@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/schemas/registered-app.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Registered-app resolution: which app in Auth's registry owns a browser origin.
+ *
+ * Auth's app registry (`auth_oauth_application` in auth-web) is the only source
+ * of origin trust. An origin resolves to an app when an enabled registry row,
+ * marked `redirect_origin_trusted` by an authorized registrar, lists a redirect
+ * URL at that origin. Dynamic client registration never sets the flag or the
+ * owning organization, so a self-registered client never resolves.
+ *
+ * A non-null answer is trust. Null means refuse: the origin is unregistered,
+ * disabled, untrusted, or claimed by more than one owning organization.
+ *
+ * Callers authenticate as their own registered app: a `client_credentials`
+ * token with the `apps:resolve` scope, minted from the app's registrar-issued
+ * credential. Owner visibility follows the caller (see `ownership`).
+ */
+import * as z from 'zod/v4';
+/**
+ * The registered app that owns a trusted origin, with what the caller may see
+ * of its owner:
+ * - `owned`: the owning organization, shown because it is the caller's own or
+ *   the caller holds the platform-intake scope `apps:owner`;
+ * - `unowned`: no organization owns the app;
+ * - `hidden`: an organization owns the app and the caller may not see which.
+ *   Never treat it as `unowned`.
+ */
+export declare const RegisteredAppSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    ownership: z.ZodLiteral<"owned">;
+    organizationId: z.ZodString;
+    clientId: z.ZodString;
+    name: z.ZodString;
+    trusted: z.ZodLiteral<true>;
+}, z.core.$strict>, z.ZodObject<{
+    ownership: z.ZodLiteral<"unowned">;
+    organizationId: z.ZodNull;
+    clientId: z.ZodString;
+    name: z.ZodString;
+    trusted: z.ZodLiteral<true>;
+}, z.core.$strict>, z.ZodObject<{
+    ownership: z.ZodLiteral<"hidden">;
+    organizationId: z.ZodNull;
+    clientId: z.ZodString;
+    name: z.ZodString;
+    trusted: z.ZodLiteral<true>;
+}, z.core.$strict>], "ownership">;
+export type RegisteredApp = z.infer<typeof RegisteredAppSchema>;
+export type RegisteredAppOwnership = RegisteredApp['ownership'];
+/** Request body of `POST /api/internal/registered-apps/resolve`. */
+export declare const RegisteredOriginResolveRequestSchema: z.ZodObject<{
+    origin: z.ZodString;
+}, z.core.$strict>;
+export type RegisteredOriginResolveRequest = z.infer<typeof RegisteredOriginResolveRequestSchema>;
+/**
+ * Response body: always 200 with `app` null for "not a registered, trusted
+ * origin". A 404 means the Auth deployment predates the route, never "untrusted".
+ */
+export declare const RegisteredOriginResolveResponseSchema: z.ZodObject<{
+    app: z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        ownership: z.ZodLiteral<"owned">;
+        organizationId: z.ZodString;
+        clientId: z.ZodString;
+        name: z.ZodString;
+        trusted: z.ZodLiteral<true>;
+    }, z.core.$strict>, z.ZodObject<{
+        ownership: z.ZodLiteral<"unowned">;
+        organizationId: z.ZodNull;
+        clientId: z.ZodString;
+        name: z.ZodString;
+        trusted: z.ZodLiteral<true>;
+    }, z.core.$strict>, z.ZodObject<{
+        ownership: z.ZodLiteral<"hidden">;
+        organizationId: z.ZodNull;
+        clientId: z.ZodString;
+        name: z.ZodString;
+        trusted: z.ZodLiteral<true>;
+    }, z.core.$strict>], "ownership">>;
+}, z.core.$strict>;
+export type RegisteredOriginResolveResponse = z.infer<typeof RegisteredOriginResolveResponseSchema>;
+/**
+ * The canonical origin of an http(s) URL or origin string, or null when it
+ * can confer no trust: unparseable, the opaque `"null"` origin, a non-http(s)
+ * scheme, or a URL carrying user info. Auth's registry and every caller use
+ * this one normalization so both sides compare the same string.
+ */
+export declare function canonicalRegisteredOrigin(value: string | null | undefined): string | null;
+//# sourceMappingURL=registered-app.d.ts.map

