@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/runtime/auth.config.descriptor.js

@@ -0,0 +1,83 @@
+/**
+ * Auth Config Manifest Descriptor
+ *
+ * Declares the authentication credentials schema for runtime resolution.
+ * The auth provider (auth/kinds/provider.default.ts) queries this manifest
+ * via runtime.query('config/manifest').withId('auth') to load credentials.
+ *
+ * Auto-discovered by the runtime.
+ */
+import { authCredentialsSchema } from "../schemas/credentials.js";
+/**
+ * Schema for stored authentication credentials.
+ *
+ * The API auth provider reads `credentials.token` by default
+ * (configured via api.descriptor.ts configKey: 'credentials.token').
+ *
+ * Login stores apiKey here; the auth provider resolves it as a bearer token.
+ * User metadata (userId, email, name) is stored alongside credentials.
+ */
+const descriptor = {
+    kind: 'config/manifest',
+    id: 'auth',
+    name: 'Authentication',
+    description: 'Authentication credentials for API access',
+    // Storage configuration
+    namespace: 'auth',
+    schema: authCredentialsSchema,
+    allowedAdapters: ['storage.localdb'],
+    scope: 'global',
+    customTables: false,
+    version: 1,
+    internal: false,
+    // Sensitive fields — adapters supporting encryption will encrypt these at rest
+    sensitiveFields: [
+        'credentials.token',
+        'credentials.apiKey',
+        'credentials.sessionToken',
+        'credentials.refreshToken'
+    ],
+    // Config tier and classification
+    tier: 'user',
+    category: 'system',
+    // Field metadata for UI
+    fields: {
+        'credentials.token': {
+            ui: {
+                label: 'API Token',
+                description: 'Bearer token for API authentication',
+                component: 'secret'
+            }
+        },
+        'credentials.apiKey': {
+            ui: {
+                label: 'API Key',
+                description: 'API key for authentication',
+                component: 'secret'
+            }
+        },
+        'credentials.sessionToken': {
+            ui: {
+                label: 'Session Token',
+                description: 'Session token from login',
+                component: 'secret'
+            }
+        },
+        'credentials.refreshToken': {
+            ui: {
+                label: 'Refresh Token',
+                description: 'Token used to refresh expired sessions',
+                component: 'secret'
+            }
+        }
+    },
+    // Navigation
+    navigation: {
+        page: 'settings',
+        section: 'auth',
+        order: 5
+    },
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth.config.descriptor.js.map

package/dist/runtime/auth.config.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.config.descriptor.js","sourceRoot":"","sources":["../../src/runtime/auth.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,UAAU,GAA6B;IAC5C,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,2CAA2C;IAExD,wBAAwB;IACxB,SAAS,EAAE,MAAM;IACjB,MAAM,EAAE,qBAAqB;IAC7B,eAAe,EAAE,CAAC,iBAAiB,CAAC;IACpC,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,KAAK;IAEf,+EAA+E;IAC/E,eAAe,EAAE;QAChB,mBAAmB;QACnB,oBAAoB;QACpB,0BAA0B;QAC1B,0BAA0B;KAC1B;IAED,iCAAiC;IACjC,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAElB,wBAAwB;IACxB,MAAM,EAAE;QACP,mBAAmB,EAAE;YACpB,EAAE,EAAE;gBACH,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,qCAAqC;gBAClD,SAAS,EAAE,QAAQ;aACnB;SACD;QACD,oBAAoB,EAAE;YACrB,EAAE,EAAE;gBACH,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,4BAA4B;gBACzC,SAAS,EAAE,QAAQ;aACnB;SACD;QACD,0BAA0B,EAAE;YAC3B,EAAE,EAAE;gBACH,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,0BAA0B;gBACvC,SAAS,EAAE,QAAQ;aACnB;SACD;QACD,0BAA0B,EAAE;YAC3B,EAAE,EAAE;gBACH,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,wCAAwC;gBACrD,SAAS,EAAE,QAAQ;aACnB;SACD;KACD;IAED,aAAa;IACb,UAAU,EAAE;QACX,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,CAAC;KACR;IAED,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/runtime/auth.consumer.plugin.d.ts

