@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/schemas/auth/ui.js

@@ -0,0 +1,112 @@
+import * as z from 'zod/v4';
+export const authMethodSchema = z.enum([
+    'email',
+    'phone',
+    'magic-link',
+    'wallet',
+    'oauth:github',
+    'oauth:google',
+    'oauth:discord',
+    'oauth:microsoft',
+    'oauth:twitter'
+]);
+// UI-specific auth types and schemas
+// Login form UI state
+export const loginUIStateSchema = z.object({
+    showPassword: z.boolean().default(false),
+    rememberMe: z.boolean().default(false),
+    isLoading: z.boolean().default(false),
+    errorMessage: z.string().nullable().default(null)
+});
+// Registration form UI state
+export const registerUIStateSchema = z.object({
+    showPassword: z.boolean().default(false),
+    showConfirmPassword: z.boolean().default(false),
+    acceptedTerms: z.boolean().default(false),
+    isLoading: z.boolean().default(false),
+    errorMessage: z.string().nullable().default(null)
+});
+// Password reset UI state
+export const passwordResetUIStateSchema = z.object({
+    showNewPassword: z.boolean().default(false),
+    showConfirmPassword: z.boolean().default(false),
+    isLoading: z.boolean().default(false),
+    successMessage: z.string().nullable().default(null),
+    errorMessage: z.string().nullable().default(null)
+});
+// Two-factor auth UI state
+export const twoFactorUIStateSchema = z.object({
+    isSetupMode: z.boolean().default(false),
+    showQRCode: z.boolean().default(false),
+    showRecoveryCodes: z.boolean().default(false),
+    isVerifying: z.boolean().default(false),
+    qrCodeUrl: z.string().nullable().default(null),
+    recoveryCodes: z.array(z.string()).default([])
+});
+// MFA setup UI state
+export const mfaSetupUIStateSchema = z.object({
+    step: z.enum(['password', 'qr-code', 'verify', 'recovery-codes', 'complete']).default('password'),
+    qrCodeDataUrl: z.string().nullable().default(null),
+    secret: z.string().nullable().default(null),
+    recoveryCodes: z.array(z.string()).default([]),
+    isGenerating: z.boolean().default(false),
+    showManualEntry: z.boolean().default(false),
+    isLoading: z.boolean().default(false),
+    error: z.string().nullable().default(null)
+});
+// MFA verification UI state (during login)
+export const mfaVerificationUIStateSchema = z.object({
+    useRecoveryCode: z.boolean().default(false),
+    isVerifying: z.boolean().default(false),
+    remainingAttempts: z.number().nullable().default(null),
+    lockoutTime: z.number().nullable().default(null), // seconds remaining
+    error: z.string().nullable().default(null),
+    trustDevice: z.boolean().default(false)
+});
+// MFA settings UI state
+export const mfaSettingsUIStateSchema = z.object({
+    isEnabled: z.boolean().default(false),
+    showDisableConfirm: z.boolean().default(false),
+    showRegenerateConfirm: z.boolean().default(false),
+    showRecoveryCodes: z.boolean().default(false),
+    isLoading: z.boolean().default(false),
+    error: z.string().nullable().default(null),
+    successMessage: z.string().nullable().default(null)
+});
+// API key management UI state
+export const apiKeyUIStateSchema = z.object({
+    showCreateDialog: z.boolean().default(false),
+    showRevokeDialog: z.boolean().default(false),
+    selectedKeyId: z.uuid().nullable().default(null),
+    newlyCreatedKey: z.string().nullable().default(null), // Shown once after creation
+    isLoading: z.boolean().default(false)
+});
+// Auth modal state
+export const authModalStateSchema = z.object({
+    isOpen: z.boolean().default(false),
+    mode: z.enum(['login', 'register', 'forgot-password', 'reset-password']).default('login'),
+    redirectTo: z.string().nullable().default(null)
+});
+// External application authorization state
+export const externalAppAuthStateSchema = z.object({
+    isAuthorizing: z.boolean().default(false),
+    applicationName: z.string().nullable().default(null),
+    requestedScopes: z.array(z.string()).default([]),
+    redirectUri: z.string().nullable().default(null),
+    state: z.string().nullable().default(null)
+});
+// Auth guard state for protected routes
+export const authGuardStateSchema = z.object({
+    isChecking: z.boolean().default(true),
+    isAuthenticated: z.boolean().default(false),
+    redirectTo: z.string().nullable().default(null),
+    requiredPermissions: z.array(z.string()).default([])
+});
+// Profile auth section state
+export const profileAuthSectionStateSchema = z.object({
+    showSessions: z.boolean().default(false),
+    showApiKeys: z.boolean().default(false),
+    showTwoFactor: z.boolean().default(false),
+    activeTab: z.enum(['overview', 'sessions', 'api-keys', 'two-factor']).default('overview')
+});
+//# sourceMappingURL=ui.js.map

