@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/cli/services/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/services/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/cli/services/auth.js

@@ -0,0 +1,7 @@
+export { handleDeviceAuth, executeAuthLogin } from "./login.js";
+export { executeAuthStatus } from "./status.js";
+export { executeAuthLogout } from "./logout.js";
+export { executeAuthToken } from "./token.js";
+export { executeAuthProfile } from "./profile.js";
+export { executeAuthApiKey } from "./api-key.js";
+//# sourceMappingURL=auth.js.map

package/dist/cli/services/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/services/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/cli/services/bootstrap-session.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Adopt the session the thin `vibes` shim obtained during a first install.
+ *
+ * The host graph cannot be installed without a registry credential, and
+ * `vibes auth login` lives inside that graph. So the shim runs the same device
+ * sign-in itself (`apps/cli-bin/src/bin/thin/bootstrap-sign-in.ts`) and passes
+ * the approved session to the host as an ARGUMENT:
+ * `startHost({ bootstrap: { session } })` in `@vibesdotdev/plugins`. The host
+ * binds that bootstrap into the runtime it composes as runtime-local context
+ * (`HOST_BOOTSTRAP_CONTEXT_ID`, owned by `@vibesdotdev/cli/host-bootstrap`).
+ * This module is the auth half of the contract: it validates the session with auth's own schema, stores it through the
+ * credential store, and the auth plugin then binds it and emits
+ * `auth.login.succeeded`, so every post-login projection (registry client
+ * config, Forge git, SSH) runs as if the user had typed `vibes auth login`.
+ *
+ * Only the composing runtime can read the context. No process global, no
+ * environment variable and no file carries the session, so no other runtime,
+ * child process or daemon can see it.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, type RuntimeRef } from '@vibesdotdev/kernel';
+export declare const bootstrapSessionSchema: z.ZodObject<{
+    authOrigin: z.ZodString;
+    sessionToken: z.ZodString;
+    refreshToken: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    method: z.ZodLiteral<"device">;
+}, z.core.$strict>;
+export type BootstrapSession = z.infer<typeof bootstrapSessionSchema>;
+/**
+ * The host carried a first-install session this package cannot adopt. The
+ * message names the failing fields and never includes their values.
+ */
+export declare class InvalidBootstrapSessionError extends CapabilityError {
+    constructor(message: string);
+}
+/** Validate a handed-off session, or throw `InvalidBootstrapSessionError`. */
+export declare function parseBootstrapSession(raw: unknown): BootstrapSession;
+/** The runtime slice adoption needs: its own context, and (for storage) its query surface. */
+export type BootstrapRuntime = Pick<RuntimeRef, 'hasContext' | 'context' | 'query' | 'hasKind' | 'getEnv' | 'getEnvSnapshot' | 'resolveCredential'>;
+/**
+ * Read the session the host bound into this runtime. Null when the runtime
+ * carries no bootstrap context or the bootstrap has no session; a malformed
+ * session throws `InvalidBootstrapSessionError`.
+ */
+export declare function readBootstrapSession(runtime: BootstrapRuntime): Promise<BootstrapSession | null>;
+export type BootstrapAdoption = {
+    readonly status: 'none';
+} | {
+    readonly status: 'adopted';
+    readonly environment: string;
+} | {
+    readonly status: 'skipped';
+    readonly reason: string;
+} | {
+    readonly status: 'failed';
+    readonly reason: string;
+};
+/**
+ * Store the session the host carries for this runtime.
+ *
+ * A session minted against a different auth origin than this host's
+ * environment is `skipped`: storing it would sign the host in to the wrong
+ * place. A store that refuses it is `failed`. Both carry a reason the caller
+ * reports; neither is silent.
+ */
+export declare function adoptBootstrapSession(runtime: RuntimeRef): Promise<BootstrapAdoption>;
+//# sourceMappingURL=bootstrap-session.d.ts.map

