@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/features/services/credential-store.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Auth Credential Store
+ *
+ * Unified credential storage using config/manifest#auth, **partitioned by the
+ * declared service environment** so a production login cannot overwrite a local
+ * credential (and vice versa). See issue #1132 / #1112.
+ *
+ * Storage address: StorageManifest.partition(environmentId) → namespace
+ * `auth/<envId>`. Legacy unpartitioned `auth` documents remain readable for
+ * migration and dual-write so old readers still see the *active* environment's
+ * credentials until the single-record shape is retired.
+ */
+import type { AuthCredentials, CredentialInfo, SetCredentialsInput } from '../../schemas/credentials.ts';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+/** The agent/API key credential an agent CLI host provides. */
+export declare const AGENT_API_KEY_CREDENTIAL = "VIBES_API_KEY";
+export type EnvAgentApiKeySource = `credential:${typeof AGENT_API_KEY_CREDENTIAL}`;
+export interface EnvAgentApiKey {
+    token: string;
+    source: EnvAgentApiKeySource;
+}
+/**
+ * The agent/API key the runtime's host provides, resolved as a credential
+ * (`runtime.resolveCredential`, rc05): a `vibes secrets exec --with
+ * VIBES_API_KEY` child reads it through its host-credentials manifest, and a
+ * host's composed store answers it. It is never read from the environment,
+ * and no other variable name is scanned for one. `null` only when no store
+ * holds it; any other failure is the store's typed error.
+ */
+export declare function resolveAgentApiKey(runtime: Pick<RuntimeRef, 'resolveCredential'>): Promise<EnvAgentApiKey | null>;
+/**
+ * The slice of a runtime this store needs. Callers embedded in a scoped
+ * runtime (the studio TUI) pass THEIR runtime explicitly — the ambient
+ * ambient default-runtime global is a different instance there and does not carry
+ * the registered kinds (the known ambient-vs-scoped resolution trap).
+ */
+export type CredentialStoreRuntime = RuntimeRef;
+export declare function isCredentialStoreRuntime(value: unknown): boolean;
+/** Minimal surface of config/manifest#auth after resolve (ConfigManifest). */
+export interface AuthCredentialsManifest {
+    load: () => Promise<AuthCredentials | null>;
+    save: (data: AuthCredentials) => Promise<void>;
+    delete: () => Promise<void>;
+    /** StorageManifest.partition — present on real ConfigManifest instances. */
+    partition?: (partitionId: string) => AuthCredentialsManifest;
+    listPartitions?: () => Promise<string[]>;
+    namespace?: string;
+}
+/**
+ * Resolve the active declared service environment for credential partition selection.
+ *
+ * An explicit environment is retained. Existing infra.services hosts retain
+ * their original partition address; hosts without that authority use the
+ * declared config/environment id. No partition is relabeled or merged.
+ *
+ * **Fail closed** when none of those are available — do not guess
+ * `local`/`production` from environment aliases, which would route credential
+ * I/O to the wrong partition.
+ */
+export declare function resolveCredentialEnvironmentId(runtime: CredentialStoreRuntime, explicit?: string): Promise<string>;
+/**
+ * Resolve the partition for one environment (namespace `auth/<envId>`).
+ * Falls back to the root manifest when partition is unavailable (tests / legacy).
+ */
+export declare function getEnvironmentAuthManifest(environmentId: string, runtime: CredentialStoreRuntime): Promise<{
+    root: AuthCredentialsManifest;
+    env: AuthCredentialsManifest;
+    environmentId: string;
+}>;
+export type CredentialStoreDiagnosticCode = 'storage-unavailable' | 'configuration-unavailable' | 'load-failed';
+export interface CredentialStoreDiagnostic {
+    code: CredentialStoreDiagnosticCode;
+    /** Safe, secret-free explanation suitable for CLI diagnostics. */
+    message: string;
+}
+export interface CredentialStoreLoadResult {
+    credentials: CredentialInfo | null;
+    diagnostic: CredentialStoreDiagnostic | null;
+}
+/** Select the host key or stored login; only confirmed absence returns null. */
+export declare function selectCredential(runtime: CredentialStoreRuntime, environmentId?: string): Promise<CredentialInfo | null>;
+/**
+ * Load stored credentials with a safe diagnostic when the local storage
+ * substrate is unavailable. The ordinary getCredentials() API remains a
+ * credential-dark nullable read for auth consumers.
+ */
+export declare function getCredentialsWithDiagnostics(runtime: CredentialStoreRuntime, environmentId?: string): Promise<CredentialStoreLoadResult>;
+/**
+ * The stored `vibes auth login` for one environment partition, and nothing
+ * else: no injected env key is consulted. This is the read the
+ * `auth/device-session` secrets store answers from. A storage failure throws.
+ */
+export declare function loadStoredCredentials(runtime: CredentialStoreRuntime, environmentId?: string): Promise<CredentialInfo | null>;
+/**
+ * Get stored credentials for the active (or explicit) environment.
