@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/cli/schemas/types.d.ts

@@ -0,0 +1,108 @@
+import type { ApiClientImplementation } from '@vibesdotdev/client';
+import type { AuthConsumerRuntime } from '../../client/consumer-context.types.ts';
+import type { AuthProviderImplementation } from '../../schemas/provider.ts';
+export interface AuthCLIEnvironment {
+    id: string;
+    name?: string;
+    apiUrl: string;
+    headers: Record<string, string>;
+}
+export interface AuthCLILogger {
+    info: (msg: string) => void;
+    warn: (msg: string) => void;
+    error: (msg: string) => void;
+    debug: (msg: string) => void;
+}
+export interface AuthCLIExternalUrl {
+    open(url: string): Promise<void>;
+}
+export interface AuthCLIContext {
+    logger: AuthCLILogger;
+    environment: AuthCLIEnvironment;
+    auth: AuthProviderImplementation | null;
+    createClient: () => Promise<ApiClientImplementation>;
+    externalUrl?: AuthCLIExternalUrl;
+    /**
+     * The runtime this context was built against. Services thread it to the
+     * credential store and the auth origin, so a command reads and writes the
+     * credential of the runtime it resolves everything else from, and sends it
+     * only to that runtime's auth origin — never the ambient global's.
+     */
+    runtime: AuthConsumerRuntime;
+}
+export interface AuthApiKeyRecord {
+    id: string;
+    name: string;
+    prefix: string;
+    lastUsed?: string;
+    createdAt: string;
+    expiresAt?: string;
+}
+export interface AuthApiKeyListResult {
+    apiKeys: AuthApiKeyRecord[];
+}
+export interface CreatedAuthApiKey extends AuthApiKeyRecord {
+    key: string;
+}
+export interface AuthApiKeyCreateResult {
+    apiKey: CreatedAuthApiKey;
+}
+export interface AuthValidationUser {
+    id: string;
+    email: string;
+    name?: string;
+}
+export interface AuthValidationResult {
+    valid: boolean;
+    user?: AuthValidationUser;
+}
+export interface AuthPermissionRecord {
+    id: string;
+    name: string;
+    resource: string;
+    action: string;
+    description: string | null;
+}
+export interface AuthPermissionsApiResponse {
+    roles: Array<{
+        id: string;
+        name: string;
+        description: string | null;
+        projectId?: string | null;
+        permissions: AuthPermissionRecord[];
+    }>;
+    permissions: AuthPermissionRecord[];
+}
+export interface AuthPermissionsResult {
+    permissions: string[];
+}
+export interface AuthSessionResponse {
+    user?: AuthValidationUser | null;
+    session?: {
+        id: string;
+        userId: string;
+        expiresAt: string | Date;
+    } | null;
+}
+export interface AuthAPI {
+    apiKeys: {
+        list(): Promise<AuthApiKeyListResult>;
+        create(data: {
+            name: string;
+            expiresAt?: string;
+        }): Promise<AuthApiKeyCreateResult>;
+        delete(id: string): Promise<void>;
+    };
+    validate(): Promise<AuthValidationResult>;
+    permissions(): Promise<AuthPermissionsResult>;
+}
+export type CallbackUser = {
+    id: string;
+    email: string;
+    name?: string;
+};
+export type CallbackPayload = {
+    apiKey: string;
+    user?: CallbackUser;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/cli/schemas/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/cli/schemas/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAE5E,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,kBAAkB,CAAC;IAChC,IAAI,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACxC,YAAY,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;OAKG;IACH,OAAO,EAAE,mBAAmB,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACpC,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IAC1D,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IAC1C,KAAK,EAAE,KAAK,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,WAAW,EAAE,oBAAoB,EAAE,CAAC;KACpC,CAAC,CAAC;IACH,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACrC,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EACL;QACA,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,GACD,IAAI,CAAC;CACR;AAED,MAAM,WAAW,OAAO;IACvB,OAAO,EAAE;QACR,IAAI,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACpF,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAClC,CAAC;IAEF,QAAQ,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE1C,WAAW,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACxE,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAE,CAAC"}

package/dist/cli/schemas/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/cli/schemas/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/cli/schemas/types.ts"],"names":[],"mappings":""}

