@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/system/internal-api/client.js

@@ -0,0 +1,117 @@
+import { vibesApiClient } from '@vibesdotdev/client';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { authInternalEndpoints } from "./endpoints.js";
+import { permissionsCheckRequestSchema, permissionsCheckResponseSchema, permissionsIsSuperuserRequestSchema, permissionsIsSuperuserResponseSchema, permissionsIsStaffRequestSchema, permissionsIsStaffResponseSchema, permissionsIsOrgAdminRequestSchema, permissionsIsOrgAdminResponseSchema, permissionsIsTeamAdminRequestSchema, permissionsIsTeamAdminResponseSchema, userOAuthAccountDetailResponseSchema, userOAuthAccountSelectionSchema, userOAuthAccountsResponseSchema, userOAuthAccountUnlinkResponseSchema, userPromoteStaffRequestSchema, userPromoteStaffResponseSchema, userSlugRequestSchema, userSlugResponseSchema } from "./schemas.js";
+/** A request this client refuses to send: the caller's input fails the endpoint's request schema. */
+function parseRequest(schema, input) {
+    const parsed = schema.safeParse(input);
+    if (!parsed.success) {
+        throw new CapabilityError('The auth internal request is not valid.', 'INVALID_INPUT', {
+            reason: 'auth-internal-request-invalid',
+            retryable: false,
+            cause: parsed.error
+        });
+    }
+    return parsed.data;
+}
+/** The auth service's answer, read through the endpoint's response schema; the body is never copied into the refusal. */
+function parseResponse(schema, response) {
+    const parsed = schema.safeParse(response);
+    if (!parsed.success) {
+        throw new CapabilityError('The auth internal service answered with a response this client does not accept.', 'INTERNAL', {
+            reason: 'auth-internal-response-invalid',
+            retryable: false,
+            cause: parsed.error
+        });
+    }
+    return parsed.data;
+}
+/** A value, or a function that answers it: read at call time. */
+function valueOf(source) {
+    return source instanceof Function ? source() : source;
+}
+export function createAuthInternalClient(config) {
+    const getApi = () => {
+        const apiConfig = {
+            id: 'auth-internal',
+            baseUrl: valueOf(config.baseUrl),
+            fetch: config.fetch,
+            timeout: config.timeout
+        };
+        return vibesApiClient(apiConfig);
+    };
+    // Resolve the bearer token PER REQUEST (not baked at construction): on workerd
+    // the token binds via getRuntimeEnv only inside a request, so a client built at
+    // isolate bootstrap would otherwise send an empty `Bearer ` forever.
+    const authHeaders = async () => {
+        const token = await valueOf(config.token);
+        return token ? { Authorization: `Bearer ${token}` } : {};
+    };
+    return {
+        async checkPermission(input) {
+            const body = parseRequest(permissionsCheckRequestSchema, input);
+            const response = await getApi().post(authInternalEndpoints.permissionsCheck, body, {
+                headers: await authHeaders()
+            });
+            return parseResponse(permissionsCheckResponseSchema, response).allowed;
+        },
+        async isSuperuser(userId) {
+            const body = parseRequest(permissionsIsSuperuserRequestSchema, { userId });
+            const response = await getApi().post(authInternalEndpoints.permissionsIsSuperuser, body, {
+                headers: await authHeaders()
+            });
+            return parseResponse(permissionsIsSuperuserResponseSchema, response).isSuperuser;
+        },
+        async isStaff(userId) {
+            const body = parseRequest(permissionsIsStaffRequestSchema, { userId });
+            const response = await getApi().post(authInternalEndpoints.permissionsIsStaff, body, {
+                headers: await authHeaders()
+            });
+            return parseResponse(permissionsIsStaffResponseSchema, response).isStaff;
+        },
+        async isOrgAdmin(userId, organizationId) {
+            const body = parseRequest(permissionsIsOrgAdminRequestSchema, { userId, organizationId });
+            const response = await getApi().post(authInternalEndpoints.permissionsIsOrgAdmin, body, {
+                headers: await authHeaders()
+            });
+            return parseResponse(permissionsIsOrgAdminResponseSchema, response).isOrgAdmin;
+        },
+        async isTeamAdmin(userId, teamId) {
+            const body = parseRequest(permissionsIsTeamAdminRequestSchema, { userId, teamId });
+            const response = await getApi().post(authInternalEndpoints.permissionsIsTeamAdmin, body, {
+                headers: await authHeaders()
+            });
+            return parseResponse(permissionsIsTeamAdminResponseSchema, response).isTeamAdmin;
+        },
+        async listOAuthAccounts(userId) {
+            const response = await getApi().get(authInternalEndpoints.userOAuthAccounts(userId), {
+                headers: await authHeaders()