+ */
+export declare function getCredentials(runtime: CredentialStoreRuntime, environmentId?: string): Promise<CredentialInfo | null>;
+/**
+ * Save credentials for one environment only.
+ *
+ * @param input - Credentials to save
+ * @param environment - Target environment id (defaults to active config/environment)
+ * Dual-writes the legacy root document when saving the *active* environment so
+ * old readers still observe the selected credentials.
+ */
+export declare function setCredentials(input: SetCredentialsInput, environment: string | undefined, runtime: CredentialStoreRuntime): Promise<void>;
+/**
+ * Clear credentials for the active (or explicit) environment only.
+ * Also clears the legacy root when clearing the active environment.
+ */
+export declare function clearCredentials(runtime: CredentialStoreRuntime, environmentId?: string): Promise<void>;
+/**
+ * Check if credentials are stored for the active environment.
+ */
+export declare function hasCredentials(runtime: CredentialStoreRuntime, environmentId?: string): Promise<boolean>;
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/features/services/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../src/features/services/credential-store.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACX,eAAe,EAEf,cAAc,EACd,mBAAmB,EACnB,MAAM,8BAA8B,CAAC;AAItC,OAAO,EAA+D,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAInH,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,kBAAkB,CAAC;AAIxD,MAAM,MAAM,oBAAoB,GAAG,cAAc,OAAO,wBAAwB,EAAE,CAAC;AAEnF,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,oBAAoB,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,GAC5C,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAQhC;AAqFD;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAahD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhE;AAED,8EAA8E;AAC9E,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,MAAM,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,4EAA4E;IAC5E,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,uBAAuB,CAAC;IAC7D,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CACnD,OAAO,EAAE,sBAAsB,EAC/B,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAmBD;;;GAGG;AACH,wBAAsB,0BAA0B,CAC/C,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,sBAAsB,GAC7B,OAAO,CAAC;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,GAAG,EAAE,uBAAuB,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAUjG;AA6GD,MAAM,MAAM,6BAA6B,GACxC,qBAAqB,GAAG,2BAA2B,GAAG,aAAa,CAAC;AAErE,MAAM,WAAW,yBAAyB;IACzC,IAAI,EAAE,6BAA6B,CAAC;IACpC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACzC,WAAW,EAAE,cAAc,GAAG,IAAI,CAAC;IACnC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;CAC7C;AA+CD,gFAAgF;AAChF,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,sBAAsB,EAC/B,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAGhC;AAED;;;;GAIG;AACH,wBAAsB,6BAA6B,CAClD,OAAO,EAAE,sBAAsB,EAC/B,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,yBAAyB,CAAC,CAWpC;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,sBAAsB,EAC/B,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA6BhC;AAED;;GAEG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,sBAAsB,EAC/B,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAEhC;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CACnC,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAkFf;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,sBAAsB,EAC/B,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;GAEG;AACH,wBAAsB,cAAc,CACnC,OAAO,EAAE,sBAAsB,EAC/B,aAAa,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,OAAO,CAAC,CAGlB"}

package/dist/features/services/credential-store.js

@@ -0,0 +1,476 @@
+import { credentialReferences, referenceKey, pendingReferences, retireCredentialReferences } from "./credential-custody.js";
+import { serviceEnvironment } from '@vibesdotdev/infra-core/service';
+import { deviceSessionState, invalidateDeviceSession } from "../../device-session/device-session.state.js";
+import { dropAppCredentialVerdicts } from "../../client/app-authority.js";
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { attempt } from "../utils/attempt.js";
+import { authCredentialsSchema, setCredentialsInputSchema } from "../../schemas/credentials.js";
+/** The agent/API key credential an agent CLI host provides. */
+export const AGENT_API_KEY_CREDENTIAL = 'VIBES_API_KEY';
+const STORED_CREDENTIAL_SOURCE = 'config/manifest#auth';
+/**
+ * The agent/API key the runtime's host provides, resolved as a credential
+ * (`runtime.resolveCredential`, rc05): a `vibes secrets exec --with
+ * VIBES_API_KEY` child reads it through its host-credentials manifest, and a
+ * host's composed store answers it. It is never read from the environment,
+ * and no other variable name is scanned for one. `null` only when no store
+ * holds it; any other failure is the store's typed error.
+ */
+export async function resolveAgentApiKey(runtime) {
+    const resolution = await runtime.resolveCredential({ source: 'secret', key: AGENT_API_KEY_CREDENTIAL });
+    if (resolution.ok) {
+        const token = resolution.value.trim();
+        return token ? { token, source: `credential:${AGENT_API_KEY_CREDENTIAL}` } : null;
+    }
+    if (resolution.error.code === 'NOT_FOUND' && resolution.error.reason === 'credential-not-set')
+        return null;
+    throw resolution.error;
+}
+function envAgentCredentialInfo(resolved) {
+    return {
+        type: 'apiKey',
+        token: resolved.token,
+        apiKey: resolved.token,
+        source: resolved.source
+    };
+}
+function toCredentialInfo(input) {
+    // `credentials.token` is the compatibility projection consumed by
+    // auth/provider for BOTH credential kinds. Explicit owner fields win.
