@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/svelte/loaders.js

@@ -0,0 +1,59 @@
+/**
+ * SvelteKit `load` helpers for `@vibesdotdev/auth/svelte`.
+ *
+ * Exported under the `./loaders` subpath so SvelteKit keeps this server-only
+ * code out of the browser bundle (see SURFACE-PACKAGE-CONVENTIONS §2.5 / §2.7).
+ *
+ * Auth data lives in the sibling `apps/auth-web/src/server/` tree (better-auth
+ * session, organization context). Per §2.5.1 we DON'T reach into another
+ * runtime — the consuming app supplies the fetchers, and this loader composes
+ * the layout-shaped result. Mirrors the pattern in `account-svelte`.
+ */
+import * as z from 'zod/v4';
+import { getLogger } from '@vibesdotdev/logging';
+import { attempt, failureLabel, rethrowFailure } from "./outcome.js";
+/** `emailVerified` as the session's loose user carries it: a boolean, or absent. */
+const emailVerifiedSchema = z.boolean().optional().catch(undefined);
+/**
+ * Compose the auth layout payload for a SvelteKit `+layout.server.ts`.
+ *
+ * Returns a serializable object the consuming app spreads into its own
+ * `LayoutServerLoad` return. The client-side `authState` consumes this same
+ * shape via `authState.init({ initialSession })`.
+ *
+ * Usage:
+ *
+ *   import { loadAuthLayoutData } from '@vibesdotdev/auth/svelte/loaders';
+ *
+ *   export const load: LayoutServerLoad = async ({ locals }) => {
+ *     const data = await loadAuthLayoutData({
+ *       runtime: locals.runtime,
+ *       fetchers: {
+ *         getSession: async () => locals.session ?? null
+ *       }
+ *     });
+ *     return data;
+ *   };
+ */
+export async function loadAuthLayoutData(input) {
+    const { fetchers, throwOnError = false } = input;
+    const log = getLogger('auth.svelte.loaders', input.runtime);
+    const resolved = await attempt(() => fetchers.getSession());
+    if (!resolved.ok) {
+        if (throwOnError)
+            rethrowFailure(resolved.failure);
+        // Degrading is the documented default: the layout renders signed out.
+        log.warn('Could not resolve the session for the auth layout; rendering signed out', {
+            failure: failureLabel(resolved.failure)
+        });
+        return { user: null, session: null };
+    }
+    const session = resolved.value;
+    if (!session) {
+        return { user: null, session: null };
+    }
+    const user = session.user
+        ? { ...session.user, emailVerified: emailVerifiedSchema.parse(session.user.emailVerified) }
+        : null;
+    return { user, session };
+}

package/dist/svelte/navigation-effect.d.ts

@@ -0,0 +1,7 @@
+export type AuthNavigate = (href: string) => void;
+/**
+ * Execute the host-owned auth navigation effect when supplied, otherwise use
+ * the browser's full-document navigation. Returns false during SSR.
+ */
+export declare function navigateAuth(navigate: AuthNavigate | undefined, href: string): boolean;
+//# sourceMappingURL=navigation-effect.d.ts.map

package/dist/svelte/navigation-effect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation-effect.d.ts","sourceRoot":"","sources":["../../src/svelte/navigation-effect.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAElD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAStF"}

package/dist/svelte/navigation-effect.js

@@ -0,0 +1,16 @@
+import { browserWindow } from "./browser-window.js";
+/**
+ * Execute the host-owned auth navigation effect when supplied, otherwise use
+ * the browser's full-document navigation. Returns false during SSR.
+ */
+export function navigateAuth(navigate, href) {
+    if (navigate) {
+        navigate(href);
+        return true;
+    }
+    const page = browserWindow();
+    if (!page)
+        return false;
+    page.location.assign(href);
+    return true;
+}

