@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/features/utils/attempt.js

@@ -0,0 +1,43 @@
+/**
+ * One attempt, captured once as an outcome: the value, or the failure that
+ * ended it. The caller reads the failure and decides (branch on its `code` /
+ * `reason`, report its value-free facts, or throw a typed refusal with it as
+ * `cause`); the capture itself never decides, drops or rewrites it.
+ */
+import { CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+/** Run `work`; an async failure is the outcome, never thrown. */
+export async function attempt(work) {
+    try {
+        return { ok: true, value: await work() };
+    }
+    catch (error) {
+        return { ok: false, failure: CaughtFailureSchema.parse(error) };
+    }
+}
+/** Run `work`; a synchronous failure is the outcome, never thrown. */
+export function attemptSync(work) {
+    try {
+        return { ok: true, value: work() };
+    }
+    catch (error) {
+        return { ok: false, failure: CaughtFailureSchema.parse(error) };
+    }
+}
+/** Throw a captured failure again: the `Error` itself, or the non-Error value that was thrown. */
+export function rethrowFailure(failure) {
+    throw failure instanceof Error ? failure : failure.value;
+}
+/** Whether the failure says the thing asked for is not there (`NOT_FOUND`), as opposed to a fault. */
+export function isAbsentFailure(failure) {
+    return valueFreeFailure(failure).code === 'NOT_FOUND';
+}
+/**
+ * The failure named by its value-free facts only (`CapabilityError UNAVAILABLE
+ * qr-code-unavailable`, `Error ENOENT`): safe in a log field or a message,
+ * never the failure's own text.
+ */
+export function failureLabel(failure) {
+    const facts = valueFreeFailure(failure);
+    return [facts.name, facts.code, facts.reason].filter((fact) => fact !== undefined).join(' ');
+}
+//# sourceMappingURL=attempt.js.map

package/dist/features/utils/attempt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attempt.js","sourceRoot":"","sources":["../../../src/features/utils/attempt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAsB,MAAM,qBAAqB,CAAC;AAMhG,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAI,IAAsB;IACtD,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACjE,CAAC;AACF,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAI,IAAa;IAC3C,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACjE,CAAC;AACF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,cAAc,CAAC,OAAsB;IACpD,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AAC1D,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,eAAe,CAAC,OAAsB;IACrD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAsB;IAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9F,CAAC"}

package/dist/features/utils/qr-code.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Generate QR code data URL from TOTP URI. The URI is a secret: it is length
+ * bounded, and neither it nor the generator's own text reaches a message or a
+ * detail (the generator's failure is the `cause`).
+ * @param totpURI - The TOTP URI from Better Auth
+ * @returns Promise<string> - QR code as data URL
+ * @throws CapabilityError `qr-code-input-invalid` or `qr-code-unavailable`
+ */
+export declare function generateQRCodeDataURL(totpURI: string): Promise<string>;
+/**
+ * Extract secret from TOTP URI for manual entry
+ * @param totpURI - The TOTP URI from Better Auth
+ * @returns string - The secret for manual entry
+ * @throws CapabilityError `totp-uri-invalid`
+ */
+export declare function extractSecretFromTOTPURI(totpURI: string): string;
+//# sourceMappingURL=qr-code.d.ts.map

package/dist/features/utils/qr-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr-code.d.ts","sourceRoot":"","sources":["../../../src/features/utils/qr-code.ts"],"names":[],"mappings":"AAiBA;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B5E;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAWhE"}

package/dist/features/utils/qr-code.js

@@ -0,0 +1,68 @@
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { attempt } from "./attempt.js";
+/** The longest TOTP URI accepted: a Better Auth `otpauth://` URI is a few hundred characters. */
+const MAX_TOTP_URI_LENGTH = 1024;
+const totpUriSchema = z.string().min(1).max(MAX_TOTP_URI_LENGTH);
+async function loadQRCode() {
+    const module = await import('qrcode');
+    // SAFETY: `qrcode` is a CommonJS package; under ESM interop its API is `default`, under CJS interop the module itself.
+    return (module.default ?? module);
+}
+/**
+ * Generate QR code data URL from TOTP URI. The URI is a secret: it is length
+ * bounded, and neither it nor the generator's own text reaches a message or a
+ * detail (the generator's failure is the `cause`).
+ * @param totpURI - The TOTP URI from Better Auth
+ * @returns Promise<string> - QR code as data URL
+ * @throws CapabilityError `qr-code-input-invalid` or `qr-code-unavailable`
+ */
+export async function generateQRCodeDataURL(totpURI) {
+    const uri = totpUriSchema.safeParse(totpURI);
+    if (!uri.success) {
+        throw new CapabilityError('The TOTP URI is not valid.', 'INVALID_INPUT', {
+            reason: 'qr-code-input-invalid',
+            retryable: false,
+            details: { maxLength: MAX_TOTP_URI_LENGTH }
+        });
+    }
+    const generated = await attempt(async () => {
+        const QRCode = await loadQRCode();
+        return QRCode.toDataURL(uri.data, {
+            errorCorrectionLevel: 'L',
+            margin: 1,
+            color: {
+                dark: '#000000',
+                light: '#FFFFFF'
+            },
+            width: 256
+        });
+    });
+    if (!generated.ok) {
+        throw new CapabilityError('The QR code could not be generated.', 'UNAVAILABLE', {
+            reason: 'qr-code-unavailable',
+            retryable: false,
+            cause: generated.failure
+        });
+    }
+    return generated.value;
+}
+/**
+ * Extract secret from TOTP URI for manual entry
+ * @param totpURI - The TOTP URI from Better Auth
+ * @returns string - The secret for manual entry
+ * @throws CapabilityError `totp-uri-invalid`
+ */
+export function extractSecretFromTOTPURI(totpURI) {
+    const uri = totpUriSchema.safeParse(totpURI);
+    const url = uri.success ? URL.parse(uri.data) : null;
+    const secret = url?.searchParams.get('secret');
+    if (!secret) {
+        throw new CapabilityError('The TOTP URI does not carry a secret.', 'INVALID_INPUT', {
+            reason: 'totp-uri-invalid',
+            retryable: false
+        });
+    }
+    return secret;
+}
+//# sourceMappingURL=qr-code.js.map

