@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/cli/commands/seed/seed-users.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Canonical seed-persona registry.
+ *
+ * Persona → system role mapping (applied at auth-web startup by
+ * `assignPersonaSystemRoles()` in `$lib/features/permissions/server/persona-roles.ts`):
+ *
+ *   dev@vibes.dev              → developer       (also owner of the `vibes` org)
+ *   admin@test.vibes.dev       → admin           (NOT isSuperuser — see decision below)
+ *   readonly@test.vibes.dev    → readonly
+ *   project-admin@test.vibes.dev → project_admin
+ *
+ *   free|plus|pro|ultra@test.vibes.dev → user (default)
+ *   org-{owner,admin,member,viewer}@test.vibes.dev → user (default)
+ *     ↳ org-role personas get their elevated *org* role in account-web's
+ *       membership table, NOT a system role.
+ *
+ * ## Decision: `admin@test.vibes.dev` is NOT a superuser
+ *
+ * The label "Platform Admin" used to be ambiguous — `isSuperuser:false` on
+ * this persona was the trigger for friction signal `friction_ne38d5tqj2wf`.
+ * Resolution: this persona is a *system administrator* (`admin` role granting
+ * users/projects/system/billing/secrets/roles permissions) but is intentionally
+ * not a superuser. The `admin:all` wildcard is reserved for `superadmin`, which
+ * no seeded persona currently carries. If a test needs full-bypass access,
+ * either add a dedicated `superadmin@test.vibes.dev` persona or flip a specific
+ * user via the admin operator path (`createLocalUser({ isSuperuser: true })`).
+ *
+ * ## Dev-superuser tier (admin-toolbar)
+ *
+ * The admin-toolbar's "Seed" panel exposes a `dev-superuser` tier that
+ * promotes `dev@vibes.dev` to `is_superuser=true` via
+ * `setLocalSuperuserByEmail()`. This is the canonical way to grant local
+ * superuser access for testing the toolbar itself — no new persona row, just
+ * a flag flip on the existing `dev` user (which the tiered seed already
+ * creates). The "Decision" above still stands: this is a deliberate
+ * per-environment override, not a default.
+ */
+export interface SeedUser {
+    email: string;
+    password: string;
+    name: string;
+}
+export declare const DEV_USER: {
+    readonly email: "dev@vibes.dev";
+    readonly password: "vibes123";
+    readonly name: "Dev User";
+};
+/**
+ * Platform superuser persona. Created with `is_superuser=true` so the admin
+ * toolbar works on first sign-in without any manual SQL flip. Seeded by both
+ * the standalone tiered seed (which calls `/api/internal/users/promote-admin`
+ * with the internal service token to flip the flag after sign-up) and the
+ * in-process admin-toolbar seed endpoint (which calls
+ * `setLocalSuperuserByEmail()` directly).
+ *
+ * Intentionally separate from `dev@vibes.dev` (which stays a normal user by
+ * default) and from `admin@test.vibes.dev` (a role-admin, not full bypass).
+ */
+export declare const SUPERADMIN_USER: {
+    readonly email: "superadmin@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Platform Superadmin";
+};
+export declare const SUPERUSER_PERSONAS: readonly [{
+    readonly email: "superadmin@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Platform Superadmin";
+}];
+export declare const TIER_USERS: readonly [{
+    readonly email: "free@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Free Tier User";
+}, {
+    readonly email: "plus@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Plus Tier User";
+}, {
+    readonly email: "pro@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Pro Tier User";
+}, {
+    readonly email: "ultra@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Ultra Tier User";
+}, {
+    readonly email: "admin@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Platform Admin";
+}];
+export declare const SYSTEM_ROLE_USERS: readonly [{
+    readonly email: "readonly@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Readonly User";
+}, {
+    readonly email: "project-admin@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Project Admin";
+}];
+export declare const ORG_ROLE_USERS: readonly [{
+    readonly email: "org-owner@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Org Owner";
+}, {
+    readonly email: "org-admin@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Org Admin";
+}, {
+    readonly email: "org-member@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Org Member";
+}, {
+    readonly email: "org-viewer@test.vibes.dev";
+    readonly password: "testpassword123";
+    readonly name: "Org Viewer";
+}];
+export declare const VIBES_ORG: {
+    readonly name: "Vibes";
+    readonly slug: "vibes";
+    readonly description: "Default seeded org — referenced by VIBES_ORG_ID=vibes in docs.";
+};
+/**
+ * Personas enrolled into the `vibes` org (slug = `vibes`).
+ * Owner is `dev@vibes.dev`; remaining personas join as `member`.
+ * Decision rationale: keep org-* personas exclusive to their dedicated
+ * `e2e-test-org` — so each org's member list reflects its specific test
+ * purpose. The `vibes` org is for platform-default flows (the
+ * VIBES_ORG_ID=vibes path in discovery docs).
+ */
+export declare const VIBES_ORG_MEMBERS: readonly [{
+    readonly email: "admin@test.vibes.dev";
+    readonly role: "admin";
+}, {
+    readonly email: "free@test.vibes.dev";
+    readonly role: "member";
+}, {
+    readonly email: "plus@test.vibes.dev";
+    readonly role: "member";
+}, {
+    readonly email: "pro@test.vibes.dev";
+    readonly role: "member";
+}, {
+    readonly email: "ultra@test.vibes.dev";
+    readonly role: "member";
+}];
+//# sourceMappingURL=seed-users.d.ts.map

