@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/schemas/consumer-auth.d.ts

@@ -0,0 +1,95 @@
+import * as z from 'zod/v4';
+export declare const StoredIdentitySchema: z.ZodObject<{
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type StoredIdentity = z.infer<typeof StoredIdentitySchema>;
+export declare const StoredIdentityResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"signed-in">;
+    identity: z.ZodObject<{
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+        userId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"signed-out">;
+}, z.core.$strip>], "status">;
+export type StoredIdentityResult = z.infer<typeof StoredIdentityResultSchema>;
+export declare const DeviceSignInProgressSchema: z.ZodObject<{
+    message: z.ZodString;
+    tone: z.ZodEnum<{
+        error: "error";
+        info: "info";
+        warn: "warn";
+    }>;
+}, z.core.$strip>;
+export type DeviceSignInProgress = z.infer<typeof DeviceSignInProgressSchema>;
+export declare const DeviceSignInOptionsSchema: z.ZodObject<{
+    signal: z.ZodOptional<z.ZodInstanceOf<AbortSignal>>;
+    onProgress: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+        message: z.ZodString;
+        tone: z.ZodEnum<{
+            error: "error";
+            info: "info";
+            warn: "warn";
+        }>;
+    }, z.core.$strip>], null>, z.ZodVoid>>;
+}, z.core.$strict>;
+export type DeviceSignInOptions = z.infer<typeof DeviceSignInOptionsSchema>;
+export declare const DeviceSignInResultSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    message: z.ZodString;
+    cause: z.ZodOptional<z.ZodPipe<z.ZodUnknown, z.ZodTransform<Error | import("@vibesdotdev/kernel").ThrownNonError, unknown>>>;
+}, z.core.$strip>;
+export type DeviceSignInResult = z.infer<typeof DeviceSignInResultSchema>;
+/** Compatible device-login adapter; credential fields stay within Auth consumers. */
+export declare const DeviceLoginResultSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    message: z.ZodString;
+    cause: z.ZodOptional<z.ZodPipe<z.ZodUnknown, z.ZodTransform<Error | import("@vibesdotdev/kernel").ThrownNonError, unknown>>>;
+    token: z.ZodNullable<z.ZodString>;
+    user: z.ZodOptional<z.ZodObject<{
+        userId: z.ZodOptional<z.ZodString>;
+        email: z.ZodString;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DeviceLoginResult = z.infer<typeof DeviceLoginResultSchema>;
+/**
+ * Callable web transport; native runtime-specific static members are not required.
+ * `Request` is declared by its ambient type rather than `z.instanceof`: under
+ * Cloudflare workers types the constructor is generic, so `InstanceType` widens
+ * to `Request<unknown, unknown>` and `typeof fetch` would stop satisfying the shape.
+ */
+export declare const AuthFetchSchema: z.ZodFunction<z.ZodTuple<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<URL>, z.ZodCustom<Request, Request>]>, z.ZodOptional<z.ZodCustom<RequestInit, RequestInit>>], null>, z.ZodPromise<z.ZodInstanceOf<Response>>>;
+export type AuthFetch = z.infer<typeof AuthFetchSchema>;
+export declare const ConsumerAuthOperationsSchema: z.ZodObject<{
+    getStoredIdentity: z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodPromise<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        status: z.ZodLiteral<"signed-in">;
+        identity: z.ZodObject<{
+            email: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+            userId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>, z.ZodObject<{
+        status: z.ZodLiteral<"signed-out">;
+    }, z.core.$strip>], "status">>>;
+    signInDevice: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+        signal: z.ZodOptional<z.ZodInstanceOf<AbortSignal>>;
+        onProgress: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            message: z.ZodString;
+            tone: z.ZodEnum<{
+                error: "error";
+                info: "info";
+                warn: "warn";
+            }>;
+        }, z.core.$strip>], null>, z.ZodVoid>>;
+    }, z.core.$strict>], null>, z.ZodPromise<z.ZodObject<{
+        success: z.ZodBoolean;
+        message: z.ZodString;
+        cause: z.ZodOptional<z.ZodPipe<z.ZodUnknown, z.ZodTransform<Error | import("@vibesdotdev/kernel").ThrownNonError, unknown>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ConsumerAuthOperations = z.infer<typeof ConsumerAuthOperationsSchema>;
+//# sourceMappingURL=consumer-auth.d.ts.map

package/dist/schemas/consumer-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-auth.d.ts","sourceRoot":"","sources":["../../src/schemas/consumer-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,oBAAoB;;;;iBAI/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,eAAO,MAAM,0BAA0B;;;;;;;;;6BAGrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,eAAO,MAAM,0BAA0B;;;;;;;iBAGrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,eAAO,MAAM,yBAAyB;;;;;;;;;;kBAG3B,CAAC;AACZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,qFAAqF;AACrF,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAKlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,eAAe,oOAG1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/schemas/consumer-auth.js

