@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/config/auth.app-credentials.config.descriptor.js

@@ -0,0 +1,25 @@
+import { AUTH_APP_CREDENTIALS_MANIFEST_ID, AuthAppCredentialsConfigSchema } from "../schemas/app-credentials.js";
+const descriptor = {
+    kind: 'config/manifest',
+    id: AUTH_APP_CREDENTIALS_MANIFEST_ID,
+    name: 'Auth App Credentials',
+    description: "Credential references for this app's own Auth client id and secret (app-to-Auth calls).",
+    namespace: AUTH_APP_CREDENTIALS_MANIFEST_ID,
+    schema: AuthAppCredentialsConfigSchema,
+    allowedAdapters: ['config/vibes'],
+    defaultAdapter: 'config/vibes',
+    storedLayer: 'none',
+    scope: 'global',
+    version: 1,
+    tier: 'system',
+    category: 'auth',
+    internal: false,
+    customTables: false,
+    fields: {
+        clientId: { ui: { label: 'Client id credential' } },
+        clientSecret: { ui: { label: 'Client secret credential' } }
+    },
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth.app-credentials.config.descriptor.js.map

package/dist/config/auth.app-credentials.config.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.app-credentials.config.descriptor.js","sourceRoot":"","sources":["../../src/config/auth.app-credentials.config.descriptor.ts"],"names":[],"mappings":"AAOA,OAAO,EACN,gCAAgC,EAChC,8BAA8B,EAC9B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,UAAU,GAA6B;IAC5C,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,gCAAgC;IACpC,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,yFAAyF;IACtG,SAAS,EAAE,gCAAgC;IAC3C,MAAM,EAAE,8BAA8B;IACtC,eAAe,EAAE,CAAC,cAAc,CAAC;IACjC,cAAc,EAAE,cAAc;IAC9B,WAAW,EAAE,MAAM;IACnB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE;QACP,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE;QACnD,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE;KAC3D;IACD,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/config/auth.providers.config.descriptor.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Auth Providers — config/manifest descriptor
+ *
+ * Makes the auth.providers config manifest discoverable by the runtime.
+ * Stores overrides for builtin providers (displayName, icon, scopes).
+ *
+ * Usage in vibes.config.ts:
+ * ```ts
+ * export default defineConfig({
+ *   auth: {
+ *     providers: {
+ *       overrides: {
+ *         microsoft: {
+ *           displayName: 'Microsoft Entra',
+ *           icon: 'microsoft-entra'
+ *         }
+ *       }
+ *     }
+ *   }
+ * });
+ * ```
+ */
+import type { ConfigManifestDescriptor } from '@vibesdotdev/config/schemas/config-manifest-descriptor';
+declare const descriptor: ConfigManifestDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.providers.config.descriptor.d.ts.map

package/dist/config/auth.providers.config.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.providers.config.descriptor.d.ts","sourceRoot":"","sources":["../../src/config/auth.providers.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAGvG,QAAA,MAAM,UAAU,EAAE,wBA6BjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/config/auth.providers.config.descriptor.js

@@ -0,0 +1,51 @@
+/**
+ * Auth Providers — config/manifest descriptor
+ *
+ * Makes the auth.providers config manifest discoverable by the runtime.
+ * Stores overrides for builtin providers (displayName, icon, scopes).
+ *
+ * Usage in vibes.config.ts:
+ * ```ts
+ * export default defineConfig({
+ *   auth: {
+ *     providers: {
+ *       overrides: {
+ *         microsoft: {
+ *           displayName: 'Microsoft Entra',
+ *           icon: 'microsoft-entra'
+ *         }
+ *       }
+ *     }
+ *   }
+ * });
+ * ```
+ */
+import { AuthProvidersConfigSchema } from "../schemas/auth-provider.js";
+const descriptor = {
+    kind: 'config/manifest',
+    id: 'auth.providers',
+    name: 'Auth Providers',
+    description: 'Auth provider overrides and customizations',
+    namespace: 'auth.providers',
+    schema: AuthProvidersConfigSchema,
+    dataType: 'records',
+    allowedAdapters: ['config/vibes'],
+    defaultAdapter: 'config/vibes',
+    scope: 'global',
+    customTables: false,
+    version: 1,
+    internal: false,
+    tier: 'system',
+    category: 'auth',
+    fields: {
+        overrides: {
+            ui: { label: 'Provider Overrides' }
+        },
+        custom: {
+            ui: { label: 'Custom Providers' }
+        }
+    },
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth.providers.config.descriptor.js.map

