@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/api/auth.api-client.schemas.d.ts

@@ -0,0 +1,199 @@
+/**
+ * Canonical schemas for the auth api-client's response contract — the single
+ * source of truth for `AuthSession` / `AuthSessionUser` (re-exported as types
+ * from `auth.api-client.types.ts`). Every method decodes the transport through
+ * these, so the object handed back to callers is reconstructed from the same
+ * schema that defines its type: `object → schema → transport → schema → object`.
+ *
+ * Notes:
+ *   - The session USER is a `looseObject`: better-auth attaches flow-specific
+ *     extras (provider ids, profile fields) that the `[key: string]: unknown`
+ *     index signature on `AuthSessionUser` is meant to carry — so the schema
+ *     keeps them. The session ENVELOPE is a strict `object`: the client's
+ *     contract is exactly `{ user, session }`, and top-level better-auth extras
+ *     (tokens, redirect URLs) are intentionally dropped — no caller reads them.
+ *   - `expiresAt` stays `string | Date` (no `z.coerce.date()`) because the
+ *     declared type is a union; the schema is faithful to that contract.
+ */
+import * as z from 'zod/v4';
+/** The user fragment of a session payload. Loose: extra better-auth fields pass through. */
+export declare const authSessionUserSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$loose>;
+export type AuthSessionUser = z.infer<typeof authSessionUserSchema>;
+/**
+ * Session payload returned by `/sign-in/email`, `/sign-up/email`, and
+ * `/session`. The `user` key is required-but-nullable; `session` is optional.
+ */
+export declare const authSessionSchema: z.ZodObject<{
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$loose>>;
+    session: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        userId: z.ZodString;
+        expiresAt: z.ZodUnion<readonly [z.ZodString, z.ZodDate]>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type AuthSession = z.infer<typeof authSessionSchema>;
+/**
+ * `/session` tolerates "no active session": better-auth may answer with a
+ * `null` body (and a 200) instead of a 401. Normalize that — and an empty body
+ * — to the canonical signed-out shape so `getSession()` never throws on the
+ * unauthenticated path.
+ */
+export declare const getSessionResponseSchema: z.ZodPipe<z.ZodOptional<z.ZodNullable<z.ZodObject<{
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        image: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$loose>>;
+    session: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        userId: z.ZodString;
+        expiresAt: z.ZodUnion<readonly [z.ZodString, z.ZodDate]>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>>>, z.ZodTransform<{
+    user: {
+        [x: string]: unknown;
+        id: string;
+        email: string;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+    } | null;
+    session?: {
+        id: string;
+        userId: string;
+        expiresAt: string | Date;
+    } | null | undefined;
+}, {
+    user: {
+        [x: string]: unknown;
+        id: string;
+        email: string;
+        name?: string | null | undefined;
+        image?: string | null | undefined;
+    } | null;
+    session?: {
+        id: string;
+        userId: string;
+        expiresAt: string | Date;
+    } | null | undefined;
+} | null | undefined>>;
+/**
+ * `/api/users/search` response. The canonical shape is `{ items }`; a legacy
+ * `{ users }` alias is tolerated. Both are optional so a sparse body validates,
+ * and `searchUsers()` falls back to `[]`.
+ */
+export declare const authUserSearchResponseSchema: z.ZodObject<{
+    items: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email: z.ZodString;
+        image: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>>;
+    users: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email: z.ZodString;
+        image: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type AuthUserSearchResponse = z.infer<typeof authUserSearchResponseSchema>;