package/dist/schemas/auth/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../../src/schemas/auth/ui.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAO5B,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,OAAO;IACP,OAAO;IACP,YAAY;IACZ,QAAQ;IACR,cAAc;IACd,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,eAAe;CACf,CAAC,CAAC;AAGH,qCAAqC;AAErC,sBAAsB;AACtB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACjD,CAAC,CAAC;AAGH,6BAA6B;AAC7B,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACjD,CAAC,CAAC;AAGH,0BAA0B;AAC1B,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACjD,CAAC,CAAC;AAGH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9C,CAAC,CAAC;AAGH,qBAAqB;AACrB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IACjG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC1C,CAAC,CAAC;AAGH,2CAA2C;AAC3C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,oBAAoB;IACtE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACvC,CAAC,CAAC;AAGH,wBAAwB;AACxB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnD,CAAC,CAAC;AAGH,8BAA8B;AAC9B,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B;IAClF,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACrC,CAAC,CAAC;AAoBH,mBAAmB;AACnB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACzF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/C,CAAC,CAAC;AAGH,2CAA2C;AAC3C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC1C,CAAC,CAAC;AAGH,wCAAwC;AACxC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/C,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACpD,CAAC,CAAC;AAGH,6BAA6B;AAC7B,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;CACzF,CAAC,CAAC"}