package/dist/features/utils/qr-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr-code.js","sourceRoot":"","sources":["../../../src/features/utils/qr-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC,iGAAiG;AACjG,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAEjE,KAAK,UAAU,UAAU;IACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,uHAAuH;IACvH,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAiB,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe;IAC1D,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CAAC,4BAA4B,EAAE,eAAe,EAAE;YACxE,MAAM,EAAE,uBAAuB;YAC/B,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE;SAC3C,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QAC1C,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;YACjC,oBAAoB,EAAE,GAAG;YACzB,MAAM,EAAE,CAAC;YACT,KAAK,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,SAAS;aAChB;YACD,KAAK,EAAE,GAAG;SACV,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,aAAa,EAAE;YAC/E,MAAM,EAAE,qBAAqB;YAC7B,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,SAAS,CAAC,OAAO;SACxB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACvD,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,MAAM,MAAM,GAAG,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE;YACnF,MAAM,EAAE,kBAAkB;YAC1B,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,60 @@
+export { DefaultAuthProvider } from './client/provider-compat.ts';
+export { AUTH_DEVICE_SESSION_CAPABILITY_ID, AUTH_DEVICE_SESSION_CLIENT_ID, AUTH_DEVICE_SESSION_KIND, AUTH_DEVICE_SESSION_REVALIDATE_MS, authDeviceSessionCapabilityDescriptor, authDeviceSessionCapabilityExposure, authDeviceSessionCapabilityKind, authDeviceSessionDescriptorSchema, authDeviceSessionErrorSchema, authDeviceSessionSnapshotSchema, authDeviceSessionUserSchema, authDeviceSessionWarningSchema, authProviderKind } from './runtime/kinds/index.ts';
+export type { AuthDeviceSessionCapability, AuthDeviceSessionDescriptor, AuthDeviceSessionSnapshot, AuthDeviceSessionUser, AuthDeviceSessionWarning } from './runtime/kinds/index.ts';
+export { default as authPlugin } from './runtime/auth.plugin.ts';
+export { DelegatedActorVerificationSchema, SessionJwtVerificationSchema, authRequestPrincipal, bindVerifiedSessionJwt, createJwtSessionBindingHandler, createJwtSessionHandle, verifyDelegatedActorClaims, verifyDelegatedActorClaimsResult, verifySessionJwtResult } from './server/jwt-session-handle.ts';
+export { BROWSER_SESSION_HANDOFF_COOKIE, createBrowserSessionCodeHandoff } from './server/browser-session-code-handoff.ts';
+export type { BrowserSessionCodeHandoffOptions } from './server/browser-session-code-handoff.ts';
+export type { DelegatedActorClaims, DelegatedActorVerification, DelegatedActorVerificationOptions, JwtSessionHandleOptions, OrgClaim, SessionJwtVerification } from './server/jwt-session-handle.ts';
+export type { Session, AuthKey, AuthAttempt, ApiKey, ExternalApplication, AuthToken, TotpSecret, RecoveryCode, DatabaseUserAttributes, ApiScope, ApiKeyWithApplication, SessionWithUser, AuthState, ValidatedSessionContext } from './schemas/index.ts';
+export { apiScopes } from './schemas/index.ts';
+export type { BetterAuthUser as User, BetterAuthSession as BASession } from './schemas/index.ts';
+export { authCapabilitySchema, authCapabilitiesSchema } from './schemas/index.ts';
+export type { AuthCapability, AuthCapabilities } from './schemas/index.ts';
+export type { AuthAdminClient, AuthAdminClientOptions, AuthAdminCreateUserInput, AuthAdminCreateUserResult, AuthAdminSecurityApiKeyRecord, AuthAdminSecurityApiKeyStatus, AuthAdminSecurityApiKeysPage, AuthAdminSecurityPagination, AuthAdminSecuritySessionRecord, AuthAdminSecuritySessionStatus, AuthAdminSecuritySessionsPage, AuthAdminUserDetail, AuthAdminUserListItem, AuthAdminOperatorUserRecord, AuthAdminUserProfileRecord, AuthAdminUserRecord, AuthAdminUserRoleFilter, AuthAdminUsersPage, PermissionRecord, RolePermissionRecord, RoleRecord, SecurityStats } from './schemas/index.ts';
+export { CreateApiKeyInputSchema, CreatedApiKeySchema, ApiKeyValidationResultSchema, ApiKeyValidationResponseSchema } from './schemas/index.ts';
+export type { CreateApiKeyInput, CreatedApiKey, ApiKeyValidationResult, ApiKeyValidationResponse } from './schemas/index.ts';
+export { AuthProviderDescriptorSchema, AuthProviderTypeSchema, ApiAuthConfigSchema, DbAuthConfigSchema, AuthContextSchema } from './schemas/index.ts';
+export type { AuthProviderDescriptor, AuthProviderType, ApiAuthConfig, DbAuthConfig, AuthContext, AuthProviderImplementation } from './schemas/index.ts';
+export { userKindValues, userKindSchema, authScopeValues, authScopeSchema, agentProfileSchema, agentIdentitySchema, scopedApiKeySchema, createAgentKeyInputSchema, createAgentIdentityInputSchema, agentCredentialMetadataSchema, ownedAgentCredentialSummarySchema, ownedAgentCredentialsResponseSchema, agentPrincipalOwnerSchema, authenticatedAgentPrincipalSchema, issueAgentCredentialInputSchema, issuedAgentCredentialSchema } from './schemas/index.ts';
+export type { UserKind, AuthScope, AgentProfile, AgentIdentity, ScopedApiKey, CreateAgentKeyInput, CreateAgentIdentityInput, AgentCredentialMetadata, OwnedAgentCredentialSummary, OwnedAgentCredentialsResponse, AgentPrincipalOwner, AuthenticatedAgentPrincipal, IssueAgentCredentialInput, IssuedAgentCredential } from './schemas/index.ts';
