@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/server/services/account-linking.service.js

@@ -0,0 +1,178 @@
+/**
+ * Account Linking Service
+ *
+ * Manages multi-provider OAuth account linking.
+ * Uses StorageManifest for data access — no direct Drizzle imports.
+ */
+import { getLogger } from '@vibesdotdev/logging';
+export class AccountLinkingService {
+    log;
+    runtime;
+    accounts;
+    /** `accounts` is the `auth.accounts` manifest of the runtime the service was composed on. */
+    constructor(runtime, accounts) {
+        this.runtime = runtime;
+        this.log = getLogger('auth:account-linking', runtime);
+        this.accounts = accounts;
+    }
+    async listLinkedProviders(userId) {
+        const accounts = await this.accounts.findByUserId(userId);
+        return accounts.map((account, index) => ({
+            providerId: account.providerId,
+            accountId: account.accountId,
+            displayName: `${account.providerId} (${account.accountId.slice(0, 8)}…)`,
+            linkedAt: account.createdAt,
+            isPrimary: index === 0
+        }));
+    }
+    async generateLinkUrl(provider, userId) {
+        const userAccounts = await this.accounts.findByUserId(userId);
+        const existingLink = userAccounts.find(acc => acc.providerId === provider);
+        if (existingLink) {
+            throw new Error(`${provider} is already linked to your account`);
+        }
+        const state = this.encodeLinkingState(userId, provider);
+        switch (provider) {
+            case 'github':
+                return this.buildGithubOAuthUrl(this.runtime, state);
+            case 'google':
+                return this.buildGoogleOAuthUrl(this.runtime, state);
+            case 'microsoft':
+                return this.buildMicrosoftOAuthUrl(this.runtime, state);
+            case 'discord':
+                return this.buildDiscordOAuthUrl(this.runtime, state);
+            default:
+                throw new Error(`Unsupported provider: ${provider}`);
+        }
+    }
+    async linkProvider(userId, providerAccount) {
+        const existing = await this.accounts.findByUserAndProvider(userId, providerAccount.providerId);
+        if (existing) {
+            this.log.warn('Provider already linked, updating', {
+                userId,
+                providerId: providerAccount.providerId
+            });
+            await this.accounts.updateAccount(existing.id, {
+                accessToken: providerAccount.accessToken,
+                refreshToken: providerAccount.refreshToken ?? null,
+                accessTokenExpiresAt: providerAccount.accessTokenExpiresAt ?? null,
+                refreshTokenExpiresAt: providerAccount.refreshTokenExpiresAt ?? null,
+                scope: providerAccount.scope ?? null,
+                idToken: providerAccount.idToken ?? null
+            });
+        }
+        else {
+            this.log.info('Linking new provider', {
+                userId,
+                providerId: providerAccount.providerId,
+                accountId: providerAccount.accountId
+            });
+            await this.accounts.create({
+                id: crypto.randomUUID(),
+                userId,
+                accountId: providerAccount.accountId,
+                providerId: providerAccount.providerId,
+                accessToken: providerAccount.accessToken,
+                refreshToken: providerAccount.refreshToken ?? null,
+                accessTokenExpiresAt: providerAccount.accessTokenExpiresAt ?? null,
+                refreshTokenExpiresAt: providerAccount.refreshTokenExpiresAt ?? null,
+                scope: providerAccount.scope ?? null,
+                idToken: providerAccount.idToken ?? null,
+                password: null
+            });
+        }
+    }
+    async unlinkProvider(userId, providerId, options = {}) {
+        const safety = options.confirmedRemainingProviders === undefined
+            ? await this.validateUnlinkSafety(userId, providerId)
+            : {
+                safe: options.confirmedRemainingProviders > 0,
+                reason: options.confirmedRemainingProviders > 0
+                    ? undefined
+                    : 'Cannot unlink your last authentication method. Add another provider first.',
+                remainingProviders: options.confirmedRemainingProviders
+            };
+        if (!safety.safe) {
+            throw new Error(safety.reason || 'Cannot unlink provider');
+        }
+        await this.accounts.deleteByUserAndProvider(userId, providerId);
+        this.log.info('Provider unlinked', { userId, providerId });
+    }
+    async validateUnlinkSafety(userId, providerId) {
+        const allAccounts = await this.accounts.findByUserId(userId);
+        const remainingCount = allAccounts.filter(acc => acc.providerId !== providerId).length;
+        if (remainingCount === 0) {
+            return {
+                safe: false,
+                reason: 'Cannot unlink your last authentication method. Add another provider first.',
+                remainingProviders: 0
+            };
+        }
+        return {
+            safe: true,
+            remainingProviders: remainingCount
+        };
+    }
+    async isProviderAccountLinked(providerId, accountId) {
+        const account = await this.accounts.findByProvider(providerId, accountId);
+        if (account) {
+            return {
+                isLinked: true,
+                linkedUserId: account.userId
+            };
+        }
+        return { isLinked: false };
+    }
+    async findUserByProvider(providerId, accountId) {
+        const account = await this.accounts.findByProvider(providerId, accountId);
+        return account?.userId ?? null;
+    }
+    encodeLinkingState(userId, provider) {
+        const payload = {
+            action: 'link',
+            userId,
+            provider,
+            exp: Date.now() + 10 * 60 * 1000
+        };
+        return Buffer.from(JSON.stringify(payload)).toString('base64url');
+    }
+    buildGithubOAuthUrl(runtime, state) {
+        const clientId = runtime.getEnv('VIBES_AUTH_GITHUB_CLIENT_ID') ?? runtime.getEnv('GITHUB_CLIENT_ID');
+        if (!clientId)
+            throw new Error('GitHub sign-in is not configured on this server');
+        const redirectUri = `${getAuthBaseUrl(runtime)}/api/auth/callback/github`;
+        return `https://github.com/login/oauth/authorize?client_id=${clientId}&redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}&scope=read:user,user:email`;
+    }
+    buildGoogleOAuthUrl(runtime, state) {
+        const clientId = runtime.getEnv('VIBES_AUTH_GOOGLE_CLIENT_ID') ?? runtime.getEnv('GOOGLE_CLIENT_ID');
+        if (!clientId)
+            throw new Error('Google sign-in is not configured on this server');
+        const redirectUri = `${getAuthBaseUrl(runtime)}/api/auth/callback/google`;
+        return `https://accounts.google.com/o/oauth2/v2/auth?client_id=${clientId}&redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}&response_type=code&scope=openid%20email%20profile`;
+    }
+    buildMicrosoftOAuthUrl(runtime, state) {
+        const clientId = runtime.getEnv('VIBES_AUTH_MICROSOFT_CLIENT_ID') ??
+            runtime.getEnv('AZURE_AD_CLIENT_ID');
+        if (!clientId)
+            throw new Error('Microsoft sign-in is not configured on this server');
+        const redirectUri = `${getAuthBaseUrl(runtime)}/api/auth/callback/microsoft`;
+        return `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=${clientId}&redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}&response_type=code&scope=openid%20email%20profile`;
+    }
+    buildDiscordOAuthUrl(runtime, state) {
+        const clientId = runtime.getEnv('VIBES_AUTH_DISCORD_CLIENT_ID') ?? runtime.getEnv('DISCORD_CLIENT_ID');
+        if (!clientId)
+            throw new Error('Discord sign-in is not configured on this server');
+        const redirectUri = `${getAuthBaseUrl(runtime)}/api/auth/callback/discord`;
+        return `https://discord.com/api/oauth2/authorize?client_id=${clientId}&redirect_uri=${encodeURIComponent(redirectUri)}&state=${state}&response_type=code&scope=identify%20email`;
+    }
+}
+function getAuthBaseUrl(runtime) {
+    const url = runtime.getEnv('VIBES_AUTH_BASE_URL') ??
+        runtime.getEnv('PUBLIC_VIBES_AUTH_ORIGIN') ??
+        runtime.getEnv('PUBLIC_APP_URL');
+    if (!url) {
+        throw new Error('Auth base URL is not configured');
+    }
+    return url;
+}
+//# sourceMappingURL=account-linking.service.js.map