+    // When both apiKey and sessionToken coexist in a merged store record,
+    // prefer the API key so agent CLI prove does not require a Drew human session.
+    if (input.apiKey) {
+        return {
+            type: 'apiKey',
+            // Competing session → active bearer is the apiKey.
+            // apiKey-only → keep compatibility projection when present.
+            token: input.sessionToken ? input.apiKey : (input.token ?? input.apiKey),
+            apiKey: input.apiKey,
+            refreshToken: input.refreshToken,
+            expiresAt: input.expiresAt,
+            environment: input.environment,
+            userId: input.userId,
+            email: input.email,
+            name: input.name,
+            source: STORED_CREDENTIAL_SOURCE
+        };
+    }
+    if (input.sessionToken) {
+        return {
+            type: 'session',
+            token: input.sessionToken,
+            sessionToken: input.sessionToken,
+            sessionTokenReference: input.sessionTokenReference,
+            refreshToken: input.refreshToken,
+            refreshTokenReference: input.refreshTokenReference,
+            expiresAt: input.expiresAt,
+            environment: input.environment,
+            userId: input.userId,
+            email: input.email,
+            name: input.name,
+            source: STORED_CREDENTIAL_SOURCE
+        };
+    }
+    if (input.token) {
+        return {
+            type: 'apiKey',
+            token: input.token,
+            refreshToken: input.refreshToken,
+            expiresAt: input.expiresAt,
+            environment: input.environment,
+            userId: input.userId,
+            email: input.email,
+            name: input.name,
+            source: STORED_CREDENTIAL_SOURCE
+        };
+    }
+    return null;
+}
+function credentialIdentityKey(info) {
+    // Exact-duplicate detection: same type + same primary secret material.
+    const secret = info.apiKey ?? info.token ?? info.sessionToken ?? '';
+    return `${info.type}:${secret}`;
+}
+const runtimeMethod = z.instanceof(Function);
+/** The methods a runtime must answer for this store to use it. */
+const credentialStoreRuntimeSchema = z.looseObject({
+    query: runtimeMethod,
+    getEnv: runtimeMethod,
+    getEnvSnapshot: runtimeMethod,
+    hasKind: runtimeMethod,
+    resolveCredential: runtimeMethod
+});
+export function isCredentialStoreRuntime(value) {
+    return credentialStoreRuntimeSchema.safeParse(value).success;
+}
+/**
+ * Resolve the active declared service environment for credential partition selection.
+ *
+ * An explicit environment is retained. Existing infra.services hosts retain
+ * their original partition address; hosts without that authority use the
+ * declared config/environment id. No partition is relabeled or merged.
+ *
+ * **Fail closed** when none of those are available — do not guess
+ * `local`/`production` from environment aliases, which would route credential
+ * I/O to the wrong partition.
+ */
+export async function resolveCredentialEnvironmentId(runtime, explicit) {
+    // The projection can place a non-string in this slot when a tuple omits it.
+    // Only a parsed environment id is an explicit choice.
+    const explicitId = z.string().trim().min(1).safeParse(explicit);
+    if (explicitId.success)
+        return explicitId.data;
+    // Compatibility read-through: hosts with the original partition authority
+    // keep addressing that partition, even when config/environment has a
+    // different id. Never merge two environments' stored identities.
+    const manifests = runtime.hasKind('config/manifest') ? runtime.query('config/manifest').withId('infra.services') : null;
+    // A runtime facade may not list descriptors; then no `infra.services` authority is declared.
+    const declaredServices = manifests?.descriptors?.() ?? [];
+    if (declaredServices.length > 0) {
+        return serviceEnvironment(runtime);
+    }
+    if (runtime.hasKind('config/environment')) {
+        const environments = runtime.query('config/environment');
+        const environment = environments.descriptors().length > 0 ? await environments.resolve() : null;
+        if (environment?.id?.trim())
+            return environment.id.trim();
+    }
+    throw new CapabilityError('config/environment unavailable for credential partition selection', 'UNAVAILABLE', {
+        reason: 'credential-environment-unresolved'
+    });
+}
+/**
+ * Lazy-load the root ConfigManifest for auth credentials.
+ */
+async function getAuthRootManifest(runtime) {
+    const manifest = await runtime
+        .query('config/manifest')
+        .withId('auth')
+        .resolve();
+    if (!manifest) {
+        throw new CapabilityError('config/manifest#auth not registered (auth credentials manifest missing)', 'UNAVAILABLE', {
+            reason: 'auth-manifest-unregistered'
+        });
+    }
+    return manifest;
+}
+/**
+ * Resolve the partition for one environment (namespace `auth/<envId>`).
+ * Falls back to the root manifest when partition is unavailable (tests / legacy).
