@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/device-session/device-session.store.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The `auth/device-session` secrets store (rc05 §2.2-§2.3; rc01 §2.1).
+ *
+ * `get(tier, 'VIBES_AUTH_TOKEN')` answers the app bearer for the stored
+ * `vibes auth login` of the environment this host calls. The tier argument is
+ * not the partition: the login is partitioned by the environment it was stored
+ * under (rc01 B17), which `resolveCredentialEnvironmentId` names.
+ *
+ * The bearer is minted from the stored credential by `resolveAppJwt` and kept
+ * per runtime. A minted JWT is re-minted on the first read inside two minutes
+ * of its `exp`; an opaque durable credential never decays. No read ever sees
+ * the process environment: a host-provided bearer comes through
+ * `host-credentials` on a `hostCredentials` host instead.
+ *
+ * The minted Bearer [REDACTED] also retained on this store instance. The kernel
+ * isolates retained `runtime/client` instances per declared scope, so a
+ * `patchDeclaredScope` constructs a fresh auth client with an empty bearer
+ * map even though the stored login never changed. The store's own impl cache
+ * is scope-independent, so the mirror carries still-usable bearers across
+ * those generations without re-opening the credential store. Sign-in and
+ * sign-out clear the mirror through `invalidateDeviceSession`, so a later
+ * generation can never serve a retired login.
+ *
+ * Failures:
+ * - no stored login: `undefined`, which the kernel reports as `NOT_FOUND`
+ *   `credential-not-set`;
+ * - the stored login, or the only bearer it yields, has expired:
+ *   `AUTH_REQUIRED` `session-expired`;
+ * - a session login whose app-JWT exchange failed, with no still-valid bearer
+ *   to keep: `UNAVAILABLE` `refresh-failed`.
+ */
+import { type KindContext, type RuntimeDescriptor } from '@vibesdotdev/kernel';
+import type { AuthAuthorityState } from '../schemas/authority-state.ts';
+export { invalidateDeviceSession } from './device-session.state.ts';
+export default class DeviceSessionStore {
+    readonly id = "auth/device-session";
+    readonly descriptor: RuntimeDescriptor;
+    private readonly runtime;
+    /**
+     * Bearer [REDACTED] that survives scope-patch authority generations (see the
+     * module comment), with the generation it was baselined against. This
+     * instance is kernel-cached independently of declared scope; it is never
+     * ambient, never persisted, and never shared between runtimes.
+     */
+    private readonly retainedBearers;
+    private retainedAuthority?;
+    private retainedEpoch?;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
+    private environmentId;
+    /**
+     * A still-usable Bearer [REDACTED] environment that needs no credential-store
+     * read, if one survived. A new authority generation (a scope patch
+     * re-created `runtime/client#auth`) keeps the mirror: the stored login it
+     * was minted from never changed, and the fresh generation's map is seeded
+     * so its own invalidation keeps working. An epoch bump within one
+     * generation (sign-in, sign-out, verdict drop) retires every mirror entry
+     * the authority map no longer holds.
+     */
+    peekRetainedBearer(state: AuthAuthorityState, environmentId: string): string | undefined;
+    /** Remember a freshly read Bearer [REDACTED] the authority map and the mirror. */
+    retainBearer(state: AuthAuthorityState, environmentId: string, token: string): void;
+    /** Forget a Bearer [REDACTED] both maps (no login, expired, unusable). */
+    forgetBearer(state: AuthAuthorityState, environmentId: string): void;
+    /**
+     * Sign-in/out entrypoint: drop this environment's (or every) retained
+     * bearer, so a later authority generation can never serve a retired login.
+     * Called synchronously from `invalidateDeviceSession`.
+     */
+    clearRetainedBearer(environmentId?: string): void;
+    get(_tier: string, key: string): Promise<string | undefined>;
+    getAll(tier: string): Promise<Record<string, string>>;
+    list(_tier: string): Promise<Array<{
+        key: string;
+        hasValue: boolean;
+        source: string;
+    }>>;
+    set(): Promise<void>;
+    unset(): Promise<void>;
+    setAll(): Promise<void>;
+}
+//# sourceMappingURL=device-session.store.d.ts.map

