,YAAY,UAA6B,EAAmB,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;QAC/E,IAAI,CAAC,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,KAAK,CAAC,QAAQ;QACrB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAqD,eAAe,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5J,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACpI,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,cAAc,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC3E,KAAK,CAAC,mBAAmB,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACrF,KAAK,CAAC,OAAO,KAA6E,CAAC;CAC3F"}

package/dist/client/read-json-or-null.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Read a response body as JSON, reporting a body that is not JSON as `null`.
+ *
+ * A non-JSON body is an expected shape (an HTML error page, an empty 204), not
+ * a failure, so callers treat `null` as "no structured payload" and apply their
+ * own typed handling. Network and status failures are not read here: only the
+ * JSON parser's `SyntaxError` is that absence, and any other failure is thrown.
+ */
+import * as z from 'zod/v4';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+declare const jsonValueSchema: z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>;
+export type ResponseJson = z.infer<typeof jsonValueSchema> | null;
+export declare function readJsonOrNull(response: Response): Promise<ResponseJson>;
+/**
+ * Read the body of an already-failed response for its error message.
+ *
+ * The status is what the caller reports; the body only enriches the message, so
+ * an unreadable body yields `''` (and a debug log naming the failure by class)
+ * rather than masking the HTTP failure.
+ */
+export declare function readErrorBodyText(response: Response, runtime: RuntimeRef): Promise<string>;
+export {};
+//# sourceMappingURL=read-json-or-null.d.ts.map

package/dist/client/read-json-or-null.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-json-or-null.d.ts","sourceRoot":"","sources":["../../src/client/read-json-or-null.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAKxE,QAAA,MAAM,eAAe,iPAAkB,CAAC;AAExC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,GAAG,IAAI,CAAC;AAElE,wBAAsB,cAAc,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,CAQ9E;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAKhG"}

package/dist/client/read-json-or-null.js

@@ -0,0 +1,39 @@
+/**
+ * Read a response body as JSON, reporting a body that is not JSON as `null`.
+ *
+ * A non-JSON body is an expected shape (an HTML error page, an empty 204), not
+ * a failure, so callers treat `null` as "no structured payload" and apply their
+ * own typed handling. Network and status failures are not read here: only the
+ * JSON parser's `SyntaxError` is that absence, and any other failure is thrown.
+ */
+import * as z from 'zod/v4';
+import { valueFreeFailure } from '@vibesdotdev/kernel';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { getLogger } from '@vibesdotdev/logging';
+import { attempt, failureLabel, rethrowFailure } from "../features/utils/attempt.js";
+const jsonValueSchema = JsonValueSchema;
+export async function readJsonOrNull(response) {
+    const read = await attempt(() => response.json());
+    if (read.ok) {
+        const json = jsonValueSchema.safeParse(read.value);
+        return json.success ? json.data : null;
+    }
+    if (valueFreeFailure(read.failure).name === 'SyntaxError')
+        return null;
+    return rethrowFailure(read.failure);
+}
+/**
+ * Read the body of an already-failed response for its error message.
+ *
+ * The status is what the caller reports; the body only enriches the message, so
+ * an unreadable body yields `''` (and a debug log naming the failure by class)
+ * rather than masking the HTTP failure.
+ */
+export async function readErrorBodyText(response, runtime) {
+    const read = await attempt(() => response.text());
+    if (read.ok)
+        return read.value;
+    getLogger('auth.client.response', runtime).debug('could not read the body of a failed response', { failure: failureLabel(read.failure) });
+    return '';
+}
+//# sourceMappingURL=read-json-or-null.js.map

package/dist/client/read-json-or-null.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-json-or-null.js","sourceRoot":"","sources":["../../src/client/read-json-or-null.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAmB,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAErF,MAAM,eAAe,GAAG,eAAe,CAAC;AAIxC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAkB;IACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,OAAmB;IAC9E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC/B,SAAS,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1I,OAAO,EAAE,CAAC;AACX,CAAC"}