package/dist/schemas/registered-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registered-app.d.ts","sourceRoot":"","sources":["../../src/schemas/registered-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAW5B;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;iCAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,sBAAsB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;AAEhE,oEAAoE;AACpE,eAAO,MAAM,oCAAoC;;kBAG/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;GAGG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;kBAEhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAMzF"}

package/dist/schemas/registered-app.js

@@ -0,0 +1,68 @@
+/**
+ * Registered-app resolution: which app in Auth's registry owns a browser origin.
+ *
+ * Auth's app registry (`auth_oauth_application` in auth-web) is the only source
+ * of origin trust. An origin resolves to an app when an enabled registry row,
+ * marked `redirect_origin_trusted` by an authorized registrar, lists a redirect
+ * URL at that origin. Dynamic client registration never sets the flag or the
+ * owning organization, so a self-registered client never resolves.
+ *
+ * A non-null answer is trust. Null means refuse: the origin is unregistered,
+ * disabled, untrusted, or claimed by more than one owning organization.
+ *
+ * Callers authenticate as their own registered app: a `client_credentials`
+ * token with the `apps:resolve` scope, minted from the app's registrar-issued
+ * credential. Owner visibility follows the caller (see `ownership`).
+ */
+import * as z from 'zod/v4';
+const registeredAppIdentity = {
+    /** OAuth client id of the registry row. Public, safe to log. */
+    clientId: z.string().min(1),
+    /** Registered client name. */
+    name: z.string().min(1),
+    /** Always true: an origin without registrar-set trust resolves to null instead. */
+    trusted: z.literal(true)
+};
+/**
+ * The registered app that owns a trusted origin, with what the caller may see
+ * of its owner:
+ * - `owned`: the owning organization, shown because it is the caller's own or
+ *   the caller holds the platform-intake scope `apps:owner`;
+ * - `unowned`: no organization owns the app;
+ * - `hidden`: an organization owns the app and the caller may not see which.
+ *   Never treat it as `unowned`.
+ */
+export const RegisteredAppSchema = z.discriminatedUnion('ownership', [
+    z.strictObject({ ...registeredAppIdentity, ownership: z.literal('owned'), organizationId: z.string().min(1) }),
+    z.strictObject({ ...registeredAppIdentity, ownership: z.literal('unowned'), organizationId: z.null() }),
+    z.strictObject({ ...registeredAppIdentity, ownership: z.literal('hidden'), organizationId: z.null() })
+]);
+/** Request body of `POST /api/internal/registered-apps/resolve`. */
+export const RegisteredOriginResolveRequestSchema = z.strictObject({
+    /** A canonical http(s) origin, as `canonicalRegisteredOrigin` returns it. */
+    origin: z.string().min(1).max(2048)
+});
+/**
+ * Response body: always 200 with `app` null for "not a registered, trusted
+ * origin". A 404 means the Auth deployment predates the route, never "untrusted".
+ */
+export const RegisteredOriginResolveResponseSchema = z.strictObject({
+    app: RegisteredAppSchema.nullable()
+});
+/**
+ * The canonical origin of an http(s) URL or origin string, or null when it
+ * can confer no trust: unparseable, the opaque `"null"` origin, a non-http(s)
+ * scheme, or a URL carrying user info. Auth's registry and every caller use
+ * this one normalization so both sides compare the same string.
+ */
+export function canonicalRegisteredOrigin(value) {
+    if (!value || !URL.canParse(value))
+        return null;
+    const parsed = new URL(value);
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:')
+        return null;
+    if (parsed.username || parsed.password)
+        return null;
+    return parsed.origin;
+}
+//# sourceMappingURL=registered-app.js.map