package/dist/config/auth.providers.config.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.providers.config.descriptor.js","sourceRoot":"","sources":["../../src/config/auth.providers.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAExE,MAAM,UAAU,GAA6B;IAC5C,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,4CAA4C;IAEzD,SAAS,EAAE,gBAAgB;IAC3B,MAAM,EAAE,yBAAyB;IACjC,QAAQ,EAAE,SAAS;IACnB,eAAe,EAAE,CAAC,cAAc,CAAC;IACjC,cAAc,EAAE,cAAc;IAC9B,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,KAAK;IAEf,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,MAAM;IAEhB,MAAM,EAAE;QACP,SAAS,EAAE;YACV,EAAE,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE;SACnC;QACD,MAAM,EAAE;YACP,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE;SACjC;KACD;IAED,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/config/auth.providers.storage.descriptor.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Auth Providers — storage/manifest descriptor
+ *
+ * Storage manifest for custom OIDC/SAML providers.
+ * Custom providers are stored in the auth-web app's database and exposed
+ * via cloud-api adapter for cross-app consumption.
+ *
+ * Data flow:
+ * 1. Custom providers stored in auth-web DB (ownerApp: 'auth' — environment apps map key)
+ * 2. auth-web exposes /api/auth/providers CRUD endpoint
+ * 3. Other apps consume via storage.cloud-api adapter
+ * 4. Resolver merges builtin + custom providers
+ */
+import type { StorageManifestDescriptor } from '@vibesdotdev/storage';
+declare const descriptor: StorageManifestDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.providers.storage.descriptor.d.ts.map

package/dist/config/auth.providers.storage.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.providers.storage.descriptor.d.ts","sourceRoot":"","sources":["../../src/config/auth.providers.storage.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AActE,QAAA,MAAM,UAAU,EAAE,yBA6BjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/config/auth.providers.storage.descriptor.js

@@ -0,0 +1,54 @@
+/**
+ * Auth Providers — storage/manifest descriptor
+ *
+ * Storage manifest for custom OIDC/SAML providers.
+ * Custom providers are stored in the auth-web app's database and exposed
+ * via cloud-api adapter for cross-app consumption.
+ *
+ * Data flow:
+ * 1. Custom providers stored in auth-web DB (ownerApp: 'auth' — environment apps map key)
+ * 2. auth-web exposes /api/auth/providers CRUD endpoint
+ * 3. Other apps consume via storage.cloud-api adapter
+ * 4. Resolver merges builtin + custom providers
+ */
+import * as z from 'zod/v4';
+import { CustomAuthProviderSchema } from "../schemas/auth-provider.js";
+/**
+ * Storage schema: array of custom provider records
+ */
+const CustomProvidersStorageSchema = z.array(CustomAuthProviderSchema);
+/**
+ * Sensitive fields that should be encrypted in storage
+ */
+const SENSITIVE_FIELDS = ['config.issuer', 'config.authorizationEndpoint', 'config.tokenEndpoint', 'clientId'];
+const descriptor = {
+    kind: 'storage/manifest',
+    id: 'auth.custom-providers',
+    name: 'Custom Auth Providers',
+    description: 'Custom OIDC/SAML provider configurations',
+    namespace: 'auth.custom-providers',
+    schema: CustomProvidersStorageSchema,
+    dataType: 'objects',
+    idField: 'id',
+    allowedAdapters: ['storage.drizzle', 'storage.cloud-api'],
+    defaultAdapter: 'storage.drizzle',
+    adapterConfig: {
+        'storage.drizzle': {
+            tableName: 'auth_custom_providers'
+        },
+        'storage.cloud-api': {
+            ownerApp: 'auth',
+            endpoint: '/api/auth/providers',
+            idField: 'id'
+        }
+    },
+    scope: 'global',
+    sensitiveFields: SENSITIVE_FIELDS,
+    version: 1,
+    customTables: true,
+    internal: false,
+    enabled: true,
+    tags: ['auth', 'providers', 'oidc', 'saml', 'custom']
+};
+export default descriptor;
+//# sourceMappingURL=auth.providers.storage.descriptor.js.map