package/dist/cli/services/api-key.d.ts

@@ -0,0 +1,4 @@
+import type { AuthApiKeyInput, AuthApiKeyResult } from '../schemas/commands.ts';
+import type { AuthCLIContext } from '../schemas/types.ts';
+export declare function executeAuthApiKey(input: AuthApiKeyInput, context: AuthCLIContext): Promise<AuthApiKeyResult>;
+//# sourceMappingURL=api-key.d.ts.map

package/dist/cli/services/api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../../../src/cli/services/api-key.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA6C1D,wBAAsB,iBAAiB,CACtC,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,gBAAgB,CAAC,CA4F3B"}

package/dist/cli/services/api-key.js

@@ -0,0 +1,124 @@
+import * as z from 'zod/v4';
+import { attempt } from "../../features/utils/attempt.js";
+import { failureMessage } from "../../client/request-failure.js";
+/** What `GET /api/auth/api-keys` answers: the user's keys, by prefix only. */
+const listAnswerSchema = z.object({
+    apiKeys: z.array(z.object({
+        id: z.string(),
+        name: z.string(),
+        prefix: z.string(),
+        lastUsed: z.string().optional(),
+        createdAt: z.string(),
+        expiresAt: z.string().optional()
+    }))
+});
+/** What `POST /api/auth/api-keys` answers: the created key, shown once. */
+const createdAnswerSchema = z.object({
+    apiKey: z.object({
+        id: z.string(),
+        name: z.string(),
+        key: z.string(),
+        createdAt: z.string(),
+        expiresAt: z.string().optional()
+    })
+});
+function toDate(value) {
+    if (value instanceof Date) {
+        return value;
+    }
+    const parsed = z.string().safeParse(value);
+    if (!parsed.success) {
+        return null;
+    }
+    const date = new Date(parsed.data);
+    if (Number.isNaN(date.getTime())) {
+        return null;
+    }
+    return date;
+}
+export async function executeAuthApiKey(input, context) {
+    const outcome = await attempt(async () => {
+        const authClient = await context.createClient();
+        switch (input.action) {
+            case 'list': {
+                const listResult = listAnswerSchema.parse(await authClient.get('/api/auth/api-keys'));
+                const apiKeys = listResult.apiKeys.map((apiKey) => ({
+                    id: apiKey.id,
+                    name: apiKey.name,
+                    key: apiKey.prefix,
+                    createdAt: toDate(apiKey.createdAt) ?? new Date(),
+                    expiresAt: toDate(apiKey.expiresAt),
+                    lastUsedAt: toDate(apiKey.lastUsed) ?? null
+                }));
+                return {
+                    success: true,
+                    action: 'list',
+                    message: `Found ${apiKeys.length} API key(s)`,
+                    apiKeys
+                };
+            }
+            case 'create': {
+                if (!input.name) {
+                    return { success: false, action: 'create', message: 'API key name is required', apiKeys: [] };
+                }
+                const created = input.expiresAt
+                    ? await authClient.post('/api/auth/api-keys', {
+                        name: input.name,
+                        expiresAt: input.expiresAt.toISOString()
+                    })
+                    : await authClient.post('/api/auth/api-keys', { name: input.name });
+                const createResult = createdAnswerSchema.parse(created);
+                const apiKey = {
+                    id: createResult.apiKey.id,
+                    name: createResult.apiKey.name,
+                    key: createResult.apiKey.key,
+                    createdAt: toDate(createResult.apiKey.createdAt) ?? new Date(),
+                    expiresAt: toDate(createResult.apiKey.expiresAt),
+                    lastUsedAt: null
+                };
+                return {
+                    success: true,
+                    action: 'create',
+                    message: `Created API key: ${createResult.apiKey.name}`,
+                    apiKeys: [apiKey],
+                    newKey: createResult.apiKey.key
+                };
+            }
+            case 'revoke':
+            case 'delete': {
+                const keyId = input.id || input.keyId;
+                if (!keyId) {
+                    return {
+                        success: false,
+                        action: input.action,
+                        message: 'API key ID is required',
+                        apiKeys: []
+                    };
+                }
+                await authClient.delete(`/api/auth/api-keys/${encodeURIComponent(keyId)}`);
+                return {
+                    success: true,
+                    action: input.action,
+                    message: `Revoked API key: ${keyId}`,
+                    apiKeys: []
+                };
+            }
+            default:
+                return {
+                    success: false,
+                    action: input.action,
+                    message: `Unknown action: ${input.action}`,
+                    apiKeys: []
+                };
+        }
+    });
+    if (outcome.ok)
+        return outcome.value;
+    return {
+        success: false,
+        action: input.action,
+        message: `API key operation failed: ${failureMessage(outcome.failure)}`,
+        apiKeys: []
+    };
+}
+//# sourceMappingURL=api-key.js.map