package/dist/schemas/registered-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registered-app.js","sourceRoot":"","sources":["../../src/schemas/registered-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,qBAAqB,GAAG;IAC7B,gEAAgE;IAChE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,8BAA8B;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,mFAAmF;IACnF,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CACxB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IACpE,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACvG,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;CACtG,CAAC,CAAC;AAIH,oEAAoE;AACpE,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,6EAA6E;IAC7E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAgC;IACzE,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC;AACtB,CAAC"}

package/dist/schemas/session-verification.d.ts

@@ -0,0 +1,87 @@
+import * as z from 'zod/v4';
+import type { JWTPayload } from 'jose';
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { RuntimeClient } from '@vibesdotdev/kernel/client';
+export declare const jwtSessionFetcherSchema: z.ZodCustom<z.core.$InferOuterFunctionType<z.ZodTuple<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<URL>, z.ZodCustom<Request, Request>]>, z.ZodOptional<z.ZodCustom<RequestInit, RequestInit>>], null>, z.ZodPromise<z.ZodInstanceOf<Response>>>, z.core.$InferOuterFunctionType<z.ZodTuple<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<URL>, z.ZodCustom<Request, Request>]>, z.ZodOptional<z.ZodCustom<RequestInit, RequestInit>>], null>, z.ZodPromise<z.ZodInstanceOf<Response>>>>;
+export type JwtSessionFetcher = z.infer<typeof jwtSessionFetcherSchema>;
+export declare const delegatedActorVerificationOptionsSchema: z.ZodObject<{
+    token: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    authOrigin: z.ZodString;
+    runtime: z.ZodCustom<VibesRuntime, VibesRuntime>;
+    serviceBindingFetcher: z.ZodOptional<z.ZodCustom<z.core.$InferOuterFunctionType<z.ZodTuple<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<URL>, z.ZodCustom<Request, Request>]>, z.ZodOptional<z.ZodCustom<RequestInit, RequestInit>>], null>, z.ZodPromise<z.ZodInstanceOf<Response>>>, z.core.$InferOuterFunctionType<z.ZodTuple<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<URL>, z.ZodCustom<Request, Request>]>, z.ZodOptional<z.ZodCustom<RequestInit, RequestInit>>], null>, z.ZodPromise<z.ZodInstanceOf<Response>>>>>;
+    jwksFetchTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    fetcher: z.ZodOptional<z.ZodCustom<z.core.$InferOuterFunctionType<z.ZodTuple<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<URL>, z.ZodCustom<Request, Request>]>, z.ZodOptional<z.ZodCustom<RequestInit, RequestInit>>], null>, z.ZodPromise<z.ZodInstanceOf<Response>>> | z.core.$InferOuterFunctionType<z.ZodTuple<readonly [], null>, z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<URL>, z.ZodCustom<Request, Request>]>, z.ZodOptional<z.ZodCustom<RequestInit, RequestInit>>], null>, z.ZodPromise<z.ZodInstanceOf<Response>>>>> | null, z.core.$InferOuterFunctionType<z.ZodTuple<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<URL>, z.ZodCustom<Request, Request>]>, z.ZodOptional<z.ZodCustom<RequestInit, RequestInit>>], null>, z.ZodPromise<z.ZodInstanceOf<Response>>> | z.core.$InferOuterFunctionType<z.ZodTuple<readonly [], null>, z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<URL>, z.ZodCustom<Request, Request>]>, z.ZodOptional<z.ZodCustom<RequestInit, RequestInit>>], null>, z.ZodPromise<z.ZodInstanceOf<Response>>>>> | null>>;