@@ -0,0 +1,46 @@
+import * as z from 'zod/v4';
+import { CaughtFailureSchema } from '@vibesdotdev/kernel';
+export const StoredIdentitySchema = z.object({
+    email: z.string().optional(),
+    name: z.string().optional(),
+    userId: z.string().optional()
+});
+export const StoredIdentityResultSchema = z.discriminatedUnion('status', [
+    z.object({ status: z.literal('signed-in'), identity: StoredIdentitySchema }),
+    z.object({ status: z.literal('signed-out') })
+]);
+export const DeviceSignInProgressSchema = z.object({
+    message: z.string(),
+    tone: z.enum(['info', 'warn', 'error'])
+});
+export const DeviceSignInOptionsSchema = z.object({
+    signal: z.instanceof(AbortSignal).optional(),
+    onProgress: z.function({ input: [DeviceSignInProgressSchema], output: z.void() }).optional()
+}).strict();
+export const DeviceSignInResultSchema = z.object({
+    success: z.boolean(),
+    message: z.string(),
+    cause: z.unknown().transform(value => CaughtFailureSchema.parse(value)).optional()
+});
+/** Compatible device-login adapter; credential fields stay within Auth consumers. */
+export const DeviceLoginResultSchema = DeviceSignInResultSchema.extend({
+    token: z.string().nullable(),
+    user: z.object({
+        userId: z.string().optional(), email: z.string(), name: z.string().nullable().optional()
+    }).optional()
+});
+/**
+ * Callable web transport; native runtime-specific static members are not required.
+ * `Request` is declared by its ambient type rather than `z.instanceof`: under
+ * Cloudflare workers types the constructor is generic, so `InstanceType` widens
+ * to `Request<unknown, unknown>` and `typeof fetch` would stop satisfying the shape.
+ */
+export const AuthFetchSchema = z.function({
+    input: [z.union([z.string(), z.instanceof(URL), z.custom(value => value instanceof Request)]), z.custom().optional()],
+    output: z.promise(z.instanceof(Response))
+});
+export const ConsumerAuthOperationsSchema = z.object({
+    getStoredIdentity: z.function({ input: [], output: z.promise(StoredIdentityResultSchema) }),
+    signInDevice: z.function({ input: [DeviceSignInOptionsSchema], output: z.promise(DeviceSignInResultSchema) })
+});
+//# sourceMappingURL=consumer-auth.js.map

package/dist/schemas/consumer-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-auth.js","sourceRoot":"","sources":["../../src/schemas/consumer-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACxE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;CAC7C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5F,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClF,CAAC,CAAC;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,wBAAwB,CAAC,MAAM,CAAC;IACtE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACxF,CAAC,CAAC,QAAQ,EAAE;CACb,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,QAAQ,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAU,KAAK,CAAC,EAAE,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAe,CAAC,QAAQ,EAAE,CAAC;IAC3I,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC3F,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;CAC7G,CAAC,CAAC"}