+export { authSecretReferenceSchema, credentialTypeSchema, credentialInfoSchema, setCredentialsInputSchema, authCredentialsUserSchema, authCredentialsTokenSchema, authCredentialsSchema } from './schemas/index.ts';
+export type { AuthSecretReference, CredentialType, CredentialInfo, SetCredentialsInput, AuthCredentialsUser, AuthCredentialsToken, AuthCredentials } from './schemas/index.ts';
+export { loginSchema, registerSchema, updateUserSchema, forgotPasswordSchema, resetPasswordSchema, changePasswordSchema, generateApiKeySchema, authorizeExternalAppSchema, cliAuthSchema, mfaSetupSchema, mfaVerificationSchema, mfaDisableSchema, recoveryCodeSchema, regenerateRecoveryCodesSchema, availableScopes } from './schemas/index.ts';
+export type { LoginInput, RegisterInput, UpdateUserInput, ForgotPasswordInput, ResetPasswordInput, ChangePasswordInput, GenerateApiKeyInput, AuthorizeExternalAppInput, CliAuthInput, MfaSetupInput, MfaVerificationInput, MfaDisableInput, RecoveryCodeInput, RegenerateRecoveryCodesInput } from './schemas/index.ts';
+export { loginUIStateSchema, registerUIStateSchema, passwordResetUIStateSchema, twoFactorUIStateSchema, mfaSetupUIStateSchema, mfaVerificationUIStateSchema, mfaSettingsUIStateSchema, apiKeyUIStateSchema, authModalStateSchema, externalAppAuthStateSchema, authGuardStateSchema, profileAuthSectionStateSchema } from './schemas/index.ts';
+export type { LoginUIState, RegisterUIState, PasswordResetUIState, TwoFactorUIState, MfaSetupUIState, MfaVerificationUIState, MfaSettingsUIState, ApiKeyUIState, AuthModalState, ExternalAppAuthState, AuthGuardState, ProfileAuthSectionState, LoginFormProps, OAuthButtonsProps, AuthGuardProps } from './schemas/index.ts';
+export { emailTemplateTypeSchema, emailDataSchema, emailRateLimitSchema, emailTemplateContextSchema, emailSendResultSchema } from './features/email/schemas/index.ts';
+export type { EmailTemplateType, EmailData, EmailRateLimit, EmailSendResult } from './features/email/schemas/index.ts';
+export { emailTemplateDataSchema, emailQueueJobSchema, emailStatsSchema, emailProviderSchema, emailServiceConfigSchema } from './features/email/schemas/index.ts';
+export type { EmailTemplateData, EmailQueueJob, EmailStats, EmailProvider, EmailServiceConfig } from './features/email/schemas/index.ts';
+export { emailVerificationRequestSchema, passwordResetRequestSchema, emailVerificationTokenSchema, passwordResetTokenSchema, emailTemplateFormSchema, bulkEmailSendSchema, emailPreferencesSchema, emailBounceSchema } from './features/email/schemas/index.ts';
+export type { EmailVerificationRequest, PasswordResetRequest, EmailVerificationToken, PasswordResetToken, EmailTemplateForm, BulkEmailSend, EmailPreferences, EmailBounce } from './features/email/schemas/index.ts';
+export { TransportOptionsSchema, EmailProviderModeSchema, ResolvedSmtpConfigSchema, ResolvedTransportOptionsSchema } from './features/email/schemas/index.ts';
+export type { TransportOptions, EmailProviderMode, ResolvedSmtpConfig, ResolvedTransportOptions } from './features/email/schemas/index.ts';
+export { oauthAccountCredentialReference, oauthAccountCredentialSelectionSchema, type OAuthAccountCredentialSelectionInput, oauthDefaultAccountCredentialReference, oauthDefaultAccountCredentialSelectionSchema, type OAuthDefaultAccountCredentialSelectionInput } from './bearer/oauth-account.ts';
+export type { OAuthProvider, OAuthAccount, OAuthCallback, OAuthState, OAuthProviderConfig, OAuthSignInRequest, OAuthProviderSettings } from './features/oauth/schemas/index.ts';
+export { oauthProviderSchema, oauthAccountSchema, oauthCallbackSchema, oauthStateSchema, oauthProviderConfigSchema, oauthSignInSchema, oauthProviderSettingsSchema } from './features/oauth/schemas/index.ts';
+export { oauthSignInFormSchema, oauthProviderSettingsFormSchema } from './features/oauth/schemas/index.ts';
+export type { OAuthSignInForm, OAuthProviderSettingsForm } from './features/oauth/schemas/index.ts';
+export { oauthProviderDisplaySchema } from './features/oauth/schemas/index.ts';
+export type { OAuthProviderDisplay, OAuthButtonState, OAuthFlowUIState } from './features/oauth/schemas/index.ts';
+export type { Permission, PermissionAction, PermissionResource, Role, RolePermission, UserRole, RoleWithPermissions, UserRoleWithDetails, PermissionCheck, SystemRole, UserPermission } from './features/permissions/schemas/index.ts';
+export { createRoleSchema, updateRoleSchema, assignRoleSchema, createPermissionSchema, grantPermissionsSchema, revokePermissionsSchema, checkPermissionSchema, permissionActionSchema, permissionResourceSchema, systemRoles, isSystemRole } from './features/permissions/schemas/index.ts';
+export type { CreateRoleInput, UpdateRoleInput, AssignRoleInput, CreatePermissionInput, GrantPermissionsInput, RevokePermissionsInput, CheckPermissionInput } from './features/permissions/schemas/index.ts';
+export { roleSelectionSchema, permissionFilterSchema, roleAssignmentModalSchema, permissionViewStateSchema } from './features/permissions/schemas/index.ts';
+export type { RoleListItem, PermissionListItem, UserRoleAssignment, PermissionTreeNode, RoleSelection, PermissionFilter, RoleAssignmentModal, PermissionViewState } from './features/permissions/schemas/index.ts';
+export type { GuardConfig, RouteGuardConfig, ResourceGuardConfig } from './features/permissions/schemas/index.ts';