package/dist/device-session/device-session.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-session.store.d.ts","sourceRoot":"","sources":["../../src/device-session/device-session.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAUhG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAOxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAgHpE,MAAM,CAAC,OAAO,OAAO,kBAAkB;IACtC,QAAQ,CAAC,EAAE,yBAA2B;IACtC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAC7D,OAAO,CAAC,iBAAiB,CAAC,CAAqB;IAC/C,OAAO,CAAC,aAAa,CAAC,CAAS;gBAEnB,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW;IAQ/D,OAAO,CAAC,aAAa;IAIrB;;;;;;;;OAQG;IACH,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAgBxF,kFAAkF;IAClF,YAAY,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAKnF,0EAA0E;IAC1E,YAAY,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,GAAG,IAAI;IAKpE;;;;OAIG;IACH,mBAAmB,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IAM3C,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAK5D,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAKrD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAOvF,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAIpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/device-session/device-session.store.descriptor.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `auth/device-session`: the `secrets/store` that answers the signed-in
+ * user's bearer on an `interactiveSession` host (rc05 §2.2-§2.3).
+ *
+ * It is `selection: 'by-id'`, so scope resolution never picks it and it never
+ * shadows `encrypted-local`; `resolveCallerBearer` names it in the reference.
+ * It answers only `VIBES_AUTH_TOKEN`, from the active profile's stored
+ * `vibes auth login`, partitioned by the environment the login was stored
+ * under (rc01 B17: never by the declared tier).
+ *
+ * `backend` is this store's own open id (rc05 §2.3). `priority` orders only
+ * scope stores, so it does not apply here.
+ */
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel';
+export declare const DEVICE_SESSION_STORE_ID = "auth/device-session";
+/** The one key this store answers. */
+export declare const DEVICE_SESSION_BEARER_KEY = "VIBES_AUTH_TOKEN";
+/** The `secrets/store` descriptor fields this store declares (auth does not depend on secrets). */
+type DeviceSessionStoreDescriptor = RuntimeDescriptor & {
+    backend: string;
+    selection: 'by-id';
+    tiers: string[];
+    priority: number;
+};
+declare const deviceSessionStoreDescriptor: DeviceSessionStoreDescriptor;
+export default deviceSessionStoreDescriptor;
+//# sourceMappingURL=device-session.store.descriptor.d.ts.map

package/dist/device-session/device-session.store.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-session.store.descriptor.d.ts","sourceRoot":"","sources":["../../src/device-session/device-session.store.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,sCAAsC;AACtC,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D,mGAAmG;AACnG,KAAK,4BAA4B,GAAG,iBAAiB,GAAG;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,QAAA,MAAM,4BAA4B,EAAE,4BAYnC,CAAC;AAEF,eAAe,4BAA4B,CAAC"}

package/dist/device-session/device-session.store.descriptor.js

@@ -0,0 +1,30 @@
+/**
+ * `auth/device-session`: the `secrets/store` that answers the signed-in
+ * user's bearer on an `interactiveSession` host (rc05 §2.2-§2.3).
+ *
+ * It is `selection: 'by-id'`, so scope resolution never picks it and it never
+ * shadows `encrypted-local`; `resolveCallerBearer` names it in the reference.
+ * It answers only `VIBES_AUTH_TOKEN`, from the active profile's stored
+ * `vibes auth login`, partitioned by the environment the login was stored
+ * under (rc01 B17: never by the declared tier).
+ *
+ * `backend` is this store's own open id (rc05 §2.3). `priority` orders only
+ * scope stores, so it does not apply here.
+ */
+export const DEVICE_SESSION_STORE_ID = 'auth/device-session';
+/** The one key this store answers. */
+export const DEVICE_SESSION_BEARER_KEY = 'VIBES_AUTH_TOKEN';
+const deviceSessionStoreDescriptor = {
+    id: DEVICE_SESSION_STORE_ID,
+    kind: 'secrets/store',
+    name: 'Device session',
+    description: "The signed-in user's app bearer from the stored `vibes auth login`, reachable only by id.",
+    tags: ['auth', 'identity-scoped', 'by-id'],
+    enabled: true,
+    backend: 'auth/device-session',
+    selection: 'by-id',
+    tiers: ['local', 'dev', 'staging', 'production'],
+    priority: 0
+};
+export default deviceSessionStoreDescriptor;
+//# sourceMappingURL=device-session.store.descriptor.js.map

