@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/system/require-admin.js

@@ -0,0 +1,184 @@
+import { getLogger } from '@vibesdotdev/logging';
+import { attempt, failureLabel } from "../features/utils/attempt.js";
+async function throwHttpError(status, message) {
+    const { error } = await import('@sveltejs/kit');
+    throw error(status, message);
+}
+/**
+ * An authority's answer to a privilege check, or a denial when it cannot
+ * answer: fail closed, so an unreachable authority denies the privilege. The
+ * denial is logged by the failure's class, never its text.
+ */
+async function decide(runtime, check, ask) {
+    const answer = await attempt(ask);
+    if (answer.ok)
+        return answer.value;
+    getLogger('auth.require-admin', runtime).warn('Admin check failed; denying', { check, failure: failureLabel(answer.failure) });
+    return false;
+}
+function guardAuditLog(runtime, input) {
+    const entry = {
+        id: crypto.randomUUID(),
+        timestamp: new Date().toISOString(),
+        category: input.category,
+        severity: input.severity,
+        action: input.action,
+        actor: input.actor,
+        target: input.target,
+        outcome: input.outcome,
+        context: input.context,
+        error: input.error
+    };
+    getLogger('auth.require-admin', runtime).error('[AUDIT] authorization guard denied', { audit: JSON.stringify(entry) });
+}
+/**
+ * Binds admin guard functions to an auth-internal HTTP client. Consumer
+ * apps call this once at startup and export the returned functions from
+ * their own $lib/server/auth-admin.ts so routes can use them directly.
+ *
+ * Staff (Vibes-operator) bit is the canonical cross-tenant bypass. The
+ * org/team fast paths short-circuit on `user.staff`, not `user.isSuperuser` —
+ * a general admin (Better Auth `isSuperuser`) does NOT implicitly satisfy
+ * org/team checks.
+ */
+export function buildRequireAdmin(client, runtime) {
+    async function isStaff(user) {
+        if (!user)
+            return false;
+        if (user.staff)
+            return true;
+        return decide(runtime, 'isStaff', () => client.isStaff(user.id));
+    }
+    async function requireStaff(user) {
+        if (!user) {
+            guardAuditLog(runtime, {
+                category: 'authorization',
+                severity: 'medium',
+                action: 'require_staff',
+                actor: { id: 'anonymous', type: 'user' },
+                outcome: 'failure',
+                error: 'Authentication required'
+            });
+            return await throwHttpError(401, 'Authentication required');
+        }
+        if (await isStaff(user))
+            return;
+        guardAuditLog(runtime, {
+            category: 'authorization',
+            severity: 'high',
+            action: 'require_staff',
+            actor: { id: user.id, type: 'user', name: user.email ?? undefined },
+            outcome: 'failure',
+            error: 'Staff access required'
+        });
+        return await throwHttpError(403, 'Staff access required');
+    }
+    async function isSuperuser(user) {
+        if (!user)
+            return false;
+        if (user.isSuperuser)
+            return true;
+        return decide(runtime, 'isSuperuser', () => client.isSuperuser(user.id));
+    }
+    async function requireSuperuser(user) {
+        if (!user) {
+            guardAuditLog(runtime, {
+                category: 'authorization',
+                severity: 'medium',
+                action: 'require_superuser',
+                actor: { id: 'anonymous', type: 'user' },
+                outcome: 'failure',
+                error: 'Authentication required'
+            });
+            return await throwHttpError(401, 'Authentication required');
+        }
+        if (await isSuperuser(user))
+            return;
+        guardAuditLog(runtime, {
+            category: 'authorization',
+            severity: 'high',
+            action: 'require_superuser',
+            actor: { id: user.id, type: 'user', name: user.email ?? undefined },
+            outcome: 'failure',
+            error: 'Superuser access required'
+        });
+        return await throwHttpError(403, 'Superuser access required');
+    }
+    async function isOrgAdmin(user, organizationId) {
+        if (!user)
+            return false;
+        if (user.staff)
+            return true;
+        return decide(runtime, 'isOrgAdmin', () => client.isOrgAdmin(user.id, organizationId));
+    }
+    async function requireOrgAdmin(user, organizationId) {
+        if (!user) {
+            guardAuditLog(runtime, {
+                category: 'authorization',
+                severity: 'medium',
+                action: 'require_org_admin',
+                actor: { id: 'anonymous', type: 'user' },
+                outcome: 'failure',
+                context: { organizationId },
+                error: 'Authentication required'
+            });
+            return await throwHttpError(401, 'Authentication required');
+        }
+        if (await isOrgAdmin(user, organizationId))
+            return;
+        guardAuditLog(runtime, {
+            category: 'authorization',
+            severity: 'high',
+            action: 'require_org_admin',
+            actor: { id: user.id, type: 'user', name: user.email ?? undefined },
+            target: { id: organizationId, type: 'organization' },
+            outcome: 'failure',
+            error: 'Organization admin access required'
+        });
+        return await throwHttpError(403, 'Organization admin access required');
+    }
+    async function isTeamAdmin(user, teamId) {
+        if (!user)
+            return false;
+        if (user.staff)
+            return true;
+        return decide(runtime, 'isTeamAdmin', () => client.isTeamAdmin(user.id, teamId));
+    }
+    async function requireTeamAdmin(user, teamId) {
+        if (!user) {
+            guardAuditLog(runtime, {
+                category: 'authorization',
+                severity: 'medium',
+                action: 'require_team_admin',
+                actor: { id: 'anonymous', type: 'user' },
+                outcome: 'failure',
+                context: { teamId },
+                error: 'Authentication required'
+            });
+            return await throwHttpError(401, 'Authentication required');
+        }
+        if (await isTeamAdmin(user, teamId))
+            return;
+        guardAuditLog(runtime, {
+            category: 'authorization',
+            severity: 'high',
+            action: 'require_team_admin',
+            actor: { id: user.id, type: 'user', name: user.email ?? undefined },
+            target: { id: teamId, type: 'team' },
+            outcome: 'failure',
+            error: 'Team admin access required'
+        });
+        return await throwHttpError(403, 'Team admin access required');
+    }
+    return {
+        isStaff,
+        requireStaff,
+        requireSuperuser,
+        isSuperuser,
+        requireOrgAdmin,
+        isOrgAdmin,
+        requireTeamAdmin,
+        isTeamAdmin
+    };
+}
+//# sourceMappingURL=require-admin.js.map