+export { authorizationPrincipalSchema, authorizationGateSchema, organizationAuthorizationRoleSchema, authorizationRequestSchema, authorizationDecisionReasonSchema, authorizationDecisionEvidenceSchema, authorizationDecisionSchema, authorize, hasOrganizationPermission, authorizeOrganizationPermission, organizationAuthorizationRequestSchema, organizationAuthorizationResultSchema } from './features/authorization/organization-policy.ts';
+export type { AuthorizationPrincipal, AuthorizationGate, AuthorizationRequest, AuthorizationDecision, OrganizationAuthorizationRole, OrganizationAuthorizationRequest, OrganizationAuthorizationResult } from './features/authorization/organization-policy.ts';
+export type { AuthUser, NamedRow, PermissionCheckResult, PermissionContext, PermissionDefinition, PermissionRequirement, PermissionRequirementWithResourceId, ResourceOwnership, RoleDefinition, SeedMappingRow, SeedPermissionInput, SeedPermissionRow, SeedRoleInput, SeedRoleRow, UserPermissionRow, UserRoleRow } from './features/permissions/schemas/index.ts';
+export { authUserSchema, namedRowSchema, permissionCheckResultSchema, permissionContextSchema, permissionDefinitionSchema, permissionRequirementSchema, permissionRequirementWithResourceIdSchema, resourceOwnershipSchema, roleDefinitionSchema, seedMappingRowSchema, seedPermissionInputSchema, seedPermissionRowSchema, seedRoleInputSchema, seedRoleRowSchema, userPermissionRowSchema, userRoleRowSchema } from './features/permissions/schemas/index.ts';
+export { default as authConfigDescriptor } from './runtime/auth.config.descriptor.ts';
+export { default as authContextDescriptor } from './runtime/auth.context.descriptor.ts';
+export { default as authLoggerDescriptor } from './runtime/logging/auth.logger.descriptor.ts';
+export { default as authOutputDescriptor } from './runtime/logging/auth.output.descriptor.ts';
+export { resolveAuthApiBaseUrl } from './features/config/auth-api.ts';
+export { AUTH_E2E_LOCAL_ORIGIN, AUTH_E2E_DEV_SERVER_ORIGIN, resolveAuthE2EOriginOverride, resolveAuthE2EOrigin, resolveAuthE2EBaseUrl, shouldUseExternalAuthOrigin } from './features/config/e2e.ts';
+export { generateQRCodeDataURL, extractSecretFromTOTPURI } from './features/utils/qr-code.ts';
+export { getAuthErrorMessage } from './features/core/shared/auth-errors.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACN,iCAAiC,EACjC,6BAA6B,EAC7B,wBAAwB,EACxB,iCAAiC,EACjC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,gBAAgB,EAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,gCAAgC,EAChC,sBAAsB,EACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,EAC/B,MAAM,0CAA0C,CAAC;AAClD,YAAY,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AACjG,YAAY,EACX,oBAAoB,EACpB,0BAA0B,EAC1B,iCAAiC,EACjC,uBAAuB,EACvB,QAAQ,EACR,sBAAsB,EACtB,MAAM,gCAAgC,CAAC;AAGxC,YAAY,EACX,OAAO,EACP,OAAO,EACP,WAAW,EACX,MAAM,EACN,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,sBAAsB,EACtB,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,SAAS,EACT,uBAAuB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,YAAY,EAAE,cAAc,IAAI,IAAI,EAAE,iBAAiB,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,YAAY,EACX,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,8BAA8B,EAC9B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,wBAAwB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,WAAW,EACX,0BAA0B,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,cAAc,EACd,cAAc,EACd,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,iCAAiC,EACjC,mCAAmC,EACnC,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC7B,eAAe,EACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,4BAA4B,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,6BAA6B,EAC7B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACN,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,eAAe,EACf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,EACxB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,+BAA+B,EAAE,qCAAqC,EAAE,KAAK,oCAAoC,EAAE,sCAAsC,EAAE,4CAA4C,EAAE,KAAK,2CAA2C,EAAE,MAAM,2BAA2B,CAAC;AAGtS,YAAY,EACX,aAAa,EACb,YAAY,EACZ,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,+BAA+B,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,YAAY,EACX,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,mCAAmC,CAAC;AAG3C,YAAY,EACX,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,IAAI,EACJ,cAAc,EACd,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,cAAc,EACd,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACX,eAAe,EACf,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACX,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACX,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,4BAA4B,EAC5B,uBAAuB,EACvB,mCAAmC,EACnC,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,2BAA2B,EAC3B,SAAS,EACT,yBAAyB,EACzB,+BAA+B,EAC/B,sCAAsC,EACtC,qCAAqC,EACrC,MAAM,iDAAiD,CAAC;AACzD,YAAY,EACX,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,6BAA6B,EAC7B,gCAAgC,EAChC,+BAA+B,EAC/B,MAAM,iDAAiD,CAAC;AACzD,YAAY,EACX,QAAQ,EACR,QAAQ,EACR,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,mCAAmC,EACnC,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,yCAAyC,EACzC,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAG9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACN,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2BAA2B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC"}