package/dist/server/services/account-linking.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-linking.service.js","sourceRoot":"","sources":["../../../src/server/services/account-linking.service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AA4BjD,MAAM,OAAO,qBAAqB;IAChB,GAAG,CAA+B;IAC3C,OAAO,CAAwB;IAC/B,QAAQ,CAAsB;IAEtC,6FAA6F;IAC7F,YAAY,OAA8B,EAAE,QAA6B;QACxE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAE1D,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACxC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;YACxE,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,SAAS,EAAE,KAAK,KAAK,CAAC;SACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAA2B,EAAE,MAAc;QAChE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC;QAE3E,IAAI,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,oCAAoC,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAExD,QAAQ,QAAQ,EAAE,CAAC;YAClB,KAAK,QAAQ;gBACZ,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtD,KAAK,QAAQ;gBACZ,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtD,KAAK,WAAW;gBACf,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzD,KAAK,SAAS;gBACb,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACvD;gBACC,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACvD,CAAC;IACF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,eAAqC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,MAAM,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;QAE/F,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBAClD,MAAM;gBACN,UAAU,EAAE,eAAe,CAAC,UAAU;aACtC,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC9C,WAAW,EAAE,eAAe,CAAC,WAAW;gBACxC,YAAY,EAAE,eAAe,CAAC,YAAY,IAAI,IAAI;gBAClD,oBAAoB,EAAE,eAAe,CAAC,oBAAoB,IAAI,IAAI;gBAClE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,IAAI,IAAI;gBACpE,KAAK,EAAE,eAAe,CAAC,KAAK,IAAI,IAAI;gBACpC,OAAO,EAAE,eAAe,CAAC,OAAO,IAAI,IAAI;aACxC,CAAC,CAAC;QACJ,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBACrC,MAAM;gBACN,UAAU,EAAE,eAAe,CAAC,UAAU;gBACtC,SAAS,EAAE,eAAe,CAAC,SAAS;aACpC,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC1B,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,MAAM;gBACN,SAAS,EAAE,eAAe,CAAC,SAAS;gBACpC,UAAU,EAAE,eAAe,CAAC,UAAU;gBACtC,WAAW,EAAE,eAAe,CAAC,WAAW;gBACxC,YAAY,EAAE,eAAe,CAAC,YAAY,IAAI,IAAI;gBAClD,oBAAoB,EAAE,eAAe,CAAC,oBAAoB,IAAI,IAAI;gBAClE,qBAAqB,EAAE,eAAe,CAAC,qBAAqB,IAAI,IAAI;gBACpE,KAAK,EAAE,eAAe,CAAC,KAAK,IAAI,IAAI;gBACpC,OAAO,EAAE,eAAe,CAAC,OAAO,IAAI,IAAI;gBACxC,QAAQ,EAAE,IAAI;aACd,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,MAAc,EACd,UAAkB,EAClB,UAAoD,EAAE;QAEtD,MAAM,MAAM,GACX,OAAO,CAAC,2BAA2B,KAAK,SAAS;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC;YACrD,CAAC,CAAC;gBACA,IAAI,EAAE,OAAO,CAAC,2BAA2B,GAAG,CAAC;gBAC7C,MAAM,EACL,OAAO,CAAC,2BAA2B,GAAG,CAAC;oBACtC,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,4EAA4E;gBAChF,kBAAkB,EAAE,OAAO,CAAC,2BAA2B;aACvD,CAAC;QAEL,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAEhE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,UAAkB;QAC5D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;QAEvF,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;gBACN,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,4EAA4E;gBACpF,kBAAkB,EAAE,CAAC;aACrB,CAAC;QACH,CAAC;QAED,OAAO;YACN,IAAI,EAAE,IAAI;YACV,kBAAkB,EAAE,cAAc;SAClC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,UAAkB,EAAE,SAAiB;QAIlE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAE1E,IAAI,OAAO,EAAE,CAAC;YACb,OAAO;gBACN,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,OAAO,CAAC,MAAM;aAC5B,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,UAAkB,EAAE,SAAiB;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1E,OAAO,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;IAChC,CAAC;IAEO,kBAAkB,CAAC,MAAc,EAAE,QAAgB;QAC1D,MAAM,OAAO,GAAG;YACf,MAAM,EAAE,MAAM;YACd,MAAM;YACN,QAAQ;YACR,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SAChC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnE,CAAC;IAEO,mBAAmB,CAAC,OAA8B,EAAE,KAAa;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACrG,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,2BAA2B,CAAC;QAC1E,OAAO,sDAAsD,QAAQ,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,UAAU,KAAK,6BAA6B,CAAC;IACnK,CAAC;IAEO,mBAAmB,CAAC,OAA8B,EAAE,KAAa;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACrG,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAClF,MAAM,WAAW,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,2BAA2B,CAAC;QAC1E,OAAO,0DAA0D,QAAQ,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,UAAU,KAAK,oDAAoD,CAAC;IAC9L,CAAC;IAEO,sBAAsB,CAAC,OAA8B,EAAE,KAAa;QAC3E,MAAM,QAAQ,GACb,OAAO,CAAC,MAAM,CAAC,gCAAgC,CAAC;YAChD,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACrF,MAAM,WAAW,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,8BAA8B,CAAC;QAC7E,OAAO,4EAA4E,QAAQ,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,UAAU,KAAK,oDAAoD,CAAC;IAChN,CAAC;IAEO,oBAAoB,CAAC,OAA8B,EAAE,KAAa;QACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,8BAA8B,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACvG,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACnF,MAAM,WAAW,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,4BAA4B,CAAC;QAC3E,OAAO,sDAAsD,QAAQ,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,UAAU,KAAK,4CAA4C,CAAC;IAClL,CAAC;CACD;AAED,SAAS,cAAc,CAAC,OAA8B;IACrD,MAAM,GAAG,GACR,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,0BAA0B,CAAC;QAC1C,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/server/session-revocation.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Session Token Revocation
+ *
+ * Revokes session tokens by adding them to the SESSION_BLACKLIST KV namespace.
+ * Paired with the reader in jwt-session-handle.ts that checks before JWT verification.
+ */
+import * as z from 'zod/v4';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+declare global {
+    interface KVNamespace {
+        get(key: string): Promise<string | null>;
+        put(key: string, value: string, options?: {
+            expirationTtl?: number;
+        }): Promise<void>;
+    }
+}
+/** What the session handle, SESSION_BLACKLIST's reader, asks of the namespace. */
+export type SessionBlacklistReader = Pick<KVNamespace, 'get'>;
+/** What the revocation calls below, its writers, ask of the namespace. */
+export type SessionBlacklistWriter = Pick<KVNamespace, 'put'>;
+/**
+ * SESSION_BLACKLIST's owning schemas for `runtime.getBinding`, one per use.
+ * Each admits the native namespace itself, never a copy, so its methods keep
+ * their receiver.
+ */
+export declare const SessionBlacklistReaderSchema: z.ZodCustom<SessionBlacklistReader, SessionBlacklistReader>;
+export declare const SessionBlacklistWriterSchema: z.ZodCustom<SessionBlacklistWriter, SessionBlacklistWriter>;
+/**
+ * Get the revocation key for a session token.
+ * Shared with the reader in jwt-session-handle.ts.
+ */
+export declare function sessionRevocationKey(token: string): Promise<string>;
+/** Preserve existing revocations only when their unchanged key fits Cloudflare KV. */
+export declare function sessionRevocationKeys(token: string): Promise<string[]>;
+/** Revocation key for a session id (covers every JWT minted for that session). */
+export declare function sessionIdRevocationKey(sessionId: string): string;
+/**
+ * Revoke JWTs by session id, with a TTL until each session's expiry.
+ * Fails closed (typed CapabilityError) when SESSION_BLACKLIST is unbound.
+ */
+export declare function revokeSessionIds(runtime: Pick<VibesRuntime, 'getBinding'>, sessions: Array<{
+    sessionId: string;
+    expiresAt: Date | number;
+}>, options?: {
+    nowMs?: number;
+}): Promise<void>;
+/**
+ * Revoke a single session token.
+ *
+ * Decodes the JWT (without verification) to extract the `exp` claim and set
+ * the KV entry's TTL accordingly. Fails closed if the SESSION_BLACKLIST
+ * binding is not available.
+ *
+ * @param runtime - Runtime to resolve the SESSION_BLACKLIST KV namespace
+ * @param token - JWT token to revoke
+ * @param options - Optional configuration (nowMs for testing)
+ * @throws CapabilityError if SESSION_BLACKLIST binding is unavailable or token is invalid
+ */
+export declare function revokeSessionToken(runtime: Pick<VibesRuntime, 'getBinding'>, token: string, options?: {
+    nowMs?: number;
+}): Promise<void>;
+/**
+ * Revoke multiple session tokens.
+ *
+ * @param runtime - Runtime to resolve the SESSION_BLACKLIST KV namespace
+ * @param tokens - Array of JWT tokens to revoke
+ * @throws First error encountered during revocation; other tokens may or may not be revoked
+ */
+export declare function revokeSessionTokens(runtime: Pick<VibesRuntime, 'getBinding'>, tokens: string[]): Promise<void>;
+//# sourceMappingURL=session-revocation.d.ts.map