+/** `/sign-out` returns a body we never read — accept anything (incl. no body). */
+export declare const authVoidResponseSchema: z.ZodUnknown;
+/**
+ * Active better-auth session row returned by `GET /api/auth/list-sessions`.
+ * `id` + `token` are load-bearing (revoke needs the token); the metadata
+ * fields are tolerant — better-auth populates `ipAddress`/`userAgent` as null,
+ * but a sparse row (missing a timestamp or the nullable fields entirely) must
+ * not throw, so those are nullish rather than required-nullable.
+ */
+export declare const authUserSessionSchema: z.ZodObject<{
+    id: z.ZodString;
+    token: z.ZodString;
+    userId: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    createdAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    updatedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    ipAddress: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    userAgent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const authUserSessionListSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    token: z.ZodString;
+    userId: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    createdAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    updatedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    ipAddress: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    userAgent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>>;
+export declare const authRevokeSessionResultSchema: z.ZodObject<{
+    status: z.ZodBoolean;
+}, z.core.$strip>;
+export type AuthUserSession = z.infer<typeof authUserSessionSchema>;
+export type AuthRevokeSessionResult = z.infer<typeof authRevokeSessionResultSchema>;
+/** Public Auth health projection used to offer only configured sign-in providers. */
+export declare const authEnabledSocialProvidersSchema: z.ZodPipe<z.ZodObject<{
+    auth: z.ZodObject<{
+        enabledSocialProviders: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodTransform<string[], {
+    auth: {
+        enabledSocialProviders: string[];
+    };
+}>>;
+/**
+ * Token-free projection of a Better Auth account returned by
+ * `GET /api/auth/list-accounts`.
+ *
+ * Better Auth's adapter row can contain access, refresh, and ID tokens. This
+ * schema deliberately reconstructs only identity metadata, so those values
+ * cannot enter a consumer or a serialized Svelte payload even if an upstream
+ * response accidentally includes them.
+ */
+export declare const authConnectedAccountSchema: z.ZodObject<{
+    id: z.ZodString;
+    providerId: z.ZodString;
+    accountId: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const authConnectedAccountListSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    providerId: z.ZodString;
+    accountId: z.ZodString;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+}, z.core.$strip>>;
+/** Public input for Better Auth's social-link flow. Token-bearing ID-token fields are excluded. */
+export declare const authLinkSocialInputSchema: z.ZodObject<{
+    provider: z.ZodString;
+    callbackURL: z.ZodOptional<z.ZodString>;
+    errorCallbackURL: z.ZodOptional<z.ZodString>;
+    requestSignUp: z.ZodOptional<z.ZodBoolean>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    loginHint: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const authLinkSocialResultSchema: z.ZodObject<{
+    url: z.ZodString;
+    redirect: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const authUnlinkAccountResultSchema: z.ZodObject<{
+    status: z.ZodBoolean;
+}, z.core.$strip>;
+export type AuthConnectedAccount = z.infer<typeof authConnectedAccountSchema>;
+export type AuthLinkSocialInput = z.infer<typeof authLinkSocialInputSchema>;
+export type AuthLinkSocialResult = z.infer<typeof authLinkSocialResultSchema>;
+export type AuthUnlinkAccountResult = z.infer<typeof authUnlinkAccountResultSchema>;
+//# sourceMappingURL=auth.api-client.schemas.d.ts.map