package/dist/config/auth.providers.storage.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.providers.storage.descriptor.js","sourceRoot":"","sources":["../../src/config/auth.providers.storage.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAEvE;;GAEG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAEvE;;GAEG;AACH,MAAM,gBAAgB,GAAG,CAAC,eAAe,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,UAAU,CAAC,CAAC;AAE/G,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,kBAAkB;IACxB,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,0CAA0C;IAEvD,SAAS,EAAE,uBAAuB;IAClC,MAAM,EAAE,4BAA4B;IACpC,QAAQ,EAAE,SAAS;IACnB,OAAO,EAAE,IAAI;IACb,eAAe,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;IACzD,cAAc,EAAE,iBAAiB;IACjC,aAAa,EAAE;QACd,iBAAiB,EAAE;YAClB,SAAS,EAAE,uBAAuB;SAClC;QACD,mBAAmB,EAAE;YACpB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,qBAAqB;YAC/B,OAAO,EAAE,IAAI;SACb;KACD;IACD,KAAK,EAAE,QAAQ;IACf,eAAe,EAAE,gBAAgB;IACjC,OAAO,EAAE,CAAC;IACV,YAAY,EAAE,IAAI;IAClB,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;CACrD,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/config/env.d.ts

@@ -0,0 +1,6 @@
+/** Auth origins are declared services on the caller's runtime. */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+export type AuthEnvRuntime = RuntimeRef;
+/** Explicit API descriptor baseUrl overrides are handled by the client owner. */
+export declare function resolveAuthOrigin(runtime: AuthEnvRuntime): Promise<string>;
+//# sourceMappingURL=env.d.ts.map

package/dist/config/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC;AAExC,iFAAiF;AACjF,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhF"}

package/dist/config/env.js

@@ -0,0 +1,6 @@
+import { resolveAuthApiBaseUrl } from "../features/config/auth-api.js";
+/** Explicit API descriptor baseUrl overrides are handled by the client owner. */
+export async function resolveAuthOrigin(runtime) {
+    return resolveAuthApiBaseUrl(runtime);
+}
+//# sourceMappingURL=env.js.map

package/dist/config/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/config/env.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAIvE,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAuB;IAC9D,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC"}

package/dist/config/local-auth-origin.d.ts

@@ -0,0 +1,6 @@
+export declare const VIBES_LOCAL_AUTH_ORIGIN = "https://auth.vibes.local";
+export declare const VIBES_LOCAL_AUTH_SERVICE_ORIGIN = "http://127.0.0.1:8420";
+export declare function isLocalAuthOrigin(authOrigin: string): boolean;
+export declare function resolveLocalAuthOrigin(authOrigin: string): string;
+export declare function resolveLocalAuthUrl(rawUrl: string): string;
+//# sourceMappingURL=local-auth-origin.d.ts.map

package/dist/config/local-auth-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-auth-origin.d.ts","sourceRoot":"","sources":["../../src/config/local-auth-origin.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,uBAAuB,6BAA6B,CAAC;AAClE,eAAO,MAAM,+BAA+B,0BAA0B,CAAC;AAOvE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAQ7D;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAIjE;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAM1D"}

