@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/client/auth-client.js

@@ -0,0 +1,58 @@
+import { authAppRoutes } from "./routes.js";
+function normalizeOrigin(origin) {
+    return origin.endsWith('/') ? origin.slice(0, -1) : origin;
+}
+function normalizePath(path) {
+    return path.startsWith('/') ? path : `/${path}`;
+}
+function buildAuthUrl(authOrigin, path, params = {}) {
+    const url = new URL(path, `${normalizeOrigin(authOrigin)}/`);
+    for (const [key, value] of Object.entries(params)) {
+        if (value) {
+            url.searchParams.set(key, value);
+        }
+    }
+    return url.toString();
+}
+export function createAuthClient(config) {
+    const authOrigin = normalizeOrigin(config.authOrigin);
+    const clientOrigin = normalizeOrigin(config.clientOrigin);
+    const callbackPath = normalizePath(config.callbackPath ?? '/auth/callback');
+    const callbackUrl = new URL(callbackPath, `${clientOrigin}/`).toString();
+    const clientId = String(config.clientId);
+    return {
+        authOrigin,
+        clientId,
+        clientOrigin,
+        callbackUrl,
+        signInUrl(options = {}) {
+            return buildAuthUrl(authOrigin, authAppRoutes.signIn, {
+                client: clientId,
+                redirect_to: options.redirectTo ?? callbackUrl
+            });
+        },
+        signUpUrl(options = {}) {
+            return buildAuthUrl(authOrigin, authAppRoutes.signUp, {
+                client: clientId,
+                redirect_to: options.redirectTo ?? callbackUrl
+            });
+        },
+        gatewayUrl() {
+            return buildAuthUrl(authOrigin, authAppRoutes.apiGateway);
+        },
+        sessionUrl() {
+            return buildAuthUrl(authOrigin, authAppRoutes.apiSession, {
+                client: clientId
+            });
+        }
+    };
+}
+/**
+ * Build the canonical auth entry URL without forcing a consumer to retain an
+ * auth client instance. The sign-in UI lives at auth-web's root (`/`), not at
+ * `/sign-in`; centralizing this keeps app prompts and redirects from drifting.
+ */
+export function buildAuthSignInUrl(config) {
+    return createAuthClient(config).signInUrl({ redirectTo: config.redirectTo });
+}
+//# sourceMappingURL=auth-client.js.map

package/dist/client/auth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../../src/client/auth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,SAAS,eAAe,CAAC,MAAc;IACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,YAAY,CACpB,UAAkB,EAClB,IAAY,EACZ,SAA6C,EAAE;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,GAAG,YAAY,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEzC,OAAO;QACN,UAAU;QACV,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,SAAS,CAAC,UAA+B,EAAE;YAC1C,OAAO,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,EAAE;gBACrD,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,WAAW;aAC9C,CAAC,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,UAA+B,EAAE;YAC1C,OAAO,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,EAAE;gBACrD,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,OAAO,CAAC,UAAU,IAAI,WAAW;aAC9C,CAAC,CAAC;QACJ,CAAC;QACD,UAAU;YACT,OAAO,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;QACD,UAAU;YACT,OAAO,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,UAAU,EAAE;gBACzD,MAAM,EAAE,QAAQ;aAChB,CAAC,CAAC;QACJ,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkD;IACpF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/client/auth.api-client.impl.d.ts

