@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/docs/sessions.docs.descriptor.js

@@ -0,0 +1,295 @@
+const descriptor = {
+    kind: 'docs/topic',
+    id: 'auth.sessions',
+    title: 'Session Management',
+    summary: 'Session lifecycle, tokens, expiration, and refresh',
+    body: {
+        type: 'markdown',
+        sourceType: 'raw',
+        source: `---
+title: Session Management
+summary: Session lifecycle, tokens, expiration, and refresh
+tags: [auth, sessions, tokens, expiration, refresh]
+id: auth.sessions
+parent: auth
+order: 2
+surfaces: [cli, web, in-app]
+hardware: [consumer, cloud]
+---
+
+# Session Management
+
+Vibes auth is built on **better-auth**. Sessions are carried by a short-lived
+**JWT cookie** issued by \`auth.vibes.dev\` and refreshed transparently from a
+longer-lived better-auth session cookie. Consumer apps do not mint or store
+their own tokens — they verify the JWT against the auth origin's JWKS and read
+the principal off \`event.locals\`.
+
+There are two surfaces:
+
+- **Server (SvelteKit hooks)** — \`createJwtSessionHandle\` verifies the JWT
+  cookie (or a forwarded \`Authorization: Bearer\` JWT on service-to-service
+  calls) and populates \`event.locals.user\` / \`event.locals.session\`.
+- **Client (browser / CLI)** — the \`AuthApiClient\`, resolved through the
+  runtime, calls the auth origin's HTTP endpoints with \`credentials: 'include'\`.
+
+## Server-side: the session handle
+
+\`createJwtSessionHandle\` returns a SvelteKit \`Handle\`. Wire it into your app's
+\`hooks.server.ts\`:
+
+\`\`\`ts
+import { createJwtSessionHandle } from '@vibesdotdev/auth';
+
+export const handle = createJwtSessionHandle({
+  // Origin that issues + signs the JWT (where the JWKS lives).
+  authOrigin: 'https://auth.vibes.dev',
+  // Used to namespace the logger ("<clientName>.session").
+  clientName: 'platform-web'
+});
+\`\`\`
+
+\`JwtSessionHandleOptions\`:
+
+\`\`\`ts
+interface JwtSessionHandleOptions {
+  // Auth origin, or a getter resolving it lazily (e.g. per-env).
+  authOrigin: string | (() => string);
+  clientName?: string;
+  // Override how session/API-key auth RPCs are made. Defaults to a Cloudflare
+  // service binding named 'AUTH_SERVICE' when present, else global fetch.
+  // Pass null to force global fetch even when a binding exists.
+  fetcher?: ((input: URL | string | Request, init?: RequestInit) => Promise<Response>) | null;
+  // JWKS refills use the public issuer by default. Set auth-service only when
+  // the resolved auth fetcher targets the same issuer worker and key store.
+  // auth-service-hedged-public prefers that binding, then starts canonical
+  // public verification after 250ms. Transport/malformed/unknown-key failures
+  // may use the alternate. Primary signature and JWT-claim failures remain
+  // terminal; an alternate failure cannot overrule a later primary success.
+  jwksTransport?:
+    | 'public-origin'
+    | 'auth-service'
+    | 'auth-service-hedged-public';
+  // Binding name to prefer for auth calls (default 'AUTH_SERVICE');
+  // null disables the binding lookup.
+  serviceBindingName?: string | null;
+}
+\`\`\`
+
+### What the handle does
+
+On each request the handle, in order:
+
+1. Reads the JWT cookie; if present, verifies it (\`issuer: authOrigin\`,
+   \`audience: 'vibes-apps'\`) against the auth origin's
+   \`/api/auth/jwks\` endpoint and populates locals.
+2. Otherwise checks for a forwarded \`Authorization: Bearer <jwt>\` — used by
+   worker-to-worker calls that can't carry the browser cookie jar. Same JWKS
+   verify path; the principal stays the requesting user.
+3. Otherwise, if a better-auth session cookie is present, refreshes a new JWT
+   from the auth origin and sets the cookie.
+4. If none succeed, sets \`locals.user = null\` and \`locals.session = null\`.
+
+JWKS verification state belongs to the runtime's \`runtime/client#auth\`:
+each transport trust class uses a separate key resolver with a bounded one-hour lifetime, refills are
+single-flighted and timeout-bounded, and an unknown signing \`kid\` triggers a
+cooldown-guarded refresh. Runtime disposal clears verification state and fences
+pending completions. Agent-key validation stays uncached. Transport selection does not weaken the exact
+\`issuer\`, \`audience\`, or signature checks.
+
+### Reading the principal
+
+After the handle runs, \`event.locals\` carries:
+
+\`\`\`ts
+// event.locals.user (null when unauthenticated)
+{
+  id: string;            // JWT sub
+  email: string;
+  name?: string;
+  orgId?: string;        // active org (JWT 'org' claim)
+  orgs: OrgClaim[];      // org memberships from the 'orgs' claim
+  roles?: string[];
+  staff: boolean;        // admin-gate flag
+  isSuperuser: boolean;  // admin-gate flag
+}
+
+// event.locals.session
+{
+  id?: string;           // sessionId claim
+  validUntil?: number;   // JWT exp (Unix seconds)
+}
+\`\`\`
+
+\`OrgClaim\` is exported for typing the membership entries:
+
+\`\`\`ts
+import type { OrgClaim } from '@vibesdotdev/auth';