package/dist/cli/services/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../../src/cli/services/api-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,KAAK,CACf,CAAC,CAAC,MAAM,CAAC;QACR,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC,CACF;CACD,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACF,CAAC,CAAC;AAEH,SAAS,MAAM,CAAC,KAAuC;IACtD,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,KAAsB,EACtB,OAAuB;IAEvB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAA+B,EAAE;QACnE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAEhD,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,GAAG,CAAU,oBAAoB,CAAC,CAAC,CAAC;gBAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;oBACnD,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,GAAG,EAAE,MAAM,CAAC,MAAM;oBAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE;oBACjD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;oBACnC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI;iBAC3C,CAAC,CAAC,CAAC;gBAEJ,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,aAAa;oBAC7C,OAAO;iBACP,CAAC;YACH,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACf,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;oBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBAC/F,CAAC;gBAED,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS;oBAC9B,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAU,oBAAoB,EAAE;wBACrD,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;qBACxC,CAAC;oBACH,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAU,oBAAoB,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9E,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAExD,MAAM,MAAM,GAAG;oBACd,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE;oBAC1B,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI;oBAC9B,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG;oBAC5B,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE;oBAC9D,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC;oBAChD,UAAU,EAAE,IAAI;iBAChB,CAAC;gBAEF,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,oBAAoB,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE;oBACvD,OAAO,EAAE,CAAC,MAAM,CAAC;oBACjB,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG;iBAC/B,CAAC;YACH,CAAC;YAED,KAAK,QAAQ,CAAC;YACd,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC;gBACtC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACZ,OAAO;wBACN,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,OAAO,EAAE,wBAAwB;wBACjC,OAAO,EAAE,EAAE;qBACX,CAAC;gBACH,CAAC;gBAED,MAAM,UAAU,CAAC,MAAM,CAAC,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC3E,OAAO;oBACN,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,OAAO,EAAE,oBAAoB,KAAK,EAAE;oBACpC,OAAO,EAAE,EAAE;iBACX,CAAC;YACH,CAAC;YAED;gBACC,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,OAAO,EAAE,mBAAmB,KAAK,CAAC,MAAM,EAAE;oBAC1C,OAAO,EAAE,EAAE;iBACX,CAAC;QACJ,CAAC;IACF,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,OAAO;QACN,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,6BAA6B,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QACvE,OAAO,EAAE,EAAE;KACX,CAAC;AACH,CAAC"}

package/dist/cli/services/app-jwt.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Credential→JWT exchange for CLI callers of app APIs (platform-web et al).
+ *
+ * App workers authorize a SIGNED JWT, not the durable credential the CLI
+ * stores. Mint one via auth-web `GET /api/auth/token` (better-auth jwt
+ * plugin): session tokens go as `Authorization: Bearer`, API keys (the device
+ * flow's durable credential) as `x-api-key`. Mirrors forge-cli's
+ * `resolveAppJwt`; lives here so every CLI surface consumes one exchange.
+ */
+import { getPathRoots } from '@vibesdotdev/paths';
+import { type CredentialStoreRuntime } from '../../features/services/credential-store.ts';
+import { type AuthEnvRuntime } from '../../config/env.ts';
+export type AppJwtRuntime = NonNullable<Parameters<typeof getPathRoots>[0]> & CredentialStoreRuntime & AuthEnvRuntime;
+/**
+ * Resolve a signed app JWT for the credential stored on `runtime`. `null`
+ * when no credential is stored. When auth-web refuses every exchange form
+ * for the credential (an API key today), the raw key is presented: app
+ * session handles validate it against auth-web's /api/api-keys/validate. A
+ * failed exchange (transport, status, body) throws `UNAVAILABLE`
+ * `app-jwt-mint-failed`; it never falls back to the durable credential.
+ */
+export declare function resolveCliAppJwt(runtime: AppJwtRuntime): Promise<string | null>;
+//# sourceMappingURL=app-jwt.d.ts.map

package/dist/cli/services/app-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-jwt.d.ts","sourceRoot":"","sources":["../../../src/cli/services/app-jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,YAAY,EAAkB,MAAM,oBAAoB,CAAC;AAGlE,OAAO,EAEN,KAAK,sBAAsB,EAC3B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAqB7E,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAC1E,sBAAsB,GACtB,cAAc,CAAC;AAmIhB;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBrF"}

