@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/device-session/auth-device-session.capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device-session.capability.js","sourceRoot":"","sources":["../../src/device-session/auth-device-session.capability.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,uBAAuB,EACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,iCAAiC,GAAG,qBAAqB,CAAC;AACvE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAC;AAC9D,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;AAC9D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,IAAI,CAAC;IACrD,6BAA6B;IAC7B,kBAAkB;IAClB,sBAAsB;CACtB,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAExD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACP,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAEX,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,eAAe;QACf,eAAe;QACf,gBAAgB;QAChB,eAAe;QACf,kBAAkB;QAClB,uBAAuB;QACvB,eAAe;QACf,iBAAiB;QACjB,qBAAqB;QACrB,eAAe;KACf,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAEX,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAEX,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,+BAA+B;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC7E,2BAA2B;SACzB,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QAC/B,OAAO,EAAE,8BAA8B,CAAC,QAAQ,EAAE;KAClD,CAAC;SACD,MAAM,EAAE;IACV,2BAA2B;SACzB,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACV,2BAA2B;SACzB,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACjC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;SACD,MAAM,EAAE;IACV,2BAA2B;SACzB,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC9B,IAAI,EAAE,2BAA2B;QACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC3C,CAAC;SACD,MAAM,EAAE;IACV,2BAA2B;SACzB,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1B,KAAK,EAAE,4BAA4B;KACnC,CAAC;SACD,MAAM,EAAE;CACV,CAAC,CAAC;AAaH,MAAM,CAAC,MAAM,iCAAiC,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC/E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACzC,QAAQ,EAAE,+BAA+B;CACzC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,iBAAiB,CAG9D;IACD,EAAE,EAAE,wBAAwB;IAC5B,gBAAgB,EAAE,iCAAiC;CACnD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qCAAqC,GAAgC;IACjF,EAAE,EAAE,iCAAiC;IACrC,IAAI,EAAE,wBAAwB;IAC9B,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACV,wFAAwF;IACzF,QAAQ,EAAE,6BAA6B;IACvC,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,CAAC,UAAU,CAAC;CACtB,CAAC;AAEF,MAAM,YAAY,GAAG;IACpB,IAAI,EAAE,aAAsB;IAC5B,iBAAiB,EAAE,KAAK;IACxB,aAAa,EAAE,MAAM;CACrB,CAAC;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAEzE,MAAM,kBAAkB,GAAG;IAC1B,kBAAkB,EAAE,WAAoB;IACxC,YAAY,EAAE,UAAmB;IACjC,eAAe,EAAE,+BAA+B;IAChD,YAAY;IACZ,cAAc,EAAE,EAAE,GAAG,IAAI;CACzB,CAAC;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,oBAAoB,CAAC;IACvE,eAAe,EAAE,CAAC;IAClB,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,OAAO,EAAE;QACR,QAAQ,EAAE;YACT,OAAO,EAAE;gBACR,EAAE,EAAE,sCAAsC;gBAC1C,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,wBAAwB;aAChC;YACD,MAAM,EAAE;gBACP,EAAE,EAAE,qCAAqC;gBACzC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,+BAA+B;aACvC;YACD,GAAG,kBAAkB;YACrB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;YACtC,eAAe,EAAE,GAAG;SACpB;QACD,KAAK,EAAE;YACN,OAAO,EAAE;gBACR,EAAE,EAAE,mCAAmC;gBACvC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,wBAAwB;aAChC;YACD,MAAM,EAAE;gBACP,EAAE,EAAE,kCAAkC;gBACtC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,+BAA+B;aACvC;YACD,GAAG,kBAAkB;YACrB,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE;YACjD,eAAe,EAAE,GAAG;SACpB;QACD,MAAM,EAAE;YACP,OAAO,EAAE,EAAE,EAAE,EAAE,oCAAoC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;YACtF,MAAM,EAAE;gBACP,EAAE,EAAE,mCAAmC;gBACvC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,+BAA+B;aACvC;YACD,GAAG,kBAAkB;YACrB,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE;YACjD,eAAe,EAAE,GAAG;SACpB;QACD,OAAO,EAAE;YACR,OAAO,EAAE;gBACR,EAAE,EAAE,sCAAsC;gBAC1C,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,wBAAwB;aAChC;YACD,MAAM,EAAE;gBACP,EAAE,EAAE,qCAAqC;gBACzC,OAAO,EAAE,CAAC;gBACV,MAAM,EAAE,+BAA+B;aACvC;YACD,GAAG,kBAAkB;YACrB,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE;YACjD,eAAe,EAAE,GAAG;SACpB;KACD;CACD,CAAC,CAAC"}

package/dist/device-session/auth-device-session.impl.consumer.worker.d.ts

@@ -0,0 +1,58 @@
+import { type KindContext, type RuntimeDescriptor, type VibesRuntime } from '@vibesdotdev/kernel';
+import { type DeviceAuthorizationToken, type DeviceAuthorizationUser } from '../client/device-authorization.ts';
+import { type AuthDeviceSessionCapability, type AuthDeviceSessionSnapshot } from './auth-device-session.capability.ts';
+export declare const AUTH_DEVICE_SESSION_SECRET_STORE_ID = "encrypted-local";
+interface PersistDeviceSessionOptions {
+    runtime: VibesRuntime;
+    environmentId: string;
+    token: DeviceAuthorizationToken;
+    user: DeviceAuthorizationUser;
+    nonce?: () => string;
+}
+/**
+ * Persist an approved device session without writing credential bytes to the
+ * auth config document. The config manifest receives only exact
+ * `secrets/store#encrypted-local` references.
+ */
+export declare function persistDeviceSession(options: PersistDeviceSessionOptions): Promise<void>;
+export interface AuthDeviceSessionServiceOptions {
+    runtime: VibesRuntime;
+    fetcher?: typeof globalThis.fetch;
+    now?: () => number;
+    delay?: (milliseconds: number, signal: AbortSignal) => Promise<void>;
+    nonce?: () => string;
+    /**
+     * After a sign-in or a revalidated session: the `auth/device-session` store
+     * re-mints this environment's bearer from the stored login on its next read.