+ */
+export async function getEnvironmentAuthManifest(environmentId, runtime) {
+    const root = await getAuthRootManifest(runtime);
+    if (root.partition) {
+        return {
+            root,
+            env: root.partition(environmentId),
+            environmentId
+        };
+    }
+    return { root, env: root, environmentId };
+}
+async function resolveSecretReference(runtime, reference) {
+    if (!reference)
+        return undefined;
+    const store = await runtime
+        .query('secrets/store')
+        .withId(reference.storeId)
+        .resolve();
+    if (!store) {
+        throw new CapabilityError(`secrets/store#${reference.storeId} is not registered`, 'UNAVAILABLE', {
+            reason: 'secrets-store-unregistered',
+            details: { store: reference.storeId }
+        });
+    }
+    return store.get(reference.environment, reference.key);
+}
+async function dataToCredentialInfo(data, runtime) {
+    if (!data?.credentials)
+        return null;
+    const sessionToken = data.credentials.sessionToken ??
+        (await resolveSecretReference(runtime, data.credentials.sessionTokenReference));
+    const refreshToken = data.credentials.refreshToken ??
+        (await resolveSecretReference(runtime, data.credentials.refreshTokenReference));
+    return toCredentialInfo({
+        token: data.credentials.token,
+        apiKey: data.credentials.apiKey,
+        sessionToken,
+        sessionTokenReference: data.credentials.sessionTokenReference,
+        refreshToken,
+        refreshTokenReference: data.credentials.refreshTokenReference,
+        expiresAt: data.credentials.expiresAt,
+        environment: data.environment,
+        userId: data.user?.userId,
+        email: data.user?.email,
+        name: data.user?.name
+    });
+}
+/**
+ * One-shot migration: if the environment partition is empty but the legacy
+ * unpartitioned document has credentials that belong to this environment
+ * (matching label, or unlabeled legacy record), copy into the partition.
+ * Never logs secret values. Idempotent.
+ */
+async function migrateLegacyIfNeeded(root, envManifest, environmentId, partitioned) {
+    if (partitioned?.credentials || partitioned?.pendingSecretCleanup !== undefined)
+        return partitioned;
+    // Only the root document is the legacy single-record shape.
+    if (root === envManifest)
+        return partitioned;
+    const legacy = await root.load();
+    if (!legacy?.credentials)
+        return null;
+    const legacyEnv = legacy.environment?.trim();
+    // Labeled legacy → only migrate into the matching partition.
+    // Unlabeled legacy → quarantine into `legacy-unassigned` once; never
+    // auto-claim for the active environment (no-data-loss / #1134 kickback).
+    if (!legacyEnv) {
+        if (environmentId === 'legacy-unassigned') {
+            const migrated = {
+                ...legacy,
+                environment: 'legacy-unassigned'
+            };
+            await envManifest.save(migrated);
+            return migrated;
+        }
+        // Best-effort quarantine write into the unassigned partition; callers of
+        // other environments still see null until they re-login for that env.
+        if (root.partition) {
+            const quarantine = root.partition('legacy-unassigned');
+            const already = await quarantine.load();
+            if (!already?.credentials) {
+                await quarantine.save({
+                    ...legacy,
+                    environment: 'legacy-unassigned'
+                });
+            }
+        }
+        return null;
+    }
+    if (legacyEnv !== environmentId) {
+        return null;
+    }
+    const migrated = {
+        ...legacy,
+        environment: environmentId
+    };
+    await envManifest.save(migrated);
+    return migrated;
+}
+function classifyCredentialStoreFailure(failure) {
+    const message = failure instanceof Error ? failure.message : failure.description;
+    if (/eacces|eperm|readonly|read-only|not writable|permission denied|sqlite.*(readonly|writable)/i.test(message)) {
+        return {
+            code: 'storage-unavailable',
+            message: 'Credential storage is unavailable or not writable in this environment.'
+        };
+    }
+    if (/config\/environment|config\/manifest|credential partition|not registered|unavailable/i.test(message)) {
+        return {
+            code: 'configuration-unavailable',
+            message: 'Credential storage configuration is unavailable in this environment.'
+        };
+    }
+    return {
+        code: 'load-failed',
+        message: 'Credential storage could not be loaded.'
+    };
+}
+/** Order persistence work without holding up sign-out behind a pending read. */
+async function withCredentialOperation(runtime, operation) {
+    const state = await deviceSessionState(runtime);
+    const previous = state.credentialOperations;
+    const { promise, resolve } = Promise.withResolvers();
+    state.credentialOperations = promise;
+    await previous;
+    try {
+        return await operation();
+    }
+    finally {
+        resolve();
+    }
+}
+/** Select the host key or stored login; only confirmed absence returns null. */
+export async function selectCredential(runtime, environmentId) {
+    const agent = await resolveAgentApiKey(runtime);
+    return agent ? envAgentCredentialInfo(agent) : loadStoredCredentials(runtime, environmentId);
+}
+/**
+ * Load stored credentials with a safe diagnostic when the local storage
+ * substrate is unavailable. The ordinary getCredentials() API remains a
+ * credential-dark nullable read for auth consumers.
+ */
+export async function getCredentialsWithDiagnostics(runtime, environmentId) {
+    // One runtime answers both the provided key and the stored login, so a
+    // caller's runtime never reads another runtime's credential.
