@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/runtime/consumer-auth.context.descriptor.d.ts

@@ -0,0 +1,30 @@
+declare const _default: {
+    id: string;
+    kind: "context";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    valueKind?: "data" | "service" | undefined;
+    valueSchema?: unknown;
+    config?: {
+        sources: ("literal" | "workspace" | "floor")[];
+        subset?: true | undefined;
+    } | undefined;
+};
+export default _default;
+//# sourceMappingURL=consumer-auth.context.descriptor.d.ts.map

package/dist/runtime/consumer-auth.context.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-auth.context.descriptor.d.ts","sourceRoot":"","sources":["../../src/runtime/consumer-auth.context.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAGG"}

package/dist/runtime/consumer-auth.context.descriptor.js

@@ -0,0 +1,6 @@
+import { createContextDescriptor } from '@vibesdotdev/kernel/factory/context';
+export default createContextDescriptor({
+    id: 'auth/consumer-operations',
+    description: 'Auth-owned stored identity and device sign-in operations, composed only by consumer hosts.'
+});
+//# sourceMappingURL=consumer-auth.context.descriptor.js.map

package/dist/runtime/consumer-auth.context.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-auth.context.descriptor.js","sourceRoot":"","sources":["../../src/runtime/consumer-auth.context.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,eAAe,uBAAuB,CAAC;IACtC,EAAE,EAAE,0BAA0B;IAC9B,WAAW,EAAE,4FAA4F;CACzG,CAAC,CAAC"}

package/dist/runtime/consumer-auth.impl.consumer.d.ts

@@ -0,0 +1,7 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type ConsumerAuthOperations } from '../schemas/consumer-auth.ts';
+declare const _default: {
+    provide(runtime: VibesRuntime): ConsumerAuthOperations;
+};
+export default _default;
+//# sourceMappingURL=consumer-auth.impl.consumer.d.ts.map

package/dist/runtime/consumer-auth.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-auth.impl.consumer.d.ts","sourceRoot":"","sources":["../../src/runtime/consumer-auth.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAK9F,OAAO,EAE2E,KAAK,sBAAsB,EAC5G,MAAM,6BAA6B,CAAC;;qBAGnB,YAAY,GAAG,sBAAsB;;AADvD,wBA0CE"}

package/dist/runtime/consumer-auth.impl.consumer.js

@@ -0,0 +1,51 @@
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { redactedExcerpt } from '@vibesdotdev/shared/utils';
+import { loadStoredCredentials, resolveAgentApiKey } from "../features/services/credential-store.js";
+import { buildAuthConsumerContext } from "../client/consumer-context.js";
+import { activateDeviceSession } from "../client/device-login.js";
+import { StoredIdentitySchema, StoredIdentityResultSchema, DeviceSignInProgressSchema, DeviceSignInResultSchema } from "../schemas/consumer-auth.js";
+export default {
+    provide(runtime) {
+        return {
+            async getStoredIdentity() {
+                const credentials = await resolveAgentApiKey(runtime) ?? await loadStoredCredentials(runtime);
+                return StoredIdentityResultSchema.parse(credentials
+                    ? { status: 'signed-in', identity: StoredIdentitySchema.parse(credentials) }
+                    : { status: 'signed-out' });
+            },
+            async signInDevice(options) {
+                const context = await buildAuthConsumerContext(runtime);
+                const progress = (message, tone) => {
+                    options.onProgress?.(DeviceSignInProgressSchema.parse({
+                        message: redactedExcerpt(message, { maxChars: 300 }), tone
+                    }));
+                };
+                let result;
+                try {
+                    result = await activateDeviceSession({
+                        ...context,
+                        logger: {
+                            info: message => progress(message, 'info'),
+                            warn: message => progress(message, 'warn'),
+                            error: message => progress(message, 'error'),
+                            debug: () => { }
+                        }
+                    }, { signal: options.signal });
+                }
+                catch (error) {
+                    if (options.signal?.aborted || runtime.lifecycle.signal.aborted) {
+                        throw new CapabilityError('Device sign-in cancelled.', 'CANCELLED', {
+                            reason: 'device-sign-in-cancelled', cause: CaughtFailureSchema.parse(error)
+                        });
+                    }
+                    throw error;
+                }
+                return DeviceSignInResultSchema.parse({
+                    success: result.success, message: redactedExcerpt(result.message, { maxChars: 160 }),
+                    cause: result.cause
+                });
+            }
+        };
+    }
+};
+//# sourceMappingURL=consumer-auth.impl.consumer.js.map