package/dist/device-session/device-session.store.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-session.store.descriptor.js","sourceRoot":"","sources":["../../src/device-session/device-session.store.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE7D,sCAAsC;AACtC,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAU5D,MAAM,4BAA4B,GAAiC;IAClE,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,gBAAgB;IACtB,WAAW,EACV,2FAA2F;IAC5F,IAAI,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,CAAC;IAC1C,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,qBAAqB;IAC9B,SAAS,EAAE,OAAO;IAClB,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC;IAChD,QAAQ,EAAE,CAAC;CACX,CAAC;AAEF,eAAe,4BAA4B,CAAC"}

package/dist/device-session/device-session.store.js

@@ -0,0 +1,225 @@
+/**
+ * The `auth/device-session` secrets store (rc05 §2.2-§2.3; rc01 §2.1).
+ *
+ * `get(tier, 'VIBES_AUTH_TOKEN')` answers the app bearer for the stored
+ * `vibes auth login` of the environment this host calls. The tier argument is
+ * not the partition: the login is partitioned by the environment it was stored
+ * under (rc01 B17), which `resolveCredentialEnvironmentId` names.
+ *
+ * The bearer is minted from the stored credential by `resolveAppJwt` and kept
+ * per runtime. A minted JWT is re-minted on the first read inside two minutes
+ * of its `exp`; an opaque durable credential never decays. No read ever sees
+ * the process environment: a host-provided bearer comes through
+ * `host-credentials` on a `hostCredentials` host instead.
+ *
+ * The minted Bearer [REDACTED] also retained on this store instance. The kernel
+ * isolates retained `runtime/client` instances per declared scope, so a
+ * `patchDeclaredScope` constructs a fresh auth client with an empty bearer
+ * map even though the stored login never changed. The store's own impl cache
+ * is scope-independent, so the mirror carries still-usable bearers across
+ * those generations without re-opening the credential store. Sign-in and
+ * sign-out clear the mirror through `invalidateDeviceSession`, so a later
+ * generation can never serve a retired login.
+ *
+ * Failures:
+ * - no stored login: `undefined`, which the kernel reports as `NOT_FOUND`
+ *   `credential-not-set`;
+ * - the stored login, or the only bearer it yields, has expired:
+ *   `AUTH_REQUIRED` `session-expired`;
+ * - a session login whose app-JWT exchange failed, with no still-valid bearer
+ *   to keep: `UNAVAILABLE` `refresh-failed`.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { resolveAppJwt } from "../client/app-authority.js";
+import { decodeJWTUnsafe } from "../jwt/index.js";
+import { isCredentialStoreRuntime, loadStoredCredentials, resolveCredentialEnvironmentId } from "../features/services/credential-store.js";
+import { DEVICE_SESSION_BEARER_KEY, DEVICE_SESSION_STORE_ID } from "./device-session.store.descriptor.js";
+import { deviceSessionState } from "./device-session.state.js";
+export { invalidateDeviceSession } from "./device-session.state.js";
+/** A minted JWT is re-minted on the first read this long before its `exp`. */
+const REFRESH_LEAD_MS = 2 * 60_000;
+function jwtExpiryMs(token) {
+    const exp = decodeJWTUnsafe(token)?.exp;
+    return exp === undefined ? null : exp * 1000;
+}
+function isUsable(token, nowMs) {
+    const expiresAtMs = jwtExpiryMs(token);
+    return expiresAtMs === null || expiresAtMs - nowMs >= REFRESH_LEAD_MS;
+}
+function isUnexpired(token, nowMs) {
+    const expiresAtMs = jwtExpiryMs(token);
+    return expiresAtMs === null || expiresAtMs > nowMs;
+}
+function sessionExpired(environmentId) {
+    return new CapabilityError('The stored sign-in has expired.', 'AUTH_REQUIRED', {
+        reason: 'session-expired',
+        recoveryHint: 'Run: vibes auth login',
+        details: { store: DEVICE_SESSION_STORE_ID, environment: environmentId }
+    });
+}
+function refreshFailed(environmentId) {
+    return new CapabilityError('Vibes Auth did not exchange the stored sign-in for an app bearer.', 'UNAVAILABLE', {
+        reason: 'refresh-failed',
+        retryable: true,
+        recoveryHint: 'Check that Vibes Auth is reachable, then retry. If it keeps failing, run: vibes auth login',
+        details: { store: DEVICE_SESSION_STORE_ID, environment: environmentId }
+    });
+}
+async function readBearer(runtime, environmentId, store) {
+    const state = await deviceSessionState(runtime);
+    const cached = state.bearers.get(environmentId);
+    if (cached !== undefined && isUsable(cached, Date.now()))
+        return cached;
+    // A scope patch re-created runtime/client#auth with an empty bearer map
+    // while the stored login never changed: serve a still-usable retained
+    // Bearer [REDACTED] of re-opening the credential store.
+    const retained = store.peekRetainedBearer(state, environmentId);
+    if (retained !== undefined)
+        return retained;
+    const epoch = state.epoch;
+    const loaded = new Array();
+    const token = (await resolveAppJwt({
+        runtime,
+        environment: environmentId,
+        loadCredentials: async () => {
+            const credential = await loadStoredCredentials(runtime, environmentId);
+            loaded.push(credential);
+            return credential;
+        }
+    }))?.trim();
+    // A sign-in or sign-out landed while this read was loading: what it loaded
+    // may be the login that was just replaced, so read the current one.
+    if (state.epoch !== epoch)
+        return readBearer(runtime, environmentId, store);
+    if (!token) {