@@ -0,0 +1,3 @@
+export declare const authConsumerPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default authConsumerPlugin;
+//# sourceMappingURL=auth.consumer.plugin.d.ts.map

package/dist/runtime/auth.consumer.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.consumer.plugin.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.consumer.plugin.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,kBAAkB,6CA4B7B,CAAC;AAEH,eAAe,kBAAkB,CAAC"}

package/dist/runtime/auth.consumer.plugin.js

@@ -0,0 +1,42 @@
+/**
+ * Auth — consumer app-authority and device-session implementations.
+ *
+ * Sub-plugin carrying portable app-authority exchange, the Node-only
+ * device-authorization implementation that backs `vibes auth login`, and the
+ * `auth/device-session` secrets store that serves that login's bearer.
+ * Portability of the app-authority loader does not make this whole plugin a
+ * browser bundle: the existing device-session closure still needs its host.
+ *
+ * Split out of the kind-declaring `auth` plugin so the universal plugin carries
+ * NO `*.impl.consumer.*` import. Tagging the device-session loader `scope: 'consumer.worker'`
+ * stops the RUNTIME resolving it in a cloud scope, but a static `import()`
+ * inside a universal plugin is still followed by the BUNDLER — so the module
+ * shipped in every cloud worker artifact that composes auth. It was present in
+ * 14 of 16 deployed apps.
+ *
+ * Compose this ONLY in a consumer-scope config. `@vibesdotdev/plugins/auth`
+ * registers it alongside `auth` for consumer surfaces; cloud apps register
+ * `auth` alone. Mirrors the disjoint-loader shape of
+ * `@vibesdotdev/agent-execution/code-session`.
+ */
+import { createRuntimePlugin, loader } from '@vibesdotdev/kernel';
+import { authDeviceSessionCapabilityDescriptor, authDeviceSessionCapabilityKind } from "../device-session/auth-device-session.capability.js";
+import consumerAuthDescriptor from "./consumer-auth.context.descriptor.js";
+import deviceSessionStoreDescriptor from "../device-session/device-session.store.descriptor.js";
+export const authConsumerPlugin = createRuntimePlugin({
+    id: 'auth-consumer',
+    name: 'Auth — app authority and device session (consumer impl)',
+    description: 'Portable app-authority exchange and Node-only device authorization. Consumer-scope only — cloud apps must not compose it.',
+    dependencies: ['auth'],
+    // The signed-in user's bearer on an interactiveSession host: a by-id
+    // `secrets/store` that `resolveCallerBearer` names (rc05 §2.2).
+    descriptors: [deviceSessionStoreDescriptor, consumerAuthDescriptor],
+    loaders: [
+        loader(consumerAuthDescriptor.id, { kind: 'context', scope: 'consumer' }, () => import("./consumer-auth.impl.consumer.js")),
+        loader(deviceSessionStoreDescriptor.id, { kind: deviceSessionStoreDescriptor.kind, scope: 'consumer' }, () => import("../device-session/device-session.store.js")),
+        loader('api', { kind: 'auth/provider', scope: 'consumer' }, () => import("./kinds/provider.api.impl.consumer.js")),
+        loader(authDeviceSessionCapabilityDescriptor.id, { kind: authDeviceSessionCapabilityKind.id, scope: 'consumer.worker' }, () => import("../device-session/auth-device-session.impl.consumer.worker.js"))
+    ]
+});
+export default authConsumerPlugin;
+//# sourceMappingURL=auth.consumer.plugin.js.map

package/dist/runtime/auth.consumer.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.consumer.plugin.js","sourceRoot":"","sources":["../../src/runtime/auth.consumer.plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACN,qCAAqC,EACrC,+BAA+B,EAC/B,MAAM,qDAAqD,CAAC;AAC7D,OAAO,sBAAsB,MAAM,uCAAuC,CAAC;AAC3E,OAAO,4BAA4B,MAAM,sDAAsD,CAAC;AAEhG,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;IACrD,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,yDAAyD;IAC/D,WAAW,EACV,2HAA2H;IAC5H,YAAY,EAAE,CAAC,MAAM,CAAC;IACtB,qEAAqE;IACrE,gEAAgE;IAChE,WAAW,EAAE,CAAC,4BAA4B,EAAE,sBAAsB,CAAC;IACnE,OAAO,EAAE;QACR,MAAM,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EACvE,GAAG,EAAE,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAClD,MAAM,CACL,4BAA4B,CAAC,EAAE,EAC/B,EAAE,IAAI,EAAE,4BAA4B,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAC9D,GAAG,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC,CACzD;QACD,MAAM,CACL,KAAK,EACL,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,EAC5C,GAAG,EAAE,CAAC,MAAM,CAAC,uCAAuC,CAAC,CACrD;QACD,MAAM,CACL,qCAAqC,CAAC,EAAE,EACxC,EAAE,IAAI,EAAE,+BAA+B,CAAC,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EACtE,GAAG,EAAE,CAAC,MAAM,CAAC,+DAA+D,CAAC,CAC7E;KACD;CACD,CAAC,CAAC;AAEH,eAAe,kBAAkB,CAAC"}