package/dist/runtime/consumer-auth.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-auth.impl.consumer.js","sourceRoot":"","sources":["../../src/runtime/consumer-auth.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAqB,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACrG,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EACN,oBAAoB,EAAE,0BAA0B,EAChD,0BAA0B,EAAE,wBAAwB,EACpD,MAAM,6BAA6B,CAAC;AAErC,eAAe;IACd,OAAO,CAAC,OAAqB;QAC5B,OAAO;YACN,KAAK,CAAC,iBAAiB;gBACtB,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,IAAI,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAC9F,OAAO,0BAA0B,CAAC,KAAK,CAAC,WAAW;oBAClD,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;oBAC5E,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,YAAY,CAAC,OAAO;gBACzB,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;gBACxD,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,IAAkC,EAAE,EAAE;oBACxE,OAAO,CAAC,UAAU,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAC;wBACrD,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI;qBAC1D,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC;gBACF,IAAI,MAAyD,CAAC;gBAC9D,IAAI,CAAC;oBACJ,MAAM,GAAG,MAAM,qBAAqB,CAAC;wBACpC,GAAG,OAAO;wBACV,MAAM,EAAE;4BACP,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;4BAC1C,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;4BAC1C,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;4BAC5C,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;yBACf;qBACD,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjE,MAAM,IAAI,eAAe,CAAC,2BAA2B,EAAE,WAAW,EAAE;4BACnE,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;yBAC3E,CAAC,CAAC;oBACJ,CAAC;oBACD,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,OAAO,wBAAwB,CAAC,KAAK,CAAC;oBACrC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;oBACpF,KAAK,EAAE,MAAM,CAAC,KAAK;iBACnB,CAAC,CAAC;YACJ,CAAC;SACD,CAAC;IACH,CAAC;CACD,CAAC"}

package/dist/runtime/kinds/account-linking.kind.d.ts

@@ -0,0 +1,28 @@
+import * as z from 'zod/v4';
+import type { AccountLinkingService } from '../../server/services/account-linking.service.ts';
+export declare const AccountLinkingDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"auth/account-linking">;
+}, z.core.$strip>;
+export type AccountLinkingDescriptor = z.infer<typeof AccountLinkingDescriptorSchema>;
+export declare const accountLinkingKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<AccountLinkingService>;
+//# sourceMappingURL=account-linking.kind.d.ts.map

package/dist/runtime/kinds/account-linking.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-linking.kind.d.ts","sourceRoot":"","sources":["../../../src/runtime/kinds/account-linking.kind.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kDAAkD,CAAC;AAE9F,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;iBAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,kBAAkB,kFAQ7B,CAAC"}

package/dist/runtime/kinds/account-linking.kind.js

@@ -0,0 +1,12 @@
+import { createRuntimeKind } from '@vibesdotdev/kernel';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import * as z from 'zod/v4';
+export const AccountLinkingDescriptorSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('auth/account-linking')
+});
+export const accountLinkingKind = createRuntimeKind({
+    id: 'auth/account-linking',
+    descriptorSchema: AccountLinkingDescriptorSchema,
+    contexts: []
+});
+//# sourceMappingURL=account-linking.kind.js.map

package/dist/runtime/kinds/account-linking.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-linking.kind.js","sourceRoot":"","sources":["../../../src/runtime/kinds/account-linking.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC5E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;CACvC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB,CAIjD;IACD,EAAE,EAAE,sBAAsB;IAC1B,gBAAgB,EAAE,8BAA8B;IAChD,QAAQ,EAAE,EAAE;CACZ,CAAC,CAAC"}

