@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/client/admin.js

@@ -0,0 +1,179 @@
+/**
+ * Auth Admin Client
+ *
+ * Client API for auth admin operations (security stats, session/key
+ * revocation, roles/permissions CRUD). Used by downstream apps like
+ * platform to avoid direct DB access.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { readJsonOrNull } from "./read-json-or-null.js";
+import { bulkSetStatusResultSchema, createUserResultSchema, permissionResponseSchema, permissionsResponseSchema, revokedSchema, rolePermissionsResponseSchema, roleResponseSchema, rolesResponseSchema, securityApiKeysPageSchema, securitySessionsPageSchema, securityStatsSchema, setStatusResultSchema, successSchema, userCohortsPageSchema, userDetailSchema, usersPageSchema } from "../schemas/admin/responses.js";
+export { authAdminUserStatusValues } from "../schemas/admin/index.js";
+/** An id that goes into a URL path: one opaque token (no separator, query, fragment, escape or dot segment). */
+const adminIdSchema = z
+    .string()
+    .min(1)
+    .max(256)
+    .regex(/^[^\s/\\?#%]+$/u)
+    .refine((value) => value !== '.' && value !== '..');
+function adminId(value) {
+    if (!adminIdSchema.safeParse(value).success) {
+        throw new CapabilityError('An auth admin id is not an opaque token.', 'INVALID_INPUT', {
+            reason: 'auth-id-invalid',
+            retryable: false
+        });
+    }
+    return encodeURIComponent(value);
+}
+/** An admin call that failed: HTTP status and route only, never the answer's body (it can echo the request). */
+function adminFailure(method, path, status) {
+    return new CapabilityError(`Auth admin API ${method} ${path} failed (HTTP ${status}).`, status === 401 ? 'AUTH_REQUIRED' : status === 403 ? 'PERMISSION_DENIED' : status >= 500 ? 'UNAVAILABLE' : 'INVALID_INPUT', {
+        reason: 'auth-admin-request-failed',
+        retryable: false,
+        details: { status }
+    });
+}
+function isForEachHeaders(headers) {
+    return !Array.isArray(headers) && 'forEach' in headers && typeof headers.forEach === 'function';
+}
+export function createAuthAdminClient(options) {
+    const fetcher = options.fetch ?? globalThis.fetch;
+    /** One admin call: the answer is parsed by `schema`; with `allow404`, a 404 is `null`. */
+    async function request(method, path, schema, config = {}) {
+        const headers = new Headers();
+        if (options.headers) {
+            if (Array.isArray(options.headers)) {
+                for (const [key, value] of options.headers) {
+                    headers.set(key, value);
+                }
+            }
+            else if (isForEachHeaders(options.headers)) {
+                options.headers.forEach((value, key) => {
+                    headers.set(key, value);
+                });
+            }
+            else {
+                for (const [key, value] of Object.entries(options.headers)) {
+                    headers.set(key, value);
+                }
+            }
+        }
+        headers.set('accept', 'application/json');
+        if (options.adminToken)
+            headers.set('authorization', `Bearer ${options.adminToken}`);
+        if (config.body !== undefined)
+            headers.set('content-type', 'application/json');
+        const url = new URL(path, options.baseUrl);
+        for (const [key, value] of Object.entries(config.query || {})) {
+            if (value !== undefined && value !== '')
+                url.searchParams.set(key, String(value));
+        }
+        const response = await fetcher(url, {
+            method,
+            headers,
+            body: config.body !== undefined ? JSON.stringify(config.body) : undefined
+        });
+        if (config.allow404 && response.status === 404)
+            return null;
+        if (!response.ok)
+            throw adminFailure(method, path, response.status);
+        const parsed = schema.safeParse(await readJsonOrNull(response));
+        if (!parsed.success) {
+            throw new CapabilityError(`Auth admin API ${method} ${path} answered with a body this client does not accept.`, 'INTERNAL', {