+        store.forgetBearer(state, environmentId);
+        return undefined;
+    }
+    const nowMs = Date.now();
+    const loadedCredential = loaded.at(-1) ?? null;
+    const storedExpiry = loadedCredential?.expiresAt ? Date.parse(loadedCredential.expiresAt) : Number.NaN;
+    if (Number.isFinite(storedExpiry) && storedExpiry <= nowMs) {
+        store.forgetBearer(state, environmentId);
+        throw sessionExpired(environmentId);
+    }
+    // A session login yields the raw session token when the exchange fails. That
+    // is not an app bearer (apps accept a JWT or a real API key), so keep the
+    // previous JWT while it is still valid and exchange again on the next read.
+    if (loadedCredential?.type === 'session' && jwtExpiryMs(token) === null) {
+        if (cached !== undefined && jwtExpiryMs(cached) !== null && isUnexpired(cached, nowMs)) {
+            return cached;
+        }
+        throw refreshFailed(environmentId);
+    }
+    if (!isUnexpired(token, nowMs)) {
+        store.forgetBearer(state, environmentId);
+        throw sessionExpired(environmentId);
+    }
+    store.retainBearer(state, environmentId, token);
+    return token;
+}
+function readOnly(operation) {
+    return new CapabilityError(`The ${DEVICE_SESSION_STORE_ID} store is read-only; ${operation} goes through vibes auth.`, 'INTERNAL', {
+        reason: 'store-read-only',
+        recoveryHint: 'Run: vibes auth login, or vibes auth logout',
+        details: { store: DEVICE_SESSION_STORE_ID }
+    });
+}
+export default class DeviceSessionStore {
+    id = DEVICE_SESSION_STORE_ID;
+    descriptor;
+    runtime;
+    /**
+     * Bearer [REDACTED] that survives scope-patch authority generations (see the
+     * module comment), with the generation it was baselined against. This
+     * instance is kernel-cached independently of declared scope; it is never
+     * ambient, never persisted, and never shared between runtimes.
+     */
+    retainedBearers = new Map();
+    retainedAuthority;
+    retainedEpoch;
+    constructor(descriptor, context) {
+        if (!isCredentialStoreRuntime(context?.runtime)) {
+            throw new CapabilityError(`${DEVICE_SESSION_STORE_ID} needs the runtime that composed it.`, 'INTERNAL');
+        }
+        this.descriptor = descriptor;
+        this.runtime = context.runtime;
+    }
+    environmentId() {
+        return resolveCredentialEnvironmentId(this.runtime);
+    }
+    /**
+     * A still-usable Bearer [REDACTED] environment that needs no credential-store
+     * read, if one survived. A new authority generation (a scope patch
+     * re-created `runtime/client#auth`) keeps the mirror: the stored login it
+     * was minted from never changed, and the fresh generation's map is seeded
+     * so its own invalidation keeps working. An epoch bump within one
+     * generation (sign-in, sign-out, verdict drop) retires every mirror entry
+     * the authority map no longer holds.
+     */
+    peekRetainedBearer(state, environmentId) {
+        if (this.retainedAuthority !== state) {
+            this.retainedAuthority = state;
+            this.retainedEpoch = state.epoch;
+        }
+        else if (this.retainedEpoch !== state.epoch) {
+            for (const [environment, token] of this.retainedBearers) {
+                if (state.bearers.get(environment) !== token)
+                    this.retainedBearers.delete(environment);
+            }
+            this.retainedEpoch = state.epoch;
+        }
+        const mirrored = this.retainedBearers.get(environmentId);
+        if (mirrored === undefined || !isUsable(mirrored, Date.now()))
+            return undefined;
+        state.bearers.set(environmentId, mirrored);
+        return mirrored;
+    }
+    /** Remember a freshly read Bearer [REDACTED] the authority map and the mirror. */
+    retainBearer(state, environmentId, token) {
+        state.bearers.set(environmentId, token);
+        this.retainedBearers.set(environmentId, token);
+    }
+    /** Forget a Bearer [REDACTED] both maps (no login, expired, unusable). */
+    forgetBearer(state, environmentId) {
+        state.bearers.delete(environmentId);
+        this.retainedBearers.delete(environmentId);
+    }
+    /**
+     * Sign-in/out entrypoint: drop this environment's (or every) retained
+     * bearer, so a later authority generation can never serve a retired login.
+     * Called synchronously from `invalidateDeviceSession`.
+     */
+    clearRetainedBearer(environmentId) {
+        const id = environmentId?.trim();
+        if (id)
+            this.retainedBearers.delete(id);
+        else
+            this.retainedBearers.clear();
+    }
+    async get(_tier, key) {
+        if (key !== DEVICE_SESSION_BEARER_KEY)
+            return undefined;
+        return readBearer(this.runtime, await this.environmentId(), this);
+    }
+    async getAll(tier) {
+        const bearer = await this.get(tier, DEVICE_SESSION_BEARER_KEY);
+        return bearer === undefined ? {} : { [DEVICE_SESSION_BEARER_KEY]: bearer };
+    }
+    async list(_tier) {
+        const stored = await loadStoredCredentials(this.runtime, await this.environmentId());
+        return [
+            { key: DEVICE_SESSION_BEARER_KEY, hasValue: Boolean(stored?.token), source: DEVICE_SESSION_STORE_ID }
+        ];
+    }
+    async set() {
+        throw readOnly('signing in');
+    }
+    async unset() {
+        throw readOnly('signing out');
+    }
+    async setAll() {
+        throw readOnly('signing in');
+    }
+}
+//# sourceMappingURL=device-session.store.js.map