package/dist/index.js

@@ -0,0 +1,37 @@
+export { DefaultAuthProvider } from "./client/provider-compat.js";
+export { AUTH_DEVICE_SESSION_CAPABILITY_ID, AUTH_DEVICE_SESSION_CLIENT_ID, AUTH_DEVICE_SESSION_KIND, AUTH_DEVICE_SESSION_REVALIDATE_MS, authDeviceSessionCapabilityDescriptor, authDeviceSessionCapabilityExposure, authDeviceSessionCapabilityKind, authDeviceSessionDescriptorSchema, authDeviceSessionErrorSchema, authDeviceSessionSnapshotSchema, authDeviceSessionUserSchema, authDeviceSessionWarningSchema, authProviderKind } from "./runtime/kinds/index.js";
+export { default as authPlugin } from "./runtime/auth.plugin.js";
+export { DelegatedActorVerificationSchema, SessionJwtVerificationSchema, authRequestPrincipal, bindVerifiedSessionJwt, createJwtSessionBindingHandler, createJwtSessionHandle, verifyDelegatedActorClaims, verifyDelegatedActorClaimsResult, verifySessionJwtResult } from "./server/jwt-session-handle.js";
+export { BROWSER_SESSION_HANDOFF_COOKIE, createBrowserSessionCodeHandoff } from "./server/browser-session-code-handoff.js";
+export { apiScopes } from "./schemas/index.js";
+export { authCapabilitySchema, authCapabilitiesSchema } from "./schemas/index.js";
+export { CreateApiKeyInputSchema, CreatedApiKeySchema, ApiKeyValidationResultSchema, ApiKeyValidationResponseSchema } from "./schemas/index.js";
+export { AuthProviderDescriptorSchema, AuthProviderTypeSchema, ApiAuthConfigSchema, DbAuthConfigSchema, AuthContextSchema } from "./schemas/index.js";
+export { userKindValues, userKindSchema, authScopeValues, authScopeSchema, agentProfileSchema, agentIdentitySchema, scopedApiKeySchema, createAgentKeyInputSchema, createAgentIdentityInputSchema, agentCredentialMetadataSchema, ownedAgentCredentialSummarySchema, ownedAgentCredentialsResponseSchema, agentPrincipalOwnerSchema, authenticatedAgentPrincipalSchema, issueAgentCredentialInputSchema, issuedAgentCredentialSchema } from "./schemas/index.js";
+export { authSecretReferenceSchema, credentialTypeSchema, credentialInfoSchema, setCredentialsInputSchema, authCredentialsUserSchema, authCredentialsTokenSchema, authCredentialsSchema } from "./schemas/index.js";
+export { loginSchema, registerSchema, updateUserSchema, forgotPasswordSchema, resetPasswordSchema, changePasswordSchema, generateApiKeySchema, authorizeExternalAppSchema, cliAuthSchema, mfaSetupSchema, mfaVerificationSchema, mfaDisableSchema, recoveryCodeSchema, regenerateRecoveryCodesSchema, availableScopes } from "./schemas/index.js";
+export { loginUIStateSchema, registerUIStateSchema, passwordResetUIStateSchema, twoFactorUIStateSchema, mfaSetupUIStateSchema, mfaVerificationUIStateSchema, mfaSettingsUIStateSchema, apiKeyUIStateSchema, authModalStateSchema, externalAppAuthStateSchema, authGuardStateSchema, profileAuthSectionStateSchema } from "./schemas/index.js";
+// Email schemas
+export { emailTemplateTypeSchema, emailDataSchema, emailRateLimitSchema, emailTemplateContextSchema, emailSendResultSchema } from "./features/email/schemas/index.js";
+export { emailTemplateDataSchema, emailQueueJobSchema, emailStatsSchema, emailProviderSchema, emailServiceConfigSchema } from "./features/email/schemas/index.js";
+export { emailVerificationRequestSchema, passwordResetRequestSchema, emailVerificationTokenSchema, passwordResetTokenSchema, emailTemplateFormSchema, bulkEmailSendSchema, emailPreferencesSchema, emailBounceSchema } from "./features/email/schemas/index.js";
+export { TransportOptionsSchema, EmailProviderModeSchema, ResolvedSmtpConfigSchema, ResolvedTransportOptionsSchema } from "./features/email/schemas/index.js";
+export { oauthAccountCredentialReference, oauthAccountCredentialSelectionSchema, oauthDefaultAccountCredentialReference, oauthDefaultAccountCredentialSelectionSchema } from "./bearer/oauth-account.js";
+export { oauthProviderSchema, oauthAccountSchema, oauthCallbackSchema, oauthStateSchema, oauthProviderConfigSchema, oauthSignInSchema, oauthProviderSettingsSchema } from "./features/oauth/schemas/index.js";
+export { oauthSignInFormSchema, oauthProviderSettingsFormSchema } from "./features/oauth/schemas/index.js";
+export { oauthProviderDisplaySchema } from "./features/oauth/schemas/index.js";
+export { createRoleSchema, updateRoleSchema, assignRoleSchema, createPermissionSchema, grantPermissionsSchema, revokePermissionsSchema, checkPermissionSchema, permissionActionSchema, permissionResourceSchema, systemRoles, isSystemRole } from "./features/permissions/schemas/index.js";
+export { roleSelectionSchema, permissionFilterSchema, roleAssignmentModalSchema, permissionViewStateSchema } from "./features/permissions/schemas/index.js";
+export { authorizationPrincipalSchema, authorizationGateSchema, organizationAuthorizationRoleSchema, authorizationRequestSchema, authorizationDecisionReasonSchema, authorizationDecisionEvidenceSchema, authorizationDecisionSchema, authorize, hasOrganizationPermission, authorizeOrganizationPermission, organizationAuthorizationRequestSchema, organizationAuthorizationResultSchema } from "./features/authorization/organization-policy.js";
+export { authUserSchema, namedRowSchema, permissionCheckResultSchema, permissionContextSchema, permissionDefinitionSchema, permissionRequirementSchema, permissionRequirementWithResourceIdSchema, resourceOwnershipSchema, roleDefinitionSchema, seedMappingRowSchema, seedPermissionInputSchema, seedPermissionRowSchema, seedRoleInputSchema, seedRoleRowSchema, userPermissionRowSchema, userRoleRowSchema } from "./features/permissions/schemas/index.js";
+// Runtime descriptors
+export { default as authConfigDescriptor } from "./runtime/auth.config.descriptor.js";
+export { default as authContextDescriptor } from "./runtime/auth.context.descriptor.js";
+export { default as authLoggerDescriptor } from "./runtime/logging/auth.logger.descriptor.js";
+export { default as authOutputDescriptor } from "./runtime/logging/auth.output.descriptor.js";
+// Features
+export { resolveAuthApiBaseUrl } from "./features/config/auth-api.js";
+export { AUTH_E2E_LOCAL_ORIGIN, AUTH_E2E_DEV_SERVER_ORIGIN, resolveAuthE2EOriginOverride, resolveAuthE2EOrigin, resolveAuthE2EBaseUrl, shouldUseExternalAuthOrigin } from "./features/config/e2e.js";
+export { generateQRCodeDataURL, extractSecretFromTOTPURI } from "./features/utils/qr-code.js";
+export { getAuthErrorMessage } from "./features/core/shared/auth-errors.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACN,iCAAiC,EACjC,6BAA6B,EAC7B,wBAAwB,EACxB,iCAAiC,EACjC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,gBAAgB,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,gCAAgC,EAChC,sBAAsB,EACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,EAC/B,MAAM,0CAA0C,CAAC;AA4BlD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AA0BlF,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,8BAA8B,EAC9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACN,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,oBAAoB,CAAC;AAS5B,OAAO,EACN,cAAc,EACd,cAAc,EACd,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,iCAAiC,EACjC,mCAAmC,EACnC,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,MAAM,oBAAoB,CAAC;AAiB5B,OAAO,EACN,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,EACN,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC7B,eAAe,EACf,MAAM,oBAAoB,CAAC;AAiB5B,OAAO,EACN,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,6BAA6B,EAC7B,MAAM,oBAAoB,CAAC;AAmB5B,gBAAgB;AAChB,OAAO,EACN,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,mCAAmC,CAAC;AAO3C,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,EACxB,MAAM,mCAAmC,CAAC;AAQ3C,OAAO,EACN,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,mCAAmC,CAAC;AAW3C,OAAO,EACN,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,MAAM,mCAAmC,CAAC;AAQ3C,OAAO,EAAE,+BAA+B,EAAE,qCAAqC,EAA6C,sCAAsC,EAAE,4CAA4C,EAAoD,MAAM,2BAA2B,CAAC;AAYtS,OAAO,EACN,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,+BAA+B,EAC/B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAqB/E,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,MAAM,yCAAyC,CAAC;AAUjD,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,yCAAyC,CAAC;AAgBjD,OAAO,EACN,4BAA4B,EAC5B,uBAAuB,EACvB,mCAAmC,EACnC,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,2BAA2B,EAC3B,SAAS,EACT,yBAAyB,EACzB,+BAA+B,EAC/B,sCAAsC,EACtC,qCAAqC,EACrC,MAAM,iDAAiD,CAAC;AA4BzD,OAAO,EACN,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,yCAAyC,EACzC,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,yCAAyC,CAAC;AAEjD,sBAAsB;AACtB,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAE9F,WAAW;AACX,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACN,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2BAA2B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC"}