@@ -0,0 +1,29 @@
+import type { ApiClientImplementation, ApiStreamEvent } from '@vibesdotdev/client/schemas';
+import type { ApiClientDescriptor } from '@vibesdotdev/client/schemas';
+import type { KindContext } from '@vibesdotdev/kernel/schemas/kind';
+declare class AuthApiClient implements ApiClientImplementation {
+    private readonly descriptor;
+    private readonly context;
+    private clientPromise?;
+    constructor(descriptor: ApiClientDescriptor, context: KindContext);
+    /**
+     * Build the underlying client on FIRST USE, not at construction. The auth
+     * origin resolves lazily here — by request time the runtime is composed —
+     * so a client constructed before runtime bootstrap neither freezes an origin
+     * nor fail-louds on an unresolved one (A5 acceptance #9). Memoized: the
+     * origin is resolved once. resolveAuthApiBaseUrl THROWS rather than invent a
+     * bare-domain fallback, so an uncomposed runtime surfaces loudly at the call
+     * site instead of silently hitting the wrong host.
+     */
+    private ensureClient;
+    get<T = unknown>(endpoint: string, options?: Parameters<ApiClientImplementation['get']>[1]): Promise<T>;
+    post<T = unknown>(endpoint: string, body?: Parameters<ApiClientImplementation['post']>[1], options?: Parameters<ApiClientImplementation['post']>[2]): Promise<T>;
+    put<T = unknown>(endpoint: string, body?: Parameters<ApiClientImplementation['put']>[1], options?: Parameters<ApiClientImplementation['put']>[2]): Promise<T>;
+    patch<T = unknown>(endpoint: string, body?: Parameters<ApiClientImplementation['patch']>[1], options?: Parameters<ApiClientImplementation['patch']>[2]): Promise<T>;
+    delete<T = unknown>(endpoint: string, options?: Parameters<ApiClientImplementation['delete']>[1]): Promise<T>;
+    request<T = unknown>(endpoint: string, options?: Parameters<ApiClientImplementation['request']>[1]): Promise<T>;
+    stream<T = unknown>(endpoint: string, options?: Parameters<ApiClientImplementation['stream']>[1]): AsyncIterableIterator<ApiStreamEvent<T>>;
+}
+declare const _default: import("@vibesdotdev/kernel").RuntimeImplementationWrapper<typeof AuthApiClient>;
+export default _default;
+//# sourceMappingURL=auth.api-client.impl.d.ts.map

package/dist/client/auth.api-client.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.impl.d.ts","sourceRoot":"","sources":["../../src/client/auth.api-client.impl.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAGpE,cAAM,aAAc,YAAW,uBAAuB;IAIpD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJzB,OAAO,CAAC,aAAa,CAAC,CAAmC;gBAGvC,UAAU,EAAE,mBAAmB,EAC/B,OAAO,EAAE,WAAW;IAGtC;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAgBd,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIvG,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIhK,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAI7J,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAInK,MAAM,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAI7G,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAI9G,MAAM,CAAC,CAAC,GAAG,OAAO,EACxB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,UAAU,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GACxD,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;CAI3C;;AAED,wBAIG"}

package/dist/client/auth.api-client.impl.js

@@ -0,0 +1,64 @@
+import { createRuntimeImplementation } from '@vibesdotdev/kernel/factory/implementation';
+import { vibesApiClient } from '@vibesdotdev/client';
+import { resolveAuthApiBaseUrl } from "../features/config/auth-api.js";
+class AuthApiClient {
+    descriptor;
+    context;
+    clientPromise;
+    constructor(descriptor, context) {
+        this.descriptor = descriptor;
+        this.context = context;
+    }
+    /**
+     * Build the underlying client on FIRST USE, not at construction. The auth
+     * origin resolves lazily here — by request time the runtime is composed —
+     * so a client constructed before runtime bootstrap neither freezes an origin
+     * nor fail-louds on an unresolved one (A5 acceptance #9). Memoized: the
+     * origin is resolved once. resolveAuthApiBaseUrl THROWS rather than invent a
+     * bare-domain fallback, so an uncomposed runtime surfaces loudly at the call
+     * site instead of silently hitting the wrong host.
+     */
+    ensureClient() {
+        if (!this.clientPromise) {
+            this.clientPromise = (async () => {
+                const baseUrl = this.descriptor.baseUrl ?? (await resolveAuthApiBaseUrl(this.context.runtime));
+                return vibesApiClient({
+                    id: 'auth',
+                    baseUrl,
+                    runtime: this.context.runtime,
+                    timeout: this.descriptor.timeout,
+                    debug: this.descriptor.debug
+                });
+            })();
+        }
+        return this.clientPromise;
+    }
+    async get(endpoint, options) {
+        return (await this.ensureClient()).get(endpoint, options);
+    }
+    async post(endpoint, body, options) {
+        return (await this.ensureClient()).post(endpoint, body, options);
+    }
+    async put(endpoint, body, options) {
+        return (await this.ensureClient()).put(endpoint, body, options);
+    }
+    async patch(endpoint, body, options) {
+        return (await this.ensureClient()).patch(endpoint, body, options);
+    }
+    async delete(endpoint, options) {
+        return (await this.ensureClient()).delete(endpoint, options);
+    }
+    async request(endpoint, options) {
+        return (await this.ensureClient()).request(endpoint, options);
+    }
+    async *stream(endpoint, options) {
+        const client = await this.ensureClient();
+        yield* client.stream(endpoint, options);
+    }
+}
+export default createRuntimeImplementation({
+    kind: 'api/client',
+    id: 'auth',
+    implementation: AuthApiClient
+});
+//# sourceMappingURL=auth.api-client.impl.js.map