package/dist/runtime/kinds/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Auth Kind Exports
+ */
+export { authProviderKind } from './provider.kind.ts';
+export { accountLinkingKind } from './account-linking.kind.ts';
+export { DefaultAuthProvider } from '../../client/provider-compat.ts';
+export { AUTH_DEVICE_SESSION_CAPABILITY_ID, AUTH_DEVICE_SESSION_CLIENT_ID, AUTH_DEVICE_SESSION_KIND, AUTH_DEVICE_SESSION_REVALIDATE_MS, authDeviceSessionCapabilityDescriptor, authDeviceSessionCapabilityExposure, authDeviceSessionCapabilityKind, authDeviceSessionDescriptorSchema, authDeviceSessionErrorSchema, authDeviceSessionSnapshotSchema, authDeviceSessionUserSchema, authDeviceSessionWarningSchema } from '../../device-session/auth-device-session.capability.ts';
+export type { AuthDeviceSessionCapability, AuthDeviceSessionDescriptor, AuthDeviceSessionSnapshot, AuthDeviceSessionUser, AuthDeviceSessionWarning } from '../../device-session/auth-device-session.capability.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/kinds/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/kinds/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EACN,iCAAiC,EACjC,6BAA6B,EAC7B,wBAAwB,EACxB,iCAAiC,EACjC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,MAAM,wDAAwD,CAAC;AAChE,YAAY,EACX,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,MAAM,wDAAwD,CAAC"}

package/dist/runtime/kinds/index.js

@@ -0,0 +1,8 @@
+/**
+ * Auth Kind Exports
+ */
+export { authProviderKind } from "./provider.kind.js";
+export { accountLinkingKind } from "./account-linking.kind.js";
+export { DefaultAuthProvider } from "../../client/provider-compat.js";
+export { AUTH_DEVICE_SESSION_CAPABILITY_ID, AUTH_DEVICE_SESSION_CLIENT_ID, AUTH_DEVICE_SESSION_KIND, AUTH_DEVICE_SESSION_REVALIDATE_MS, authDeviceSessionCapabilityDescriptor, authDeviceSessionCapabilityExposure, authDeviceSessionCapabilityKind, authDeviceSessionDescriptorSchema, authDeviceSessionErrorSchema, authDeviceSessionSnapshotSchema, authDeviceSessionUserSchema, authDeviceSessionWarningSchema } from "../../device-session/auth-device-session.capability.js";
+//# sourceMappingURL=index.js.map

package/dist/runtime/kinds/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/kinds/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EACN,iCAAiC,EACjC,6BAA6B,EAC7B,wBAAwB,EACxB,iCAAiC,EACjC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,MAAM,wDAAwD,CAAC"}

package/dist/runtime/kinds/provider.api.impl.consumer.d.ts

@@ -0,0 +1,7 @@
+import type { AuthContext } from '../../schemas/provider.ts';
+import { DefaultAuthProvider } from './provider.default.ts';
+/** Consumer-only: durable sessions need Auth's app-bearer exchange before forwarding. */
+export default class ConsumerApiAuthProvider extends DefaultAuthProvider {
+    getAuthContext(): Promise<AuthContext>;
+}
+//# sourceMappingURL=provider.api.impl.consumer.d.ts.map

package/dist/runtime/kinds/provider.api.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.api.impl.consumer.d.ts","sourceRoot":"","sources":["../../../src/runtime/kinds/provider.api.impl.consumer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,yFAAyF;AACzF,MAAM,CAAC,OAAO,OAAO,uBAAwB,SAAQ,mBAAmB;IACxD,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;CA2BrD"}

package/dist/runtime/kinds/provider.api.impl.consumer.js

@@ -0,0 +1,37 @@
+import { serviceOrigin, serviceEnvironment } from '@vibesdotdev/infra-core/service';
+import { resolveAppAuthority } from "../../client/app-authority.js";
+import { getCredentials } from "../../features/services/credential-store.js";
+import { DefaultAuthProvider } from "./provider.default.js";
+/** Consumer-only: durable sessions need Auth's app-bearer exchange before forwarding. */
+export default class ConsumerApiAuthProvider extends DefaultAuthProvider {
+    async getAuthContext() {
+        // The loader belongs to the canonical API descriptor. Preserve custom
+        // configurations if a host explicitly reuses this implementation.
+        const config = this.descriptor.api;
+        if (this.descriptor.type !== 'api' || config?.tokenSource !== 'config' ||
+            (config.configKey !== undefined && config.configKey !== 'credentials.token')) {
+            return super.getAuthContext();
+        }
+        const runtime = this.context.runtime;
+        const environment = await serviceEnvironment(runtime);
+        const authOrigin = await serviceOrigin(runtime, 'auth');
+        const credential = await getCredentials(runtime, environment);
+        if (!credential)
+            return { isAuthenticated: false, error: 'No credential in the selected environment' };
+        const { token } = await resolveAppAuthority({
+            runtime,
+            authOrigin,
+            environment,
+            loadCredentials: async () => credential
+        });
+        const result = {
+            isAuthenticated: true,
+            token,
+            headers: { [config.headerName ?? 'Authorization']: config.tokenPrefix ? `${config.tokenPrefix} ${token}` : token }
+        };
+        if (credential.userId)
+            result.userId = credential.userId;
+        return result;
+    }
+}
+//# sourceMappingURL=provider.api.impl.consumer.js.map