package/dist/json.d.ts

@@ -0,0 +1,11 @@
+import * as z from 'zod/v4';
+export type JsonPrimitive = string | number | boolean | null;
+export type JsonObject = {
+    readonly [key: string]: JsonValue;
+};
+export type JsonValue = JsonPrimitive | JsonValue[] | JsonObject;
+export declare const jsonValueSchema: z.ZodType<JsonValue>;
+export declare const jsonObjectSchema: z.ZodType<JsonObject>;
+export declare function asJsonObject(value: JsonValue | undefined | null): JsonObject | undefined;
+export declare function asJsonString(value: JsonValue | undefined): string | undefined;
+//# sourceMappingURL=json.d.ts.map

package/dist/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAC/D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,GAAG,UAAU,CAAC;AAEjE,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAShD,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAyC,CAAC;AAE7F,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI,GAAG,UAAU,GAAG,SAAS,CAGxF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG7E"}

package/dist/json.js

@@ -0,0 +1,19 @@
+import * as z from 'zod/v4';
+export const jsonValueSchema = z.lazy(() => z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+    z.array(jsonValueSchema),
+    z.record(z.string(), jsonValueSchema)
+]));
+export const jsonObjectSchema = z.record(z.string(), jsonValueSchema);
+export function asJsonObject(value) {
+    const parsed = jsonObjectSchema.safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
+export function asJsonString(value) {
+    const parsed = z.string().safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
+//# sourceMappingURL=json.js.map

package/dist/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAM5B,MAAM,CAAC,MAAM,eAAe,GAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAChE,CAAC,CAAC,KAAK,CAAC;IACP,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,IAAI,EAAE;IACR,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;CACrC,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;AAE7F,MAAM,UAAU,YAAY,CAAC,KAAmC;IAC/D,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAA4B;IACxD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC"}

package/dist/jwt/index.d.ts

@@ -0,0 +1,51 @@
+/**
+ * JWT utilities for Vibes auth.
+ * Uses jose for JWT verification against Better Auth JWKS.
+ */
+import * as z from 'zod/v4';
+import { type JWTPayload } from 'jose';
+declare global {
+    interface KVNamespace {
+        get(key: string): Promise<string | null>;
+        put(key: string, value: string, options?: {
+            expirationTtl?: number;
+        }): Promise<void>;
+    }
+}
+/** The claims Vibes reads from an auth JWT: the registered claims jose reports, and the Vibes ones; other claims pass through. */
+export declare const vibesJwtPayloadSchema: z.ZodObject<{
+    iss: z.ZodOptional<z.ZodString>;
+    sub: z.ZodOptional<z.ZodString>;
+    aud: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    exp: z.ZodOptional<z.ZodNumber>;
+    nbf: z.ZodOptional<z.ZodNumber>;
+    iat: z.ZodOptional<z.ZodNumber>;
+    jti: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    userId: z.ZodOptional<z.ZodString>;
+    org: z.ZodOptional<z.ZodString>;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    sessionId: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type VibesJWTPayload = z.infer<typeof vibesJwtPayloadSchema>;
+export type JWTValidationResult = {
+    valid: true;
+    payload: VibesJWTPayload;
+} | {
+    valid: false;
+    error: 'expired' | 'invalid' | 'revoked' | 'unknown';
+    message: string;
+};
+/**
+ * Decode a JWT without verification (for client-side inspection only).
+ * ⚠️ DO NOT use for auth decisions - signature not validated!
+ *
+ * `null` means there is no usable payload: the text is not a JWT, or a claim
+ * Vibes reads has the wrong type (`sub` a number, `roles` a string, ...). A
+ * payload with no `sub` is returned as it is: callers that need the user check
+ * it. Any other failure is not an absence and is thrown. `decode` is jose's
+ * `decodeJwt`; it is a parameter so a fault in the decoder can be exercised.
+ */
+export declare function decodeJWTUnsafe(token: string, decode?: (token: string) => JWTPayload): VibesJWTPayload | null;
+//# sourceMappingURL=index.d.ts.map

