@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/cli/services/login.js

@@ -0,0 +1,143 @@
+import * as z from 'zod/v4';
+import { setCredentials } from "../../features/services/credential-store.js";
+import { mapLoginUser } from "./login-shared.js";
+import { auditLog, getLogger } from '@vibesdotdev/logging';
+import { readJsonOrNull } from "../../client/read-json-or-null.js";
+import { attempt, failureLabel } from "../../features/utils/attempt.js";
+import { failureMessage } from "../../client/request-failure.js";
+export { handleDeviceAuth } from "./login-device.cli.js";
+import { jsonValueSchema } from "../../json.js";
+const sessionUserSchema = z.object({
+    id: z.string(),
+    email: z.string(),
+    name: z.string().optional()
+});
+const sessionPayloadSchema = z.object({
+    user: sessionUserSchema.optional()
+});
+async function validateSuppliedToken(token, authOrigin, runtime) {
+    const logger = getLogger('auth.cli-login', runtime);
+    const checked = await attempt(async () => {
+        const headers = { 'Content-Type': 'application/json' };
+        // Try both credential forms: Authorization header (JWT) and x-api-key (API key)
+        let response = await fetch(`${authOrigin}/api/auth/get-session`, {
+            method: 'GET',
+            headers: { ...headers, Authorization: `Bearer ${token}` }
+        });
+        if (!response.ok) {
+            response = await fetch(`${authOrigin}/api/auth/get-session`, {
+                method: 'GET',
+                headers: { ...headers, 'x-api-key': token }
+            });
+        }
+        if (!response.ok)
+            return { valid: false };
+        const raw = jsonValueSchema.safeParse(await readJsonOrNull(response));
+        if (!raw.success)
+            return { valid: false };
+        const session = sessionPayloadSchema.safeParse(raw.data);
+        if (session.success && session.data.user?.id) {
+            return {
+                valid: true,
+                user: {
+                    id: session.data.user.id,
+                    email: session.data.user.email,
+                    name: session.data.user.name
+                }
+            };
+        }
+        return { valid: false };
+    });
+    if (checked.ok)
+        return checked.value;
+    logger.warn('Token validation request failed; reporting invalid', { failure: failureLabel(checked.failure) });
+    return { valid: false };
+}
+/**
+ * Login with an API key token.
+ *
+ * Important: only persist credentials after we've validated the token.
+ * Credentials are stored via config/manifest#auth (unified storage).
+ */
+export async function executeAuthLogin(input, context) {
+    const suppliedToken = input.token;
+    if (suppliedToken) {
+        const environmentName = context.environment.id;
+        const authenticated = await attempt(async () => {
+            const { resolveAuthOrigin } = await import("../../config/env.js");
+            const authOrigin = await resolveAuthOrigin(context.runtime);
+            const validateResult = await validateSuppliedToken(suppliedToken, authOrigin, context.runtime);
+            if (!validateResult.valid) {
+                await auditLog({
+                    category: 'authentication',
+                    severity: 'medium',
+                    action: 'login',
+                    actor: { id: 'cli', type: 'user' },
+                    outcome: 'failure',
+                    context: { method: 'api_key', environment: environmentName },
+                    error: 'API key is invalid'
+                }, context.runtime);
+                return { success: false, message: 'API key is invalid', token: null };
+            }
+            const mappedUser = mapLoginUser(validateResult.user);
+            const credentials = { apiKey: suppliedToken };
+            if (mappedUser) {
+                credentials.userId = mappedUser.userId;
+                credentials.email = mappedUser.email ?? undefined;
+                credentials.name = mappedUser.name ?? undefined;
+            }
+            await setCredentials(credentials, environmentName, context.runtime);
+            await auditLog({
+                category: 'authentication',
+                severity: 'medium',
+                action: 'login',
+                actor: mappedUser
+                    ? { id: mappedUser.userId ?? 'cli', type: 'user', name: mappedUser.email ?? undefined }
+                    : { id: 'cli', type: 'user' },
+                outcome: 'success',
+                context: { method: 'api_key', environment: environmentName }
+            }, context.runtime);
+            return {
+                success: true,
+                message: 'Successfully authenticated with API key',
+                token: suppliedToken,
+                user: mappedUser
+            };
+        });
+        if (authenticated.ok)
+            return authenticated.value;
+        await auditLog({
+            category: 'authentication',
+            severity: 'medium',
+            action: 'login',
+            actor: { id: 'cli', type: 'user' },
+            outcome: 'error',
+            context: { method: 'api_key', environment: environmentName },
+            error: failureLabel(authenticated.failure)
+        }, context.runtime);
+        return {
+            success: false,
+            message: `Failed to authenticate: ${failureMessage(authenticated.failure)}`,
+            token: null
+        };
+    }
+    if (input.interactive) {
+        const device = await attempt(async () => {
+            const { handleDeviceAuth } = await import("./login-device.cli.js");
+            return handleDeviceAuth(context);
+        });
+        if (device.ok)
+            return device.value;
+        return {
+            success: false,
+            message: `Authentication failed: ${failureMessage(device.failure)}`,
+            token: null
+        };
+    }
+    return {
+        success: false,
+        message: 'No authentication method provided. Use --token <api-key> or run in interactive mode.',
+        token: null
+    };
+}
+//# sourceMappingURL=login.js.map

