@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/features/authorization/organization-policy.d.ts

@@ -0,0 +1,270 @@
+import * as z from 'zod/v4';
+/** Roles returned by Account's live organization membership contract. */
+export declare const organizationAuthorizationRoleSchema: z.ZodEnum<{
+    owner: "owner";
+    member: "member";
+    admin: "admin";
+    billing_admin: "billing_admin";
+    viewer: "viewer";
+}>;
+export type OrganizationAuthorizationRole = z.infer<typeof organizationAuthorizationRoleSchema>;
+/**
+ * A server-verified principal. These objects are created after Auth verifies
+ * the session, credential, or service binding. A browser or worker must not
+ * construct one from unverified request fields.
+ */
+export declare const authorizationPrincipalSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"human">;
+    actorId: z.ZodString;
+    accountId: z.ZodString;
+    isSuperuser: z.ZodBoolean;
+    isStaff: z.ZodBoolean;
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"agent">;
+    actorId: z.ZodString;
+    agentId: z.ZodString;
+    ownerAccountId: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"system">;
+    actorId: z.ZodString;
+    serviceId: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strict>], "kind">;
+export type AuthorizationPrincipal = z.infer<typeof authorizationPrincipalSchema>;
+export declare const authorizationGateSchema: z.ZodEnum<{
+    organization: "organization";
+    system: "system";
+    adminOnly: "adminOnly";
+    permission: "permission";
+}>;
+export type AuthorizationGate = z.infer<typeof authorizationGateSchema>;
+/**
+ * Auth's shared authorization request. Account supplies the optional live
+ * organization facts. Missing facts are a denial, never an implicit allow.
+ */
+export declare const authorizationRequestSchema: z.ZodObject<{
+    principal: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"human">;
+        actorId: z.ZodString;
+        accountId: z.ZodString;
+        isSuperuser: z.ZodBoolean;
+        isStaff: z.ZodBoolean;
+        permissions: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"agent">;
+        actorId: z.ZodString;
+        agentId: z.ZodString;
+        ownerAccountId: z.ZodString;
+        permissions: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"system">;
+        actorId: z.ZodString;
+        serviceId: z.ZodString;
+        permissions: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>], "kind">;
+    gate: z.ZodEnum<{
+        organization: "organization";
+        system: "system";
+        adminOnly: "adminOnly";
+        permission: "permission";
+    }>;
+    resource: z.ZodString;
+    action: z.ZodString;
+    permission: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationSlug: z.ZodOptional<z.ZodString>;
+    organizationRole: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        owner: "owner";
+        member: "member";
+        admin: "admin";
+        billing_admin: "billing_admin";
+        viewer: "viewer";
+    }>>>;
+}, z.core.$strict>;
+export type AuthorizationRequest = z.infer<typeof authorizationRequestSchema>;
+export declare const authorizationDecisionReasonSchema: z.ZodEnum<{
+    superuser: "superuser";
+    "staff-admin-gate": "staff-admin-gate";
+    "explicit-permission": "explicit-permission";
+    "organization-role": "organization-role";
+    "system-permission": "system-permission";
+    "agent-principal-requires-explicit-grant": "agent-principal-requires-explicit-grant";
+    "not-a-member": "not-a-member";
+    "role-does-not-grant-permission": "role-does-not-grant-permission";
+    "missing-required-facts": "missing-required-facts";
+}>;
+export declare const authorizationDecisionEvidenceSchema: z.ZodObject<{
+    principalKind: z.ZodEnum<{
+        agent: "agent";
+        system: "system";
+        human: "human";
+    }>;
+    gate: z.ZodEnum<{
+        organization: "organization";
+        system: "system";
+        adminOnly: "adminOnly";
+        permission: "permission";
+    }>;
+    resource: z.ZodString;
+    action: z.ZodString;
+    organizationId: z.ZodNullable<z.ZodString>;
+    organizationSlug: z.ZodNullable<z.ZodString>;
+    organizationRole: z.ZodNullable<z.ZodEnum<{
+        owner: "owner";
+        member: "member";
+        admin: "admin";
+        billing_admin: "billing_admin";
+        viewer: "viewer";
+    }>>;
+    sources: z.ZodArray<z.ZodEnum<{
+        "auth-session": "auth-session";
+        "auth-credential": "auth-credential";
+        "account-live": "account-live";
+        "service-binding": "service-binding";
+    }>>;
+}, z.core.$strip>;
+export declare const authorizationDecisionSchema: z.ZodObject<{
+    allowed: z.ZodBoolean;
+    reason: z.ZodEnum<{
+        superuser: "superuser";
+        "staff-admin-gate": "staff-admin-gate";
+        "explicit-permission": "explicit-permission";
+        "organization-role": "organization-role";
+        "system-permission": "system-permission";
+        "agent-principal-requires-explicit-grant": "agent-principal-requires-explicit-grant";
+        "not-a-member": "not-a-member";