package/dist/schemas/auth-provider.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Auth Provider Schemas
+ *
+ * Zod schemas for auth provider descriptors used by the resolver.
+ * Supports builtin OAuth providers (from better-auth) and custom OIDC/SAML providers.
+ */
+import * as z from 'zod/v4';
+/**
+ * Auth provider type discriminator
+ */
+export declare const AuthProviderTypeSchema: z.ZodEnum<{
+    oauth: "oauth";
+    oidc: "oidc";
+    saml: "saml";
+}>;
+export type AuthProviderType = z.infer<typeof AuthProviderTypeSchema>;
+/**
+ * Source type: where the provider comes from
+ * - builtin: supplied by the host auth implementation
+ * - custom: user-defined OIDC/SAML provider
+ */
+export declare const AuthProviderSourceTypeSchema: z.ZodEnum<{
+    custom: "custom";
+    builtin: "builtin";
+}>;
+export type AuthProviderSourceType = z.infer<typeof AuthProviderSourceTypeSchema>;
+/**
+ * Masked provider config (no secrets exposed)
+ */
+export declare const AuthProviderConfigSchema: z.ZodObject<{
+    clientId: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    issuer: z.ZodOptional<z.ZodString>;
+    authorizationEndpoint: z.ZodOptional<z.ZodString>;
+    tokenEndpoint: z.ZodOptional<z.ZodString>;
+    userInfoEndpoint: z.ZodOptional<z.ZodString>;
+    jwksUri: z.ZodOptional<z.ZodString>;
+    metadataUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthProviderConfig = z.infer<typeof AuthProviderConfigSchema>;
+/**
+ * Auth provider descriptor
+ *
+ * Returned by the auth/provider resolver.
+ * Includes both builtin OAuth providers and custom OIDC/SAML providers.
+ */
+export declare const AuthProviderDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodEnum<{
+        oauth: "oauth";
+        oidc: "oidc";
+        saml: "saml";
+    }>;
+    enabled: z.ZodBoolean;
+    displayName: z.ZodString;
+    icon: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    defaultScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    callbackPath: z.ZodOptional<z.ZodString>;
+    config: z.ZodOptional<z.ZodObject<{
+        clientId: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        issuer: z.ZodOptional<z.ZodString>;
+        authorizationEndpoint: z.ZodOptional<z.ZodString>;
+        tokenEndpoint: z.ZodOptional<z.ZodString>;
+        userInfoEndpoint: z.ZodOptional<z.ZodString>;
+        jwksUri: z.ZodOptional<z.ZodString>;
+        metadataUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    sourceType: z.ZodEnum<{
+        custom: "custom";
+        builtin: "builtin";
+    }>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        consumer: "consumer";
+        cloud: "cloud";
+    }>>>;
+    surfaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type AuthProviderDescriptor = z.infer<typeof AuthProviderDescriptorSchema>;
+/**
+ * Override configuration for builtin providers
+ * Allows customization of displayName, icon, etc. via vibes.config.ts
+ */
+export declare const AuthProviderOverrideSchema: z.ZodObject<{
+    displayName: z.ZodOptional<z.ZodString>;
+    icon: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    defaultScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type AuthProviderOverride = z.infer<typeof AuthProviderOverrideSchema>;
+/**
+ * Custom OIDC/SAML provider definition
+ * Stored in storage manifest, managed via CRUD API
+ */
+export declare const CustomAuthProviderSchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodEnum<{
+        oidc: "oidc";
+        saml: "saml";
+    }>;
+    displayName: z.ZodString;
+    icon: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    config: z.ZodObject<{
+        issuer: z.ZodOptional<z.ZodString>;
+        authorizationEndpoint: z.ZodOptional<z.ZodString>;
+        tokenEndpoint: z.ZodOptional<z.ZodString>;
+        userInfoEndpoint: z.ZodOptional<z.ZodString>;
+        jwksUri: z.ZodOptional<z.ZodString>;
+        metadataUrl: z.ZodOptional<z.ZodString>;
+        entityId: z.ZodOptional<z.ZodString>;
+        ssoUrl: z.ZodOptional<z.ZodString>;
+        sloUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    clientId: z.ZodOptional<z.ZodString>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        consumer: "consumer";
+        cloud: "cloud";
+    }>>>;
+    surfaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type CustomAuthProvider = z.infer<typeof CustomAuthProviderSchema>;
+/**
+ * Config manifest schema for auth provider overrides
+ */
+export declare const AuthProvidersConfigSchema: z.ZodObject<{
+    overrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        displayName: z.ZodOptional<z.ZodString>;
+        icon: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        defaultScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    custom: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodEnum<{
+            oidc: "oidc";
+            saml: "saml";
+        }>;
+        displayName: z.ZodString;
+        icon: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        config: z.ZodObject<{
+            issuer: z.ZodOptional<z.ZodString>;
+            authorizationEndpoint: z.ZodOptional<z.ZodString>;
+            tokenEndpoint: z.ZodOptional<z.ZodString>;
+            userInfoEndpoint: z.ZodOptional<z.ZodString>;
+            jwksUri: z.ZodOptional<z.ZodString>;
+            metadataUrl: z.ZodOptional<z.ZodString>;
+            entityId: z.ZodOptional<z.ZodString>;
+            ssoUrl: z.ZodOptional<z.ZodString>;
+            sloUrl: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        clientId: z.ZodOptional<z.ZodString>;
+        hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+        surfaces: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type AuthProvidersConfig = z.infer<typeof AuthProvidersConfigSchema>;
+//# sourceMappingURL=auth-provider.d.ts.map

package/dist/schemas/auth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../../src/schemas/auth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;EAAoC,CAAC;AACxE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;EAAgC,CAAC;AAC1E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;iBASnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuCvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;GAGG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuDnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/schemas/auth-provider.js