package/dist/client/request-failure.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Read a failed auth request without its credential.
+ *
+ * `@vibesdotdev/client` errors carry the request, whose headers hold the
+ * bearer, so only the status and the message are ever read. For a non-JSON
+ * error the message is the whole response body, and a proxy's HTML error page
+ * arrives that way, so `failureMessage` folds it to one short line before it
+ * reaches a log, an audit record or the user.
+ *
+ * Each reader takes a caught failure (`CaughtFailure`), never the raw `catch`
+ * binding: capture it once with `attempt`.
+ */
+import type { CaughtFailure } from '@vibesdotdev/kernel';
+/** The failure's text: an `Error`'s message, or the description of a non-Error that was thrown. */
+export declare function failureText(failure: CaughtFailure): string;
+/** The HTTP status a failed request itself carries (on the error, or on the response it holds), if any. */
+export declare function carriedStatus(failure: CaughtFailure): number | undefined;
+/** The HTTP status a failed request carries, wherever the client put it; failing that, one named in its text. */
+export declare function errorStatus(failure: CaughtFailure): number | undefined;
+/** True when the request never got an HTTP answer: DNS, connect, TLS, timeout. */
+export declare function isTransportFailure(failure: CaughtFailure): boolean;
+/**
+ * The failure's message on one line, at most 200 characters including the
+ * truncation ellipsis. Callers add HTTP status and contextual guidance outside
+ * this excerpt. Read no request or headers: those can hold the credential.
+ */
+export declare function failureMessage(failure: CaughtFailure): string;
+//# sourceMappingURL=request-failure.d.ts.map

package/dist/client/request-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-failure.d.ts","sourceRoot":"","sources":["../../src/client/request-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWzD,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAE1D;AAED,2GAA2G;AAC3G,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAKxE;AAED,iHAAiH;AACjH,wBAAgB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,CAOtE;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAqBlE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAM7D"}

package/dist/client/request-failure.js

@@ -0,0 +1,80 @@
+/**
+ * Read a failed auth request without its credential.
+ *
+ * `@vibesdotdev/client` errors carry the request, whose headers hold the
+ * bearer, so only the status and the message are ever read. For a non-JSON
+ * error the message is the whole response body, and a proxy's HTML error page
+ * arrives that way, so `failureMessage` folds it to one short line before it
+ * reaches a log, an audit record or the user.
+ *
+ * Each reader takes a caught failure (`CaughtFailure`), never the raw `catch`
+ * binding: capture it once with `attempt`.
+ */
+import * as z from 'zod/v4';
+const FAILURE_MESSAGE_LIMIT = 200;
+/** Where a failed request carries its HTTP status: on the error, or on the response it holds. */
+const statusCarrierSchema = z.looseObject({
+    status: z.number().optional(),
+    statusCode: z.number().optional(),
+    response: z.looseObject({ status: z.number().optional() }).optional()
+});
+/** The failure's text: an `Error`'s message, or the description of a non-Error that was thrown. */
+export function failureText(failure) {
+    return failure instanceof Error ? failure.message : failure.description;
+}
+/** The HTTP status a failed request itself carries (on the error, or on the response it holds), if any. */
+export function carriedStatus(failure) {
+    // An `Error` carries its status itself; a thrown non-Error carries it on the value that was thrown.
+    const carrier = statusCarrierSchema.safeParse(failure instanceof Error ? failure : failure.value);
+    if (!carrier.success)
+        return undefined;
+    return carrier.data.status ?? carrier.data.statusCode ?? carrier.data.response?.status;
+}
+/** The HTTP status a failed request carries, wherever the client put it; failing that, one named in its text. */
+export function errorStatus(failure) {
+    const carried = carriedStatus(failure);
+    // The client uses zero for a transport failure: no HTTP response arrived.
+    if (carried === 0)
+        return undefined;
+    if (carried !== undefined)
+        return carried;
+    const match = failureText(failure).match(/\b(401|403|404|408|429|5\d{2})\b/);
+    return match ? Number(match[1]) : undefined;
+}
+/** True when the request never got an HTTP answer: DNS, connect, TLS, timeout. */
+export function isTransportFailure(failure) {
+    if (carriedStatus(failure) === 0)
+        return true;
+    if (errorStatus(failure) !== undefined)
+        return false;
+    const msg = failureText(failure).toLowerCase();
+    return (msg.includes('econnrefused') ||
+        msg.includes('enotfound') ||
+        msg.includes('etimedout') ||
+        msg.includes('econnreset') ||
+        msg.includes('fetch failed') ||
+        msg.includes('failed to fetch') ||
+        msg.includes('network') ||
+        msg.includes('socket') ||
+        msg.includes('dns') ||
+        msg.includes('timeout') ||
+        msg.includes('certificate') ||
+        msg.includes('ssl') ||
+        msg.includes('tls') ||
+        msg.includes('unable to connect') ||
+        msg.includes('origin unresolved'));
+}
+/**
+ * The failure's message on one line, at most 200 characters including the
+ * truncation ellipsis. Callers add HTTP status and contextual guidance outside
+ * this excerpt. Read no request or headers: those can hold the credential.
+ */
+export function failureMessage(failure) {
+    const message = failureText(failure).replace(/\s+/g, ' ').trim();
+    if (!message)
+        return 'no detail given';
+    return message.length > FAILURE_MESSAGE_LIMIT
+        ? `${message.slice(0, FAILURE_MESSAGE_LIMIT - 1)}…`
+        : message;
+}
+//# sourceMappingURL=request-failure.js.map