+        "role-does-not-grant-permission": "role-does-not-grant-permission";
+        "missing-required-facts": "missing-required-facts";
+    }>;
+    evidence: z.ZodObject<{
+        principalKind: z.ZodEnum<{
+            agent: "agent";
+            system: "system";
+            human: "human";
+        }>;
+        gate: z.ZodEnum<{
+            organization: "organization";
+            system: "system";
+            adminOnly: "adminOnly";
+            permission: "permission";
+        }>;
+        resource: z.ZodString;
+        action: z.ZodString;
+        organizationId: z.ZodNullable<z.ZodString>;
+        organizationSlug: z.ZodNullable<z.ZodString>;
+        organizationRole: z.ZodNullable<z.ZodEnum<{
+            owner: "owner";
+            member: "member";
+            admin: "admin";
+            billing_admin: "billing_admin";
+            viewer: "viewer";
+        }>>;
+        sources: z.ZodArray<z.ZodEnum<{
+            "auth-session": "auth-session";
+            "auth-credential": "auth-credential";
+            "account-live": "account-live";
+            "service-binding": "service-binding";
+        }>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type AuthorizationDecision = z.infer<typeof authorizationDecisionSchema>;
+/**
+ * The single shared authorization operation for Auth consumers.
+ *
+ * Human superusers pass every gate. Staff retain the historical admin-only
+ * bypass, but do not gain organization ownership or billing authority. Agent
+ * principals never inherit human-owner flags. System principals need an
+ * explicit service permission. Organization decisions use only Account's
+ * canonical live id, slug, and role facts.
+ */
+export declare function authorize(request: AuthorizationRequest): AuthorizationDecision;
+export declare function hasOrganizationPermission(role: OrganizationAuthorizationRole | null | undefined, permission: string): boolean;
+export declare const authorizeOrganizationPermission: typeof authorize;
+export declare const organizationAuthorizationRequestSchema: z.ZodObject<{
+    principal: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"human">;
+        actorId: z.ZodString;
+        accountId: z.ZodString;
+        isSuperuser: z.ZodBoolean;
+        isStaff: z.ZodBoolean;
+        permissions: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"agent">;
+        actorId: z.ZodString;
+        agentId: z.ZodString;
+        ownerAccountId: z.ZodString;
+        permissions: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"system">;
+        actorId: z.ZodString;
+        serviceId: z.ZodString;
+        permissions: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>], "kind">;
+    gate: z.ZodEnum<{
+        organization: "organization";
+        system: "system";
+        adminOnly: "adminOnly";
+        permission: "permission";
+    }>;
+    resource: z.ZodString;
+    action: z.ZodString;
+    permission: z.ZodOptional<z.ZodString>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationSlug: z.ZodOptional<z.ZodString>;
+    organizationRole: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+        owner: "owner";
+        member: "member";
+        admin: "admin";
+        billing_admin: "billing_admin";
+        viewer: "viewer";
+    }>>>;
+}, z.core.$strict>;
+export declare const organizationAuthorizationResultSchema: z.ZodObject<{
+    allowed: z.ZodBoolean;
+    reason: z.ZodEnum<{
+        superuser: "superuser";
+        "staff-admin-gate": "staff-admin-gate";
+        "explicit-permission": "explicit-permission";
+        "organization-role": "organization-role";
+        "system-permission": "system-permission";
+        "agent-principal-requires-explicit-grant": "agent-principal-requires-explicit-grant";
+        "not-a-member": "not-a-member";
+        "role-does-not-grant-permission": "role-does-not-grant-permission";
+        "missing-required-facts": "missing-required-facts";
+    }>;
+    evidence: z.ZodObject<{
+        principalKind: z.ZodEnum<{
+            agent: "agent";
+            system: "system";
+            human: "human";
+        }>;
+        gate: z.ZodEnum<{
+            organization: "organization";
+            system: "system";
+            adminOnly: "adminOnly";
+            permission: "permission";
+        }>;
+        resource: z.ZodString;
+        action: z.ZodString;
+        organizationId: z.ZodNullable<z.ZodString>;
+        organizationSlug: z.ZodNullable<z.ZodString>;
+        organizationRole: z.ZodNullable<z.ZodEnum<{
+            owner: "owner";
+            member: "member";
+            admin: "admin";
+            billing_admin: "billing_admin";
+            viewer: "viewer";
+        }>>;
+        sources: z.ZodArray<z.ZodEnum<{
+            "auth-session": "auth-session";
+            "auth-credential": "auth-credential";
+            "account-live": "account-live";
+            "service-binding": "service-binding";
+        }>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type OrganizationAuthorizationRequest = AuthorizationRequest;
+export type OrganizationAuthorizationResult = AuthorizationDecision;
+//# sourceMappingURL=organization-policy.d.ts.map