package/dist/server/session-revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-revocation.d.ts","sourceRoot":"","sources":["../../src/server/session-revocation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAqC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAI3F,OAAO,CAAC,MAAM,CAAC;IACd,UAAU,WAAW;QACpB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;YAAE,aAAa,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACrF;CACD;AAED,kFAAkF;AAClF,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAE9D,0EAA0E;AAC1E,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAK9D;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,6DAExC,CAAC;AACF,eAAO,MAAM,4BAA4B,6DAExC,CAAC;AAIF;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIzE;AAED,sFAAsF;AACtF,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAI5E;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EACzC,QAAQ,EAAE,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAA;CAAE,CAAC,EAChE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1B,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EACzC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1B,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EACzC,MAAM,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/dist/server/session-revocation.js

@@ -0,0 +1,112 @@
+/**
+ * Session Token Revocation
+ *
+ * Revokes session tokens by adding them to the SESSION_BLACKLIST KV namespace.
+ * Paired with the reader in jwt-session-handle.ts that checks before JWT verification.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, valueFreeFailure } from '@vibesdotdev/kernel';
+import { decodeJwt } from 'jose';
+import { attemptSync, rethrowFailure } from "../features/utils/attempt.js";
+const SessionBlacklistReaderMethodsSchema = z.object({ get: z.function() });
+const SessionBlacklistWriterMethodsSchema = z.object({ put: z.function() });
+/**
+ * SESSION_BLACKLIST's owning schemas for `runtime.getBinding`, one per use.
+ * Each admits the native namespace itself, never a copy, so its methods keep
+ * their receiver.
+ */
+export const SessionBlacklistReaderSchema = z.custom((value) => SessionBlacklistReaderMethodsSchema.safeParse(value).success);
+export const SessionBlacklistWriterSchema = z.custom((value) => SessionBlacklistWriterMethodsSchema.safeParse(value).success);
+const MINIMUM_TTL_SECONDS = 60;
+/**
+ * Get the revocation key for a session token.
+ * Shared with the reader in jwt-session-handle.ts.
+ */
+export async function sessionRevocationKey(token) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(token));
+    const fingerprint = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('');
+    return `revoked:sha256:${fingerprint}`;
+}
+/** Preserve existing revocations only when their unchanged key fits Cloudflare KV. */
+export async function sessionRevocationKeys(token) {
+    const key = await sessionRevocationKey(token);
+    const legacyKey = `revoked:${token}`;
+    return new TextEncoder().encode(legacyKey).byteLength <= 512 ? [key, legacyKey] : [key];
+}
+/** Revocation key for a session id (covers every JWT minted for that session). */
+export function sessionIdRevocationKey(sessionId) {
+    return `revoked-session:${sessionId}`;
+}
+/**
+ * Revoke JWTs by session id, with a TTL until each session's expiry.
+ * Fails closed (typed CapabilityError) when SESSION_BLACKLIST is unbound.
+ */
+export async function revokeSessionIds(runtime, sessions, options) {
+    if (sessions.length === 0)
+        return;
+    const kv = runtime.getBinding('SESSION_BLACKLIST', SessionBlacklistWriterSchema);
+    if (!kv) {
+        throw new CapabilityError('Session blacklist KV namespace (SESSION_BLACKLIST) is not bound.', 'UNAVAILABLE', { reason: 'session-blacklist-unavailable' });
+    }
+    const nowMs = options?.nowMs ?? Date.now();
+    for (const { sessionId, expiresAt } of sessions) {
+        const expMs = expiresAt instanceof Date ? expiresAt.getTime() : expiresAt;
+        if (!sessionId || !Number.isFinite(expMs)) {
+            throw new CapabilityError('Session id or expiry is invalid.', 'INVALID_INPUT', {
+                reason: 'session-expiry-missing'
+            });
+        }
+        const expirationTtl = Math.max(MINIMUM_TTL_SECONDS, Math.ceil((expMs - nowMs) / 1000));
+        await kv.put(sessionIdRevocationKey(sessionId), '1', { expirationTtl });
+    }
+}
+/**
+ * Revoke a single session token.
+ *
+ * Decodes the JWT (without verification) to extract the `exp` claim and set
+ * the KV entry's TTL accordingly. Fails closed if the SESSION_BLACKLIST
+ * binding is not available.
+ *
+ * @param runtime - Runtime to resolve the SESSION_BLACKLIST KV namespace
+ * @param token - JWT token to revoke
+ * @param options - Optional configuration (nowMs for testing)
+ * @throws CapabilityError if SESSION_BLACKLIST binding is unavailable or token is invalid
+ */
+export async function revokeSessionToken(runtime, token, options) {
+    const kv = runtime.getBinding('SESSION_BLACKLIST', SessionBlacklistWriterSchema);
+    if (!kv) {
+        throw new CapabilityError('Session blacklist KV namespace (SESSION_BLACKLIST) is not bound.', 'UNAVAILABLE', { reason: 'session-blacklist-unavailable' });
+    }
+    // Decode without verification to get the exp claim. Only jose's invalid-JWT error means
+    // "this is not a decodable token"; any other failure is not that and is thrown.
+    const decoded = attemptSync(() => decodeJwt(token));
+    if (!decoded.ok) {
+        if (valueFreeFailure(decoded.failure).code !== 'ERR_JWT_INVALID')
+            return rethrowFailure(decoded.failure);
+        throw new CapabilityError('Cannot decode token to extract expiration.', 'INVALID_INPUT', { reason: 'token-exp-missing', cause: valueFreeFailure(decoded.failure) });
+    }
+    const exp = z.number().safeParse(decoded.value.exp);
+    if (!exp.success) {
+        throw new CapabilityError('Token does not have an exp claim.', 'INVALID_INPUT', { reason: 'token-exp-missing' });
+    }
+    const nowMs = options?.nowMs ?? Date.now();
+    const expMs = exp.data * 1000;
+    const remainingMs = expMs - nowMs;
+    const expirationTtl = Math.max(MINIMUM_TTL_SECONDS, Math.ceil(remainingMs / 1000));
+    for (const key of await sessionRevocationKeys(token)) {
+        await kv.put(key, '1', { expirationTtl });
+    }
+}
+/**
+ * Revoke multiple session tokens.
+ *
+ * @param runtime - Runtime to resolve the SESSION_BLACKLIST KV namespace
+ * @param tokens - Array of JWT tokens to revoke
+ * @throws First error encountered during revocation; other tokens may or may not be revoked
+ */
+export async function revokeSessionTokens(runtime, tokens) {
+    for (const token of tokens) {
+        await revokeSessionToken(runtime, token);
+    }
+}
+//# sourceMappingURL=session-revocation.js.map