package/dist/runtime/auth.context.descriptor.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Auth Context Descriptor
+ *
+ * Runtime-local auth context. The signed-in user's bearer is not held here:
+ * the `auth/device-session` secrets store serves it (rc05 §2.2).
+ */
+/** Auth state scoped to one composed runtime instance. */
+export type AuthRuntimeContext = Record<never, never>;
+declare const _default: {
+    id: string;
+    kind: "context";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    valueKind?: "data" | "service" | undefined;
+    valueSchema?: unknown;
+    config?: {
+        sources: ("literal" | "workspace" | "floor")[];
+        subset?: true | undefined;
+    } | undefined;
+};
+export default _default;
+//# sourceMappingURL=auth.context.descriptor.d.ts.map

package/dist/runtime/auth.context.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.context.descriptor.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.context.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,0DAA0D;AAC1D,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEtD,wBAGG"}

package/dist/runtime/auth.context.descriptor.js

@@ -0,0 +1,12 @@
+/**
+ * Auth Context Descriptor
+ *
+ * Runtime-local auth context. The signed-in user's bearer is not held here:
+ * the `auth/device-session` secrets store serves it (rc05 §2.2).
+ */
+import { createContextDescriptor } from '@vibesdotdev/kernel/factory/context';
+export default createContextDescriptor({
+    id: 'auth/context',
+    description: 'Authentication context with user info and credentials.'
+});
+//# sourceMappingURL=auth.context.descriptor.js.map

package/dist/runtime/auth.context.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.context.descriptor.js","sourceRoot":"","sources":["../../src/runtime/auth.context.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAK9E,eAAe,uBAAuB,CAAC;IACtC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,wDAAwD;CACrE,CAAC,CAAC"}

package/dist/runtime/auth.context.impl.d.ts

@@ -0,0 +1,10 @@
+import type { AuthRuntimeContext } from './auth.context.descriptor.ts';
+/**
+ * One context implementation instance is created by each runtime asset graph,
+ * so auth state follows the runtime that owns it instead of a process-global
+ * module singleton.
+ */
+export default class AuthContextImplementation {
+    provide(): AuthRuntimeContext;
+}
+//# sourceMappingURL=auth.context.impl.d.ts.map

package/dist/runtime/auth.context.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.context.impl.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.context.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,yBAAyB;IAC7C,OAAO,IAAI,kBAAkB;CAG7B"}

package/dist/runtime/auth.context.impl.js

@@ -0,0 +1,11 @@
+/**
+ * One context implementation instance is created by each runtime asset graph,
+ * so auth state follows the runtime that owns it instead of a process-global
+ * module singleton.
+ */
+export default class AuthContextImplementation {
+    provide() {
+        return this;
+    }
+}
+//# sourceMappingURL=auth.context.impl.js.map

package/dist/runtime/auth.context.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.context.impl.js","sourceRoot":"","sources":["../../src/runtime/auth.context.impl.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,yBAAyB;IAC7C,OAAO;QACN,OAAO,IAAI,CAAC;IACb,CAAC;CACD"}

package/dist/runtime/auth.identity.descriptor.d.ts

@@ -0,0 +1,30 @@
+declare const _default: {
+    id: string;
+    kind: "context";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    valueKind?: "data" | "service" | undefined;
+    valueSchema?: unknown;
+    config?: {
+        sources: ("literal" | "workspace" | "floor")[];
+        subset?: true | undefined;
+    } | undefined;
+};
+export default _default;
+//# sourceMappingURL=auth.identity.descriptor.d.ts.map