package/dist/features/authorization/organization-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-policy.d.ts","sourceRoot":"","sources":["../../../src/features/authorization/organization-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,yEAAyE;AACzE,eAAO,MAAM,mCAAmC;;;;;;EAM9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAClD,OAAO,mCAAmC,CAC1C,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;4BAsBvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,uBAAuB;;;;;EAKlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAW7B,CAAC;AACX,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,iCAAiC;;;;;;;;;;EAU5C,CAAC;AAEH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS9C,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AA8DhF;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,CA2C9E;AAED,wBAAgB,yBAAyB,CACxC,IAAI,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,EACtD,UAAU,EAAE,MAAM,GAChB,OAAO,CAET;AAED,eAAO,MAAM,+BAA+B,kBAAY,CAAC;AACzD,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAA6B,CAAC;AACjF,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA8B,CAAC;AACjF,MAAM,MAAM,gCAAgC,GAAG,oBAAoB,CAAC;AACpE,MAAM,MAAM,+BAA+B,GAAG,qBAAqB,CAAC"}

package/dist/features/authorization/organization-policy.js

@@ -0,0 +1,187 @@
+import * as z from 'zod/v4';
+/** Roles returned by Account's live organization membership contract. */
+export const organizationAuthorizationRoleSchema = z.enum([
+    'owner',
+    'admin',
+    'billing_admin',
+    'member',
+    'viewer'
+]);
+const permissionNameSchema = z
+    .string()
+    .regex(/^[a-z][a-z0-9-]*(?::[a-z][a-z0-9-]*)+$/);
+/**
+ * A server-verified principal. These objects are created after Auth verifies
+ * the session, credential, or service binding. A browser or worker must not
+ * construct one from unverified request fields.
+ */
+export const authorizationPrincipalSchema = z.discriminatedUnion('kind', [
+    z.object({
+        kind: z.literal('human'),
+        actorId: z.string().min(1),
+        accountId: z.string().min(1),
+        isSuperuser: z.boolean(),
+        isStaff: z.boolean(),
+        permissions: z.array(permissionNameSchema)
+    }).strict(),
+    z.object({
+        kind: z.literal('agent'),
+        actorId: z.string().min(1),
+        agentId: z.string().min(1),
+        ownerAccountId: z.string().min(1),
+        permissions: z.array(permissionNameSchema)
+    }).strict(),
+    z.object({
+        kind: z.literal('system'),
+        actorId: z.string().min(1),
+        serviceId: z.string().min(1),
+        permissions: z.array(permissionNameSchema)
+    }).strict()
+]);
+export const authorizationGateSchema = z.enum([
+    'permission',
+    'adminOnly',
+    'organization',
+    'system'
+]);
+/**
+ * Auth's shared authorization request. Account supplies the optional live
+ * organization facts. Missing facts are a denial, never an implicit allow.
+ */
+export const authorizationRequestSchema = z
+    .object({
+    principal: authorizationPrincipalSchema,
+    gate: authorizationGateSchema,
+    resource: z.string().min(1),
+    action: z.string().min(1),
+    permission: permissionNameSchema.optional(),
+    organizationId: z.string().min(1).optional(),
+    organizationSlug: z.string().min(1).optional(),
+    organizationRole: organizationAuthorizationRoleSchema.nullable().optional()
+})
+    .strict();
+export const authorizationDecisionReasonSchema = z.enum([
+    'superuser',
+    'staff-admin-gate',
+    'explicit-permission',
+    'organization-role',
+    'system-permission',
+    'agent-principal-requires-explicit-grant',
+    'not-a-member',
+    'role-does-not-grant-permission',
+    'missing-required-facts'
+]);
+export const authorizationDecisionEvidenceSchema = z.object({
+    principalKind: z.enum(['human', 'agent', 'system']),
+    gate: authorizationGateSchema,
+    resource: z.string(),
+    action: z.string(),
+    organizationId: z.string().nullable(),
+    organizationSlug: z.string().nullable(),
+    organizationRole: organizationAuthorizationRoleSchema.nullable(),
+    sources: z.array(z.enum(['auth-session', 'auth-credential', 'account-live', 'service-binding']))
+});
+export const authorizationDecisionSchema = z.object({
+    allowed: z.boolean(),
+    reason: authorizationDecisionReasonSchema,