package/dist/server/session-revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-revocation.js","sourceRoot":"","sources":["../../src/server/session-revocation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAqB,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAe3E,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC5E,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CACnD,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CACvE,CAAC;AACF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CACnD,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CACvE,CAAC;AAEF,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAa;IACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9G,OAAO,kBAAkB,WAAW,EAAE,CAAC;AACxC,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACxD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,WAAW,KAAK,EAAE,CAAC;IACrC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACzF,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACvD,OAAO,mBAAmB,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAAyC,EACzC,QAAgE,EAChE,OAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;IACjF,IAAI,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,IAAI,eAAe,CACxB,kEAAkE,EAClE,aAAa,EACb,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAC3C,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3C,KAAK,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,QAAQ,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,eAAe,EAAE;gBAC9E,MAAM,EAAE,wBAAwB;aAChC,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QACvF,MAAM,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACzE,CAAC;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAAyC,EACzC,KAAa,EACb,OAA4B;IAE5B,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC;IACjF,IAAI,CAAC,EAAE,EAAE,CAAC;QACT,MAAM,IAAI,eAAe,CACxB,kEAAkE,EAClE,aAAa,EACb,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAC3C,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,gFAAgF;IAChF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzG,MAAM,IAAI,eAAe,CACxB,4CAA4C,EAC5C,eAAe,EACf,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACzE,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,eAAe,CACxB,mCAAmC,EACnC,eAAe,EACf,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAC/B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC9B,MAAM,WAAW,GAAG,KAAK,GAAG,KAAK,CAAC;IAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC7B,mBAAmB,EACnB,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAC7B,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,MAAM,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3C,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAyC,EACzC,MAAgB;IAEhB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;AACF,CAAC"}