package/dist/api/auth.api-client.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.schemas.d.ts","sourceRoot":"","sources":["../../src/api/auth.api-client.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,4FAA4F;AAC5F,eAAO,MAAM,qBAAqB;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;iBAS5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAEyB,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;iBAGvC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;iBAUhC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;kBAAiC,CAAC;AAExE,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,qFAAqF;AACrF,eAAO,MAAM,gCAAgC;;;;;;;;GAIY,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B;;;;;;;iBAOrC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;kBAAsC,CAAC;AAUlF,mGAAmG;AACnG,eAAO,MAAM,yBAAyB;;;;;;;iBAOpC,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/api/auth.api-client.schemas.js

@@ -0,0 +1,130 @@
+/**
+ * Canonical schemas for the auth api-client's response contract — the single
+ * source of truth for `AuthSession` / `AuthSessionUser` (re-exported as types
+ * from `auth.api-client.types.ts`). Every method decodes the transport through
+ * these, so the object handed back to callers is reconstructed from the same
+ * schema that defines its type: `object → schema → transport → schema → object`.
+ *
+ * Notes:
+ *   - The session USER is a `looseObject`: better-auth attaches flow-specific
+ *     extras (provider ids, profile fields) that the `[key: string]: unknown`
+ *     index signature on `AuthSessionUser` is meant to carry — so the schema
+ *     keeps them. The session ENVELOPE is a strict `object`: the client's
+ *     contract is exactly `{ user, session }`, and top-level better-auth extras
+ *     (tokens, redirect URLs) are intentionally dropped — no caller reads them.
+ *   - `expiresAt` stays `string | Date` (no `z.coerce.date()`) because the
+ *     declared type is a union; the schema is faithful to that contract.
+ */
+import * as z from 'zod/v4';
+import { userListItemSchema } from '@vibesdotdev/account/schemas';
+/** The user fragment of a session payload. Loose: extra better-auth fields pass through. */
+export const authSessionUserSchema = z.looseObject({
+    id: z.string(),
+    email: z.string(),
+    name: z.string().nullish(),
+    image: z.string().nullish()
+});
+/**
+ * Session payload returned by `/sign-in/email`, `/sign-up/email`, and
+ * `/session`. The `user` key is required-but-nullable; `session` is optional.
+ */
+export const authSessionSchema = z.object({
+    user: authSessionUserSchema.nullable(),
+    session: z
+        .object({
+        id: z.string(),
+        userId: z.string(),
+        expiresAt: z.union([z.string(), z.date()])
+    })
+        .nullish()
+});
+/**
+ * `/session` tolerates "no active session": better-auth may answer with a
+ * `null` body (and a 200) instead of a 401. Normalize that — and an empty body
+ * — to the canonical signed-out shape so `getSession()` never throws on the
+ * unauthenticated path.
+ */
+export const getSessionResponseSchema = authSessionSchema
+    .nullish()
+    .transform((value) => value ?? { user: null, session: null });
+/**
+ * `/api/users/search` response. The canonical shape is `{ items }`; a legacy
+ * `{ users }` alias is tolerated. Both are optional so a sparse body validates,
+ * and `searchUsers()` falls back to `[]`.
+ */
+export const authUserSearchResponseSchema = z.object({
+    items: z.array(userListItemSchema).optional(),
+    users: z.array(userListItemSchema).optional()
+});
+/** `/sign-out` returns a body we never read — accept anything (incl. no body). */
+export const authVoidResponseSchema = z.unknown();
+/**
+ * Active better-auth session row returned by `GET /api/auth/list-sessions`.
+ * `id` + `token` are load-bearing (revoke needs the token); the metadata
+ * fields are tolerant — better-auth populates `ipAddress`/`userAgent` as null,
+ * but a sparse row (missing a timestamp or the nullable fields entirely) must
+ * not throw, so those are nullish rather than required-nullable.
+ */
+export const authUserSessionSchema = z.object({
+    id: z.string(),
+    /** Session token passed to `POST /api/auth/revoke-session` as `{ token }`. */
+    token: z.string(),
+    userId: z.string(),
+    expiresAt: z.string().nullish(),
+    createdAt: z.string().nullish(),
+    updatedAt: z.string().nullish(),
+    ipAddress: z.string().nullish(),
+    userAgent: z.string().nullish()
+});
+export const authUserSessionListSchema = z.array(authUserSessionSchema);
+export const authRevokeSessionResultSchema = z.object({
+    status: z.boolean()
+});
+/** Public Auth health projection used to offer only configured sign-in providers. */
+export const authEnabledSocialProvidersSchema = z
+    .object({
+    auth: z.object({ enabledSocialProviders: z.array(z.string().min(1)) })
+})
+    .transform((value) => value.auth.enabledSocialProviders);
+/**
+ * Token-free projection of a Better Auth account returned by
+ * `GET /api/auth/list-accounts`.
+ *
+ * Better Auth's adapter row can contain access, refresh, and ID tokens. This
+ * schema deliberately reconstructs only identity metadata, so those values
+ * cannot enter a consumer or a serialized Svelte payload even if an upstream
+ * response accidentally includes them.
+ */
+export const authConnectedAccountSchema = z.object({
+    id: z.string(),
+    providerId: z.string(),
+    accountId: z.string(),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+    scopes: z.array(z.string())
+});
+export const authConnectedAccountListSchema = z.array(authConnectedAccountSchema);
+const authHttpUrlSchema = z
+    .string()
+    .url()
+    .refine((value) => {
+    const protocol = new URL(value).protocol;
+    return protocol === 'http:' || protocol === 'https:';
+}, 'Expected an http(s) URL');
+/** Public input for Better Auth's social-link flow. Token-bearing ID-token fields are excluded. */
+export const authLinkSocialInputSchema = z.object({
+    provider: z.string().trim().min(1),
+    callbackURL: authHttpUrlSchema.optional(),
+    errorCallbackURL: authHttpUrlSchema.optional(),
+    requestSignUp: z.boolean().optional(),
+    scopes: z.array(z.string().min(1)).optional(),
+    loginHint: z.string().min(1).optional()
+});
+export const authLinkSocialResultSchema = z.object({
+    url: authHttpUrlSchema,
+    redirect: z.boolean()
+});
+export const authUnlinkAccountResultSchema = z.object({
+    status: z.boolean()
+});
+//# sourceMappingURL=auth.api-client.schemas.js.map