+    evidence: authorizationDecisionEvidenceSchema
+});
+const ROLE_PERMISSIONS = {
+    owner: new Set([
+        'org:read',
+        'org:settings:write',
+        'org:invitations:manage',
+        'org:members:manage',
+        'org:members:promote-owner',
+        'org:billing:read',
+        'org:billing:write'
+    ]),
+    admin: new Set([
+        'org:read',
+        'org:settings:write',
+        'org:invitations:manage',
+        'org:members:manage',
+        'org:billing:read',
+        'org:billing:write'
+    ]),
+    billing_admin: new Set(['org:read', 'org:billing:read', 'org:billing:write']),
+    member: new Set(['org:read']),
+    viewer: new Set(['org:read'])
+};
+function hasExplicitPermission(principal, permission) {
+    return principal.permissions.some((candidate) => candidate === permission ||
+        candidate === '*:*' ||
+        (candidate.endsWith(':*') && permission.startsWith(candidate.slice(0, -1))));
+}
+function evidence(request) {
+    const principalKind = request.principal.kind;
+    const sources = principalKind === 'human'
+        ? ['auth-session']
+        : principalKind === 'agent'
+            ? ['auth-credential']
+            : ['service-binding'];
+    return {
+        principalKind,
+        gate: request.gate,
+        resource: request.resource,
+        action: request.action,
+        organizationId: request.organizationId ?? null,
+        organizationSlug: request.organizationSlug ?? null,
+        organizationRole: request.organizationRole ?? null,
+        sources: [...sources, ...(request.organizationId ? ['account-live'] : [])]
+    };
+}
+function decision(request, allowed, reason) {
+    return authorizationDecisionSchema.parse({ allowed, reason, evidence: evidence(request) });
+}
+/**
+ * The single shared authorization operation for Auth consumers.
+ *
+ * Human superusers pass every gate. Staff retain the historical admin-only
+ * bypass, but do not gain organization ownership or billing authority. Agent
+ * principals never inherit human-owner flags. System principals need an
+ * explicit service permission. Organization decisions use only Account's
+ * canonical live id, slug, and role facts.
+ */
+export function authorize(request) {
+    const value = authorizationRequestSchema.parse(request);
+    if (value.principal.kind === 'human' && value.principal.isSuperuser) {
+        return decision(value, true, 'superuser');
+    }
+    if (value.gate === 'adminOnly') {
+        if (value.principal.kind === 'human' && value.principal.isStaff) {
+            return decision(value, true, 'staff-admin-gate');
+        }
+        if (value.principal.kind !== 'human') {
+            return decision(value, false, 'agent-principal-requires-explicit-grant');
+        }
+    }
+    if (value.gate === 'organization') {
+        if (value.principal.kind !== 'human') {
+            return decision(value, false, 'agent-principal-requires-explicit-grant');
+        }
+        if (!value.organizationId || !value.organizationSlug || !value.organizationRole) {
+            return decision(value, false, 'missing-required-facts');
+        }
+        const required = value.permission ?? `${value.resource}:${value.action}`;
+        if (!ROLE_PERMISSIONS[value.organizationRole].has(required)) {
+            return decision(value, false, 'role-does-not-grant-permission');
+        }
+        return decision(value, true, 'organization-role');
+    }
+    const required = value.permission ?? `${value.resource}:${value.action}`;
+    if (hasExplicitPermission(value.principal, required)) {
+        return decision(value, true, value.principal.kind === 'system' ? 'system-permission' : 'explicit-permission');
+    }
+    if (value.principal.kind !== 'human') {
+        return decision(value, false, 'agent-principal-requires-explicit-grant');
+    }
+    return decision(value, false, 'missing-required-facts');
+}
+export function hasOrganizationPermission(role, permission) {
+    return role ? ROLE_PERMISSIONS[role].has(permission) : false;
+}
+export const authorizeOrganizationPermission = authorize;
+export const organizationAuthorizationRequestSchema = authorizationRequestSchema;
+export const organizationAuthorizationResultSchema = authorizationDecisionSchema;
+//# sourceMappingURL=organization-policy.js.map