+                reason: 'auth-admin-response-invalid',
+                retryable: false,
+                cause: parsed.error
+            });
+        }
+        return parsed.data;
+    }
+    /** `request` for a call that always has an answer (no `allow404`). */
+    async function answer(method, path, schema, config = {}) {
+        const result = await request(method, path, schema, config);
+        if (result === null) {
+            throw new CapabilityError(`Auth admin API ${method} ${path} answered with no content.`, 'INTERNAL', {
+                reason: 'auth-admin-response-invalid',
+                retryable: false
+            });
+        }
+        return result;
+    }
+    return {
+        getSecurityStats: () => answer('GET', '/api/admin/security', securityStatsSchema),
+        listSecuritySessions: (input = {}) => answer('GET', '/api/admin/security', securitySessionsPageSchema, {
+            query: {
+                resource: 'sessions',
+                page: input?.page,
+                perPage: input?.perPage,
+                search: input?.search,
+                status: input?.status
+            }
+        }),
+        listSecurityApiKeys: (input = {}) => answer('GET', '/api/admin/security', securityApiKeysPageSchema, {
+            query: {
+                resource: 'api-keys',
+                page: input?.page,
+                perPage: input?.perPage,
+                search: input?.search,
+                status: input?.status
+            }
+        }),
+        getUserCohorts: (input = {}) => {
+            const from = input.from instanceof Date ? input.from.toISOString() : input.from;
+            const to = input.to instanceof Date ? input.to.toISOString() : input.to;
+            return answer('GET', '/api/admin/users/cohorts', userCohortsPageSchema, {
+                query: {
+                    interval: input.interval,
+                    from,
+                    to
+                }
+            });
+        },
+        listUsers: (input = {}) => answer('GET', '/api/admin/users', usersPageSchema, {
+            query: {
+                page: input?.page,
+                perPage: input?.perPage,
+                search: input?.search,
+                role: input?.role,
+                status: input?.status
+            }
+        }),
+        getUser: (userId) => request('GET', `/api/admin/users/${adminId(userId)}`, userDetailSchema, { allow404: true }),
+        createUser: (input) => answer('POST', '/api/admin/users', createUserResultSchema, { body: input }),
+        setUserSuperuserStatus: (userId, makeSuperuser) => answer('PATCH', `/api/admin/users/${adminId(userId)}`, successSchema, {
+            body: { action: 'set-admin', makeAdmin: makeSuperuser }
+        }),
+        setUserStatus: (userId, status, options = {}) => answer('PATCH', `/api/admin/users/${adminId(userId)}`, setStatusResultSchema, {
+            body: { action: 'set-status', status, reason: options.reason ?? null }
+        }),
+        bulkSetUserStatus: (userIds, status, options = {}) => answer('PATCH', '/api/admin/users', bulkSetStatusResultSchema, {
+            body: { action: 'set-status', userIds, status, reason: options.reason ?? null }
+        }),
+        deleteUser: (userId) => answer('DELETE', `/api/admin/users/${adminId(userId)}`, successSchema),
+        revokeSessions: () => answer('POST', '/api/admin/security', revokedSchema, { body: { action: 'revoke-sessions' } }),
+        revokeApiKeys: () => answer('POST', '/api/admin/security', revokedSchema, { body: { action: 'revoke-api-keys' } }),
+        revokeSession: (sessionId, options = {}) => answer('POST', '/api/admin/security', revokedSchema, {
+            body: { action: 'revoke-session', sessionId, reason: options.reason ?? null }
+        }),
+        revokeApiKey: (apiKeyId, options = {}) => answer('POST', '/api/admin/security', revokedSchema, {
+            body: { action: 'revoke-api-key', apiKeyId, reason: options.reason ?? null }
+        }),
+        listRoles: async () => (await answer('GET', '/api/admin/roles', rolesResponseSchema)).roles,