package/dist/system/require-admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-admin.js","sourceRoot":"","sources":["../../src/system/require-admin.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAsB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAGrE,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,OAAe;IAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAChD,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAaD;;;;GAIG;AACH,KAAK,UAAU,MAAM,CAAC,OAAmB,EAAE,KAAa,EAAE,GAA2B;IACpF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACnC,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/H,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,OAAmB,EAAE,KAAoB;IAC/D,MAAM,KAAK,GAAG;QACb,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;KAClB,CAAC;IACF,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACxH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,OAAmB;IAChF,KAAK,UAAU,OAAO,CAAC,IAA4B;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAA4B;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,aAAa,CAAC,OAAO,EAAE;gBACtB,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,eAAe;gBACvB,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;gBACxC,OAAO,EAAE,SAAS;gBAClB,KAAK,EAAE,yBAAyB;aAChC,CAAC,CAAC;YACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QAChC,aAAa,CAAC,OAAO,EAAE;YACtB,QAAQ,EAAE,eAAe;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE;YACnE,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,uBAAuB;SAC9B,CAAC,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,IAA4B;QACtD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,IAA4B;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,aAAa,CAAC,OAAO,EAAE;gBACtB,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;gBACxC,OAAO,EAAE,SAAS;gBAClB,KAAK,EAAE,yBAAyB;aAChC,CAAC,CAAC;YACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO;QACpC,aAAa,CAAC,OAAO,EAAE;YACtB,QAAQ,EAAE,eAAe;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,mBAAmB;YAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE;YACnE,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,2BAA2B;SAClC,CAAC,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,UAAU,UAAU,CACxB,IAA4B,EAC5B,cAAsB;QAEtB,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,UAAU,eAAe,CAC7B,IAA4B,EAC5B,cAAsB;QAEtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,aAAa,CAAC,OAAO,EAAE;gBACtB,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;gBACxC,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,EAAE,cAAc,EAAE;gBAC3B,KAAK,EAAE,yBAAyB;aAChC,CAAC,CAAC;YACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC;YAAE,OAAO;QACnD,aAAa,CAAC,OAAO,EAAE;YACtB,QAAQ,EAAE,eAAe;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,mBAAmB;YAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE;YACnE,MAAM,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE;YACpD,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,oCAAoC;SAC3C,CAAC,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,IAA4B,EAAE,MAAc;QACtE,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,IAA4B,EAAE,MAAc;QAC3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,aAAa,CAAC,OAAO,EAAE;gBACtB,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,oBAAoB;gBAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;gBACxC,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,EAAE,MAAM,EAAE;gBACnB,KAAK,EAAE,yBAAyB;aAChC,CAAC,CAAC;YACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO;QAC5C,aAAa,CAAC,OAAO,EAAE;YACtB,QAAQ,EAAE,eAAe;YACzB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,oBAAoB;YAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE;YACnE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;YACpC,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,4BAA4B;SACnC,CAAC,CAAC;QACH,OAAO,MAAM,cAAc,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IAChE,CAAC;IAED,OAAO;QACN,OAAO;QACP,YAAY;QACZ,gBAAgB;QAChB,WAAW;QACX,eAAe;QACf,UAAU;QACV,gBAAgB;QAChB,WAAW;KACX,CAAC;AACH,CAAC"}