package/dist/svelte/outcome.d.ts

@@ -0,0 +1,24 @@
+/**
+ * One attempt as an outcome, for the Svelte surface. The built package ships
+ * `src/svelte` on its own, so this surface carries the small capture it needs
+ * instead of reaching into the core tree with a relative import.
+ */
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+export type Attempt<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly failure: CaughtFailure;
+};
+/** Run `work`; an async failure is the outcome, never thrown. */
+export declare function attempt<T>(work: () => Promise<T>): Promise<Attempt<T>>;
+/** Run `work`; a synchronous failure is the outcome, never thrown. */
+export declare function attemptSync<T>(work: () => T): Attempt<T>;
+/** Throw a captured failure again: the `Error` itself, or the non-Error value that was thrown. */
+export declare function rethrowFailure(failure: CaughtFailure): never;
+/** The failure named by its value-free facts only (class, code, reason): safe in a log field. */
+export declare function failureLabel(failure: CaughtFailure): string;
+/** The HTTP status an auth call was refused with; 0 for any other failure. */
+export declare function failureStatus(failure: CaughtFailure): number;
+//# sourceMappingURL=outcome.d.ts.map

package/dist/svelte/outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome.d.ts","sourceRoot":"","sources":["../../src/svelte/outcome.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAyC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGhG,MAAM,MAAM,OAAO,CAAC,CAAC,IAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE3D,iEAAiE;AACjE,wBAAsB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAM5E;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAMxD;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,KAAK,CAE5D;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAG3D;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAE5D"}

package/dist/svelte/outcome.js

@@ -0,0 +1,38 @@
+/**
+ * One attempt as an outcome, for the Svelte surface. The built package ships
+ * `src/svelte` on its own, so this surface carries the small capture it needs
+ * instead of reaching into the core tree with a relative import.
+ */
+import { CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { AuthClientError } from '@vibesdotdev/auth/api';
+/** Run `work`; an async failure is the outcome, never thrown. */
+export async function attempt(work) {
+    try {
+        return { ok: true, value: await work() };
+    }
+    catch (error) {
+        return { ok: false, failure: CaughtFailureSchema.parse(error) };
+    }
+}
+/** Run `work`; a synchronous failure is the outcome, never thrown. */
+export function attemptSync(work) {
+    try {
+        return { ok: true, value: work() };
+    }
+    catch (error) {
+        return { ok: false, failure: CaughtFailureSchema.parse(error) };
+    }
+}
+/** Throw a captured failure again: the `Error` itself, or the non-Error value that was thrown. */
+export function rethrowFailure(failure) {
+    throw failure instanceof Error ? failure : failure.value;
+}
+/** The failure named by its value-free facts only (class, code, reason): safe in a log field. */
+export function failureLabel(failure) {
+    const facts = valueFreeFailure(failure);
+    return [facts.name, facts.code, facts.reason].filter((fact) => fact !== undefined).join(' ');
+}
+/** The HTTP status an auth call was refused with; 0 for any other failure. */
+export function failureStatus(failure) {
+    return failure instanceof AuthClientError ? failure.status : 0;
+}

package/dist/svelte/password.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Password-strength heuristics used by `<SignUpForm />`.
+ *
+ * These are PURELY a UX hint — the canonical strength/policy enforcement
+ * happens server-side in better-auth. Do NOT rely on these scores for any
+ * security decision. Mirrors the helpers used by auth-web's `/register`.
+ */
+export type PasswordStrength = 'weak' | 'fair' | 'good' | 'strong' | 'excellent';
+/** Tailwind class used to color the strength meter bar. */
+export type PasswordStrengthClass = string;
+export interface PasswordStrengthResult {
+    /** 0-4 score: length + character-class diversity. */
+    score: number;
+    label: PasswordStrength;
+    /** Tailwind background class to color the meter bar. */
+    colorClass: PasswordStrengthClass;
+    /** 0-100 percentage suitable for a meter `width:` style. */
+    percent: number;
+    hasLength: boolean;
+    hasUppercase: boolean;
+    hasLowercase: boolean;
+    hasDigit: boolean;
+    hasSymbol: boolean;
+}
+/**
+ * Compute a 0-4 strength score for a password.
+ *
+ * +1 length >= 12, +1 uppercase, +1 digit, +1 non-alphanumeric (symbol).
+ * Returns 0 for an empty string. Lowercase is tracked but doesn't add to the
+ * score because nearly every password contains some.
+ */
+export declare function getPasswordScore(value: string): number;
+export declare function getPasswordStrengthLabel(score: number): PasswordStrength;
+export declare function getPasswordStrengthClass(score: number): PasswordStrengthClass;
+/**
+ * Convenience: return the full strength result for a password including
+ * the character-class flags any password-policy UI needs to render.
+ */
+export declare function evaluatePassword(value: string): PasswordStrengthResult;
+//# sourceMappingURL=password.d.ts.map