package/dist/runtime/kinds/provider.api.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.api.impl.consumer.js","sourceRoot":"","sources":["../../../src/runtime/kinds/provider.api.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,yFAAyF;AACzF,MAAM,CAAC,OAAO,OAAO,uBAAwB,SAAQ,mBAAmB;IAC9D,KAAK,CAAC,cAAc;QAC5B,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,EAAE,WAAW,KAAK,QAAQ;YACrE,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,mBAAmB,CAAC,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC,cAAc,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACrC,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;QACvG,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,mBAAmB,CAAC;YAC7C,OAAO;YACL,UAAU;YACV,WAAW;YACX,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU;SACvC,CAAC,CAAC;QACH,MAAM,MAAM,GAAgB;YAC3B,eAAe,EAAE,IAAI;YACrB,KAAK;YACL,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,eAAe,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE;SAClH,CAAC;QACF,IAAI,UAAU,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACzD,OAAO,MAAM,CAAC;IACf,CAAC;CACD"}

package/dist/runtime/kinds/provider.default.api.d.ts

@@ -0,0 +1,4 @@
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+import type { AuthContext, AuthProviderDescriptor } from '../../schemas/provider.ts';
+export declare function getApiAuthContext(descriptor: AuthProviderDescriptor, context: KindContext): Promise<AuthContext>;
+//# sourceMappingURL=provider.default.api.d.ts.map

package/dist/runtime/kinds/provider.default.api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.default.api.d.ts","sourceRoot":"","sources":["../../../src/runtime/kinds/provider.default.api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAIrF,wBAAsB,iBAAiB,CACtC,UAAU,EAAE,sBAAsB,EAClC,OAAO,EAAE,WAAW,GAClB,OAAO,CAAC,WAAW,CAAC,CAwDtB"}

package/dist/runtime/kinds/provider.default.api.js

@@ -0,0 +1,56 @@
+import { getLogger } from '@vibesdotdev/logging';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { getTokenFromConfig } from "./provider.default.config.js";
+export async function getApiAuthContext(descriptor, context) {
+    const log = getLogger('auth.provider', context.runtime);
+    const apiConfig = descriptor.api;
+    if (!apiConfig) {
+        log.warn('No API configuration on auth provider descriptor');
+        return { isAuthenticated: false, error: 'No API configuration' };
+    }
+    log.debug('Resolving API auth', {
+        tokenSource: apiConfig.tokenSource,
+        configKey: apiConfig.configKey,
+        headerName: apiConfig.headerName
+    });
+    let token;
+    switch (apiConfig.tokenSource) {
+        case 'config':
+            token = await getTokenFromConfig(context, apiConfig.configKey);
+            break;
+        case 'secret': {
+            if (!apiConfig.credential)
+                throw new CapabilityError('Secret auth requires a declared credential reference.', 'INVALID_INPUT', { reason: 'auth-credential-required' });
+            const result = await context.runtime.resolveCredential(apiConfig.credential);
+            if (!result.ok)
+                throw result.error;
+            token = result.value;
+            break;
+        }
+    }
+    log.debug('Auth token lookup result', {
+        source: apiConfig.tokenSource,
+        configKey: apiConfig.configKey,
+        found: !!token,
+        tokenLength: token?.length ?? 0
+    });
+    if (!token) {
+        log.warn('Auth token not found', {
+            source: apiConfig.tokenSource,
+            configKey: apiConfig.configKey
+        });
+        return {
+            isAuthenticated: false,
+            error: `No token available from ${apiConfig.tokenSource} source`
+        };
+    }
+    const headerValue = apiConfig.tokenPrefix ? `${apiConfig.tokenPrefix} ${token}` : token;
+    return {
+        isAuthenticated: true,
+        token,
+        headers: {
+            [apiConfig.headerName ?? 'Authorization']: headerValue
+        }
+    };
+}
+//# sourceMappingURL=provider.default.api.js.map