package/dist/features/authorization/organization-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-policy.js","sourceRoot":"","sources":["../../../src/features/authorization/organization-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,yEAAyE;AACzE,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,IAAI,CAAC;IACzD,OAAO;IACP,OAAO;IACP,eAAe;IACf,QAAQ;IACR,QAAQ;CACR,CAAC,CAAC;AAKH,MAAM,oBAAoB,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,KAAK,CAAC,wCAAwC,CAAC,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACxE,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;KAC1C,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;KAC1C,CAAC,CAAC,MAAM,EAAE;IACX,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;KAC1C,CAAC,CAAC,MAAM,EAAE;CACX,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,YAAY;IACZ,WAAW;IACX,cAAc;IACd,QAAQ;CACR,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACzC,MAAM,CAAC;IACP,SAAS,EAAE,4BAA4B;IACvC,IAAI,EAAE,uBAAuB;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,gBAAgB,EAAE,mCAAmC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE,CAAC;AAGX,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,IAAI,CAAC;IACvD,WAAW;IACX,kBAAkB;IAClB,qBAAqB;IACrB,mBAAmB;IACnB,mBAAmB;IACnB,yCAAyC;IACzC,cAAc;IACd,gCAAgC;IAChC,wBAAwB;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,EAAE,uBAAuB;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,gBAAgB,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IAChE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;CAChG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,iCAAiC;IACzC,QAAQ,EAAE,mCAAmC;CAC7C,CAAC,CAAC;AAGH,MAAM,gBAAgB,GAAG;IACxB,KAAK,EAAE,IAAI,GAAG,CAAC;QACd,UAAU;QACV,oBAAoB;QACpB,wBAAwB;QACxB,oBAAoB;QACpB,2BAA2B;QAC3B,kBAAkB;QAClB,mBAAmB;KACnB,CAAC;IACF,KAAK,EAAE,IAAI,GAAG,CAAC;QACd,UAAU;QACV,oBAAoB;QACpB,wBAAwB;QACxB,oBAAoB;QACpB,kBAAkB;QAClB,mBAAmB;KACnB,CAAC;IACF,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IAC7E,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;CACwC,CAAC;AAEvE,SAAS,qBAAqB,CAAC,SAAiC,EAAE,UAAkB;IACnF,OAAO,SAAS,CAAC,WAAW,CAAC,IAAI,CAChC,CAAC,SAAS,EAAE,EAAE,CACb,SAAS,KAAK,UAAU;QACxB,SAAS,KAAK,KAAK;QACnB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAC5E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAA6B;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;IAC7C,MAAM,OAAO,GACZ,aAAa,KAAK,OAAO;QACxB,CAAC,CAAE,CAAC,cAAc,CAAW;QAC7B,CAAC,CAAC,aAAa,KAAK,OAAO;YAC1B,CAAC,CAAE,CAAC,iBAAiB,CAAW;YAChC,CAAC,CAAE,CAAC,iBAAiB,CAAW,CAAC;IACpC,OAAO;QACN,aAAa;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;QAC9C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;QAClD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;QAClD,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KACnF,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAChB,OAA6B,EAC7B,OAAgB,EAChB,MAAyD;IAEzD,OAAO,2BAA2B,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,OAA6B;IACtD,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAExD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,yCAAyC,CAAC,CAAC;QAC1E,CAAC;IACF,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,yCAAyC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACjF,OAAO,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACzE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,OAAO,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,gCAAgC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;IACzE,IAAI,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtD,OAAO,QAAQ,CACd,KAAK,EACL,IAAI,EACJ,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAC/E,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,yCAAyC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,IAAsD,EACtD,UAAkB;IAElB,OAAO,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,SAAS,CAAC;AACzD,MAAM,CAAC,MAAM,sCAAsC,GAAG,0BAA0B,CAAC;AACjF,MAAM,CAAC,MAAM,qCAAqC,GAAG,2BAA2B,CAAC"}