package/dist/server/session-verifier.d.ts

@@ -0,0 +1,69 @@
+import * as z from 'zod/v4';
+import type { JWTPayload } from 'jose';
+import type { JwtSessionFetcher } from '../schemas/session-verification.ts';
+export declare const SESSION_VERIFIER_KIND = "auth/session-verifier";
+export declare const SESSION_VERIFIER_ID = "auth.session-verifier";
+export declare const SessionVerifierDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    priority: z.ZodOptional<z.ZodNumber>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"auth/session-verifier">;
+}, z.core.$strip>;
+export type SessionVerifierDescriptor = z.infer<typeof SessionVerifierDescriptorSchema>;
+export interface SessionJwtVerifier {
+    verify(input: {
+        token: string;
+        authOrigin: string;
+        fetcher: JwtSessionFetcher;
+        jwksFetchTimeoutMs: number;
+        viaServiceBinding?: boolean;
+    }): Promise<JWTPayload>;
+}
+export declare const sessionVerifierKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<SessionJwtVerifier>;
+/** Verified claims only; the credential remains in the request header. */
+export declare const SessionJwtVerificationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"verified">;
+    payload: z.ZodObject<{
+        iss: z.ZodOptional<z.ZodString>;
+        aud: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        exp: z.ZodOptional<z.ZodNumber>;
+        nbf: z.ZodOptional<z.ZodNumber>;
+        iat: z.ZodOptional<z.ZodNumber>;
+        jti: z.ZodOptional<z.ZodString>;
+        email: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        userId: z.ZodOptional<z.ZodString>;
+        org: z.ZodOptional<z.ZodString>;
+        roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        sessionId: z.ZodOptional<z.ZodString>;
+        sub: z.ZodString;
+    }, z.core.$loose>;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"invalid">;
+    reason: z.ZodEnum<{
+        invalid: "invalid";
+        scope: "scope";
+        missing: "missing";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+}, z.core.$strip>], "status">;
+export type SessionJwtVerification = z.infer<typeof SessionJwtVerificationSchema>;
+//# sourceMappingURL=session-verifier.d.ts.map

package/dist/server/session-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-verifier.d.ts","sourceRoot":"","sources":["../../src/server/session-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAC7D,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAC3D,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;iBAA6E,CAAC;AAC1H,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,iBAAiB,CAAC;QAC3B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,iBAAiB,CAAC,EAAE,OAAO,CAAC;KAC5B,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACxB;AAED,eAAO,MAAM,mBAAmB,+EAE9B,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;6BAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/server/session-verifier.js