package/dist/client/auth.api-client.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-client.impl.js","sourceRoot":"","sources":["../../src/client/auth.api-client.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,MAAM,aAAa;IAIA;IACA;IAJV,aAAa,CAAoC;IAEzD,YACkB,UAA+B,EAC/B,OAAoB;QADpB,eAAU,GAAV,UAAU,CAAqB;QAC/B,YAAO,GAAP,OAAO,CAAa;IACnC,CAAC;IAEJ;;;;;;;;OAQG;IACK,YAAY;QACnB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACzB,IAAI,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,EAAE;gBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/F,OAAO,cAAc,CAAC;oBACrB,EAAE,EAAE,MAAM;oBACV,OAAO;oBACP,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;oBAC7B,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO;oBAChC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK;iBAC5B,CAAC,CAAC;YACJ,CAAC,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,QAAgB,EAAE,OAAuD;QAC/F,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,IAAI,CAAc,QAAgB,EAAE,IAAqD,EAAE,OAAwD;QACxJ,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAc,QAAgB,EAAE,IAAoD,EAAE,OAAuD;QACrJ,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,KAAK,CAAc,QAAgB,EAAE,IAAsD,EAAE,OAAyD;QAC3J,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,MAAM,CAAc,QAAgB,EAAE,OAA0D;QACrG,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,OAAO,CAAc,QAAgB,EAAE,OAA2D;QACvG,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CACZ,QAAgB,EAChB,OAA0D;QAE1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACzC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;CACD;AAED,eAAe,2BAA2B,CAAC;IAC1C,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,MAAM;IACV,cAAc,EAAE,aAAa;CAC7B,CAAC,CAAC"}

package/dist/client/auth.legacy-api-client.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { ApiClientDescriptor } from '@vibesdotdev/client/schemas';
+declare const descriptor: ApiClientDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.legacy-api-client.descriptor.d.ts.map

package/dist/client/auth.legacy-api-client.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.legacy-api-client.descriptor.d.ts","sourceRoot":"","sources":["../../src/client/auth.legacy-api-client.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,QAAA,MAAM,UAAU,EAAE,mBAKjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/client/auth.legacy-api-client.descriptor.js

@@ -0,0 +1,8 @@
+const descriptor = {
+    id: 'auth',
+    kind: 'api/client',
+    name: 'Auth API Client',
+    description: 'API client for the auth service'
+};
+export default descriptor;
+//# sourceMappingURL=auth.legacy-api-client.descriptor.js.map

package/dist/client/auth.legacy-api-client.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.legacy-api-client.descriptor.js","sourceRoot":"","sources":["../../src/client/auth.legacy-api-client.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAwB;IACvC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,iCAAiC;CAC9C,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/client/browser-session-code.d.ts