package/dist/cli/services/app-jwt.js

@@ -0,0 +1,189 @@
+/**
+ * Credential→JWT exchange for CLI callers of app APIs (platform-web et al).
+ *
+ * App workers authorize a SIGNED JWT, not the durable credential the CLI
+ * stores. Mint one via auth-web `GET /api/auth/token` (better-auth jwt
+ * plugin): session tokens go as `Authorization: Bearer`, API keys (the device
+ * flow's durable credential) as `x-api-key`. Mirrors forge-cli's
+ * `resolveAppJwt`; lives here so every CLI surface consumes one exchange.
+ */
+import * as z from 'zod/v4';
+import { getPathRoots, getRuntimePath } from '@vibesdotdev/paths';
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { CapabilityError, valueFreeFailure } from '@vibesdotdev/kernel';
+import { getCredentials } from "../../features/services/credential-store.js";
+import { resolveAuthOrigin } from "../../config/env.js";
+import { attempt, attemptSync } from "../../features/utils/attempt.js";
+import { failureMessage } from "../../client/request-failure.js";
+import { decodeJWTUnsafe } from "../../jwt/index.js";
+/** A cached JWT is reused only while it has at least this long left before its own `exp`. */
+const FRESH_JWT_MIN_LIFETIME_MS = 30 * 1000;
+/** The machine secret that keys the cache's credential HMAC, stable across CLI processes. */
+const CACHE_KEY_SECRET = 'VIBES_APP_JWT_CACHE_KEY';
+function looksLikeJwt(token) {
+    return token.split('.').length === 3;
+}
+/** The cache is per user: it sits in the runtime's active (profile) home. */
+async function diskCachePath(runtime) {
+    return (await getRuntimePath(runtime)).join(getPathRoots(runtime).activeHome, 'app-jwt-cache.json');
+}
+/** What the disk cache holds: the login's HMAC under the machine cache key, and the minted JWT. */
+const diskCacheSchema = z.looseObject({ mac: z.string(), jwt: z.string() });
+/**
+ * The HMAC key for the cache, held in the machine's secrets store and created
+ * on first use. `null` (no cache) when no tier is declared, no store is
+ * composed, or the store refuses: the cache degrades, it never fails a call.
+ */
+async function cacheMacKey(runtime) {
+    const tier = runtime.scope.qualifiers.environmentTier;
+    if (!tier || !runtime.hasKind('secrets/store'))
+        return null;
+    const stored = await runtime.resolveCredential({ source: 'secret', key: CACHE_KEY_SECRET });
+    let keyHex;
+    if (stored.ok) {
+        keyHex = stored.value;
+    }
+    else if (stored.error.reason === 'credential-not-set') {
+        keyHex = Array.from(crypto.getRandomValues(new Uint8Array(32)), (byte) => byte.toString(16).padStart(2, '0')).join('');
+        const written = await attempt(async () => {
+            const store = await runtime.query('secrets/store').enabled().select();
+            if (!store)
+                throw new CapabilityError('No secrets store resolves for the app JWT cache key.', 'UNAVAILABLE', { reason: 'no-store' });
+            await store.impl.set(tier, CACHE_KEY_SECRET, keyHex);
+        });
+        if (!written.ok)
+            return null;
+    }
+    else {
+        return null;
+    }
+    const raw = Uint8Array.from(keyHex.match(/../g) ?? [], (pair) => Number.parseInt(pair, 16));
+    if (raw.byteLength < 32)
+        return null;
+    return crypto.subtle.importKey('raw', raw, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+}
+async function credentialMac(key, token) {
+    const mac = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(token));
+    return Array.from(new Uint8Array(mac), (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+/** A JWT with at least {@link FRESH_JWT_MIN_LIFETIME_MS} left before its own `exp`; one without an `exp` is not kept. */
+function isFreshJwt(token) {
+    const exp = decodeJWTUnsafe(token)?.exp;
+    return exp !== undefined && exp * 1000 > Date.now() + FRESH_JWT_MIN_LIFETIME_MS;
+}
+async function readDiskCache(runtime, key, sessionToken) {
+    const files = await resolveFileSystemAdapter(runtime, { binding: false });
+    const file = await diskCachePath(runtime);
+    // No cache yet: mint fresh. Any other read failure propagates.
+    if (!(await files.exists(file)))
+        return null;
+    const raw = await files.readFile(file, 'utf8');
+    const decoded = attemptSync(() => diskCacheSchema.safeParse(JSON.parse(String(raw))));
+    if (!decoded.ok) {
+        throw new CapabilityError(`The app JWT cache ${file} is not valid JSON.`, 'INTERNAL', {
+            reason: 'data-corrupt',
+            retryable: false,
+            recoveryHint: `Delete ${file}; the next call mints a fresh JWT.`,
+            // Value-free facts only: the parser's text can quote the cached JWT.
+            cause: valueFreeFailure(decoded.failure)
+        });
+    }
+    // A cache of another shape (an older layout) is a miss, as is an expiring or foreign one.