package/dist/cli/commands/seed/seed-users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-users.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/seed/seed-users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,QAAQ;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,QAAQ;;;;CAIQ,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;;;;CAIC,CAAC;AAE9B,eAAO,MAAM,kBAAkB;;;;EAA2D,CAAC;AAE3F,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;EAMiB,CAAC;AAEzC,eAAO,MAAM,iBAAiB;;;;;;;;EAOU,CAAC;AAEzC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;EAKa,CAAC;AAEzC,eAAO,MAAM,SAAS;;;;CAIZ,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;EAMpB,CAAC"}

package/dist/cli/commands/seed/seed-users.js

@@ -0,0 +1,64 @@
+export const DEV_USER = {
+    email: 'dev@vibes.dev',
+    password: 'vibes123',
+    name: 'Dev User'
+};
+/**
+ * Platform superuser persona. Created with `is_superuser=true` so the admin
+ * toolbar works on first sign-in without any manual SQL flip. Seeded by both
+ * the standalone tiered seed (which calls `/api/internal/users/promote-admin`
+ * with the internal service token to flip the flag after sign-up) and the
+ * in-process admin-toolbar seed endpoint (which calls
+ * `setLocalSuperuserByEmail()` directly).
+ *
+ * Intentionally separate from `dev@vibes.dev` (which stays a normal user by
+ * default) and from `admin@test.vibes.dev` (a role-admin, not full bypass).
+ */
+export const SUPERADMIN_USER = {
+    email: 'superadmin@test.vibes.dev',
+    password: 'testpassword123',
+    name: 'Platform Superadmin'
+};
+export const SUPERUSER_PERSONAS = [SUPERADMIN_USER];
+export const TIER_USERS = [
+    { email: 'free@test.vibes.dev', password: 'testpassword123', name: 'Free Tier User' },
+    { email: 'plus@test.vibes.dev', password: 'testpassword123', name: 'Plus Tier User' },
+    { email: 'pro@test.vibes.dev', password: 'testpassword123', name: 'Pro Tier User' },
+    { email: 'ultra@test.vibes.dev', password: 'testpassword123', name: 'Ultra Tier User' },
+    { email: 'admin@test.vibes.dev', password: 'testpassword123', name: 'Platform Admin' }
+];
+export const SYSTEM_ROLE_USERS = [
+    { email: 'readonly@test.vibes.dev', password: 'testpassword123', name: 'Readonly User' },
+    {
+        email: 'project-admin@test.vibes.dev',
+        password: 'testpassword123',
+        name: 'Project Admin'
+    }
+];
+export const ORG_ROLE_USERS = [
+    { email: 'org-owner@test.vibes.dev', password: 'testpassword123', name: 'Org Owner' },
+    { email: 'org-admin@test.vibes.dev', password: 'testpassword123', name: 'Org Admin' },
+    { email: 'org-member@test.vibes.dev', password: 'testpassword123', name: 'Org Member' },
+    { email: 'org-viewer@test.vibes.dev', password: 'testpassword123', name: 'Org Viewer' }
+];
+export const VIBES_ORG = {
+    name: 'Vibes',
+    slug: 'vibes',
+    description: 'Default seeded org — referenced by VIBES_ORG_ID=vibes in docs.'
+};
+/**
+ * Personas enrolled into the `vibes` org (slug = `vibes`).
+ * Owner is `dev@vibes.dev`; remaining personas join as `member`.
+ * Decision rationale: keep org-* personas exclusive to their dedicated
+ * `e2e-test-org` — so each org's member list reflects its specific test
+ * purpose. The `vibes` org is for platform-default flows (the
+ * VIBES_ORG_ID=vibes path in discovery docs).
+ */
+export const VIBES_ORG_MEMBERS = [
+    { email: 'admin@test.vibes.dev', role: 'admin' },
+    { email: 'free@test.vibes.dev', role: 'member' },
+    { email: 'plus@test.vibes.dev', role: 'member' },
+    { email: 'pro@test.vibes.dev', role: 'member' },
+    { email: 'ultra@test.vibes.dev', role: 'member' }
+];
+//# sourceMappingURL=seed-users.js.map