@@ -0,0 +1,32 @@
+import { type NativeBrowserSessionClient } from '../schemas/browser-session-code.ts';
+export { BROWSER_SESSION_CODE_PATH, browserSessionCodeAuthorizeQuerySchema, browserSessionCodeExchangeRequestSchema, browserSessionCodeExchangeResponseSchema, nativeBrowserSessionClientSchema, pkceCodeVerifierSchema } from '../schemas/browser-session-code.ts';
+export type { NativeBrowserSessionClient, BrowserSessionCodeAuthorizeQuery, BrowserSessionCodeExchangeRequest, BrowserSessionCodeExchangeResponse } from '../schemas/browser-session-code.ts';
+/**
+ * Native companions Auth hands browser sessions to. HQ serves the same app on
+ * its declared PM ports: `hq-local-dev` (5180) and `hq-applets-dev` (5191).
+ */
+export declare const NATIVE_BROWSER_SESSION_CLIENTS: readonly NativeBrowserSessionClient[];
+/** The declared native client whose exact callbacks include `redirectUri`, if any. */
+export declare function nativeBrowserSessionClientFor(clientId: string, redirectUri: string): NativeBrowserSessionClient | undefined;
+/** RFC 7636 S256: base64url(SHA-256(ASCII(verifier))). */
+export declare function browserSessionCodeChallenge(codeVerifier: string): Promise<string>;
+/** The top-level navigation that asks Auth for a single-use session code. */
+export declare function browserSessionCodeAuthorizeUrl(options: {
+    authOrigin: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+}): string;
+/**
+ * Server-to-server exchange of a single-use code for the short-lived app JWT.
+ * Never call this from a browser: the verifier must stay on the receiving host.
+ */
+export declare function exchangeBrowserSessionCode(fetcher: typeof fetch, options: {
+    authOrigin: string;
+    clientId: string;
+    redirectUri: string;
+    code: string;
+    codeVerifier: string;
+    signal?: AbortSignal;
+}): Promise<string>;
+//# sourceMappingURL=browser-session-code.d.ts.map

package/dist/client/browser-session-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-session-code.d.ts","sourceRoot":"","sources":["../../src/client/browser-session-code.ts"],"names":[],"mappings":"AAGA,OAAO,EAKN,KAAK,0BAA0B,EAC/B,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACN,yBAAyB,EACzB,sCAAsC,EACtC,uCAAuC,EACvC,wCAAwC,EACxC,gCAAgC,EAChC,sBAAsB,EACtB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACX,0BAA0B,EAC1B,gCAAgC,EAChC,iCAAiC,EACjC,kCAAkC,EAClC,MAAM,oCAAoC,CAAC;AAQ5C;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,0BAA0B,EAE9E,CAAC;AAEH,sFAAsF;AACtF,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS,CAG3H;AAED,0DAA0D;AAC1D,wBAAsB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGvF;AAED,6EAA6E;AAC7E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAOT;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC/C,OAAO,EAAE,OAAO,KAAK,EACrB,OAAO,EAAE;IACR,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,GACC,OAAO,CAAC,MAAM,CAAC,CAqCjB"}