package/dist/api/auth.api-client.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.schemas.js","sourceRoot":"","sources":["../../src/api/auth.api-client.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC;IAClD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC3B,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,CAAC;SACR,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAC1C,CAAC;SACD,OAAO,EAAE;CACX,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB;KACvD,OAAO,EAAE;KACT,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAIH,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,8EAA8E;IAC9E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC;AAKH,qFAAqF;AACrF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACtE,CAAC;KACD,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAElF,MAAM,iBAAiB,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC;IACzC,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC;AACtD,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAE/B,mGAAmG;AACnG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,gBAAgB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IAC9C,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,GAAG,EAAE,iBAAiB;IACtB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACnB,CAAC,CAAC"}

package/dist/api/auth.api-client.types.d.ts

@@ -0,0 +1,142 @@
+/**
+ * auth api-client types — interface + request/option shapes only.
+ *
+ * Pure types; no runtime code. Imported by the consumer impl and by every
+ * downstream surface (auth-svelte components, cli commands, browser stores).
+ *
+ * NEVER include tokens, password values, or session secrets in type field
+ * defaults, examples, or comments — these types travel into Svelte component
+ * inferred props and SvelteKit serialized payloads.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+import type { StoredIdentityResult, DeviceSignInOptions, DeviceSignInResult } from '../schemas/consumer-auth.ts';
+import type { CredentialInfo } from '../schemas/credentials.ts';
+import type { ResolveAppJwtOptions, ResolveFreshAppJwtInput } from '../schemas/app-jwt.ts';
+export type { ResolveAppJwtOptions, ResolveFreshAppJwtInput } from '../schemas/app-jwt.ts';
+import type { RuntimeClient } from '@vibesdotdev/kernel/client';
+import type { UserListItem } from '@vibesdotdev/account/schemas';
+import type { RegisteredApp } from '../schemas/registered-app.ts';
+export type { RegisteredApp } from '../schemas/registered-app.ts';
+import type { AuthSession, AuthSessionUser, AuthRevokeSessionResult, AuthUserSession, AuthConnectedAccount, AuthLinkSocialInput, AuthLinkSocialResult, AuthUnlinkAccountResult } from './auth.api-client.schemas.ts';
+export type { AuthSession, AuthSessionUser, AuthRevokeSessionResult, AuthUserSession, AuthConnectedAccount, AuthLinkSocialInput, AuthLinkSocialResult, AuthUnlinkAccountResult };
+export type AuthProviderId = 'github' | 'google' | 'discord' | 'apple' | 'microsoft' | 'twitter' | 'email' | (string & {});
+export interface AuthProviderConfig {
+    id: AuthProviderId;
+    /** Display label, e.g. "Continue with GitHub". */
+    label: string;
+    /** Iconify name, e.g. `lucide:github`. */
+    icon?: string;
+    /** Override the path used for sign-in (default `/api/auth/sign-in/{id}`). */
+    signInPath?: string;
+    /** Override the path used for sign-up (default `/api/auth/sign-up/{id}`). */
+    signUpPath?: string;
+}
+export interface EmailPasswordCredentials {
+    email: string;
+    password: string;
+    /**
+     * Persist the session beyond the current browser session. Posted to
+     * better-auth as `rememberMe`. Defaults to true on the server when omitted.
+     */
+    rememberMe?: boolean;
+    /**
+     * Optional callback URL passed to better-auth (`callbackURL`). When set,
+     * better-auth includes it in the response so the caller can navigate.
+     */
+    callbackURL?: string;
+}
+export interface AuthSignUpCredentials extends EmailPasswordCredentials {
+    name?: string;
+}
+export interface AuthProviderUrlOptions {
+    redirectTo?: string;
+    signInPath?: string;
+    signUpPath?: string;
+}
+export interface AuthUserSearchOptions {
+    query: string;
+    limit?: number;
+    offset?: number;
+    exclude?: string[];
+}
+/**
+ * Request-scoped SSR identity forwarded to auth-web for one call only.
+ *
+ * The implementation copies only recognized Auth session cookies and derives
+ * Origin from `request.url`; it never retains this object on the runtime-client
+ * singleton.
+ */
+export interface AuthApiRequestOptions {
+    request: Pick<Request, 'headers' | 'url'>;