package/dist/config/local-auth-origin.js

@@ -0,0 +1,33 @@
+const LOCAL_AUTH_HOST = 'auth.vibes.local';
+export const VIBES_LOCAL_AUTH_ORIGIN = 'https://auth.vibes.local';
+export const VIBES_LOCAL_AUTH_SERVICE_ORIGIN = 'http://127.0.0.1:8420';
+/** `URL.parse` answers null for text that is not a URL: absence, not a failure. */
+function parseAuthUrl(authOrigin) {
+    return URL.parse(authOrigin);
+}
+export function isLocalAuthOrigin(authOrigin) {
+    const url = parseAuthUrl(authOrigin);
+    if (!url)
+        return false;
+    // URL.hostname keeps the brackets of an IPv6 literal, so loopback v6 is '[::1]'.
+    if (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]') {
+        return true;
+    }
+    return url.hostname === LOCAL_AUTH_HOST;
+}
+export function resolveLocalAuthOrigin(authOrigin) {
+    const url = parseAuthUrl(authOrigin);
+    if (!url || url.hostname !== LOCAL_AUTH_HOST)
+        return authOrigin;
+    return VIBES_LOCAL_AUTH_SERVICE_ORIGIN;
+}
+export function resolveLocalAuthUrl(rawUrl) {
+    const url = URL.parse(rawUrl);
+    if (!url)
+        return rawUrl;
+    const origin = resolveLocalAuthOrigin(url.origin);
+    if (origin === url.origin)
+        return rawUrl;
+    return URL.parse(`${url.pathname}${url.search}${url.hash}`, `${origin}/`)?.toString() ?? rawUrl;
+}
+//# sourceMappingURL=local-auth-origin.js.map

package/dist/config/local-auth-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-auth-origin.js","sourceRoot":"","sources":["../../src/config/local-auth-origin.ts"],"names":[],"mappings":"AAAA,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAClE,MAAM,CAAC,MAAM,+BAA+B,GAAG,uBAAuB,CAAC;AAEvE,mFAAmF;AACnF,SAAS,YAAY,CAAC,UAAkB;IACvC,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IACnD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,iFAAiF;IACjF,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9F,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,KAAK,eAAe,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACxD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe;QAAE,OAAO,UAAU,CAAC;IAChE,OAAO,+BAA+B,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IACjD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC;IACxB,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IACzC,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,MAAM,CAAC;AACjG,CAAC"}