package/dist/schemas/credentials.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Credential schemas — relocated from users.
+ *
+ * Auth-domain credential types for scoped API key authentication.
+ * Runtime credential storage lives in ./api/credentials.ts (config/manifest#auth).
+ */
+import * as z from 'zod/v4';
+/**
+ * Credential types for authentication
+ */
+export declare const credentialTypeSchema: z.ZodEnum<{
+    none: "none";
+    session: "session";
+    apiKey: "apiKey";
+}>;
+export type CredentialType = z.infer<typeof credentialTypeSchema>;
+/**
+ * Reference to credential material held by a runtime-selected secure store.
+ *
+ * The auth config document may persist this metadata because it contains no
+ * secret bytes. Consumer runtime implementations resolve the reference in
+ * process; renderer projections never receive the resolved value.
+ */
+export declare const authSecretReferenceSchema: z.ZodObject<{
+    storeId: z.ZodString;
+    environment: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strip>;
+export type AuthSecretReference = z.infer<typeof authSecretReferenceSchema>;
+/**
+ * Core credential info schema
+ */
+export declare const credentialInfoSchema: z.ZodObject<{
+    type: z.ZodEnum<{
+        none: "none";
+        session: "session";
+        apiKey: "apiKey";
+    }>;
+    token: z.ZodOptional<z.ZodString>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    sessionTokenReference: z.ZodOptional<z.ZodObject<{
+        storeId: z.ZodString;
+        environment: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strip>>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    refreshTokenReference: z.ZodOptional<z.ZodObject<{
+        storeId: z.ZodString;
+        environment: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strip>>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    environment: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        "chat:send": "chat:send";
+        "chat:read": "chat:read";
+        "knowledge:read": "knowledge:read";
+        "knowledge:write": "knowledge:write";
+        "session:join": "session:join";
+        "session:create": "session:create";
+        "forum:post": "forum:post";
+        "forum:react": "forum:react";
+        "presence:update": "presence:update";
+        "presentations:request": "presentations:request";
+        "presentations:review": "presentations:review";
+        "forge:read": "forge:read";
+        "forge:write": "forge:write";
+        "forge:review": "forge:review";
+        "forge:merge": "forge:merge";
+    }>>>;
+    projectId: z.ZodOptional<z.ZodString>;
+    ipWhitelist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    dailyQuota: z.ZodOptional<z.ZodNumber>;
+    source: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type CredentialInfo = z.infer<typeof credentialInfoSchema>;
+/**
+ * Set credentials input schema
+ */
+export declare const setCredentialsInputSchema: z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+        partial: "partial";
+        "replace-session": "replace-session";
+    }>>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    sessionTokenReference: z.ZodOptional<z.ZodObject<{
+        storeId: z.ZodString;
+        environment: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strip>>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    refreshTokenReference: z.ZodOptional<z.ZodObject<{
+        storeId: z.ZodString;
+        environment: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strip>>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SetCredentialsInput = z.infer<typeof setCredentialsInputSchema>;
+/**
+ * User info within auth credentials
+ */
+export declare const authCredentialsUserSchema: z.ZodObject<{
+    userId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthCredentialsUser = z.infer<typeof authCredentialsUserSchema>;
+/**
+ * Credentials sub-object within auth credentials
+ */
+export declare const authCredentialsTokenSchema: z.ZodObject<{
+    token: z.ZodOptional<z.ZodString>;
+    apiKey: z.ZodOptional<z.ZodString>;
+    sessionToken: z.ZodOptional<z.ZodString>;
+    sessionTokenReference: z.ZodOptional<z.ZodObject<{
+        storeId: z.ZodString;
+        environment: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strip>>;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    refreshTokenReference: z.ZodOptional<z.ZodObject<{
+        storeId: z.ZodString;
+        environment: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strip>>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuthCredentialsToken = z.infer<typeof authCredentialsTokenSchema>;
+/**
+ * Full auth credentials schema for storage
+ */
+export declare const authCredentialsSchema: z.ZodObject<{
+    user: z.ZodOptional<z.ZodObject<{
+        userId: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    credentials: z.ZodOptional<z.ZodObject<{
+        token: z.ZodOptional<z.ZodString>;
+        apiKey: z.ZodOptional<z.ZodString>;
+        sessionToken: z.ZodOptional<z.ZodString>;
+        sessionTokenReference: z.ZodOptional<z.ZodObject<{
+            storeId: z.ZodString;
+            environment: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strip>>;
+        refreshToken: z.ZodOptional<z.ZodString>;
+        refreshTokenReference: z.ZodOptional<z.ZodObject<{
+            storeId: z.ZodString;
+            environment: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strip>>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    environment: z.ZodOptional<z.ZodString>;
+    pendingSecretCleanup: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        storeId: z.ZodString;
+        environment: z.ZodString;
+        key: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type AuthCredentials = z.infer<typeof authCredentialsSchema>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/schemas/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/schemas/credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;EAAwC,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwB/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;iBAmBrC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;iBAQrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;GAEG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/schemas/credentials.js