package/dist/system/session-handle.d.ts

@@ -0,0 +1,15 @@
+import type { Handle } from '@sveltejs/kit';
+import type { SessionFetchHandleOptions } from '../server/schemas/index.ts';
+export type { SessionFetchHandleOptions } from '../server/schemas/index.ts';
+/**
+ * SvelteKit handle that fetches session state from auth-web's /api/session
+ * and populates event.locals.user / event.locals.session. Used by every
+ * vibes app's hooks.server.ts to stay in sync with auth without touching
+ * the auth DB.
+ *
+ * GET /api/session still reads Better Auth's session cookie (a vibes JWT
+ * bearer is not that token). This handle keeps the inbound Cookie until
+ * that receiver accepts the JWT.
+ */
+export declare function createSessionFetchHandle(options: SessionFetchHandleOptions): Handle;
+//# sourceMappingURL=session-handle.d.ts.map

package/dist/system/session-handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-handle.d.ts","sourceRoot":"","sources":["../../src/system/session-handle.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAI5C,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAG5E,YAAY,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAiB5E;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAsDnF"}

package/dist/system/session-handle.js

@@ -0,0 +1,104 @@
+import * as z from 'zod/v4';
+import { getLogger } from '@vibesdotdev/logging';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { resolveLocalAuthUrl } from "../config/local-auth-origin.js";
+import { attempt, failureLabel } from "../features/utils/attempt.js";
+import { AuthServiceBindingSchema } from "../server/auth-service-binding.js";
+const FORWARDABLE_AUTH_COOKIES = new Set(['vibes.jwt']);
+/** What auth-web's `GET /api/session` answers. */
+const sessionPayloadSchema = z.looseObject({
+    user: z.unknown().optional(),
+    session: z.unknown().optional()
+});
+/**
+ * SvelteKit handle that fetches session state from auth-web's /api/session
+ * and populates event.locals.user / event.locals.session. Used by every
+ * vibes app's hooks.server.ts to stay in sync with auth without touching
+ * the auth DB.
+ *
+ * GET /api/session still reads Better Auth's session cookie (a vibes JWT
+ * bearer is not that token). This handle keeps the inbound Cookie until
+ * that receiver accepts the JWT.
+ */
+export function createSessionFetchHandle(options) {
+    return async ({ event, resolve }) => {
+        // SAFETY: `App.Locals` is an interface the consumer app augments; this handle owns the session fields on it (`SessionLocals`).
+        const locals = event.locals;
+        const runtime = locals.runtime;
+        if (!runtime || !(runtime.getBinding instanceof Function)) {
+            throw new CapabilityError('Runtime required for session fetch', 'UNAVAILABLE', { reason: 'runtime-unavailable' });
+        }
+        const logger = getLogger('auth.session-fetch', runtime);
+        const fetched = await attempt(async () => {
+            await options.ensureInitialized?.();
+            const sessionFetchTimeoutMs = 10_000;
+            const controller = new AbortController();
+            const disarm = runtime.lifecycle.timeout(() => controller.abort(), sessionFetchTimeoutMs);
+            let response;
+            try {
+                const sessionUrl = resolveLocalAuthUrl(options.sessionUrl instanceof Function ? options.sessionUrl() : options.sessionUrl);
+                response = await fetchAuthSession(sessionUrl, runtime, {
+                    headers: {
+                        cookie: event.request.headers.get('cookie') || '',
+                        ...options.fetchOptions?.headers
+                    },
+                    ...options.fetchOptions,
+                    signal: controller.signal
+                });
+            }
+            finally {
+                disarm();
+            }
+            if (!response.ok)
+                return null;
+            return { response, payload: sessionPayloadSchema.parse(await response.json()) };
+        });
+        if (fetched.ok && fetched.value) {
+            locals.user = fetched.value.payload.user ?? null;
+            locals.session = fetched.value.payload.session ?? null;
+            const resolved = await resolve(event);
+            return appendForwardableAuthCookies(resolved, fetched.value.response);
+        }
+        if (!fetched.ok) {
+            logger.warn('[createSessionFetchHandle] Failed to fetch session', {
+                failure: failureLabel(fetched.failure)
+            });
+        }
+        locals.user = null;
+        locals.session = null;
+        return resolve(event);
+    };
+}
+async function fetchAuthSession(url, runtime, init) {
+    const request = new Request(url, init);
+    const binding = getAuthServiceBinding(runtime);
+    if (binding) {
+        return binding.fetch(request);
+    }
+    return fetch(request);
+}
+function getAuthServiceBinding(runtime) {
+    return runtime.getBinding('AUTH_SERVICE', AuthServiceBindingSchema);
+}
+function appendForwardableAuthCookies(response, authResponse) {
+    const cookies = getSetCookieHeaders(authResponse).filter(isForwardableAuthCookie);
+    if (!cookies.length)
+        return response;
+    const next = new Response(response.body, response);
+    for (const cookie of cookies) {
+        next.headers.append('Set-Cookie', cookie);
+    }
+    return next;
+}
+function getSetCookieHeaders(response) {
+    const setCookies = response.headers.getSetCookie?.();
+    if (setCookies?.length)
+        return setCookies;
+    const single = response.headers.get('Set-Cookie');
+    return single ? [single] : [];
+}
+function isForwardableAuthCookie(header) {
+    const name = header.split('=', 1)[0]?.trim();
+    return FORWARDABLE_AUTH_COOKIES.has(name);
+}
+//# sourceMappingURL=session-handle.js.map