package/dist/device-session/auth-device-session.capability.d.ts

@@ -0,0 +1,202 @@
+import * as z from 'zod/v4';
+export declare const AUTH_DEVICE_SESSION_CAPABILITY_ID = "auth.device-session";
+export declare const AUTH_DEVICE_SESSION_KIND = "auth/device-session";
+export declare const AUTH_DEVICE_SESSION_CLIENT_ID = "bridge-desktop";
+export declare const authDeviceSessionClientIdSchema: z.ZodEnum<{
+    "bridge-desktop": "bridge-desktop";
+    "vibes-mobile-ios": "vibes-mobile-ios";
+    "vibes-mobile-android": "vibes-mobile-android";
+}>;
+export declare const AUTH_DEVICE_SESSION_REVALIDATE_MS = 15000;
+export declare const authDeviceSessionUserSchema: z.ZodObject<{
+    userId: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strict>;
+export declare const authDeviceSessionErrorSchema: z.ZodObject<{
+    code: z.ZodEnum<{
+        access_denied: "access_denied";
+        expired_token: "expired_token";
+        invalid_client: "invalid_client";
+        invalid_grant: "invalid_grant";
+        invalid_response: "invalid_response";
+        local_sign_out_failed: "local_sign_out_failed";
+        network_error: "network_error";
+        session_invalid: "session_invalid";
+        storage_unavailable: "storage_unavailable";
+        unknown_error: "unknown_error";
+    }>;
+    message: z.ZodString;
+}, z.core.$strict>;
+export declare const authDeviceSessionWarningSchema: z.ZodObject<{
+    code: z.ZodLiteral<"remote_revocation_unconfirmed">;
+    message: z.ZodString;
+}, z.core.$strict>;
+/**
+ * Renderer-safe state only.
+ *
+ * The RFC 8628 device code and every durable credential are deliberately
+ * absent. Strict objects turn an accidental extra field into a projection
+ * failure instead of silently stripping evidence of a boundary regression.
+ */
+export declare const authDeviceSessionSnapshotSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    clientId: z.ZodEnum<{
+        "bridge-desktop": "bridge-desktop";
+        "vibes-mobile-ios": "vibes-mobile-ios";
+        "vibes-mobile-android": "vibes-mobile-android";
+    }>;
+    environmentId: z.ZodString;
+    status: z.ZodLiteral<"signed-out">;
+    warning: z.ZodOptional<z.ZodObject<{
+        code: z.ZodLiteral<"remote_revocation_unconfirmed">;
+        message: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    clientId: z.ZodEnum<{
+        "bridge-desktop": "bridge-desktop";
+        "vibes-mobile-ios": "vibes-mobile-ios";
+        "vibes-mobile-android": "vibes-mobile-android";
+    }>;
+    environmentId: z.ZodString;
+    status: z.ZodLiteral<"requesting">;
+}, z.core.$strict>, z.ZodObject<{
+    clientId: z.ZodEnum<{
+        "bridge-desktop": "bridge-desktop";
+        "vibes-mobile-ios": "vibes-mobile-ios";
+        "vibes-mobile-android": "vibes-mobile-android";
+    }>;
+    environmentId: z.ZodString;
+    status: z.ZodLiteral<"pending">;
+    userCode: z.ZodString;
+    verificationUri: z.ZodString;
+    verificationUriComplete: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    clientId: z.ZodEnum<{
+        "bridge-desktop": "bridge-desktop";
+        "vibes-mobile-ios": "vibes-mobile-ios";
+        "vibes-mobile-android": "vibes-mobile-android";
+    }>;
+    environmentId: z.ZodString;
+    status: z.ZodLiteral<"signed-in">;
+    user: z.ZodObject<{
+        userId: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>;
+    revalidateAt: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    clientId: z.ZodEnum<{
+        "bridge-desktop": "bridge-desktop";
+        "vibes-mobile-ios": "vibes-mobile-ios";
+        "vibes-mobile-android": "vibes-mobile-android";
+    }>;
+    environmentId: z.ZodString;
+    status: z.ZodLiteral<"error">;
+    error: z.ZodObject<{
+        code: z.ZodEnum<{
+            access_denied: "access_denied";
+            expired_token: "expired_token";
+            invalid_client: "invalid_client";
+            invalid_grant: "invalid_grant";
+            invalid_response: "invalid_response";
+            local_sign_out_failed: "local_sign_out_failed";
+            network_error: "network_error";
+            session_invalid: "session_invalid";
+            storage_unavailable: "storage_unavailable";
+            unknown_error: "unknown_error";
+        }>;
+        message: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>], "status">;
+export type AuthDeviceSessionSnapshot = z.infer<typeof authDeviceSessionSnapshotSchema>;
+export type AuthDeviceSessionUser = z.infer<typeof authDeviceSessionUserSchema>;
+export type AuthDeviceSessionWarning = z.infer<typeof authDeviceSessionWarningSchema>;
+export interface AuthDeviceSessionCapability {
+    snapshot(environmentId?: string): Promise<AuthDeviceSessionSnapshot>;
+    begin(environmentId?: string): Promise<AuthDeviceSessionSnapshot>;
+    cancel(): Promise<AuthDeviceSessionSnapshot>;
+    signOut(environmentId?: string): Promise<AuthDeviceSessionSnapshot>;
+}
+export declare const authDeviceSessionDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"auth/device-session">;
+    clientId: z.ZodEnum<{
+        "bridge-desktop": "bridge-desktop";
+        "vibes-mobile-ios": "vibes-mobile-ios";
+        "vibes-mobile-android": "vibes-mobile-android";
+    }>;
+}, z.core.$strip>;
+export type AuthDeviceSessionDescriptor = z.infer<typeof authDeviceSessionDescriptorSchema>;
+export declare const authDeviceSessionCapabilityKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<AuthDeviceSessionCapability>;
+export declare const authDeviceSessionCapabilityDescriptor: AuthDeviceSessionDescriptor;
+export declare const authDeviceSessionCapabilityExposure: {
+    protocolVersion: 1;
+    discoverable: boolean;
+    audiences: ("service" | "operator" | "consumer-renderer" | "consumer-cli" | "consumer-agent")[];
+    methods: Record<string, {
+        request: {
+            id: string;
+            version: number;
+            schema: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+        };
+        result: {
+            id: string;
+            version: number;
+            schema: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+        };
+        dataClassification: "user" | "secret" | "public" | "sensitive";
+        rendererView: "denied" | "raw" | "redacted";
+        retry: {
+            mode: "read";
+            retry: "safe";
+        } | {
+            mode: "idempotent";
+            operationIdRequired: true;
+            reconciliationMethod: string;
+        } | {
+            mode: "non-idempotent";
+            retry: "never";
+        };
+        cancellation: {
+            mode: "required" | "none" | "cooperative";
+            defaultDeadlineMs: number;
+            maxDeadlineMs: number;
+        };
+        maxRequestBytes: number;
+        maxResultBytes: number;
+        projectRenderer?: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>> | undefined;
+        stream?: {
+            event: {
+                id: string;
+                version: number;
+                schema: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+            };
+            maxEventBytes: number;
+            initialCredits: number;
+            maxCredits: number;
+            projectRenderer?: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>> | undefined;
+        } | undefined;
+    }>;
+};
+//# sourceMappingURL=auth-device-session.capability.d.ts.map