+}
+/**
+ * Canonical auth client contract. Every consumer (cli, svelte components,
+ * browser stores, session watchers) resolves an instance of this via
+ * `getVibesClient<AuthApiClient>('auth', runtime)`.
+ *
+ * Implementations are loaded by the auth plugin's scope-gated loader.
+ */
+export interface AuthApiClient extends RuntimeClient {
+    /** Consumer composition only. Agent credential takes precedence; no credential value leaves Auth. */
+    getStoredIdentity(): Promise<StoredIdentityResult>;
+    getCredential(environmentId?: string): Promise<CredentialInfo | null>;
+    resolveAppJwt(options?: ResolveAppJwtOptions): Promise<string | null>;
+    resolveFreshAppJwt(options?: ResolveFreshAppJwtInput): Promise<string | null>;
+    /** Consumer composition only. Progress and cancellation belong to this invocation. */
+    signInDevice(options?: DeviceSignInOptions): Promise<DeviceSignInResult>;
+    /** Idempotent lazy-init. Safe to call repeatedly. */
+    ensureLoaded(): Promise<void>;
+    /** Resolved auth origin used by URL-builder methods. Safe to log. */
+    readonly authOrigin: string;
+    /** POST /api/auth/sign-in/email — email/password sign-in. */
+    signInEmail(input: EmailPasswordCredentials): Promise<AuthSession>;
+    /** POST /api/auth/sign-up/email — email/password sign-up. */
+    signUpEmail(input: AuthSignUpCredentials): Promise<AuthSession>;
+    /** POST /api/auth/sign-out — clears the active session cookie. */
+    signOut(): Promise<void>;
+    /** GET /api/auth/session — returns the current session (user: null when unauthenticated). */
+    getSession(): Promise<AuthSession>;
+    /** GET /api/users/search — search active users by name or email. */
+    searchUsers(options: AuthUserSearchOptions): Promise<UserListItem[]>;
+    /** GET /api/auth/list-sessions — active sessions for the signed-in user. */
+    listSessions(): Promise<AuthUserSession[]>;
+    /** POST /api/auth/revoke-session — revoke one session by its token. */
+    revokeSession(token: string): Promise<AuthRevokeSessionResult>;
+    /** POST /api/auth/revoke-other-sessions — revoke every session except the current one. */
+    revokeOtherSessions(): Promise<AuthRevokeSessionResult>;
+    /** POST /api/auth/revoke-sessions — revoke all sessions (including the current one). */
+    revokeAllSessions(): Promise<AuthRevokeSessionResult>;
+    /** GET /api/auth/list-accounts — token-free linked sign-in accounts. */
+    listAccounts(options?: AuthApiRequestOptions): Promise<AuthConnectedAccount[]>;
+    /** GET /api/health — provider IDs enabled by Auth's resolved runtime configuration. */
+    listEnabledSocialProviders(): Promise<string[]>;
+    /** POST /api/auth/link-social with redirect disabled so the caller owns navigation. */
+    linkSocial(input: AuthLinkSocialInput, options?: AuthApiRequestOptions): Promise<AuthLinkSocialResult>;
+    /** POST /api/auth/unlink-account — unlink one Better Auth account by row id. */
+    unlinkAccount(accountId: string, options?: AuthApiRequestOptions): Promise<AuthUnlinkAccountResult>;
+    /**
+     * POST /api/internal/registered-apps/resolve — the registered app that owns
+     * `origin` in Auth's app registry, or null (refuse) when the origin is
+     * unregistered, disabled, untrusted, or claimed by more than one owning org.
+     * The owner is shown per caller (`ownership`: owned, unowned, hidden).
+     * Server-side only: calls Auth as this app, with a `client_credentials`
+     * token minted from the credentials `auth.app-credentials` names (cached
+     * until shortly before expiry). Refuses `UNAVAILABLE` without them. One
+     * call per invocation; per-request memoization belongs to
+     * `createRegisteredOriginResolver`.
+     */
+    resolveRegisteredOrigin(origin: string): Promise<RegisteredApp | null>;
+    /** Build the redirect URL for an OAuth provider sign-in (no fetch performed). */
+    providerSignInUrl(providerId: AuthProviderId, opts?: Pick<AuthProviderUrlOptions, 'redirectTo' | 'signInPath'>): string;
+    /** Build the redirect URL for an OAuth provider sign-up (no fetch performed). */
+    providerSignUpUrl(providerId: AuthProviderId, opts?: Pick<AuthProviderUrlOptions, 'redirectTo' | 'signUpPath'>): string;
+}
+export declare class AuthNotSignedInError extends CapabilityError {
+    constructor();
+}
+/** An auth client call that failed: `status` is the HTTP status, `reason` is `auth-client-error`. */
+export declare class AuthClientError extends CapabilityError {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+//# sourceMappingURL=auth.api-client.types.d.ts.map