package/dist/cli/commands/seed/seed-users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-users.js","sourceRoot":"","sources":["../../../../src/cli/commands/seed/seed-users.ts"],"names":[],"mappings":"AA2CA,MAAM,CAAC,MAAM,QAAQ,GAAG;IACvB,KAAK,EAAE,eAAe;IACtB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,UAAU;CACY,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC9B,KAAK,EAAE,2BAA2B;IAClC,QAAQ,EAAE,iBAAiB;IAC3B,IAAI,EAAE,qBAAqB;CACC,CAAC;AAE9B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,eAAe,CAAwC,CAAC;AAE3F,MAAM,CAAC,MAAM,UAAU,GAAG;IACzB,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACrF,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACrF,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE;IACnF,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACvF,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE;CAC/C,CAAC;AAEzC,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAChC,EAAE,KAAK,EAAE,yBAAyB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,EAAE;IACxF;QACC,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,iBAAiB;QAC3B,IAAI,EAAE,eAAe;KACrB;CACsC,CAAC;AAEzC,MAAM,CAAC,MAAM,cAAc,GAAG;IAC7B,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;IACrF,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;IACrF,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE;IACvF,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE;CAChD,CAAC;AAEzC,MAAM,CAAC,MAAM,SAAS,GAAG;IACxB,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,gEAAgE;CACpE,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAChC,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE;IAChD,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChD,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAChD,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/C,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE;CACxC,CAAC"}

package/dist/cli/commands/setup/auth.setup.descriptor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Auth Setup CLI Command Descriptor
+ *
+ * Project git, npm/bun registry, and durable machine auth after login.
+ */
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.setup.descriptor.d.ts.map

package/dist/cli/commands/setup/auth.setup.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.setup.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/setup/auth.setup.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,QAAA,MAAM,UAAU,EAAE,yBAgCjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/commands/setup/auth.setup.descriptor.js