+        listPermissions: async () => (await answer('GET', '/api/admin/roles', permissionsResponseSchema, { query: { resource: 'permissions' } }))
+            .permissions,
+        listRolePermissions: async () => (await answer('GET', '/api/admin/roles', rolePermissionsResponseSchema, {
+            query: { resource: 'role-permissions' }
+        })).rolePermissions,
+        createRole: async (input) => (await answer('POST', '/api/admin/roles', roleResponseSchema, { body: { type: 'role', ...input } })).role,
+        updateRole: async (input) => {
+            await request('PATCH', '/api/admin/roles', z.unknown(), { body: { type: 'role', ...input } });
+        },
+        createPermission: async (input) => (await answer('POST', '/api/admin/roles', permissionResponseSchema, { body: { type: 'permission', ...input } }))
+            .permission,
+        updatePermission: async (input) => {
+            await request('PATCH', '/api/admin/roles', z.unknown(), { body: { type: 'permission', ...input } });
+        }
+    };
+}
+//# sourceMappingURL=admin.js.map

package/dist/client/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/client/admin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACN,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,aAAa,EACb,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,MAAM,+BAA+B,CAAC;AA4CvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,gHAAgH;AAChH,MAAM,aAAa,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,iBAAiB,CAAC;KACxB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC;AAErD,SAAS,OAAO,CAAC,KAAa;IAC7B,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,0CAA0C,EAAE,eAAe,EAAE;YACtF,MAAM,EAAE,iBAAiB;YACzB,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,gHAAgH;AAChH,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;IACjE,OAAO,IAAI,eAAe,CAAC,kBAAkB,MAAM,IAAI,IAAI,iBAAiB,MAAM,IAAI,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,EAAE;QAClN,MAAM,EAAE,2BAA2B;QACnC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,MAAM,EAAE;KACnB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACxB,OAA6B;IAE7B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,SAAS,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAElD,0FAA0F;IAC1F,KAAK,UAAU,OAAO,CACrB,MAAc,EACd,IAAY,EACZ,MAAS,EACT,SAII,EAAE;QAEN,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACzB,CAAC;YACF,CAAC;iBAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;oBACtC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACzB,CAAC,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACzB,CAAC;YACF,CAAC;QACF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,UAAU;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAE/E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACnC,MAAM;YACN,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SACzE,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,IAAI,eAAe,CAAC,kBAAkB,MAAM,IAAI,IAAI,oDAAoD,EAAE,UAAU,EAAE;gBAC3H,MAAM,EAAE,6BAA6B;gBACrC,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,MAAM,CAAC,KAAK;aACnB,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACpB,CAAC;IAED,sEAAsE;IACtE,KAAK,UAAU,MAAM,CACpB,MAAc,EACd,IAAY,EACZ,MAAS,EACT,SAAwC,EAAE;QAE1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,eAAe,CAAC,kBAAkB,MAAM,IAAI,IAAI,4BAA4B,EAAE,UAAU,EAAE;gBACnG,MAAM,EAAE,6BAA6B;gBACrC,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,OAAO;QACN,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,CAAC;QACjF,oBAAoB,EAAE,CAAC,QAAgE,EAAE,EAAE,EAAE,CAC5F,MAAM,CAAC,KAAK,EAAE,qBAAqB,EAAE,0BAA0B,EAAE;YAChE,KAAK,EAAE;gBACN,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,KAAK,EAAE,IAAI;gBACjB,OAAO,EAAE,KAAK,EAAE,OAAO;gBACvB,MAAM,EAAE,KAAK,EAAE,MAAM;gBACrB,MAAM,EAAE,KAAK,EAAE,MAAM;aACrB;SACD,CAAC;QACH,mBAAmB,EAAE,CAAC,QAA+D,EAAE,EAAE,EAAE,CAC1F,MAAM,CAAC,KAAK,EAAE,qBAAqB,EAAE,yBAAyB,EAAE;YAC/D,KAAK,EAAE;gBACN,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,KAAK,EAAE,IAAI;gBACjB,OAAO,EAAE,KAAK,EAAE,OAAO;gBACvB,MAAM,EAAE,KAAK,EAAE,MAAM;gBACrB,MAAM,EAAE,KAAK,EAAE,MAAM;aACrB;SACD,CAAC;QACH,cAAc,EAAE,CAAC,QAAmC,EAAE,EAAE,EAAE;YACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAChF,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC,KAAK,EAAE,0BAA0B,EAAE,qBAAqB,EAAE;gBACvE,KAAK,EAAE;oBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,IAAI;oBACJ,EAAE;iBACF;aACD,CAAC,CAAC;QACJ,CAAC;QACD,SAAS,EAAE,CAAC,QAAqD,EAAE,EAAE,EAAE,CACtE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE;YAClD,KAAK,EAAE;gBACN,IAAI,EAAE,KAAK,EAAE,IAAI;gBACjB,OAAO,EAAE,KAAK,EAAE,OAAO;gBACvB,MAAM,EAAE,KAAK,EAAE,MAAM;gBACrB,IAAI,EAAE,KAAK,EAAE,IAAI;gBACjB,MAAM,EAAE,KAAK,EAAE,MAAM;aACrB;SACD,CAAC;QACH,OAAO,EAAE,CAAC,MAAc,EAAE,EAAE,CAC3B,OAAO,CAAC,KAAK,EAAE,oBAAoB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5F,UAAU,EAAE,CAAC,KAA+B,EAAE,EAAE,CAC/C,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5E,sBAAsB,EAAE,CAAC,MAAc,EAAE,aAAsB,EAAE,EAAE,CAClE,MAAM,CAAC,OAAO,EAAE,oBAAoB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE;YACrE,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE;SACvD,CAAC;QACH,aAAa,EAAE,CACd,MAAc,EACd,MAA2B,EAC3B,UAAsC,EAAE,EACvC,EAAE,CACH,MAAM,CAAC,OAAO,EAAE,oBAAoB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,qBAAqB,EAAE;YAC7E,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE;SACtE,CAAC;QACH,iBAAiB,EAAE,CAClB,OAAiB,EACjB,MAA2B,EAC3B,UAAsC,EAAE,EACvC,EAAE,CACH,MAAM,CAAC,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE;YAC9D,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE;SAC/E,CAAC;QACH,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC;QACtG,cAAc,EAAE,GAAG,EAAE,CACpB,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC;QAC9F,aAAa,EAAE,GAAG,EAAE,CACnB,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC;QAC9F,aAAa,EAAE,CAAC,SAAiB,EAAE,UAAsC,EAAE,EAAE,EAAE,CAC9E,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE;YACpD,IAAI,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE;SAC7E,CAAC;QACH,YAAY,EAAE,CAAC,QAAgB,EAAE,UAAsC,EAAE,EAAE,EAAE,CAC5E,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,EAAE;YACpD,IAAI,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE;SAC5E,CAAC;QACH,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC,KAAK;QAC3F,eAAe,EAAE,KAAK,IAAI,EAAE,CAC3B,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;aAC1G,WAAW;QACd,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAC/B,CACC,MAAM,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,6BAA6B,EAAE;YACtE,KAAK,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE;SACvC,CAAC,CACF,CAAC,eAAe;QAClB,UAAU,EAAE,KAAK,EAAE,KAAmD,EAAE,EAAE,CACzE,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QAC1G,UAAU,EAAE,KAAK,EAAE,KAAmD,EAAE,EAAE;YACzE,MAAM,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,gBAAgB,EAAE,KAAK,EAAE,KAAyD,EAAE,EAAE,CACrF,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;aAC9G,UAAU;QACb,gBAAgB,EAAE,KAAK,EAAE,KAAyD,EAAE,EAAE;YACrF,MAAM,OAAO,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/client/app-authority.d.ts

@@ -0,0 +1,175 @@
+import { CapabilityError, valueFreeFailure, type RuntimeRef } from '@vibesdotdev/kernel';
+/**
+ * Credential→JWT exchange for CLI callers of app APIs (platform-web et al).
+ *
+ * Session credentials mint an app JWT through auth-web `GET /api/auth/token`;
+ * real API keys retain their validated bearer form. Device sessions may occupy
+ * the API-key storage slot, so live Auth classification precedes exchange.
+ * One portable owner serves CLI callers and runtime auth providers. Its
+ * optional short-lived cache stays in memory; no bearer is persisted here.
+ * A device session is presented the one way auth-web accepts it
+ * (`sessionAuthorizationHeader`).
+ */
+/**
+ * Loads the stored credential of the runtime the caller holds, for example
+ * `() => getCredentials(runtime, environmentId)`. Required: this module never
+ * reads a host-bound default runtime.
+ */
+export type CredentialLoader = () => Promise<CredentialInfo | null>;
+import type { ApiClientImplementation } from '@vibesdotdev/client/schemas';
+import type { CredentialInfo } from '../schemas/credentials.ts';
+/**
+ * Drop the app-credential verdicts this runtime's host holds: every one, or,
+ * given the origin that refused a request, that auth origin's (an app origin
+ * that is no auth origin drops all, since any of them may have carried the
+ * credential). The next call resolves the credential afresh.
