@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/api/index.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Public barrel for the `@vibesdotdev/auth/api` subpath.
+ *
+ * Exports the descriptor + types. Implementations are loaded by the auth
+ * plugin via `loader()` and are NOT re-exported here — consumers resolve
+ * instances through `getVibesClient<AuthApiClient>('auth', runtime)`.
+ *
+ * Per FEATURE-API-CLIENT-RUNTIME-KIND.md (spec lock 2026-05-27):
+ *   - No cloud impl: auth runtime is owned solely by `apps/auth-web`. Even
+ *     workerd-co-located callers go through HTTP.
+ *   - No bearer-token surface: better-auth uses session cookies; the client
+ *     forwards `credentials: 'include'` on every request.
+ */
+export { StoredIdentitySchema, StoredIdentityResultSchema, DeviceSignInOptionsSchema, DeviceSignInProgressSchema, DeviceSignInResultSchema, type StoredIdentity, type StoredIdentityResult, type DeviceSignInOptions, type DeviceSignInProgress, type DeviceSignInResult } from '../schemas/consumer-auth.ts';
+export { default as authApiClientDescriptor } from './auth.api-client.descriptor.ts';
+export { authProviderSignInPath, authProviderSignUpPath } from './auth.api-client.urls.ts';
+export { failureMessage } from './failure-message.ts';
+export { AuthClientError, AuthNotSignedInError, type AuthApiClient, type AuthApiRequestOptions, type AuthConnectedAccount, type AuthLinkSocialInput, type AuthLinkSocialResult, type AuthProviderConfig, type AuthProviderId, type AuthProviderUrlOptions, type AuthSession, type AuthSessionUser, type AuthRevokeSessionResult, type AuthSignUpCredentials, type AuthUserSearchOptions, type AuthUserSession, type AuthUnlinkAccountResult, type EmailPasswordCredentials } from './auth.api-client.types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACN,oBAAoB,EAAE,0BAA0B,EAAE,yBAAyB,EAC3E,0BAA0B,EAAE,wBAAwB,EACpD,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EACxE,KAAK,oBAAoB,EAAE,KAAK,kBAAkB,EAClD,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,eAAe,EACf,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,MAAM,4BAA4B,CAAC"}

package/dist/api/index.js

@@ -0,0 +1,19 @@
+/**
+ * Public barrel for the `@vibesdotdev/auth/api` subpath.
+ *
+ * Exports the descriptor + types. Implementations are loaded by the auth
+ * plugin via `loader()` and are NOT re-exported here — consumers resolve
+ * instances through `getVibesClient<AuthApiClient>('auth', runtime)`.
+ *
+ * Per FEATURE-API-CLIENT-RUNTIME-KIND.md (spec lock 2026-05-27):
+ *   - No cloud impl: auth runtime is owned solely by `apps/auth-web`. Even
+ *     workerd-co-located callers go through HTTP.
+ *   - No bearer-token surface: better-auth uses session cookies; the client
+ *     forwards `credentials: 'include'` on every request.
+ */
+export { StoredIdentitySchema, StoredIdentityResultSchema, DeviceSignInOptionsSchema, DeviceSignInProgressSchema, DeviceSignInResultSchema } from "../schemas/consumer-auth.js";
+export { default as authApiClientDescriptor } from "./auth.api-client.descriptor.js";
+export { authProviderSignInPath, authProviderSignUpPath } from "./auth.api-client.urls.js";
+export { failureMessage } from "./failure-message.js";
+export { AuthClientError, AuthNotSignedInError } from "./auth.api-client.types.js";
+//# sourceMappingURL=index.js.map

package/dist/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EACN,oBAAoB,EAAE,0BAA0B,EAAE,yBAAyB,EAC3E,0BAA0B,EAAE,wBAAwB,EAGpD,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACN,eAAe,EACf,oBAAoB,EAiBpB,MAAM,4BAA4B,CAAC"}

package/dist/augmentations/users.descriptor.d.ts

@@ -0,0 +1,35 @@
+/** `ai/augment` descriptor for inviting people by name or email. */
+declare const _default: {
+    id: string;
+    kind: "ai/augment";
+    trigger: string;
+    title: string;
+    priority: number;
+    positionRule: "start-only" | "after-whitespace" | "anywhere";
+    eagerCompletions: boolean;
+    maxCompletions: number;
+    debounceMs: number;
+    async: boolean;
+    placement: "command" | "primary" | "overflow";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    config?: unknown;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    category?: string | undefined;
+};
+export default _default;
+//# sourceMappingURL=users.descriptor.d.ts.map

package/dist/augmentations/users.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.descriptor.d.ts","sourceRoot":"","sources":["../../src/augmentations/users.descriptor.ts"],"names":[],"mappings":"AAEA,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACpE,wBAcG"}