package/dist/cli/services/bootstrap-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-session.d.ts","sourceRoot":"","sources":["../../../src/cli/services/bootstrap-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAMvE,eAAO,MAAM,sBAAsB;;;;;;kBAQzB,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,eAAe;gBACpD,OAAO,EAAE,MAAM;CAI3B;AAMD,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAQpE;AAED,8FAA8F;AAC9F,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAClC,UAAU,EACV,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,mBAAmB,CAClG,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAUtG;AASD,MAAM,MAAM,iBAAiB,GAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAc3F"}

package/dist/cli/services/bootstrap-session.js

@@ -0,0 +1,102 @@
+/**
+ * Adopt the session the thin `vibes` shim obtained during a first install.
+ *
+ * The host graph cannot be installed without a registry credential, and
+ * `vibes auth login` lives inside that graph. So the shim runs the same device
+ * sign-in itself (`apps/cli-bin/src/bin/thin/bootstrap-sign-in.ts`) and passes
+ * the approved session to the host as an ARGUMENT:
+ * `startHost({ bootstrap: { session } })` in `@vibesdotdev/plugins`. The host
+ * binds that bootstrap into the runtime it composes as runtime-local context
+ * (`HOST_BOOTSTRAP_CONTEXT_ID`, owned by `@vibesdotdev/cli/host-bootstrap`).
+ * This module is the auth half of the contract: it validates the session with auth's own schema, stores it through the
+ * credential store, and the auth plugin then binds it and emits
+ * `auth.login.succeeded`, so every post-login projection (registry client
+ * config, Forge git, SSH) runs as if the user had typed `vibes auth login`.
+ *
+ * Only the composing runtime can read the context. No process global, no
+ * environment variable and no file carries the session, so no other runtime,
+ * child process or daemon can see it.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { HOST_BOOTSTRAP_CONTEXT_ID } from '@vibesdotdev/cli/host-bootstrap';
+import { buildAuthCLIContext } from "../context-bridge.js";
+import { persistDeviceSession } from "./login-device.cli.js";
+export const bootstrapSessionSchema = z
+    .object({
+    authOrigin: z.string().url(),
+    sessionToken: z.string().min(1),
+    refreshToken: z.string().min(1).optional(),
+    expiresAt: z.string().optional(),
+    method: z.literal('device')
+})
+    .strict();
+const hostBootstrapSchema = z.object({ session: z.unknown().optional() }).passthrough();
+/**
+ * The host carried a first-install session this package cannot adopt. The
+ * message names the failing fields and never includes their values.
+ */
+export class InvalidBootstrapSessionError extends CapabilityError {
+    constructor(message) {
+        super(message, 'INVALID_INPUT', { reason: 'bootstrap-session-invalid', retryable: false });
+        this.name = 'InvalidBootstrapSessionError';
+    }
+}
+function describeIssues(error) {
+    return error.issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`).join('; ');
+}
+/** Validate a handed-off session, or throw `InvalidBootstrapSessionError`. */
+export function parseBootstrapSession(raw) {
+    const parsed = bootstrapSessionSchema.safeParse(raw);
+    if (!parsed.success) {
+        throw new InvalidBootstrapSessionError(`The install sign-in handed to the CLI host is not a device session (${describeIssues(parsed.error)}).`);
+    }
+    return parsed.data;
+}
+/**
+ * Read the session the host bound into this runtime. Null when the runtime
+ * carries no bootstrap context or the bootstrap has no session; a malformed
+ * session throws `InvalidBootstrapSessionError`.
+ */
+export async function readBootstrapSession(runtime) {
+    if (!runtime.hasContext(HOST_BOOTSTRAP_CONTEXT_ID))
+        return null;
+    const bootstrap = hostBootstrapSchema.safeParse(await runtime.context(HOST_BOOTSTRAP_CONTEXT_ID));
+    if (!bootstrap.success) {
+        throw new InvalidBootstrapSessionError(`The CLI host bootstrap context is malformed (${describeIssues(bootstrap.error)}).`);
+    }
+    if (bootstrap.data.session === undefined)
+        return null;
+    return parseBootstrapSession(bootstrap.data.session);
+}
+function sameOrigin(left, right) {
+    // An unparseable URL (null) is not the same origin.
+    const a = URL.parse(left);
+    const b = URL.parse(right);
+    return a !== null && b !== null && a.origin === b.origin;
+}
+/**
+ * Store the session the host carries for this runtime.
+ *
+ * A session minted against a different auth origin than this host's
+ * environment is `skipped`: storing it would sign the host in to the wrong
+ * place. A store that refuses it is `failed`. Both carry a reason the caller
+ * reports; neither is silent.
+ */
+export async function adoptBootstrapSession(runtime) {
+    const session = await readBootstrapSession(runtime);
+    if (!session)
+        return { status: 'none' };
+    const context = await buildAuthCLIContext(runtime);
+    if (!sameOrigin(session.authOrigin, context.environment.apiUrl)) {
+        return {
+            status: 'skipped',
+            reason: `it was issued by ${session.authOrigin}, but this environment signs in at ${context.environment.apiUrl}`
+        };
+    }
+    const result = await persistDeviceSession(context, session);
+    return result.success
+        ? { status: 'adopted', environment: context.environment.id }
+        : { status: 'failed', reason: result.message };
+}
+//# sourceMappingURL=bootstrap-session.js.map