+     */
+    refreshBearer?: (runtime: VibesRuntime, environmentId: string) => void | Promise<void>;
+    /** After a local sign-out: the store stops serving this environment's bearer. */
+    clearBearer?: (runtime: VibesRuntime, environmentId: string) => void | Promise<void>;
+}
+export declare class AuthDeviceSessionService implements AuthDeviceSessionCapability {
+    private readonly logger;
+    private readonly runtime;
+    private readonly fetcher?;
+    private readonly now;
+    private readonly delay;
+    private readonly nonce?;
+    private readonly refreshBearer;
+    private readonly clearBearer;
+    private current;
+    private abortController;
+    private generation;
+    constructor(options: AuthDeviceSessionServiceOptions);
+    private resolveEnvironment;
+    private signedInSnapshot;
+    private clearInvalidSession;
+    snapshot(requestedEnvironmentId?: string): Promise<AuthDeviceSessionSnapshot>;
+    begin(requestedEnvironmentId?: string): Promise<AuthDeviceSessionSnapshot>;
+    private pollUntilSettled;
+    cancel(): Promise<AuthDeviceSessionSnapshot>;
+    signOut(requestedEnvironmentId?: string): Promise<AuthDeviceSessionSnapshot>;
+}
+export default class ConsumerAuthDeviceSessionCapability extends AuthDeviceSessionService {
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
+}
+export {};
+//# sourceMappingURL=auth-device-session.impl.consumer.worker.d.ts.map

package/dist/device-session/auth-device-session.impl.consumer.worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device-session.impl.consumer.worker.d.ts","sourceRoot":"","sources":["../../src/device-session/auth-device-session.impl.consumer.worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuC,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGvI,OAAO,EAON,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,MAAM,mCAAmC,CAAC;AAU3C,OAAO,EAIN,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,MAAM,qCAAqC,CAAC;AAI7C,eAAO,MAAM,mCAAmC,oBAAoB,CAAC;AASrE,UAAU,2BAA2B;IACpC,OAAO,EAAE,YAAY,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,wBAAwB,CAAC;IAChC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACrB;AAyBD;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAuE9F;AAED,MAAM,WAAW,+BAA+B;IAC/C,OAAO,EAAE,YAAY,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,iFAAiF;IACjF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAuFD,qBAAa,wBAAyB,YAAW,2BAA2B;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA0B;IACnD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+D;IACrF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgE;IAC9F,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8D;IAC1F,OAAO,CAAC,OAAO,CAA0C;IACzD,OAAO,CAAC,eAAe,CAAgC;IACvD,OAAO,CAAC,UAAU,CAAK;gBAEX,OAAO,EAAE,+BAA+B;YAYtC,kBAAkB;IAkBhC,OAAO,CAAC,gBAAgB;YAsBV,mBAAmB;IAkB3B,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAwD7E,KAAK,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;YAiDlE,gBAAgB;IAqDxB,MAAM,IAAI,OAAO,CAAC,yBAAyB,CAAC;IAe5C,OAAO,CAAC,sBAAsB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAyFlF;AAED,MAAM,CAAC,OAAO,OAAO,mCAAoC,SAAQ,wBAAwB;gBAC5E,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW;CAiB/D"}

package/dist/device-session/auth-device-session.impl.consumer.worker.js

@@ -0,0 +1,494 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { attempt, failureLabel, rethrowFailure } from "../features/utils/attempt.js";
+import { resolveVibesAppOriginForEnvironment } from '@vibesdotdev/config/environment/resolve-app-origin';
+import { DeviceAuthorizationError, getDeviceAuthorizationUser, pollDeviceAuthorization, requestDeviceAuthorization, revokeDeviceAuthorizationSession } from "../client/device-authorization.js";
+import { clearCredentials, getCredentials, getEnvironmentAuthManifest, resolveCredentialEnvironmentId, setCredentials } from "../features/services/credential-store.js";
+import { invalidateDeviceSession } from "./device-session.store.js";
+import { AUTH_DEVICE_SESSION_CLIENT_ID, AUTH_DEVICE_SESSION_REVALIDATE_MS, authDeviceSessionDescriptorSchema } from "./auth-device-session.capability.js";
+import { pendingReferences, credentialReferences, referenceKey } from "../features/services/credential-custody.js";
+import { getLogger } from '@vibesdotdev/logging';
+export const AUTH_DEVICE_SESSION_SECRET_STORE_ID = 'encrypted-local';
+const AUTH_DEVICE_SESSION_SECRET_KEY_PREFIX = 'auth.device-session';
+async function resolveEncryptedLocalStore(runtime) {
+    const store = await runtime
+        .query('secrets/store')
+        .withId(AUTH_DEVICE_SESSION_SECRET_STORE_ID)
+        .resolve();
+    if (!store) {
+        throw new Error(`secrets/store#${AUTH_DEVICE_SESSION_SECRET_STORE_ID} is required for device sessions`);
+    }
+    return store;
+}
+function createSecretReference(environmentId, key) {
+    return {
+        storeId: AUTH_DEVICE_SESSION_SECRET_STORE_ID,
+        environment: environmentId,
+        key
+    };
+}
+/**
+ * Persist an approved device session without writing credential bytes to the
+ * auth config document. The config manifest receives only exact
+ * `secrets/store#encrypted-local` references.
+ */
+export async function persistDeviceSession(options) {
+    const logger = getLogger('auth.device-session', options.runtime);
+    const store = await resolveEncryptedLocalStore(options.runtime);
+    const { env } = await getEnvironmentAuthManifest(options.environmentId, options.runtime);
+    const previous = await env.load();
+    const nonce = (options.nonce ?? (() => crypto.randomUUID()))();
+    const sessionKey = `${AUTH_DEVICE_SESSION_SECRET_KEY_PREFIX}.${AUTH_DEVICE_SESSION_CLIENT_ID}.${nonce}.session`;
+    const refreshKey = `${AUTH_DEVICE_SESSION_SECRET_KEY_PREFIX}.${AUTH_DEVICE_SESSION_CLIENT_ID}.${nonce}.refresh`;
+    const sessionTokenReference = createSecretReference(options.environmentId, sessionKey);
+    const refreshTokenReference = options.token.refreshToken
+        ? createSecretReference(options.environmentId, refreshKey)
+        : undefined;
+    const written = [];
+    // Reserve custody before creating material. Failed rollback can leave these
+    // references for the next canonical credential write to retire safely.