package/dist/runtime/auth.identity.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.identity.descriptor.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.identity.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,wBAKG"}

package/dist/runtime/auth.identity.descriptor.js

@@ -0,0 +1,20 @@
+/**
+ * Auth Identity Context Descriptor
+ *
+ * Provides the effective authenticated identity for the currently selected
+ * environment. This is the canonical runtime context for "who am I when
+ * talking to the current environment's APIs".
+ *
+ * Registered via the auth-core-provider and pulled in through the
+ * plugins-auth umbrella (which is part of the plugins kitchen sink).
+ *
+ * Consumers (knowledge, Studio, auth commands, MCP, API clients) resolve via:
+ *   const identity = await runtime.context<AuthIdentity>('auth/identity');
+ */
+import { createContextDescriptor } from '@vibesdotdev/kernel/factory/context';
+export default createContextDescriptor({
+    id: 'auth/identity',
+    description: 'Effective user identity for the currently selected environment. ' +
+        'Contains userId + environment details for authenticated API access across surfaces.'
+});
+//# sourceMappingURL=auth.identity.descriptor.js.map

package/dist/runtime/auth.identity.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.identity.descriptor.js","sourceRoot":"","sources":["../../src/runtime/auth.identity.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,eAAe,uBAAuB,CAAC;IACtC,EAAE,EAAE,eAAe;IACnB,WAAW,EACV,kEAAkE;QAClE,qFAAqF;CACtF,CAAC,CAAC"}

package/dist/runtime/auth.identity.impl.d.ts

@@ -0,0 +1,16 @@
+import type { AuthIdentity } from '../schemas/identity.ts';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+export type { AuthIdentity } from '../schemas/identity.ts';
+/**
+ * Implementation for the 'auth/identity' context (consumer scope).
+ *
+ * The loader in auth-core-provider wires this as the provider for the
+ * 'auth/identity' context. It reuses the same resolution logic as the
+ * CLI context-bridge (config/environment + auth/provider) so that
+ * the selected environment's real user is available everywhere.
+ */
+declare const _default: {
+    provide: (runtime: VibesRuntime) => Promise<AuthIdentity>;
+};
+export default _default;
+//# sourceMappingURL=auth.identity.impl.d.ts.map

package/dist/runtime/auth.identity.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.identity.impl.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.identity.impl.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAI5F,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AA0C3D;;;;;;;GAOG;;uBAEuB,YAAY,KAAG,OAAO,CAAC,YAAY,CAAC;;AAD9D,wBA4DE"}