package/dist/augmentations/users.descriptor.js

@@ -0,0 +1,18 @@
+import { AIAugmentDescriptorSchema } from '@vibesdotdev/ai-schemas/augmentations/schemas/augment';
+/** `ai/augment` descriptor for inviting people by name or email. */
+export default AIAugmentDescriptorSchema.parse({
+    id: 'chat.augment.users',
+    name: 'People',
+    title: 'People',
+    description: 'Invite people to a chat by name or email.',
+    category: 'People',
+    trigger: '@',
+    positionRule: 'after-whitespace',
+    eagerCompletions: true,
+    maxCompletions: 20,
+    debounceMs: 150,
+    async: true,
+    priority: 90,
+    enabled: true
+});
+//# sourceMappingURL=users.descriptor.js.map

package/dist/augmentations/users.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.descriptor.js","sourceRoot":"","sources":["../../src/augmentations/users.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uDAAuD,CAAC;AAElG,oEAAoE;AACpE,eAAe,yBAAyB,CAAC,KAAK,CAAC;IAC9C,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,QAAQ;IACf,WAAW,EAAE,2CAA2C;IACxD,QAAQ,EAAE,QAAQ;IAClB,OAAO,EAAE,GAAG;IACZ,YAAY,EAAE,kBAAkB;IAChC,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,EAAE;IAClB,UAAU,EAAE,GAAG;IACf,KAAK,EAAE,IAAI;IACX,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/bearer/caller-bearer.context.descriptor.d.ts

@@ -0,0 +1,35 @@
+export declare const CALLER_BEARER_CONTEXT_ID = "auth/caller-bearer";
+/** The context's value: one call per request, never memoized. */
+export interface CallerBearerContext {
+    resolve(): Promise<string | null>;
+}
+declare const _default: {
+    id: string;
+    kind: "context";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    valueKind?: "data" | "service" | undefined;
+    valueSchema?: unknown;
+    config?: {
+        sources: ("literal" | "workspace" | "floor")[];
+        subset?: true | undefined;
+    } | undefined;
+};
+export default _default;
+//# sourceMappingURL=caller-bearer.context.descriptor.d.ts.map

package/dist/bearer/caller-bearer.context.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-bearer.context.descriptor.d.ts","sourceRoot":"","sources":["../../src/bearer/caller-bearer.context.descriptor.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IACnC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,wBAIG"}

package/dist/bearer/caller-bearer.context.descriptor.js

@@ -0,0 +1,18 @@
+/**
+ * `auth/caller-bearer`: `resolveCallerBearer` across the runtime boundary, for
+ * the packages auth itself depends on (account, notifications, storage), which
+ * cannot import `@vibesdotdev/auth/caller-bearer` without a package cycle.
+ *
+ * The context holds no bearer. Each `resolve()` runs `resolveCallerBearer`
+ * against the runtime the context was resolved from, inside the caller's
+ * invocation (rc05 §2.2; rc01 §3 "Bridge-key readers").
+ *
+ *   const bearer = await (await runtime.context<CallerBearerContext>('auth/caller-bearer')).resolve();
+ */
+import { createContextDescriptor } from '@vibesdotdev/kernel/factory/context';
+export const CALLER_BEARER_CONTEXT_ID = 'auth/caller-bearer';
+export default createContextDescriptor({
+    id: CALLER_BEARER_CONTEXT_ID,
+    description: "The caller's bearer, chosen by the host's declared bearer capability (auth's resolveCallerBearer)."
+});
+//# sourceMappingURL=caller-bearer.context.descriptor.js.map

package/dist/bearer/caller-bearer.context.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-bearer.context.descriptor.js","sourceRoot":"","sources":["../../src/bearer/caller-bearer.context.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAO7D,eAAe,uBAAuB,CAAC;IACtC,EAAE,EAAE,wBAAwB;IAC5B,WAAW,EACV,oGAAoG;CACrG,CAAC,CAAC"}

package/dist/bearer/caller-bearer.context.impl.d.ts

@@ -0,0 +1,8 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { CallerBearerContext } from './caller-bearer.context.descriptor.ts';
+/** Binds `resolveCallerBearer` to the runtime that resolved the context; it holds no bearer. */
+declare const _default: {
+    provide(runtime: VibesRuntime): CallerBearerContext;
+};
+export default _default;
+//# sourceMappingURL=caller-bearer.context.impl.d.ts.map

package/dist/bearer/caller-bearer.context.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-bearer.context.impl.d.ts","sourceRoot":"","sources":["../../src/bearer/caller-bearer.context.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAGjF,gGAAgG;;qBAE9E,YAAY,GAAG,mBAAmB;;AADpD,wBAIE"}

package/dist/bearer/caller-bearer.context.impl.js

@@ -0,0 +1,8 @@
+import { resolveCallerBearer } from "./caller-bearer.js";
+/** Binds `resolveCallerBearer` to the runtime that resolved the context; it holds no bearer. */
+export default {
+    provide(runtime) {
+        return { resolve: () => resolveCallerBearer(runtime) };
+    }
+};
+//# sourceMappingURL=caller-bearer.context.impl.js.map