+    if (!decoded.value.success)
+        return null;
+    const cache = decoded.value.data;
+    if (cache.mac === (await credentialMac(key, sessionToken)) && isFreshJwt(cache.jwt))
+        return cache.jwt;
+    return null;
+}
+async function writeDiskCache(runtime, key, sessionToken, jwt) {
+    // A failed cache write propagates; it is never silently skipped.
+    const files = await resolveFileSystemAdapter(runtime, { binding: false });
+    const file = await diskCachePath(runtime);
+    await files.mkdir(getPathRoots(runtime).activeHome, { recursive: true });
+    // Owner-only before it holds anything: an empty temporary file is made 0600,
+    // then the JWT is written into it and it replaces the cache in one rename.
+    const temporary = `${file}.${crypto.randomUUID()}.tmp`;
+    await files.writeFile(temporary, '', { mode: 0o600 });
+    try {
+        await files.writeFile(temporary, JSON.stringify({ mac: await credentialMac(key, sessionToken), jwt }), { mode: 0o600 });
+        await files.rename(temporary, file);
+    }
+    catch (error) {
+        await attempt(() => files.remove(temporary));
+        throw error;
+    }
+}
+function mintFailed(url, message, details, failure) {
+    const options = {
+        reason: 'app-jwt-mint-failed',
+        retryable: true,
+        details: { url, ...details }
+    };
+    // The failed request carries the credential as a header: only its value-free facts are the cause.
+    if (failure !== undefined)
+        options.cause = valueFreeFailure(failure);
+    return new CapabilityError(`App JWT mint at ${url} failed: ${message}`, 'UNAVAILABLE', options);
+}
+/** What auth-web's `GET /api/auth/token` answers with when it mints. */
+const mintAnswerSchema = z.looseObject({ token: z.string().min(1) });
+/**
+ * One exchange attempt with one credential form. `null` means auth-web refused
+ * this form (401/403), so the caller tries the next; any other outcome that is
+ * not a token (a transport error, another status, an unreadable body) is a
+ * typed mint failure.
+ */
+async function mintJwt(url, form, headers) {
+    const sent = await attempt(() => fetch(url, { method: 'GET', headers }));
+    if (!sent.ok)
+        throw mintFailed(url, failureMessage(sent.failure), { form }, sent.failure);
+    const res = sent.value;
+    if (res.status === 401 || res.status === 403)
+        return null;
+    if (!res.ok)
+        throw mintFailed(url, `HTTP ${res.status}`, { form, status: res.status });
+    const read = await attempt(() => res.json());
+    if (!read.ok)
+        throw mintFailed(url, 'the response was not JSON', { form, status: res.status }, read.failure);
+    const answer = mintAnswerSchema.safeParse(read.value);
+    if (!answer.success)
+        throw mintFailed(url, 'the response named no token', { form, status: res.status });
+    return answer.data.token;
+}
+/**
+ * Resolve a signed app JWT for the credential stored on `runtime`. `null`
+ * when no credential is stored. When auth-web refuses every exchange form
+ * for the credential (an API key today), the raw key is presented: app
+ * session handles validate it against auth-web's /api/api-keys/validate. A
+ * failed exchange (transport, status, body) throws `UNAVAILABLE`
+ * `app-jwt-mint-failed`; it never falls back to the durable credential.
+ */
+export async function resolveCliAppJwt(runtime) {
+    const creds = await getCredentials(runtime);
+    const sessionToken = creds?.token;
+    if (!sessionToken)
+        return null;
+    if (looksLikeJwt(sessionToken))
+        return sessionToken;
+    // Cross-invocation cache — avoids a network mint on every CLI command.
+    const key = await cacheMacKey(runtime);
+    const cached = key ? await readDiskCache(runtime, key, sessionToken) : null;
+    if (cached)
+        return cached;
+    const url = `${await resolveAuthOrigin(runtime)}/api/auth/token`;
+    // Order matters: the device flow's durable credential is a better-auth
+    // SESSION token (stored as `apiKey`), and better-auth sessions
+    // authenticate via cookie — bearer/x-api-key forms 401 on /api/auth/token.
+    const jwt = (await mintJwt(url, 'secure-cookie', { Cookie: `__Secure-better-auth.session_token=${sessionToken}` })) ??
+        (await mintJwt(url, 'cookie', { Cookie: `better-auth.session_token=${sessionToken}` })) ??
+        (await mintJwt(url, 'bearer', { Authorization: `Bearer ${sessionToken}` })) ??
+        (await mintJwt(url, 'api-key', { 'x-api-key': sessionToken }));
+    // Every form refused: no JWT is mintable for this credential (API keys
+    // today), so the raw key is presented for auth-web's key validation.
+    if (!jwt)
+        return sessionToken;
+    if (key && isFreshJwt(jwt))
+        await writeDiskCache(runtime, key, sessionToken, jwt);
+    return jwt;
+}
+//# sourceMappingURL=app-jwt.js.map