@@ -0,0 +1,137 @@
+/**
+ * Auth Provider Schemas
+ *
+ * Zod schemas for auth provider descriptors used by the resolver.
+ * Supports builtin OAuth providers (from better-auth) and custom OIDC/SAML providers.
+ */
+import * as z from 'zod/v4';
+/**
+ * Auth provider type discriminator
+ */
+export const AuthProviderTypeSchema = z.enum(['oauth', 'oidc', 'saml']);
+/**
+ * Source type: where the provider comes from
+ * - builtin: supplied by the host auth implementation
+ * - custom: user-defined OIDC/SAML provider
+ */
+export const AuthProviderSourceTypeSchema = z.enum(['builtin', 'custom']);
+/**
+ * Masked provider config (no secrets exposed)
+ */
+export const AuthProviderConfigSchema = z.object({
+    clientId: z.string().optional(),
+    scopes: z.array(z.string()).optional(),
+    issuer: z.string().optional(),
+    authorizationEndpoint: z.string().optional(),
+    tokenEndpoint: z.string().optional(),
+    userInfoEndpoint: z.string().optional(),
+    jwksUri: z.string().optional(),
+    metadataUrl: z.string().optional()
+});
+/**
+ * Auth provider descriptor
+ *
+ * Returned by the auth/provider resolver.
+ * Includes both builtin OAuth providers and custom OIDC/SAML providers.
+ */
+export const AuthProviderDescriptorSchema = z.object({
+    /** Unique provider ID (e.g., 'github', 'google', 'acme-oidc') */
+    id: z.string(),
+    /** Provider type */
+    type: AuthProviderTypeSchema,
+    /** Whether this provider is enabled */
+    enabled: z.boolean(),
+    /** Display name for UI (e.g., 'GitHub', 'Google', 'ACME Corp SSO') */
+    displayName: z.string(),
+    /** Icon identifier for UI components */
+    icon: z.string(),
+    /** Optional description */
+    description: z.string().optional(),
+    /** Default OAuth scopes for this provider */
+    defaultScopes: z.array(z.string()).optional(),
+    /** OAuth callback path (builtin only) */
+    callbackPath: z.string().optional(),
+    /** Masked config (no secrets) */
+    config: AuthProviderConfigSchema.optional(),
+    /** Source type: builtin (host implementation) or custom (user-defined) */
+    sourceType: AuthProviderSourceTypeSchema,
+    /** Tags for filtering/categorization */
+    tags: z.array(z.string()).optional(),
+    /** Hardware constraints (for custom providers) */
+    hardware: z.array(z.enum(['cloud', 'consumer'])).optional(),
+    /** Surface constraints (for custom providers) */
+    surfaces: z.array(z.string()).optional()
+});
+/**
+ * Override configuration for builtin providers
+ * Allows customization of displayName, icon, etc. via vibes.config.ts
+ */
+export const AuthProviderOverrideSchema = z.object({
+    /** Override display name */
+    displayName: z.string().optional(),
+    /** Override icon identifier */
+    icon: z.string().optional(),
+    /** Override description */
+    description: z.string().optional(),
+    /** Override default scopes */
+    defaultScopes: z.array(z.string()).optional()
+});
+/**
+ * Custom OIDC/SAML provider definition
+ * Stored in storage manifest, managed via CRUD API
+ */
+export const CustomAuthProviderSchema = z.object({
+    /** Unique ID (slug format: 'acme-oidc', 'corp-saml') */
+    id: z.string().min(1).max(64),
+    /** Provider type */
+    type: z.enum(['oidc', 'saml']),
+    /** Display name for UI */
+    displayName: z.string().min(1),
+    /** Icon identifier */
+    icon: z.string().optional(),
+    /** Description */
+    description: z.string().optional(),
+    /** Whether this provider is enabled */
+    enabled: z.boolean().default(true),
+    /** OIDC/SAML configuration */
+    config: z.object({
+        /** OIDC issuer URL (required for OIDC) */
+        issuer: z.string().url().optional(),
+        /** Authorization endpoint (required for OIDC if no issuer) */
+        authorizationEndpoint: z.string().url().optional(),
+        /** Token endpoint (required for OIDC if no issuer) */
+        tokenEndpoint: z.string().url().optional(),
+        /** User info endpoint (optional) */
+        userInfoEndpoint: z.string().url().optional(),
+        /** JWKS URI for key discovery (optional) */
+        jwksUri: z.string().url().optional(),
+        /** Metadata URL (optional, for OIDC auto-discovery) */
+        metadataUrl: z.string().url().optional(),
+        /** Entity ID (required for SAML) */
+        entityId: z.string().optional(),
+        /** SSO URL (required for SAML) */
+        ssoUrl: z.string().url().optional(),
+        /** SLO URL (optional for SAML) */
+        sloUrl: z.string().url().optional()
+    }),
+    /** OAuth/OIDC scopes */
+    scopes: z.array(z.string()).optional(),
+    /** Client ID (stored encrypted in storage manifest) */
+    clientId: z.string().optional(),
+    /** Hardware constraints */
+    hardware: z.array(z.enum(['cloud', 'consumer'])).optional(),
+    /** Surface constraints */
+    surfaces: z.array(z.string()).optional(),
+    /** Tags for filtering */
+    tags: z.array(z.string()).optional()
+});
+/**
+ * Config manifest schema for auth provider overrides
+ */
+export const AuthProvidersConfigSchema = z.object({
+    /** Overrides for builtin providers */
+    overrides: z.record(z.string(), AuthProviderOverrideSchema).optional(),
+    /** Custom OIDC/SAML providers (deprecated: use storage manifest instead) */
+    custom: z.array(CustomAuthProviderSchema).optional()
+});
+//# sourceMappingURL=auth-provider.js.map