package/dist/bearer/caller-bearer.context.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-bearer.context.impl.js","sourceRoot":"","sources":["../../src/bearer/caller-bearer.context.impl.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,gGAAgG;AAChG,eAAe;IACd,OAAO,CAAC,OAAqB;QAC5B,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;IACxD,CAAC;CACD,CAAC"}

package/dist/bearer/caller-bearer.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The caller's bearer, chosen by the host's declared bearer capability
+ * (rc05 §2.2; rc01 §2.1 "Identity by host capability").
+ *
+ * | Declared             | Bearer                                                          |
+ * | -------------------- | --------------------------------------------------------------- |
+ * | `requestPrincipals`  | the invocation principal's JWT; `null` when anonymous/service   |
+ * | `interactiveSession` | `auth/device-session`, named by id                              |
+ * | `hostCredentials`    | the scope-selected store (`host-credentials`)                   |
+ * | none                 | `INTERNAL` `principal-source-undeclared`                        |
+ *
+ * It consults no store of its own: it dispatches to `requestPrincipal()` or to
+ * the kernel's `resolveCredential`, so auth is not a second resolver (R7). An
+ * unset bearer is `AUTH_REQUIRED` `not-signed-in`, naming `vibes auth login` on
+ * an interactive host and `vibes secrets exec --session` on a host-credentials
+ * host. A
+ * request host never reads a store, so a daemon's own login is never lent to
+ * a caller. Outside an invocation a request host throws `invocation-inactive`,
+ * never anonymous.
+ */
+import { type RequestPrincipal, type RuntimeScope } from '@vibesdotdev/kernel';
+import type { CredentialReference, CredentialResolution } from '@vibesdotdev/kernel/credentials';
+export { CALLER_BEARER_CONTEXT_ID } from './caller-bearer.context.descriptor.ts';
+export type { CallerBearerContext } from './caller-bearer.context.descriptor.ts';
+/** The slice of a runtime the bearer dispatch reads. */
+export interface CallerBearerRuntime {
+    readonly declaredScope: Pick<RuntimeScope, 'capabilities'>;
+    requestPrincipal(): RequestPrincipal;
+    resolveCredential(reference: CredentialReference): Promise<CredentialResolution>;
+}
+/**
+ * Resolve the bearer the current caller presents to Vibes APIs, or `null` for
+ * an anonymous (or service) request on a request-principal host.
+ */
+export declare function resolveCallerBearer(runtime: CallerBearerRuntime): Promise<string | null>;
+//# sourceMappingURL=caller-bearer.d.ts.map

package/dist/bearer/caller-bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-bearer.d.ts","sourceRoot":"","sources":["../../src/bearer/caller-bearer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAmB,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChG,OAAO,KAAK,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACjG,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,YAAY,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAMjF,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC3D,gBAAgB,IAAI,gBAAgB,CAAC;IACrC,iBAAiB,CAAC,SAAS,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACjF;AA2BD;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2B9F"}