+            });
+            return parseResponse(userOAuthAccountsResponseSchema, response).accounts;
+        },
+        async getOAuthAccount(userId, providerId, selection) {
+            const query = selection === undefined ? undefined : parseRequest(userOAuthAccountSelectionSchema, selection);
+            const response = await getApi().get(authInternalEndpoints.userOAuthAccount(userId, providerId), { headers: await authHeaders(), query });
+            return parseResponse(userOAuthAccountDetailResponseSchema, response).account;
+        },
+        async unlinkOAuthAccount(userId, providerId) {
+            const response = await getApi().delete(authInternalEndpoints.userOAuthAccountUnlink(userId, providerId), { headers: await authHeaders() });
+            return parseResponse(userOAuthAccountUnlinkResponseSchema, response);
+        },
+        async ensureUserSlug(userId, input = {}) {
+            const body = parseRequest(userSlugRequestSchema, input);
+            const response = await getApi().post(authInternalEndpoints.userSlug(userId), body, {
+                headers: await authHeaders()
+            });
+            return parseResponse(userSlugResponseSchema, response).slug;
+        },
+        async promoteStaff(email) {
+            const body = parseRequest(userPromoteStaffRequestSchema, { email });
+            const response = await getApi().post(authInternalEndpoints.userPromoteStaff, body, {
+                headers: await authHeaders()
+            });
+            return parseResponse(userPromoteStaffResponseSchema, response);
+        }
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/system/internal-api/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/system/internal-api/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAwB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,gCAAgC,EAChC,kCAAkC,EAClC,mCAAmC,EACnC,mCAAmC,EACnC,oCAAoC,EACpC,oCAAoC,EACpC,+BAA+B,EAC/B,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,EAOtB,MAAM,cAAc,CAAC;AAqCtB,qGAAqG;AACrG,SAAS,YAAY,CAAsB,MAAS,EAAE,KAAiB;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,yCAAyC,EAAE,eAAe,EAAE;YACrF,MAAM,EAAE,+BAA+B;YACvC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,yHAAyH;AACzH,SAAS,aAAa,CAAsB,MAAS,EAAE,QAAiB;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,iFAAiF,EAAE,UAAU,EAAE;YACxH,MAAM,EAAE,gCAAgC;YACxC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,iEAAiE;AACjE,SAAS,OAAO,CAAI,MAAqB;IACxC,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAgC;IACxE,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,MAAM,SAAS,GAAoB;YAClC,EAAE,EAAE,eAAe;YACnB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACvB,CAAC;QACF,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,+EAA+E;IAC/E,gFAAgF;IAChF,qEAAqE;IACrE,MAAM,WAAW,GAAG,KAAK,IAAqC,EAAE;QAC/D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC,CAAC;IAEF,OAAO;QACN,KAAK,CAAC,eAAe,CAAC,KAAK;YAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE;gBAClF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,IAAI,EAAE;gBACxF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC;QAClF,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM;YACnB,MAAM,IAAI,GAAG,YAAY,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,IAAI,EAAE;gBACpF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,gCAAgC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC1E,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc;YACtC,MAAM,IAAI,GAAG,YAAY,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,qBAAqB,EAAE,IAAI,EAAE;gBACvF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC;QAChF,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM;YAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,IAAI,EAAE;gBACxF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC;QAClF,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM;YAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;gBACpF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC;QAC1E,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS;YAClD,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;YAC7G,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAClC,qBAAqB,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,EAC1D,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,KAAK,EAAE,CACvC,CAAC;YACF,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC9E,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,MAAM,EAAE,UAAU;YAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,MAAM,CACrC,qBAAqB,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,EAChE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAChC,CAAC;YACF,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE;YACtC,MAAM,IAAI,GAAG,YAAY,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBAClF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,KAAK;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE;gBAClF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/system/internal-api/endpoints.d.ts