package/dist/client/browser-session-code.js

@@ -0,0 +1,78 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { base64UrlEncode } from "./mobile-auth.js";
+import { readJsonOrNull } from "./read-json-or-null.js";
+import { BROWSER_SESSION_CODE_PATH, browserSessionCodeExchangeRequestSchema, browserSessionCodeExchangeResponseSchema, nativeBrowserSessionClientSchema } from "../schemas/browser-session-code.js";
+export { BROWSER_SESSION_CODE_PATH, browserSessionCodeAuthorizeQuerySchema, browserSessionCodeExchangeRequestSchema, browserSessionCodeExchangeResponseSchema, nativeBrowserSessionClientSchema, pkceCodeVerifierSchema } from "../schemas/browser-session-code.js";
+const LOOPBACK_CALLBACK_HOSTS = ['127.0.0.1', 'localhost', '[::1]'];
+function loopbackCallbacks(ports, path) {
+    return ports.flatMap((port) => LOOPBACK_CALLBACK_HOSTS.map((host) => `http://${host}:${port}${path}`));
+}
+/**
+ * Native companions Auth hands browser sessions to. HQ serves the same app on
+ * its declared PM ports: `hq-local-dev` (5180) and `hq-applets-dev` (5191).
+ */
+export const NATIVE_BROWSER_SESSION_CLIENTS = nativeBrowserSessionClientSchema.array().parse([
+    { id: 'hq-local', name: 'HQ on this computer', callbackUris: loopbackCallbacks([5180, 5191], '/auth/callback') }
+]);
+/** The declared native client whose exact callbacks include `redirectUri`, if any. */
+export function nativeBrowserSessionClientFor(clientId, redirectUri) {
+    const client = NATIVE_BROWSER_SESSION_CLIENTS.find((entry) => entry.id === clientId);
+    return client?.callbackUris.includes(redirectUri) ? client : undefined;
+}
+/** RFC 7636 S256: base64url(SHA-256(ASCII(verifier))). */
+export async function browserSessionCodeChallenge(codeVerifier) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(codeVerifier));
+    return base64UrlEncode(new Uint8Array(digest));
+}
+/** The top-level navigation that asks Auth for a single-use session code. */
+export function browserSessionCodeAuthorizeUrl(options) {
+    const url = new URL(BROWSER_SESSION_CODE_PATH, options.authOrigin);
+    url.searchParams.set('client', options.clientId);
+    url.searchParams.set('redirect_uri', options.redirectUri);
+    url.searchParams.set('code_challenge', options.codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    return url.toString();
+}
+/**
+ * Server-to-server exchange of a single-use code for the short-lived app JWT.
+ * Never call this from a browser: the verifier must stay on the receiving host.
+ */
+export async function exchangeBrowserSessionCode(fetcher, options) {
+    const body = browserSessionCodeExchangeRequestSchema.safeParse({
+        code: options.code,
+        client_id: options.clientId,
+        redirect_uri: options.redirectUri,
+        code_verifier: options.codeVerifier
+    });
+    if (!body.success) {
+        throw new CapabilityError('The sign-in callback was incomplete. Please sign in again.', 'AUTH_REQUIRED', {
+            reason: 'browser-session-code-input-invalid',
+            retryable: false
+        });
+    }
+    const response = await fetcher(new URL(BROWSER_SESSION_CODE_PATH, options.authOrigin), {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify(body.data),
+        cache: 'no-store',
+        redirect: 'error',
+        signal: options.signal
+    });
+    if (response.status >= 500) {
+        throw new CapabilityError('Auth is unavailable. Please try signing in again.', 'UNAVAILABLE', {
+            reason: 'browser-session-code-unavailable',
+            retryable: true,
+            details: { status: response.status }
+        });
+    }
+    const parsed = browserSessionCodeExchangeResponseSchema.safeParse(await readJsonOrNull(response));
+    if (!response.ok || !parsed.success) {
+        throw new CapabilityError('This sign-in link expired or was already used. Please sign in again.', 'AUTH_REQUIRED', {
+            reason: 'browser-session-code-refused',
+            retryable: false,
+            details: { status: response.status }
+        });
+    }
+    return parsed.data.jwt;
+}
+//# sourceMappingURL=browser-session-code.js.map

package/dist/client/browser-session-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-session-code.js","sourceRoot":"","sources":["../../src/client/browser-session-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACN,yBAAyB,EACzB,uCAAuC,EACvC,wCAAwC,EACxC,gCAAgC,EAEhC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACN,yBAAyB,EACzB,sCAAsC,EACtC,uCAAuC,EACvC,wCAAwC,EACxC,gCAAgC,EAChC,sBAAsB,EACtB,MAAM,oCAAoC,CAAC;AAQ5C,MAAM,uBAAuB,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAU,CAAC;AAE7E,SAAS,iBAAiB,CAAC,KAAwB,EAAE,IAAY;IAChE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAA0C,gCAAgC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC;IACnI,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,gBAAgB,CAAC,EAAE;CAChH,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,UAAU,6BAA6B,CAAC,QAAgB,EAAE,WAAmB;IAClF,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IACrF,OAAO,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,YAAoB;IACrE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7F,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,8BAA8B,CAAC,OAK9C;IACA,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACnE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,OAAqB,EACrB,OAOC;IAED,MAAM,IAAI,GAAG,uCAAuC,CAAC,SAAS,CAAC;QAC9D,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,aAAa,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,eAAe,CAAC,4DAA4D,EAAE,eAAe,EAAE;YACxG,MAAM,EAAE,oCAAoC;YAC5C,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,GAAG,CAAC,yBAAyB,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE;QACtF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CAAC,mDAAmD,EAAE,aAAa,EAAE;YAC7F,MAAM,EAAE,kCAAkC;YAC1C,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;SACpC,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,wCAAwC,CAAC,SAAS,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,eAAe,CAAC,sEAAsE,EAAE,eAAe,EAAE;YAClH,MAAM,EAAE,8BAA8B;YACtC,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;SACpC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;AACxB,CAAC"}

package/dist/client/browser-session.d.ts

@@ -0,0 +1,9 @@
+/** Normalize a return path without allowing navigation off the receiving host. */
+export declare function authReturnPath(value: string | null | undefined, origin: string): string;
+/** Browser-owned cookie exchange. The short-lived JWT stays in memory until bound. */
+export declare function bindBrowserSession(fetcher: typeof fetch, options: {
+    authOrigin: string;
+    bindingPath: string;
+    signal?: AbortSignal;
+}): Promise<void>;
+//# sourceMappingURL=browser-session.d.ts.map