@@ -0,0 +1,37 @@
+/**
+ * Auth Setup CLI Command Descriptor
+ *
+ * Project git, npm/bun registry, and durable machine auth after login.
+ */
+const descriptor = {
+    kind: 'cli/command',
+    id: 'auth.setup',
+    name: 'setup',
+    description: 'Set up this machine for Vibes git and private packages, or repair it if something is missing',
+    group: 'auth',
+    options: [
+        {
+            flags: '--check',
+            description: 'Report git, registry, and package-auth status without writing'
+        },
+        {
+            flags: '--json',
+            description: 'Output as JSON'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    examples: [
+        {
+            command: 'vibes auth setup',
+            description: 'Write git remotes, npm/bun registry config, and durable package auth'
+        },
+        {
+            command: 'vibes auth setup --check',
+            description: 'Show whether this machine can clone and install private packages'
+        }
+    ]
+};
+export default descriptor;
+//# sourceMappingURL=auth.setup.descriptor.js.map

package/dist/cli/commands/setup/auth.setup.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.setup.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/commands/setup/auth.setup.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,OAAO;IACb,WAAW,EACV,8FAA8F;IAC/F,KAAK,EAAE,MAAM;IAEb,OAAO,EAAE;QACR;YACC,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,+DAA+D;SAC5E;QACD;YACC,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,gBAAgB;SAC7B;KACD;IAED,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,kBAAkB;YAC3B,WAAW,EAAE,sEAAsE;SACnF;QACD;YACC,OAAO,EAAE,0BAA0B;YACnC,WAAW,EAAE,kEAAkE;SAC/E;KACD;CACD,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/commands/setup/auth.setup.impl.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `vibes auth setup` — one beginner command that projects every machine
+ * integration login already promised: Forge git plus npm/bun registry auth.
+ *
+ * Owners stay with their commands. This umbrella queries `cli/command`
+ * `registry.setup` and `forge.setup-git` and never imports those packages'
+ * internals.
+ */
+declare const _default: import("@vibesdotdev/cli").CommandImplementation;
+export default _default;
+//# sourceMappingURL=auth.setup.impl.d.ts.map

package/dist/cli/commands/setup/auth.setup.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.setup.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/setup/auth.setup.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;;AA2CH,wBAsFG"}