@@ -0,0 +1,15 @@
+export declare const AUTH_INTERNAL_BASE_PATH = "/api/internal";
+export declare const authInternalEndpoints: {
+    readonly permissionsCheck: "/api/internal/permissions/check";
+    readonly permissionsIsSuperuser: "/api/internal/permissions/is-superuser";
+    readonly permissionsIsStaff: "/api/internal/permissions/is-staff";
+    readonly permissionsIsOrgAdmin: "/api/internal/permissions/is-org-admin";
+    readonly permissionsIsTeamAdmin: "/api/internal/permissions/is-team-admin";
+    readonly userOAuthAccounts: (userId: string) => string;
+    readonly userOAuthAccount: (userId: string, providerId: string) => string;
+    readonly userOAuthAccountUnlink: (userId: string, providerId: string) => string;
+    readonly userSlug: (userId: string) => string;
+    readonly userPromoteStaff: "/api/internal/users/promote-staff";
+    readonly registeredAppsResolve: "/api/internal/registered-apps/resolve";
+};
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/system/internal-api/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/endpoints.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAEvD,eAAO,MAAM,qBAAqB;;;;;;yCAML,MAAM;wCAEP,MAAM,cAAc,MAAM;8CAEpB,MAAM,cAAc,MAAM;gCAExC,MAAM;;;CAIhB,CAAC"}

package/dist/system/internal-api/endpoints.js

@@ -0,0 +1,15 @@
+export const AUTH_INTERNAL_BASE_PATH = '/api/internal';
+export const authInternalEndpoints = {
+    permissionsCheck: `${AUTH_INTERNAL_BASE_PATH}/permissions/check`,
+    permissionsIsSuperuser: `${AUTH_INTERNAL_BASE_PATH}/permissions/is-superuser`,
+    permissionsIsStaff: `${AUTH_INTERNAL_BASE_PATH}/permissions/is-staff`,
+    permissionsIsOrgAdmin: `${AUTH_INTERNAL_BASE_PATH}/permissions/is-org-admin`,
+    permissionsIsTeamAdmin: `${AUTH_INTERNAL_BASE_PATH}/permissions/is-team-admin`,
+    userOAuthAccounts: (userId) => `${AUTH_INTERNAL_BASE_PATH}/users/${encodeURIComponent(userId)}/oauth-accounts`,
+    userOAuthAccount: (userId, providerId) => `${AUTH_INTERNAL_BASE_PATH}/users/${encodeURIComponent(userId)}/oauth-accounts/${encodeURIComponent(providerId)}`,
+    userOAuthAccountUnlink: (userId, providerId) => `${AUTH_INTERNAL_BASE_PATH}/users/${encodeURIComponent(userId)}/oauth-accounts/${encodeURIComponent(providerId)}`,
+    userSlug: (userId) => `${AUTH_INTERNAL_BASE_PATH}/users/${encodeURIComponent(userId)}/slug`,
+    userPromoteStaff: `${AUTH_INTERNAL_BASE_PATH}/users/promote-staff`,
+    registeredAppsResolve: `${AUTH_INTERNAL_BASE_PATH}/registered-apps/resolve`
+};
+//# sourceMappingURL=endpoints.js.map