+    await env.save({
+        ...previous,
+        pendingSecretCleanup: pendingReferences(previous, {
+            credentials: { sessionTokenReference, refreshTokenReference }
+        })
+    });
+    const persisted = await attempt(async () => {
+        await store.set(options.environmentId, sessionKey, options.token.sessionToken);
+        written.push(sessionTokenReference);
+        if (options.token.refreshToken && refreshTokenReference) {
+            await store.set(options.environmentId, refreshKey, options.token.refreshToken);
+            written.push(refreshTokenReference);
+        }
+        await setCredentials({
+            mode: 'replace-session',
+            sessionTokenReference,
+            refreshTokenReference,
+            expiresAt: options.token.expiresAt,
+            userId: options.user.userId,
+            email: options.user.email,
+            name: options.user.name ?? undefined
+        }, options.environmentId, options.runtime);
+    });
+    if (!persisted.ok) {
+        // If the environment document committed but the compatibility root write
+        // failed, keep its referenced values. Otherwise remove only the new,
+        // uniquely named entries and leave the previous session intact.
+        const reread = await attempt(() => env.load());
+        if (!reread.ok) {
+            logger.warn('Could not re-read the committed environment document during rollback', {
+                failure: failureLabel(reread.failure)
+            });
+        }
+        // An unreadable commit has an unknown outcome: keep the reserved journal
+        // and material rather than deleting a possibly committed credential.
+        if (reread.ok) {
+            const retained = new Set(credentialReferences(reread.value).map(referenceKey));
+            for (const reference of written) {
+                if (retained.has(referenceKey(reference)))
+                    continue;
+                const removed = await attempt(() => store.unset(reference.environment, reference.key));
+                // Best-effort cleanup: the original failure rethrown below is what the caller must see.
+                if (!removed.ok) {
+                    logger.warn('Could not remove a partially written credential reference', {
+                        failure: failureLabel(removed.failure)
+                    });
+                }
+            }
+        }
+        return rethrowFailure(persisted.failure);
+    }
+}
+/** An aborted wait: a DOM AbortError or the lifecycle's typed `wait-aborted` cancellation. */
+function isAbortCause(cause) {
+    if (cause instanceof CapabilityError)
+        return cause.reason === 'wait-aborted';
+    return cause instanceof Error && cause.name === 'AbortError';
+}
+function safeError(environmentId, cause) {
+    let code = 'unknown_error';
+    let message = 'Secure sign-in could not be completed.';
+    if (cause instanceof DeviceAuthorizationError) {
+        code = cause.legacyCode;
+        switch (cause.legacyCode) {
+            case 'access_denied':
+                message = 'Sign-in was denied.';
+                break;
+            case 'expired_token':
+                message = 'The sign-in code expired. Start again to get a new code.';
+                break;
+            case 'network_error':
+                message = 'Vibes Auth could not be reached. Check your connection and try again.';
+                break;
+            case 'session_invalid':
+                message = 'The device session is no longer valid. Sign in again.';
+                break;
+            default:
+                break;
+        }
+    }
+    else if (cause instanceof Error &&
+        (cause.message.includes('secrets/store#encrypted-local') ||
+            cause.message.includes('config/manifest#auth'))) {
+        code = 'storage_unavailable';
+        message = 'Secure local credential storage is unavailable.';
+    }
+    return {
+        status: 'error',
+        clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+        environmentId,
+        error: { code, message }
+    };
+}
+function copySnapshot(snapshot) {
+    return structuredClone(snapshot);
+}
+function localSignOutError(environmentId) {
+    return {
+        status: 'error',
+        clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+        environmentId,
+        error: {
+            code: 'local_sign_out_failed',
+            message: 'Secure local sign-out could not be completed.'
+        }
+    };
+}
+function authOriginUndeclared(environmentId) {
+    return new CapabilityError(`config/environment#${environmentId} does not declare apps.auth`, 'UNAVAILABLE', {
+        reason: 'auth-origin-undeclared',
+        retryable: false
+    });
+}
+/** Run one local step; a failure is logged by its class (never its text) and reported as `false`. */
+async function stepSucceeded(runtime, message, step) {
+    const outcome = await attempt(step);
+    if (outcome.ok)
+        return true;
+    getLogger('auth.device-session', runtime).error(message, { failure: failureLabel(outcome.failure) });
+    return false;
+}
+function remoteRevocationWarning() {
+    return {
+        code: 'remote_revocation_unconfirmed',
+        message: 'Signed out on this device. Vibes Auth could not confirm remote session revocation.'