package/dist/device-session/auth-device-session.capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device-session.capability.d.ts","sourceRoot":"","sources":["../../src/device-session/auth-device-session.capability.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,iCAAiC,wBAAwB,CAAC;AACvE,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAC9D,eAAO,MAAM,6BAA6B,mBAAmB,CAAC;AAC9D,eAAO,MAAM,+BAA+B;;;;EAI1C,CAAC;AACH,eAAO,MAAM,iCAAiC,QAAS,CAAC;AAExD,eAAO,MAAM,2BAA2B;;;;kBAM9B,CAAC;AAEX,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;kBAgB/B,CAAC;AAEX,eAAO,MAAM,8BAA8B;;;kBAKjC,CAAC;AAOX;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAmC1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACrE,KAAK,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAClE,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC7C,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACpE;AAED,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,+BAA+B,wFAM1C,CAAC;AAEH,eAAO,MAAM,qCAAqC,EAAE,2BASnD,CAAC;AAmBF,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8D9C,CAAC"}

package/dist/device-session/auth-device-session.capability.js

@@ -0,0 +1,185 @@
+import { createRuntimeKind, RuntimeDescriptorSchema } from '@vibesdotdev/kernel';
+import { defineRemoteExposure } from '@vibesdotdev/kernel/federation';
+import * as z from 'zod/v4';
+export const AUTH_DEVICE_SESSION_CAPABILITY_ID = 'auth.device-session';
+export const AUTH_DEVICE_SESSION_KIND = 'auth/device-session';
+export const AUTH_DEVICE_SESSION_CLIENT_ID = 'bridge-desktop';
+export const authDeviceSessionClientIdSchema = z.enum([
+    AUTH_DEVICE_SESSION_CLIENT_ID,
+    'vibes-mobile-ios',
+    'vibes-mobile-android'
+]);
+export const AUTH_DEVICE_SESSION_REVALIDATE_MS = 15_000;
+export const authDeviceSessionUserSchema = z
+    .object({
+    userId: z.string().min(1),
+    email: z.string().email(),
+    name: z.string().nullable().optional()
+})
+    .strict();
+export const authDeviceSessionErrorSchema = z
+    .object({
+    code: z.enum([
+        'access_denied',
+        'expired_token',
+        'invalid_client',
+        'invalid_grant',
+        'invalid_response',
+        'local_sign_out_failed',
+        'network_error',
+        'session_invalid',
+        'storage_unavailable',
+        'unknown_error'
+    ]),
+    message: z.string().min(1)
+})
+    .strict();
+export const authDeviceSessionWarningSchema = z
+    .object({
+    code: z.literal('remote_revocation_unconfirmed'),
+    message: z.string().min(1)
+})
+    .strict();
+const authDeviceSessionBaseSchema = z.object({
+    clientId: authDeviceSessionClientIdSchema,
+    environmentId: z.string().min(1)
+});
+/**
+ * Renderer-safe state only.
+ *
+ * The RFC 8628 device code and every durable credential are deliberately
+ * absent. Strict objects turn an accidental extra field into a projection
+ * failure instead of silently stripping evidence of a boundary regression.
+ */
+export const authDeviceSessionSnapshotSchema = z.discriminatedUnion('status', [
+    authDeviceSessionBaseSchema
+        .extend({
+        status: z.literal('signed-out'),
+        warning: authDeviceSessionWarningSchema.optional()
+    })
+        .strict(),
+    authDeviceSessionBaseSchema
+        .extend({
+        status: z.literal('requesting')
+    })
+        .strict(),
+    authDeviceSessionBaseSchema
+        .extend({
+        status: z.literal('pending'),
+        userCode: z.string().min(1),
+        verificationUri: z.string().url(),
+        verificationUriComplete: z.string().url().optional(),
+        expiresAt: z.string().datetime()
+    })
+        .strict(),
+    authDeviceSessionBaseSchema
+        .extend({
+        status: z.literal('signed-in'),
+        user: authDeviceSessionUserSchema,
+        revalidateAt: z.string().datetime(),