package/dist/cli/services/bootstrap-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-session.js","sourceRoot":"","sources":["../../../src/cli/services/bootstrap-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAG7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACrC,MAAM,CAAC;IACP,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAIX,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAExF;;;GAGG;AACH,MAAM,OAAO,4BAA6B,SAAQ,eAAe;IAChE,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC5C,CAAC;CACD;AAED,SAAS,cAAc,CAAC,KAAiB;IACxC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxG,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,GAAY;IACjD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,4BAA4B,CACrC,uEAAuE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACvG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAyB;IACnE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,OAAO,CAAU,yBAAyB,CAAC,CAAC,CAAC;IAC3G,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,4BAA4B,CACrC,gDAAgD,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CACnF,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC9C,oDAAoD;IACpD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;AAC1D,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAmB;IAC9D,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,OAAO;YACN,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,oBAAoB,OAAO,CAAC,UAAU,sCAAsC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE;SAChH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,OAAO;QACpB,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;QAC5D,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACjD,CAAC"}

package/dist/cli/services/login-device.cli.d.ts

@@ -0,0 +1,32 @@
+import type { AuthLoginResult } from '../schemas/commands.ts';
+import type { AuthCLIContext } from '../schemas/types.ts';
+/**
+ * Handle device-authorization (RFC 8628) login flow.
+ *
+ * 1. Requests a device code from the auth server.
+ * 2. Displays the user_code and opens the browser for approval.
+ * 3. Polls the token endpoint until the user approves/denies or the code expires.
+ * 4. Confirms the session and its identity via get-session.
+ * 5. Stores the session with that identity (`persistDeviceSession`).
+ */
+export declare function handleDeviceAuth(context: AuthCLIContext): Promise<AuthLoginResult>;
+/** A device-approved session, however it was obtained. */
+export interface DeviceSession {
+    sessionToken: string;
+    refreshToken?: string;
+    expiresAt?: string;
+}
+/**
+ * Confirm an approved device session with auth, then persist it with its
+ * identity.
+ *
+ * Shared by `vibes auth login` and the first-install handoff from the thin
+ * shim (`bootstrap-session.ts`), so a session stored either way is identical.
+ * When auth-web says it does not know the session, the login fails and
+ * nothing is stored, so the login already stored stays as it was. When
+ * auth-web gives no verdict (unreachable, an outage), the session it issued
+ * moments ago is stored and the user is told why the name and email are
+ * missing instead of finding out later.
+ */
+export declare function persistDeviceSession(context: AuthCLIContext, session: DeviceSession): Promise<AuthLoginResult>;
+//# sourceMappingURL=login-device.cli.d.ts.map

package/dist/cli/services/login-device.cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-device.cli.d.ts","sourceRoot":"","sources":["../../../src/cli/services/login-device.cli.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA2C1D;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CA+JxF;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,aAAa,GACpB,OAAO,CAAC,eAAe,CAAC,CA8D1B"}