+    };
+}
+export class AuthDeviceSessionService {
+    logger;
+    runtime;
+    fetcher;
+    now;
+    delay;
+    nonce;
+    refreshBearer;
+    clearBearer;
+    current = null;
+    abortController = null;
+    generation = 0;
+    constructor(options) {
+        this.runtime = options.runtime;
+        this.logger = getLogger('auth.device-session', options.runtime);
+        this.fetcher = options.fetcher;
+        this.now = options.now ?? Date.now;
+        this.delay =
+            options.delay ?? ((milliseconds, signal) => this.runtime.lifecycle.delay(milliseconds, signal));
+        this.nonce = options.nonce;
+        this.refreshBearer = options.refreshBearer ?? invalidateDeviceSession;
+        this.clearBearer = options.clearBearer ?? invalidateDeviceSession;
+    }
+    async resolveEnvironment(requestedEnvironmentId) {
+        const environmentId = await resolveCredentialEnvironmentId(this.runtime, requestedEnvironmentId);
+        const authOrigin = await resolveVibesAppOriginForEnvironment('auth', environmentId, this.runtime);
+        if (!authOrigin) {
+            throw authOriginUndeclared(environmentId);
+        }
+        return { environmentId, authOrigin };
+    }
+    signedInSnapshot(environmentId, user, expiresAt) {
+        const now = this.now();
+        const expiresAtMs = expiresAt ? Date.parse(expiresAt) : Number.NaN;
+        const hasExpiry = Number.isFinite(expiresAtMs);
+        const revalidateAtMs = hasExpiry
+            ? Math.min(now + AUTH_DEVICE_SESSION_REVALIDATE_MS, expiresAtMs)
+            : now + AUTH_DEVICE_SESSION_REVALIDATE_MS;
+        const snapshot = {
+            status: 'signed-in',
+            clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+            environmentId,
+            user,
+            revalidateAt: new Date(revalidateAtMs).toISOString()
+        };
+        if (hasExpiry)
+            snapshot.expiresAt = new Date(expiresAtMs).toISOString();
+        return snapshot;
+    }
+    async clearInvalidSession(environmentId) {
+        const credentialsCleared = await stepSucceeded(this.runtime, 'Could not clear stored credentials', () => clearCredentials(this.runtime, environmentId));
+        const bearerCleared = await stepSucceeded(this.runtime, 'Could not clear the device-session bearer', () => Promise.resolve(this.clearBearer(this.runtime, environmentId)));
+        this.current =
+            credentialsCleared && bearerCleared
+                ? {
+                    status: 'signed-out',
+                    clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+                    environmentId
+                }
+                : localSignOutError(environmentId);
+        return copySnapshot(this.current);
+    }
+    async snapshot(requestedEnvironmentId) {
+        const { environmentId, authOrigin } = await this.resolveEnvironment(requestedEnvironmentId);
+        if (this.current?.environmentId === environmentId) {
+            if (this.current.status === 'requesting' || this.current.status === 'pending') {
+                return copySnapshot(this.current);
+            }
+            if (this.current.status === 'signed-in' &&
+                this.now() < Date.parse(this.current.revalidateAt)) {
+                return copySnapshot(this.current);
+            }
+        }
+        const credentials = await getCredentials(this.runtime, environmentId);
+        if (credentials?.type === 'session' && credentials.sessionToken) {
+            const expiresAtMs = credentials.expiresAt ? Date.parse(credentials.expiresAt) : Number.NaN;
+            if (Number.isFinite(expiresAtMs) && expiresAtMs <= this.now()) {
+                return this.clearInvalidSession(environmentId);
+            }
+            const sessionToken = credentials.sessionToken;
+            const revalidated = await attempt(async () => {
+                const user = await getDeviceAuthorizationUser({
+                    authOrigin,
+                    sessionToken,
+                    fetcher: this.fetcher
+                });
+                await this.refreshBearer(this.runtime, environmentId);
+                return user;
+            });
+            if (revalidated.ok) {
+                this.current = this.signedInSnapshot(environmentId, revalidated.value, credentials.expiresAt);
+                return copySnapshot(this.current);
+            }
+            if (revalidated.failure instanceof DeviceAuthorizationError &&
+                revalidated.failure.legacyCode === 'session_invalid') {
+                return this.clearInvalidSession(environmentId);
+            }
+            this.current = safeError(environmentId, revalidated.failure);
+            return copySnapshot(this.current);
+        }
+        if (!(await stepSucceeded(this.runtime, 'Could not clear the device-session bearer', () => Promise.resolve(this.clearBearer(this.runtime, environmentId))))) {
+            this.current = localSignOutError(environmentId);
+            return copySnapshot(this.current);
+        }
+        this.current = {
+            status: 'signed-out',
+            clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+            environmentId
+        };
+        return copySnapshot(this.current);
+    }
+    async begin(requestedEnvironmentId) {
+        this.abortController?.abort();
+        const generation = ++this.generation;
+        const abortController = new AbortController();
+        this.abortController = abortController;
+        let environmentId = requestedEnvironmentId?.trim() || 'unresolved';
+        const started = await attempt(async () => {
+            const resolved = await this.resolveEnvironment(requestedEnvironmentId);
+            environmentId = resolved.environmentId;
+            this.current = {
+                status: 'requesting',
+                clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+                environmentId
+            };
+            const code = await requestDeviceAuthorization({
+                authOrigin: resolved.authOrigin,
+                clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+                fetcher: this.fetcher,
+                signal: abortController.signal,
+                now: this.now
+            });
+            if (generation !== this.generation)
+                return this.snapshot(environmentId);
+            this.current = {
+                status: 'pending',
+                clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+                environmentId,
+                userCode: code.userCode,
+                verificationUri: code.verificationUri,
+                verificationUriComplete: code.verificationUriComplete,
+                expiresAt: new Date(code.issuedAtMs + code.expiresInSeconds * 1_000).toISOString()
+            };
+            void this.pollUntilSettled(generation, resolved.authOrigin, environmentId, code, abortController.signal);
+            return copySnapshot(this.current);
+        });
+        if (started.ok)
+            return started.value;
+        if (isAbortCause(started.failure) && generation !== this.generation) {
+            return this.snapshot(requestedEnvironmentId);
+        }
+        this.current = safeError(environmentId, started.failure);
+        return copySnapshot(this.current);
+    }
+    async pollUntilSettled(generation, authOrigin, environmentId, code, signal) {
+        let retryAfterMs = code.intervalSeconds * 1_000;
+        const settled = await attempt(async () => {
+            while (generation === this.generation && !signal.aborted) {
+                if (this.now() >= code.issuedAtMs + code.expiresInSeconds * 1_000) {