package/dist/cli/services/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/cli/services/login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAE7E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAMH,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,UAAkB,EAAE,OAAkC;IACzG,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAAiC,EAAE;QACrE,MAAM,OAAO,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QACvD,gFAAgF;QAChF,IAAI,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,uBAAuB,EAAE;YAChE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,uBAAuB,EAAE;gBAC5D,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE;aAC3C,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YAC9C,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE;oBACL,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBACxB,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;oBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;iBAC5B;aACD,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9G,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,KAAqB,EACrB,OAAuB;IAEvB,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,IAAI,aAAa,EAAE,CAAC;QACnB,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAE/C,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,KAAK,IAA8B,EAAE;YACxE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClE,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAE/F,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;gBAC3B,MAAM,QAAQ,CAAC;oBACd,QAAQ,EAAE,gBAAgB;oBAC1B,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;oBAClC,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE;oBAC5D,KAAK,EAAE,oBAAoB;iBAC3B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACvE,CAAC;YAED,MAAM,UAAU,GAAG,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAErD,MAAM,WAAW,GAAyC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACpF,IAAI,UAAU,EAAE,CAAC;gBAChB,WAAW,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;gBACvC,WAAW,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,SAAS,CAAC;gBAClD,WAAW,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,SAAS,CAAC;YACjD,CAAC;YACD,MAAM,cAAc,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAEpE,MAAM,QAAQ,CAAC;gBACd,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,UAAU;oBAChB,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,IAAI,SAAS,EAAE;oBACvF,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;gBAC9B,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE;aAC5D,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAEpB,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,yCAAyC;gBAClD,KAAK,EAAE,aAAa;gBACpB,IAAI,EAAE,UAAU;aAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,aAAa,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC;QACjD,MAAM,QAAQ,CAAC;YACd,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;YAClC,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE;YAC5D,KAAK,EAAE,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC;SAC1C,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,2BAA2B,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE;YAC3E,KAAK,EAAE,IAAI;SACX,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;YACvC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACnE,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QACnC,OAAO;YACN,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,0BAA0B,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YACnE,KAAK,EAAE,IAAI;SACX,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,sFAAsF;QAC/F,KAAK,EAAE,IAAI;KACX,CAAC;AACH,CAAC"}

package/dist/cli/services/logout.d.ts

@@ -0,0 +1,4 @@
+import type { AuthLogoutInput, AuthLogoutResult } from '../schemas/commands.ts';
+import type { AuthCLIContext } from '../schemas/types.ts';
+export declare function executeAuthLogout(_input: AuthLogoutInput, context: AuthCLIContext): Promise<AuthLogoutResult>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/cli/services/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/cli/services/logout.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAyC1D,wBAAsB,iBAAiB,CACtC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAgE3B"}