package/dist/system/session-handle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-handle.js","sourceRoot":"","sources":["../../src/system/session-handle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAA2B,MAAM,mCAAmC,CAAC;AAUtG,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAExD,kDAAkD;AAClD,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IAC1E,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QACnC,+HAA+H;QAC/H,MAAM,MAAM,GAAG,KAAK,CAAC,MAAuB,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,YAAY,QAAQ,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,eAAe,CACxB,oCAAoC,EACpC,aAAa,EACb,EAAE,MAAM,EAAE,qBAAqB,EAAE,CACjC,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;YACxC,MAAM,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;YAEpC,MAAM,qBAAqB,GAAG,MAAM,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,qBAAqB,CAAC,CAAC;YAC1F,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACJ,MAAM,UAAU,GAAG,mBAAmB,CACrC,OAAO,CAAC,UAAU,YAAY,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAClF,CAAC;gBACF,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,OAAO,EAAE;oBACtD,OAAO,EAAE;wBACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;wBACjD,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO;qBAChC;oBACD,GAAG,OAAO,CAAC,YAAY;oBACvB,MAAM,EAAE,UAAU,CAAC,MAAM;iBACzB,CAAC,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACV,MAAM,EAAE,CAAC;YACV,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;YACjD,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,4BAA4B,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBACjE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;aACtC,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,OAAqB,EAAE,IAAiB;IACpF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAqB;IACnD,OAAO,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAkB,EAAE,YAAsB;IAC/E,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC;IAErC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB;IAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;IACrD,IAAI,UAAU,EAAE,MAAM;QAAE,OAAO,UAAU,CAAC;IAE1C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAc;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/system/sign-out-handoff.d.ts