+                    throw new DeviceAuthorizationError('expired_token', 'Device authorization expired');
+                }
+                await this.delay(retryAfterMs, signal);
+                const result = await pollDeviceAuthorization({
+                    authOrigin,
+                    clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+                    code,
+                    fetcher: this.fetcher,
+                    signal,
+                    intervalMs: retryAfterMs
+                });
+                if (result.status === 'pending') {
+                    retryAfterMs = result.retryAfterMs;
+                    continue;
+                }
+                const user = await getDeviceAuthorizationUser({
+                    authOrigin,
+                    sessionToken: result.token.sessionToken,
+                    fetcher: this.fetcher,
+                    signal
+                });
+                await persistDeviceSession({
+                    runtime: this.runtime,
+                    environmentId,
+                    token: result.token,
+                    user,
+                    nonce: this.nonce
+                });
+                await this.refreshBearer(this.runtime, environmentId);
+                if (generation !== this.generation)
+                    return;
+                this.abortController = null;
+                this.current = this.signedInSnapshot(environmentId, user, result.token.expiresAt);
+                return;
+            }
+        });
+        if (settled.ok)
+            return;
+        if (generation !== this.generation || isAbortCause(settled.failure))
+            return;
+        this.abortController = null;
+        this.current = safeError(environmentId, settled.failure);
+    }
+    async cancel() {
+        this.generation += 1;
+        this.abortController?.abort();
+        this.abortController = null;
+        if (this.current?.status === 'signed-in')
+            return copySnapshot(this.current);
+        const environmentId = this.current?.environmentId ?? (await resolveCredentialEnvironmentId(this.runtime));
+        this.current = {
+            status: 'signed-out',
+            clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+            environmentId
+        };
+        return copySnapshot(this.current);
+    }
+    async signOut(requestedEnvironmentId) {
+        this.generation += 1;
+        this.abortController?.abort();
+        this.abortController = null;
+        let environmentId = requestedEnvironmentId?.trim() || 'unresolved';
+        const signedOutResult = await attempt(async () => {
+            environmentId = await resolveCredentialEnvironmentId(this.runtime, requestedEnvironmentId);
+            let hadRemoteSession = this.current?.status === 'signed-in' && this.current.environmentId === environmentId;
+            let sessionToken;
+            // Two reads, each applied as soon as it succeeds: a failure of the second does not lose what the first showed.
+            const storedRead = await attempt(async () => {
+                const { env } = await getEnvironmentAuthManifest(environmentId, this.runtime);
+                return env.load();
+            });
+            if (storedRead.ok) {
+                hadRemoteSession ||= Boolean(storedRead.value?.credentials?.sessionToken || storedRead.value?.credentials?.sessionTokenReference);
+                const credentialsRead = await attempt(() => getCredentials(this.runtime, environmentId));
+                if (credentialsRead.ok) {
+                    if (credentialsRead.value?.type === 'session') {
+                        sessionToken = credentialsRead.value.sessionToken;
+                        hadRemoteSession = true;
+                    }
+                }
+                else {
+                    this.logger.warn('Sign-out preflight could not resolve the stored session', { failure: failureLabel(credentialsRead.failure) });
+                }
+            }
+            else {
+                this.logger.warn('Sign-out preflight could not resolve the stored session', { failure: failureLabel(storedRead.failure) });
+            }
+            // The deterministic local clear below remains authoritative. If
+            // preflight cannot resolve a remote token, the result will carry
+            // an unconfirmed-revocation warning when a session was known.
+            const credentialsCleared = await stepSucceeded(this.runtime, 'Sign-out could not clear stored credentials', () => clearCredentials(this.runtime, environmentId));
+            const bearerCleared = await stepSucceeded(this.runtime, 'Sign-out could not clear the device-session bearer', () => Promise.resolve(this.clearBearer(this.runtime, environmentId)));
+            if (!credentialsCleared || !bearerCleared) {
+                this.current = localSignOutError(environmentId);
+                return copySnapshot(this.current);
+            }
+            let warning;
+            if (hadRemoteSession) {
+                if (!sessionToken) {
+                    warning = remoteRevocationWarning();
+                }
+                else {
+                    const token = sessionToken;
+                    const revocation = await attempt(async () => {
+                        const authOrigin = await resolveVibesAppOriginForEnvironment('auth', environmentId, this.runtime);
+                        if (!authOrigin)
+                            throw authOriginUndeclared(environmentId);
+                        return revokeDeviceAuthorizationSession({
+                            runtime: this.runtime,
+                            authOrigin,
+                            sessionToken: token,
+                            fetcher: this.fetcher
+                        });
+                    });
+                    if (revocation.ok) {
+                        if (!revocation.value)
+                            warning = remoteRevocationWarning();
+                    }
+                    else {
+                        this.logger.warn('Remote session revocation failed', { failure: failureLabel(revocation.failure) });
+                        warning = remoteRevocationWarning();
+                    }
+                }
+            }
+            const signedOut = {
+                status: 'signed-out',
+                clientId: AUTH_DEVICE_SESSION_CLIENT_ID,
+                environmentId
+            };
+            if (warning)
+                signedOut.warning = warning;
+            this.current = signedOut;
+            return copySnapshot(this.current);
+        });
+        if (signedOutResult.ok)
+            return signedOutResult.value;
+        this.current = safeError(environmentId, signedOutResult.failure);
+        return copySnapshot(this.current);
+    }
+}
+export default class ConsumerAuthDeviceSessionCapability extends AuthDeviceSessionService {
+    constructor(descriptor, context) {
+        if (!context.runtime) {
+            throw new CapabilityError('Auth device session requires runtime context', 'INTERNAL', {
+                reason: 'runtime-context-required',
+                retryable: false
+            });
+        }
+        const typedDescriptor = authDeviceSessionDescriptorSchema.parse(descriptor);
+        if (typedDescriptor.clientId !== AUTH_DEVICE_SESSION_CLIENT_ID) {
+            throw new CapabilityError(`Unsupported auth device-session client: ${typedDescriptor.clientId}`, 'INVALID_INPUT', {
+                reason: 'device-session-client-unsupported',
+                retryable: false
+            });
+        }
+        // SAFETY: the kind context hands the loader the VibesRuntime it was resolved on.