package/dist/cli/commands/setup/auth.setup.impl.js

@@ -0,0 +1,129 @@
+/**
+ * `vibes auth setup` — one beginner command that projects every machine
+ * integration login already promised: Forge git plus npm/bun registry auth.
+ *
+ * Owners stay with their commands. This umbrella queries `cli/command`
+ * `registry.setup` and `forge.setup-git` and never imports those packages'
+ * internals.
+ */
+import * as z from 'zod/v4';
+import { isCapabilityError } from '@vibesdotdev/kernel';
+import { defineCommandImplementation } from '@vibesdotdev/cli';
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { writeJson } from '@vibesdotdev/cli/output';
+import { resolveCallerBearer } from "../../../bearer/caller-bearer.js";
+import { attempt, rethrowFailure } from "../../../features/utils/attempt.js";
+import { failureMessage } from "../../../client/request-failure.js";
+import { openAuthCommandOutput } from "../../command-io.js";
+const MACHINE_COMMANDS = [
+    { id: 'registry.setup', label: 'Packages' },
+    { id: 'forge.setup-git', label: 'Git' }
+];
+/**
+ * Package sign-in is the caller's bearer (rc05 §2.2: registry reads use it;
+ * `VIBES_REGISTRY_JWT` folded into `VIBES_REGISTRY_TOKEN`, never read here).
+ * Only a missing or expired login is a setup step to report; any other
+ * failure is thrown.
+ */
+async function packageSignIn(runtime) {
+    const resolved = await attempt(() => resolveCallerBearer(runtime));
+    if (resolved.ok) {
+        if (resolved.value)
+            return { ok: true, detail: 'bound' };
+    }
+    else {
+        const failure = resolved.failure;
+        if (!(failure instanceof Error && isCapabilityError(failure)) || failure.code !== 'AUTH_REQUIRED')
+            rethrowFailure(failure);
+        if (failure.reason === 'session-expired') {
+            return { ok: false, detail: 'Package auth expired. Run vibes auth login, then vibes auth setup.' };
+        }
+        if (failure.reason !== 'not-signed-in')
+            rethrowFailure(failure);
+    }
+    return { ok: false, detail: 'Not signed in. Run vibes auth login, then vibes auth setup.' };
+}
+export default defineCommandImplementation({
+    options: z.object({
+        check: z.boolean().optional(),
+        json: z.boolean().optional(),
+        format: z.string().optional()
+    }),
+    async execute(_args, options, context) {
+        const check = options.check === true;
+        const asJson = options.json === true || options.format === 'json';
+        const { runtime } = context;
+        const out = await openAuthCommandOutput(runtime);
+        const steps = [];
+        if (!check && !asJson) {
+            out.line('Setting up this machine for Vibes git and private packages.');
+        }
+        for (const command of MACHINE_COMMANDS) {
+            const outcome = await attempt(async () => {
+                const query = runtime.query('cli/command').withId(command.id);
+                // A command nobody registered is a missing install, not a fault; one whose loader fails is a fault.
+                if (!(await query.existsAsync()))
+                    return null;
+                const executable = await query.resolve();
+                await executable.execute({}, { check, quiet: true }, context);
+                return executable;
+            });
+            if (outcome.ok && outcome.value === null) {
+                steps.push({
+                    id: command.id,
+                    label: command.label,
+                    ok: false,
+                    detail: 'This Vibes install is missing that setup command.'
+                });
+            }
+            else if (outcome.ok) {
+                steps.push({
+                    id: command.id,
+                    label: command.label,
+                    ok: true,
+                    detail: check ? 'ready' : 'updated'
+                });
+            }
+            else {
+                steps.push({
+                    id: command.id,
+                    label: command.label,
+                    ok: false,
+                    detail: failureMessage(outcome.failure)
+                });
+            }
+        }
+        steps.push({ id: 'registry.token', label: 'Package sign-in', ...(await packageSignIn(runtime)) });
+        const failed = steps.filter((step) => !step.ok);
+        if (asJson) {
+            await writeJson(runtime, {
+                check,
+                ok: failed.length === 0,
+                steps: steps.map((step) => ({
+                    id: step.id,
+                    label: step.label,
+                    ok: step.ok,
+                    detail: step.detail
+                }))
+            });
+            if (failed.length > 0)
+                requestCLIExit(1);
+            return;
+        }
+        if (failed.length === 0) {
+            out.line(check
+                ? 'This machine is ready for Vibes git and private packages.'
+                : 'This machine is ready. New terminals pick up package auth automatically.\nIf something breaks later, run: vibes auth setup');
+            return;
+        }
+        out.line(check ? 'This machine still needs setup:' : 'Signed in, but this machine still needs a repair:');
+        for (const step of failed) {
+            out.line(`  ${step.label}: ${step.detail}`);
+        }
+        if (check) {
+            out.line('\nRun: vibes auth setup');
+        }
+        requestCLIExit(1);
+    }
+});
+//# sourceMappingURL=auth.setup.impl.js.map

package/dist/cli/commands/setup/auth.setup.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.setup.impl.js","sourceRoot":"","sources":["../../../../src/cli/commands/setup/auth.setup.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAG/D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,gBAAgB,GAAG;IACxB,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE;IAC3C,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE;CAC9B,CAAC;AAKX;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAC,OAAqB;IACjD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,QAAQ,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC1D,CAAC;SAAM,CAAC;QACP,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QACjC,IAAI,CAAC,CAAC,OAAO,YAAY,KAAK,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;YAAE,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3H,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oEAAoE,EAAE,CAAC;QACpG,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;YAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;AAC7F,CAAC;AAED,eAAe,2BAA2B,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC7B,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;QAClE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,KAAK,GAAsE,EAAE,CAAC;QAEpF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QACzE,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;gBACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAwC,aAAa,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACrG,oGAAoG;gBACpG,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAC9C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;gBACzC,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC9D,OAAO,UAAU,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,mDAAmD;iBAC3D,CAAC,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACvB,KAAK,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;iBACnC,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,IAAI,CAAC;oBACV,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;iBACvC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;QAElG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,CAAC,OAAO,EAAE;gBACxB,KAAK;gBACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;gBACvB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,MAAM,EAAE,IAAI,CAAC,MAAM;iBACnB,CAAC,CAAC;aACH,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,cAAc,CAAC,CAAC,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CACP,KAAK;gBACJ,CAAC,CAAC,2DAA2D;gBAC7D,CAAC,CAAC,4HAA4H,CAC/H,CAAC;YACF,OAAO;QACR,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC;QAC1G,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACrC,CAAC;QACD,cAAc,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;CACD,CAAC,CAAC"}