package/dist/runtime/auth.identity.impl.js

@@ -0,0 +1,111 @@
+import * as z from 'zod/v4';
+import { getLogger } from '@vibesdotdev/logging';
+import { CapabilityError, isCapabilityError } from '@vibesdotdev/kernel';
+import { getCredentialsWithDiagnostics } from "../features/services/credential-store.js";
+import { attempt, attemptSync, failureLabel, isAbsentFailure, rethrowFailure } from "../features/utils/attempt.js";
+/** What a selected `config/environment` offers: its id, its API origin, and (optionally) the headers it sends. */
+const configEnvironmentSurfaceSchema = z.looseObject({
+    id: z.string().min(1),
+    apiUrl: z.string().min(1),
+    getHeaders: z.function({ input: [], output: z.record(z.string(), z.string()) }).optional()
+});
+const userIdSchema = z.string().min(1).optional().catch(undefined);
+const providerUserSchema = z.looseObject({ id: userIdSchema }).optional().catch(undefined);
+/**
+ * The user id an `auth/provider` surface carries, where it carries one: `user.id`,
+ * `session.userId`, `session.user.id`, or what `getCurrentUser()` answers. A field
+ * of another shape is no id, never a failure.
+ */
+const providerSurfaceSchema = z.looseObject({
+    user: providerUserSchema,
+    session: z
+        .looseObject({ userId: userIdSchema, user: providerUserSchema })
+        .optional()
+        .catch(undefined),
+    getCurrentUser: z
+        .function({ input: [], output: z.looseObject({ id: userIdSchema }).nullish().catch(undefined) })
+        .optional()
+        .catch(undefined)
+});
+function readProviderUserId(surface, runtime) {
+    const logger = getLogger('auth.identity', runtime);
+    const fromFields = surface.user?.id ?? surface.session?.userId ?? surface.session?.user?.id;
+    if (fromFields)
+        return fromFields;
+    if (!surface.getCurrentUser)
+        return null;
+    const current = attemptSync(() => surface.getCurrentUser?.());
+    if (current.ok)
+        return current.value?.id ?? null;
+    logger.debug('auth/provider getCurrentUser failed; keeping field ids only', {
+        failure: failureLabel(current.failure)
+    });
+    return null;
+}
+/**
+ * Implementation for the 'auth/identity' context (consumer scope).
+ *
+ * The loader in auth-core-provider wires this as the provider for the
+ * 'auth/identity' context. It reuses the same resolution logic as the
+ * CLI context-bridge (config/environment + auth/provider) so that
+ * the selected environment's real user is available everywhere.
+ */
+export default {
+    provide: async (runtime) => {
+        const logger = getLogger('auth.identity', runtime);
+        const env = configEnvironmentSurfaceSchema.safeParse(await runtime.query('config/environment').resolve());
+        if (!env.success) {
+            throw new CapabilityError('config/environment is undeclared.', 'UNAVAILABLE', {
+                reason: 'environment-undeclared',
+                cause: env.error
+            });
+        }
+        const environment = {
+            id: env.data.id,
+            name: env.data.id,
+            apiUrl: env.data.apiUrl,
+            headers: env.data.getHeaders?.() ?? {}
+        };
+        let userId = null;
+        let isAuthenticated = false;
+        // No `auth/provider`, or no signed-in session, is an ordinary state; any other failure is real.
+        const provider = await attempt(() => runtime.query('auth/provider').resolve());
+        if (provider.ok) {
+            const surface = providerSurfaceSchema.safeParse(provider.value);
+            const candidate = surface.success ? readProviderUserId(surface.data, runtime) : null;
+            if (candidate) {
+                userId = candidate;
+                isAuthenticated = true;
+            }
+        }
+        else if (isAbsentFailure(provider.failure) || (isCapabilityError(provider.failure) && provider.failure.code === 'AUTH_REQUIRED')) {
+            logger.debug('No auth provider or not logged in for this environment', {
+                failure: failureLabel(provider.failure)
+            });
+        }
+        else {
+            rethrowFailure(provider.failure);
+        }
+        // Fall back to the stored `vibes auth login` credential (the same source
+        // `auth status` reads) when the live auth/provider surfaced no user id —
+        // e.g. an apiKey credential that isn't a cookie session. Keeps
+        // auth/identity consistent with auth status across every credential type,
+        // so scope resolution, knowledge, Studio and MCP all see the logged-in user.
+        if (!userId) {
+            const { credentials: creds, diagnostic } = await getCredentialsWithDiagnostics(runtime);
+            if (diagnostic) {
+                logger.warn('Credential store unavailable; staying unauthenticated', { code: diagnostic.code });
+            }
+            if (creds && creds.type !== 'none' && creds.userId) {
+                userId = creds.userId;
+                isAuthenticated = true;
+            }
+        }
+        return {
+            userId,
+            environment,
+            isAuthenticated
+        };
+    }
+};
+//# sourceMappingURL=auth.identity.impl.js.map