package/dist/device-session/device-session.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-session.store.js","sourceRoot":"","sources":["../../src/device-session/device-session.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,eAAe,EAA4C,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EACN,wBAAwB,EACxB,qBAAqB,EACrB,8BAA8B,EAE9B,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EACN,yBAAyB,EACzB,uBAAuB,EACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC;AAEnC,SAAS,WAAW,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACxC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,KAAa;IAC7C,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,GAAG,KAAK,IAAI,eAAe,CAAC;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa;IAChD,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,GAAG,KAAK,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,aAAqB;IAC5C,OAAO,IAAI,eAAe,CAAC,iCAAiC,EAAE,eAAe,EAAE;QAC9E,MAAM,EAAE,iBAAiB;QACzB,YAAY,EAAE,uBAAuB;QACrC,OAAO,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE;KACvE,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,aAAqB;IAC3C,OAAO,IAAI,eAAe,CACzB,mEAAmE,EACnE,aAAa,EACb;QACC,MAAM,EAAE,gBAAgB;QACxB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,4FAA4F;QAC1G,OAAO,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,aAAa,EAAE;KACvE,CACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,OAA+B,EAC/B,aAAqB,EACrB,KAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAChE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAE5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,KAAK,EAAyB,CAAC;IAClD,MAAM,KAAK,GAAG,CACb,MAAM,aAAa,CAAC;QACnB,OAAO;QACP,WAAW,EAAE,aAAa;QAC1B,eAAe,EAAE,KAAK,IAAI,EAAE;YAC3B,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,OAAO,UAAU,CAAC;QACnB,CAAC;KACD,CAAC,CACF,EAAE,IAAI,EAAE,CAAC;IACV,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IAE5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACzC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/C,MAAM,YAAY,GAAG,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACvG,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;QAC5D,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACzC,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,IAAI,gBAAgB,EAAE,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QACzE,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACxF,OAAO,MAAM,CAAC;QACf,CAAC;QACD,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACzC,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IAClC,OAAO,IAAI,eAAe,CACzB,OAAO,uBAAuB,wBAAwB,SAAS,2BAA2B,EAC1F,UAAU,EACV;QACC,MAAM,EAAE,iBAAiB;QACzB,YAAY,EAAE,6CAA6C;QAC3D,OAAO,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE;KAC3C,CACD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,kBAAkB;IAC7B,EAAE,GAAG,uBAAuB,CAAC;IAC7B,UAAU,CAAoB;IACtB,OAAO,CAAyB;IACjD;;;;;OAKG;IACc,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,iBAAiB,CAAsB;IACvC,aAAa,CAAU;IAE/B,YAAY,UAA6B,EAAE,OAAoB;QAC9D,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,eAAe,CAAC,GAAG,uBAAuB,sCAAsC,EAAE,UAAU,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,CAAC;IAEO,aAAa;QACpB,OAAO,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;OAQG;IACH,kBAAkB,CAAC,KAAyB,EAAE,aAAqB;QAClE,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;YAC/B,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC;QAClC,CAAC;aAAM,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/C,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBACzD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK;oBAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC;QAClC,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QAChF,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,kFAAkF;IAClF,YAAY,CAAC,KAAyB,EAAE,aAAqB,EAAE,KAAa;QAC3E,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,0EAA0E;IAC1E,YAAY,CAAC,KAAyB,EAAE,aAAqB;QAC5D,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACpC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,mBAAmB,CAAC,aAAsB;QACzC,MAAM,EAAE,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;QACjC,IAAI,EAAE;YAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;;YACnC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,GAAW;QACnC,IAAI,GAAG,KAAK,yBAAyB;YAAE,OAAO,SAAS,CAAC;QACxD,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAY;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC/D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACvB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACrF,OAAO;YACN,EAAE,GAAG,EAAE,yBAAyB,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE;SACrG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG;QACR,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,KAAK;QACV,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM;QACX,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;CACD"}