package/dist/cli/services/login-device.cli.js

@@ -0,0 +1,296 @@
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { attempt, failureLabel } from "../../features/utils/attempt.js";
+import { isCredentialStoreRuntime, setCredentials } from "../../features/services/credential-store.js";
+import { sessionAuthorizationHeader } from "../../client/session-authorization.js";
+import { errorStatus, failureMessage, failureText, isTransportFailure } from "../../client/request-failure.js";
+import { GET_SESSION_PATH, readGetSessionAnswer } from "../../client/session-identity.js";
+import { auditLog } from '@vibesdotdev/logging';
+/** What `POST /api/auth/device/code` answers (RFC 8628 §3.2). */
+const deviceCodeSchema = z.looseObject({
+    device_code: z.string().min(1),
+    user_code: z.string().min(1),
+    verification_uri: z.string().min(1),
+    verification_uri_complete: z.string().optional().catch(undefined),
+    expires_in: z.number(),
+    interval: z.number().optional().catch(undefined)
+});
+/** What `POST /api/auth/device/token` answers: a protocol error, or the approved session. */
+const deviceTokenSchema = z.looseObject({
+    error: z.string().optional().catch(undefined),
+    access_token: z.string().min(1).optional().catch(undefined),
+    refresh_token: z.string().optional().catch(undefined),
+    expires_in: z.number().optional().catch(undefined)
+});
+const CLI_SCOPES = [
+    'profile:read',
+    'agents:read',
+    'agents:run',
+    'knowledge:read',
+    'knowledge:create',
+    'knowledge:update',
+    'knowledge:delete'
+].join(' ');
+/**
+ * Handle device-authorization (RFC 8628) login flow.
+ *
+ * 1. Requests a device code from the auth server.
+ * 2. Displays the user_code and opens the browser for approval.
+ * 3. Polls the token endpoint until the user approves/denies or the code expires.
+ * 4. Confirms the session and its identity via get-session.
+ * 5. Stores the session with that identity (`persistDeviceSession`).
+ */
+export async function handleDeviceAuth(context) {
+    // Resolve through the context's runtime (context-bridge createClient), not
+    // the ambient global — a scoped caller's ambient instance has no kinds.
+    const authClient = await context.createClient();
+    context.logger.info('Starting device authorization flow...');
+    const requested = await attempt(async () => deviceCodeSchema.parse(await authClient.post('/api/auth/device/code', { client_id: 'vibes-cli', scope: CLI_SCOPES }, { headers: { 'content-type': 'application/json' } })));
+    if (!requested.ok) {
+        const errMsg = failureMessage(requested.failure);
+        await auditLog({
+            category: 'authentication',
+            severity: 'medium',
+            action: 'device_code_request',
+            actor: { id: 'cli', type: 'user' },
+            outcome: 'failure',
+            context: { environment: context.environment.id },
+            error: `Failed to request device code: ${errMsg}`
+        }, context.runtime);
+        return { success: false, message: `Failed to request device code: ${errMsg}`, token: null };
+    }
+    const codeData = requested.value;
+    context.logger.info(`Your device code: ${codeData.user_code}`);
+    context.logger.info(`Visit ${codeData.verification_uri} to approve this device.`);
+    const completeUri = codeData.verification_uri_complete;
+    if (completeUri) {
+        const externalUrl = context.externalUrl;
+        const opened = externalUrl ? await attempt(() => externalUrl.open(completeUri)) : null;
+        // No opener on this surface, or the opener failed: the user follows the URL printed above.
+        if (!opened?.ok) {
+            context.logger.warn(opened
+                ? `Failed to open browser automatically (${failureLabel(opened.failure)}). Please visit the URL above.`
+                : 'Failed to open browser automatically. Please visit the URL above.');
+        }
+    }
+    // Step 2: Poll for token
+    const expiresAtMs = Date.now() + codeData.expires_in * 1000;
+    let pollIntervalMs = (codeData.interval ?? 5) * 1000;
+    while (Date.now() < expiresAtMs) {
+        await context.runtime.lifecycle.delay(pollIntervalMs);
+        const polled = await attempt(async () => deviceTokenSchema.parse(await authClient.post('/api/auth/device/token', {
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            device_code: codeData.device_code,
+            client_id: 'vibes-cli'
+        }, { headers: { 'content-type': 'application/json' } })));
+        if (!polled.ok) {
+            const errText = failureText(polled.failure);
+            const errMsg = failureMessage(polled.failure);