package/dist/svelte/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/svelte/password.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEjF,2DAA2D;AAC3D,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE3C,MAAM,WAAW,sBAAsB;IACtC,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,gBAAgB,CAAC;IACxB,wDAAwD;IACxD,UAAU,EAAE,qBAAqB,CAAC;IAClC,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQtD;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAMxE;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAK7E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAatE"}

package/dist/svelte/password.js

@@ -0,0 +1,66 @@
+/**
+ * Password-strength heuristics used by `<SignUpForm />`.
+ *
+ * These are PURELY a UX hint — the canonical strength/policy enforcement
+ * happens server-side in better-auth. Do NOT rely on these scores for any
+ * security decision. Mirrors the helpers used by auth-web's `/register`.
+ */
+/**
+ * Compute a 0-4 strength score for a password.
+ *
+ * +1 length >= 12, +1 uppercase, +1 digit, +1 non-alphanumeric (symbol).
+ * Returns 0 for an empty string. Lowercase is tracked but doesn't add to the
+ * score because nearly every password contains some.
+ */
+export function getPasswordScore(value) {
+    if (!value)
+        return 0;
+    let score = 0;
+    if (value.length >= 12)
+        score += 1;
+    if (/[A-Z]/.test(value))
+        score += 1;
+    if (/[0-9]/.test(value))
+        score += 1;
+    if (/[^A-Za-z0-9]/.test(value))
+        score += 1;
+    return score;
+}
+export function getPasswordStrengthLabel(score) {
+    if (score <= 0)
+        return 'weak';
+    if (score === 1)
+        return 'fair';
+    if (score === 2)
+        return 'good';
+    if (score === 3)
+        return 'strong';
+    return 'excellent';
+}
+export function getPasswordStrengthClass(score) {
+    if (score <= 1)
+        return 'bg-destructive/70';
+    if (score === 2)
+        return 'bg-amber-500/80';
+    if (score === 3)
+        return 'bg-emerald-500/80';
+    return 'bg-green-500/90';
+}
+/**
+ * Convenience: return the full strength result for a password including
+ * the character-class flags any password-policy UI needs to render.
+ */
+export function evaluatePassword(value) {
+    const score = getPasswordScore(value);
+    return {
+        score,
+        label: getPasswordStrengthLabel(score),
+        colorClass: getPasswordStrengthClass(score),
+        percent: (score / 4) * 100,
+        hasLength: value.length >= 8,
+        hasUppercase: /[A-Z]/.test(value),
+        hasLowercase: /[a-z]/.test(value),
+        hasDigit: /[0-9]/.test(value),
+        hasSymbol: /[^A-Za-z0-9]/.test(value)
+    };
+}

package/dist/svelte/session-warmup.d.ts

@@ -0,0 +1,6 @@
+/**
+ * A same-origin navigation already carries the freshly written auth cookie.
+ * Warm-up is only useful before handing the session to another origin.
+ */
+export declare function needsSessionWarmup(redirectTo: string | undefined, currentOrigin: string): boolean;
+//# sourceMappingURL=session-warmup.d.ts.map

package/dist/svelte/session-warmup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-warmup.d.ts","sourceRoot":"","sources":["../../src/svelte/session-warmup.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAOjG"}

package/dist/svelte/session-warmup.js

@@ -0,0 +1,12 @@
+/**
+ * A same-origin navigation already carries the freshly written auth cookie.
+ * Warm-up is only useful before handing the session to another origin.
+ */
+export function needsSessionWarmup(redirectTo, currentOrigin) {
+    if (!redirectTo)
+        return false;
+    // A redirect that is not a URL at all (an unusual but accepted scheme) keeps the best-effort
+    // behavior: the warm-up layer already contains its own failure.
+    const target = URL.parse(redirectTo, currentOrigin);
+    return target === null ? true : target.origin !== currentOrigin;
+}