package/dist/client/browser-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-session.d.ts","sourceRoot":"","sources":["../../src/client/browser-session.ts"],"names":[],"mappings":"AAQA,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAIvF;AAED,sFAAsF;AACtF,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,OAAO,KAAK,EACrB,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,GACxE,OAAO,CAAC,IAAI,CAAC,CA0Bf"}

package/dist/client/browser-session.js

@@ -0,0 +1,43 @@
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { authSessionStateSchema } from "../schemas/api/client.js";
+import { readJsonOrNull } from "./read-json-or-null.js";
+const browserSessionSchema = authSessionStateSchema.pick({ authenticated: true, jwt: true });
+const bindingSchema = z.object({ bound: z.literal(true) });
+/** Normalize a return path without allowing navigation off the receiving host. */
+export function authReturnPath(value, origin) {
+    if (!value?.startsWith('/') || value.startsWith('//') || !URL.canParse(value, origin))
+        return '/';
+    const target = new URL(value, origin);
+    return target.origin === new URL(origin).origin ? target.pathname + target.search + target.hash : '/';
+}
+/** Browser-owned cookie exchange. The short-lived JWT stays in memory until bound. */
+export async function bindBrowserSession(fetcher, options) {
+    // The bearer may only be forwarded to a relative path on the receiving host.
+    if (authReturnPath(options.bindingPath, 'https://session.invalid') !== options.bindingPath) {
+        throw new CapabilityError('The sign-in callback is not configured correctly.', 'INVALID_INPUT', { reason: 'browser-binding-path-invalid', retryable: false });
+    }
+    const session = await fetcher(new URL('/api/session', options.authOrigin), {
+        credentials: 'include', cache: 'no-store', redirect: 'error', signal: options.signal
+    });
+    if (!session.ok)
+        throw new CapabilityError('Auth is unavailable. Please try signing in again.', 'UNAVAILABLE', { reason: 'browser-session-unavailable', retryable: true });
+    const state = browserSessionSchema.safeParse(await readJsonOrNull(session));
+    if (!state.success || !state.data.authenticated || !state.data.jwt) {
+        throw new CapabilityError('Your Auth session could not be read. Allow cross-site cookies for Auth, then try again.', 'AUTH_REQUIRED', { reason: 'browser-session-required', retryable: false });
+    }
+    options.signal?.throwIfAborted();
+    const binding = await fetcher(options.bindingPath, {
+        method: 'POST', credentials: 'same-origin', cache: 'no-store', redirect: 'error', signal: options.signal,
+        headers: { authorization: `Bearer ${state.data.jwt}` }
+    });
+    if (binding.status >= 500) {
+        throw new CapabilityError('The app cannot verify your session right now. Please try again later.', 'UNAVAILABLE', { reason: 'browser-binding-unavailable', retryable: true });
+    }
+    if (!binding.ok || !bindingSchema.safeParse(await readJsonOrNull(binding)).success) {
+        throw new CapabilityError(binding.status === 403
+            ? 'Sign in with the same account used by this consumer.'
+            : 'Your session could not be verified. Please sign in again.', 'PERMISSION_DENIED', { reason: 'browser-binding-refused', retryable: false });
+    }
+}
+//# sourceMappingURL=browser-session.js.map

package/dist/client/browser-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-session.js","sourceRoot":"","sources":["../../src/client/browser-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7F,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAE3D,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,KAAgC,EAAE,MAAc;IAC9E,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,GAAG,CAAC;IAClG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACvG,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAAqB,EACrB,OAA0E;IAE1E,6EAA6E;IAC7E,IAAI,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5F,MAAM,IAAI,eAAe,CAAC,mDAAmD,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/J,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE;QAC1E,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;KACpF,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,mDAAmD,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3K,MAAM,KAAK,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACpE,MAAM,IAAI,eAAe,CAAC,yFAAyF,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACjM,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE;QAClD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;QACxG,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE;KACtD,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,uEAAuE,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/K,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACpF,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,KAAK,GAAG;YAC/C,CAAC,CAAC,sDAAsD;YACxD,CAAC,CAAC,2DAA2D,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/I,CAAC;AACF,CAAC"}