+}, z.core.$strip>;
+export type DelegatedActorVerificationOptions = z.infer<typeof delegatedActorVerificationOptionsSchema>;
+export declare const orgClaimSchema: z.ZodObject<{
+    id: z.ZodString;
+    role: z.ZodString;
+    slug: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+export type OrgClaim = z.infer<typeof orgClaimSchema>;
+/** Verified tenant-gate projection; no credential crosses this boundary. */
+export declare const delegatedActorClaimsSchema: z.ZodObject<{
+    userId: z.ZodString;
+    orgs: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        role: z.ZodString;
+        slug: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+    }, z.core.$strip>>;
+    staff: z.ZodBoolean;
+    isSuperuser: z.ZodBoolean;
+}, z.core.$strip>;
+export type DelegatedActorClaims = z.infer<typeof delegatedActorClaimsSchema>;
+/** Dependency failures reject with their typed CapabilityError instead of becoming invalid credentials. */
+export declare const delegatedActorVerificationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"verified">;
+    claims: z.ZodObject<{
+        userId: z.ZodString;
+        orgs: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            role: z.ZodString;
+            slug: z.ZodCatch<z.ZodOptional<z.ZodString>>;
+        }, z.core.$strip>>;
+        staff: z.ZodBoolean;
+        isSuperuser: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    status: z.ZodLiteral<"invalid">;
+    reason: z.ZodEnum<{
+        invalid: "invalid";
+        scope: "scope";
+        missing: "missing";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+}, z.core.$strip>], "status">;
+export type DelegatedActorVerification = z.infer<typeof delegatedActorVerificationSchema>;
+export declare const jwksEntrySchema: z.ZodObject<{
+    resolver: z.ZodCustom<import("jose").LocalJWKSet, import("jose").LocalJWKSet>;
+    expiresAtMs: z.ZodNumber;
+}, z.core.$strip>;
+export type JwksEntry = z.infer<typeof jwksEntrySchema>;
+export declare const sessionVerificationStateSchema: z.ZodObject<{
+    active: z.ZodDefault<z.ZodBoolean>;
+    jwksByOrigin: z.ZodDefault<z.ZodMap<z.ZodString, z.ZodObject<{
+        resolver: z.ZodCustom<import("jose").LocalJWKSet, import("jose").LocalJWKSet>;
+        expiresAtMs: z.ZodNumber;
+    }, z.core.$strip>>>;
+    jwksForceRefreshAtMs: z.ZodDefault<z.ZodMap<z.ZodString, z.ZodNumber>>;
+    jwksRefillInFlight: z.ZodDefault<z.ZodMap<z.ZodString, z.ZodCustom<Promise<{
+        resolver: import("jose").LocalJWKSet;
+        expiresAtMs: number;
+    }>, Promise<{
+        resolver: import("jose").LocalJWKSet;
+        expiresAtMs: number;
+    }>>>>;
+    apiKeyCache: z.ZodDefault<z.ZodMap<z.ZodString, z.ZodObject<{
+        expiresAtMs: z.ZodNumber;
+        payload: z.ZodCustom<JWTPayload | null, JWTPayload | null>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type SessionVerificationState = z.infer<typeof sessionVerificationStateSchema>;
+/** Verification needs no HTTP client initialization or auth-origin configuration. */
+export interface SessionVerificationClient extends RuntimeClient {
+    readonly sessionVerificationState: SessionVerificationState;
+}
+//# sourceMappingURL=session-verification.d.ts.map