package/dist/cli/services/logout.js

@@ -0,0 +1,101 @@
+import { getCredentials, clearCredentials } from "../../features/services/credential-store.js";
+import { resolveAuthOrigin } from "../../config/env.js";
+import { auditLog, getLogger } from '@vibesdotdev/logging';
+import { attempt, failureLabel } from "../../features/utils/attempt.js";
+import { failureMessage } from "../../client/request-failure.js";
+/**
+ * Logout and clear stored credentials.
+ * Uses config/manifest#auth (unified storage) via credential store.
+ */
+async function revokeServerSession(token, authOrigin, runtime) {
+    const logger = getLogger('auth.cli-logout', runtime);
+    const revoked = await attempt(async () => {
+        // Try session revocation endpoint first
+        const signoutRes = await fetch(`${authOrigin}/signout`, {
+            method: 'POST',
+            headers: { Cookie: `__Secure-better-auth.session_token=${token}` }
+        });
+        if (signoutRes.ok)
+            return true;
+        // Fallback to alternative cookie format
+        const signoutRes2 = await fetch(`${authOrigin}/signout`, {
+            method: 'POST',
+            headers: { Cookie: `better-auth.session_token=${token}` }
+        });
+        if (signoutRes2.ok)
+            return true;
+        // Try API revoke endpoint for API keys
+        const revokeRes = await fetch(`${authOrigin}/api/auth/jwt/revoke`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-api-key': token
+            }
+        });
+        return revokeRes.ok;
+    });
+    if (revoked.ok)
+        return revoked.value;
+    logger.warn('Server-side session revocation failed', { failure: failureLabel(revoked.failure) });
+    return false;
+}
+export async function executeAuthLogout(_input, context) {
+    const outcome = await attempt(async () => {
+        const currentCredentials = await getCredentials(context.runtime);
+        if (!currentCredentials) {
+            await auditLog({
+                category: 'authentication',
+                severity: 'low',
+                action: 'logout',
+                actor: { id: 'cli', type: 'user' },
+                outcome: 'success',
+                context: { environment: context.environment.id, alreadyLoggedOut: true }
+            }, context.runtime);
+            return {
+                success: true,
+                message: 'Already logged out - no credentials found',
+                clearedSessions: false
+            };
+        }
+        const actorId = currentCredentials.userId ?? 'cli';
+        const authOrigin = await resolveAuthOrigin(context.runtime);
+        const sessionToken = currentCredentials.token;
+        // Attempt server-side revocation
+        const revoked = sessionToken ? await revokeServerSession(sessionToken, authOrigin, context.runtime) : false;
+        await clearCredentials(context.runtime);
+        const message = revoked
+            ? 'Successfully logged out and cleared credentials; server session revoked'
+            : 'Successfully cleared local credentials; server session could NOT be revoked — revoke at account.vibes.dev/security';
+        await auditLog({
+            category: 'authentication',
+            severity: 'low',
+            action: 'logout',
+            actor: { id: actorId, type: 'user' },
+            outcome: 'success',
+            context: { environment: context.environment.id, clearedSessions: revoked, serverRevoked: revoked }
+        }, context.runtime);
+        return {
+            success: true,
+            message,
+            clearedSessions: revoked
+        };
+    });
+    if (outcome.ok)
+        return outcome.value;
+    context.logger.error(`Failed to logout: ${failureMessage(outcome.failure)}`);
+    await auditLog({
+        category: 'authentication',
+        severity: 'medium',
+        action: 'logout',
+        actor: { id: 'cli', type: 'user' },
+        outcome: 'error',
+        context: { environment: context.environment.id },
+        error: failureLabel(outcome.failure)
+    }, context.runtime);
+    return {
+        success: false,
+        message: `Logout failed: ${failureMessage(outcome.failure)}`,
+        clearedSessions: false
+    };
+}
+//# sourceMappingURL=logout.js.map