package/dist/runtime/kinds/provider.default.api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.default.api.js","sourceRoot":"","sources":["../../../src/runtime/kinds/provider.default.api.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,UAAkC,EAClC,OAAoB;IAEpB,MAAM,GAAG,GAAG,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC;IACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAC7D,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAClE,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE;QAC/B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;KAChC,CAAC,CAAC;IAEH,IAAI,KAAyB,CAAC;IAE9B,QAAQ,SAAS,CAAC,WAAW,EAAE,CAAC;QAC/B,KAAK,QAAQ;YACZ,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM;QACP,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,UAAU;gBAAE,MAAM,IAAI,eAAe,CAAC,uDAAuD,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACvK,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC;YACnC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACrB,MAAM;QACP,CAAC;IACF,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE;QACrC,MAAM,EAAE,SAAS,CAAC,WAAW;QAC7B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC;KAC/B,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAChC,MAAM,EAAE,SAAS,CAAC,WAAW;YAC7B,SAAS,EAAE,SAAS,CAAC,SAAS;SAC9B,CAAC,CAAC;QACH,OAAO;YACN,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,2BAA2B,SAAS,CAAC,WAAW,SAAS;SAChE,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAExF,OAAO;QACN,eAAe,EAAE,IAAI;QACrB,KAAK;QACL,OAAO,EAAE;YACR,CAAC,SAAS,CAAC,UAAU,IAAI,eAAe,CAAC,EAAE,WAAW;SACtD;KACD,CAAC;AACH,CAAC"}

package/dist/runtime/kinds/provider.default.config.d.ts

@@ -0,0 +1,17 @@
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+import type { AuthCredentials, CredentialInfo } from '../../schemas/credentials.ts';
+/**
+ * Resolve a bearer/token from the **environment-partitioned** credential store.
+ *
+ * Must not load unpartitioned `config/manifest#auth` root directly — that leaks
+ * the dual-write compatibility document across environment switches (#1132 / #1134).
+ */
+export declare function getTokenFromConfig(context: KindContext, configKey?: string): Promise<string | undefined>;
+/** Map CredentialInfo fields to the key paths used by auth provider consumers. */
+export declare function resolveCredentialToken(credentials: CredentialInfo, keyPath: string): string | undefined;
+/**
+ * @deprecated Prefer {@link resolveCredentialToken} against CredentialInfo from
+ * getCredentials. Kept for callers that still hold a full AuthCredentials document.
+ */
+export declare function resolveConfigToken(config: AuthCredentials, keyPath: string): string | undefined;
+//# sourceMappingURL=provider.default.config.d.ts.map

package/dist/runtime/kinds/provider.default.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.default.config.d.ts","sourceRoot":"","sources":["../../../src/runtime/kinds/provider.default.config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAGpE,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAMpF;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,WAAW,EACpB,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkC7B;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CACrC,WAAW,EAAE,cAAc,EAC3B,OAAO,EAAE,MAAM,GACb,MAAM,GAAG,SAAS,CA4BpB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA4B/F"}