+    const rt = runtime;
+    const loaded = await attempt(async () => {
+        // A host-provided agent/API key beats any stored human session so forge
+        // doctor/transport can prove without login.
+        return selectCredential(rt, environmentId);
+    });
+    if (loaded.ok)
+        return { credentials: loaded.value, diagnostic: null };
+    return { credentials: null, diagnostic: classifyCredentialStoreFailure(loaded.failure) };
+}
+/**
+ * The stored `vibes auth login` for one environment partition, and nothing
+ * else: no injected env key is consulted. This is the read the
+ * `auth/device-session` secrets store answers from. A storage failure throws.
+ */
+export async function loadStoredCredentials(runtime, environmentId) {
+    const state = await deviceSessionState(runtime);
+    const epoch = state.epoch;
+    const envId = await resolveCredentialEnvironmentId(runtime, environmentId);
+    const { root, env } = await getEnvironmentAuthManifest(envId, runtime);
+    // Read I/O can wait on its adapter without blocking a concurrent sign-out.
+    const partitioned = await env.load();
+    const result = await withCredentialOperation(runtime, async () => {
+        if (state.epoch !== epoch)
+            return { retry: true };
+        // Migration and legacy projection share the credential mutation boundary.
+        const data = await migrateLegacyIfNeeded(root, env, envId, partitioned);
+        const activeId = await resolveCredentialEnvironmentId(runtime);
+        if (data?.credentials && envId === activeId && root !== env) {
+            const rootSnapshot = await root.load();
+            const rootInfo = await dataToCredentialInfo(rootSnapshot, runtime);
+            const dataInfo = await dataToCredentialInfo(data, runtime);
+            const sameIdentity = rootSnapshot?.credentials &&
+                rootInfo &&
+                dataInfo &&
+                credentialIdentityKey(dataInfo) === credentialIdentityKey(rootInfo) &&
+                rootSnapshot.environment === envId;
+            if (!sameIdentity)
+                await root.save(data);
+        }
+        return { retry: false, credentials: await dataToCredentialInfo(data, runtime) };
+    });
+    return result.retry ? loadStoredCredentials(runtime, envId) : result.credentials;
+}
+/**
+ * Get stored credentials for the active (or explicit) environment.
+ */
+export async function getCredentials(runtime, environmentId) {
+    return (await getCredentialsWithDiagnostics(runtime, environmentId)).credentials;
+}
+/**
+ * Save credentials for one environment only.
+ *
+ * @param input - Credentials to save
+ * @param environment - Target environment id (defaults to active config/environment)
+ * Dual-writes the legacy root document when saving the *active* environment so
+ * old readers still observe the selected credentials.
+ */
+export async function setCredentials(input, environment, runtime) {
+    const parsed = setCredentialsInputSchema.safeParse(input);
+    if (!parsed.success) {
+        throw new CapabilityError('Credential update input is invalid.', 'INVALID_INPUT', {
+            reason: 'credential-input-invalid'
+        });
+    }
+    await withCredentialOperation(runtime, async () => {
+        const update = parsed.data;
+        const envId = await resolveCredentialEnvironmentId(runtime, environment);
+        const { root, env } = await getEnvironmentAuthManifest(envId, runtime);
+        // Approved sessions replace identity and all credential metadata together.
+        // Partial updates retain the existing merge contract for API-key callers.
+        const previous = await env.load();
+        const activeId = await resolveCredentialEnvironmentId(runtime);
+        const legacy = root !== env ? await root.load() : null;
+        // Preserve a legacy-only login before replacing another environment's
+        // compatibility projection, including the unassigned migration partition.
+        const legacyId = legacy?.environment?.trim() || 'legacy-unassigned';
+        if (envId === activeId && legacy?.credentials && legacyId !== envId && root.partition) {
+            const legacyPartition = root.partition(legacyId);
+            await migrateLegacyIfNeeded(root, legacyPartition, legacyId, await legacyPartition.load());
+        }
+        const existing = update.mode === 'replace-session' ? {} : previous ?? {};
+        const sessionReferenceSelected = update.sessionTokenReference !== undefined;
+        const refreshReferenceSelected = update.refreshTokenReference !== undefined;
+        const data = {
+            ...existing,
+            credentials: {
+                ...existing.credentials,
+                token: update.apiKey ??
+                    update.sessionToken ??
+                    (sessionReferenceSelected ? undefined : existing.credentials?.token),
+                apiKey: update.apiKey ?? existing.credentials?.apiKey,
+                sessionToken: update.sessionToken ??
+                    (sessionReferenceSelected ? undefined : existing.credentials?.sessionToken),
+                sessionTokenReference: update.sessionTokenReference ?? existing.credentials?.sessionTokenReference,
+                refreshToken: update.refreshToken ??
+                    (sessionReferenceSelected || refreshReferenceSelected
+                        ? undefined
+                        : existing.credentials?.refreshToken),
+                refreshTokenReference: update.refreshTokenReference ??