package/dist/cli/services/app-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-jwt.js","sourceRoot":"","sources":["../../../src/cli/services/app-jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAA2E,MAAM,qBAAqB,CAAC;AACjJ,OAAO,EACN,cAAc,EAEd,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAuB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,6FAA6F;AAC7F,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,6FAA6F;AAC7F,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACtC,CAAC;AAYD,6EAA6E;AAC7E,KAAK,UAAU,aAAa,CAAC,OAAsB;IAClD,OAAO,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;AACrG,CAAC;AAED,mGAAmG;AACnG,MAAM,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAK5E;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,OAAsB;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC;IACtD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5F,IAAI,MAAc,CAAC;IACnB,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IACvB,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACzD,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;YACxC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAwC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC;YAC7G,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,eAAe,CAAC,sDAAsD,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACrI,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;IAC9B,CAAC;SAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,GAAG,CAAC,UAAU,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAc,EAAE,KAAa;IACzD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,yHAAyH;AACzH,SAAS,UAAU,CAAC,KAAa;IAChC,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACxC,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,yBAAyB,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAsB,EAAE,GAAc,EAAE,YAAoB;IACxF,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,qBAAqB,IAAI,qBAAqB,EAAE,UAAU,EAAE;YACrF,MAAM,EAAE,cAAc;YACtB,SAAS,EAAE,KAAK;YAChB,YAAY,EAAE,UAAU,IAAI,oCAAoC;YAChE,qEAAqE;YACrE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC;SACxC,CAAC,CAAC;IACJ,CAAC;IACD,0FAA0F;IAC1F,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IACjC,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IACtG,OAAO,IAAI,CAAC;AACb,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,OAAsB,EACtB,GAAc,EACd,YAAoB,EACpB,GAAW;IAEX,iEAAiE;IACjE,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;IACvD,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxH,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,OAAe,EAAE,OAAwC,EAAE,OAAuB;IAClH,MAAM,OAAO,GAA2B;QACvC,MAAM,EAAE,qBAAqB;QAC7B,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE;KAC5B,CAAC;IACF,kGAAkG;IAClG,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrE,OAAO,IAAI,eAAe,CAAC,mBAAmB,GAAG,YAAY,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AACjG,CAAC;AAED,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAErE;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,OAA+B;IAChF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,2BAA2B,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,6BAA6B,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACxG,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAsB;IAC5D,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,EAAE,KAAK,CAAC;IAClC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,YAAY,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IACpD,uEAAuE;IACvE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACjE,uEAAuE;IACvE,+DAA+D;IAC/D,2EAA2E;IAC3E,MAAM,GAAG,GACR,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,sCAAsC,YAAY,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,6BAA6B,YAAY,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAChE,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC;IAC9B,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;IAClF,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/cli/services/auth-probe-failure.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Classify failures from live auth probes (`/api/user/me`, `/api/auth/get-session`).
+ *
+ * Dogfood footgun (FINDINGS F6): collapsing network/server outages into
+ * "credential rejected → re-login" makes operators burn time re-authing when
+ * auth-web is simply down or unreachable.
+ */
+import type { CaughtFailure } from '@vibesdotdev/kernel';
+export type AuthProbeFailureKind = 'unauthorized' | 'unreachable' | 'unknown';
+/**
+ * Pure classifier for auth live-probe errors.
+ */
+export declare function classifyAuthProbeFailure(err: CaughtFailure): AuthProbeFailureKind;
+/** Prefer the more specific kind when merging sequential probe failures. */
+export declare function mergeAuthProbeFailureKinds(a: AuthProbeFailureKind | null, b: AuthProbeFailureKind): AuthProbeFailureKind;
+export declare function messageForAuthProbeFailure(kind: AuthProbeFailureKind, origin?: string | null): string;
+//# sourceMappingURL=auth-probe-failure.d.ts.map