package/dist/api/auth.api-client.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.types.d.ts","sourceRoot":"","sources":["../../src/api/auth.api-client.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAA4B,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,YAAY,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,YAAY,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAKlE,OAAO,KAAK,EACX,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACX,WAAW,EACX,eAAe,EACf,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GACzB,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE/F,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,cAAc,CAAC;IACnB,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAsB,SAAQ,wBAAwB;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,KAAK,CAAC,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAc,SAAQ,aAAa;IACnD,qGAAqG;IACrG,iBAAiB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnD,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACtE,aAAa,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE,kBAAkB,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9E,sFAAsF;IACtF,YAAY,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACzE,qDAAqD;IACrD,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,6DAA6D;IAC7D,WAAW,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEnE,6DAA6D;IAC7D,WAAW,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEhE,kEAAkE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzB,6FAA6F;IAC7F,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAEnC,oEAAoE;IACpE,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAErE,4EAA4E;IAC5E,YAAY,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE3C,uEAAuE;IACvE,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE/D,0FAA0F;IAC1F,mBAAmB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAExD,wFAAwF;IACxF,iBAAiB,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEtD,wEAAwE;IACxE,YAAY,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAE/E,uFAAuF;IACvF,0BAA0B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEhD,uFAAuF;IACvF,UAAU,CACT,KAAK,EAAE,mBAAmB,EAC1B,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC,gFAAgF;IAChF,aAAa,CACZ,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC;;;;;;;;;;OAUG;IACH,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAEvE,iFAAiF;IACjF,iBAAiB,CAChB,UAAU,EAAE,cAAc,EAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,GAAG,YAAY,CAAC,GAC9D,MAAM,CAAC;IAEV,iFAAiF;IACjF,iBAAiB,CAChB,UAAU,EAAE,cAAc,EAC1B,IAAI,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,GAAG,YAAY,CAAC,GAC9D,MAAM,CAAC;CACV;AAED,qBAAa,oBAAqB,SAAQ,eAAe;;CASxD;AAYD,qGAAqG;AACrG,qBAAa,eAAgB,SAAQ,eAAe;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAS3C"}

package/dist/api/auth.api-client.types.js

@@ -0,0 +1,45 @@
+/**
+ * auth api-client types — interface + request/option shapes only.
+ *
+ * Pure types; no runtime code. Imported by the consumer impl and by every
+ * downstream surface (auth-svelte components, cli commands, browser stores).
+ *
+ * NEVER include tokens, password values, or session secrets in type field
+ * defaults, examples, or comments — these types travel into Svelte component
+ * inferred props and SvelteKit serialized payloads.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+export class AuthNotSignedInError extends CapabilityError {
+    constructor() {
+        super('Not signed in. Sign in via auth-web (or set `VIBES_AUTH_API_URL` to point at a running auth.vibes.dev) to authenticate the auth client.', 'AUTH_REQUIRED', { reason: 'not-signed-in', retryable: false });
+        this.name = 'AuthNotSignedInError';
+    }
+}
+/** The `CapabilityError` code an HTTP status from auth belongs to. */
+function authClientErrorCode(status) {
+    if (status === 401)
+        return 'AUTH_REQUIRED';
+    if (status === 403)
+        return 'PERMISSION_DENIED';
+    if (status === 404)
+        return 'NOT_FOUND';
+    if (status === 408)
+        return 'TIMEOUT';
+    if (status === 429)
+        return 'RATE_LIMITED';
+    return status >= 500 ? 'UNAVAILABLE' : 'INVALID_INPUT';
+}
+/** An auth client call that failed: `status` is the HTTP status, `reason` is `auth-client-error`. */
+export class AuthClientError extends CapabilityError {
+    status;
+    constructor(message, status) {
+        super(message, authClientErrorCode(status), {
+            reason: 'auth-client-error',
+            retryable: false,
+            details: { status }
+        });
+        this.name = 'AuthClientError';
+        this.status = status;
+    }
+}
+//# sourceMappingURL=auth.api-client.types.js.map