package/dist/client/consumer-context.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Auth consumer context bridge
+ *
+ * Constructs an AuthConsumerContext from the runtime for use by CLI, TUI, and
+ * other consumer authentication adapters.
+ *
+ * Boundaries:
+ * - Service origin and target come from `infra/service` on the handed runtime.
+ * - Authentication comes from `auth/provider` (runtime kind).
+ * - API access uses `api/client#auth` (runtime resolved).
+ *
+ * Uses HTTP/2 (via node:http2) for HTTPS endpoints in local dev,
+ * since the vite dev server requires h2 and Bun's fetch is HTTP/1.1.
+ */
+import type { AuthConsumerContext, AuthConsumerRuntime } from './consumer-context.types.ts';
+/**
+ * Build an AuthConsumerContext on `runtime`, the caller's own runtime (a
+ * command's `context.runtime`, the studio TUI's scoped runtime). There is no
+ * default: every resolution below (environment, provider, client, external
+ * URL) and every credential the context later persists belongs to the runtime
+ * handed in, never to the host's default runtime.
+ */
+export declare function buildAuthConsumerContext(runtime: AuthConsumerRuntime): Promise<AuthConsumerContext>;
+export type { AuthConsumerContext, AuthConsumerEnvironment, AuthConsumerExternalUrl, AuthConsumerLogger, AuthConsumerRuntime } from './consumer-context.types.ts';
+//# sourceMappingURL=consumer-context.d.ts.map

package/dist/client/consumer-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-context.d.ts","sourceRoot":"","sources":["../../src/client/consumer-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EACX,mBAAmB,EAGnB,mBAAmB,EACnB,MAAM,6BAA6B,CAAC;AAKrC;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgCzG;AAED,YAAY,EACX,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,MAAM,6BAA6B,CAAC"}

package/dist/client/consumer-context.js

@@ -0,0 +1,52 @@
+/**
+ * Auth consumer context bridge
+ *
+ * Constructs an AuthConsumerContext from the runtime for use by CLI, TUI, and
+ * other consumer authentication adapters.
+ *
+ * Boundaries:
+ * - Service origin and target come from `infra/service` on the handed runtime.
+ * - Authentication comes from `auth/provider` (runtime kind).
+ * - API access uses `api/client#auth` (runtime resolved).
+ *
+ * Uses HTTP/2 (via node:http2) for HTTPS endpoints in local dev,
+ * since the vite dev server requires h2 and Bun's fetch is HTTP/1.1.
+ */
+import { getLogger } from '@vibesdotdev/logging';
+import { resolveCredentialEnvironmentId } from "../features/services/credential-store.js";
+import { resolveAuthApiBaseUrl } from "../features/config/auth-api.js";
+/**
+ * Build an AuthConsumerContext on `runtime`, the caller's own runtime (a
+ * command's `context.runtime`, the studio TUI's scoped runtime). There is no
+ * default: every resolution below (environment, provider, client, external
+ * URL) and every credential the context later persists belongs to the runtime
+ * handed in, never to the host's default runtime.
+ */
+export async function buildAuthConsumerContext(runtime) {
+    const logger = getLogger('auth.consumer', runtime);
+    const environmentId = await resolveCredentialEnvironmentId(runtime);
+    const environment = {
+        id: environmentId,
+        name: environmentId,
+        apiUrl: await resolveAuthApiBaseUrl(runtime),
+        // Preserve headers declared by legacy environment implementations.
+        headers: runtime.hasKind('config/environment')
+            ? (await runtime.query('config/environment').resolve())?.getHeaders?.() ?? {}
+            : {}
+    };
+    // A host that registers no `auth/provider` kind, or no provider for it, is
+    // the one confirmed absence; a provider that fails to load propagates.
+    const providers = runtime.hasKind('auth/provider') ? runtime.query('auth/provider') : null;
+    const auth = providers && providers.descriptors().length > 0
+        ? await providers.resolve()
+        : null;
+    // The selected API client owns request configuration and credentials.
+    const createClient = async () => runtime.query('api/client').withId('auth').resolve();
+    // Browser launch is surface UX: a host that publishes no `cli/external-url`
+    // still displays the URL. A published one that fails to load propagates.
+    const externalUrl = runtime.hasContext('cli/external-url')
+        ? await runtime.context('cli/external-url')
+        : undefined;
+    return { logger, environment, auth, createClient, externalUrl, runtime };
+}
+//# sourceMappingURL=consumer-context.js.map