package/dist/docs/auth.docs.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { DocsTopicDescriptor } from '@vibesdotdev/docs-contracts';
+declare const descriptor: DocsTopicDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.docs.descriptor.d.ts.map

package/dist/docs/auth.docs.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.docs.descriptor.d.ts","sourceRoot":"","sources":["../../src/docs/auth.docs.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAmCvE,QAAA,MAAM,UAAU,EAAE,mBAejB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/docs/auth.docs.descriptor.js

@@ -0,0 +1,50 @@
+const authMarkdown = `---
+title: Auth
+summary: Flows, sessions, OAuth, and providers.
+parent: 
+order: 3
+---
+
+# Auth
+
+Flows, sessions, OAuth, and providers. Authentication is built on Better Auth with JWT session handles; providers (including OAuth) plug in through the runtime.
+
+## When to use
+
+Reach for auth when your app needs to identify the caller, gate a route or worker, or talk to another service on the user's behalf — sign-in flows, session validation, OAuth connections, and the credential each request authenticates with.
+
+## How it resolves
+
+Auth is a runtime-resolved capability: the active provider is registered as kind \`auth/provider\` and selected by the current scope (the DB provider is server-only; the API provider is the default for CLI/consumer contexts). App code never picks one by hand — it queries the runtime:
+
+\`\`\`ts
+// runtime is the one your host handed you (event.locals.runtime, context.runtime).
+const authProvider = await runtime.query('auth/provider').first();
+\`\`\`
+
+:::card{title="In this section"}
+- [\`auth.flows\`](auth.flows) — Authentication Flows
+- [\`auth.sessions\`](auth.sessions) — Session Management
+- [\`auth.oauth\`](auth.oauth) — OAuth Authentication
+- [\`auth.providers\`](auth.providers) — Authentication Providers
+- [\`auth.keys\`](auth.keys) — Key Envelopes (did:key, recipient key bundles, sign-then-encrypt)
+:::
+`;
+const descriptor = {
+    kind: 'docs/topic',
+    id: 'auth',
+    title: 'Auth',
+    summary: "Flows, sessions, OAuth, and providers.",
+    body: {
+        type: 'markdown',
+        sourceType: 'raw',
+        source: authMarkdown
+    },
+    order: 3,
+    tags: ['auth', 'overview'],
+    surfaces: ['web', 'in-app'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth.docs.descriptor.js.map