package/dist/cli/commands/status/auth.status.descriptor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Auth Status CLI Command Descriptor
+ *
+ * Show current authentication status.
+ */
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.status.descriptor.d.ts.map

package/dist/cli/commands/status/auth.status.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.status.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/status/auth.status.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,QAAA,MAAM,UAAU,EAAE,yBAiBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/commands/status/auth.status.descriptor.js

@@ -0,0 +1,23 @@
+/**
+ * Auth Status CLI Command Descriptor
+ *
+ * Show current authentication status.
+ */
+const descriptor = {
+    kind: 'cli/command',
+    id: 'auth.status',
+    name: 'status',
+    description: 'Show current authentication status',
+    group: 'auth',
+    options: [
+        {
+            flags: '--json',
+            description: 'Output as JSON'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth.status.descriptor.js.map

package/dist/cli/commands/status/auth.status.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.status.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/commands/status/auth.status.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,oCAAoC;IACjD,KAAK,EAAE,MAAM;IAEb,OAAO,EAAE;QACR;YACC,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,gBAAgB;SAC7B;KACD;IAED,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/commands/status/auth.status.impl.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Auth Status CLI Command Implementation
+ *
+ * Reports whether the CLI is *actually* authenticated — not merely whether
+ * a credential blob is stored. Presence-only checks false-positive when a
+ * stored apiKey/session is expired or rejected by auth-web
+ * (friction_b9ad9h6ca96m / dogfood 2026-06-08).
+ *
+ * Live probe uses `probeAuthCredential` (`GET /api/auth/token`) — the same
+ * session-to-JWT exchange forge, registry, and infra publish already use.
+ *
+ * Failure kinds (FINDINGS F6):
+ * - unauthorized → credential present but rejected (re-login may help)
+ * - unreachable → auth server down/network (do NOT advise re-login)
+ * - unknown → indeterminate
+ */
+declare const _default: import("@vibesdotdev/cli").CommandImplementation;
+export default _default;
+//# sourceMappingURL=auth.status.impl.d.ts.map

package/dist/cli/commands/status/auth.status.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.status.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/status/auth.status.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;;AAWH,wBAwGG"}