package/dist/bearer/caller-bearer.js

@@ -0,0 +1,71 @@
+/**
+ * The caller's bearer, chosen by the host's declared bearer capability
+ * (rc05 §2.2; rc01 §2.1 "Identity by host capability").
+ *
+ * | Declared             | Bearer                                                          |
+ * | -------------------- | --------------------------------------------------------------- |
+ * | `requestPrincipals`  | the invocation principal's JWT; `null` when anonymous/service   |
+ * | `interactiveSession` | `auth/device-session`, named by id                              |
+ * | `hostCredentials`    | the scope-selected store (`host-credentials`)                   |
+ * | none                 | `INTERNAL` `principal-source-undeclared`                        |
+ *
+ * It consults no store of its own: it dispatches to `requestPrincipal()` or to
+ * the kernel's `resolveCredential`, so auth is not a second resolver (R7). An
+ * unset bearer is `AUTH_REQUIRED` `not-signed-in`, naming `vibes auth login` on
+ * an interactive host and `vibes secrets exec --session` on a host-credentials
+ * host. A
+ * request host never reads a store, so a daemon's own login is never lent to
+ * a caller. Outside an invocation a request host throws `invocation-inactive`,
+ * never anonymous.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+export { CALLER_BEARER_CONTEXT_ID } from "./caller-bearer.context.descriptor.js";
+import { DEVICE_SESSION_BEARER_KEY, DEVICE_SESSION_STORE_ID } from "../device-session/device-session.store.descriptor.js";
+/**
+ * The remedy a signed-out caller runs, by capability: an interactive host
+ * signs in; a host-credentials host is a child whose parent must publish the
+ * operator's session into its manifest.
+ */
+const NOT_SIGNED_IN_REMEDY = {
+    interactiveSession: 'Run: vibes auth login',
+    hostCredentials: 'Run the command under: vibes secrets exec --session -- <command>'
+};
+function bearerOf(resolution, capability) {
+    if (resolution.ok)
+        return resolution.value;
+    const { error } = resolution;
+    if (error.reason !== 'credential-not-set')
+        throw error;
+    throw new CapabilityError('Not signed in.', 'AUTH_REQUIRED', {
+        reason: 'not-signed-in',
+        recoveryHint: NOT_SIGNED_IN_REMEDY[capability],
+        details: error.details,
+        cause: error
+    });
+}
+/**
+ * Resolve the bearer the current caller presents to Vibes APIs, or `null` for
+ * an anonymous (or service) request on a request-principal host.
+ */
+export async function resolveCallerBearer(runtime) {
+    const capabilities = runtime.declaredScope.capabilities;
+    if (capabilities?.requestPrincipals) {
+        const principal = runtime.requestPrincipal();
+        return principal.kind === 'user' ? principal.jwt : null;
+    }
+    if (capabilities?.interactiveSession) {
+        return bearerOf(await runtime.resolveCredential({
+            source: 'secret',
+            key: DEVICE_SESSION_BEARER_KEY,
+            store: DEVICE_SESSION_STORE_ID
+        }), 'interactiveSession');
+    }
+    if (capabilities?.hostCredentials) {
+        return bearerOf(await runtime.resolveCredential({ source: 'secret', key: DEVICE_SESSION_BEARER_KEY }), 'hostCredentials');
+    }
+    throw new CapabilityError('This host declares no source for the caller bearer.', 'INTERNAL', {
+        reason: 'principal-source-undeclared',
+        recoveryHint: 'Declare requestPrincipals, interactiveSession or hostCredentials in the host scope capabilities.'
+    });
+}
+//# sourceMappingURL=caller-bearer.js.map

package/dist/bearer/caller-bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-bearer.js","sourceRoot":"","sources":["../../src/bearer/caller-bearer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,eAAe,EAA4C,MAAM,qBAAqB,CAAC;AAEhG,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAEjF,OAAO,EACN,yBAAyB,EACzB,uBAAuB,EACvB,MAAM,sDAAsD,CAAC;AAS9D;;;;GAIG;AACH,MAAM,oBAAoB,GAAG;IAC5B,kBAAkB,EAAE,uBAAuB;IAC3C,eAAe,EAAE,kEAAkE;CAC1E,CAAC;AAEX,SAAS,QAAQ,CAChB,UAAgC,EAChC,UAA6C;IAE7C,IAAI,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC3C,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,oBAAoB;QAAE,MAAM,KAAK,CAAC;IACvD,MAAM,IAAI,eAAe,CAAC,gBAAgB,EAAE,eAAe,EAAE;QAC5D,MAAM,EAAE,eAAe;QACvB,YAAY,EAAE,oBAAoB,CAAC,UAAU,CAAC;QAC9C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK;KACZ,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAA4B;IACrE,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC;IACxD,IAAI,YAAY,EAAE,iBAAiB,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7C,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IACD,IAAI,YAAY,EAAE,kBAAkB,EAAE,CAAC;QACtC,OAAO,QAAQ,CACd,MAAM,OAAO,CAAC,iBAAiB,CAAC;YAC/B,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,yBAAyB;YAC9B,KAAK,EAAE,uBAAuB;SAC9B,CAAC,EACF,oBAAoB,CACpB,CAAC;IACH,CAAC;IACD,IAAI,YAAY,EAAE,eAAe,EAAE,CAAC;QACnC,OAAO,QAAQ,CACd,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC,EACrF,iBAAiB,CACjB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,qDAAqD,EAAE,UAAU,EAAE;QAC5F,MAAM,EAAE,6BAA6B;QACrC,YAAY,EACX,kGAAkG;KACnG,CAAC,CAAC;AACJ,CAAC"}