+            // OAuth device-flow polling errors arrive as HTTP 400 and surface
+            // here as thrown errors, not as 200-with-error bodies — keep polling.
+            if (errText.includes('authorization_pending')) {
+                context.logger.debug('Authorization pending...');
+                continue;
+            }
+            if (errText.includes('slow_down')) {
+                context.logger.debug('Polling slowed down by server...');
+                pollIntervalMs += 5000;
+                continue;
+            }
+            await auditLog({
+                category: 'authentication',
+                severity: 'medium',
+                action: 'device_token_poll',
+                actor: { id: 'cli', type: 'user' },
+                outcome: 'error',
+                context: { environment: context.environment.id },
+                error: errMsg
+            }, context.runtime);
+            return { success: false, message: `Token request failed: ${errMsg}`, token: null };
+        }
+        const tokenData = polled.value;
+        if (tokenData.error === 'authorization_pending') {
+            context.logger.debug('Authorization pending...');
+            continue;
+        }
+        if (tokenData.error === 'slow_down') {
+            context.logger.debug('Polling slowed down by server...');
+            pollIntervalMs += 5000;
+            continue;
+        }
+        if (tokenData.error === 'expired_token') {
+            await auditLog({
+                category: 'authentication',
+                severity: 'medium',
+                action: 'device_token_poll',
+                actor: { id: 'cli', type: 'user' },
+                outcome: 'failure',
+                context: { environment: context.environment.id },
+                error: 'Device code expired'
+            }, context.runtime);
+            return { success: false, message: 'Device code expired. Please try again.', token: null };
+        }
+        if (tokenData.error === 'access_denied') {
+            await auditLog({
+                category: 'authentication',
+                severity: 'medium',
+                action: 'device_token_poll',
+                actor: { id: 'cli', type: 'user' },
+                outcome: 'failure',
+                context: { environment: context.environment.id },
+                error: 'Access denied by user'
+            }, context.runtime);
+            return { success: false, message: 'Access denied by user.', token: null };
+        }
+        if (!tokenData.access_token) {
+            await auditLog({
+                category: 'authentication',
+                severity: 'medium',
+                action: 'device_token_poll',
+                actor: { id: 'cli', type: 'user' },
+                outcome: 'error',
+                context: { environment: context.environment.id },
+                error: 'Token response carried no access token'
+            }, context.runtime);
+            return { success: false, message: 'Token request failed: the answer carried no access token', token: null };
+        }
+        return persistDeviceSession(context, {
+            sessionToken: tokenData.access_token,
+            refreshToken: tokenData.refresh_token,
+            expiresAt: tokenData.expires_in
+                ? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()
+                : undefined
+        });
+    }
+    await auditLog({
+        category: 'authentication',
+        severity: 'medium',
+        action: 'device_token_poll',
+        actor: { id: 'cli', type: 'user' },
+        outcome: 'failure',
+        context: { environment: context.environment.id },
+        error: 'Device code expired (loop exit)'
+    }, context.runtime);
+    return { success: false, message: 'Device code expired. Please try again.', token: null };
+}
+/**
+ * Confirm an approved device session with auth, then persist it with its
+ * identity.
+ *
+ * Shared by `vibes auth login` and the first-install handoff from the thin
+ * shim (`bootstrap-session.ts`), so a session stored either way is identical.
+ * When auth-web says it does not know the session, the login fails and
+ * nothing is stored, so the login already stored stays as it was. When
+ * auth-web gives no verdict (unreachable, an outage), the session it issued
+ * moments ago is stored and the user is told why the name and email are
+ * missing instead of finding out later.
+ */
+export async function persistDeviceSession(context, session) {
+    const { sessionToken, refreshToken, expiresAt } = session;
+    const environmentName = context.environment.id;
+    const runtime = credentialStoreRuntime(context);