package/dist/cli/services/auth-probe-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-probe-failure.d.ts","sourceRoot":"","sources":["../../../src/cli/services/auth-probe-failure.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,aAAa,GAAG,SAAS,CAAC;AAiB9E;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,aAAa,GAAG,oBAAoB,CAiDjF;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CACzC,CAAC,EAAE,oBAAoB,GAAG,IAAI,EAC9B,CAAC,EAAE,oBAAoB,GACrB,oBAAoB,CAWtB;AAED,wBAAgB,0BAA0B,CACzC,IAAI,EAAE,oBAAoB,EAC1B,MAAM,GAAE,MAAM,GAAG,IAAW,GAC1B,MAAM,CAmBR"}

package/dist/cli/services/auth-probe-failure.js

@@ -0,0 +1,109 @@
+/**
+ * Classify failures from live auth probes (`/api/user/me`, `/api/auth/get-session`).
+ *
+ * Dogfood footgun (FINDINGS F6): collapsing network/server outages into
+ * "credential rejected → re-login" makes operators burn time re-authing when
+ * auth-web is simply down or unreachable.
+ */
+import * as z from 'zod/v4';
+/** Where a failed probe carries its HTTP status: on the error, or on the response it holds. */
+const probeStatusSchema = z.looseObject({
+    status: z.number().optional().catch(undefined),
+    statusCode: z.number().optional().catch(undefined),
+    httpStatus: z.number().optional().catch(undefined),
+    response: z.looseObject({ status: z.number().optional().catch(undefined) }).optional().catch(undefined)
+});
+function extractHttpStatus(failure) {
+    const carrier = probeStatusSchema.safeParse(failure instanceof Error ? failure : failure.value);
+    if (!carrier.success)
+        return null;
+    const { status, statusCode, httpStatus, response } = carrier.data;
+    return status ?? statusCode ?? httpStatus ?? response?.status ?? null;
+}
+/**
+ * Pure classifier for auth live-probe errors.
+ */
+export function classifyAuthProbeFailure(err) {
+    const status = extractHttpStatus(err);
+    if (status === 401 || status === 403)
+        return 'unauthorized';
+    // Wrong origin / missing route is an environment/outage problem, not a bad token.
+    if (status === 404)
+        return 'unreachable';
+    if (status !== null && status >= 500)
+        return 'unreachable';
+    const msg = (err instanceof Error ? err.message : err.description).toLowerCase();
+    if (/\b401\b/.test(msg) || /\b403\b/.test(msg))
+        return 'unauthorized';
+    if (/\b404\b/.test(msg) || /\b5\d{2}\b/.test(msg))
+        return 'unreachable';
+    if (msg.includes('unauthorized') ||
+        msg.includes('forbidden') ||
+        msg.includes('invalid credentials') ||
+        msg.includes('not authenticated') ||
+        msg.includes('invalid token') ||
+        msg.includes('token expired') ||
+        msg.includes('session expired')) {
+        return 'unauthorized';
+    }
+    if (msg.includes('econnrefused') ||
+        msg.includes('enotfound') ||
+        msg.includes('etimedout') ||
+        msg.includes('econnreset') ||
+        msg.includes('network') ||
+        msg.includes('fetch failed') ||
+        msg.includes('failed to fetch') ||
+        msg.includes('unable to connect') ||
+        msg.includes('socket') ||
+        msg.includes('dns') ||
+        msg.includes('abort') ||
+        msg.includes('timeout') ||
+        msg.includes('certificate') ||
+        msg.includes('ssl') ||
+        msg.includes('tls') ||
+        msg.includes('service unavailable')) {
+        return 'unreachable';
+    }
+    // Other 4xx without auth wording — treat as unknown (not "re-login")
+    if (status !== null && status >= 400 && status < 500)
+        return 'unknown';
+    return 'unknown';
+}
+/** Prefer the more specific kind when merging sequential probe failures. */
+export function mergeAuthProbeFailureKinds(a, b) {
+    if (!a)
+        return b;
+    // unauthorized wins over unknown — we saw a clear auth rejection
+    if (a === 'unauthorized' || b === 'unauthorized')
+        return 'unauthorized';
+    // unreachable only if both sides are unreachable/unknown and neither is unauthorized
+    if (a === 'unreachable' || b === 'unreachable') {
+        if (a === 'unknown' && b === 'unreachable')
+            return 'unreachable';
+        if (a === 'unreachable' && b === 'unknown')
+            return 'unreachable';
+        if (a === 'unreachable' && b === 'unreachable')
+            return 'unreachable';
+    }
+    return a === b ? a : 'unknown';
+}
+export function messageForAuthProbeFailure(kind, origin = null) {
+    // Always NAME the probed origin. A dev workspace resolves the LOCAL auth
+    // origin; "auth server unreachable" without it reads as a production
+    // outage when the failure is a stopped local daemon (2026-08-18 incident:
+    // auth.vibes.local answered 502 while auth.vibes.dev was healthy, and the
+    // bare message sent an operator chasing the wrong server).
+    const at = origin ? ` at ${origin}` : '';
+    const localHint = origin && /\.local(?::\d+)?$|127\.0\.0\.1|localhost/.test(origin)
+        ? ' (this is the LOCAL dev origin — production may be fine; check the local auth daemon or your VIBES_AUTH_ORIGIN/environment)'
+        : '';
+    switch (kind) {
+        case 'unauthorized':
+            return `Credential stored but not accepted by auth server${at}`;
+        case 'unreachable':
+            return `Could not verify authentication — auth server unreachable${at}${localHint}`;
+        default:
+            return `Unable to verify authentication status${at ? ` (probed${at})` : ''}`;
+    }
+}
+//# sourceMappingURL=auth-probe-failure.js.map