package/dist/features/config/auth-api.d.ts

@@ -0,0 +1,4 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+/** The declared auth service wins; environment apps.auth supports older hosts. */
+export declare function resolveAuthApiBaseUrl(runtime: RuntimeRef): Promise<string>;
+//# sourceMappingURL=auth-api.d.ts.map

package/dist/features/config/auth-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-api.d.ts","sourceRoot":"","sources":["../../../src/features/config/auth-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG/F,kFAAkF;AAClF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBhF"}

package/dist/features/config/auth-api.js

@@ -0,0 +1,20 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+/** The declared auth service wins; environment apps.auth supports older hosts. */
+export async function resolveAuthApiBaseUrl(runtime) {
+    if (runtime.hasKind('infra/service')) {
+        const services = runtime.query('infra/service').withId('auth').descriptors();
+        if (services.length > 0)
+            return serviceOrigin(runtime, 'auth');
+    }
+    if (runtime.hasKind('config/environment')) {
+        const environment = await runtime.query('config/environment').resolve();
+        const apps = environment?.descriptor ? environment.descriptor.apps : environment?.apps;
+        if (apps?.auth)
+            return new URL(apps.auth).origin;
+    }
+    throw new CapabilityError('Auth has no declared origin in this runtime.', 'NOT_FOUND', {
+        reason: runtime.hasKind('config/environment') ? 'auth-origin-unresolved' : 'service-undeclared', details: { serviceId: 'auth' }
+    });
+}
+//# sourceMappingURL=auth-api.js.map

package/dist/features/config/auth-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-api.js","sourceRoot":"","sources":["../../../src/features/config/auth-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA2C,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAmB;IAC9D,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,KAAK,CAGpC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC;QACvF,IAAI,IAAI,EAAE,IAAI;YAAE,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,8CAA8C,EAAE,WAAW,EAAE;QACtF,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,oBAAoB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;KAC/H,CAAC,CAAC;AACJ,CAAC"}

package/dist/features/config/e2e.d.ts

@@ -0,0 +1,9 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+export declare const AUTH_E2E_LOCAL_ORIGIN = "https://auth.vibes.local";
+export declare const AUTH_E2E_DEV_SERVER_ORIGIN = "http://localhost:4173";
+/** An explicit test-host setting, never a shell environment alias. */
+export declare function resolveAuthE2EOriginOverride(runtime: RuntimeRef): Promise<string | undefined>;
+export declare function resolveAuthE2EOrigin(runtime: RuntimeRef): Promise<string>;
+export declare function resolveAuthE2EBaseUrl(runtime: RuntimeRef): Promise<string>;
+export declare function shouldUseExternalAuthOrigin(runtime: RuntimeRef): Promise<boolean>;
+//# sourceMappingURL=e2e.d.ts.map

package/dist/features/config/e2e.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e.d.ts","sourceRoot":"","sources":["../../../src/features/config/e2e.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAExE,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAChE,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAMlE,sEAAsE;AACtE,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAEnG;AACD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/E;AACD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhF;AACD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF"}