+ */
+export declare function dropAppCredentialVerdicts(runtime: RuntimeRef, refusingOrigin?: string): void;
+type AuthClientFactory = () => Promise<ApiClientImplementation>;
+/** Credential-dark identity shared by CLI diagnostics and authenticated calls. */
+export interface AppAuthority {
+    /** Storage address or env var name — never the secret itself. */
+    source: string;
+    kind: 'api-key' | 'session' | 'jwt';
+    environment: string | null;
+    origin: string;
+}
+export type AppAuthorityFailureCode = 'credential-missing' | 'credential-expired' | 'environment-mismatch';
+/** JSON payload of {@link AppAuthorityError}; `authority` appears only when present. */
+type AppAuthorityErrorJson = {
+    name: string;
+    code: AppAuthorityFailureCode;
+    message: string;
+    authority?: AppAuthority;
+};
+/**
+ * A typed failure whose enumerable data is safe for JSON/log output: a
+ * `CapabilityError` whose `reason` is the failure code (`legacyCode` keeps the
+ * same value for readers of the old `code` field).
+ */
+export declare class AppAuthorityError extends CapabilityError {
+    readonly legacyCode: AppAuthorityFailureCode;
+    readonly authority?: AppAuthority;
+    constructor(code: AppAuthorityFailureCode, message: string, authority?: AppAuthority);
+    toJSON(): AppAuthorityErrorJson;
+}
+/** JSON payload of {@link AppJwtMintError}; `status` appears only when present. */
+type AppJwtMintErrorJson = {
+    name: string;
+    message: string;
+    status?: number;
+};
+/**
+ * Auth did not mint a usable app JWT for the stored credential.
+ *
+ * Carries the HTTP status and auth's own one-line message, never the
+ * credential. The client error is deliberately not kept as `cause`: it holds
+ * the request, whose headers carry the session token; only its value-free
+ * facts (`valueFreeFailure`) are.
+ */
+export declare class AppJwtMintError extends CapabilityError {
+    readonly status?: number;
+    constructor(message: string, status?: number, failure?: ReturnType<typeof valueFreeFailure>);
+    toJSON(): AppJwtMintErrorJson;
+}
+export interface ResolvedAppAuthority {
+    /** Secret bearer used only by the caller's request construction. Never log it. */
+    token: string;
+    /** Safe descriptor suitable for doctor JSON and structured errors. */
+    authority: AppAuthority;
+    /** Whether the auth-owned compatibility resolver minted a different bearer. */
+    exchanged: boolean;
+}
+export interface ResolveAppAuthorityOptions {
+    runtime: RuntimeRef;
+    authOrigin: string;
+    environment?: string | null;
+    now?: () => number;
+    fetchImpl?: typeof fetch;
+    loadCredentials: CredentialLoader;
+    createClient?: (authOrigin: string) => Promise<ApiClientImplementation>;
+}
+/**
+ * Build the redacted descriptor without validating or returning a token. It
+ * carries nothing derived from the token: a digest of a short token is
+ * guessable offline, and this descriptor rides in errors and diagnostics.
+ */
+export declare function describeAppAuthority(credential: CredentialInfo, authOrigin: string): AppAuthority;
+/**
+ * Strict credential-to-app authority resolution.
+ *
+ * This is deliberately a preflight, not a second auth framework: it binds the
+ * credential to the selected runtime environment, then delegates mint/raw-key
+ * compatibility to the existing auth-owned resolver. The live app consumer is
+ * the only validity verdict.
+ */
+export declare function resolveAppAuthority(options: ResolveAppAuthorityOptions): Promise<ResolvedAppAuthority>;
+export interface ResolveFreshAppJwtOptions {
+    runtime: RuntimeRef;
+    loadCredentials: CredentialLoader;
+    createClient?: AuthClientFactory;
+    authOrigin?: string;
+    now?: () => number;
+}
+/**
+ * Mint a new app JWT from the stored CLI credential.
+ *
+ * Unlike resolveAppJwt, this strict surface never consults the in-memory cache
+ * and never falls back to returning the raw durable credential. It is for
+ * unattended jobs whose persisted contract explicitly requires a short-lived
+ * app JWT rather than a generally compatible app bearer. It returns null only
+ * when no credential is stored. When auth cannot mint, it throws
+ * `AppJwtMintError`, so the job reports why instead of a bare "no JWT".
+ */
+export declare function resolveFreshAppJwtOwned(options: ResolveFreshAppJwtOptions): Promise<string | null>;
+export interface AuthCredentialProbe {
+    valid: boolean;
+    reason: 'unauthorized' | 'unreachable' | 'unknown' | null;
+    user: {
+        userId?: string;
+        email: string;
+        name: string | null;
+    } | null;
+    /**
+     * The auth origin this probe actually contacted (null before resolution).