package/dist/svelte/sessions.d.ts

@@ -0,0 +1,18 @@
+import type { AuthUserSession } from '@vibesdotdev/auth/api';
+/**
+ * The subset of a session the panel needs to render/split. `token`/`userId` are
+ * optional so account-web can pass a token-stripped list (tokens stay server
+ * side, resolved by id during revocation) while other hosts can still pass the
+ * full {@link AuthUserSession} for the in-panel revoke fallback.
+ */
+export type AuthSessionView = Omit<AuthUserSession, 'token' | 'userId'> & Partial<Pick<AuthUserSession, 'token' | 'userId'>>;
+export interface AuthSessionGroups {
+    currentSession: AuthSessionView | null;
+    otherSessions: AuthSessionView[];
+}
+export declare function findSessionToken(sessions: AuthSessionView[], sessionId: string): string | null;
+export declare function splitAuthSessions(sessions: AuthSessionView[], currentSessionId: string | null | undefined): AuthSessionGroups;
+export declare function getAuthSessionDeviceIcon(userAgent: string | null | undefined): string;
+export declare function getAuthSessionBrowserName(userAgent: string | null | undefined): string;
+export declare function formatAuthSessionLastActive(date: string | Date | null | undefined): string;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/svelte/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/svelte/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,GACtE,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IACjC,cAAc,EAAE,eAAe,GAAG,IAAI,CAAC;IACvC,aAAa,EAAE,eAAe,EAAE,CAAC;CACjC;AAED,wBAAgB,gBAAgB,CAC/B,QAAQ,EAAE,eAAe,EAAE,EAC3B,SAAS,EAAE,MAAM,GACf,MAAM,GAAG,IAAI,CAEf;AAED,wBAAgB,iBAAiB,CAChC,QAAQ,EAAE,eAAe,EAAE,EAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACzC,iBAAiB,CAUnB;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAYrF;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAStF;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAkB1F"}

package/dist/svelte/sessions.js

@@ -0,0 +1,56 @@
+export function findSessionToken(sessions, sessionId) {
+    return sessions.find((session) => session.id === sessionId)?.token ?? null;
+}
+export function splitAuthSessions(sessions, currentSessionId) {
+    const currentSession = currentSessionId
+        ? (sessions.find((session) => session.id === currentSessionId) ?? null)
+        : null;
+    return {
+        currentSession,
+        otherSessions: currentSessionId
+            ? sessions.filter((session) => session.id !== currentSessionId)
+            : sessions
+    };
+}
+export function getAuthSessionDeviceIcon(userAgent) {
+    const normalizedUserAgent = (userAgent ?? '').toLowerCase();
+    if (normalizedUserAgent.includes('mobile') ||
+        normalizedUserAgent.includes('android') ||
+        normalizedUserAgent.includes('iphone')) {
+        return 'lucide:smartphone';
+    }
+    return 'lucide:monitor';
+}
+export function getAuthSessionBrowserName(userAgent) {
+    const normalizedUserAgent = (userAgent ?? '').toLowerCase();
+    if (normalizedUserAgent.includes('edg/'))
+        return 'Edge';
+    if (normalizedUserAgent.includes('firefox'))
+        return 'Firefox';
+    if (normalizedUserAgent.includes('chrome'))
+        return 'Chrome';
+    if (normalizedUserAgent.includes('safari'))
+        return 'Safari';
+    return 'Unknown Browser';
+}
+export function formatAuthSessionLastActive(date) {
+    if (!date)
+        return 'Never';
+    const targetDate = new Date(date);
+    if (Number.isNaN(targetDate.getTime()))
+        return 'Never';
+    const now = new Date();
+    const diffMs = now.getTime() - targetDate.getTime();
+    const diffMins = Math.floor(diffMs / 60000);
+    const diffHours = Math.floor(diffMs / 3600000);
+    const diffDays = Math.floor(diffMs / 86400000);
+    if (diffMins < 1)
+        return 'Just now';
+    if (diffMins < 60)
+        return `${diffMins} minute${diffMins === 1 ? '' : 's'} ago`;
+    if (diffHours < 24)
+        return `${diffHours} hour${diffHours === 1 ? '' : 's'} ago`;
+    if (diffDays < 7)
+        return `${diffDays} day${diffDays === 1 ? '' : 's'} ago`;
+    return targetDate.toLocaleDateString();
+}