package/dist/cli/services/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../../src/cli/services/logout.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,UAAkB,EAAE,OAAkC;IACvG,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACxC,wCAAwC;QACxC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,UAAU,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,sCAAsC,KAAK,EAAE,EAAE;SAClE,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC/B,wCAAwC;QACxC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,UAAU,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,KAAK,EAAE,EAAE;SACzD,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAChC,uCAAuC;QACvC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,sBAAsB,EAAE;YAClE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,KAAK;aAClB;SACD,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAuB,EACvB,OAAuB;IAEvB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAA+B,EAAE;QACnE,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEjE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACzB,MAAM,QAAQ,CAAC;gBACd,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;aACxE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,2CAA2C;gBACpD,eAAe,EAAE,KAAK;aACtB,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,IAAI,KAAK,CAAC;QACnD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC;QAE9C,iCAAiC;QACjC,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAE5G,MAAM,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,OAAO;YACtB,CAAC,CAAC,yEAAyE;YAC3E,CAAC,CAAC,oHAAoH,CAAC;QAExH,MAAM,QAAQ,CAAC;YACd,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;YACpC,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE;SAClG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAEpB,OAAO;YACN,OAAO,EAAE,IAAI;YACb,OAAO;YACP,eAAe,EAAE,OAAO;SACxB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7E,MAAM,QAAQ,CAAC;QACd,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QAClC,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;QAChD,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;KACpC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,OAAO;QACN,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,kBAAkB,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC5D,eAAe,EAAE,KAAK;KACtB,CAAC;AACH,CAAC"}

package/dist/cli/services/profile.d.ts

@@ -0,0 +1,7 @@
+import type { AuthProfileInput, AuthProfileResult } from '../schemas/commands.ts';
+import type { AuthCLIContext } from '../schemas/types.ts';
+import { type AuthCredentialProbe } from '../../client/app-authority.ts';
+export declare function executeAuthProfile(input: AuthProfileInput, context: AuthCLIContext, deps?: {
+    probe?: () => Promise<AuthCredentialProbe>;
+}): Promise<AuthProfileResult>;
+//# sourceMappingURL=profile.d.ts.map

package/dist/cli/services/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../src/cli/services/profile.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAEN,KAAK,mBAAmB,EACxB,MAAM,+BAA+B,CAAC;AAOvC,wBAAsB,kBAAkB,CACvC,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAA;CAAO,GACvD,OAAO,CAAC,iBAAiB,CAAC,CAmC5B"}

package/dist/cli/services/profile.js

@@ -0,0 +1,45 @@
+import * as z from 'zod/v4';
+import { getCredentials } from "../../features/services/credential-store.js";
+import { getLogger } from '@vibesdotdev/logging';
+import { attempt, failureLabel } from "../../features/utils/attempt.js";
+import { probeAuthCredential } from "../../client/app-authority.js";
+/** What `GET /api/auth/permissions` answers: the grants as resource and action. */
+const permissionsAnswerSchema = z.object({
+    permissions: z.array(z.object({ resource: z.string(), action: z.string() }))
+});
+export async function executeAuthProfile(input, context, deps = {}) {
+    const log = getLogger('auth.cli.profile', context.runtime);
+    const unauthenticated = {
+        user: null,
+        permissions: [],
+        permissionsAvailable: false,
+        authenticated: false
+    };
+    const outcome = await attempt(async () => {
+        const probe = await (deps.probe ?? (() => probeAuthCredential(context.runtime, undefined, () => getCredentials(context.runtime))))();
+        if (!probe.valid)
+            return unauthenticated;
+        const authClient = await context.createClient();
+        const fetched = await attempt(async () => permissionsAnswerSchema.parse(await authClient.get('/api/auth/permissions')));
+        if (!fetched.ok) {
+            // Only the failure's class is logged: passing the raw Error here would
+            // serialize its full `.stack` into the log context, which surfaces as a
+            // stack-trace JSON blob right before the clean "Not authenticated" line.
+            log.warn('Failed to fetch auth permissions; reporting empty permission set', {
+                failure: failureLabel(fetched.failure)
+            });
+            return { user: probe.user, permissions: [], permissionsAvailable: false, authenticated: true };
+        }
+        return {
+            user: probe.user,
+            permissions: fetched.value.permissions.map((p) => `${p.resource}:${p.action}`),
+            permissionsAvailable: true,
+            authenticated: true
+        };
+    });
+    if (outcome.ok)
+        return outcome.value;
+    log.warn('Auth profile probe failed; reporting unauthenticated', { failure: failureLabel(outcome.failure) });
+    return unauthenticated;
+}
+//# sourceMappingURL=profile.js.map