+     * Failure messages MUST name it: a dev workspace resolves the LOCAL origin,
+     * and "auth server unreachable" with no origin reads as a production outage
+     * when it is a stopped local daemon — that exact misread cost an operator
+     * incident time on 2026-08-18.
+     */
+    origin: string | null;
+}
+/**
+ * Force a live credential verdict against auth-web. Reachability is "did the
+ * origin answer over HTTP", not "did a particular route exist". `/api/user/me`
+ * 404s on the shipping auth-web; `/api/auth/get-session` and `/api/auth/token`
+ * are the live probes. A 401 from a live origin is unauthorized, never an outage.
+ */
+export declare function probeAuthCredential(runtime: RuntimeRef, createClient: AuthClientFactory | undefined, loadCredentials: CredentialLoader): Promise<AuthCredentialProbe>;
+/**
+ * Resolve an app credential for the current CLI login: a signed app JWT when
+ * one is mintable, otherwise the raw durable credential. API keys mint no JWT —
+ * they 401 `/api/auth/token` and authenticate instead against auth-web's
+ * `/api/api-keys/validate`, which app session handles also consult — so the
+ * raw key IS a usable app credential (callers inject it as
+ * VIBES_AUTH_TOKEN / Bearer exactly like a JWT; app workers accept either).
+ * Returns `null` only when no credential is stored.
+ *
+ * This is a best-effort token provider, not a live verdict: for an
+ * authenticated/not-authenticated decision use `probeAuthCredential`, which
+ * verifies the credential (including the `/api/api-keys/validate` fallback).
+ */
+export declare function resolveAppJwtOwned(deps: {
+    runtime: RuntimeRef;
+    loadCredentials: CredentialLoader;
+    createClient?: AuthClientFactory;
+    authOrigin?: string;
+    /** The environment the credential belongs to; part of the verdict's key. */
+    environment?: string;
+}): Promise<string | null>;
+/** Compatibility adapter to runtime/client#auth. */
+export declare function resolveAppJwt(deps: Parameters<typeof resolveAppJwtOwned>[0]): Promise<string | null>;
+/** Compatibility adapter to runtime/client#auth. */
+export declare function resolveFreshAppJwt(deps: ResolveFreshAppJwtOptions): Promise<string | null>;
+export {};
+//# sourceMappingURL=app-authority.d.ts.map

package/dist/client/app-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-authority.d.ts","sourceRoot":"","sources":["../../src/client/app-authority.ts"],"names":[],"mappings":"AACA,OAAO,EACN,eAAe,EACf,gBAAgB,EAIhB,KAAK,UAAU,EACf,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;GAUG;AAEH;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;AASpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAShE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAkB5F;AAaD,KAAK,iBAAiB,GAAG,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAMhE,kFAAkF;AAClF,MAAM,WAAW,YAAY;IAC5B,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC;IACpC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,uBAAuB,GAClC,oBAAoB,GAAG,oBAAoB,GAAG,sBAAsB,CAAC;AAEtE,wFAAwF;AACxF,KAAK,qBAAqB,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,uBAAuB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,YAAY,CAAC;CACzB,CAAC;AASF;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,eAAe;IACrD,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC;gBAEtB,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,YAAY;IAOpF,MAAM,IAAI,qBAAqB;CAS/B;AAED,mFAAmF;AACnF,KAAK,mBAAmB,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAYF;;;;;;;GAOG;AACH,qBAAa,eAAgB,SAAQ,eAAe;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC;IAQ3F,MAAM,IAAI,mBAAmB;CAQ7B;AAeD,MAAM,WAAW,oBAAoB;IACpC,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,SAAS,EAAE,YAAY,CAAC;IACxB,+EAA+E;IAC/E,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IAC1C,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxE;AAYD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,YAAY,CAOjG;AAeD;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAuD/B;AAaD,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,UAAU,CAAC;IACpB,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,yBAAyB,GAChC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AA2CD,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,cAAc,GAAG,aAAa,GAAG,SAAS,GAAG,IAAI,CAAC;IAC1D,IAAI,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACrE;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AASD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,iBAAiB,GAAG,SAAS,EAC3C,eAAe,EAAE,gBAAgB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CA0G9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACvC,IAAI,EAAE;IACL,OAAO,EAAE,UAAU,CAAC;IACpB,eAAe,EAAE,gBAAgB,CAAC;IAClC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,GACC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqGxB;AAED,oDAAoD;AACpD,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG1G;AAED,oDAAoD;AACpD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGhG"}