@@ -0,0 +1,88 @@
+import { CapabilityError, type VibesRuntime } from '@vibesdotdev/kernel';
+export type AuthSignOutFetcher = (request: Request) => Promise<Response>;
+export interface AuthSignOutHandoffOptions {
+    request: Request;
+    authOrigin: string;
+    sharedCookieDomain: string | null;
+    redirectTo: string;
+    /**
+     * Callers may pass `locals.sessionToken`. Auth-web `/signout` still
+     * requires the Better Auth session cookie (a vibes JWT bearer is not
+     * that token, and an opaque bearer 500s in `readPresentedJwt` before
+     * `signOut`). The inbound Cookie is the credential until that receiver
+     * accepts a bearer session token.
+     */
+    sessionToken?: string | null;
+    fetcher?: AuthSignOutFetcher | null;
+    serviceBindingName?: string | null;
+}
+/** A sign-out that Auth did not confirm: `status` is the HTTP status when Auth answered. */
+export declare class AuthSignOutHandoffError extends CapabilityError {
+    readonly status?: number;
+    constructor(message: string, status?: number);
+}
+/**
+ * Revoke the canonical Auth session and preserve every cookie deletion on the
+ * same-origin consumer response.
+ */
+export declare function completeAuthSignOut(runtime: Pick<VibesRuntime, 'getBinding'>, options: AuthSignOutHandoffOptions): Promise<Response>;
+/**
+ * Build a consumer app's `/auth/signout` POST handler.
+ *
+ * Every consumer needs the identical wrapper around `completeAuthSignOut`:
+ * same-origin guard, derive the shared cookie domain from declared caller
+ * configuration, delegate. Hand-writing it produced 15 byte-identical
+ * copies of `sharedCookieDomain()` across the fleet and two silent failure modes
+ * — a route that returned a bare redirect (dropping Auth's cookie deletions, so
+ * the stateless 15-minute `vibes.jwt` kept authenticating), and apps whose shell
+ * posted to a route that did not exist.
+ *
+ * Owning it here makes the wrong shape unrepresentable: a consumer supplies only
+ * what actually differs.
+ *
+ *     // The runtime is the request's (`event.locals.runtime`), so build per request.
+ *     export const POST: RequestHandler = (event) =>
+ *       createAuthSignOutHandler(event.locals.runtime, {
+ *         authOrigin: appAuthClient.authOrigin,
+ *         baseDomain: siteConfig.baseDomain,
+ *         redirectTo: () => appAuthClient.signInUrl()
+ *       })(event);
+ */
+export interface AuthSignOutHandlerOptions {
+    /** This app's Auth origin. */
+    authOrigin: string;
+    /** Where to send the browser afterwards. A function so it can read the request URL. */
+    redirectTo: string | ((event: {
+        request: Request;
+        url: URL;
+    }) => string);
+    /**
+     * Same-origin guard. Omitted or null uses the shared `requireSameOriginPost` contract:
+     * reject a PRESENT, mismatched Origin or Referer; allow both absent, which is
+     * how server-side proxies and the Auth service binding call in.
+     */
+    guard?: ((request: Request, url: URL) => void | Promise<void>) | null;
+    /**
+     * Declares that a trusted proxy (the dev nginx that terminates TLS) sets
+     * `X-Forwarded-Proto` / `X-Forwarded-Host`, so the default guard reads them
+     * for the public origin. Default `false`: those headers are client input and
+     * a forged one cannot move the expected origin. Ignored when `guard` is given.
+     */
+    trustProxy?: boolean;
+    /** Declared site base domain; omitted, null or blank selects host-only deletion. */
+    baseDomain?: string | null;
+    /** Override derivation from baseDomain. Null explicitly selects host-only deletion. */
+    sharedCookieDomain?: string | null;
+    /** Test seam — forwarded to `completeAuthSignOut`. */
+    fetcher?: AuthSignOutFetcher | null;
+}
+/** Derive the shared cookie domain, returning null when Auth is not on it. */
+export declare function deriveSharedCookieDomain(authOrigin: string, baseDomain: string | null | undefined): string | null;
+export declare function createAuthSignOutHandler(runtime: Pick<VibesRuntime, 'getBinding'>, options: AuthSignOutHandlerOptions): (event: {
+    request: Request;
+    url: URL;
+    locals?: {
+        sessionToken?: string | null;
+    };
+}) => Promise<Response>;
+//# sourceMappingURL=sign-out-handoff.d.ts.map

package/dist/system/sign-out-handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out-handoff.d.ts","sourceRoot":"","sources":["../../src/system/sign-out-handoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAyD,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKhI,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzE,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAUD,4FAA4F;AAC5F,qBAAa,uBAAwB,SAAQ,eAAe;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAO5C;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EACzC,OAAO,EAAE,yBAAyB,GAChC,OAAO,CAAC,QAAQ,CAAC,CAkCnB;AAwDD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,yBAAyB;IACzC,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,GAAG,CAAA;KAAE,KAAK,MAAM,CAAC,CAAC;IACzE;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACtE;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,sDAAsD;IACtD,OAAO,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACpC;AAED,8EAA8E;AAC9E,wBAAgB,wBAAwB,CACvC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,MAAM,GAAG,IAAI,CAKf;AAED,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EACzC,OAAO,EAAE,yBAAyB,IAQP,OAAO;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,MAAM,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC1C,KAAG,OAAO,CAAC,QAAQ,CAAC,CAqBrB"}