package/dist/bearer/oauth-account.d.ts

@@ -0,0 +1,37 @@
+import * as z from 'zod/v4';
+/** Provider account identity, never an integration connection id or caller-supplied user. */
+export declare const oauthAccountCredentialSelectionSchema: z.ZodObject<{
+    providerId: z.ZodString;
+    accountId: z.ZodString;
+    token: z.ZodDefault<z.ZodLiteral<"accessToken">>;
+}, z.core.$strict>;
+export type OAuthAccountCredentialSelectionInput = z.input<typeof oauthAccountCredentialSelectionSchema>;
+/** Default use is an explicit unique-account snapshot admitted inside Auth. */
+export declare const oauthDefaultAccountCredentialSelectionSchema: z.ZodObject<{
+    providerId: z.ZodString;
+    selection: z.ZodDefault<z.ZodLiteral<"single">>;
+    token: z.ZodDefault<z.ZodLiteral<"accessToken">>;
+}, z.core.$strict>;
+export type OAuthDefaultAccountCredentialSelectionInput = z.input<typeof oauthDefaultAccountCredentialSelectionSchema>;
+export declare const oauthAccountCredentialUseSelectionSchema: z.ZodUnion<readonly [z.ZodObject<{
+    providerId: z.ZodString;
+    accountId: z.ZodString;
+    token: z.ZodDefault<z.ZodLiteral<"accessToken">>;
+}, z.core.$strict>, z.ZodObject<{
+    providerId: z.ZodString;
+    selection: z.ZodDefault<z.ZodLiteral<"single">>;
+    token: z.ZodDefault<z.ZodLiteral<"accessToken">>;
+}, z.core.$strict>]>;
+export declare function oauthDefaultAccountCredentialReference(input: OAuthDefaultAccountCredentialSelectionInput): {
+    source: "secret";
+    key: string;
+    store?: string | undefined;
+    operation?: object | undefined;
+};
+export declare function oauthAccountCredentialReference(input: OAuthAccountCredentialSelectionInput): {
+    source: "secret";
+    key: string;
+    store?: string | undefined;
+    operation?: object | undefined;
+};
+//# sourceMappingURL=oauth-account.d.ts.map

package/dist/bearer/oauth-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-account.d.ts","sourceRoot":"","sources":["../../src/bearer/oauth-account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,6FAA6F;AAC7F,eAAO,MAAM,qCAAqC;;;;kBAIhD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEzG,+EAA+E;AAC/E,eAAO,MAAM,4CAA4C;;;;kBAIvD,CAAC;AACH,MAAM,MAAM,2CAA2C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AACvH,eAAO,MAAM,wCAAwC;;;;;;;;oBAEnD,CAAC;AAEH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,2CAA2C;;;;;EAQxG;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,oCAAoC;;;;;EAQ1F"}

package/dist/bearer/oauth-account.js

@@ -0,0 +1,51 @@
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { SecretCredentialReferenceSchema } from '@vibesdotdev/kernel/credentials';
+import { OAUTH_ACCOUNT_STORE_ID } from "./oauth-account.store.descriptor.js";
+/** Provider account identity, never an integration connection id or caller-supplied user. */
+export const oauthAccountCredentialSelectionSchema = z.strictObject({
+    providerId: z.string().min(1),
+    accountId: z.string().min(1),
+    token: z.literal('accessToken').default('accessToken')
+});
+/** Default use is an explicit unique-account snapshot admitted inside Auth. */
+export const oauthDefaultAccountCredentialSelectionSchema = z.strictObject({
+    providerId: z.string().min(1),
+    selection: z.literal('single').default('single'),
+    token: z.literal('accessToken').default('accessToken')
+});
+export const oauthAccountCredentialUseSelectionSchema = z.union([
+    oauthAccountCredentialSelectionSchema, oauthDefaultAccountCredentialSelectionSchema
+]);
+export function oauthDefaultAccountCredentialReference(input) {
+    const selected = oauthDefaultAccountCredentialSelectionSchema.safeParse(input);
+    if (!selected.success) {
+        throw new CapabilityError('OAuth account selection is invalid.', 'INVALID_INPUT', {
+            reason: 'oauth-account-selection-invalid', retryable: false
+        });
+    }
+    return accountCredentialReference(selected.data);
+}
+export function oauthAccountCredentialReference(input) {
+    const selected = oauthAccountCredentialSelectionSchema.safeParse(input);
+    if (!selected.success) {
+        throw new CapabilityError('OAuth account selection is invalid.', 'INVALID_INPUT', {
+            reason: 'oauth-account-selection-invalid', retryable: false
+        });
+    }
+    return accountCredentialReference(selected.data);
+}
+function accountCredentialReference(selection) {
+    const reference = SecretCredentialReferenceSchema.safeParse({
+        source: 'secret',
+        store: OAUTH_ACCOUNT_STORE_ID,
+        key: new URLSearchParams(selection).toString()
+    });
+    if (!reference.success) {
+        throw new CapabilityError('OAuth account selection cannot be represented by a credential reference.', 'INVALID_INPUT', {
+            reason: 'oauth-account-reference-invalid', retryable: false
+        });
+    }
+    return reference.data;
+}
+//# sourceMappingURL=oauth-account.js.map

package/dist/bearer/oauth-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-account.js","sourceRoot":"","sources":["../../src/bearer/oauth-account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,+BAA+B,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;CACtD,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;CACtD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,qCAAqC,EAAE,4CAA4C;CACnF,CAAC,CAAC;AAEH,MAAM,UAAU,sCAAsC,CAAC,KAAkD;IACxG,MAAM,QAAQ,GAAG,4CAA4C,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,eAAe,EAAE;YACjF,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK;SAC3D,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAA2C;IAC1F,MAAM,QAAQ,GAAG,qCAAqC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,eAAe,EAAE;YACjF,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK;SAC3D,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,0BAA0B,CAAC,SAAoE;IACvG,MAAM,SAAS,GAAG,+BAA+B,CAAC,SAAS,CAAC;QAC3D,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,sBAAsB;QAC7B,GAAG,EAAE,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;KAC9C,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,0EAA0E,EAAE,eAAe,EAAE;YACtH,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK;SAC3D,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC;AACvB,CAAC"}