@@ -0,0 +1,15 @@
+import * as z from 'zod/v4';
+import { createRuntimeKind, RuntimeDescriptorSchema } from '@vibesdotdev/kernel';
+import { vibesJwtPayloadSchema } from "../jwt/index.js";
+export const SESSION_VERIFIER_KIND = 'auth/session-verifier';
+export const SESSION_VERIFIER_ID = 'auth.session-verifier';
+export const SessionVerifierDescriptorSchema = RuntimeDescriptorSchema.extend({ kind: z.literal(SESSION_VERIFIER_KIND) });
+export const sessionVerifierKind = createRuntimeKind({
+    id: SESSION_VERIFIER_KIND, descriptorSchema: SessionVerifierDescriptorSchema
+});
+/** Verified claims only; the credential remains in the request header. */
+export const SessionJwtVerificationSchema = z.discriminatedUnion('status', [
+    z.object({ status: z.literal('verified'), payload: vibesJwtPayloadSchema.extend({ sub: z.string().min(1) }) }),
+    z.object({ status: z.literal('invalid'), reason: z.enum(['missing', 'invalid', 'expired', 'scope', 'revoked']) })
+]);
+//# sourceMappingURL=session-verifier.js.map

package/dist/server/session-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-verifier.js","sourceRoot":"","sources":["../../src/server/session-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAC3D,MAAM,CAAC,MAAM,+BAA+B,GAAG,uBAAuB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;AAa1H,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAgD;IACnG,EAAE,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,+BAA+B;CAC5E,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC1E,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9G,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;CACjH,CAAC,CAAC"}

package/dist/storage/auth-accounts.storage.descriptor.d.ts

@@ -0,0 +1,74 @@
+import { z } from 'zod/v4';
+import type { StorageManifestDescriptor } from '@vibesdotdev/storage/schemas/manifest-descriptor';
+export interface AuthAccountRow {
+    id: string;
+    userId: string;
+    accountId: string;
+    providerId: string;
+    accessToken: string | null;
+    refreshToken: string | null;
+    accessTokenExpiresAt: Date | null;
+    refreshTokenExpiresAt: Date | null;
+    scope: string | null;
+    idToken: string | null;
+    password: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface AuthAccountCreate {
+    id: string;
+    userId: string;
+    accountId: string;
+    providerId: string;
+    accessToken?: string | null;
+    refreshToken?: string | null;
+    accessTokenExpiresAt?: Date | null;
+    refreshTokenExpiresAt?: Date | null;
+    scope?: string | null;
+    idToken?: string | null;
+    password?: string | null;
+    createdAt?: Date;
+    updatedAt?: Date;
+}
+export interface AuthAccountUpdate {
+    accessToken?: string | null;
+    refreshToken?: string | null;
+    accessTokenExpiresAt?: Date | null;
+    refreshTokenExpiresAt?: Date | null;
+    scope?: string | null;
+    idToken?: string | null;
+    updatedAt?: Date;
+}
+export declare const AuthAccountRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodString;
+    accountId: z.ZodString;
+    providerId: z.ZodString;
+    accessToken: z.ZodNullable<z.ZodString>;
+    refreshToken: z.ZodNullable<z.ZodString>;
+    accessTokenExpiresAt: z.ZodNullable<z.ZodDate>;
+    refreshTokenExpiresAt: z.ZodNullable<z.ZodDate>;
+    scope: z.ZodNullable<z.ZodString>;
+    idToken: z.ZodNullable<z.ZodString>;
+    password: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+}, z.core.$strip>;
+export declare const AuthAccountsStateSchema: z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodString;
+    accountId: z.ZodString;
+    providerId: z.ZodString;
+    accessToken: z.ZodNullable<z.ZodString>;
+    refreshToken: z.ZodNullable<z.ZodString>;
+    accessTokenExpiresAt: z.ZodNullable<z.ZodDate>;
+    refreshTokenExpiresAt: z.ZodNullable<z.ZodDate>;
+    scope: z.ZodNullable<z.ZodString>;
+    idToken: z.ZodNullable<z.ZodString>;
+    password: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodDate;
+    updatedAt: z.ZodDate;
+}, z.core.$strip>>;
+declare const descriptor: StorageManifestDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth-accounts.storage.descriptor.d.ts.map

package/dist/storage/auth-accounts.storage.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-accounts.storage.descriptor.d.ts","sourceRoot":"","sources":["../../src/storage/auth-accounts.storage.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kDAAkD,CAAC;AAElG,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,oBAAoB,EAAE,IAAI,GAAG,IAAI,CAAC;IAClC,qBAAqB,EAAE,IAAI,GAAG,IAAI,CAAC;IACnC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oBAAoB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACnC,qBAAqB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oBAAoB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACnC,qBAAqB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;iBAc/B,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;kBAAgC,CAAC;AAErE,QAAA,MAAM,UAAU,EAAE,yBA0BjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/storage/auth-accounts.storage.descriptor.js