package/dist/features/config/e2e.js

@@ -0,0 +1,21 @@
+import * as z from 'zod/v4';
+import { readPluginConfig } from '@vibesdotdev/kernel';
+export const AUTH_E2E_LOCAL_ORIGIN = 'https://auth.vibes.local';
+export const AUTH_E2E_DEV_SERVER_ORIGIN = 'http://localhost:4173';
+const AuthTestHostConfig = z.object({
+    e2e: z.object({ origin: z.url().optional() }).strict().prefault({})
+}).passthrough();
+/** An explicit test-host setting, never a shell environment alias. */
+export async function resolveAuthE2EOriginOverride(runtime) {
+    return (await readPluginConfig(runtime, 'auth', AuthTestHostConfig))?.e2e.origin;
+}
+export async function resolveAuthE2EOrigin(runtime) {
+    return await resolveAuthE2EOriginOverride(runtime) ?? AUTH_E2E_LOCAL_ORIGIN;
+}
+export async function resolveAuthE2EBaseUrl(runtime) {
+    return await resolveAuthE2EOriginOverride(runtime) ?? AUTH_E2E_DEV_SERVER_ORIGIN;
+}
+export async function shouldUseExternalAuthOrigin(runtime) {
+    return Boolean(await resolveAuthE2EOriginOverride(runtime));
+}
+//# sourceMappingURL=e2e.js.map

package/dist/features/config/e2e.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e.js","sourceRoot":"","sources":["../../../src/features/config/e2e.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAmB,MAAM,qBAAqB,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAChE,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAElE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAAmB;IACrE,OAAO,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC;AAClF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAmB;IAC7D,OAAO,MAAM,4BAA4B,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC;AAC7E,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAmB;IAC9D,OAAO,MAAM,4BAA4B,CAAC,OAAO,CAAC,IAAI,0BAA0B,CAAC;AAClF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAmB;IACpE,OAAO,OAAO,CAAC,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/features/core/shared/auth-errors.d.ts

@@ -0,0 +1,2 @@
+export declare function getAuthErrorMessage(value: string | null | undefined, fallback?: string): string | null;
+//# sourceMappingURL=auth-errors.d.ts.map

package/dist/features/core/shared/auth-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-errors.d.ts","sourceRoot":"","sources":["../../../../src/features/core/shared/auth-errors.ts"],"names":[],"mappings":"AAyDA,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,QAAQ,SAA4D,GAClE,MAAM,GAAG,IAAI,CAqBf"}