+        super({ runtime: context.runtime });
+    }
+}
+//# sourceMappingURL=auth-device-session.impl.consumer.worker.js.map

package/dist/device-session/auth-device-session.impl.consumer.worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-device-session.impl.consumer.worker.js","sourceRoot":"","sources":["../../src/device-session/auth-device-session.impl.consumer.worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAmF,MAAM,qBAAqB,CAAC;AACvI,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,EAAE,mCAAmC,EAAE,MAAM,oDAAoD,CAAC;AACzG,OAAO,EACN,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,EACvB,0BAA0B,EAC1B,gCAAgC,EAIhC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,gBAAgB,EAChB,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,cAAc,EACd,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EACN,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EAGjC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AACnH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,MAAM,CAAC,MAAM,mCAAmC,GAAG,iBAAiB,CAAC;AACrE,MAAM,qCAAqC,GAAG,qBAAqB,CAAC;AAgBpE,KAAK,UAAU,0BAA0B,CACxC,OAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,OAAO;SACzB,KAAK,CAA8C,eAAe,CAAC;SACnE,MAAM,CAAC,mCAAmC,CAAC;SAC3C,OAAO,EAAE,CAAC;IACZ,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,iBAAiB,mCAAmC,kCAAkC,CACtF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,aAAqB,EAAE,GAAW;IAChE,OAAO;QACN,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,aAAa;QAC1B,GAAG;KACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAoC;IAC9E,MAAM,MAAM,GAAG,SAAS,CAAC,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,UAAU,GAAG,GAAG,qCAAqC,IAAI,6BAA6B,IAAI,KAAK,UAAU,CAAC;IAChH,MAAM,UAAU,GAAG,GAAG,qCAAqC,IAAI,6BAA6B,IAAI,KAAK,UAAU,CAAC;IAChH,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACvF,MAAM,qBAAqB,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY;QACvD,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC;QAC1D,CAAC,CAAC,SAAS,CAAC;IACb,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,GAAG,CAAC,IAAI,CAAC;QACd,GAAG,QAAQ;QACX,oBAAoB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;YACjD,WAAW,EAAE,EAAE,qBAAqB,EAAE,qBAAqB,EAAE;SAC7D,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1C,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,qBAAqB,EAAE,CAAC;YACzD,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,cAAc,CACnB;YACC,IAAI,EAAE,iBAAiB;YACvB,qBAAqB;YACrB,qBAAqB;YACrB,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;YAClC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;YAC3B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS;SACpC,EACD,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,OAAO,CACf,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,yEAAyE;QACzE,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,sEAAsE,EAAE;gBACnF,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;YAC/E,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;gBACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;oBAAE,SAAS;gBACpD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvF,wFAAwF;gBACxF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;wBACxE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;qBACtC,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;AACF,CAAC;AAiBD,8FAA8F;AAC9F,SAAS,YAAY,CAAC,KAAoB;IACzC,IAAI,KAAK,YAAY,eAAe;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC;IAC7E,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,aAAqB,EAAE,KAAoB;IAC7D,IAAI,IAAI,GACP,eAAe,CAAC;IACjB,IAAI,OAAO,GAAG,wCAAwC,CAAC;IACvD,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;QAC/C,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC;QACxB,QAAQ,KAAK,CAAC,UAAU,EAAE,CAAC;YAC1B,KAAK,eAAe;gBACnB,OAAO,GAAG,qBAAqB,CAAC;gBAChC,MAAM;YACP,KAAK,eAAe;gBACnB,OAAO,GAAG,0DAA0D,CAAC;gBACrE,MAAM;YACP,KAAK,eAAe;gBACnB,OAAO,GAAG,uEAAuE,CAAC;gBAClF,MAAM;YACP,KAAK,iBAAiB;gBACrB,OAAO,GAAG,uDAAuD,CAAC;gBAClE,MAAM;YACP;gBACC,MAAM;QACR,CAAC;IACF,CAAC;SAAM,IACN,KAAK,YAAY,KAAK;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAAC;YACvD,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,EAC/C,CAAC;QACF,IAAI,GAAG,qBAAqB,CAAC;QAC7B,OAAO,GAAG,iDAAiD,CAAC;IAC7D,CAAC;IACD,OAAO;QACN,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,6BAA6B;QACvC,aAAa;QACb,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;KACxB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAmC;IACxD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,iBAAiB,CAAC,aAAqB;IAC/C,OAAO;QACN,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,6BAA6B;QACvC,aAAa;QACb,KAAK,EAAE;YACN,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,+CAA+C;SACxD;KACD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,aAAqB;IAClD,OAAO,IAAI,eAAe,CAAC,sBAAsB,aAAa,6BAA6B,EAAE,aAAa,EAAE;QAC3G,MAAM,EAAE,wBAAwB;QAChC,SAAS,EAAE,KAAK;KAChB,CAAC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,aAAa,CAAC,OAAqB,EAAE,OAAe,EAAE,IAAyB;IAC7F,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,SAAS,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,uBAAuB;IAI/B,OAAO;QACN,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,oFAAoF;KAC7F,CAAC;AACH,CAAC;AAED,MAAM,OAAO,wBAAwB;IACnB,MAAM,CAA+B;IACrC,OAAO,CAAe;IACtB,OAAO,CAA2B;IAClC,GAAG,CAAe;IAClB,KAAK,CAA+D;IACpE,KAAK,CAAgB;IACrB,aAAa,CAAgE;IAC7E,WAAW,CAA8D;IAClF,OAAO,GAAqC,IAAI,CAAC;IACjD,eAAe,GAA2B,IAAI,CAAC;IAC/C,UAAU,GAAG,CAAC,CAAC;IAEvB,YAAY,OAAwC;QACnD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,KAAK;YACT,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,uBAAuB,CAAC;IACnE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC/B,sBAA+B;QAE/B,MAAM,aAAa,GAAG,MAAM,8BAA8B,CACzD,IAAI,CAAC,OAAO,EACZ,sBAAsB,CACtB,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC3D,MAAM,EACN,aAAa,EACb,IAAI,CAAC,OAAO,CACZ,CAAC;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;IACtC,CAAC;IAEO,gBAAgB,CACvB,aAAqB,EACrB,IAA6B,EAC7B,SAAkB;QAElB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACnE,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,cAAc,GAAG,SAAS;YAC/B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,iCAAiC,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,GAAG,GAAG,iCAAiC,CAAC;QAC3C,MAAM,QAAQ,GAAgE;YAC7E,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,6BAA6B;YACvC,aAAa;YACb,IAAI;YACJ,YAAY,EAAE,IAAI,IAAI,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;SACpD,CAAC;QACF,IAAI,SAAS;YAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QACxE,OAAO,QAAQ,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