@@ -0,0 +1,105 @@
+/**
+ * Credential schemas — relocated from users.
+ *
+ * Auth-domain credential types for scoped API key authentication.
+ * Runtime credential storage lives in ./api/credentials.ts (config/manifest#auth).
+ */
+import * as z from 'zod/v4';
+import { authScopeSchema } from "./agents.js";
+/**
+ * Credential types for authentication
+ */
+export const credentialTypeSchema = z.enum(['apiKey', 'session', 'none']);
+/**
+ * Reference to credential material held by a runtime-selected secure store.
+ *
+ * The auth config document may persist this metadata because it contains no
+ * secret bytes. Consumer runtime implementations resolve the reference in
+ * process; renderer projections never receive the resolved value.
+ */
+export const authSecretReferenceSchema = z.object({
+    storeId: z.string().min(1).refine((value) => value.trim().length > 0),
+    environment: z.string().min(1).refine((value) => value.trim().length > 0),
+    key: z.string().min(1).refine((value) => value.trim().length > 0)
+});
+/**
+ * Core credential info schema
+ */
+export const credentialInfoSchema = z.object({
+    type: credentialTypeSchema,
+    token: z.string().optional(),
+    apiKey: z.string().optional(),
+    sessionToken: z.string().optional(),
+    sessionTokenReference: authSecretReferenceSchema.optional(),
+    refreshToken: z.string().optional(),
+    refreshTokenReference: authSecretReferenceSchema.optional(),
+    expiresAt: z.string().optional(),
+    /** Runtime environment id this credential was stored under (partition label). */
+    environment: z.string().optional(),
+    userId: z.string().optional(),
+    email: z.string().email().optional(),
+    name: z.string().optional(),
+    scopes: z.array(authScopeSchema).optional(),
+    projectId: z.string().optional(),
+    ipWhitelist: z.array(z.string()).optional(),
+    dailyQuota: z.number().int().positive().optional(),
+    /**
+     * Credential-dark provenance for doctor/authority diagnostics.
+     * Examples: `config/manifest#auth`, `env:VIBES_API_KEY`, `env:GLADOS_AGENT_API_KEY`.
+     * Never holds secret material — only the env var *name* or storage address.
+     */
+    source: z.string().min(1).optional()
+});
+/**
+ * Set credentials input schema
+ */
+export const setCredentialsInputSchema = z.object({
+    /** Omitted fields merge by default; an approved session replaces the whole login. */
+    mode: z.enum(['partial', 'replace-session']).optional(),
+    apiKey: z.string().optional(),
+    sessionToken: z.string().optional(),
+    sessionTokenReference: authSecretReferenceSchema.optional(),
+    refreshToken: z.string().optional(),
+    refreshTokenReference: authSecretReferenceSchema.optional(),
+    expiresAt: z.string().optional(),
+    userId: z.string().optional(),
+    email: z.string().email().optional(),
+    name: z.string().optional()
+}).refine((input) => {
+    if (input.mode !== 'replace-session')
+        return true;
+    if (input.sessionToken !== undefined)
+        return input.sessionToken.trim().length > 0;
+    return input.sessionTokenReference !== undefined;
+}, { message: 'A replacement requires a session credential or reference.', path: ['sessionToken'] });
+/**
+ * User info within auth credentials
+ */
+export const authCredentialsUserSchema = z.object({
+    userId: z.string().optional(),
+    email: z.string().email().optional(),
+    name: z.string().optional()
+});
+/**
+ * Credentials sub-object within auth credentials
+ */
+export const authCredentialsTokenSchema = z.object({
+    token: z.string().optional(),
+    apiKey: z.string().optional(),
+    sessionToken: z.string().optional(),
+    sessionTokenReference: authSecretReferenceSchema.optional(),
+    refreshToken: z.string().optional(),
+    refreshTokenReference: authSecretReferenceSchema.optional(),
+    expiresAt: z.string().optional()
+});
+/**
+ * Full auth credentials schema for storage
+ */
+export const authCredentialsSchema = z.object({
+    user: authCredentialsUserSchema.optional(),
+    credentials: authCredentialsTokenSchema.optional(),
+    environment: z.string().optional(),
+    /** Durable custody of references awaiting safe retirement; contains no secret bytes. */
+    pendingSecretCleanup: z.array(authSecretReferenceSchema).optional()
+});
+//# sourceMappingURL=credentials.js.map

package/dist/schemas/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/schemas/credentials.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAG1E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACrE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACzE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;CACjE,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,oBAAoB;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,qBAAqB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,qBAAqB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,iFAAiF;IACjF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,qFAAqF;IACrF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,qBAAqB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,qBAAqB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC,MAAM,CACR,CAAC,KAAK,EAAE,EAAE;IACT,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC,qBAAqB,KAAK,SAAS,CAAC;AAClD,CAAC,EACD,EAAE,OAAO,EAAE,2DAA2D,EAAE,IAAI,EAAE,CAAC,cAAc,CAAC,EAAE,CAChG,CAAC;AAIF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,qBAAqB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,qBAAqB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,wFAAwF;IACxF,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC"}