package/dist/system/sign-out-handoff.js

@@ -0,0 +1,136 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { attempt } from "../features/utils/attempt.js";
+import { failureMessage } from "../client/request-failure.js";
+import { AuthServiceBindingSchema } from "../server/auth-service-binding.js";
+const SHARED_JWT_COOKIE = 'vibes.jwt';
+/** The `CapabilityError` code a sign-out failure belongs to, from the status Auth answered (none: it did not answer). */
+function signOutErrorCode(status) {
+    if (status === undefined)
+        return 'UNAVAILABLE';
+    return status >= 500 ? 'UNAVAILABLE' : 'INVALID_INPUT';
+}
+/** A sign-out that Auth did not confirm: `status` is the HTTP status when Auth answered. */
+export class AuthSignOutHandoffError extends CapabilityError {
+    status;
+    constructor(message, status) {
+        const options = { reason: 'auth-sign-out-failed', retryable: false };
+        if (status !== undefined)
+            options.details = { status };
+        super(message, signOutErrorCode(status), options);
+        this.name = 'AuthSignOutHandoffError';
+        if (status !== undefined)
+            this.status = status;
+    }
+}
+/**
+ * Revoke the canonical Auth session and preserve every cookie deletion on the
+ * same-origin consumer response.
+ */
+export async function completeAuthSignOut(runtime, options) {
+    const authOrigin = normalizeOrigin(options.authOrigin);
+    const fetcher = resolveAuthFetcher(runtime, options);
+    const request = new Request(new URL('/signout', `${authOrigin}/`).toString(), {
+        method: 'POST',
+        headers: {
+            accept: 'text/html',
+            cookie: options.request.headers.get('cookie') ?? ''
+        },
+        redirect: 'manual'
+    });
+    const sent = await attempt(() => fetcher(request));
+    if (!sent.ok) {
+        throw new AuthSignOutHandoffError(`Auth sign-out transport failed: ${failureMessage(sent.failure)}`);
+    }
+    const authResponse = sent.value;
+    if (authResponse.status < 200 || authResponse.status >= 400) {
+        throw new AuthSignOutHandoffError(`Auth sign-out was not confirmed (${authResponse.status})`, authResponse.status);
+    }
+    const headers = new Headers({ location: options.redirectTo, 'cache-control': 'no-store' });
+    for (const cookie of getSetCookieHeaders(authResponse)) {
+        if (!isSharedJwtCookie(cookie))
+            headers.append('Set-Cookie', cookie);
+    }
+    for (const cookie of sharedJwtDeletionCookies(authOrigin, options.sharedCookieDomain)) {
+        headers.append('Set-Cookie', cookie);
+    }
+    return new Response(null, { status: 303, headers });
+}
+function resolveAuthFetcher(runtime, options) {
+    if (options.fetcher === null)
+        return (request) => globalThis.fetch(request);
+    if (options.fetcher)
+        return options.fetcher;
+    const bindingName = options.serviceBindingName === undefined ? 'AUTH_SERVICE' : options.serviceBindingName;
+    if (bindingName) {
+        const binding = runtime.getBinding(bindingName, AuthServiceBindingSchema);
+        if (binding)
+            return binding.fetch.bind(binding);
+    }
+    return (request) => globalThis.fetch(request);
+}
+function normalizeOrigin(origin) {
+    return origin.endsWith('/') ? origin.slice(0, -1) : origin;
+}
+function getSetCookieHeaders(response) {
+    const headers = response.headers;
+    const multiple = headers.getSetCookie?.();
+    if (multiple?.length)
+        return multiple;
+    const single = response.headers.get('Set-Cookie');
+    return single ? [single] : [];
+}
+function isSharedJwtCookie(header) {
+    return header.split('=', 1)[0]?.trim() === SHARED_JWT_COOKIE;
+}
+function sharedJwtDeletionCookies(authOrigin, configuredCookieDomain) {
+    const url = new URL(authOrigin);
+    const secure = url.protocol === 'https:';
+    const common = `Path=/; Max-Age=0; HttpOnly; SameSite=${secure ? 'None' : 'Lax'}${secure ? '; Secure' : ''}`;
+    const cookies = [`${SHARED_JWT_COOKIE}=; ${common}`];
+    const domain = normalizeCookieDomain(configuredCookieDomain);
+    if (domain)
+        cookies.push(`${SHARED_JWT_COOKIE}=; Domain=${domain}; ${common}`);
+    return cookies;
+}
+function normalizeCookieDomain(configuredCookieDomain) {
+    if (configuredCookieDomain === null)
+        return null;
+    const domain = configuredCookieDomain.trim().toLowerCase();
+    if (!/^\.?[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/.test(domain)) {
+        throw new AuthSignOutHandoffError('Configured shared cookie domain is invalid');
+    }
+    return domain.startsWith('.') ? domain : `.${domain}`;
+}
+/** Derive the shared cookie domain, returning null when Auth is not on it. */
+export function deriveSharedCookieDomain(authOrigin, baseDomain) {
+    const domain = baseDomain?.trim().replace(/^\./, '');
+    if (!domain)
+        return null;
+    const hostname = new URL(authOrigin).hostname;
+    return hostname === domain || hostname.endsWith(`.${domain}`) ? `.${domain}` : null;
+}
+export function createAuthSignOutHandler(runtime, options) {
+    const guard = options.guard ??
+        (async (request, url) => {
+            const { requireSameOriginPost } = await import('@vibesdotdev/kit/server/endpoint/same-origin');
+            requireSameOriginPost(request, url, undefined, { trustProxy: options.trustProxy === true });
+        });
+    return async function POST(event) {
+        await guard(event.request, event.url);
+        const redirectTo = options.redirectTo instanceof Function ? options.redirectTo(event) : options.redirectTo;
+        const sharedCookieDomain = options.sharedCookieDomain !== undefined
+            ? options.sharedCookieDomain
+            : deriveSharedCookieDomain(options.authOrigin, normalizeCookieDomain(options.baseDomain?.trim() || null));
+        const handoff = {
+            request: event.request,
+            authOrigin: options.authOrigin,
+            sharedCookieDomain,
+            redirectTo,
+            sessionToken: event.locals?.sessionToken,
+        };
+        if (options.fetcher !== undefined)
+            handoff.fetcher = options.fetcher;
+        return completeAuthSignOut(runtime, handoff);
+    };
+}
+//# sourceMappingURL=sign-out-handoff.js.map