package/dist/schemas/auth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/schemas/auth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAGxE;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAG1E;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,iEAAiE;IACjE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAEd,oBAAoB;IACpB,IAAI,EAAE,sBAAsB;IAE5B,uCAAuC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IAEpB,sEAAsE;IACtE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,wCAAwC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAEhB,2BAA2B;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,6CAA6C;IAC7C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE7C,yCAAyC;IACzC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC,iCAAiC;IACjC,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAE3C,0EAA0E;IAC1E,UAAU,EAAE,4BAA4B;IAExC,wCAAwC;IACxC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEpC,kDAAkD;IAClD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE3D,iDAAiD;IACjD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,4BAA4B;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,+BAA+B;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,2BAA2B;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,8BAA8B;IAC9B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,wDAAwD;IACxD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAE7B,oBAAoB;IACpB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9B,0BAA0B;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,sBAAsB;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE3B,kBAAkB;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,uCAAuC;IACvC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,8BAA8B;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,0CAA0C;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACnC,8DAA8D;QAC9D,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAClD,sDAAsD;QACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1C,oCAAoC;QACpC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC7C,4CAA4C;QAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACpC,uDAAuD;QACvD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACxC,oCAAoC;QACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,kCAAkC;QAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACnC,kCAAkC;QAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;IAEF,wBAAwB;IACxB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEtC,uDAAuD;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE/B,2BAA2B;IAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE3D,0BAA0B;IAC1B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAExC,yBAAyB;IACzB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,sCAAsC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,QAAQ,EAAE;IAEtE,4EAA4E;IAC5E,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC"}

package/dist/schemas/authority-state.d.ts

@@ -0,0 +1,42 @@
+import * as z from 'zod/v4';
+import type { RuntimeClient } from '@vibesdotdev/kernel/client';
+export declare const appCredentialVerdictSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"api-key">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"session">;
+    jwt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "kind">;
+export type AppCredentialVerdict = z.infer<typeof appCredentialVerdictSchema>;
+export declare const appCredentialVerdictSlotSchema: z.ZodObject<{
+    authOrigin: z.ZodString;
+    credentialMac: z.ZodString;
+    verdict: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"api-key">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"session">;
+        jwt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>], "kind">;
+}, z.core.$strip>;
+export declare const authAuthorityStateSchema: z.ZodObject<{
+    epoch: z.ZodDefault<z.ZodNumber>;
+    credentialOperations: z.ZodOptional<z.ZodCustom<Promise<void>, Promise<void>>>;
+    verdicts: z.ZodDefault<z.ZodMap<z.ZodString, z.ZodObject<{
+        authOrigin: z.ZodString;
+        credentialMac: z.ZodString;
+        verdict: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"api-key">;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"session">;
+            jwt: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>], "kind">;
+    }, z.core.$strip>>>;
+    bearers: z.ZodDefault<z.ZodMap<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type AuthAuthorityState = z.infer<typeof authAuthorityStateSchema>;
+/** The authority portion of runtime/client#auth; no HTTP initialization is needed. */
+export interface AuthAuthorityClient extends RuntimeClient {
+    readonly authorityState: AuthAuthorityState;
+    dispose(): void | Promise<void>;
+    credentialMac(token: string): Promise<string>;
+}
+//# sourceMappingURL=authority-state.d.ts.map

package/dist/schemas/authority-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-state.d.ts","sourceRoot":"","sources":["../../src/schemas/authority-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,eAAO,MAAM,0BAA0B;;;;;2BAGrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,eAAO,MAAM,8BAA8B;;;;;;;;;iBAEzC,CAAC;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;iBAKnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,sFAAsF;AACtF,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACzD,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IAC5C,OAAO,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC9C"}