package/dist/runtime/auth.identity.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.identity.impl.js","sourceRoot":"","sources":["../../src/runtime/auth.identity.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAInH,kHAAkH;AAClH,MAAM,8BAA8B,GAAG,CAAC,CAAC,WAAW,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1F,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACnE,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAE3F;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3C,IAAI,EAAE,kBAAkB;IACxB,OAAO,EAAE,CAAC;SACR,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;SAC/D,QAAQ,EAAE;SACV,KAAK,CAAC,SAAS,CAAC;IAClB,cAAc,EAAE,CAAC;SACf,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;SAC/F,QAAQ,EAAE;SACV,KAAK,CAAC,SAAS,CAAC;CAClB,CAAC,CAAC;AAEH,SAAS,kBAAkB,CAAC,OAA+C,EAAE,OAAqB;IACjG,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;IAC5F,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,CAAC,OAAO,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,6DAA6D,EAAE;QAC3E,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;KACtC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,eAAe;IACd,OAAO,EAAE,KAAK,EAAE,OAAqB,EAAyB,EAAE;QAC/D,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,8BAA8B,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CAAC,mCAAmC,EAAE,aAAa,EAAE;gBAC7E,MAAM,EAAE,wBAAwB;gBAChC,KAAK,EAAE,GAAG,CAAC,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAA4B;YAC5C,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;YACf,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;YACjB,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM;YACvB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE;SACtC,CAAC;QAEF,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,eAAe,GAAG,KAAK,CAAC;QAE5B,gGAAgG;QAChG,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrF,IAAI,SAAS,EAAE,CAAC;gBACf,MAAM,GAAG,SAAS,CAAC;gBACnB,eAAe,GAAG,IAAI,CAAC;YACxB,CAAC;QACF,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,CAAC;YACpI,MAAM,CAAC,KAAK,CAAC,wDAAwD,EAAE;gBACtE,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC;aACvC,CAAC,CAAC;QACJ,CAAC;aAAM,CAAC;YACP,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,+DAA+D;QAC/D,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,6BAA6B,CAAC,OAAO,CAAC,CAAC;YACxF,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBACtB,eAAe,GAAG,IAAI,CAAC;YACxB,CAAC;QACF,CAAC;QAED,OAAO;YACN,MAAM;YACN,WAAW;YACX,eAAe;SACf,CAAC;IACH,CAAC;CACD,CAAC"}

package/dist/runtime/auth.plugin.d.ts

@@ -0,0 +1,3 @@
+declare const defaultExport: import("@vibesdotdev/kernel").RuntimePlugin;
+export default defaultExport;
+//# sourceMappingURL=auth.plugin.d.ts.map

package/dist/runtime/auth.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.plugin.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.plugin.ts"],"names":[],"mappings":"AAuBA,QAAA,MAAM,aAAa,6CA+CjB,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/runtime/auth.plugin.js

@@ -0,0 +1,58 @@
+import { createRuntimePlugin, loader } from '@vibesdotdev/kernel';
+import { authProviderKind } from "./kinds/index.js";
+import { authDeviceSessionCapabilityDescriptor, authDeviceSessionCapabilityExposure, authDeviceSessionCapabilityKind } from "../device-session/auth-device-session.capability.js";
+import authCoreProviderPlugin from "./plugin/core.provider.js";
+import authSupportPlugin from "./plugin/support.js";
+import authApiClientPlugin from "./plugin/api-client.js";
+import authLoginSucceededEventDescriptor from "../events/session-established.event.descriptor.js";
+import authEmailConfigDescriptor from "../features/email/email.config.descriptor.js";
+import authOnClientAuthRejectedSubscription from "../events/on-client-auth-rejected.subscription.descriptor.js";
+// Docs
+import authDescriptor from "../docs/auth.docs.descriptor.js";
+import flowsDescriptor from "../docs/flows.docs.descriptor.js";
+import sessionsDescriptor from "../docs/sessions.docs.descriptor.js";
+import oauthDescriptor from "../docs/oauth.docs.descriptor.js";
+import providersDescriptor from "../docs/auth.providers.docs.descriptor.js";
+import keysDescriptor from "../docs/keys.docs.descriptor.js";
+// Hoisted const: tsc rewriteRelativeImportExtensions does not rewrite `.ts` specifiers inside `export default <expr>` (TS 6.0.3).
+const defaultExport = createRuntimePlugin({
+    id: 'auth',
+    name: 'Authentication',
+    description: 'Authentication runtime assets and slice plugins',
+    dependencies: ['config', 'docs', 'runtime-client'],
+    kinds: [authProviderKind, authDeviceSessionCapabilityKind],
+    descriptors: [
+        authEmailConfigDescriptor,
+        authDescriptor,
+        flowsDescriptor,
+        sessionsDescriptor,
+        oauthDescriptor,
+        providersDescriptor,
+        keysDescriptor,
+        authLoginSucceededEventDescriptor,
+        authDeviceSessionCapabilityDescriptor,
+        authOnClientAuthRejectedSubscription
+    ],
+    loaders: [
+        loader('resolver.auth-provider', { kind: 'runtime/resolver' }, async () => import("../resolvers/auth-provider.resolver.impl.js")),
+        loader('auth.hooks.on-client-auth-rejected', { kind: 'runtime/subscription' }, async () => import("../events/on-client-auth-rejected.impl.js")),
+        // The consumer device-session loader lives in `./auth.consumer.plugin.ts`.
+        // A static import() here is followed by the bundler regardless of its
+        // scope tag, which shipped the Node-only impl into every cloud worker
+        // that composes auth.
+    ],
+    remoteExposures: [
+        {
+            kindId: authDeviceSessionCapabilityKind.id,
+            assetId: authDeviceSessionCapabilityDescriptor.id,
+            exposure: authDeviceSessionCapabilityExposure
+        }
+    ],
+    async onRegister(runtime) {
+        await runtime.registerPlugin(authCoreProviderPlugin);
+        await runtime.registerPlugin(authSupportPlugin);
+        await runtime.registerPlugin(authApiClientPlugin);
+    }
+});
+export default defaultExport;
+//# sourceMappingURL=auth.plugin.js.map