package/dist/docs/auth.docs.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.docs.descriptor.js","sourceRoot":"","sources":["../../src/docs/auth.docs.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BpB,CAAC;AAEF,MAAM,UAAU,GAAwB;IACvC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,MAAM;IACV,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,wCAAwC;IACjD,IAAI,EAAE;QACL,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,YAAY;KACpB;IACD,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;IAC1B,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;IAC3B,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/docs/auth.providers.docs.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { DocsTopicDescriptor } from '@vibesdotdev/docs-contracts';
+declare const descriptor: DocsTopicDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.providers.docs.descriptor.d.ts.map

package/dist/docs/auth.providers.docs.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.providers.docs.descriptor.d.ts","sourceRoot":"","sources":["../../src/docs/auth.providers.docs.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,QAAA,MAAM,UAAU,EAAE,mBA8KjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/docs/auth.providers.docs.descriptor.js

@@ -0,0 +1,177 @@
+const descriptor = {
+    kind: 'docs/topic',
+    id: 'auth.providers',
+    title: 'Authentication Providers',
+    summary: 'The auth/provider runtime kind: how the runtime authenticates to access resources',
+    body: {
+        type: 'markdown',
+        sourceType: 'raw',
+        source: `---
+id: auth.providers
+title: Authentication Providers
+summary: The auth/provider runtime kind — how the runtime authenticates to access resources
+tags: [auth, providers, runtime-kind, resolution]
+parent: auth
+order: 4
+surfaces: [cli, web, in-app]
+hardware: [consumer, cloud]
+---
+
+# Authentication Providers
+
+The \`auth/provider\` runtime kind controls **how the runtime authenticates to access resources** — not end-user login. A provider supplies an auth context (token + headers) that downstream API clients and tools attach to their requests.
+
+Two built-in providers are auto-discovered:
+
+- **\`api\`** — the default. Reads credentials from the auth config and authenticates over HTTP. Available in every scope (CLI, consumer, web).
+- **\`db\`** — direct database access for server-side operations. Only resolves on cloud hardware with the \`workers/worker\` surface; otherwise the runtime falls back to \`api\`.
+
+End-user concerns (email/password login, OAuth sign-in, sessions) live in the related topics linked at the bottom of this page.
+
+## Provider implementation interface
+
+Resolved providers implement \`AuthProviderImplementation\` (from \`@vibesdotdev/auth\`):
+
+\`\`\`ts
+import type {
+  AuthProviderImplementation,
+  AuthProviderDescriptor,
+  AuthProviderType,
+  AuthContext
+} from '@vibesdotdev/auth';
+
+interface AuthProviderImplementation {
+  readonly descriptor: AuthProviderDescriptor;
+  readonly type: AuthProviderType; // 'api' | 'db'
+
+  // Returns the auth context (token + headers) for outgoing requests
+  getAuthContext(): Promise<AuthContext>;
+
+  // Whether this provider can operate in the current scope
+  isAvailable(): Promise<boolean>;
+
+  // Validates that the current credentials authenticate successfully
+  validateCredentials(): Promise<{ valid: boolean; error?: string }>;
+
+  // Optional cleanup
+  dispose?(): Promise<void>;
+}
+\`\`\`
+
+\`getAuthContext()\` returns an \`AuthContext\`:
+
+\`\`\`ts
+interface AuthContext {
+  isAuthenticated: boolean;
+  userId?: string;
+  token?: string;
+  headers?: Record<string, string>;
+  error?: string;
+}
+\`\`\`
+
+## Provider descriptor
+
+Descriptors validate against \`AuthProviderDescriptorSchema\`. The shape is the runtime descriptor base plus auth-specific fields:
+
+\`\`\`ts
+import type { AuthProviderDescriptor } from '@vibesdotdev/auth';
+
+const apiProvider: AuthProviderDescriptor = {
+  kind: 'auth/provider',
+  id: 'api',
+  name: 'API Authentication',
+  description: 'HTTP-based authentication using credentials from auth config',
+  enabled: true,
+  type: 'api',          // 'api' | 'db'
+  isDefault: true,
+  api: {