+    // Confirm before storing. The bearer is passed EXPLICITLY: the runtime's
+    // api/client#auth carries no credential of its own, and an unauthenticated
+    // get-session quietly returns no user (the bug that left the TUI status
+    // line reading 'local' after a successful sign-in).
+    const identity = await readDeviceIdentity(context, sessionToken);
+    if (identity.status === 'rejected') {
+        await auditLog({
+            category: 'authentication',
+            severity: 'medium',
+            action: 'login',
+            actor: { id: 'cli', type: 'user' },
+            outcome: 'failure',
+            context: { method: 'device_code', environment: environmentName },
+            error: identity.reason
+        }, context.runtime);
+        return {
+            success: false,
+            message: `Sign-in failed: ${identity.reason}. Nothing was stored; run \`vibes auth login\` again.`,
+            token: null
+        };
+    }
+    const user = identity.status === 'confirmed' ? identity.user : undefined;
+    const stored = {
+        mode: 'replace-session', sessionToken, refreshToken, expiresAt
+    };
+    if (user) {
+        stored.userId = user.userId;
+        stored.email = user.email;
+        stored.name = user.name ?? undefined;
+    }
+    await setCredentials(stored, environmentName, runtime);
+    if (identity.status === 'unconfirmed') {
+        context.logger.warn(`Signed in, but your account could not be confirmed: ${identity.reason}. ` +
+            'The session is saved without a confirmed name and email; run `vibes auth login` again to retry.');
+    }
+    await auditLog({
+        category: 'authentication',
+        severity: 'medium',
+        action: 'login',
+        actor: user ? { id: user.userId, type: 'user', name: user.email } : { id: 'cli', type: 'user' },
+        outcome: 'success',
+        context: identity.status === 'unconfirmed'
+            ? { method: 'device_code', environment: environmentName, identityError: identity.reason }
+            : { method: 'device_code', environment: environmentName }
+    }, context.runtime);
+    return {
+        success: true,
+        message: 'Successfully authenticated via device authorization',
+        token: sessionToken,
+        user
+    };
+}
+/**
+ * The runtime the credential store writes through: the context's own. A value
+ * that cannot query kinds or read its environment is a wiring bug, so it fails
+ * loudly instead of writing the login into some other store.
+ */
+function credentialStoreRuntime(context) {
+    if (!isCredentialStoreRuntime(context.runtime)) {
+        throw new CapabilityError('The auth CLI context carries a runtime the credential store cannot query.', 'INTERNAL', { reason: 'runtime-invalid', retryable: false });
+    }
+    return context.runtime;
+}
+/**
+ * Ask auth-web who the approved session belongs to. Only get-session's
+ * JSON null is auth disowning the session. Everything else that is not a user
+ * (no client, no answer, an HTTP error, a body that is not get-session's)
+ * leaves the session unconfirmed, with its cause, because none of it is
+ * auth's verdict on the session.
+ */
+async function readDeviceIdentity(context, sessionToken) {
+    const created = await attempt(() => context.createClient());
+    if (!created.ok) {
+        return {
+            status: 'unconfirmed',
+            reason: `the auth client could not be created (${failureMessage(created.failure)})`
+        };
+    }
+    const client = created.value;
+    const read = await attempt(() => client.get(GET_SESSION_PATH, {
+        headers: sessionAuthorizationHeader(sessionToken)
+    }));
+    if (!read.ok)
+        return { status: 'unconfirmed', reason: identityRequestFailure(read.failure) };
+    const answer = readGetSessionAnswer(read.value);
+    if (answer.kind === 'known')
+        return { status: 'confirmed', user: answer.user };
+    if (answer.kind === 'unknown-session') {
+        return {
+            status: 'rejected',
+            reason: `auth does not recognize the new session (${GET_SESSION_PATH} answered null)`
+        };
+    }
+    return { status: 'unconfirmed', reason: `${GET_SESSION_PATH} answered without a user record` };
+}
+function identityRequestFailure(failure) {
+    const status = errorStatus(failure);
+    if (status !== undefined) {
+        return `${GET_SESSION_PATH} answered HTTP ${status}: ${failureMessage(failure)}`;
+    }
+    if (isTransportFailure(failure))
+        return `auth could not be reached (${failureMessage(failure)})`;
+    return `${GET_SESSION_PATH} failed: ${failureMessage(failure)}`;
+}
+//# sourceMappingURL=login-device.cli.js.map