package/dist/client/request-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-failure.js","sourceRoot":"","sources":["../../src/client/request-failure.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,iGAAiG;AACjG,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrE,CAAC,CAAC;AAEH,mGAAmG;AACnG,MAAM,UAAU,WAAW,CAAC,OAAsB;IACjD,OAAO,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;AACzE,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,aAAa,CAAC,OAAsB;IACnD,oGAAoG;IACpG,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClG,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACvC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;AACxF,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,WAAW,CAAC,OAAsB;IACjD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,0EAA0E;IAC1E,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,OAAsB;IACxD,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,CACN,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC1B,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC3B,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CACjC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAsB;IACpD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,IAAI,CAAC,OAAO;QAAE,OAAO,iBAAiB,CAAC;IACvC,OAAO,OAAO,CAAC,MAAM,GAAG,qBAAqB;QAC5C,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,GAAG,CAAC,CAAC,GAAG;QACnD,CAAC,CAAC,OAAO,CAAC;AACZ,CAAC"}

package/dist/client/routes.d.ts

@@ -0,0 +1,29 @@
+export declare const authAppRoutes: {
+    readonly home: "/";
+    readonly signIn: "/";
+    readonly signUp: "/register";
+    readonly email: "/email";
+    readonly register: "/register";
+    readonly verify: "/verify";
+    readonly forgotPassword: "/forgot-password";
+    readonly resetPassword: "/reset-password";
+    readonly phone: "/phone";
+    readonly magicLink: "/magic-link";
+    readonly cli: "/cli";
+    readonly external: "/external";
+    readonly connect: "/connect";
+    readonly success: "/success";
+    readonly error: "/error";
+    readonly recovery: "/recovery";
+    readonly signout: "/signout";
+    readonly banned: "/banned";
+    readonly suspended: "/suspended";
+    readonly restricted: "/restricted";
+    readonly maintenance: "/maintenance";
+    readonly gateway: "/gateway";
+    readonly apiGateway: "/api/gateway";
+    readonly apiHealth: "/api/health";
+    readonly apiSession: "/api/session";
+    readonly apiSessionCode: "/api/session/code";
+};
+//# sourceMappingURL=routes.d.ts.map

package/dist/client/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/client/routes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BhB,CAAC"}

package/dist/client/routes.js

@@ -0,0 +1,29 @@
+export const authAppRoutes = {
+    home: '/',
+    signIn: '/',
+    signUp: '/register',
+    email: '/email',
+    register: '/register',
+    verify: '/verify',
+    forgotPassword: '/forgot-password',
+    resetPassword: '/reset-password',
+    phone: '/phone',
+    magicLink: '/magic-link',
+    cli: '/cli',
+    external: '/external',
+    connect: '/connect',
+    success: '/success',
+    error: '/error',
+    recovery: '/recovery',
+    signout: '/signout',
+    banned: '/banned',
+    suspended: '/suspended',
+    restricted: '/restricted',
+    maintenance: '/maintenance',
+    gateway: '/gateway',
+    apiGateway: '/api/gateway',
+    apiHealth: '/api/health',
+    apiSession: '/api/session',
+    apiSessionCode: '/api/session/code'
+};
+//# sourceMappingURL=routes.js.map