package/dist/schemas/authority-state.js

@@ -0,0 +1,15 @@
+import * as z from 'zod/v4';
+export const appCredentialVerdictSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('api-key') }),
+    z.object({ kind: z.literal('session'), jwt: z.string().optional() })
+]);
+export const appCredentialVerdictSlotSchema = z.object({
+    authOrigin: z.string(), credentialMac: z.string(), verdict: appCredentialVerdictSchema
+});
+export const authAuthorityStateSchema = z.object({
+    epoch: z.number().int().default(0),
+    credentialOperations: z.custom((value) => value instanceof Promise).optional(),
+    verdicts: z.map(z.string(), appCredentialVerdictSlotSchema).default(() => new Map()),
+    bearers: z.map(z.string(), z.string()).default(() => new Map())
+});
+//# sourceMappingURL=authority-state.js.map

package/dist/schemas/authority-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-state.js","sourceRoot":"","sources":["../../src/schemas/authority-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACtE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IACxC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;CACpE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,0BAA0B;CACtF,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAgB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,QAAQ,EAAE;IAC7F,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;IACpF,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;CAC/D,CAAC,CAAC"}

package/dist/schemas/browser-session-code.d.ts

@@ -0,0 +1,49 @@
+import * as z from 'zod/v4';
+/**
+ * Browser session code handoff wire contract (Auth ↔ receiving host).
+ *
+ * The browser only ever carries a short-lived, single-use code in the
+ * callback URL. The receiving host's server exchanges it with Auth
+ * server-to-server, proving the PKCE verifier it kept in a host-only cookie.
+ */
+export declare const BROWSER_SESSION_CODE_PATH = "/api/session/code";
+/** RFC 7636 §4.1 verifier alphabet and length. */
+export declare const pkceCodeVerifierSchema: z.ZodString;
+/** S256 challenge: base64url SHA-256 digest (43 chars, unpadded). */
+export declare const pkceCodeChallengeSchema: z.ZodString;
+export declare const browserSessionCodeSchema: z.ZodString;
+export declare const browserSessionClientIdSchema: z.ZodString;
+export declare const browserSessionRedirectUriSchema: z.ZodString;
+/** Query Auth's authorize GET accepts on a top-level browser navigation. */
+export declare const browserSessionCodeAuthorizeQuerySchema: z.ZodObject<{
+    client: z.ZodString;
+    redirect_uri: z.ZodString;
+    code_challenge: z.ZodString;
+    code_challenge_method: z.ZodLiteral<"S256">;
+}, z.core.$strip>;
+export type BrowserSessionCodeAuthorizeQuery = z.infer<typeof browserSessionCodeAuthorizeQuerySchema>;
+/** Body the receiving host's server POSTs to exchange a code. */
+export declare const browserSessionCodeExchangeRequestSchema: z.ZodObject<{
+    code: z.ZodString;
+    client_id: z.ZodString;
+    redirect_uri: z.ZodString;
+    code_verifier: z.ZodString;
+}, z.core.$strip>;
+export type BrowserSessionCodeExchangeRequest = z.infer<typeof browserSessionCodeExchangeRequestSchema>;
+export declare const browserSessionCodeExchangeResponseSchema: z.ZodObject<{
+    jwt: z.ZodString;
+}, z.core.$strip>;
+export type BrowserSessionCodeExchangeResponse = z.infer<typeof browserSessionCodeExchangeResponseSchema>;
+/**
+ * A native companion that receives browser sessions by single-use code. It has
+ * no web origin, so Auth binds every code to one of its exact declared loopback
+ * callbacks: a page or process on any other local port cannot receive a code
+ * by naming this client.
+ */
+export declare const nativeBrowserSessionClientSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    callbackUris: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type NativeBrowserSessionClient = z.infer<typeof nativeBrowserSessionClientSchema>;
+//# sourceMappingURL=browser-session-code.d.ts.map