+                    (sessionReferenceSelected ? undefined : existing.credentials?.refreshTokenReference),
+                expiresAt: update.expiresAt ?? existing.credentials?.expiresAt
+            },
+            user: {
+                ...existing.user,
+                userId: update.userId ?? existing.user?.userId,
+                email: update.email ?? existing.user?.email,
+                name: update.name ?? existing.user?.name
+            },
+            environment: envId,
+            pendingSecretCleanup: pendingReferences(previous, envId === activeId ? legacy : null)
+        };
+        const retained = new Set(credentialReferences(data).map(referenceKey));
+        data.pendingSecretCleanup = data.pendingSecretCleanup?.filter((reference) => !retained.has(referenceKey(reference)));
+        if (!data.pendingSecretCleanup?.length)
+            delete data.pendingSecretCleanup;
+        // Config edits are JSON: omitted optionals must be absent, not undefined.
+        const persisted = authCredentialsSchema.parse({
+            ...data,
+            credentials: Object.fromEntries(Object.entries(data.credentials ?? {}).filter(([, value]) => value !== undefined)),
+            user: Object.fromEntries(Object.entries(data.user ?? {}).filter(([, value]) => value !== undefined))
+        });
+        await env.save(persisted);
+        // The device-session store re-mints this environment's bearer on its next read.
+        invalidateDeviceSession(runtime, envId);
+        dropAppCredentialVerdicts(runtime);
+        // Dual-write active environment to legacy root for old-reader compatibility.
+        if (envId === activeId && root !== env) {
+            await root.save(persisted);
+        }
+        await retireCredentialReferences(runtime, root, env);
+    });
+}
+/**
+ * Clear credentials for the active (or explicit) environment only.
+ * Also clears the legacy root when clearing the active environment.
+ */
+export async function clearCredentials(runtime, environmentId) {
+    await withCredentialOperation(runtime, async () => {
+        const rt = runtime;
+        const envId = await resolveCredentialEnvironmentId(rt, environmentId);
+        const { root, env } = await getEnvironmentAuthManifest(envId, rt);
+        const data = await env.load();
+        const legacy = root === env ? null : await root.load();
+        const activeId = await resolveCredentialEnvironmentId(rt);
+        const clearLegacy = envId === activeId && root !== env &&
+            (!legacy?.environment?.trim() || legacy.environment === envId);
+        // Commit a signed-out document while retaining the cleanup journal.
+        await env.save({
+            environment: envId,
+            pendingSecretCleanup: pendingReferences(data, clearLegacy ? legacy : null)
+        });
+        invalidateDeviceSession(rt, envId);
+        dropAppCredentialVerdicts(rt);
+        if (clearLegacy)
+            await root.delete();
+        await retireCredentialReferences(rt, root, env);
+        const remaining = await env.load();
+        if (!remaining?.pendingSecretCleanup?.length)
+            await env.delete();
+    });
+}
+/**
+ * Check if credentials are stored for the active environment.
+ */
+export async function hasCredentials(runtime, environmentId) {
+    const creds = await getCredentials(runtime, environmentId);
+    return creds !== null && creds.type !== 'none';
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/features/services/credential-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../../../src/features/services/credential-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAC5H,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAoBrE,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAC3G,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAA+D,MAAM,qBAAqB,CAAC;AACnH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAEhG,+DAA+D;AAC/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AAExD,MAAM,wBAAwB,GAAG,sBAA+B,CAAC;AASjE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAA8C;IAE9C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACxG,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,wBAAwB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAC3G,MAAM,UAAU,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAwB;IACvD,OAAO;QACN,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,QAAQ,CAAC,KAAK;QACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;KACvB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAYzB;IACA,kEAAkE;IAClE,sEAAsE;IACtE,sEAAsE;IACtE,+EAA+E;IAC/E,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,mDAAmD;YACnD,4DAA4D;YAC5D,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACxE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,wBAAwB;SAChC,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO;YACN,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,KAAK,CAAC,YAAY;YACzB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,wBAAwB;SAChC,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACN,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,wBAAwB;SAChC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAoB;IAClD,uEAAuE;IACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACpE,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AACjC,CAAC;AAUD,MAAM,aAAa,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAE7C,kEAAkE;AAClE,MAAM,4BAA4B,GAAG,CAAC,CAAC,WAAW,CAAC;IAClD,KAAK,EAAE,aAAa;IACpB,MAAM,EAAE,aAAa;IACrB,cAAc,EAAE,aAAa;IAC7B,OAAO,EAAE,aAAa;IACtB,iBAAiB,EAAE,aAAa;CAChC,CAAC