package/dist/features/core/shared/auth-errors.js

@@ -0,0 +1,68 @@
+const AUTH_ERROR_MESSAGES = new Map(Object.entries({
+    account_not_linked: 'This sign-in method is not linked to your account yet. Sign in with your existing method first, then connect this provider from your account settings.',
+    email_doesnt_match: 'This sign-in method uses a different email address than your existing account.',
+    email_not_found: 'Your sign-in provider did not return an email address for this account. Try another sign-in method, or use an account that has a primary email address.',
+    email_not_verified: 'Please verify your email address before signing in.',
+    internal_server_error: 'We hit an internal authentication error. Please try again.',
+    invalid_callback_request: 'We could not validate the sign-in response. Please try again.',
+    invalid_callback_url: 'This app is not registered as a sign-in destination. Update the app and try again.',
+    invalid_code: 'This sign-in attempt expired or was already used. Please start again.',
+    no_callback_url: 'The sign-in flow is missing a return URL. Please try again.',
+    no_code: 'The sign-in provider did not complete the sign-in flow. Please try again.',
+    oauth_provider_not_found: 'This sign-in provider is not available right now.',
+    please_restart_the_process: 'This sign-in attempt could not be verified. Please start again.',
+    signup_disabled: 'New sign-ups are currently disabled for this sign-in method.',
+    state_mismatch: 'This sign-in attempt could not be verified. Please try again.',
+    state_not_found: 'This sign-in attempt could not be verified. Please try again.',
+    unable_to_create_session: 'We could not finish signing you in. Please try again.',
+    unable_to_create_user: 'We could not create your account. Please try again.',
+    unable_to_get_user_info: 'We could not read your account details from the sign-in provider. Please try again.',
+    unable_to_link_account: 'We could not link this sign-in method to your account. Sign in with your existing method first, then connect this provider from your account settings.'
+}));
+/**
+ * Percent-decode a query value without throwing: a valid `%XX` escape is
+ * decoded, a malformed one stays literal, and bytes that are not UTF-8
+ * become U+FFFD.
+ */
+function decodeAuthError(value) {
+    const encoder = new TextEncoder();
+    const bytes = [];
+    for (const part of value.split(/(%[0-9a-fA-F]{2})/)) {
+        if (/^%[0-9a-fA-F]{2}$/.test(part))
+            bytes.push(Number.parseInt(part.slice(1), 16));
+        else
+            bytes.push(...encoder.encode(part));
+    }
+    return new TextDecoder().decode(Uint8Array.from(bytes));
+}
+function normalizeAuthErrorCode(value) {
+    return value
+        .trim()
+        .replace(/([a-z])([A-Z])/g, '$1_$2')
+        .toLowerCase()
+        .replace(/['’]/g, '')
+        .replace(/\s+/g, '_');
+}
+function looksLikeAuthErrorCode(value) {
+    const trimmed = value.trim();
+    return !trimmed.includes(' ') && (trimmed.includes('_') || trimmed.includes('-'));
+}
+export function getAuthErrorMessage(value, fallback = 'We could not complete authentication. Please try again.') {
+    if (!value) {
+        return null;
+    }
+    const decoded = decodeAuthError(value).trim();
+    if (!decoded) {
+        return null;
+    }
+    const normalized = normalizeAuthErrorCode(decoded);
+    const mapped = AUTH_ERROR_MESSAGES.get(normalized);
+    if (mapped) {
+        return mapped;
+    }
+    if (looksLikeAuthErrorCode(decoded)) {
+        return fallback;
+    }
+    return decoded;
+}
+//# sourceMappingURL=auth-errors.js.map

package/dist/features/core/shared/auth-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-errors.js","sourceRoot":"","sources":["../../../../src/features/core/shared/auth-errors.ts"],"names":[],"mappings":"AAAA,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAiB,MAAM,CAAC,OAAO,CAAC;IAClE,kBAAkB,EACjB,wJAAwJ;IACzJ,kBAAkB,EACjB,gFAAgF;IACjF,eAAe,EACd,yJAAyJ;IAC1J,kBAAkB,EAAE,qDAAqD;IACzE,qBAAqB,EAAE,4DAA4D;IACnF,wBAAwB,EAAE,+DAA+D;IACzF,oBAAoB,EACnB,oFAAoF;IACrF,YAAY,EAAE,uEAAuE;IACrF,eAAe,EAAE,6DAA6D;IAC9E,OAAO,EAAE,2EAA2E;IACpF,wBAAwB,EAAE,mDAAmD;IAC7E,0BAA0B,EAAE,iEAAiE;IAC7F,eAAe,EAAE,8DAA8D;IAC/E,cAAc,EAAE,+DAA+D;IAC/E,eAAe,EAAE,+DAA+D;IAChF,wBAAwB,EAAE,uDAAuD;IACjF,qBAAqB,EAAE,qDAAqD;IAC5E,uBAAuB,EACtB,qFAAqF;IACtF,sBAAsB,EACrB,wJAAwJ;CACzJ,CAAC,CAAC,CAAC;AAEJ;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;;YAC9E,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC5C,OAAO,KAAK;SACV,IAAI,EAAE;SACN,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;SACnC,WAAW,EAAE;SACb,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAClC,KAAgC,EAChC,QAAQ,GAAG,yDAAyD;IAEpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IAAI,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/features/email/email.config.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { ConfigManifestDescriptor } from '@vibesdotdev/config/schemas/config-manifest-descriptor';
+declare const descriptor: ConfigManifestDescriptor;
+export default descriptor;
+//# sourceMappingURL=email.config.descriptor.d.ts.map

package/dist/features/email/email.config.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.config.descriptor.d.ts","sourceRoot":"","sources":["../../../src/features/email/email.config.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAGvG,QAAA,MAAM,UAAU,EAAE,wBAUjB,CAAC;AACF,eAAe,UAAU,CAAC"}