package/dist/cli/services/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/cli/services/profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAGxE,OAAO,EACN,mBAAmB,EAEnB,MAAM,+BAA+B,CAAC;AAEvC,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;CAC5E,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,KAAuB,EACvB,OAAuB,EACvB,OAAuD,EAAE;IAEzD,MAAM,GAAG,GAAG,SAAS,CAAC,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAsB;QAC1C,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,EAAE;QACf,oBAAoB,EAAE,KAAK;QAC3B,aAAa,EAAE,KAAK;KACpB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAAgC,EAAE;QACpE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrI,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,eAAe,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAEhD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE,CACxC,uBAAuB,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,GAAG,CAAU,uBAAuB,CAAC,CAAC,CACrF,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACjB,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,GAAG,CAAC,IAAI,CAAC,kEAAkE,EAAE;gBAC5E,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAChG,CAAC;QACD,OAAO;YACN,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC9E,oBAAoB,EAAE,IAAI;YAC1B,aAAa,EAAE,IAAI;SACnB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,GAAG,CAAC,IAAI,CAAC,sDAAsD,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7G,OAAO,eAAe,CAAC;AACxB,CAAC"}

package/dist/cli/services/status.d.ts

@@ -0,0 +1,7 @@
+import type { AuthStatusInput, AuthStatusResult } from '../schemas/commands.ts';
+import type { AuthCLIContext } from '../schemas/types.ts';
+import { type AuthCredentialProbe } from '../../client/app-authority.ts';
+export declare function executeAuthStatus(_input: AuthStatusInput, _context: AuthCLIContext, deps?: {
+    probe?: () => Promise<AuthCredentialProbe>;
+}): Promise<AuthStatusResult>;
+//# sourceMappingURL=status.d.ts.map

package/dist/cli/services/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/cli/services/status.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAEN,KAAK,mBAAmB,EACxB,MAAM,+BAA+B,CAAC;AAEvC,wBAAsB,iBAAiB,CACtC,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,cAAc,EACxB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAA;CAAO,GACvD,OAAO,CAAC,gBAAgB,CAAC,CAkC3B"}

package/dist/cli/services/status.js

@@ -0,0 +1,42 @@
+import { getCredentials } from "../../features/services/credential-store.js";
+import { attempt } from "../../features/utils/attempt.js";
+import { failureMessage } from "../../client/request-failure.js";
+import { messageForAuthProbeFailure } from "./auth-probe-failure.js";
+import { probeAuthCredential } from "../../client/app-authority.js";
+export async function executeAuthStatus(_input, _context, deps = {}) {
+    const outcome = await attempt(async () => {
+        const probe = await (deps.probe ?? (() => probeAuthCredential(_context.runtime, undefined, () => getCredentials(_context.runtime))))();
+        if (probe.valid) {
+            return {
+                authenticated: true,
+                user: probe.user,
+                message: 'Authenticated',
+                reason: null,
+                origin: probe.origin ?? null,
+                subscription: null
+            };
+        }
+        const reason = probe.reason ?? 'unknown';
+        return {
+            authenticated: false,
+            user: null,
+            message: messageForAuthProbeFailure(reason, probe.origin ?? null),
+            reason,
+            origin: probe.origin ?? null,
+            subscription: null
+        };
+    });
+    if (outcome.ok)
+        return outcome.value;
+    _context.logger.warn(`Auth status probe failed: ${failureMessage(outcome.failure)}`);
+    const reason = 'unreachable';
+    return {
+        authenticated: false,
+        user: null,
+        message: messageForAuthProbeFailure(reason, null),
+        reason,
+        origin: null,
+        subscription: null
+    };
+}
+//# sourceMappingURL=status.js.map