package/dist/system/internal-api/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../../src/system/internal-api/endpoints.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEvD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,gBAAgB,EAAE,GAAG,uBAAuB,oBAAoB;IAChE,sBAAsB,EAAE,GAAG,uBAAuB,2BAA2B;IAC7E,kBAAkB,EAAE,GAAG,uBAAuB,uBAAuB;IACrE,qBAAqB,EAAE,GAAG,uBAAuB,2BAA2B;IAC5E,sBAAsB,EAAE,GAAG,uBAAuB,4BAA4B;IAC9E,iBAAiB,EAAE,CAAC,MAAc,EAAE,EAAE,CACrC,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,iBAAiB;IAChF,gBAAgB,EAAE,CAAC,MAAc,EAAE,UAAkB,EAAE,EAAE,CACxD,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,kBAAkB,CAAC,UAAU,CAAC,EAAE;IAClH,sBAAsB,EAAE,CAAC,MAAc,EAAE,UAAkB,EAAE,EAAE,CAC9D,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,kBAAkB,CAAC,UAAU,CAAC,EAAE;IAClH,QAAQ,EAAE,CAAC,MAAc,EAAE,EAAE,CAC5B,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,OAAO;IACtE,gBAAgB,EAAE,GAAG,uBAAuB,sBAAsB;IAClE,qBAAqB,EAAE,GAAG,uBAAuB,0BAA0B;CAClE,CAAC"}

package/dist/system/internal-api/index.d.ts

@@ -0,0 +1,5 @@
+export { createAuthInternalClient, type AuthInternalClient, type AuthInternalClientConfig } from './client.ts';
+export { authInternalEndpoints, AUTH_INTERNAL_BASE_PATH } from './endpoints.ts';
+export { permissionsCheckRequestSchema, permissionsCheckResponseSchema, permissionsIsSuperuserRequestSchema, permissionsIsSuperuserResponseSchema, permissionsIsStaffRequestSchema, permissionsIsStaffResponseSchema, userPromoteStaffRequestSchema, userPromoteStaffResponseSchema, permissionsIsOrgAdminRequestSchema, permissionsIsOrgAdminResponseSchema, permissionsIsTeamAdminRequestSchema, permissionsIsTeamAdminResponseSchema, userOAuthAccountSchema, userOAuthAccountsResponseSchema, userOAuthAccountDetailSchema, userOAuthAccountSelectionSchema, userOAuthAccountDetailResponseSchema, userOAuthAccountUnlinkResponseSchema, userSlugRequestSchema, userSlugResponseSchema, testPersonaSlugSchema, testMintSessionRequestSchema, testMintSessionCookieSchema, testMintSessionResponseSchema } from './schemas.ts';
+export type { PermissionsCheckRequest, PermissionsCheckResponse, PermissionsIsSuperuserRequest, PermissionsIsSuperuserResponse, PermissionsIsStaffRequest, PermissionsIsStaffResponse, UserPromoteStaffRequest, UserPromoteStaffResponse, PermissionsIsOrgAdminRequest, PermissionsIsOrgAdminResponse, PermissionsIsTeamAdminRequest, PermissionsIsTeamAdminResponse, UserOAuthAccount, UserOAuthAccountsResponse, UserOAuthAccountDetail, UserOAuthAccountDetailResponse, UserOAuthAccountUnlinkResponse, UserSlugRequest, UserSlugResponse, TestPersonaSlug, TestMintSessionRequest, TestMintSessionCookie, TestMintSessionResponse } from './schemas.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/system/internal-api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,gCAAgC,EAChC,6BAA6B,EAC7B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,mCAAmC,EACnC,oCAAoC,EACpC,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,oCAAoC,EACpC,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,MAAM,cAAc,CAAC;AACtB,YAAY,EACX,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,MAAM,cAAc,CAAC"}