package/dist/bearer/oauth-account.store.d.ts

@@ -0,0 +1,8 @@
+import { type KindContext, type RuntimeDescriptor } from '@vibesdotdev/kernel';
+/** A read-only credential view; the verified invocation owns its subject on every read. */
+export default class OAuthAccountStore {
+    private readonly runtime;
+    constructor(_descriptor: RuntimeDescriptor, context: KindContext);
+    get(_tier: string, key: string): Promise<string | undefined>;
+}
+//# sourceMappingURL=oauth-account.store.d.ts.map

package/dist/bearer/oauth-account.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-account.store.d.ts","sourceRoot":"","sources":["../../src/bearer/oauth-account.store.ts"],"names":[],"mappings":"AACA,OAAO,EAA6C,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAmB,MAAM,qBAAqB,CAAC;AAa3I,2FAA2F;AAC3F,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;gBAEzB,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW;IAI1D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAyGlE"}

package/dist/bearer/oauth-account.store.descriptor.d.ts

@@ -0,0 +1,14 @@
+export declare const OAUTH_ACCOUNT_STORE_ID = "auth/oauth-account";
+/** Account credentials are invocation-bound and never enter generic tier selection. */
+declare const _default: {
+    id: string;
+    kind: string;
+    name: string;
+    enabled: true;
+    backend: string;
+    selection: "by-id";
+    tiers: string[];
+    priority: number;
+};
+export default _default;
+//# sourceMappingURL=oauth-account.store.descriptor.d.ts.map

package/dist/bearer/oauth-account.store.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-account.store.descriptor.d.ts","sourceRoot":"","sources":["../../src/bearer/oauth-account.store.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,uFAAuF;;;;;;;;;;;AACvF,wBAWE"}

package/dist/bearer/oauth-account.store.descriptor.js

@@ -0,0 +1,13 @@
+export const OAUTH_ACCOUNT_STORE_ID = 'auth/oauth-account';
+/** Account credentials are invocation-bound and never enter generic tier selection. */
+export default {
+    id: OAUTH_ACCOUNT_STORE_ID,
+    kind: 'secrets/store',
+    name: 'Selected OAuth account',
+    enabled: true,
+    backend: OAUTH_ACCOUNT_STORE_ID,
+    selection: 'by-id',
+    tiers: ['local', 'dev', 'staging', 'production'],
+    priority: 0
+};
+//# sourceMappingURL=oauth-account.store.descriptor.js.map

package/dist/bearer/oauth-account.store.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-account.store.descriptor.js","sourceRoot":"","sources":["../../src/bearer/oauth-account.store.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D,uFAAuF;AACvF,eAAe;IACd,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,wBAAwB;IAC9B,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,sBAAsB;IAC/B,SAAS,EAAE,OAAO;IAClB,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC;IAChD,QAAQ,EAAE,CAAC;CAGX,CAAC"}