package/dist/cli/services/auth-probe-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-probe-failure.js","sourceRoot":"","sources":["../../../src/cli/services/auth-probe-failure.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,+FAA+F;AAC/F,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CACvG,CAAC,CAAC;AAEH,SAAS,iBAAiB,CAAC,OAAsB;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChG,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAClE,OAAO,MAAM,IAAI,UAAU,IAAI,UAAU,IAAI,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAkB;IAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC;IAC5D,kFAAkF;IAClF,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,aAAa,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,aAAa,CAAC;IAE3D,MAAM,GAAG,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjF,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC;IACtE,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC;IAExE,IACC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAC9B,CAAC;QACF,OAAO,cAAc,CAAC;IACvB,CAAC;IAED,IACC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC1B,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC5B,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC3B,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnB,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAClC,CAAC;QACF,OAAO,aAAa,CAAC;IACtB,CAAC;IAED,qEAAqE;IACrE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAEvE,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B,CACzC,CAA8B,EAC9B,CAAuB;IAEvB,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,cAAc;QAAE,OAAO,cAAc,CAAC;IACxE,qFAAqF;IACrF,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;QAChD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,aAAa;YAAE,OAAO,aAAa,CAAC;QACjE,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC;QACjE,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,aAAa;YAAE,OAAO,aAAa,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,IAA0B,EAC1B,SAAwB,IAAI;IAE5B,yEAAyE;IACzE,qEAAqE;IACrE,0EAA0E;IAC1E,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,MAAM,SAAS,GACd,MAAM,IAAI,0CAA0C,CAAC,IAAI,CAAC,MAAM,CAAC;QAChE,CAAC,CAAC,6HAA6H;QAC/H,CAAC,CAAC,EAAE,CAAC;IACP,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,cAAc;YAClB,OAAO,oDAAoD,EAAE,EAAE,CAAC;QACjE,KAAK,aAAa;YACjB,OAAO,4DAA4D,EAAE,GAAG,SAAS,EAAE,CAAC;QACrF;YACC,OAAO,yCAAyC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC/E,CAAC;AACF,CAAC"}

package/dist/cli/services/auth.d.ts

@@ -0,0 +1,7 @@
+export { handleDeviceAuth, executeAuthLogin } from './login.ts';
+export { executeAuthStatus } from './status.ts';
+export { executeAuthLogout } from './logout.ts';
+export { executeAuthToken } from './token.ts';
+export { executeAuthProfile } from './profile.ts';
+export { executeAuthApiKey } from './api-key.ts';
+//# sourceMappingURL=auth.d.ts.map