+        expiresAt: z.string().datetime().optional()
+    })
+        .strict(),
+    authDeviceSessionBaseSchema
+        .extend({
+        status: z.literal('error'),
+        error: authDeviceSessionErrorSchema
+    })
+        .strict()
+]);
+export const authDeviceSessionDescriptorSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal(AUTH_DEVICE_SESSION_KIND),
+    clientId: authDeviceSessionClientIdSchema
+});
+export const authDeviceSessionCapabilityKind = createRuntimeKind({
+    id: AUTH_DEVICE_SESSION_KIND,
+    descriptorSchema: authDeviceSessionDescriptorSchema
+});
+export const authDeviceSessionCapabilityDescriptor = {
+    id: AUTH_DEVICE_SESSION_CAPABILITY_ID,
+    kind: AUTH_DEVICE_SESSION_KIND,
+    name: 'Vibes device session',
+    description: 'Credential-dark device authorization state projected from the trusted consumer runtime',
+    clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+    enabled: true,
+    hardware: ['consumer']
+};
+const cancellation = {
+    mode: 'cooperative',
+    defaultDeadlineMs: 5_000,
+    maxDeadlineMs: 30_000
+};
+// One optional slot, not an empty-tuple union. An omitted id has to keep its
+// position so the projection's cancellation context is not read as the id.
+const environmentRequestSchema = z.tuple([z.string().min(1).optional()]);
+const safeSnapshotResult = {
+    dataClassification: 'sensitive',
+    rendererView: 'redacted',
+    projectRenderer: authDeviceSessionSnapshotSchema,
+    cancellation,
+    maxResultBytes: 16 * 1024
+};
+export const authDeviceSessionCapabilityExposure = defineRemoteExposure({
+    protocolVersion: 1,
+    discoverable: true,
+    audiences: ['consumer-renderer'],
+    methods: {
+        snapshot: {
+            request: {
+                id: 'auth.device-session.snapshot.request',
+                version: 1,
+                schema: environmentRequestSchema
+            },
+            result: {
+                id: 'auth.device-session.snapshot.result',
+                version: 1,
+                schema: authDeviceSessionSnapshotSchema
+            },
+            ...safeSnapshotResult,
+            retry: { mode: 'read', retry: 'safe' },
+            maxRequestBytes: 256
+        },
+        begin: {
+            request: {
+                id: 'auth.device-session.begin.request',
+                version: 1,
+                schema: environmentRequestSchema
+            },
+            result: {
+                id: 'auth.device-session.begin.result',
+                version: 1,
+                schema: authDeviceSessionSnapshotSchema
+            },
+            ...safeSnapshotResult,
+            retry: { mode: 'non-idempotent', retry: 'never' },
+            maxRequestBytes: 256
+        },
+        cancel: {
+            request: { id: 'auth.device-session.cancel.request', version: 1, schema: z.tuple([]) },
+            result: {
+                id: 'auth.device-session.cancel.result',
+                version: 1,
+                schema: authDeviceSessionSnapshotSchema
+            },
+            ...safeSnapshotResult,
+            retry: { mode: 'non-idempotent', retry: 'never' },
+            maxRequestBytes: 256
+        },
+        signOut: {
+            request: {
+                id: 'auth.device-session.sign-out.request',
+                version: 1,
+                schema: environmentRequestSchema
+            },
+            result: {
+                id: 'auth.device-session.sign-out.result',
+                version: 1,
+                schema: authDeviceSessionSnapshotSchema
+            },
+            ...safeSnapshotResult,
+            retry: { mode: 'non-idempotent', retry: 'never' },
+            maxRequestBytes: 256
+        }
+    }
+});
+//# sourceMappingURL=auth-device-session.capability.js.map