package/dist/system/sign-out-handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out-handoff.js","sourceRoot":"","sources":["../../src/system/sign-out-handoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA4E,MAAM,qBAAqB,CAAC;AAChI,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAqB7E,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAEtC,yHAAyH;AACzH,SAAS,gBAAgB,CAAC,MAA0B;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAC/C,OAAO,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC;AACxD,CAAC;AAED,4FAA4F;AAC5F,MAAM,OAAO,uBAAwB,SAAQ,eAAe;IAClD,MAAM,CAAU;IAEzB,YAAY,OAAe,EAAE,MAAe;QAC3C,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC7F,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC;QACvD,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IAChD,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAyC,EACzC,OAAkC;IAElC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,GAAG,UAAU,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC7E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;SACnD;QACD,QAAQ,EAAE,QAAQ;KAClB,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,uBAAuB,CAAC,mCAAmC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC;IAEhC,IAAI,YAAY,CAAC,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC7D,MAAM,IAAI,uBAAuB,CAChC,oCAAoC,YAAY,CAAC,MAAM,GAAG,EAC1D,YAAY,CAAC,MAAM,CACnB,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3F,KAAK,MAAM,MAAM,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvF,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,kBAAkB,CAC1B,OAAyC,EACzC,OAAkC;IAElC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAE5C,MAAM,WAAW,GAChB,OAAO,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACxF,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC1E,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5D,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAkB;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;IAC1C,IAAI,QAAQ,EAAE,MAAM;QAAE,OAAO,QAAQ,CAAC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,iBAAiB,CAAC;AAC9D,CAAC;AAED,SAAS,wBAAwB,CAChC,UAAkB,EAClB,sBAAqC;IAErC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACzC,MAAM,MAAM,GAAG,yCAAyC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7G,MAAM,OAAO,GAAG,CAAC,GAAG,iBAAiB,MAAM,MAAM,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;IAC7D,IAAI,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,iBAAiB,aAAa,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,sBAAqC;IACnE,IAAI,sBAAsB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3D,IAAI,CAAC,uCAAuC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,uBAAuB,CAAC,4CAA4C,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;AACvD,CAAC;AAkDD,8EAA8E;AAC9E,MAAM,UAAU,wBAAwB,CACvC,UAAkB,EAClB,UAAqC;IAErC,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC9C,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,wBAAwB,CACvC,OAAyC,EACzC,OAAkC;IAElC,MAAM,KAAK,GACV,OAAO,CAAC,KAAK;QACb,CAAC,KAAK,EAAE,OAAgB,EAAE,GAAQ,EAAE,EAAE;YACrC,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,8CAA8C,CAAC,CAAC;YAC/F,qBAAqB,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACJ,OAAO,KAAK,UAAU,IAAI,CAAC,KAI1B;QACA,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,UAAU,GACf,OAAO,CAAC,UAAU,YAAY,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACzF,MAAM,kBAAkB,GACvB,OAAO,CAAC,kBAAkB,KAAK,SAAS;YACvC,CAAC,CAAC,OAAO,CAAC,kBAAkB;YAC5B,CAAC,CAAC,wBAAwB,CACxB,OAAO,CAAC,UAAU,EAClB,qBAAqB,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,CACzD,CAAC;QACL,MAAM,OAAO,GAA8B;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,kBAAkB;YAClB,UAAU;YACV,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY;SACxC,CAAC;QACF,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QACrE,OAAO,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC,CAAC;AACH,CAAC"}