package/dist/runtime/kinds/provider.default.config.js

@@ -0,0 +1,103 @@
+import { getLogger } from '@vibesdotdev/logging';
+import { attempt, failureLabel } from "../../features/utils/attempt.js";
+import { getCredentials, isCredentialStoreRuntime } from "../../features/services/credential-store.js";
+/**
+ * Resolve a bearer/token from the **environment-partitioned** credential store.
+ *
+ * Must not load unpartitioned `config/manifest#auth` root directly — that leaks
+ * the dual-write compatibility document across environment switches (#1132 / #1134).
+ */
+export async function getTokenFromConfig(context, configKey) {
+    const log = getLogger('auth.provider', context.runtime);
+    if (!isCredentialStoreRuntime(context.runtime)) {
+        log.warn('No runtime.query available in auth provider context');
+        return undefined;
+    }
+    const loaded = await attempt(() => getCredentials(context.runtime));
+    if (!loaded.ok) {
+        log.error('Failed to load partitioned auth credentials', { failure: failureLabel(loaded.failure) });
+        return undefined;
+    }
+    const credentials = loaded.value;
+    if (!credentials) {
+        log.debug('No credentials for active environment');
+        return undefined;
+    }
+    const keyPath = configKey ?? 'credentials.token';
+    let value = resolveCredentialToken(credentials, keyPath);
+    // Fallback to sessionToken when token (or default key) is empty and apiKey is absent
+    if (!value && (keyPath === 'credentials.token' || keyPath === 'token')) {
+        value = resolveCredentialToken(credentials, 'credentials.sessionToken');
+    }
+    log.debug('Config token result', {
+        keyPath,
+        found: value !== undefined && value.length > 0,
+        tokenLength: value?.length ?? 0,
+        environment: credentials.environment
+    });
+    return value !== undefined && value.length > 0 ? value : undefined;
+}
+/** Map CredentialInfo fields to the key paths used by auth provider consumers. */
+export function resolveCredentialToken(credentials, keyPath) {
+    switch (keyPath) {
+        case 'token':
+        case 'credentials.token':
+            return credentials.token;
+        case 'apiKey':
+        case 'credentials.apiKey':
+            return credentials.apiKey;
+        case 'sessionToken':
+        case 'credentials.sessionToken':
+            return credentials.sessionToken;
+        case 'refreshToken':
+        case 'credentials.refreshToken':
+            return credentials.refreshToken;
+        case 'userId':
+        case 'user.userId':
+            return credentials.userId;
+        case 'email':
+        case 'user.email':
+            return credentials.email;
+        case 'name':
+        case 'user.name':
+            return credentials.name;
+        case 'environment':
+            return credentials.environment;
+        default:
+            return undefined;
+    }
+}
+/**
+ * @deprecated Prefer {@link resolveCredentialToken} against CredentialInfo from
+ * getCredentials. Kept for callers that still hold a full AuthCredentials document.
+ */
+export function resolveConfigToken(config, keyPath) {
+    switch (keyPath) {
+        case 'token':
+        case 'credentials.token':
+            return config.credentials?.token;
+        case 'apiKey':
+        case 'credentials.apiKey':
+            return config.credentials?.apiKey;
+        case 'sessionToken':
+        case 'credentials.sessionToken':
+            return config.credentials?.sessionToken;
+        case 'refreshToken':
+        case 'credentials.refreshToken':
+            return config.credentials?.refreshToken;
+        case 'userId':
+        case 'user.userId':
+            return config.user?.userId;
+        case 'email':
+        case 'user.email':
+            return config.user?.email;
+        case 'name':
+        case 'user.name':
+            return config.user?.name;
+        case 'environment':
+            return config.environment;
+        default:
+            return undefined;
+    }
+}
+//# sourceMappingURL=provider.default.config.js.map