package/dist/client/consumer-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-context.js","sourceRoot":"","sources":["../../src/client/consumer-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AASjD,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAA4B;IAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,WAAW,GAA4B;QAC5C,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,MAAM,qBAAqB,CAAC,OAAO,CAAC;QAC5C,mEAAmE;QACnE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAC7C,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAmE,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE;YAC/I,CAAC,CAAC,EAAE;KACL,CAAC;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAgD,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1I,MAAM,IAAI,GACT,SAAS,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,MAAM,GAAG,CAAC;QAC9C,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE;QAC3B,CAAC,CAAC,IAAI,CAAC;IAET,sEAAsE;IACtE,MAAM,YAAY,GAAG,KAAK,IAAsC,EAAE,CACjE,OAAO,CAAC,KAAK,CAA6C,YAAY,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IAElG,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC;QACzD,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAA0B,kBAAkB,CAAC;QACpE,CAAC,CAAC,SAAS,CAAC;IAEb,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC1E,CAAC"}

package/dist/client/consumer-context.types.d.ts

@@ -0,0 +1,52 @@
+import type { ApiClientImplementation } from '@vibesdotdev/client';
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import type { AuthProviderImplementation } from '../schemas/provider.ts';
+export interface AuthConsumerEnvironment {
+    id: string;
+    name?: string;
+    apiUrl: string;
+    headers: Record<string, string>;
+}
+export interface AuthConsumerLogger {
+    info: (message: string) => void;
+    warn: (message: string) => void;
+    error: (message: string) => void;
+    debug: (message: string) => void;
+}
+export interface AuthConsumerExternalUrl {
+    open(url: string): Promise<void>;
+}
+/**
+ * The runtime an auth consumer context resolves through: its environment,
+ * kinds and contexts. A command's `context.runtime`, a scoped TUI runtime and a
+ * plugin's `RuntimeRef` all satisfy it.
+ */
+export type AuthConsumerRuntime = RuntimeRef;
+/**
+ * Least-authority context for consumer authentication flows.
+ *
+ * CLI and TUI adapters may build this context, but the contract is not owned
+ * by either surface.
+ */
+export interface AuthConsumerContext {
+    logger: AuthConsumerLogger;
+    environment: AuthConsumerEnvironment;
+    auth: AuthProviderImplementation | null;
+    createClient: () => Promise<ApiClientImplementation>;
+    externalUrl?: AuthConsumerExternalUrl;
+    /**
+     * The runtime this context was built against.
+     *
+     * Typed, not `unknown`. Consumers pass it to runtime-taking APIs — e.g.
+     * `emitAuthLoginSucceeded(context.runtime, ...)` — and `unknown` made every
+     * one of those call sites a type error, pushing consumers to reach for the
+     * ambient default-runtime global instead. `buildAuthConsumerContext`
+     * takes this runtime as a required argument because the ambient global is a
+     * DIFFERENT instance under a scoped runtime (studio TUI:
+     * `studio/src/tui/studio-auth.ts`, `auth/src/tui/auth.tui-state.impl.consumer.ts`).
+     * A consumer that checks `context.runtime` and then emits on
+     * the ambient default-runtime global is testing one runtime and writing to another.
+     */
+    runtime: AuthConsumerRuntime;
+}
+//# sourceMappingURL=consumer-context.types.d.ts.map

package/dist/client/consumer-context.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-context.types.d.ts","sourceRoot":"","sources":["../../src/client/consumer-context.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEzE,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACvC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,WAAW,EAAE,uBAAuB,CAAC;IACrC,IAAI,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACxC,YAAY,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrD,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC;;;;;;;;;;;;OAYG;IACH,OAAO,EAAE,mBAAmB,CAAC;CAC7B"}

package/dist/client/consumer-context.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=consumer-context.types.js.map

package/dist/client/consumer-context.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-context.types.js","sourceRoot":"","sources":["../../src/client/consumer-context.types.ts"],"names":[],"mappings":""}