package/dist/system/internal-api/index.js

@@ -0,0 +1,4 @@
+export { createAuthInternalClient } from "./client.js";
+export { authInternalEndpoints, AUTH_INTERNAL_BASE_PATH } from "./endpoints.js";
+export { permissionsCheckRequestSchema, permissionsCheckResponseSchema, permissionsIsSuperuserRequestSchema, permissionsIsSuperuserResponseSchema, permissionsIsStaffRequestSchema, permissionsIsStaffResponseSchema, userPromoteStaffRequestSchema, userPromoteStaffResponseSchema, permissionsIsOrgAdminRequestSchema, permissionsIsOrgAdminResponseSchema, permissionsIsTeamAdminRequestSchema, permissionsIsTeamAdminResponseSchema, userOAuthAccountSchema, userOAuthAccountsResponseSchema, userOAuthAccountDetailSchema, userOAuthAccountSelectionSchema, userOAuthAccountDetailResponseSchema, userOAuthAccountUnlinkResponseSchema, userSlugRequestSchema, userSlugResponseSchema, testPersonaSlugSchema, testMintSessionRequestSchema, testMintSessionCookieSchema, testMintSessionResponseSchema } from "./schemas.js";
+//# sourceMappingURL=index.js.map

package/dist/system/internal-api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/system/internal-api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,wBAAwB,EAGxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,gCAAgC,EAChC,6BAA6B,EAC7B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,mCAAmC,EACnC,oCAAoC,EACpC,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,oCAAoC,EACpC,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,MAAM,cAAc,CAAC"}