package/dist/runtime/kinds/provider.default.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.default.config.js","sourceRoot":"","sources":["../../../src/runtime/kinds/provider.default.config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAExE,OAAO,EACN,cAAc,EACd,wBAAwB,EACxB,MAAM,6CAA6C,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAAoB,EACpB,SAAkB;IAElB,MAAM,GAAG,GAAG,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QAChE,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,6CAA6C,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;IACjC,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,IAAI,mBAAmB,CAAC;IACjD,IAAI,KAAK,GAAG,sBAAsB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEzD,qFAAqF;IACrF,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,KAAK,mBAAmB,IAAI,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;QACxE,KAAK,GAAG,sBAAsB,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;IACzE,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,qBAAqB,EAAE;QAChC,OAAO;QACP,KAAK,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAC9C,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC;QAC/B,WAAW,EAAE,WAAW,CAAC,WAAW;KACpC,CAAC,CAAC;IAEH,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CACrC,WAA2B,EAC3B,OAAe;IAEf,QAAQ,OAAO,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC;QACb,KAAK,mBAAmB;YACvB,OAAO,WAAW,CAAC,KAAK,CAAC;QAC1B,KAAK,QAAQ,CAAC;QACd,KAAK,oBAAoB;YACxB,OAAO,WAAW,CAAC,MAAM,CAAC;QAC3B,KAAK,cAAc,CAAC;QACpB,KAAK,0BAA0B;YAC9B,OAAO,WAAW,CAAC,YAAY,CAAC;QACjC,KAAK,cAAc,CAAC;QACpB,KAAK,0BAA0B;YAC9B,OAAO,WAAW,CAAC,YAAY,CAAC;QACjC,KAAK,QAAQ,CAAC;QACd,KAAK,aAAa;YACjB,OAAO,WAAW,CAAC,MAAM,CAAC;QAC3B,KAAK,OAAO,CAAC;QACb,KAAK,YAAY;YAChB,OAAO,WAAW,CAAC,KAAK,CAAC;QAC1B,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACf,OAAO,WAAW,CAAC,IAAI,CAAC;QACzB,KAAK,aAAa;YACjB,OAAO,WAAW,CAAC,WAAW,CAAC;QAChC;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAuB,EAAE,OAAe;IAC1E,QAAQ,OAAO,EAAE,CAAC;QACjB,KAAK,OAAO,CAAC;QACb,KAAK,mBAAmB;YACvB,OAAO,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC;QAClC,KAAK,QAAQ,CAAC;QACd,KAAK,oBAAoB;YACxB,OAAO,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC;QACnC,KAAK,cAAc,CAAC;QACpB,KAAK,0BAA0B;YAC9B,OAAO,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC;QACzC,KAAK,cAAc,CAAC;QACpB,KAAK,0BAA0B;YAC9B,OAAO,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC;QACzC,KAAK,QAAQ,CAAC;QACd,KAAK,aAAa;YACjB,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QAC5B,KAAK,OAAO,CAAC;QACb,KAAK,YAAY;YAChB,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;QAC3B,KAAK,MAAM,CAAC;QACZ,KAAK,WAAW;YACf,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,KAAK,aAAa;YACjB,OAAO,MAAM,CAAC,WAAW,CAAC;QAC3B;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC"}

package/dist/runtime/kinds/provider.default.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Default Auth Provider Implementation
+ *
+ * Provides base implementation for runtime authentication.
+ * API provider reads credentials from auth config via runtime.
+ */
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
+import type { AuthProviderDescriptor, AuthProviderImplementation, AuthContext } from '../../schemas/provider.ts';
+/**
+ * Default auth provider implementation
+ *
+ * Handles API-based authentication by reading credentials from config.
+ * DB provider should be implemented by server-side code.
+ */
+export declare class DefaultAuthProvider implements AuthProviderImplementation {
+    protected readonly context: KindContext;
+    readonly descriptor: AuthProviderDescriptor;
+    constructor(descriptor: RuntimeDescriptor, context: KindContext);
+    get type(): "api" | "db";
+    isAvailable(): Promise<boolean>;
+    getAuthContext(): Promise<AuthContext>;
+    validateCredentials(): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    dispose(): Promise<void>;
+    private getDbAuthContext;
+}
+//# sourceMappingURL=provider.default.d.ts.map

package/dist/runtime/kinds/provider.default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.default.d.ts","sourceRoot":"","sources":["../../../src/runtime/kinds/provider.default.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,MAAM,2BAA2B,CAAC;AAInC;;;;;GAKG;AACH,qBAAa,mBAAoB,YAAW,0BAA0B;IAKpE,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW;IAJxC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;gBAG3C,UAAU,EAAE,iBAAiB,EACV,OAAO,EAAE,WAAW;IAKxC,IAAI,IAAI,iBAEP;IAEK,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAgB/B,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC;IAetC,mBAAmB,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAUlE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAIhB,gBAAgB;CAiB9B"}