package/dist/schemas/session-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-verification.d.ts","sourceRoot":"","sources":["../../src/schemas/session-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,MAAM,CAAC;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAMhE,eAAO,MAAM,uBAAuB,ufAEnC,CAAC;AAMF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,uCAAuC;;;;;;;iBASlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,4EAA4E;AAC5E,eAAO,MAAM,0BAA0B;;;;;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,2GAA2G;AAC3G,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;6BAG3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;iBAQzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,qFAAqF;AACrF,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC/D,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB,CAAC;CAC5D"}

package/dist/schemas/session-verification.js

@@ -0,0 +1,49 @@
+import * as z from 'zod/v4';
+import { AuthFetchSchema } from "./consumer-auth.js";
+// Validate with the callable owner while retaining function identity and arity:
+// resolveFetcher distinguishes a direct transport from a zero-argument getter.
+export const jwtSessionFetcherSchema = z.custom(value => AuthFetchSchema.safeParse(value).success);
+const fetcherOptionSchema = z.union([
+    AuthFetchSchema,
+    z.function({ input: [], output: AuthFetchSchema.optional() }),
+    z.null()
+]);
+export const delegatedActorVerificationOptionsSchema = z.object({
+    token: z.string().nullish(),
+    authOrigin: z.string(),
+    runtime: z.custom(),
+    serviceBindingFetcher: jwtSessionFetcherSchema.optional(),
+    jwksFetchTimeoutMs: z.number().positive().optional(),
+    fetcher: z.custom(value => fetcherOptionSchema.safeParse(value).success).optional()
+});
+export const orgClaimSchema = z.object({
+    id: z.string(),
+    role: z.string(),
+    slug: z.string().optional().catch(undefined)
+});
+/** Verified tenant-gate projection; no credential crosses this boundary. */
+export const delegatedActorClaimsSchema = z.object({
+    userId: z.string().min(1),
+    orgs: z.array(orgClaimSchema),
+    staff: z.boolean(),
+    isSuperuser: z.boolean()
+});
+/** Dependency failures reject with their typed CapabilityError instead of becoming invalid credentials. */
+export const delegatedActorVerificationSchema = z.discriminatedUnion('status', [
+    z.object({ status: z.literal('verified'), claims: delegatedActorClaimsSchema }),
+    z.object({ status: z.literal('invalid'), reason: z.enum(['missing', 'invalid', 'expired', 'scope', 'revoked']) })
+]);
+export const jwksEntrySchema = z.object({
+    resolver: z.custom(),
+    expiresAtMs: z.number()
+});
+export const sessionVerificationStateSchema = z.object({
+    active: z.boolean().default(true),
+    jwksByOrigin: z.map(z.string(), jwksEntrySchema).default(() => new Map()),
+    jwksForceRefreshAtMs: z.map(z.string(), z.number()).default(() => new Map()),
+    jwksRefillInFlight: z.map(z.string(), z.custom()).default(() => new Map()),
+    apiKeyCache: z.map(z.string(), z.object({
+        expiresAtMs: z.number(), payload: z.custom()
+    })).default(() => new Map())
+});
+//# sourceMappingURL=session-verification.js.map

package/dist/schemas/session-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-verification.js","sourceRoot":"","sources":["../../src/schemas/session-verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAC9C,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CACjD,CAAC;AACF,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC;IACnC,eAAe;IACf,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC7D,CAAC,CAAC,IAAI,EAAE;CACR,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAgB;IACjC,qBAAqB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IACzD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,CAChB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CACrD,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAC5C,CAAC,CAAC;AAGH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAGH,2GAA2G;AAC3G,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC9E,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAC/E,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;CACjH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAwC;IAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;IACzE,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;IAC5E,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAsB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;IAC9F,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;QACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAqB;KAC/D,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC;CAC5B,CAAC,CAAC"}

package/dist/schemas/tui-actions.d.ts

@@ -0,0 +1,17 @@
+import * as z from 'zod/v4';
+import type { RuntimeClient } from '@vibesdotdev/kernel/client';
+import type { TuiStateContext } from '@vibesdotdev/tui/kinds/tui-state';
+import type { AuthIdentityState } from '../tui/auth.tui-state.key.ts';
+export declare const authTuiActionsSchema: z.ZodObject<{
+    refresh: z.ZodCustom<() => Promise<void>, () => Promise<void>>;
+    signIn: z.ZodCustom<() => Promise<void>, () => Promise<void>>;
+    signOut: z.ZodCustom<() => Promise<void>, () => Promise<void>>;
+}, z.core.$strip>;
+export type AuthTuiActions = z.infer<typeof authTuiActionsSchema>;
+export type AuthTuiContext = TuiStateContext<AuthIdentityState>;
+export interface AuthTuiActionsClient extends RuntimeClient {
+    attach(ctx: AuthTuiContext, actions: AuthTuiActions): () => boolean;
+    get(ctx: AuthTuiContext): AuthTuiActions | undefined;
+    remove(ctx: AuthTuiContext): void;
+}
+//# sourceMappingURL=tui-actions.d.ts.map