,CAAC;AAEH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACtD,OAAO,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CACnD,OAA+B,EAC/B,QAAiB;IAEjB,4EAA4E;IAC5E,sDAAsD;IACtD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,UAAU,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC;IAE/C,0EAA0E;IAC1E,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAA6C,iBAAiB,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpK,6FAA6F;IAC7F,MAAM,gBAAgB,GAAG,SAAS,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAoC,oBAAoB,CAAC,CAAC;QAC5F,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChG,IAAI,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE;YAAE,OAAO,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,mEAAmE,EAAE,aAAa,EAAE;QAC7G,MAAM,EAAE,mCAAmC;KAC3C,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAAC,OAA+B;IACjE,MAAM,QAAQ,GAAG,MAAM,OAAO;SAC5B,KAAK,CAA6C,iBAAiB,CAAC;SACpE,MAAM,CAAC,MAAM,CAAC;SACd,OAAO,EAAE,CAAC;IACZ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,yEAAyE,EAAE,aAAa,EAAE;YACnH,MAAM,EAAE,4BAA4B;SACpC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,aAAqB,EACrB,OAA+B;IAE/B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO;YACN,IAAI;YACJ,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YAClC,aAAa;SACb,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,sBAAsB,CACpC,OAA+B,EAC/B,SAA0C;IAE1C,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,OAAO;SACzB,KAAK,CAGJ,eAAe,CAAC;SACjB,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;SACzB,OAAO,EAAE,CAAC;IACZ,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,eAAe,CAAC,iBAAiB,SAAS,CAAC,OAAO,oBAAoB,EAAE,aAAa,EAAE;YAChG,MAAM,EAAE,4BAA4B;YACpC,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE;SACrC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,oBAAoB,CAClC,IAAwC,EACxC,OAA+B;IAE/B,IAAI,CAAC,IAAI,EAAE,WAAW;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,YAAY,GACjB,IAAI,CAAC,WAAW,CAAC,YAAY;QAC7B,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjF,MAAM,YAAY,GACjB,IAAI,CAAC,WAAW,CAAC,YAAY;QAC7B,CAAC,MAAM,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjF,OAAO,gBAAgB,CAAC;QACvB,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK;QAC7B,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM;QAC/B,YAAY;QACZ,qBAAqB,EAAE,IAAI,CAAC,WAAW,CAAC,qBAAqB;QAC7D,YAAY;QACZ,qBAAqB,EAAE,IAAI,CAAC,WAAW,CAAC,qBAAqB;QAC7D,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM;QACzB,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI;KACrB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,qBAAqB,CACnC,IAA6B,EAC7B,WAAoC,EACpC,aAAqB,EACrB,WAAmC;IAGnC,IAAI,WAAW,EAAE,WAAW,IAAI,WAAW,EAAE,oBAAoB,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAEpG,4DAA4D;IAC5D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IAE7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,WAAW;QAAE,OAAO,IAAI,CAAC;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7C,6DAA6D;IAC7D,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,IAAI,aAAa,KAAK,mBAAmB,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAoB;gBACjC,GAAG,MAAM;gBACT,WAAW,EAAE,mBAAmB;aAChC,CAAC;YACF,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjC,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;gBAC3B,MAAM,UAAU,CAAC,IAAI,CAAC;oBACrB,GAAG,MAAM;oBACT,WAAW,EAAE,mBAAmB;iBAChC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,QAAQ,GAAoB;QACjC,GAAG,MAAM;QACT,WAAW,EAAE,aAAa;KAC1B,CAAC;IACF,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC;AACjB,CAAC;AAgBD,SAAS,8BAA8B,CAAC,OAAsB;IAC7D,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACjF,IACC,6FAA6F,CAAC,IAAI,CACjG,OAAO,CACP,EACA,CAAC;QACF,OAAO;YACN,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,wEAAwE;SACjF,CAAC;IACH,CAAC;IACD,IACC,uFAAuF,CAAC,IAAI,CAC3F,OAAO,CACP,EACA,CAAC;QACF,OAAO;YACN,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,sEAAsE;SAC/E,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,yCAAyC;KAClD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,uBAAuB,CACrC,OAA+B,EAC/B,SAA2B;IAE3B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,oBAAoB,CAAC;IAC5C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;IAC3D,KAAK,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACrC,MAAM,QAAQ,CAAC;IACf,IAAI,CAAC;QACJ,OAAO,MAAM,SAAS,EAAE,CAAC;IAC1B,CAAC;YAAS,CAAC;QACV,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAA+B,EAC/B,aAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,OAA+B,EAC/B,aAAsB;IAEtB,uEAAuE;IACvE,6DAA6D;IAC7D,MAAM,EAAE,GAAG,OAAO,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,IAAoC,EAAE;QACvE,wEAAwE;QACxE,4CAA4C;QAC5C,OAAO,gBAAgB,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACtE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,8BAA8B,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAA+B,EAC/B,aAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3E,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvE,2EAA2E;IAC3E,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAErC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QAChE,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAW,CAAC;QAE3D,0EAA0E;QAC1E,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,IAAI,EAAE,WAAW,IAAI,KAAK,KAAK,QAAQ,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC7D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3D,MAAM,YAAY,GACjB,YAAY,EAAE,WAAW;gBACzB,QAAQ;gBACR,QAAQ;gBACR,qBAAqB,CAAC,QAAQ,CAAC,KAAK,qBAAqB,CAAC,QAAQ,CAAC;gBACnE,YAAY,CAAC,WAAW,KAAK,KAAK,CAAC;YACpC,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAW,CAAC;IAC1F,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAA+B,EAC/B,aAAsB;IAEtB,OAAO,CAAC,MAAM,6BAA6B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;AAClF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,KAA0B,EAC1B,WAA+B,EAC/B,OAA+B;IAE/B,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,eAAe,EAAE;YACjF,MAAM,EAAE,0BAA0B;SAClC,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEvE,2EAA2E;QAC3E,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,sEAAsE;QACtE,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC;QACpE,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,EAAE,WAAW,IAAI,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACvF,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,qBAAqB,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;QACzE,MAAM,wBAAwB,GAAG,MAAM,CAAC,qBAAqB,KAAK,SAAS,CAAC;QAC5E,MAAM,wBAAwB,GAAG,MAAM,CAAC,qBAAqB,KAAK,SAAS,CAAC;QAC5E,MAAM,IAAI,GAAoB;YAC7B,GAAG,QAAQ;YACX,WAAW,EAAE;gBACZ,GAAG,QAAQ,CAAC,WAAW;gBACvB,KAAK,EACJ,MAAM,CAAC,MAAM;oBACb,MAAM,CAAC,YAAY;oBACnB,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;gBACrE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,MAAM;gBACrD,YAAY,EACX,MAAM,CAAC,YAAY;oBACnB,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC;gBAC5E,qBAAqB,EACpB,MAAM,CAAC,qBAAqB,IAAI,QAAQ,CAAC,WAAW,EAAE,qBAAqB;gBAC5E,YAAY,EACX,MAAM,CAAC,YAAY;oBACnB,CAAC,wBAAwB,IAAI,wBAAwB;wBACpD,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC;gBACvC,qBAAqB,EACpB,MAAM,CAAC,qBAAqB;oBAC5B,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,qBAAqB,CAAC;gBACrF,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,WAAW,EAAE,SAAS;aAC9D;YACD,IAAI,EAAE;gBACL,GAAG,QAAQ,CAAC,IAAI;gBAChB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAC9C,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK;gBAC3C,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI;aACxC;YACD,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,iBAAiB,CAAC,QAAQ,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;SACrF,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACrH,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC,oBAAoB,CAAC;QAEzE,0EAA0E;QAC1E,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC;YAC7C,GAAG,IAAI;YACP,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAClH,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;SACrG,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,gFAAgF;QAChF,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAEnC,6EAA6E;QAC7E,IAAI,KAAK,KAAK,QAAQ,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,0BAA0B,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAA+B,EAC/B,aAAsB;IAEtB,MAAM,uBAAuB,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,EAAE,GAAG,OAAO,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;QACtE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,KAAK,KAAK,QAAQ,IAAI,IAAI,KAAK,GAAG;YACrD,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;QAChE,oEAAoE;QACpE,MAAM,GAAG,CAAC,IAAI,CAAC;YACd,WAAW,EAAE,KAAK;YAClB,oBAAoB,EAAE,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;SAC3E,CAAC,CAAC;QACH,uBAAuB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,WAAW;YAAE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,0BAA0B,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,EAAE,oBAAoB,EAAE,MAAM;YAAE,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,OAA+B,EAC/B,aAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3D,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;AAChD,CAAC"}

package/dist/features/utils/attempt.d.ts

@@ -0,0 +1,29 @@
+/**
+ * One attempt, captured once as an outcome: the value, or the failure that
+ * ended it. The caller reads the failure and decides (branch on its `code` /
+ * `reason`, report its value-free facts, or throw a typed refusal with it as
+ * `cause`); the capture itself never decides, drops or rewrites it.
+ */
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+export type Attempt<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly failure: CaughtFailure;
+};
+/** Run `work`; an async failure is the outcome, never thrown. */
+export declare function attempt<T>(work: () => Promise<T>): Promise<Attempt<T>>;
+/** Run `work`; a synchronous failure is the outcome, never thrown. */
+export declare function attemptSync<T>(work: () => T): Attempt<T>;
+/** Throw a captured failure again: the `Error` itself, or the non-Error value that was thrown. */
+export declare function rethrowFailure(failure: CaughtFailure): never;
+/** Whether the failure says the thing asked for is not there (`NOT_FOUND`), as opposed to a fault. */
+export declare function isAbsentFailure(failure: CaughtFailure): boolean;
+/**
+ * The failure named by its value-free facts only (`CapabilityError UNAVAILABLE
+ * qr-code-unavailable`, `Error ENOENT`): safe in a log field or a message,
+ * never the failure's own text.
+ */
+export declare function failureLabel(failure: CaughtFailure): string;
+//# sourceMappingURL=attempt.d.ts.map

package/dist/features/utils/attempt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attempt.d.ts","sourceRoot":"","sources":["../../../src/features/utils/attempt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAyC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEhG,MAAM,MAAM,OAAO,CAAC,CAAC,IAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE3D,iEAAiE;AACjE,wBAAsB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAM5E;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAMxD;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,KAAK,CAE5D;AAED,sGAAsG;AACtG,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAG3D"}