package/dist/bearer/oauth-account.store.js

@@ -0,0 +1,120 @@
+import * as z from 'zod/v4';
+import { CapabilityError, settle, valueFreeFailure } from '@vibesdotdev/kernel';
+import { userOAuthAccountDetailSchema, userOAuthAccountSchema } from "../system/internal-api/schemas.js";
+import { oauthAccountCredentialReference, oauthDefaultAccountCredentialReference, oauthAccountCredentialUseSelectionSchema } from "./oauth-account.js";
+const defaultAccountOwnerSchema = z.custom(value => z.object({ listOAuthAccounts: z.function() }).safeParse(value).success);
+const accountOwnerSchema = z.custom(value => z.object({ getOAuthAccount: z.function() }).safeParse(value).success);
+/** A read-only credential view; the verified invocation owns its subject on every read. */
+export default class OAuthAccountStore {
+    runtime;
+    constructor(_descriptor, context) {
+        this.runtime = context.runtime;
+    }
+    async get(_tier, key) {
+        const parameters = new URLSearchParams(key);
+        const parsed = oauthAccountCredentialUseSelectionSchema.safeParse(Object.fromEntries(parameters));
+        if (!parsed.success || parameters.size !== 3 || ('accountId' in parsed.data ? oauthAccountCredentialReference(parsed.data) : oauthDefaultAccountCredentialReference(parsed.data)).key !== key) {
+            throw new CapabilityError('OAuth account selection is invalid.', 'INVALID_INPUT', {
+                reason: 'oauth-account-selection-invalid', retryable: false
+            });
+        }
+        if (!this.runtime.declaredScope.capabilities?.requestPrincipals) {
+            throw new CapabilityError('OAuth account use requires a verified request principal.', 'UNAVAILABLE', {
+                reason: 'request-principal-unavailable', retryable: false
+            });
+        }
+        const principal = this.runtime.requestPrincipal();
+        if (principal.kind !== 'user') {
+            throw new CapabilityError('OAuth account use requires a signed-in user.', 'AUTH_REQUIRED', {
+                reason: 'oauth-account-user-required', retryable: false
+            });
+        }
+        if (principal.agentPrincipal) {
+            throw new CapabilityError('OAuth account delegation requires explicit account authority.', 'PERMISSION_DENIED', {
+                reason: 'oauth-account-delegation-required', retryable: false
+            });
+        }
+        const selected = parsed.data;
+        const context = await settle(() => this.runtime.context('authInternalClient'));
+        if (!context.ok) {
+            throw new CapabilityError('The Auth account owner is unavailable.', 'UNAVAILABLE', {
+                reason: 'oauth-account-owner-unavailable', cause: valueFreeFailure(context.cause)
+            });
+        }
+        const owner = accountOwnerSchema.safeParse(context.value);
+        if (!owner.success) {
+            throw new CapabilityError('The Auth account owner is unavailable.', 'UNAVAILABLE', {
+                reason: 'oauth-account-owner-unavailable', retryable: false
+            });
+        }
+        let accountId;
+        if ('accountId' in selected) {
+            accountId = selected.accountId;
+        }
+        else {
+            const listOwner = defaultAccountOwnerSchema.safeParse(context.value);
+            if (!listOwner.success) {
+                throw new CapabilityError('The Auth account owner is unavailable.', 'UNAVAILABLE', {
+                    reason: 'oauth-account-owner-unavailable', retryable: false
+                });
+            }
+            const listed = await settle(() => listOwner.data.listOAuthAccounts(principal.userId));
+            if (!listed.ok) {
+                throw new CapabilityError('OAuth account lookup failed.', 'UNAVAILABLE', {
+                    reason: 'oauth-account-owner-failed', cause: valueFreeFailure(listed.cause)
+                });
+            }
+            this.runtime.invocationSignal?.throwIfAborted();
+            const admitted = userOAuthAccountSchema.array().safeParse(listed.value);
+            if (!admitted.success) {
+                throw new CapabilityError('The Auth account owner returned no admitted identity.', 'UNAVAILABLE', {
+                    reason: 'oauth-account-response-invalid', retryable: false
+                });
+            }
+            const candidates = admitted.data.filter(account => account.providerId === selected.providerId);
+            if (candidates.length === 0)
+                return undefined;
+            if (candidates.length !== 1) {
+                throw new CapabilityError('Choose an OAuth account explicitly.', 'CONFLICT', {
+                    reason: 'oauth-account-selection-required', retryable: false
+                });
+            }
+            const candidate = candidates[0];
+            if (candidate.accountId === undefined || candidate.accountId.length === 0) {
+                throw new CapabilityError('The Auth account owner returned no admitted identity.', 'UNAVAILABLE', {
+                    reason: 'oauth-account-response-invalid', retryable: false
+                });
+            }
+            accountId = candidate.accountId;
+        }
+        const lookup = await settle(() => owner.data.getOAuthAccount(principal.userId, selected.providerId, { accountId }));
+        if (!lookup.ok) {
+            throw new CapabilityError('OAuth account lookup failed.', 'UNAVAILABLE', {
+                reason: 'oauth-account-owner-failed', cause: valueFreeFailure(lookup.cause)
+            });
+        }
+        const account = lookup.value;
+        this.runtime.invocationSignal?.throwIfAborted();
+        if (account === null)
+            return undefined;
+        const answer = userOAuthAccountDetailSchema.safeParse(account);
+        if (!answer.success || answer.data.accountId === undefined) {
+            throw new CapabilityError('The Auth account owner returned no admitted identity.', 'UNAVAILABLE', {
+                reason: 'oauth-account-response-invalid', retryable: false
+            });
+        }
+        if (answer.data.providerId !== selected.providerId || answer.data.accountId !== accountId) {
+            throw new CapabilityError('The Auth account does not match the selection.', 'PERMISSION_DENIED', {
+                reason: 'oauth-account-selection-mismatch', retryable: false
+            });
+        }
+        const expiry = answer.data.expiresAt;
+        if (expiry !== null && (!Number.isFinite(Date.parse(expiry)) || Date.parse(expiry) <= Date.now())) {
+            throw new CapabilityError('The selected OAuth token has expired.', 'AUTH_REQUIRED', {
+                reason: 'oauth-account-token-expired', retryable: false
+            });
+        }
+        return answer.data.accessToken ?? undefined;
+    }
+}
+//# sourceMappingURL=oauth-account.store.js.map