package/dist/api/auth.api-client.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.types.js","sourceRoot":"","sources":["../../src/api/auth.api-client.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAA4B,MAAM,qBAAqB,CAAC;AAwLhF,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IACxD;QACC,KAAK,CACJ,yIAAyI,EACzI,eAAe,EACf,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,CAC7C,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACpC,CAAC;CACD;AAED,sEAAsE;AACtE,SAAS,mBAAmB,CAAC,MAAc;IAC1C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,eAAe,CAAC;IAC3C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,mBAAmB,CAAC;IAC/C,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC;IACvC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC1C,OAAO,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC;AACxD,CAAC;AAED,qGAAqG;AACrG,MAAM,OAAO,eAAgB,SAAQ,eAAe;IAC1C,MAAM,CAAS;IACxB,YAAY,OAAe,EAAE,MAAc;QAC1C,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE;YAC3C,MAAM,EAAE,mBAAmB;YAC3B,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,MAAM,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;CACD"}

package/dist/api/auth.api-client.urls.d.ts

@@ -0,0 +1,6 @@
+import type { AuthProviderId, AuthProviderUrlOptions } from './auth.api-client.types.ts';
+/** Canonical relative URL for an OAuth provider sign-in. Safe for SSR hrefs. */
+export declare function authProviderSignInPath(providerId: AuthProviderId, options?: Pick<AuthProviderUrlOptions, 'redirectTo' | 'signInPath'>): string;
+/** Canonical relative URL for an OAuth provider sign-up. Safe for SSR hrefs. */
+export declare function authProviderSignUpPath(providerId: AuthProviderId, options?: Pick<AuthProviderUrlOptions, 'redirectTo' | 'signUpPath'>): string;
+//# sourceMappingURL=auth.api-client.urls.d.ts.map

package/dist/api/auth.api-client.urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.urls.d.ts","sourceRoot":"","sources":["../../src/api/auth.api-client.urls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAgCzF,gFAAgF;AAChF,wBAAgB,sBAAsB,CACrC,UAAU,EAAE,cAAc,EAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,GAAG,YAAY,CAAC,GACjE,MAAM,CAER;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CACrC,UAAU,EAAE,cAAc,EAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,YAAY,GAAG,YAAY,CAAC,GACjE,MAAM,CAER"}

package/dist/api/auth.api-client.urls.js

@@ -0,0 +1,29 @@
+const RELATIVE_AUTH_ORIGIN = 'https://auth.vibes.invalid';
+function providerPath(action, providerId, pathOverride, redirectTo) {
+    const path = pathOverride ?? `/api/auth/${action}/${encodeURIComponent(providerId)}`;
+    if (path.includes('\\')) {
+        throw new TypeError('OAuth provider paths must stay relative to the auth origin');
+    }
+    const parsed = new URL(path, RELATIVE_AUTH_ORIGIN);
+    if (parsed.origin !== RELATIVE_AUTH_ORIGIN ||
+        parsed.protocol !== 'https:' ||
+        parsed.username ||
+        parsed.password ||
+        !parsed.pathname.startsWith('/') ||
+        parsed.pathname.startsWith('//')) {
+        throw new TypeError('OAuth provider paths must stay relative to the auth origin');
+    }
+    if (redirectTo !== undefined) {
+        parsed.searchParams.set('redirect_to', redirectTo);
+    }
+    return `${parsed.pathname}${parsed.search}${parsed.hash}`;
+}
+/** Canonical relative URL for an OAuth provider sign-in. Safe for SSR hrefs. */
+export function authProviderSignInPath(providerId, options) {
+    return providerPath('sign-in', providerId, options?.signInPath, options?.redirectTo);
+}
+/** Canonical relative URL for an OAuth provider sign-up. Safe for SSR hrefs. */
+export function authProviderSignUpPath(providerId, options) {
+    return providerPath('sign-up', providerId, options?.signUpPath, options?.redirectTo);
+}
+//# sourceMappingURL=auth.api-client.urls.js.map