package/dist/schemas/flows/forms.d.ts

@@ -0,0 +1,91 @@
+import * as z from 'zod/v4';
+export declare const loginSchema: z.ZodObject<{
+    email: z.ZodEmail;
+    password: z.ZodString;
+    rememberMe: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const forgotPasswordSchema: z.ZodObject<{
+    email: z.ZodEmail;
+}, z.core.$strip>;
+export declare const registerSchema: z.ZodObject<{
+    email: z.ZodEmail;
+    name: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    password: z.ZodString;
+    confirmPassword: z.ZodString;
+    acceptTerms: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const updateUserSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodString>>>;
+    image: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodString>>>;
+}, z.core.$strip>;
+export type LoginInput = z.infer<typeof loginSchema>;
+export type ForgotPasswordInput = z.infer<typeof forgotPasswordSchema>;
+export type RegisterInput = z.infer<typeof registerSchema>;
+export type UpdateUserInput = z.infer<typeof updateUserSchema>;
+export declare const resetPasswordSchema: z.ZodObject<{
+    token: z.ZodString;
+    password: z.ZodString;
+    confirmPassword: z.ZodString;
+}, z.core.$strip>;
+export type ResetPasswordInput = z.infer<typeof resetPasswordSchema>;
+export declare const generateApiKeySchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodArray<z.ZodString>;
+    expiresInDays: z.ZodOptional<z.ZodNumber>;
+    applicationId: z.ZodOptional<z.ZodString>;
+    ipRestrictions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const authorizeExternalAppSchema: z.ZodObject<{
+    applicationId: z.ZodString;
+    state: z.ZodString;
+    redirectUri: z.ZodURL;
+    scopes: z.ZodArray<z.ZodString>;
+    allowAccess: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const cliAuthSchema: z.ZodObject<{
+    state: z.ZodString;
+    callback: z.ZodURL;
+}, z.core.$strip>;
+export type GenerateApiKeyInput = z.infer<typeof generateApiKeySchema>;
+export type AuthorizeExternalAppInput = z.infer<typeof authorizeExternalAppSchema>;
+export type CliAuthInput = z.infer<typeof cliAuthSchema>;
+export declare const mfaSetupSchema: z.ZodObject<{
+    totpCode: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>;
+export declare const mfaVerificationSchema: z.ZodObject<{
+    code: z.ZodString;
+    trustDevice: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const mfaDisableSchema: z.ZodObject<{
+    password: z.ZodString;
+    confirmDisable: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const recoveryCodeSchema: z.ZodObject<{
+    recoveryCode: z.ZodString;
+}, z.core.$strip>;
+export declare const regenerateRecoveryCodesSchema: z.ZodObject<{
+    password: z.ZodString;
+}, z.core.$strip>;
+export type MfaSetupInput = z.infer<typeof mfaSetupSchema>;
+export type MfaVerificationInput = z.infer<typeof mfaVerificationSchema>;
+export type MfaDisableInput = z.infer<typeof mfaDisableSchema>;
+export type RecoveryCodeInput = z.infer<typeof recoveryCodeSchema>;
+export type RegenerateRecoveryCodesInput = z.infer<typeof regenerateRecoveryCodesSchema>;
+/**
+ * Change password schema — validates a password change request.
+ * Requires the current password for verification plus the new password
+ * confirmed twice, matching the conventions used by resetPasswordSchema.
+ */
+export declare const changePasswordSchema: z.ZodObject<{
+    currentPassword: z.ZodString;
+    newPassword: z.ZodString;
+    confirmPassword: z.ZodString;
+}, z.core.$strip>;
+export type ChangePasswordInput = z.infer<typeof changePasswordSchema>;
+export declare const availableScopes: {
+    id: "knowledge:read" | "knowledge:write" | "profile:read" | "agents:read" | "agents:run" | "profile:write" | "agents:write";
+    label: string;
+}[];
+//# sourceMappingURL=forms.d.ts.map

package/dist/schemas/flows/forms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms.d.ts","sourceRoot":"","sources":["../../../src/schemas/flows/forms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,eAAO,MAAM,WAAW;;;;iBAItB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;iBAE/B,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;iBAkBxB,CAAC;AAEJ,eAAO,MAAM,gBAAgB;;;iBAKlB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACrD,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE/D,eAAO,MAAM,mBAAmB;;;;iBAc7B,CAAC;AAEJ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGrE,eAAO,MAAM,oBAAoB;;;;;;;iBAO/B,CAAC;AAGH,eAAO,MAAM,0BAA0B;;;;;;iBAMrC,CAAC;AAGH,eAAO,MAAM,aAAa;;;iBAGxB,CAAC;AAGH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACvE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACnF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAGzD,eAAO,MAAM,cAAc;;;iBAMzB,CAAC;AAGH,eAAO,MAAM,qBAAqB;;;iBAMhC,CAAC;AAGH,eAAO,MAAM,gBAAgB;;;iBAK3B,CAAC;AAGH,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AAGH,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAGH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAC3D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACnE,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEzF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;;iBAc9B,CAAC;AAEJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAGvE,eAAO,MAAM,eAAe;;;GAMzB,CAAC"}