package/dist/schemas/tui-actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tui-actions.d.ts","sourceRoot":"","sources":["../../src/schemas/tui-actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,eAAO,MAAM,oBAAoB;+BACR,OAAO,CAAC,IAAI,CAAC,QAAb,OAAO,CAAC,IAAI,CAAC;8BACd,OAAO,CAAC,IAAI,CAAC,QAAb,OAAO,CAAC,IAAI,CAAC;+BACZ,OAAO,CAAC,IAAI,CAAC,QAAb,OAAO,CAAC,IAAI,CAAC;iBACpC,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,cAAc,GAAG,eAAe,CAAC,iBAAiB,CAAC,CAAC;AAChE,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IAC1D,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,OAAO,CAAC;IACpE,GAAG,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAAC;IACrD,MAAM,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAC;CAClC"}

package/dist/schemas/tui-actions.js

@@ -0,0 +1,7 @@
+import * as z from 'zod/v4';
+export const authTuiActionsSchema = z.object({
+    refresh: z.custom(),
+    signIn: z.custom(),
+    signOut: z.custom()
+});
+//# sourceMappingURL=tui-actions.js.map

package/dist/schemas/tui-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tui-actions.js","sourceRoot":"","sources":["../../src/schemas/tui-actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAuB;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAuB;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAuB;CACxC,CAAC,CAAC"}

package/dist/schemas/types.d.ts

@@ -0,0 +1,3 @@
+export type { Session, AuthKey, AuthAttempt, ApiKey, ExternalApplication, AuthToken, TotpSecret, RecoveryCode, DatabaseUserAttributes, ApiScope, ApiKeyWithApplication, SessionWithUser, AuthState, ValidatedSessionContext } from './auth/types.ts';
+export { apiScopes } from './auth/types.ts';
+//# sourceMappingURL=types.d.ts.map

package/dist/schemas/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/schemas/types.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,OAAO,EACP,OAAO,EACP,WAAW,EACX,MAAM,EACN,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,sBAAsB,EACtB,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,SAAS,EACT,uBAAuB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/schemas/types.js

@@ -0,0 +1,2 @@
+export { apiScopes } from "./auth/types.js";
+//# sourceMappingURL=types.js.map

package/dist/schemas/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/schemas/types.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/schemas/ui.d.ts

@@ -0,0 +1,5 @@
+export { authMethodSchema } from './auth/ui.ts';
+export type { AuthMethod, OAuthProvider } from './auth/ui.ts';
+export { loginUIStateSchema, registerUIStateSchema, passwordResetUIStateSchema, twoFactorUIStateSchema, mfaSetupUIStateSchema, mfaVerificationUIStateSchema, mfaSettingsUIStateSchema, apiKeyUIStateSchema, authModalStateSchema, externalAppAuthStateSchema, authGuardStateSchema, profileAuthSectionStateSchema } from './auth/ui.ts';
+export type { LoginUIState, RegisterUIState, PasswordResetUIState, TwoFactorUIState, MfaSetupUIState, MfaVerificationUIState, MfaSettingsUIState, ApiKeyUIState, ApiKeyListItem, SessionListItem, AuthModalState, ExternalAppAuthState, AuthGuardState, ProfileAuthSectionState, LoginFormProps, OAuthButtonsProps, AuthGuardProps } from './auth/ui.ts';
+//# sourceMappingURL=ui.d.ts.map

package/dist/schemas/ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../src/schemas/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC;AACxU,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,uBAAuB,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/dist/schemas/ui.js