+// type OrgClaim = { id: string; role: string }
+\`\`\`
+
+> Admin gating (\`staff\` / \`isSuperuser\`) and the \`orgs\` claim are set
+> exclusively by auth-web's JWT \`definePayload\`. Tokens issued before a claim
+> existed default to \`false\` / \`[]\` until the next sign-in or refresh.
+
+## Client-side: the AuthApiClient
+
+The client contract lives in \`@vibesdotdev/auth/api\`. Resolve an instance via
+the runtime — never import an implementation directly:
+
+\`\`\`ts
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import type { AuthApiClient } from '@vibesdotdev/auth/api';
+
+const auth = getVibesClient<AuthApiClient>('auth', runtime);
+await auth.ensureLoaded();
+\`\`\`
+
+### AuthApiClient methods
+
+\`\`\`ts
+interface AuthApiClient {
+  // Idempotent lazy-init; safe to call repeatedly.
+  ensureLoaded(): Promise<void>;
+  // Resolved auth origin used by the URL builders.
+  readonly authOrigin: string;
+
+  // POST /api/auth/sign-in/email
+  signInEmail(input: EmailPasswordCredentials): Promise<AuthSession>;
+  // POST /api/auth/sign-up/email
+  signUpEmail(input: AuthSignUpCredentials): Promise<AuthSession>;
+  // POST /api/auth/sign-out — clears the active session cookie.
+  signOut(): Promise<void>;
+  // GET /api/auth/session — user is null when unauthenticated.
+  getSession(): Promise<AuthSession>;
+
+  // Build OAuth redirect URLs (no fetch performed).
+  providerSignInUrl(providerId: string, opts?: { redirectTo?: string; signInPath?: string }): string;
+  providerSignUpUrl(providerId: string, opts?: { redirectTo?: string; signUpPath?: string }): string;
+}
+\`\`\`
+
+### AuthSession shape
+
+\`\`\`ts
+interface AuthSession {
+  user: AuthSessionUser | null; // null when unauthenticated
+  session?: {
+    id: string;
+    userId: string;
+    expiresAt: string | Date;
+  } | null;
+}
+
+interface AuthSessionUser {
+  id: string;
+  email: string;
+  name?: string | null;
+  image?: string | null;
+  [key: string]: unknown;
+}
+\`\`\`
+
+### Sign in / out
+
+\`\`\`ts
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import type { AuthApiClient } from '@vibesdotdev/auth/api';
+
+const auth = getVibesClient<AuthApiClient>('auth', runtime);
+
+const result = await auth.signInEmail({
+  email: 'user@example.com',
+  password: 'secret',
+  rememberMe: true // persists beyond the browser session (default true server-side)
+});
+
+if (result.user) {
+  // signed in; session cookie was set by the auth origin
+}
+
+await auth.signOut();
+\`\`\`
+
+### Reading the current session
+
+\`\`\`ts
+const current = await auth.getSession();
+if (!current.user) {
+  // not signed in — redirect to sign-in
+} else {
+  console.log(current.user.id, current.session?.expiresAt);
+}
+\`\`\`
+
+### OAuth provider redirects
+
+\`signInEmail\` / \`signUpEmail\` cover email+password. For OAuth, build a redirect
+URL and navigate to it — the auth origin handles the provider round-trip:
+
+\`\`\`ts
+const url = auth.providerSignInUrl('github', { redirectTo: '/dashboard' });
+window.location.href = url;
+\`\`\`
+
+## Errors
+
+The client surfaces two error classes from \`@vibesdotdev/auth/api\`:
+
+\`\`\`ts
+import { AuthClientError, AuthNotSignedInError } from '@vibesdotdev/auth/api';
+
+try {
+  await auth.getSession();
+} catch (err) {
+  if (err instanceof AuthNotSignedInError) {
+    // no resolvable session origin / not authenticated
+  } else if (err instanceof AuthClientError) {
+    console.error(err.status, err.message); // HTTP status + message
+  }
+}
+\`\`\`
+
+## Server-side session types
+
+The persisted session row and validated request context are exported from the
+package root:
+
+\`\`\`ts
+import type { Session, SessionWithUser, ValidatedSessionContext } from '@vibesdotdev/auth';
+
+// Session (the DB row)
+// { id: string; userId: string; expiresAt: Date; twoFactorVerified: boolean | null }
+
+// SessionWithUser extends Session with a minimal user object.
+// ValidatedSessionContext = { user: User; session: Session }
+\`\`\`
+
+## Best practices
+
+1. **Verify, don't store** — consumer apps verify the JWT via JWKS; only
+   \`auth.vibes.dev\` owns the session of record.
+2. **Use the runtime client** — resolve \`AuthApiClient\` via \`getVibesClient\`;
+   never import an implementation or hand-roll the HTTP calls.
+3. **Forward the JWT for service calls** — worker-to-worker requests pass the
+   user's JWT as \`Authorization: Bearer\`, not a service token, so the principal
+   is preserved.
+4. **Read principal off locals** — authorize against \`event.locals.user\`
+   (including \`orgs\`, \`staff\`, \`isSuperuser\`) rather than re-querying.
+
+:::card{title="See also"}
+- [\`auth.flows\`](auth.flows) — Authentication flows
+- [\`auth.oauth\`](auth.oauth) — OAuth providers
+- [\`auth.providers\`](auth.providers) — Auth provider interface
+:::
+`
+    },
+    parent: 'auth',
+    order: 2,
+    tags: ['auth', 'sessions', 'tokens', 'expiration', 'refresh'],
+    surfaces: ['cli', 'web', 'in-app'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=sessions.docs.descriptor.js.map