,aAAqB;QACtD,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,oCAAoC,EAAE,GAAG,EAAE,CACvG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAC7C,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,2CAA2C,EAAE,GAAG,EAAE,CACzG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAC9D,CAAC;QACF,IAAI,CAAC,OAAO;YACX,kBAAkB,IAAI,aAAa;gBAClC,CAAC,CAAC;oBACA,MAAM,EAAE,YAAY;oBACpB,QAAQ,EAAE,6BAA6B;oBACvC,aAAa;iBACb;gBACF,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACrC,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,sBAA+B;QAC7C,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,OAAO,EAAE,aAAa,KAAK,aAAa,EAAE,CAAC;YACnD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/E,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,IACC,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW;gBACnC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EACjD,CAAC;gBACF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;QACF,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACtE,IAAI,WAAW,EAAE,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YACjE,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC3F,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,YAAY,GAAG,WAAW,CAAC,YAAY,CAAC;YAC9C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC5C,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC;oBAC7C,UAAU;oBACV,YAAY;oBACZ,OAAO,EAAE,IAAI,CAAC,OAAO;iBACrB,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBACtD,OAAO,IAAI,CAAC;YACb,CAAC,CAAC,CAAC;YACH,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;gBAC9F,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,IACC,WAAW,CAAC,OAAO,YAAY,wBAAwB;gBACvD,WAAW,CAAC,OAAO,CAAC,UAAU,KAAK,iBAAiB,EACnD,CAAC;gBACF,OAAO,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,aAAa,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;YAC7D,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,2CAA2C,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7J,IAAI,CAAC,OAAO,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;YAChD,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,OAAO,GAAG;YACd,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,6BAA6B;YACvC,aAAa;SACb,CAAC;QACF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,sBAA+B;QAC1C,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC;QACrC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QAEvC,IAAI,aAAa,GAAG,sBAAsB,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;YACvE,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;YACvC,IAAI,CAAC,OAAO,GAAG;gBACd,MAAM,EAAE,YAAY;gBACpB,QAAQ,EAAE,6BAA6B;gBACvC,aAAa;aACb,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC;gBAC7C,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,QAAQ,EAAE,6BAA6B;gBACvC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,eAAe,CAAC,MAAM;gBAC9B,GAAG,EAAE,IAAI,CAAC,GAAG;aACb,CAAC,CAAC;YACH,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACxE,IAAI,CAAC,OAAO,GAAG;gBACd,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,6BAA6B;gBACvC,aAAa;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,eAAe,EAAE,IAAI,CAAC,eAAe;gBACrC,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;gBACrD,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;aAClF,CAAC;YACF,KAAK,IAAI,CAAC,gBAAgB,CACzB,UAAU,EACV,QAAQ,CAAC,UAAU,EACnB,aAAa,EACb,IAAI,EACJ,eAAe,CAAC,MAAM,CACtB,CAAC;YACF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC;QACrC,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzD,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,UAAkB,EAClB,UAAkB,EAClB,aAAqB,EACrB,IAA6B,EAC7B,MAAmB;QAEnB,IAAI,YAAY,GAAG,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;YACxC,OAAO,UAAU,KAAK,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC1D,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,GAAG,KAAK,EAAE,CAAC;oBACnE,MAAM,IAAI,wBAAwB,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;gBACrF,CAAC;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;gBACvC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;oBAC5C,UAAU;oBACV,QAAQ,EAAE,6BAA6B;oBACvC,IAAI;oBACJ,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM;oBACN,UAAU,EAAE,YAAY;iBACxB,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACjC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;oBACnC,SAAS;gBACV,CAAC;gBAED,MAAM,IAAI,GAAG,MAAM,0BAA0B,CAAC;oBAC7C,UAAU;oBACV,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY;oBACvC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM;iBACN,CAAC,CAAC;gBACH,MAAM,oBAAoB,CAAC;oBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,aAAa;oBACb,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,IAAI;oBACJ,KAAK,EAAE,IAAI,CAAC,KAAK;iBACjB,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBACtD,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAC3C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAClF,OAAO;YACR,CAAC;QACF,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO;QACvB,IAAI,UAAU,KAAK,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO;QAC5E,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,MAAM;QACX,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,WAAW;YAAE,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5E,MAAM,aAAa,GAClB,IAAI,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,MAAM,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,GAAG;YACd,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,6BAA6B;YACvC,aAAa;SACb,CAAC;QACF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,sBAA+B;QAC5C,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,aAAa,GAAG,sBAAsB,EAAE,IAAI,EAAE,IAAI,YAAY,CAAC;QACnE,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,KAAK,IAAwC,EAAE;YACpF,aAAa,GAAG,MAAM,8BAA8B,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YAE3F,IAAI,gBAAgB,GACnB,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,aAAa,CAAC;YACtF,IAAI,YAAgC,CAAC;YACrC,+GAA+G;YAC/G,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC3C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,0BAA0B,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC9E,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,gBAAgB,KAAK,OAAO,CAC3B,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,IAAI,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,qBAAqB,CACnG,CAAC;gBACF,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;gBACzF,IAAI,eAAe,CAAC,EAAE,EAAE,CAAC;oBACxB,IAAI,eAAe,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;wBAC/C,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;wBAClD,gBAAgB,GAAG,IAAI,CAAC;oBACzB,CAAC;gBACF,CAAC;qBAAM,CAAC;oBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACjI,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5H,CAAC;YACD,gEAAgE;YAChE,iEAAiE;YACjE,8DAA8D;YAE9D,MAAM,kBAAkB,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,6CAA6C,EAAE,GAAG,EAAE,CAChH,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAC7C,CAAC;YACF,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,oDAAoD,EAAE,GAAG,EAAE,CAClH,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAC9D,CAAC;YACF,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,IAAI,CAAC,OAAO,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;gBAChD,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YAED,IAAI,OAAgF,CAAC;YACrF,IAAI,gBAAgB,EAAE,CAAC;gBACtB,IAAI,CAAC,YAAY,EAAE,CAAC;oBACnB,OAAO,GAAG,uBAAuB,EAAE,CAAC;gBACrC,CAAC;qBAAM,CAAC;oBACP,MAAM,KAAK,GAAG,YAAY,CAAC;oBAC3B,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;wBAC3C,MAAM,UAAU,GAAG,MAAM,mCAAmC,CAC3D,MAAM,EACN,aAAa,EACb,IAAI,CAAC,OAAO,CACZ,CAAC;wBACF,IAAI,CAAC,UAAU;4BAAE,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;wBAC3D,OAAO,gCAAgC,CAAC;4BACvC,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,UAAU;4BACV,YAAY,EAAE,KAAK;4BACnB,OAAO,EAAE,IAAI,CAAC,OAAO;yBACrB,CAAC,CAAC;oBACJ,CAAC,CAAC,CAAC;oBACH,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;wBACnB,IAAI,CAAC,UAAU,CAAC,KAAK;4BAAE,OAAO,GAAG,uBAAuB,EAAE,CAAC;oBAC5D,CAAC;yBAAM,CAAC;wBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBACpG,OAAO,GAAG,uBAAuB,EAAE,CAAC;oBACrC,CAAC;gBACF,CAAC;YACF,CAAC;YAED,MAAM,SAAS,GAAiE;gBAC/E,MAAM,EAAE,YAAY;gBACpB,QAAQ,EAAE,6BAA6B;gBACvC,aAAa;aACb,CAAC;YACF,IAAI,OAAO;gBAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC;YACzC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YACzB,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,IAAI,eAAe,CAAC,EAAE;YAAE,OAAO,eAAe,CAAC,KAAK,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,aAAa,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;QACjE,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;CACD;AAED,MAAM,CAAC,OAAO,OAAO,mCAAoC,SAAQ,wBAAwB;IACxF,YAAY,UAA6B,EAAE,OAAoB;QAC9D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,eAAe,CAAC,8CAA8C,EAAE,UAAU,EAAE;gBACrF,MAAM,EAAE,0BAA0B;gBAClC,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,iCAAiC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,eAAe,CAAC,QAAQ,KAAK,6BAA6B,EAAE,CAAC;YAChE,MAAM,IAAI,eAAe,CAAC,2CAA2C,eAAe,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE;gBACjH,MAAM,EAAE,mCAAmC;gBAC3C,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;QACD,iFAAiF;QACjF,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAuB,EAAE,CAAC,CAAC;IACrD,CAAC;CACD"}

package/dist/device-session/device-session.state.d.ts

@@ -0,0 +1,8 @@
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import type { AuthAuthorityState } from '../schemas/authority-state.ts';
+/** Compatibility type; the registered semantic auth client owns this state. */
+export type DeviceSessionState = AuthAuthorityState;
+export declare function deviceSessionState(runtime: RuntimeRef): Promise<DeviceSessionState>;
+/** In-flight reads observe the epoch change and reload the current login. */
+export declare function invalidateDeviceSession(runtime: RuntimeRef, environmentId?: string): void;
+//# sourceMappingURL=device-session.state.d.ts.map

package/dist/device-session/device-session.state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-session.state.d.ts","sourceRoot":"","sources":["../../src/device-session/device-session.state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,KAAK,EAAuB,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAQ7F,+EAA+E;AAC/E,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAEpD,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEzF;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAmBzF"}

package/dist/device-session/device-session.state.js

@@ -0,0 +1,32 @@
+import { getVibesClient, tryGetVibesClient } from '@vibesdotdev/kernel/client';
+import { DEVICE_SESSION_STORE_ID } from "./device-session.store.descriptor.js";
+export async function deviceSessionState(runtime) {
+    return (await getVibesClient('auth', runtime)).authorityState;
+}
+/** In-flight reads observe the epoch change and reload the current login. */
+export function invalidateDeviceSession(runtime, environmentId) {
+    const state = tryGetVibesClient('auth', runtime)?.authorityState;
+    if (!state)
+        return;
+    state.epoch++;
+    const id = environmentId?.trim();
+    if (id)
+        state.bearers.delete(id);
+    else
+        state.bearers.clear();
+    // The store mirrors bearers across scope-patch authority generations (see
+    // device-session.store.ts); sign-in/out clears the mirror too, so a later
+    // generation can never serve a retired login. peek is synchronous, and a
+    // store that was never materialized holds no mirror.
+    if (runtime.hasKind('secrets/store')) {
+        const store = runtime
+            .query('secrets/store')
+            .withId(DEVICE_SESSION_STORE_ID)
+            .peek?.();
+        if (id)
+            store?.clearRetainedBearer?.(id);
+        else
+            store?.clearRetainedBearer?.();
+    }
+}
+//# sourceMappingURL=device-session.state.js.map

package/dist/device-session/device-session.state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-session.state.js","sourceRoot":"","sources":["../../src/device-session/device-session.state.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAU/E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAmB;IAC3D,OAAO,CAAC,MAAM,cAAc,CAAsB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;AACpF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CAAC,OAAmB,EAAE,aAAsB;IAClF,MAAM,KAAK,GAAG,iBAAiB,CAAsB,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC;IACtF,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,MAAM,EAAE,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,EAAE;QAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;;QAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC3B,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,qDAAqD;IACrD,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO;aACnB,KAAK,CAAkD,eAAe,CAAC;aACvE,MAAM,CAAC,uBAAuB,CAAC;aAC/B,IAAI,EAAE,EAAE,CAAC;QACX,IAAI,EAAE;YAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE,CAAC,CAAC;;YACpC,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAAC;IACrC,CAAC;AACF,CAAC"}