package/dist/svelte/state.svelte.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Module-scoped reactive auth session store. Populated by `<SessionWatcher />`.
+ *
+ * Mirrors the `notificationsState` pattern from notifications-svelte so consumers
+ * can read `authState.session?.user` anywhere in the component tree.
+ */
+import type { AuthSession, AuthApiClient } from '@vibesdotdev/auth/api';
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+interface AuthState {
+    initialized: boolean;
+    loading: boolean;
+    error: string | null;
+    session: AuthSession | null;
+    readonly isAuthenticated: boolean;
+    readonly msUntilExpiry: number | null;
+    refresh(runtime: RuntimeRef, client?: AuthApiClient): Promise<AuthSession>;
+}
+export declare const authState: AuthState;
+export {};
+//# sourceMappingURL=state.svelte.d.ts.map

package/dist/svelte/state.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.svelte.d.ts","sourceRoot":"","sources":["../../src/svelte/state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,UAAU,SAAS;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC3E;AAED,eAAO,MAAM,SAAS,WAiCpB,CAAC"}

package/dist/svelte/state.svelte.js

@@ -0,0 +1,45 @@
+/**
+ * Module-scoped reactive auth session store. Populated by `<SessionWatcher />`.
+ *
+ * Mirrors the `notificationsState` pattern from notifications-svelte so consumers
+ * can read `authState.session?.user` anywhere in the component tree.
+ */
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+export const authState = $state({
+    initialized: false,
+    loading: false,
+    error: null,
+    session: null,
+    get isAuthenticated() {
+        return Boolean(this.session?.user && this.session.session);
+    },
+    get msUntilExpiry() {
+        const expiresAt = this.session?.session?.expiresAt;
+        if (!expiresAt)
+            return null;
+        const expires = expiresAt instanceof Date ? expiresAt : new Date(expiresAt);
+        const timestamp = expires.getTime();
+        if (!Number.isFinite(timestamp))
+            return null;
+        return Math.max(0, timestamp - Date.now());
+    },
+    async refresh(runtime, client) {
+        this.loading = true;
+        try {
+            const authClient = client ?? (await getVibesClient('auth', runtime));
+            await authClient.ensureLoaded();
+            const session = await authClient.getSession();
+            this.session = session;
+            this.initialized = true;
+            this.error = null;
+            return session;
+        }
+        catch (err) {
+            this.error = err instanceof Error ? err.message : String(err);
+            throw err;
+        }
+        finally {
+            this.loading = false;
+        }
+    }
+});

package/dist/svelte/styles.css

@@ -0,0 +1,10 @@
+/*
+ * Tailwind v4 source declaration for consumers — mirrors @vibesdotdev/kit's
+ * styles.css pattern. Apps that @import this file get this package's
+ * components scanned by their Tailwind build, so utility classes used only
+ * inside these components are emitted in the app's CSS bundle. Without it,
+ * such classes are missing per-app by lottery (Tailwind never scans
+ * node_modules). Paths resolve relative to this file: dist/styles.css at
+ * runtime, src/styles.css under the bun condition.
+ */
+@source "./";

package/dist/svelte/types.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Shared types for `<SignInForm>` / `<SignUpForm>` props.
+ *
+ * Kept in a dedicated module because Svelte 5 doesn't surface types declared
+ * inside `<script lang="ts">` to TypeScript consumers; you can only import a
+ * .svelte file's *default* component export. Anything callers need to type
+ * their props lives here.
+ */
+import type { AuthSession } from '@vibesdotdev/auth/api';
+/** Banner kinds rendered at the top of `<SignInForm>`. */
+export type SignInNoticeKind = 'magic-link-sent' | 'registered' | 'unverified';
+export interface SignInNotice {
+    kind: SignInNoticeKind;
+    message?: string;
+}
+/**
+ * A single policy the user must (or may) accept to register. The id +
+ * version pair becomes one entry in the `policyAcceptances` array.
+ * Mirror the policy registry the canonical flow uses (e.g.
+ * `apps/auth-web/src/lib/server/policies/versions.ts`).
+ */
+export interface PolicyDefinition {
+    id: string;
+    label: string;
+    href: string;
+    required: boolean;
+    version: string;
+}
+export interface PolicyAcceptance {
+    policyId: string;
+    version: string;
+}
+export interface SignUpSuccessDetail {
+    session: AuthSession;
+    policyAcceptances: PolicyAcceptance[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/svelte/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/svelte/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,0DAA0D;AAC1D,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,YAAY,GAAG,YAAY,CAAC;AAE/E,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,WAAW,CAAC;IACrB,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;CACtC"}