package/dist/client/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/client/routes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG;IAC5B,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,SAAS;IACjB,cAAc,EAAE,kBAAkB;IAClC,aAAa,EAAE,iBAAiB;IAChC,KAAK,EAAE,QAAQ;IACf,SAAS,EAAE,aAAa;IACxB,GAAG,EAAE,MAAM;IACX,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,UAAU;IACnB,OAAO,EAAE,UAAU;IACnB,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,YAAY;IACvB,UAAU,EAAE,aAAa;IACzB,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,aAAa;IACxB,UAAU,EAAE,cAAc;IAC1B,cAAc,EAAE,mBAAmB;CAC1B,CAAC"}

package/dist/client/schemas.d.ts

@@ -0,0 +1,3 @@
+export { authClientIdSchema, authGatewayAudienceSchema, authGatewayClientSchema, authGatewaySchema, authSessionUserSchema, authSessionSchema, authSessionStateSchema, apiKeyScopeSchema, createApiKeyInputSchema, createdApiKeySchema, apiKeyValidationResultSchema, gatewayClientDefinitionSchema, authClientConfigSchema, authRedirectOptionsSchema } from '../schemas/api/client.ts';
+export type { AuthClientId, AuthGatewayAudience, AuthGatewayClient, AuthGateway, AuthSessionUser, AuthSession, AuthSessionState, ApiKeyScope, CreateApiKeyInput, CreatedApiKey, ApiKeyValidationResult, GatewayClientDefinition, AuthClientConfig, AuthRedirectOptions } from '../schemas/api/client.ts';
+//# sourceMappingURL=schemas.d.ts.map

package/dist/client/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/client/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,0BAA0B,CAAC"}

package/dist/client/schemas.js

@@ -0,0 +1,2 @@
+export { authClientIdSchema, authGatewayAudienceSchema, authGatewayClientSchema, authGatewaySchema, authSessionUserSchema, authSessionSchema, authSessionStateSchema, apiKeyScopeSchema, createApiKeyInputSchema, createdApiKeySchema, apiKeyValidationResultSchema, gatewayClientDefinitionSchema, authClientConfigSchema, authRedirectOptionsSchema } from "../schemas/api/client.js";
+//# sourceMappingURL=schemas.js.map

package/dist/client/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/client/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,MAAM,0BAA0B,CAAC"}

package/dist/client/session-authorization.d.ts

@@ -0,0 +1,17 @@
+/**
+ * How a CLI presents a stored device session to auth-web.
+ *
+ * The RFC 8628 token endpoint hands the CLI the raw better-auth session token
+ * with `token_type: "Bearer"`. auth-web's better-auth `bearer()` plugin signs
+ * that raw token on the server and turns it into the session cookie. The same
+ * token sent as a cookie never authenticates, under either cookie name:
+ * better-auth reads the session cookie only when its value carries the
+ * server's HMAC signature, and only the server holds the key to make one. So
+ * there is exactly one header to send, and no second form worth a retry.
+ *
+ * No imports, so the thin `vibes` shim can mirror this file byte for byte.
+ */
+export declare function sessionAuthorizationHeader(sessionToken: string): {
+    Authorization: string;
+};
+//# sourceMappingURL=session-authorization.d.ts.map

package/dist/client/session-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-authorization.d.ts","sourceRoot":"","sources":["../../src/client/session-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,MAAM;;EAE9D"}

package/dist/client/session-authorization.js

@@ -0,0 +1,17 @@
+/**
+ * How a CLI presents a stored device session to auth-web.
+ *
+ * The RFC 8628 token endpoint hands the CLI the raw better-auth session token
+ * with `token_type: "Bearer"`. auth-web's better-auth `bearer()` plugin signs
+ * that raw token on the server and turns it into the session cookie. The same
+ * token sent as a cookie never authenticates, under either cookie name:
+ * better-auth reads the session cookie only when its value carries the
+ * server's HMAC signature, and only the server holds the key to make one. So
+ * there is exactly one header to send, and no second form worth a retry.
+ *
+ * No imports, so the thin `vibes` shim can mirror this file byte for byte.
+ */
+export function sessionAuthorizationHeader(sessionToken) {
+    return { Authorization: `Bearer ${sessionToken}` };
+}
+//# sourceMappingURL=session-authorization.js.map