package/dist/docs/sessions.docs.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.docs.descriptor.js","sourceRoot":"","sources":["../../src/docs/sessions.docs.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAwB;IACvC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,oBAAoB;IAC3B,OAAO,EAAE,oDAAoD;IAC7D,IAAI,EAAE;QACL,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoRT;KACC;IACD,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC;IAC7D,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;IAClC,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/events/on-client-auth-rejected.impl.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Inline handler for `client.auth-rejected`: drop the app-credential verdicts
+ * of the runtime the subscription was wired on, for the refusing origin.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+/** The one fact this handler reads from the event: the refusing origin. */
+declare const RefusalOriginSchema: z.ZodObject<{
+    origin: z.ZodString;
+}, z.core.$strip>;
+type ClientRefusal = z.input<typeof RefusalOriginSchema>;
+declare class AuthClientAuthRejectedHandler {
+    /** The hook bus delivers the event as published; it is parsed here before use. */
+    handle(payload: ClientRefusal, runtime: RuntimeRef): Promise<void>;
+}
+declare const _default: import("@vibesdotdev/kernel").RuntimeImplementationWrapper<typeof AuthClientAuthRejectedHandler>;
+export default _default;
+//# sourceMappingURL=on-client-auth-rejected.impl.d.ts.map

package/dist/events/on-client-auth-rejected.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"on-client-auth-rejected.impl.d.ts","sourceRoot":"","sources":["../../src/events/on-client-auth-rejected.impl.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,2EAA2E;AAC3E,QAAA,MAAM,mBAAmB;;iBAA0C,CAAC;AACpE,KAAK,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEzD,cAAM,6BAA6B;IAClC,kFAAkF;IAC5E,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAKxE;;AAED,wBAIG"}