package/dist/runtime/kinds/provider.default.js

@@ -0,0 +1,76 @@
+/**
+ * Default Auth Provider Implementation
+ *
+ * Provides base implementation for runtime authentication.
+ * API provider reads credentials from auth config via runtime.
+ */
+import { AuthProviderDescriptorSchema } from "../../schemas/provider.js";
+import { getApiAuthContext } from "./provider.default.api.js";
+/**
+ * Default auth provider implementation
+ *
+ * Handles API-based authentication by reading credentials from config.
+ * DB provider should be implemented by server-side code.
+ */
+export class DefaultAuthProvider {
+    context;
+    descriptor;
+    constructor(descriptor, context) {
+        this.context = context;
+        this.descriptor = AuthProviderDescriptorSchema.parse(descriptor);
+    }
+    get type() {
+        return this.descriptor.type;
+    }
+    async isAvailable() {
+        // API provider is always available
+        if (this.descriptor.type === 'api') {
+            return true;
+        }
+        // Scope compatibility is enforced by authProviderKind before construction.
+        // Rechecking host globals here would let implementation availability
+        // disagree with the descriptor selected by the runtime.
+        if (this.descriptor.type === 'db') {
+            return true;
+        }
+        return false;
+    }
+    async getAuthContext() {
+        if (this.descriptor.type === 'api') {
+            return getApiAuthContext(this.descriptor, this.context);
+        }
+        if (this.descriptor.type === 'db') {
+            return this.getDbAuthContext();
+        }
+        return {
+            isAuthenticated: false,
+            error: `Unknown provider type: ${this.descriptor.type}`
+        };
+    }
+    async validateCredentials() {
+        const authContext = await this.getAuthContext();
+        if (!authContext.isAuthenticated) {
+            return { valid: false, error: authContext.error ?? 'Not authenticated' };
+        }
+        return { valid: true };
+    }
+    async dispose() {
+        // No-op by default
+    }
+    async getDbAuthContext() {
+        const dbConfig = this.descriptor.db;
+        // DB provider should be overridden by server-side implementation
+        // Default just returns unauthenticated
+        if (dbConfig?.bypassAuth) {
+            return {
+                isAuthenticated: true,
+                headers: {}
+            };
+        }
+        return {
+            isAuthenticated: false,
+            error: 'DB provider requires server-side implementation'
+        };
+    }
+}
+//# sourceMappingURL=provider.default.js.map

package/dist/runtime/kinds/provider.default.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.default.js","sourceRoot":"","sources":["../../../src/runtime/kinds/provider.default.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IAKX;IAJX,UAAU,CAAyB;IAE5C,YACC,UAA6B,EACV,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;QAEvC,IAAI,CAAC,UAAU,GAAG,4BAA4B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,WAAW;QAChB,mCAAmC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,2EAA2E;QAC3E,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,cAAc;QACnB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACpC,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChC,CAAC;QAED,OAAO;YACN,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,0BAA0B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;SACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB;QACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEhD,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;YAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;QAC1E,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,mBAAmB;IACpB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAEpC,iEAAiE;QACjE,uCAAuC;QACvC,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;YAC1B,OAAO;gBACN,eAAe,EAAE,IAAI;gBACrB,OAAO,EAAE,EAAE;aACX,CAAC;QACH,CAAC;QAED,OAAO;YACN,eAAe,EAAE,KAAK;YACtB,KAAK,EAAE,iDAAiD;SACxD,CAAC;IACH,CAAC;CACD"}

package/dist/runtime/kinds/provider.kind.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Auth Provider Kind Definition
+ *
+ * Registers the auth/provider kind for runtime authentication.
+ * Controls how the runtime authenticates to access resources:
+ * - API: Default, uses HTTP with credentials from auth config
+ * - DB: Direct database access, server-side only
+ *
+ * Consumers query the runtime directly:
+ *   const authProvider = await runtime.query('auth/provider').resolve();
+ *
+ * The runtime picks the appropriate provider based on current scope.
+ */
+import type { RuntimeKindDescriptor, KindContext } from '@vibesdotdev/kernel/schemas/kind';
+import type { RuntimeDescriptor } from '@vibesdotdev/kernel/schemas/descriptor';
+/**
+ * Auth provider kind definition
+ */
+export declare const authProviderKind: RuntimeKindDescriptor<RuntimeDescriptor, unknown, KindContext>;
+//# sourceMappingURL=provider.kind.d.ts.map

package/dist/runtime/kinds/provider.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.kind.d.ts","sourceRoot":"","sources":["../../../src/runtime/kinds/provider.kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AA4FhF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,qBAAqB,CACnD,iBAAiB,EACjB,OAAO,EACP,WAAW,CAOX,CAAC"}