package/dist/svelte/types.js

@@ -0,0 +1,9 @@
+/**
+ * Shared types for `<SignInForm>` / `<SignUpForm>` props.
+ *
+ * Kept in a dedicated module because Svelte 5 doesn't surface types declared
+ * inside `<script lang="ts">` to TypeScript consumers; you can only import a
+ * .svelte file's *default* component export. Anything callers need to type
+ * their props lives here.
+ */
+export {};

package/dist/system/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/system/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/system/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC"}

package/dist/system/index.js

@@ -0,0 +1,4 @@
+// @vibesdotdev/auth/system — internal-only server primitives for cross-vibes-app auth integration.
+// Explicit subpath exports only. No DB, no Drizzle, no browser-safe code expected here.
+export {};
+//# sourceMappingURL=index.js.map

package/dist/system/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/system/index.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,wFAAwF;AACxF,OAAO,EAAE,CAAC"}

package/dist/system/internal-api/client.d.ts

@@ -0,0 +1,34 @@
+import type * as z from 'zod/v4';
+import { userOAuthAccountSelectionSchema, type PermissionsCheckRequest, type UserOAuthAccount, type UserOAuthAccountDetail, type UserOAuthAccountUnlinkResponse, type UserPromoteStaffResponse, type UserSlugRequest } from './schemas.ts';
+export interface AuthInternalClientConfig {
+    /** A function resolves request-bound service routing after host initialization. */
+    baseUrl: string | (() => string);
+    /**
+     * Internal-service bearer token. Pass a FUNCTION for lazy per-request
+     * resolution — required on workerd, where secrets bind via `getRuntimeEnv`
+     * (request-scoped AsyncLocalStorage). An eagerly-read string token can be
+     * EMPTY when the client is constructed at isolate bootstrap (outside any
+     * request) — e.g. a runtime-context provider built during plugin registration —
+     * and would then send `Bearer ` forever for that isolate. A function is
+     * re-evaluated on every call, so the token is always read inside the request.
+     * The function may be async, so a runtime-resolved credential
+     * (`runtime.resolveCredential`) can be returned directly.
+     */
+    token: string | (() => string | undefined | Promise<string | undefined>);
+    fetch?: typeof fetch;
+    timeout?: number;
+}
+export interface AuthInternalClient {
+    checkPermission(input: PermissionsCheckRequest): Promise<boolean>;
+    isSuperuser(userId: string): Promise<boolean>;
+    isStaff(userId: string): Promise<boolean>;
+    isOrgAdmin(userId: string, organizationId: string): Promise<boolean>;
+    isTeamAdmin(userId: string, teamId: string): Promise<boolean>;
+    listOAuthAccounts(userId: string): Promise<UserOAuthAccount[]>;
+    getOAuthAccount(userId: string, providerId: string, selection?: z.input<typeof userOAuthAccountSelectionSchema>): Promise<UserOAuthAccountDetail | null>;
+    unlinkOAuthAccount(userId: string, providerId: string): Promise<UserOAuthAccountUnlinkResponse>;
+    ensureUserSlug(userId: string, input?: UserSlugRequest): Promise<string>;
+    promoteStaff(email: string): Promise<UserPromoteStaffResponse>;
+}
+export declare function createAuthInternalClient(config: AuthInternalClientConfig): AuthInternalClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/system/internal-api/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,CAAC;AAIjC,OAAO,EAYN,+BAA+B,EAO/B,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,wBAAwB;IACxC,mFAAmF;IACnF,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACjC;;;;;;;;;;OAUG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACzE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACzJ,kBAAkB,CACjB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC3C,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC/D;AAiCD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,GAAG,kBAAkB,CAoG7F"}