package/dist/cli/services/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/cli/services/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAGjE,OAAO,EAAE,0BAA0B,EAA6B,MAAM,yBAAyB,CAAC;AAChG,OAAO,EACN,mBAAmB,EAEnB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,MAAuB,EACvB,QAAwB,EACxB,OAAuD,EAAE;IAEzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAA+B,EAAE;QACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;gBACN,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,eAAe;gBACxB,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;gBAC5B,YAAY,EAAE,IAAI;aAClB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAyB,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;QAC/D,OAAO;YACN,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;YACjE,MAAM;YACN,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,YAAY,EAAE,IAAI;SAClB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrF,MAAM,MAAM,GAAyB,aAAa,CAAC;IACnD,OAAO;QACN,aAAa,EAAE,KAAK;QACpB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC;QACjD,MAAM;QACN,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;KAClB,CAAC;AACH,CAAC"}

package/dist/cli/services/token.d.ts

@@ -0,0 +1,7 @@
+import type { AuthTokenInput, AuthTokenResult } from '../schemas/commands.ts';
+import type { AuthCLIContext } from '../schemas/types.ts';
+import { type AuthCredentialProbe } from '../../client/app-authority.ts';
+export declare function executeAuthToken(input: AuthTokenInput, context: AuthCLIContext, deps?: {
+    probe?: () => Promise<AuthCredentialProbe>;
+}): Promise<AuthTokenResult>;
+//# sourceMappingURL=token.d.ts.map

package/dist/cli/services/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/cli/services/token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAM1D,OAAO,EAEN,KAAK,mBAAmB,EACxB,MAAM,+BAA+B,CAAC;AAevC,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAA;CAAO,GACvD,OAAO,CAAC,eAAe,CAAC,CA4H1B"}