package/dist/cli/commands/status/auth.status.impl.js

@@ -0,0 +1,128 @@
+/**
+ * Auth Status CLI Command Implementation
+ *
+ * Reports whether the CLI is *actually* authenticated — not merely whether
+ * a credential blob is stored. Presence-only checks false-positive when a
+ * stored apiKey/session is expired or rejected by auth-web
+ * (friction_b9ad9h6ca96m / dogfood 2026-06-08).
+ *
+ * Live probe uses `probeAuthCredential` (`GET /api/auth/token`) — the same
+ * session-to-JWT exchange forge, registry, and infra publish already use.
+ *
+ * Failure kinds (FINDINGS F6):
+ * - unauthorized → credential present but rejected (re-login may help)
+ * - unreachable → auth server down/network (do NOT advise re-login)
+ * - unknown → indeterminate
+ */
+import * as z from 'zod/v4';
+import { defineCommandImplementation } from '@vibesdotdev/cli';
+import { writeJson } from '@vibesdotdev/cli/output';
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { getCredentials } from "../../../features/services/credential-store.js";
+import { executeAuthStatus } from "../../services/status.js";
+import { buildAuthCLIContext } from "../../context-bridge.js";
+import { openAuthCommandOutput } from "../../command-io.js";
+export default defineCommandImplementation({
+    options: z.object({ json: z.boolean().optional(), format: z.string().optional() }),
+    async execute(_args, options, command) {
+        const asJson = options.json === true || options.format === 'json';
+        const context = await buildAuthCLIContext(command.runtime);
+        const out = await openAuthCommandOutput(context.runtime);
+        const creds = await getCredentials(command.runtime);
+        const expiresAt = creds?.expiresAt;
+        const expiredLocal = expiresAt !== undefined && Number.isFinite(Date.parse(expiresAt))
+            ? Date.parse(expiresAt) < Date.now()
+            : false;
+        const credentialPresent = Boolean(creds && creds.type !== 'none');
+        // Live validity — not local presence.
+        const live = await executeAuthStatus({ output: asJson ? 'json' : 'table' }, context);
+        const authenticated = live.authenticated === true;
+        const reason = live.reason ?? null;
+        const failureMessage = (() => {
+            if (authenticated)
+                return 'Authenticated';
+            if (!credentialPresent)
+                return 'Not authenticated';
+            if (expiredLocal)
+                return `Credential expired${expiresAt ? ` (${expiresAt})` : ''}`;
+            if (reason === 'unreachable') {
+                // live.message names the probed origin (and flags a local one);
+                // never reduce it back to an origin-less "unreachable".
+                return live.message || 'Could not verify authentication — auth server unreachable';
+            }
+            if (reason === 'unknown') {
+                return live.message || 'Unable to verify authentication status';
+            }
+            // unauthorized (or missing reason with credential present)
+            return live.message || 'Credential stored but not accepted by auth server';
+        })();
+        if (asJson) {
+            const payload = {
+                authenticated,
+                // Distinct present-but-invalid signal for scripts
+                credentialPresent,
+                // Local wall-clock only — server rejection is reason unauthorized
+                expired: expiredLocal,
+                expiresAt: expiresAt ?? null,
+                type: creds?.type ?? 'none',
+                valid: authenticated,
+                // Scripts: distinguish outage from bad token without re-probing
+                reason: authenticated ? null : (reason ?? (credentialPresent ? 'unauthorized' : null)),
+                user: authenticated
+                    ? (live.user ??
+                        (creds
+                            ? {
+                                userId: creds.userId ?? null,
+                                email: creds.email ?? null,
+                                name: creds.name ?? null
+                            }
+                            : null))
+                    : null,
+                message: failureMessage,
+                subscription: live.subscription ?? null
+            };
+            await writeJson(context.runtime, payload);
+            // Fail closed so `auth status --json | jq -e .authenticated` and shell
+            // gates stay honest. Presence-only success was the dogfood footgun.
+            // Unreachable is also non-zero (cannot prove auth) but message is not "re-login".
+            if (!authenticated)
+                requestCLIExit(1);
+            return;
+        }
+        if (!authenticated) {
+            if (!credentialPresent) {
+                out.write('Not authenticated\n\nRun "vibes auth login" to authenticate.\n');
+            }
+            else if (expiredLocal) {
+                out.write(`Not authenticated (credential expired ${expiresAt})\n\nRun "vibes auth login" to authenticate.\n`);
+            }
+            else if (reason === 'unreachable') {
+                out.write('Could not verify authentication — auth server unreachable.\n\n' +
+                    'Check network connectivity and that auth.vibes.dev (or your configured auth origin) is up.\n' +
+                    'Do not re-login until the server is reachable — your stored credential may still be valid.\n');
+            }
+            else if (reason === 'unknown') {
+                out.write(`Unable to verify authentication status.\n\n${live.message}\n`);
+            }
+            else {
+                out.write('Not authenticated (credential stored but rejected by auth server)\n\nRun "vibes auth login" to refresh.\n');
+            }
+            requestCLIExit(1);
+            return;
+        }
+        out.write('Authenticated\n');
+        if (creds?.type)
+            out.write(`  Type: ${creds.type}\n`);
+        const user = live.user;
+        const email = user?.email ?? creds?.email;
+        const name = user?.name ?? creds?.name;
+        const userId = user?.userId ?? creds?.userId;
+        if (email)
+            out.write(`  Email: ${email}\n`);
+        if (name)
+            out.write(`  Name: ${name}\n`);
+        if (userId)
+            out.write(`  User ID: ${userId}\n`);
+    }
+});
+//# sourceMappingURL=auth.status.impl.js.map