package/dist/bearer/oauth-account.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-account.store.js","sourceRoot":"","sources":["../../src/bearer/oauth-account.store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAA6D,MAAM,qBAAqB,CAAC;AAE3I,OAAO,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AACzG,OAAO,EAAE,+BAA+B,EAAE,sCAAsC,EAAE,wCAAwC,EAAE,MAAM,oBAAoB,CAAC;AAEvJ,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAgD,KAAK,CAAC,EAAE,CACjG,CAAC,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CACtE,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAA8C,KAAK,CAAC,EAAE,CACxF,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CACpE,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACpB,OAAO,CAAa;IAErC,YAAY,WAA8B,EAAE,OAAoB;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,GAAW;QACnC,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,wCAAwC,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,CAC/C,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,+BAA+B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,sCAAsC,CAAC,MAAM,CAAC,IAAI,CAAC,CAC/H,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,eAAe,EAAE;gBACjF,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK;aAC3D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,EAAE,iBAAiB,EAAE,CAAC;YACjE,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,aAAa,EAAE;gBACpG,MAAM,EAAE,+BAA+B,EAAE,SAAS,EAAE,KAAK;aACzD,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,eAAe,CAAC,8CAA8C,EAAE,eAAe,EAAE;gBAC1F,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK;aACvD,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;YAC9B,MAAM,IAAI,eAAe,CAAC,+DAA+D,EAAE,mBAAmB,EAAE;gBAC/G,MAAM,EAAE,mCAAmC,EAAE,SAAS,EAAE,KAAK;aAC7D,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,eAAe,CAAC,wCAAwC,EAAE,aAAa,EAAE;gBAClF,MAAM,EAAE,iCAAiC,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC;aACjF,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CAAC,wCAAwC,EAAE,aAAa,EAAE;gBAClF,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK;aAC3D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,SAAiB,CAAC;QACtB,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;YAC7B,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAChC,CAAC;aAAM,CAAC;YACP,MAAM,SAAS,GAAG,yBAAyB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACxB,MAAM,IAAI,eAAe,CAAC,wCAAwC,EAAE,aAAa,EAAE;oBAClF,MAAM,EAAE,iCAAiC,EAAE,SAAS,EAAE,KAAK;iBAC3D,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,eAAe,CAAC,8BAA8B,EAAE,aAAa,EAAE;oBACxE,MAAM,EAAE,4BAA4B,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC3E,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,eAAe,CAAC,uDAAuD,EAAE,aAAa,EAAE;oBACjG,MAAM,EAAE,gCAAgC,EAAE,SAAS,EAAE,KAAK;iBAC1D,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC/F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,UAAU,EAAE;oBAC5E,MAAM,EAAE,kCAAkC,EAAE,SAAS,EAAE,KAAK;iBAC5D,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;YACjC,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,eAAe,CAAC,uDAAuD,EAAE,aAAa,EAAE;oBACjG,MAAM,EAAE,gCAAgC,EAAE,SAAS,EAAE,KAAK;iBAC1D,CAAC,CAAC;YACJ,CAAC;YACD,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QACjC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACpH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,8BAA8B,EAAE,aAAa,EAAE;gBACxE,MAAM,EAAE,4BAA4B,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC;aAC3E,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC;QAChD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,MAAM,GAAG,4BAA4B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,IAAI,eAAe,CAAC,uDAAuD,EAAE,aAAa,EAAE;gBACjG,MAAM,EAAE,gCAAgC,EAAE,SAAS,EAAE,KAAK;aAC1D,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC3F,MAAM,IAAI,eAAe,CAAC,gDAAgD,EAAE,mBAAmB,EAAE;gBAChG,MAAM,EAAE,kCAAkC,EAAE,SAAS,EAAE,KAAK;aAC5D,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnG,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE;gBACnF,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,KAAK;aACvD,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,SAAS,CAAC;IAC7C,CAAC;CACD"}

package/dist/bearer/request-session.store.d.ts

@@ -0,0 +1,8 @@
+import { type KindContext, type RuntimeDescriptor } from '@vibesdotdev/kernel';
+/** A read-only view of this invocation's verified caller; no bearer is retained. */
+export default class RequestSessionStore {
+    private readonly runtime;
+    constructor(_descriptor: RuntimeDescriptor, context: KindContext);
+    get(_tier: string, key: string): Promise<string | undefined>;
+}
+//# sourceMappingURL=request-session.store.d.ts.map

package/dist/bearer/request-session.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-session.store.d.ts","sourceRoot":"","sources":["../../src/bearer/request-session.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,WAAW,EAAE,KAAK,iBAAiB,EAAmB,MAAM,qBAAqB,CAAC;AAIjH,oFAAoF;AACpF,MAAM,CAAC,OAAO,OAAO,mBAAmB;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;gBAEzB,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,WAAW;IAI1D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CASlE"}