package/dist/jwt/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/jwt/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAIlD,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,WAAW;QACpB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACrF;CACD;AAED,kIAAkI;AAClI,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;iBAchC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,MAAM,mBAAmB,GAC5B;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GACzC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAK3F;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,GAAE,CAAC,KAAK,EAAE,MAAM,KAAK,UAAsB,GAAG,eAAe,GAAG,IAAI,CAQxH"}

package/dist/jwt/index.js

@@ -0,0 +1,47 @@
+/**
+ * JWT utilities for Vibes auth.
+ * Uses jose for JWT verification against Better Auth JWKS.
+ */
+import * as z from 'zod/v4';
+import { decodeJwt } from 'jose';
+import { valueFreeFailure } from '@vibesdotdev/kernel';
+import { attemptSync, rethrowFailure } from "../features/utils/attempt.js";
+/** The claims Vibes reads from an auth JWT: the registered claims jose reports, and the Vibes ones; other claims pass through. */
+export const vibesJwtPayloadSchema = z.looseObject({
+    iss: z.string().optional(),
+    sub: z.string().optional(), // user id; absent on tokens that only carry an expiry
+    aud: z.union([z.string(), z.array(z.string())]).optional(),
+    exp: z.number().optional(),
+    nbf: z.number().optional(),
+    iat: z.number().optional(),
+    jti: z.string().optional(),
+    email: z.string().optional(),
+    name: z.string().nullable().optional(),
+    userId: z.string().optional(),
+    org: z.string().optional(), // active org id
+    roles: z.array(z.string()).optional(),
+    sessionId: z.string().optional()
+});
+/** jose's code for text that is not a decodable JWT. */
+const JWT_INVALID = 'ERR_JWT_INVALID';
+/**
+ * Decode a JWT without verification (for client-side inspection only).
+ * ⚠️ DO NOT use for auth decisions - signature not validated!
+ *
+ * `null` means there is no usable payload: the text is not a JWT, or a claim
+ * Vibes reads has the wrong type (`sub` a number, `roles` a string, ...). A
+ * payload with no `sub` is returned as it is: callers that need the user check
+ * it. Any other failure is not an absence and is thrown. `decode` is jose's
+ * `decodeJwt`; it is a parameter so a fault in the decoder can be exercised.
+ */
+export function decodeJWTUnsafe(token, decode = decodeJwt) {
+    const decoded = attemptSync(() => decode(token));
+    if (!decoded.ok) {
+        if (valueFreeFailure(decoded.failure).code === JWT_INVALID)
+            return null;
+        return rethrowFailure(decoded.failure);
+    }
+    const payload = vibesJwtPayloadSchema.safeParse(decoded.value);
+    return payload.success ? payload.data : null;
+}
+//# sourceMappingURL=index.js.map

package/dist/jwt/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/jwt/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAS3E,kIAAkI;AAClI,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC;IAClD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,sDAAsD;IAClF,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,gBAAgB;IAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAOH,wDAAwD;AACxD,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,SAAwC,SAAS;IAC/F,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QACxE,OAAO,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC"}

package/dist/jwt/local-jwks-origin.d.ts

@@ -0,0 +1,3 @@
+export { isLocalAuthOrigin, resolveLocalAuthOrigin, resolveLocalAuthUrl } from '../config/local-auth-origin.ts';
+export declare function resolveJwksOrigin(authOrigin: string): string;
+//# sourceMappingURL=local-jwks-origin.d.ts.map

package/dist/jwt/local-jwks-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-jwks-origin.d.ts","sourceRoot":"","sources":["../../src/jwt/local-jwks-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,MAAM,gCAAgC,CAAC;AAIxC,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5D"}

package/dist/jwt/local-jwks-origin.js

@@ -0,0 +1,6 @@
+export { isLocalAuthOrigin, resolveLocalAuthOrigin, resolveLocalAuthUrl } from "../config/local-auth-origin.js";
+import { resolveLocalAuthOrigin } from "../config/local-auth-origin.js";
+export function resolveJwksOrigin(authOrigin) {
+    return resolveLocalAuthOrigin(authOrigin);
+}
+//# sourceMappingURL=local-jwks-origin.js.map

package/dist/jwt/local-jwks-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-jwks-origin.js","sourceRoot":"","sources":["../../src/jwt/local-jwks-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC"}

package/dist/keys/attempt.d.ts

@@ -0,0 +1,19 @@
+/**
+ * One attempt, captured once as an outcome: the value, or the failure that
+ * ended it. The caller reads the failure and decides (here: the step's
+ * `KeyEnvelopeError`, with the failure as its `cause`); the capture itself
+ * never decides, drops or rewrites it.
+ */
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+export type Attempt<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly failure: CaughtFailure;
+};
+/** Run `work`; an async failure is the outcome, never thrown. */
+export declare function attempt<T>(work: () => Promise<T>): Promise<Attempt<T>>;
+/** Run `work`; a synchronous failure is the outcome, never thrown. */
+export declare function attemptSync<T>(work: () => T): Attempt<T>;
+//# sourceMappingURL=attempt.d.ts.map

package/dist/keys/attempt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attempt.d.ts","sourceRoot":"","sources":["../../src/keys/attempt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE9E,MAAM,MAAM,OAAO,CAAC,CAAC,IAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE3D,iEAAiE;AACjE,wBAAsB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAM5E;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAMxD"}