package/dist/cli/services/token.js

@@ -0,0 +1,139 @@
+import { getCredentials, setCredentials } from "../../features/services/credential-store.js";
+import { auditLog } from '@vibesdotdev/logging';
+import { attempt } from "../../features/utils/attempt.js";
+import { decodeJWTUnsafe } from "../../jwt/index.js";
+import { failureMessage } from "../../client/request-failure.js";
+import { probeAuthCredential } from "../../client/app-authority.js";
+import { resolveCliAppJwt } from "./app-jwt.js";
+function maskToken(token) {
+    if (token.length <= 8)
+        return '********';
+    return `${token.slice(0, 4)}…${token.slice(-4)}`;
+}
+/** Informational `exp` claim for display; null for opaque tokens or bad payloads. */
+function jwtExpiry(token) {
+    // An undecodable token has no readable expiry.
+    const exp = decodeJWTUnsafe(token)?.exp;
+    return exp === undefined ? null : new Date(exp * 1000);
+}
+export async function executeAuthToken(input, context, deps = {}) {
+    const outcome = await attempt(async () => {
+        if (input.action === 'show') {
+            const creds = await getCredentials(context.runtime);
+            if (!creds?.token) {
+                await auditLog({
+                    category: 'authentication',
+                    severity: 'low',
+                    action: 'token_show',
+                    actor: { id: creds?.userId ?? 'cli', type: 'user' },
+                    outcome: 'failure',
+                    context: { environment: context.environment.id },
+                    error: 'No token stored'
+                }, context.runtime);
+                return { token: null, valid: false, expiresAt: null, message: 'No token stored' };
+            }
+            await auditLog({
+                category: 'authentication',
+                severity: 'low',
+                action: 'token_show',
+                actor: { id: creds.userId ?? 'cli', type: 'user' },
+                outcome: 'success',
+                context: { environment: context.environment.id, tokenPresent: true }
+            }, context.runtime);
+            return {
+                token: maskToken(creds.token),
+                valid: true,
+                expiresAt: creds.expiresAt ? new Date(creds.expiresAt) : null,
+                message: 'Token is stored'
+            };
+        }
+        if (input.action === 'app') {
+            // Machine-readable app JWT for scripted callers of app APIs
+            // (runnable-web et al). Unlike `show`, this returns the full
+            // short-lived token — that is the point of the action; the
+            // durable credential is never exposed here.
+            // The credential, the auth origin and the JWT cache all belong to the
+            // runtime this context was built against.
+            const appJwt = await resolveCliAppJwt(context.runtime);
+            if (!appJwt) {
+                await auditLog({
+                    category: 'authentication',
+                    severity: 'low',
+                    action: 'token_app',
+                    actor: { id: 'cli', type: 'user' },
+                    outcome: 'failure',
+                    context: { environment: context.environment.id },
+                    error: 'No app token mintable'
+                }, context.runtime);
+                return {
+                    token: null,
+                    valid: false,
+                    expiresAt: null,
+                    message: 'No app token available — run `vibes auth login` first'
+                };
+            }
+            await auditLog({
+                category: 'authentication',
+                severity: 'low',
+                action: 'token_app',
+                actor: { id: 'cli', type: 'user' },
+                outcome: 'success',
+                context: { environment: context.environment.id, tokenPresent: true }
+            }, context.runtime);
+            return {
+                token: appJwt,
+                valid: true,
+                expiresAt: jwtExpiry(appJwt),
+                message: 'App token minted'
+            };
+        }
+        const result = await (deps.probe ?? (() => probeAuthCredential(context.runtime, undefined, () => getCredentials(context.runtime))))();
+        if (!result.valid) {
+            await auditLog({
+                category: 'authentication',
+                severity: 'medium',
+                action: 'token_validate',
+                actor: { id: 'cli', type: 'user' },
+                outcome: 'failure',
+                context: { environment: context.environment.id },
+                error: 'Not authenticated'
+            }, context.runtime);
+            return { token: null, valid: false, expiresAt: null, message: 'Not authenticated' };
+        }
+        if (context.auth) {
+            const authContext = await context.auth.getAuthContext();
+            if (authContext.isAuthenticated && authContext.token) {
+                await setCredentials({ apiKey: authContext.token }, context.environment.id, context.runtime);
+            }
+        }
+        const actorId = result.user?.userId ?? 'cli';
+        await auditLog({
+            category: 'authentication',
+            severity: 'low',
+            action: 'token_validate',
+            actor: { id: actorId, type: 'user', name: result.user?.email },
+            outcome: 'success',
+            context: { environment: context.environment.id }
+        }, context.runtime);
+        return { token: null, valid: true, expiresAt: null, message: 'Token is valid' };
+    });
+    if (outcome.ok)
+        return outcome.value;
+    context.logger.warn(`Token validation failed: ${failureMessage(outcome.failure)}`);
+    await auditLog({
+        category: 'authentication',
+        severity: 'medium',
+        action: 'token_validate',
+        actor: { id: 'cli', type: 'user' },
+        outcome: 'error',
+        context: { environment: context.environment.id },
+        error: 'Unable to validate token'
+    }, context.runtime);
+    return {
+        token: null,
+        valid: false,
+        expiresAt: null,
+        message: 'Unable to validate token'
+    };
+}
+//# sourceMappingURL=token.js.map