package/dist/runtime/auth.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.plugin.js","sourceRoot":"","sources":["../../src/runtime/auth.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACN,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,MAAM,qDAAqD,CAAC;AAC7D,OAAO,sBAAsB,MAAM,2BAA2B,CAAC;AAC/D,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,mBAAmB,MAAM,wBAAwB,CAAC;AACzD,OAAO,iCAAiC,MAAM,mDAAmD,CAAC;AAClG,OAAO,yBAAyB,MAAM,8CAA8C,CAAC;AACrF,OAAO,oCAAoC,MAAM,8DAA8D,CAAC;AAEhH,OAAO;AACP,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,eAAe,MAAM,kCAAkC,CAAC;AAC/D,OAAO,kBAAkB,MAAM,qCAAqC,CAAC;AACrE,OAAO,eAAe,MAAM,kCAAkC,CAAC;AAC/D,OAAO,mBAAmB,MAAM,2CAA2C,CAAC;AAC5E,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAE7D,kIAAkI;AAClI,MAAM,aAAa,GAAG,mBAAmB,CAAC;IACzC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,iDAAiD;IAC9D,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC;IAClD,KAAK,EAAE,CAAC,gBAAgB,EAAE,+BAA+B,CAAC;IAC1D,WAAW,EAAE;QACZ,yBAAyB;QACzB,cAAc;QACd,eAAe;QACf,kBAAkB;QAClB,eAAe;QACf,mBAAmB;QACnB,cAAc;QACd,iCAAiC;QACjC,qCAAqC;QACrC,oCAAoC;KACpC;IACD,OAAO,EAAE;QACR,MAAM,CACL,wBAAwB,EACxB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAC5B,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CACjE;QACD,MAAM,CACL,oCAAoC,EACpC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAChC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAC/D;QACD,2EAA2E;QAC3E,sEAAsE;QACtE,sEAAsE;QACtE,sBAAsB;KACtB;IACD,eAAe,EAAE;QAChB;YACC,MAAM,EAAE,+BAA+B,CAAC,EAAE;YAC1C,OAAO,EAAE,qCAAqC,CAAC,EAAE;YACjD,QAAQ,EAAE,mCAAmC;SAC7C;KACD;IAED,KAAK,CAAC,UAAU,CAAC,OAAO;QACvB,MAAM,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QACrD,MAAM,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/runtime/auto-verify.config.descriptor.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Auto-Verify Policy Config Manifest Descriptor
+ *
+ * Declares the admin auto-verify policy settings for runtime resolution.
+ * The auto-verify policy controls new user registration defaults:
+ *   - signup.default_status: 'pending' | 'active'
+ *   - signup.queue_enabled: boolean
+ *   - referrals.enabled: boolean
+ *
+ * System writes to this descriptor (publish side); auth-web reads via
+ * runtime.query('config/manifest').withId('auth.auto-verify').
+ *
+ * Auto-discovered by the runtime.
+ */
+import type { ConfigManifestDescriptor } from '@vibesdotdev/config/schemas/config-manifest-descriptor';
+declare const descriptor: ConfigManifestDescriptor;
+export default descriptor;
+//# sourceMappingURL=auto-verify.config.descriptor.d.ts.map

package/dist/runtime/auto-verify.config.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-verify.config.descriptor.d.ts","sourceRoot":"","sources":["../../src/runtime/auto-verify.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AASvG,QAAA,MAAM,UAAU,EAAE,wBA+DjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/runtime/auto-verify.config.descriptor.js