package/dist/cli/commands/status/auth.status.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.status.impl.js","sourceRoot":"","sources":["../../../../src/cli/commands/status/auth.status.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,eAAe,2BAA2B,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IAClF,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,CAAC;QACnC,MAAM,YAAY,GACjB,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YACpC,CAAC,CAAC,KAAK,CAAC;QACV,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAElE,sCAAsC;QACtC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACrF,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAEnC,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE;YAC5B,IAAI,aAAa;gBAAE,OAAO,eAAe,CAAC;YAC1C,IAAI,CAAC,iBAAiB;gBAAE,OAAO,mBAAmB,CAAC;YACnD,IAAI,YAAY;gBAAE,OAAO,qBAAqB,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACnF,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;gBAC9B,gEAAgE;gBAChE,wDAAwD;gBACxD,OAAO,IAAI,CAAC,OAAO,IAAI,2DAA2D,CAAC;YACpF,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,OAAO,IAAI,wCAAwC,CAAC;YACjE,CAAC;YACD,2DAA2D;YAC3D,OAAO,IAAI,CAAC,OAAO,IAAI,mDAAmD,CAAC;QAC5E,CAAC,CAAC,EAAE,CAAC;QAEL,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG;gBACf,aAAa;gBACb,kDAAkD;gBAClD,iBAAiB;gBACjB,kEAAkE;gBAClE,OAAO,EAAE,YAAY;gBACrB,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,MAAM;gBAC3B,KAAK,EAAE,aAAa;gBACpB,gEAAgE;gBAChE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtF,IAAI,EAAE,aAAa;oBAClB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;wBACX,CAAC,KAAK;4BACL,CAAC,CAAC;gCACA,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;gCAC5B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gCAC1B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;6BACxB;4BACF,CAAC,CAAC,IAAI,CAAC,CAAC;oBACV,CAAC,CAAC,IAAI;gBACP,OAAO,EAAE,cAAc;gBACvB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;aACvC,CAAC;YACF,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC1C,uEAAuE;YACvE,oEAAoE;YACpE,kFAAkF;YAClF,IAAI,CAAC,aAAa;gBAAE,cAAc,CAAC,CAAC,CAAC,CAAC;YACtC,OAAO;QACR,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACxB,GAAG,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAC7E,CAAC;iBAAM,IAAI,YAAY,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,CACR,yCAAyC,SAAS,gDAAgD,CAClG,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;gBACrC,GAAG,CAAC,KAAK,CACR,gEAAgE;oBAC/D,8FAA8F;oBAC9F,8FAA8F,CAC/F,CAAC;YACH,CAAC;iBAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,GAAG,CAAC,KAAK,CACR,8CAA8C,IAAI,CAAC,OAAO,IAAI,CAC9D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,GAAG,CAAC,KAAK,CACR,2GAA2G,CAC3G,CAAC;YACH,CAAC;YACD,cAAc,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO;QACR,CAAC;QAED,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7B,IAAI,KAAK,EAAE,IAAI;YAAE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,KAAK,EAAE,KAAK,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,EAAE,MAAM,CAAC;QAC7C,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI;YAAE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,GAAG,CAAC,KAAK,CAAC,cAAc,MAAM,IAAI,CAAC,CAAC;IACjD,CAAC;CACD,CAAC,CAAC"}

package/dist/cli/commands/token/auth.token.descriptor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Auth Token CLI Command Descriptor
+ *
+ * Show or validate the current authentication token.
+ */
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.token.descriptor.d.ts.map

package/dist/cli/commands/token/auth.token.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.token.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/token/auth.token.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,QAAA,MAAM,UAAU,EAAE,yBAkBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}