package/dist/system/internal-api/schemas.d.ts

@@ -0,0 +1,188 @@
+import * as z from 'zod/v4';
+export declare const permissionsCheckRequestSchema: z.ZodObject<{
+    userId: z.ZodString;
+    resource: z.ZodString;
+    action: z.ZodString;
+    organizationId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    resourceId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const permissionsCheckResponseSchema: z.ZodObject<{
+    allowed: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const permissionsIsSuperuserRequestSchema: z.ZodObject<{
+    userId: z.ZodString;
+}, z.core.$strip>;
+export declare const permissionsIsSuperuserResponseSchema: z.ZodObject<{
+    isSuperuser: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const permissionsIsStaffRequestSchema: z.ZodObject<{
+    userId: z.ZodString;
+}, z.core.$strip>;
+export declare const permissionsIsStaffResponseSchema: z.ZodObject<{
+    isStaff: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const userPromoteStaffRequestSchema: z.ZodObject<{
+    email: z.ZodString;
+}, z.core.$strip>;
+export declare const userPromoteStaffResponseSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    status: z.ZodEnum<{
+        missing: "missing";
+        unchanged: "unchanged";
+        updated: "updated";
+    }>;
+    user: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        isSuperuser: z.ZodBoolean;
+        staff: z.ZodBoolean;
+        name: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const permissionsIsOrgAdminRequestSchema: z.ZodObject<{
+    userId: z.ZodString;
+    organizationId: z.ZodString;
+}, z.core.$strip>;
+export declare const permissionsIsOrgAdminResponseSchema: z.ZodObject<{
+    isOrgAdmin: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const permissionsIsTeamAdminRequestSchema: z.ZodObject<{
+    userId: z.ZodString;
+    teamId: z.ZodString;
+}, z.core.$strip>;
+export declare const permissionsIsTeamAdminResponseSchema: z.ZodObject<{
+    isTeamAdmin: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const userOAuthAccountSchema: z.ZodObject<{
+    providerId: z.ZodString;
+    accountId: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodNullable<z.ZodString>;
+    accessTokenExpiresAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const userOAuthAccountsResponseSchema: z.ZodObject<{
+    accounts: z.ZodArray<z.ZodObject<{
+        providerId: z.ZodString;
+        accountId: z.ZodOptional<z.ZodString>;
+        accessToken: z.ZodNullable<z.ZodString>;
+        accessTokenExpiresAt: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const userOAuthAccountSelectionSchema: z.ZodObject<{
+    accountId: z.ZodString;
+}, z.core.$strict>;
+export declare const userOAuthAccountDetailSchema: z.ZodObject<{
+    providerId: z.ZodString;
+    accountId: z.ZodOptional<z.ZodString>;
+    accessToken: z.ZodNullable<z.ZodString>;
+    refreshToken: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    refreshTokenExpiresAt: z.ZodNullable<z.ZodString>;
+    scope: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const userOAuthAccountDetailResponseSchema: z.ZodObject<{
+    account: z.ZodNullable<z.ZodObject<{
+        providerId: z.ZodString;
+        accountId: z.ZodOptional<z.ZodString>;
+        accessToken: z.ZodNullable<z.ZodString>;
+        refreshToken: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        refreshTokenExpiresAt: z.ZodNullable<z.ZodString>;
+        scope: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const userOAuthAccountUnlinkResponseSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    deleted: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const userSlugRequestSchema: z.ZodObject<{
+    preferredSlug: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const userSlugResponseSchema: z.ZodObject<{
+    slug: z.ZodString;
+}, z.core.$strip>;
+export declare const testPersonaSlugSchema: z.ZodEnum<{
+    free: "free";
+    plus: "plus";
+    pro: "pro";
+    ultra: "ultra";
+    admin: "admin";
+    "org-owner": "org-owner";
+    "org-admin": "org-admin";
+    "org-member": "org-member";
+    "org-viewer": "org-viewer";
+}>;
+export declare const testMintSessionRequestSchema: z.ZodUnion<readonly [z.ZodObject<{
+    persona: z.ZodEnum<{
+        free: "free";
+        plus: "plus";
+        pro: "pro";
+        ultra: "ultra";
+        admin: "admin";
+        "org-owner": "org-owner";
+        "org-admin": "org-admin";
+        "org-member": "org-member";
+        "org-viewer": "org-viewer";
+    }>;
+}, z.core.$strict>, z.ZodObject<{
+    email: z.ZodString;
+}, z.core.$strict>]>;
+export declare const testMintSessionCookieSchema: z.ZodObject<{
+    name: z.ZodString;
+    value: z.ZodString;
+    domain: z.ZodString;
+    path: z.ZodString;
+    expires: z.ZodNumber;
+    httpOnly: z.ZodBoolean;
+    secure: z.ZodBoolean;
+    sameSite: z.ZodEnum<{
+        Strict: "Strict";
+        Lax: "Lax";
+        None: "None";
+    }>;
+}, z.core.$strip>;
+export declare const testMintSessionResponseSchema: z.ZodObject<{
+    cookie: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+        domain: z.ZodString;
+        path: z.ZodString;
+        expires: z.ZodNumber;
+        httpOnly: z.ZodBoolean;
+        secure: z.ZodBoolean;
+        sameSite: z.ZodEnum<{
+            Strict: "Strict";
+            Lax: "Lax";
+            None: "None";
+        }>;
+    }, z.core.$strip>;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type PermissionsCheckRequest = z.infer<typeof permissionsCheckRequestSchema>;
+export type PermissionsCheckResponse = z.infer<typeof permissionsCheckResponseSchema>;
+export type PermissionsIsSuperuserRequest = z.infer<typeof permissionsIsSuperuserRequestSchema>;
+export type PermissionsIsSuperuserResponse = z.infer<typeof permissionsIsSuperuserResponseSchema>;
+export type PermissionsIsStaffRequest = z.infer<typeof permissionsIsStaffRequestSchema>;
+export type PermissionsIsStaffResponse = z.infer<typeof permissionsIsStaffResponseSchema>;
+export type UserPromoteStaffRequest = z.infer<typeof userPromoteStaffRequestSchema>;
+export type UserPromoteStaffResponse = z.infer<typeof userPromoteStaffResponseSchema>;
+export type PermissionsIsOrgAdminRequest = z.infer<typeof permissionsIsOrgAdminRequestSchema>;
+export type PermissionsIsOrgAdminResponse = z.infer<typeof permissionsIsOrgAdminResponseSchema>;
+export type PermissionsIsTeamAdminRequest = z.infer<typeof permissionsIsTeamAdminRequestSchema>;
+export type PermissionsIsTeamAdminResponse = z.infer<typeof permissionsIsTeamAdminResponseSchema>;
+export type UserOAuthAccount = z.infer<typeof userOAuthAccountSchema>;
+export type UserOAuthAccountsResponse = z.infer<typeof userOAuthAccountsResponseSchema>;
+export type UserOAuthAccountDetail = z.infer<typeof userOAuthAccountDetailSchema>;
+export type UserOAuthAccountDetailResponse = z.infer<typeof userOAuthAccountDetailResponseSchema>;
+export type UserOAuthAccountUnlinkResponse = z.infer<typeof userOAuthAccountUnlinkResponseSchema>;
+export type UserSlugRequest = z.infer<typeof userSlugRequestSchema>;
+export type UserSlugResponse = z.infer<typeof userSlugResponseSchema>;
+export type TestPersonaSlug = z.infer<typeof testPersonaSlugSchema>;
+export type TestMintSessionRequest = z.infer<typeof testMintSessionRequestSchema>;
+export type TestMintSessionCookie = z.infer<typeof testMintSessionCookieSchema>;
+export type TestMintSessionResponse = z.infer<typeof testMintSessionResponseSchema>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/system/internal-api/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,eAAO,MAAM,6BAA6B;;;;;;iBAMxC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AAEH,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAEH,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AAEH,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;iBAYzC,CAAC;AAEH,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAEH,eAAO,MAAM,mCAAmC;;;iBAG9C,CAAC;AAEH,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAE1C,CAAC;AAEH,eAAO,MAAM,+BAA+B;;kBAE1C,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;iBASvC,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAE/C,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;iBAG/C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;EAUhC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;oBAGvC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;iBAStC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;iBAMxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,oCAAoC,CAC3C,CAAC;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/system/internal-api/schemas.js