+    tokenSource: 'config',         // 'config' | 'env' | 'static'
+    configKey: 'credentials.token',
+    headerName: 'Authorization',
+    tokenPrefix: 'Bearer'
+  },
+  priority: 0
+};
+\`\`\`
+
+The \`db\` provider constrains its scope so it never resolves on the client:
+
+\`\`\`ts
+const dbProvider: AuthProviderDescriptor = {
+  kind: 'auth/provider',
+  id: 'db',
+  name: 'Database Authentication',
+  enabled: true,
+  type: 'db',
+  isDefault: false,
+  hardware: ['cloud'],
+  surfaces: ['workers/worker'],
+  db: { useSessionContext: true, bypassAuth: false },
+  priority: -100
+};
+\`\`\`
+
+## Resolving the provider
+
+Consumers query the runtime; the kind's resolver picks the right provider for the current scope:
+
+\`\`\`ts
+import type { AuthProviderImplementation } from '@vibesdotdev/auth';
+
+const provider = (await runtime
+  .query('auth/provider')
+  .resolve()) as AuthProviderImplementation | null;
+
+if (provider && (await provider.isAvailable())) {
+  const ctx = await provider.getAuthContext();
+  if (ctx.isAuthenticated) {
+    // Attach ctx.headers to outgoing API requests, or read ctx.userId
+    const userId = ctx.userId;
+  }
+}
+\`\`\`
+
+### Resolution rules
+
+The resolver (\`resolveAuthProvider\`) applies these steps:
+
+1. Keep only descriptors where \`enabled !== false\`.
+2. Drop any whose \`hardware\` / \`surfaces\` constraints don't match the current scope. This is how \`db\` is excluded outside \`cloud\` + \`workers/worker\`.
+3. Prefer the descriptor with \`isDefault: true\` (the \`api\` provider).
+4. Otherwise pick the highest \`priority\` (descending).
+
+So in CLI/consumer/web scopes the \`api\` provider always wins; on a cloud worker, both are available and \`api\` still wins as the default unless code resolves \`db\` explicitly.
+
+## Registration
+
+There are no per-provider plugin factories. The auth runtime is registered as a single plugin that contributes the \`auth/provider\` kind plus the built-in \`api\` and \`db\` descriptors:
+
+\`\`\`ts
+import { authPlugin } from '@vibesdotdev/auth';
+
+await runtime.registerPlugin(authPlugin);
+\`\`\`
+
+\`authPlugin\` is the default export of \`@vibesdotdev/auth\`. It declares the \`auth/provider\` kind, registers the resolver and core slice plugins, and on non-cloud scopes also loads the auth CLI plugin.
+
+## Custom providers (OIDC / SAML)
+
+Custom sign-in providers (distinct from the \`auth/provider\` transport kind above) are modeled by \`CustomAuthProviderSchema\` and resolved through the \`auth/provider-custom\` kind, merged into the sign-in provider list by the auth-provider resolver. See [\`auth.oauth\`](auth.oauth) for configuring OAuth and custom OIDC/SAML sign-in providers.
+
+:::card{title="See also"}
+- [\`auth.flows\`](auth.flows) — Authentication flows
+- [\`auth.sessions\`](auth.sessions) — Session management
+- [\`auth.oauth\`](auth.oauth) — OAuth and custom sign-in providers
+:::
+`
+    },
+    parent: 'auth',
+    order: 4,
+    tags: ['auth', 'providers', 'runtime-kind', 'resolution'],
+    surfaces: ['cli', 'web', 'in-app'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth.providers.docs.descriptor.js.map

package/dist/docs/auth.providers.docs.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.providers.docs.descriptor.js","sourceRoot":"","sources":["../../src/docs/auth.providers.docs.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAwB;IACvC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,0BAA0B;IACjC,OAAO,EAAE,mFAAmF;IAC5F,IAAI,EAAE;QACL,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8JT;KACC;IACD,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC;IACzD,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;IAClC,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/docs/flows.docs.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { DocsTopicDescriptor } from '@vibesdotdev/docs-contracts';
+declare const descriptor: DocsTopicDescriptor;
+export default descriptor;
+//# sourceMappingURL=flows.docs.descriptor.d.ts.map

package/dist/docs/flows.docs.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flows.docs.descriptor.d.ts","sourceRoot":"","sources":["../../src/docs/flows.docs.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,QAAA,MAAM,UAAU,EAAE,mBA6LjB,CAAC;AAEF,eAAe,UAAU,CAAC"}