@@ -0,0 +1,46 @@
+import { z } from 'zod/v4';
+export const AuthAccountRowSchema = z.object({
+    id: z.string().uuid(),
+    userId: z.string().uuid(),
+    accountId: z.string(),
+    providerId: z.string(),
+    accessToken: z.string().nullable(),
+    refreshToken: z.string().nullable(),
+    accessTokenExpiresAt: z.date().nullable(),
+    refreshTokenExpiresAt: z.date().nullable(),
+    scope: z.string().nullable(),
+    idToken: z.string().nullable(),
+    password: z.string().nullable(),
+    createdAt: z.date(),
+    updatedAt: z.date()
+});
+export const AuthAccountsStateSchema = z.array(AuthAccountRowSchema);
+const descriptor = {
+    id: 'auth.accounts',
+    kind: 'storage/manifest',
+    namespace: 'auth.accounts',
+    name: 'Auth Accounts',
+    description: 'OAuth account linking table (better-auth auth_account)',
+    // Local path is AuthAccountsManifest over AuthAccountRow[] (document array).
+    // HTTP CRUD on auth-web uses vibesCrudCollection for list/create only.
+    schema: AuthAccountsStateSchema,
+    dataType: 'objects',
+    adapterConfig: {
+        'storage.cloud-api': {
+            // Environment apps map key is `auth`, not the repository-collection folder `auth-web`.
+            ownerApp: 'auth',
+            endpoint: '/api/auth/accounts'
+        }
+    },
+    allowedAdapters: ['storage.cloud-api', 'storage.drizzle'],
+    defaultAdapter: 'storage.drizzle',
+    scope: 'global',
+    sensitiveFields: ['accessToken', 'refreshToken', 'idToken', 'password'],
+    version: 1,
+    customTables: false,
+    internal: false,
+    enabled: true,
+    tags: ['auth', 'oauth', 'accounts']
+};
+export default descriptor;
+//# sourceMappingURL=auth-accounts.storage.descriptor.js.map

package/dist/storage/auth-accounts.storage.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-accounts.storage.descriptor.js","sourceRoot":"","sources":["../../src/storage/auth-accounts.storage.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AA6C3B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,oBAAoB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACzC,qBAAqB,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAErE,MAAM,UAAU,GAA8B;IAC7C,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,kBAAkB;IACxB,SAAS,EAAE,eAAe;IAC1B,IAAI,EAAE,eAAe;IACrB,WAAW,EAAE,wDAAwD;IACrE,6EAA6E;IAC7E,uEAAuE;IACvE,MAAM,EAAE,uBAAuB;IAC/B,QAAQ,EAAE,SAAS;IACnB,aAAa,EAAE;QACd,mBAAmB,EAAE;YACpB,uFAAuF;YACvF,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,oBAAoB;SAC9B;KACD;IACD,eAAe,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;IACzD,cAAc,EAAE,iBAAiB;IACjC,KAAK,EAAE,QAAQ;IACf,eAAe,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC;IACvE,OAAO,EAAE,CAAC;IACV,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC;CACnC,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/storage/auth-accounts.storage.manifest.impl.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Auth Accounts Storage Manifest Implementation
+ *
+ * Custom operations for OAuth account linking via StorageManifest.
+ * Uses runtime.query() to resolve the adapter — no direct Drizzle imports.
+ */
+import { StorageManifest } from '@vibesdotdev/storage/manifest/base';
+import type { AuthAccountRow, AuthAccountCreate, AuthAccountUpdate } from './auth-accounts.storage.descriptor.ts';
+export declare class AuthAccountsManifest extends StorageManifest<AuthAccountRow[]> {
+    findByUserId(userId: string): Promise<AuthAccountRow[]>;
+    findByProvider(providerId: string, accountId: string): Promise<AuthAccountRow | undefined>;
+    findByUserAndProvider(userId: string, providerId: string): Promise<AuthAccountRow | undefined>;
+    create(account: AuthAccountCreate): Promise<AuthAccountRow>;
+    updateAccount(id: string, updates: AuthAccountUpdate): Promise<AuthAccountRow>;
+    deleteByUserAndProvider(userId: string, providerId: string): Promise<void>;
+    countByUserId(userId: string): Promise<number>;
+}
+//# sourceMappingURL=auth-accounts.storage.manifest.impl.d.ts.map

package/dist/storage/auth-accounts.storage.manifest.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-accounts.storage.manifest.impl.d.ts","sourceRoot":"","sources":["../../src/storage/auth-accounts.storage.manifest.impl.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAElH,qBAAa,oBAAqB,SAAQ,eAAe,CAAC,cAAc,EAAE,CAAC;IACpE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAKvD,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAO1F,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;IAO9F,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAqB3D,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAkB9E,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAc1E,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAIpD"}