@@ -0,0 +1,79 @@
+/**
+ * Auto-Verify Policy Config Manifest Descriptor
+ *
+ * Declares the admin auto-verify policy settings for runtime resolution.
+ * The auto-verify policy controls new user registration defaults:
+ *   - signup.default_status: 'pending' | 'active'
+ *   - signup.queue_enabled: boolean
+ *   - referrals.enabled: boolean
+ *
+ * System writes to this descriptor (publish side); auth-web reads via
+ * runtime.query('config/manifest').withId('auth.auto-verify').
+ *
+ * Auto-discovered by the runtime.
+ */
+import * as z from 'zod/v4';
+const autoVerifySchema = z.object({
+    'signup.default_status': z.enum(['pending', 'active']).default('pending'),
+    'signup.queue_enabled': z.boolean().default(true),
+    'referrals.enabled': z.boolean().default(true)
+});
+const descriptor = {
+    kind: 'config/manifest',
+    id: 'auth.auto-verify',
+    name: 'Auto-Verify Policy',
+    description: 'Admin auto-verify policy settings for new user registration',
+    namespace: 'auth.auto-verify',
+    schema: autoVerifySchema,
+    allowedAdapters: ['storage.localdb', 'storage.drizzle'],
+    defaultAdapter: 'storage.localdb',
+    scope: 'global',
+    customTables: false,
+    version: 1,
+    internal: false,
+    tier: 'system',
+    category: 'auth',
+    fields: {
+        'signup.default_status': {
+            ui: {
+                label: 'Default Signup Status',
+                description: 'Default status for new user accounts',
+                component: 'select',
+                group: 'signup'
+            },
+            options: [
+                { value: 'pending', label: 'Pending' },
+                { value: 'active', label: 'Active' }
+            ]
+        },
+        'signup.queue_enabled': {
+            ui: {
+                label: 'Queue Enabled',
+                description: 'Show queue position to pending users',
+                component: 'switch',
+                group: 'signup'
+            }
+        },
+        'referrals.enabled': {
+            ui: {
+                label: 'Referrals Enabled',
+                description: 'Enable the referral system',
+                component: 'switch',
+                group: 'referrals'
+            }
+        }
+    },
+    groups: [
+        { id: 'signup', label: 'Signup', order: 1 },
+        { id: 'referrals', label: 'Referrals', order: 2 }
+    ],
+    navigation: {
+        page: 'settings',
+        section: 'auth',
+        order: 10,
+        showInGlobalSettings: false
+    },
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auto-verify.config.descriptor.js.map

package/dist/runtime/auto-verify.config.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-verify.config.descriptor.js","sourceRoot":"","sources":["../../src/runtime/auto-verify.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzE,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,UAAU,GAA6B;IAC5C,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,6DAA6D;IAE1E,SAAS,EAAE,kBAAkB;IAC7B,MAAM,EAAE,gBAAgB;IAExB,eAAe,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IACvD,cAAc,EAAE,iBAAiB;IACjC,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,KAAK;IAEf,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,MAAM;IAEhB,MAAM,EAAE;QACP,uBAAuB,EAAE;YACxB,EAAE,EAAE;gBACH,KAAK,EAAE,uBAAuB;gBAC9B,WAAW,EAAE,sCAAsC;gBACnD,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;aACf;YACD,OAAO,EAAE;gBACR,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;gBACtC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;aACpC;SACD;QACD,sBAAsB,EAAE;YACvB,EAAE,EAAE;gBACH,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,sCAAsC;gBACnD,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;aACf;SACD;QACD,mBAAmB,EAAE;YACpB,EAAE,EAAE;gBACH,KAAK,EAAE,mBAAmB;gBAC1B,WAAW,EAAE,4BAA4B;gBACzC,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,WAAW;aAClB;SACD;KACD;IAED,MAAM,EAAE;QACP,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE;QAC3C,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;KACjD;IAED,UAAU,EAAE;QACX,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,EAAE;QACT,oBAAoB,EAAE,KAAK;KAC3B;IAED,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}