@@ -0,0 +1,123 @@
+import * as z from 'zod/v4';
+const userIdSchema = z.string().min(1);
+export const permissionsCheckRequestSchema = z.object({
+    userId: userIdSchema,
+    resource: z.string().min(1),
+    action: z.string().min(1),
+    organizationId: z.string().nullable().optional(),
+    resourceId: z.string().nullable().optional()
+});
+export const permissionsCheckResponseSchema = z.object({
+    allowed: z.boolean()
+});
+export const permissionsIsSuperuserRequestSchema = z.object({
+    userId: userIdSchema
+});
+export const permissionsIsSuperuserResponseSchema = z.object({
+    isSuperuser: z.boolean()
+});
+export const permissionsIsStaffRequestSchema = z.object({
+    userId: userIdSchema
+});
+export const permissionsIsStaffResponseSchema = z.object({
+    isStaff: z.boolean()
+});
+export const userPromoteStaffRequestSchema = z.object({
+    email: z.string().min(1)
+});
+export const userPromoteStaffResponseSchema = z.object({
+    success: z.boolean(),
+    status: z.enum(['missing', 'unchanged', 'updated']),
+    user: z
+        .object({
+        id: z.string(),
+        email: z.string(),
+        isSuperuser: z.boolean(),
+        staff: z.boolean(),
+        name: z.string().nullable()
+    })
+        .nullable()
+});
+export const permissionsIsOrgAdminRequestSchema = z.object({
+    userId: userIdSchema,
+    organizationId: z.string().min(1)
+});
+export const permissionsIsOrgAdminResponseSchema = z.object({
+    isOrgAdmin: z.boolean()
+});
+export const permissionsIsTeamAdminRequestSchema = z.object({
+    userId: userIdSchema,
+    teamId: z.string().min(1)
+});
+export const permissionsIsTeamAdminResponseSchema = z.object({
+    isTeamAdmin: z.boolean()
+});
+export const userOAuthAccountSchema = z.object({
+    providerId: z.string(),
+    accountId: z.string().optional(),
+    accessToken: z.string().nullable(),
+    accessTokenExpiresAt: z.string().nullable(),
+    createdAt: z.string().nullable().optional()
+});
+export const userOAuthAccountsResponseSchema = z.object({
+    accounts: z.array(userOAuthAccountSchema)
+});
+export const userOAuthAccountSelectionSchema = z.strictObject({
+    accountId: z.string().min(1)
+});
+export const userOAuthAccountDetailSchema = z.object({
+    providerId: z.string(),
+    /** Older Auth services omit this; selected-account use must refuse that answer. */
+    accountId: z.string().min(1).optional(),
+    accessToken: z.string().nullable(),
+    refreshToken: z.string().nullable(),
+    expiresAt: z.string().nullable(),
+    refreshTokenExpiresAt: z.string().nullable(),
+    scope: z.string().nullable()
+});
+export const userOAuthAccountDetailResponseSchema = z.object({
+    account: userOAuthAccountDetailSchema.nullable()
+});
+export const userOAuthAccountUnlinkResponseSchema = z.object({
+    success: z.boolean(),
+    deleted: z.boolean().default(false)
+});
+export const userSlugRequestSchema = z.object({
+    preferredSlug: z.string().min(1).optional()
+});
+export const userSlugResponseSchema = z.object({
+    slug: z.string()
+});
+export const testPersonaSlugSchema = z.enum([
+    'free',
+    'plus',
+    'pro',
+    'ultra',
+    'admin',
+    'org-owner',
+    'org-admin',
+    'org-member',
+    'org-viewer'
+]);
+export const testMintSessionRequestSchema = z.union([
+    z.object({ persona: testPersonaSlugSchema }).strict(),
+    z.object({ email: z.string().email() }).strict()
+]);
+export const testMintSessionCookieSchema = z.object({
+    name: z.string(),
+    value: z.string(),
+    domain: z.string(),
+    path: z.string(),
+    expires: z.number(),
+    httpOnly: z.boolean(),
+    secure: z.boolean(),
+    sameSite: z.enum(['Strict', 'Lax', 'None'])
+});
+export const testMintSessionResponseSchema = z.object({
+    cookie: testMintSessionCookieSchema,
+    user: z.object({
+        id: z.string(),
+        email: z.string()
+    })
+});
+//# sourceMappingURL=schemas.js.map