package/dist/keys/attempt.js

@@ -0,0 +1,26 @@
+/**
+ * One attempt, captured once as an outcome: the value, or the failure that
+ * ended it. The caller reads the failure and decides (here: the step's
+ * `KeyEnvelopeError`, with the failure as its `cause`); the capture itself
+ * never decides, drops or rewrites it.
+ */
+import { CaughtFailureSchema } from '@vibesdotdev/kernel';
+/** Run `work`; an async failure is the outcome, never thrown. */
+export async function attempt(work) {
+    try {
+        return { ok: true, value: await work() };
+    }
+    catch (error) {
+        return { ok: false, failure: CaughtFailureSchema.parse(error) };
+    }
+}
+/** Run `work`; a synchronous failure is the outcome, never thrown. */
+export function attemptSync(work) {
+    try {
+        return { ok: true, value: work() };
+    }
+    catch (error) {
+        return { ok: false, failure: CaughtFailureSchema.parse(error) };
+    }
+}
+//# sourceMappingURL=attempt.js.map

package/dist/keys/attempt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attempt.js","sourceRoot":"","sources":["../../src/keys/attempt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC;AAM9E,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAI,IAAsB;IACtD,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACjE,CAAC;AACF,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAI,IAAa;IAC3C,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACjE,CAAC;AACF,CAAC"}

package/dist/keys/device-keys.d.ts

@@ -0,0 +1,24 @@
+import { type Ed25519DidKey } from './did-key.ts';
+import { type X25519PublicJwk } from './recipient-key-bundle.ts';
+/**
+ * INTERNAL. Device key generation for auth/key custody (PR2) and for tests.
+ * Not re-exported from `./keys`: features obtain device keys through the
+ * auth/key kind, so keys never exist outside custody (rotation and revocation
+ * depend on it).
+ */
+export interface DeviceKeys {
+    readonly did: Ed25519DidKey;
+    /** Ed25519 private signing key. */
+    readonly signingKey: CryptoKey;
+    readonly agreement: {
+        /** RFC 7638 thumbprint of publicJwk. */
+        readonly kid: string;
+        readonly publicJwk: X25519PublicJwk;
+        /** X25519 private key-agreement key. */
+        readonly privateKey: CryptoKey;
+    };
+}
+export declare function generateDeviceKeys(options?: {
+    extractable?: boolean;
+}): Promise<DeviceKeys>;
+//# sourceMappingURL=device-keys.d.ts.map

package/dist/keys/device-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-keys.d.ts","sourceRoot":"","sources":["../../src/keys/device-keys.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAG9E,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAExF;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,mCAAmC;IACnC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE;QACnB,wCAAwC;QACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;QACpC,wCAAwC;QACxC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;KAC/B,CAAC;CACF;AAED,wBAAsB,kBAAkB,CAAC,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CA+BrG"}

package/dist/keys/device-keys.js

@@ -0,0 +1,40 @@
+import { calculateJwkThumbprint, exportJWK } from 'jose';
+import { didKeyFromEd25519PublicKey } from "./did-key.js";
+import { attempt } from "./attempt.js";
+import { stepFailure } from "./errors.js";
+import { x25519PublicJwkSchema } from "./recipient-key-bundle.js";
+export async function generateDeviceKeys(options = {}) {
+    const extractable = options.extractable ?? false;
+    const generated = await attempt(async () => ({
+        // SAFETY: generateKey for the asymmetric algorithms Ed25519 and X25519 answers a CryptoKeyPair.
+        signing: (await crypto.subtle.generateKey({ name: 'Ed25519' }, extractable, ['sign', 'verify'])),
+        // SAFETY: as above.
+        agreement: (await crypto.subtle.generateKey({ name: 'X25519' }, extractable, ['deriveBits']))
+    }));
+    if (!generated.ok)
+        throw stepFailure(generated.failure, 'unsupported_runtime', 'generate device keys');
+    const { signing, agreement } = generated.value;
+    const exported = await attempt(async () => ({
+        rawSigningPublicKey: new Uint8Array(await crypto.subtle.exportKey('raw', signing.publicKey)),
+        exportedAgreementJwk: await exportJWK(agreement.publicKey)
+    }));
+    if (!exported.ok)
+        throw stepFailure(exported.failure, 'unsupported_runtime', 'export device public keys');
+    const { rawSigningPublicKey, exportedAgreementJwk } = exported.value;
+    // Normalize: runtimes add ext/key_ops/alg members to exported JWKs.
+    const publicJwk = x25519PublicJwkSchema.parse({
+        kty: exportedAgreementJwk.kty,
+        crv: exportedAgreementJwk.crv,
+        x: exportedAgreementJwk.x
+    });
+    return {
+        did: didKeyFromEd25519PublicKey(rawSigningPublicKey),
+        signingKey: signing.privateKey,
+        agreement: {
+            kid: await calculateJwkThumbprint(publicJwk),
+            publicJwk,
+            privateKey: agreement.privateKey
+        }
+    };
+}
+//# sourceMappingURL=device-keys.js.map

package/dist/keys/device-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-keys.js","sourceRoot":"","sources":["../../src/keys/device-keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAsB,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAwB,MAAM,2BAA2B,CAAC;AAqBxF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5C,gGAAgG;QAChG,OAAO,EAAE,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAkB;QACjH,oBAAoB;QACpB,SAAS,EAAE,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,CAAC,CAAkB;KAC9G,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,CAAC,CAAC;IACvG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3C,mBAAmB,EAAE,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5F,oBAAoB,EAAE,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC;KAC1D,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;IAC1G,MAAM,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IACrE,oEAAoE;IACpE,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC;QAC7C,GAAG,EAAE,oBAAoB,CAAC,GAAG;QAC7B,GAAG,EAAE,oBAAoB,CAAC,GAAG;QAC7B,CAAC,EAAE,oBAAoB,CAAC,CAAC;KACzB,CAAC,CAAC;IACH,OAAO;QACN,GAAG,EAAE,0BAA0B,CAAC,mBAAmB,CAAC;QACpD,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE;YACV,GAAG,EAAE,MAAM,sBAAsB,CAAC,SAAS,CAAC;YAC5C,SAAS;YACT,UAAU,EAAE,SAAS,CAAC,UAAU;SAChC;KACD,CAAC;AACH,CAAC"}