package/dist/cli/services/login-device.cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-device.cli.js","sourceRoot":"","sources":["../../../src/cli/services/login-device.cli.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAsB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAGxE,OAAO,EACN,wBAAwB,EACxB,cAAc,EAEd,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC/G,OAAO,EACN,gBAAgB,EAChB,oBAAoB,EAEpB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,CAAC,CAAC,WAAW,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAChD,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC3D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAClD,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG;IAClB,cAAc;IACd,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;CAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAuB;IAC7D,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAEhD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE,CAC1C,gBAAgB,CAAC,KAAK,CACrB,MAAM,UAAU,CAAC,IAAI,CACpB,uBAAuB,EACvB,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,EAC7C,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACnD,CACD,CACD,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,QAAQ,CAAC;YACd,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,qBAAqB;YAC7B,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;YAClC,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;YAChD,KAAK,EAAE,kCAAkC,MAAM,EAAE;SACjD,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC;IAEjC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,QAAQ,CAAC,gBAAgB,0BAA0B,CAAC,CAAC;IAElF,MAAM,WAAW,GAAG,QAAQ,CAAC,yBAAyB,CAAC;IACvD,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,2FAA2F;QAC3F,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,IAAI,CAClB,MAAM;gBACL,CAAC,CAAC,yCAAyC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,gCAAgC;gBACvG,CAAC,CAAC,mEAAmE,CACtE,CAAC;QACH,CAAC;IACF,CAAC;IAED,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;IAC5D,IAAI,cAAc,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAErD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACjC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE,CACvC,iBAAiB,CAAC,KAAK,CACtB,MAAM,UAAU,CAAC,IAAI,CACpB,wBAAwB,EACxB;YACC,UAAU,EAAE,8CAA8C;YAC1D,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,WAAW;SACtB,EACD,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACnD,CACD,CACD,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9C,kEAAkE;YAClE,sEAAsE;YACtE,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBACjD,SAAS;YACV,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBACzD,cAAc,IAAI,IAAI,CAAC;gBACvB,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,CAAC;gBACd,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;gBAChD,KAAK,EAAE,MAAM;aACb,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;QAE/B,IAAI,SAAS,CAAC,KAAK,KAAK,uBAAuB,EAAE,CAAC;YACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACjD,SAAS;QACV,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACzD,cAAc,IAAI,IAAI,CAAC;YACvB,SAAS;QACV,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACzC,MAAM,QAAQ,CAAC;gBACd,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;gBAChD,KAAK,EAAE,qBAAqB;aAC5B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAwC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3F,CAAC;QACD,IAAI,SAAS,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACzC,MAAM,QAAQ,CAAC;gBACd,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;gBAChD,KAAK,EAAE,uBAAuB;aAC9B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,QAAQ,CAAC;gBACd,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;gBAChD,KAAK,EAAE,wCAAwC;aAC/C,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0DAA0D,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC7G,CAAC;QACD,OAAO,oBAAoB,CAAC,OAAO,EAAE;YACpC,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,YAAY,EAAE,SAAS,CAAC,aAAa;YACrC,SAAS,EAAE,SAAS,CAAC,UAAU;gBAC9B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;gBAClE,CAAC,CAAC,SAAS;SACZ,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,CAAC;QACd,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,mBAAmB;QAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QAClC,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;QAChD,KAAK,EAAE,iCAAiC;KACxC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,wCAAwC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC3F,CAAC;AASD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAuB,EACvB,OAAsB;IAEtB,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAEhD,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAEjE,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,QAAQ,CAAC;YACd,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;YAClC,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE;YAChE,KAAK,EAAE,QAAQ,CAAC,MAAM;SACtB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,mBAAmB,QAAQ,CAAC,MAAM,uDAAuD;YAClG,KAAK,EAAE,IAAI;SACX,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,MAAM,MAAM,GAAyC;QACpD,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS;KAC9D,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1B,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IACtC,CAAC;IACD,MAAM,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,IAAI,CAClB,uDAAuD,QAAQ,CAAC,MAAM,IAAI;YACzE,iGAAiG,CAClG,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,CAAC;QACd,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,OAAO;QACf,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QAC/F,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,aAAa;YACzC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE;YACzF,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE;KAC1D,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpB,OAAO;QACN,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,qDAAqD;QAC9D,KAAK,EAAE,YAAY;QACnB,IAAI;KACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,OAAuB;IACtD,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CACxB,2EAA2E,EAC3E,UAAU,EACV,EAAE,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAC/C,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;AACxB,CAAC;AAOD;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAChC,OAAuB,EACvB,YAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO;YACN,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,yCAAyC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;SACnF,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAC/B,MAAM,CAAC,GAAG,CAAU,gBAAgB,EAAE;QACrC,OAAO,EAAE,0BAA0B,CAAC,YAAY,CAAC;KACjD,CAAC,CACF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7F,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/E,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACvC,OAAO;YACN,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,4CAA4C,gBAAgB,iBAAiB;SACrF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,gBAAgB,iCAAiC,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAsB;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,gBAAgB,kBAAkB,MAAM,KAAK,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,8BAA8B,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;IACjG,OAAO,GAAG,gBAAgB,YAAY,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/cli/services/login-shared.d.ts