package/dist/client/session-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-authorization.js","sourceRoot":"","sources":["../../src/client/session-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,YAAoB;IAC9D,OAAO,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,CAAC;AACpD,CAAC"}

package/dist/client/session-identity.d.ts

@@ -0,0 +1,25 @@
+/**
+ * What better-auth's `GET /api/auth/get-session` says about a session.
+ *
+ * For a session it knows, auth-web answers `{ session, user }`. For one it
+ * does not know, it answers HTTP 200 with a JSON `null`: that null is auth's
+ * own verdict that the session is not valid. Any other body is not this
+ * route's contract (a proxy page, a wrong origin), so it says nothing about
+ * the session either way.
+ */
+export declare const GET_SESSION_PATH = "/api/auth/get-session";
+export interface SessionUser {
+    userId: string;
+    email: string;
+    name: string | null;
+}
+export type GetSessionAnswer = {
+    readonly kind: 'known';
+    readonly user: SessionUser;
+} | {
+    readonly kind: 'unknown-session';
+} | {
+    readonly kind: 'unreadable';
+};
+export declare function readGetSessionAnswer(body: unknown): GetSessionAnswer;
+//# sourceMappingURL=session-identity.d.ts.map

package/dist/client/session-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-identity.d.ts","sourceRoot":"","sources":["../../src/client/session-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,eAAO,MAAM,gBAAgB,0BAA0B,CAAC;AAUxD,MAAM,WAAW,WAAW;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,MAAM,gBAAgB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAInC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAMpE"}

package/dist/client/session-identity.js

@@ -0,0 +1,29 @@
+/**
+ * What better-auth's `GET /api/auth/get-session` says about a session.
+ *
+ * For a session it knows, auth-web answers `{ session, user }`. For one it
+ * does not know, it answers HTTP 200 with a JSON `null`: that null is auth's
+ * own verdict that the session is not valid. Any other body is not this
+ * route's contract (a proxy page, a wrong origin), so it says nothing about
+ * the session either way.
+ */
+import * as z from 'zod/v4';
+export const GET_SESSION_PATH = '/api/auth/get-session';
+const knownSessionSchema = z.object({
+    user: z.object({
+        id: z.string().min(1),
+        email: z.string().min(1),
+        name: z.string().nullish()
+    })
+});
+const sessionAnswerSchema = z.union([z.null(), knownSessionSchema]);
+export function readGetSessionAnswer(body) {
+    const parsed = sessionAnswerSchema.safeParse(body);
+    if (!parsed.success)
+        return { kind: 'unreadable' };
+    if (parsed.data === null)
+        return { kind: 'unknown-session' };
+    const { id, email, name } = parsed.data.user;
+    return { kind: 'known', user: { userId: id, email, name: name ?? null } };
+}
+//# sourceMappingURL=session-identity.js.map

package/dist/client/session-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-identity.js","sourceRoot":"","sources":["../../src/client/session-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAExD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;KAC1B,CAAC;CACF,CAAC,CAAC;AAaH,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEpE,MAAM,UAAU,oBAAoB,CAAC,IAAa;IACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC7D,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;AAC3E,CAAC"}

package/dist/config/auth.app-credentials.config.descriptor.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Auth app credentials — config/manifest descriptor.
+ *
+ * Names the runtime credentials holding this app's own Auth client id and
+ * secret, for app-to-Auth calls. See `schemas/app-credentials.ts`.
+ */
+import type { ConfigManifestDescriptor } from '@vibesdotdev/config/schemas/config-manifest-descriptor';
+declare const descriptor: ConfigManifestDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.app-credentials.config.descriptor.d.ts.map

package/dist/config/auth.app-credentials.config.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.app-credentials.config.descriptor.d.ts","sourceRoot":"","sources":["../../src/config/auth.app-credentials.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAMvG,QAAA,MAAM,UAAU,EAAE,wBAqBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}