package/dist/cli/services/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/cli/services/token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,6CAA6C,CAAC;AAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EACN,mBAAmB,EAEnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,SAAS,SAAS,CAAC,KAAa;IAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACzC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,KAAa;IAC/B,+CAA+C;IAC/C,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACxC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,KAAqB,EACrB,OAAuB,EACvB,OAAuD,EAAE;IAEzD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,IAA8B,EAAE;QAClE,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;gBACnB,MAAM,QAAQ,CAAC;oBACd,QAAQ,EAAE,gBAAgB;oBAC1B,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY;oBACpB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;oBACnD,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;oBAChD,KAAK,EAAE,iBAAiB;iBACxB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;YACnF,CAAC;YAED,MAAM,QAAQ,CAAC;gBACd,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,YAAY;gBACpB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClD,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aACpE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO;gBACN,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;gBAC7B,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC7D,OAAO,EAAE,iBAAiB;aAC1B,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC5B,4DAA4D;YAC5D,6DAA6D;YAC7D,2DAA2D;YAC3D,4CAA4C;YAC5C,sEAAsE;YACtE,0CAA0C;YAC1C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,QAAQ,CAAC;oBACd,QAAQ,EAAE,gBAAgB;oBAC1B,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,WAAW;oBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;oBAClC,OAAO,EAAE,SAAS;oBAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;oBAChD,KAAK,EAAE,uBAAuB;iBAC9B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpB,OAAO;oBACN,KAAK,EAAE,IAAI;oBACX,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,uDAAuD;iBAChE,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,CAAC;gBACd,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aACpE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO;gBACN,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC;gBAC5B,OAAO,EAAE,kBAAkB;aAC3B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEtI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,QAAQ,CAAC;gBACd,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;gBAClC,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;gBAChD,KAAK,EAAE,mBAAmB;aAC1B,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QACrF,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACxD,IAAI,WAAW,CAAC,eAAe,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;gBACtD,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9F,CAAC;QACF,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;QAC7C,MAAM,QAAQ,CAAC;YACd,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;YAC9D,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;SAChD,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnF,MAAM,QAAQ,CAAC;QACd,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QAClC,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE;QAChD,KAAK,EAAE,0BAA0B;KACjC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,OAAO;QACN,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,KAAK;QACZ,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,0BAA0B;KACnC,CAAC;AACH,CAAC"}

package/dist/client/admin.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Auth Admin Client
+ *
+ * Client API for auth admin operations (security stats, session/key
+ * revocation, roles/permissions CRUD). Used by downstream apps like
+ * platform to avoid direct DB access.
+ */
+import type { AuthAdminClient, AuthAdminClientOptions } from '../schemas/admin/index.ts';
+export type { AuthAdminBulkSetStatusResult, AuthAdminClient, AuthAdminClientOptions, AuthAdminCreateUserInput, AuthAdminCreateUserResult, AuthAdminReferralSummary, AuthAdminSecurityApiKeyRecord, AuthAdminSecurityApiKeyStatus, AuthAdminSecurityApiKeysPage, AuthAdminSecurityPagination, AuthAdminSecuritySessionRecord, AuthAdminSecuritySessionStatus, AuthAdminSecuritySessionsPage, AuthAdminSetStatusResult, AuthAdminUserCohortBucket, AuthAdminUserCohortInterval, AuthAdminUserCohortMember, AuthAdminUserCohortsInput, AuthAdminUserCohortsPage, AuthAdminUserDetail, AuthAdminUserListItem, AuthAdminOperatorUserRecord, AuthAdminUserProfileRecord, AuthAdminUserRecord, AuthAdminUserRoleFilter, AuthAdminUserStatus, AuthAdminUserStatusFilter, AuthAdminUsersPage, PermissionRecord, RolePermissionRecord, RoleRecord, SecurityStats } from '../schemas/admin/index.ts';
+export { authAdminUserStatusValues } from '../schemas/admin/index.ts';
+export declare function createAuthAdminClient(options: AuthAdminClientOptions): AuthAdminClient;
+//# sourceMappingURL=admin.d.ts.map

package/dist/client/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/client/admin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuBH,OAAO,KAAK,EACX,eAAe,EACf,sBAAsB,EAKtB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACX,4BAA4B,EAC5B,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,wBAAwB,EACxB,yBAAyB,EACzB,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAmCtE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CAkLtF"}