@@ -0,0 +1,10 @@
+import type { AuthLoginResult } from '../schemas/commands.ts';
+import type { AuthCLIContext, CallbackUser } from '../schemas/types.ts';
+/**
+ * Auth API base for CLI login flows — taken from AuthCLIContext only.
+ * `buildAuthCLIContext` already resolved apps.auth from config/environment.
+ * No VIBES_API_URL invent and no hardcoded auth.vibes.local fallback.
+ */
+export declare function getBaseUrl(context: AuthCLIContext): string;
+export declare function mapLoginUser(user: CallbackUser | undefined): AuthLoginResult['user'] | undefined;
+//# sourceMappingURL=login-shared.d.ts.map

package/dist/cli/services/login-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-shared.d.ts","sourceRoot":"","sources":["../../../src/cli/services/login-shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAQ1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,SAAS,CAGhG"}

package/dist/cli/services/login-shared.js

@@ -0,0 +1,18 @@
+/**
+ * Auth API base for CLI login flows — taken from AuthCLIContext only.
+ * `buildAuthCLIContext` already resolved apps.auth from config/environment.
+ * No VIBES_API_URL invent and no hardcoded auth.vibes.local fallback.
+ */
+export function getBaseUrl(context) {
+    const url = context.environment.apiUrl?.trim();
+    if (!url) {
+        throw new Error('Auth CLI context has no environment.apiUrl — buildAuthCLIContext must resolve apps.auth from config/environment.');
+    }
+    return url;
+}
+export function mapLoginUser(user) {
+    if (!user)
+        return undefined;
+    return { userId: user.id, email: user.email, name: user.name ?? null };
+}
+//# sourceMappingURL=login-shared.js.map

package/dist/cli/services/login-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-shared.js","sourceRoot":"","sources":["../../../src/cli/services/login-shared.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAuB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACd,kHAAkH,CAClH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAA8B;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;AACxE,CAAC"}

package/dist/cli/services/login.d.ts

@@ -0,0 +1,11 @@
+import type { AuthLoginInput, AuthLoginResult } from '../schemas/commands.ts';
+import type { AuthCLIContext } from '../schemas/types.ts';
+export { handleDeviceAuth } from './login-device.cli.ts';
+/**
+ * Login with an API key token.
+ *
+ * Important: only persist credentials after we've validated the token.
+ * Credentials are stored via config/manifest#auth (unified storage).
+ */
+export declare function executeAuthLogin(input: AuthLoginInput, context: AuthCLIContext): Promise<AuthLoginResult>;
+//# sourceMappingURL=login.d.ts.map

package/dist/cli/services/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/services/login.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAS1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAqDzD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,eAAe,CAAC,CAsF1B"}