package/dist/api/auth.api-client.urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.urls.js","sourceRoot":"","sources":["../../src/api/auth.api-client.urls.ts"],"names":[],"mappings":"AAEA,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAE1D,SAAS,YAAY,CACpB,MAA6B,EAC7B,UAA0B,EAC1B,YAAgC,EAChC,UAA8B;IAE9B,MAAM,IAAI,GAAG,YAAY,IAAI,aAAa,MAAM,IAAI,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;IACrF,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IACnD,IACC,MAAM,CAAC,MAAM,KAAK,oBAAoB;QACtC,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAC/B,CAAC;QACF,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CACrC,UAA0B,EAC1B,OAAmE;IAEnE,OAAO,YAAY,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACtF,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CACrC,UAA0B,EAC1B,OAAmE;IAEnE,OAAO,YAAY,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACtF,CAAC"}

package/dist/api/failure-message.d.ts

@@ -0,0 +1,11 @@
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+/**
+ * A message safe to show a user for a failed auth call. The one text taken from
+ * a failure is the auth service's own `{ error }` string on a rejected request
+ * (status below 500, at most 500 characters): it is written for the person
+ * ("Invalid email or password"). Every other failure gets fixed text chosen by
+ * its code, or `fallback`; its own message (a transport's text, a request value)
+ * never reaches the page.
+ */
+export declare function failureMessage(failure: CaughtFailure, fallback: string): string;
+//# sourceMappingURL=failure-message.d.ts.map

package/dist/api/failure-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure-message.d.ts","sourceRoot":"","sources":["../../src/api/failure-message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAW5E;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI/E"}

package/dist/api/failure-message.js

@@ -0,0 +1,25 @@
+import { isCapabilityError } from '@vibesdotdev/kernel';
+import { AuthClientError } from "./auth.api-client.types.js";
+/** What a user is told for the failures they can act on, by the failure's code. */
+const CODE_MESSAGES = new Map(Object.entries({
+    AUTH_REQUIRED: 'Sign in to continue.',
+    PERMISSION_DENIED: 'You do not have permission to do that.',
+    RATE_LIMITED: 'Too many requests. Try again shortly.',
+    UNAVAILABLE: 'This is not available right now. Try again shortly.'
+}));
+/**
+ * A message safe to show a user for a failed auth call. The one text taken from
+ * a failure is the auth service's own `{ error }` string on a rejected request
+ * (status below 500, at most 500 characters): it is written for the person
+ * ("Invalid email or password"). Every other failure gets fixed text chosen by
+ * its code, or `fallback`; its own message (a transport's text, a request value)
+ * never reaches the page.
+ */
+export function failureMessage(failure, fallback) {
+    if (failure instanceof AuthClientError && failure.status < 500)
+        return failure.message;
+    if (!isCapabilityError(failure))
+        return fallback;
+    return CODE_MESSAGES.get(failure.code) ?? fallback;
+}
+//# sourceMappingURL=failure-message.js.map

package/dist/api/failure-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failure-message.js","sourceRoot":"","sources":["../../src/api/failure-message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,mFAAmF;AACnF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAiB,MAAM,CAAC,OAAO,CAAC;IAC5D,aAAa,EAAE,sBAAsB;IACrC,iBAAiB,EAAE,wCAAwC;IAC3D,YAAY,EAAE,uCAAuC;IACrD,WAAW,EAAE,qDAAqD;CAClE,CAAC,CAAC,CAAC;AAEJ;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,OAAsB,EAAE,QAAgB;IACtE,IAAI,OAAO,YAAY,eAAe,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IACvF,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjD,OAAO,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACpD,CAAC"}