package/dist/events/on-client-auth-rejected.impl.js

@@ -0,0 +1,23 @@
+/**
+ * Inline handler for `client.auth-rejected`: drop the app-credential verdicts
+ * of the runtime the subscription was wired on, for the refusing origin.
+ */
+import { createRuntimeImplementation } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { dropAppCredentialVerdicts } from "../client/app-authority.js";
+/** The one fact this handler reads from the event: the refusing origin. */
+const RefusalOriginSchema = z.object({ origin: z.string().min(1) });
+class AuthClientAuthRejectedHandler {
+    /** The hook bus delivers the event as published; it is parsed here before use. */
+    async handle(payload, runtime) {
+        const refusal = RefusalOriginSchema.safeParse(payload);
+        // An unreadable refusal still means a credential may have been refused: drop all.
+        dropAppCredentialVerdicts(runtime, refusal.success ? refusal.data.origin : undefined);
+    }
+}
+export default createRuntimeImplementation({
+    kind: 'runtime/subscription',
+    id: 'auth.hooks.on-client-auth-rejected',
+    implementation: AuthClientAuthRejectedHandler
+});
+//# sourceMappingURL=on-client-auth-rejected.impl.js.map

package/dist/events/on-client-auth-rejected.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"on-client-auth-rejected.impl.js","sourceRoot":"","sources":["../../src/events/on-client-auth-rejected.impl.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,2BAA2B,EAAmB,MAAM,qBAAqB,CAAC;AACnF,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,2EAA2E;AAC3E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAGpE,MAAM,6BAA6B;IAClC,kFAAkF;IAClF,KAAK,CAAC,MAAM,CAAC,OAAsB,EAAE,OAAmB;QACvD,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,kFAAkF;QAClF,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvF,CAAC;CACD;AAED,eAAe,2BAA2B,CAAC;IAC1C,IAAI,EAAE,sBAAsB;IAC5B,EAAE,EAAE,oCAAoC;IACxC,cAAc,EAAE,6BAA6B;CAC7C,CAAC,CAAC"}

package/dist/events/on-client-auth-rejected.subscription.descriptor.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Subscription: an origin refused a client request (`client.auth-rejected`),
+ * so the app-credential verdicts that origin may have relied on are dropped
+ * (`dropAppCredentialVerdicts`) and the next call resolves the credential
+ * afresh. A server-side revocation therefore surfaces on the next call.
+ */
+declare const _default: {
+    kind: "runtime/subscription";
+    id: string;
+    name: string;
+    description: string;
+    event: string;
+    handler: string;
+    handlerType: string;
+    enabled: true;
+};
+export default _default;
+//# sourceMappingURL=on-client-auth-rejected.subscription.descriptor.d.ts.map

package/dist/events/on-client-auth-rejected.subscription.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"on-client-auth-rejected.subscription.descriptor.d.ts","sourceRoot":"","sources":["../../src/events/on-client-auth-rejected.subscription.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;;;;;;;;;;;AAIH,wBASG"}

package/dist/events/on-client-auth-rejected.subscription.descriptor.js

@@ -0,0 +1,18 @@
+/**
+ * Subscription: an origin refused a client request (`client.auth-rejected`),
+ * so the app-credential verdicts that origin may have relied on are dropped
+ * (`dropAppCredentialVerdicts`) and the next call resolves the credential
+ * afresh. A server-side revocation therefore surfaces on the next call.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    kind: 'runtime/subscription',
+    id: 'auth.hooks.on-client-auth-rejected',
+    name: 'Auth — Client Auth Rejected',
+    description: 'Drops cached app-credential verdicts when an origin answers a client request 401 or 403',
+    event: 'client.auth-rejected',
+    handler: 'inline',
+    handlerType: 'inline',
+    enabled: true
+});
+//# sourceMappingURL=on-client-auth-rejected.subscription.descriptor.js.map