package/dist/schemas/browser-session-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-session-code.d.ts","sourceRoot":"","sources":["../../src/schemas/browser-session-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAG7D,kDAAkD;AAClD,eAAO,MAAM,sBAAsB,aAAgD,CAAC;AACpF,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,aAA6B,CAAC;AAClE,eAAO,MAAM,wBAAwB,aAAmC,CAAC;AACzE,eAAO,MAAM,4BAA4B,aAA+C,CAAC;AACzF,eAAO,MAAM,+BAA+B,aAGoC,CAAC;AAEjF,4EAA4E;AAC5E,eAAO,MAAM,sCAAsC;;;;;iBAKjD,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,iEAAiE;AACjE,eAAO,MAAM,uCAAuC;;;;;iBAKlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,eAAO,MAAM,wCAAwC;;iBAEnD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC;;;;iBAI3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}

package/dist/schemas/browser-session-code.js

@@ -0,0 +1,49 @@
+import * as z from 'zod/v4';
+/**
+ * Browser session code handoff wire contract (Auth ↔ receiving host).
+ *
+ * The browser only ever carries a short-lived, single-use code in the
+ * callback URL. The receiving host's server exchanges it with Auth
+ * server-to-server, proving the PKCE verifier it kept in a host-only cookie.
+ */
+export const BROWSER_SESSION_CODE_PATH = '/api/session/code';
+const base64UrlSchema = z.string().regex(/^[A-Za-z0-9_-]+$/);
+/** RFC 7636 §4.1 verifier alphabet and length. */
+export const pkceCodeVerifierSchema = z.string().regex(/^[A-Za-z0-9._~-]{43,128}$/);
+/** S256 challenge: base64url SHA-256 digest (43 chars, unpadded). */
+export const pkceCodeChallengeSchema = base64UrlSchema.length(43);
+export const browserSessionCodeSchema = base64UrlSchema.min(32).max(128);
+export const browserSessionClientIdSchema = z.string().regex(/^[A-Za-z0-9._:-]{1,128}$/);
+export const browserSessionRedirectUriSchema = z
+    .string()
+    .max(2048)
+    .refine((value) => URL.canParse(value), 'redirect_uri must be an absolute URL');
+/** Query Auth's authorize GET accepts on a top-level browser navigation. */
+export const browserSessionCodeAuthorizeQuerySchema = z.object({
+    client: browserSessionClientIdSchema,
+    redirect_uri: browserSessionRedirectUriSchema,
+    code_challenge: pkceCodeChallengeSchema,
+    code_challenge_method: z.literal('S256')
+});
+/** Body the receiving host's server POSTs to exchange a code. */
+export const browserSessionCodeExchangeRequestSchema = z.object({
+    code: browserSessionCodeSchema,
+    client_id: browserSessionClientIdSchema,
+    redirect_uri: browserSessionRedirectUriSchema,
+    code_verifier: pkceCodeVerifierSchema
+});
+export const browserSessionCodeExchangeResponseSchema = z.object({
+    jwt: z.string().regex(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)
+});
+/**
+ * A native companion that receives browser sessions by single-use code. It has
+ * no web origin, so Auth binds every code to one of its exact declared loopback
+ * callbacks: a page or process on any other local port cannot receive a code
+ * by naming this client.
+ */
+export const nativeBrowserSessionClientSchema = z.object({
+    id: browserSessionClientIdSchema,
+    name: z.string().min(1),
+    callbackUris: z.array(browserSessionRedirectUriSchema).min(1)
+});
+//# sourceMappingURL=browser-session-code.js.map

package/dist/schemas/browser-session-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-session-code.js","sourceRoot":"","sources":["../../src/schemas/browser-session-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;AAC7D,kDAAkD;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;AACpF,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AACzF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC9C,MAAM,EAAE;KACR,GAAG,CAAC,IAAI,CAAC;KACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,sCAAsC,CAAC,CAAC;AAEjF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,EAAE,4BAA4B;IACpC,YAAY,EAAE,+BAA+B;IAC7C,cAAc,EAAE,uBAAuB;IACvC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACxC,CAAC,CAAC;AAGH,iEAAiE;AACjE,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,IAAI,EAAE,wBAAwB;IAC9B,SAAS,EAAE,4BAA4B;IACvC,YAAY,EAAE,+BAA+B;IAC7C,aAAa,EAAE,sBAAsB;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kDAAkD,CAAC;CACzE,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,EAAE,EAAE,4BAA4B;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7D,CAAC,CAAC"}