package/dist/tui/auth-actions.client.consumer.d.ts

@@ -0,0 +1,11 @@
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import type { AuthTuiActions, AuthTuiActionsClient, AuthTuiContext } from '../schemas/tui-actions.ts';
+/** Each activation owns its callbacks; replacing or disposing it fences older work. */
+export default class AuthTuiActionsOwner extends BaseRuntimeClient implements AuthTuiActionsClient {
+    private readonly actions;
+    attach(ctx: AuthTuiContext, actions: AuthTuiActions): () => boolean;
+    get(ctx: AuthTuiContext): AuthTuiActions | undefined;
+    remove(ctx: AuthTuiContext): void;
+    protected onDispose(): void;
+}
+//# sourceMappingURL=auth-actions.client.consumer.d.ts.map

package/dist/tui/auth-actions.client.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-actions.client.consumer.d.ts","sourceRoot":"","sources":["../../src/tui/auth-actions.client.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEtG,uFAAuF;AACvF,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,iBAAkB,YAAW,oBAAoB;IACjG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IAErE,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,OAAO;IAKnE,GAAG,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS;IAIpD,MAAM,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI;cAId,SAAS,IAAI,IAAI;CAGpC"}

package/dist/tui/auth-actions.client.consumer.js

@@ -0,0 +1,19 @@
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+/** Each activation owns its callbacks; replacing or disposing it fences older work. */
+export default class AuthTuiActionsOwner extends BaseRuntimeClient {
+    actions = new Map();
+    attach(ctx, actions) {
+        this.actions.set(ctx, actions);
+        return () => !this.runtime.lifecycle.signal.aborted && this.actions.get(ctx) === actions;
+    }
+    get(ctx) {
+        return this.actions.get(ctx);
+    }
+    remove(ctx) {
+        this.actions.delete(ctx);
+    }
+    onDispose() {
+        this.actions.clear();
+    }
+}
+//# sourceMappingURL=auth-actions.client.consumer.js.map

package/dist/tui/auth-actions.client.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-actions.client.consumer.js","sourceRoot":"","sources":["../../src/tui/auth-actions.client.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAG/D,uFAAuF;AACvF,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,iBAAiB;IAChD,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IAErE,MAAM,CAAC,GAAmB,EAAE,OAAuB;QAClD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC;IAC1F,CAAC;IAED,GAAG,CAAC,GAAmB;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,GAAmB;QACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAEkB,SAAS;QAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACD"}

package/dist/tui/auth-tui.plugin.d.ts

@@ -0,0 +1,3 @@
+export declare const authTuiPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default authTuiPlugin;
+//# sourceMappingURL=auth-tui.plugin.d.ts.map

package/dist/tui/auth-tui.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-tui.plugin.d.ts","sourceRoot":"","sources":["../../src/tui/auth-tui.plugin.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,aAAa,6CAgBxB,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/tui/auth-tui.plugin.js

@@ -0,0 +1,25 @@
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import { createRuntimeAsset, createRuntimePlugin, loader } from '@vibesdotdev/kernel';
+import authAppDescriptor from "./auth.tui-app.descriptor.js";
+import authStateDescriptor from "./auth.tui-state.descriptor.js";
+const TUI_APP = { kind: 'tui/app' };
+const TUI_STATE = { kind: 'tui/state' };
+export const authTuiPlugin = createRuntimePlugin({
+    id: 'auth.tui',
+    name: 'Auth TUI Surface',
+    description: 'Who-am-I and device login for the operator workbench.',
+    dependencies: ['tui', 'auth'],
+    async onActivate(runtime) {
+        await getVibesClient('auth.tui-actions', runtime);
+    },
+    descriptors: [authAppDescriptor, authStateDescriptor, createRuntimeAsset({
+            kind: 'runtime/client', id: 'auth.tui-actions', name: 'Auth TUI Actions'
+        })],
+    loaders: [
+        loader('auth.tui-actions', { kind: 'runtime/client', scope: 'consumer' }, () => import("./auth-actions.client.consumer.js")),
+        loader('auth.status', TUI_APP, () => import("./auth.tui-app.impl.consumer.js")),
+        loader('auth.identity', TUI_STATE, () => import("./auth.tui-state.impl.consumer.js"))
+    ]
+});
+export default authTuiPlugin;
+//# sourceMappingURL=auth-tui.plugin.js.map