package/dist/events/on-client-auth-rejected.subscription.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"on-client-auth-rejected.subscription.descriptor.js","sourceRoot":"","sources":["../../src/events/on-client-auth-rejected.subscription.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,IAAI,EAAE,sBAAsB;IAC5B,EAAE,EAAE,oCAAoC;IACxC,IAAI,EAAE,6BAA6B;IACnC,WAAW,EAAE,yFAAyF;IACtG,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,QAAQ;IACjB,WAAW,EAAE,QAAQ;IACrB,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/events/session-established.event.descriptor.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `auth.login.succeeded` — the one post-login integration boundary.
+ *
+ * Auth owns the fact that a CLI login completed. Downstream clients own their
+ * local projection through runtime subscriptions. The payload deliberately
+ * carries no credential, token, email, or user data.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+export declare const AUTH_LOGIN_SUCCEEDED_EVENT_ID = "auth.login.succeeded";
+export declare const AUTH_LOGIN_NAMESPACE = "auth/login";
+export declare const AUTH_LOGIN_SUCCEEDED_EVENT_NAME = "succeeded";
+export declare const authLoginSucceededPayloadSchema: z.ZodObject<{
+    environment: z.ZodString;
+    method: z.ZodEnum<{
+        "api-key": "api-key";
+        device: "device";
+    }>;
+    surface: z.ZodLiteral<"cli">;
+}, z.core.$strict>;
+export type AuthLoginSucceededEvent = z.infer<typeof authLoginSucceededPayloadSchema>;
+declare const descriptor: {
+    kind: "runtime/event";
+    id: string;
+    source: string;
+    name: string;
+    description: string;
+    trigger: string;
+};
+export declare function emitAuthLoginSucceeded(runtime: Pick<RuntimeRef, 'hooks'>, payload: AuthLoginSucceededEvent): Promise<void>;
+export default descriptor;
+//# sourceMappingURL=session-established.event.descriptor.d.ts.map

package/dist/events/session-established.event.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-established.event.descriptor.d.ts","sourceRoot":"","sources":["../../src/events/session-established.event.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,6BAA6B,yBAAyB,CAAC;AACpE,eAAO,MAAM,oBAAoB,eAAe,CAAC;AACjD,eAAO,MAAM,+BAA+B,cAAc,CAAC;AAE3D,eAAO,MAAM,+BAA+B;;;;;;;kBAMlC,CAAC;AAEX,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAEtF,QAAA,MAAM,UAAU;;;;;;;CAQd,CAAC;AAEH,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAClC,OAAO,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,eAAe,UAAU,CAAC"}

package/dist/events/session-established.event.descriptor.js

@@ -0,0 +1,35 @@
+/**
+ * `auth.login.succeeded` — the one post-login integration boundary.
+ *
+ * Auth owns the fact that a CLI login completed. Downstream clients own their
+ * local projection through runtime subscriptions. The payload deliberately
+ * carries no credential, token, email, or user data.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+export const AUTH_LOGIN_SUCCEEDED_EVENT_ID = 'auth.login.succeeded';
+export const AUTH_LOGIN_NAMESPACE = 'auth/login';
+export const AUTH_LOGIN_SUCCEEDED_EVENT_NAME = 'succeeded';
+export const authLoginSucceededPayloadSchema = z
+    .object({
+    environment: z.string().min(1),
+    method: z.enum(['api-key', 'device']),
+    surface: z.literal('cli')
+})
+    .strict();
+const descriptor = createRuntimeAsset({
+    kind: 'runtime/event',
+    id: AUTH_LOGIN_SUCCEEDED_EVENT_ID,
+    source: AUTH_LOGIN_NAMESPACE,
+    name: 'Auth Login Succeeded',
+    description: 'Emitted after the CLI persists a valid login so authenticated clients can project their own local integration state.',
+    trigger: 'custom'
+});
+export async function emitAuthLoginSucceeded(runtime, payload) {
+    const event = authLoginSucceededPayloadSchema.parse(payload);
+    await runtime
+        .hooks(AUTH_LOGIN_NAMESPACE)
+        .emit(AUTH_LOGIN_SUCCEEDED_EVENT_NAME, event);
+}
+export default descriptor;
+//# sourceMappingURL=session-established.event.descriptor.js.map

package/dist/events/session-established.event.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-established.event.descriptor.js","sourceRoot":"","sources":["../../src/events/session-established.event.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,kBAAkB,EAAmB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AACjD,MAAM,CAAC,MAAM,+BAA+B,GAAG,WAAW,CAAC;AAE3D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC9C,MAAM,CAAC;IACP,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAIX,MAAM,UAAU,GAAG,kBAAkB,CAAC;IACrC,IAAI,EAAE,eAAe;IACrB,EAAE,EAAE,6BAA6B;IACjC,MAAM,EAAE,oBAAoB;IAC5B,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACV,sHAAsH;IACvH,OAAO,EAAE,QAAQ;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAAkC,EAClC,OAAgC;IAEhC,MAAM,KAAK,GAAG,+BAA+B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO;SACX,KAAK,CAAiE,oBAAoB,CAAC;SAC3F,IAAI,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,eAAe,UAAU,CAAC"}