package/dist/system/internal-api/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/system/internal-api/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEvC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,EAAE,YAAY;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,YAAY;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC;SACL,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC3B,CAAC;SACD,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,EAAE,YAAY;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,mFAAmF;IACnF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM;IACN,MAAM;IACN,KAAK;IACL,OAAO;IACP,OAAO;IACP,WAAW;IACX,WAAW;IACX,YAAY;IACZ,YAAY;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrD,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CAChD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,2BAA2B;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;CACF,CAAC,CAAC"}

package/dist/system/require-admin.d.ts

@@ -0,0 +1,25 @@
+import type { AuthSessionUser } from '../server/schemas/index.ts';
+import type { AuthInternalClient } from './internal-api/client.ts';
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+export interface AdminGuards {
+    isStaff(user: AuthSessionUser | null): Promise<boolean>;
+    requireStaff(user: AuthSessionUser | null): Promise<void>;
+    requireSuperuser(user: AuthSessionUser | null): Promise<void>;
+    isSuperuser(user: AuthSessionUser | null): Promise<boolean>;
+    requireOrgAdmin(user: AuthSessionUser | null, organizationId: string): Promise<void>;
+    isOrgAdmin(user: AuthSessionUser | null, organizationId: string): Promise<boolean>;
+    requireTeamAdmin(user: AuthSessionUser | null, teamId: string): Promise<void>;
+    isTeamAdmin(user: AuthSessionUser | null, teamId: string): Promise<boolean>;
+}
+/**
+ * Binds admin guard functions to an auth-internal HTTP client. Consumer
+ * apps call this once at startup and export the returned functions from
+ * their own $lib/server/auth-admin.ts so routes can use them directly.
+ *
+ * Staff (Vibes-operator) bit is the canonical cross-tenant bypass. The
+ * org/team fast paths short-circuit on `user.staff`, not `user.isSuperuser` —
+ * a general admin (Better Auth `isSuperuser`) does NOT implicitly satisfy
+ * org/team checks.
+ */
+export declare function buildRequireAdmin(client: AuthInternalClient, runtime: RuntimeRef): AdminGuards;
+//# sourceMappingURL=require-admin.d.ts.map

package/dist/system/require-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-admin.d.ts","sourceRoot":"","sources":["../../src/system/require-admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAOtD,MAAM,WAAW,WAAW;IAC3B,OAAO,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,YAAY,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,UAAU,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5E;AA8BD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,GAAG,WAAW,CA6I9F"}