@@ -0,0 +1,3 @@
+export { authMethodSchema } from "./auth/ui.js";
+export { loginUIStateSchema, registerUIStateSchema, passwordResetUIStateSchema, twoFactorUIStateSchema, mfaSetupUIStateSchema, mfaVerificationUIStateSchema, mfaSettingsUIStateSchema, apiKeyUIStateSchema, authModalStateSchema, externalAppAuthStateSchema, authGuardStateSchema, profileAuthSectionStateSchema } from "./auth/ui.js";
+//# sourceMappingURL=ui.js.map

package/dist/schemas/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/schemas/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAC"}

package/dist/server/auth-service-binding.d.ts

@@ -0,0 +1,11 @@
+import * as z from 'zod/v4';
+/** The auth service binding (`AUTH_SERVICE` or a declared name): a worker-to-worker fetcher. */
+export interface AuthServiceBinding {
+    fetch: typeof globalThis.fetch;
+}
+/**
+ * The auth service binding's owning schema for `runtime.getBinding`. It admits
+ * the native binding itself, never a copy, so `fetch` keeps its receiver.
+ */
+export declare const AuthServiceBindingSchema: z.ZodCustom<AuthServiceBinding, AuthServiceBinding>;
+//# sourceMappingURL=auth-service-binding.d.ts.map

package/dist/server/auth-service-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service-binding.d.ts","sourceRoot":"","sources":["../../src/server/auth-service-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,gGAAgG;AAChG,MAAM,WAAW,kBAAkB;IAClC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAID;;;GAGG;AACH,eAAO,MAAM,wBAAwB,qDAEpC,CAAC"}

package/dist/server/auth-service-binding.js

@@ -0,0 +1,8 @@
+import * as z from 'zod/v4';
+const AuthServiceBindingMethodsSchema = z.object({ fetch: z.function() });
+/**
+ * The auth service binding's owning schema for `runtime.getBinding`. It admits
+ * the native binding itself, never a copy, so `fetch` keeps its receiver.
+ */
+export const AuthServiceBindingSchema = z.custom((value) => AuthServiceBindingMethodsSchema.safeParse(value).success);
+//# sourceMappingURL=auth-service-binding.js.map

package/dist/server/auth-service-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service-binding.js","sourceRoot":"","sources":["../../src/server/auth-service-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAO5B,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE1E;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAC/C,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CACnE,CAAC"}

package/dist/server/bound-session-verifier.descriptor.d.ts

@@ -0,0 +1,7 @@
+declare const _default: {
+    id: string;
+    kind: string;
+    name: string;
+};
+export default _default;
+//# sourceMappingURL=bound-session-verifier.descriptor.d.ts.map

package/dist/server/bound-session-verifier.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-session-verifier.descriptor.d.ts","sourceRoot":"","sources":["../../src/server/bound-session-verifier.descriptor.ts"],"names":[],"mappings":";;;;;AAAA,wBAGE"}

package/dist/server/bound-session-verifier.descriptor.js

@@ -0,0 +1,5 @@
+export default {
+    id: 'auth.session-verifier', kind: 'auth/session-verifier',
+    name: 'Session verifier'
+};
+//# sourceMappingURL=bound-session-verifier.descriptor.js.map

package/dist/server/bound-session-verifier.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-session-verifier.descriptor.js","sourceRoot":"","sources":["../../src/server/bound-session-verifier.descriptor.ts"],"names":[],"mappings":"AAAA,eAAe;IACd,EAAE,EAAE,uBAAuB,EAAE,IAAI,EAAE,uBAAuB;IAC1D,IAAI,EAAE,kBAAkB;CACxB,CAAC"}

package/dist/server/bound-session-verifier.impl.d.ts

@@ -0,0 +1,7 @@
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { SessionJwtVerifier } from './session-verifier.ts';
+export default class BoundSessionVerifier extends BaseRuntimeClient<VibesRuntime> implements SessionJwtVerifier {
+    verify(input: Parameters<SessionJwtVerifier['verify']>[0]): Promise<import("jose").JWTPayload>;
+}
+//# sourceMappingURL=bound-session-verifier.impl.d.ts.map

package/dist/server/bound-session-verifier.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-session-verifier.impl.d.ts","sourceRoot":"","sources":["../../src/server/bound-session-verifier.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAGhE,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,iBAAiB,CAAC,YAAY,CAAE,YAAW,kBAAkB;IACxG,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;CAM/D"}

package/dist/server/bound-session-verifier.impl.js

@@ -0,0 +1,11 @@
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { verifyBoundAuthJwt } from "./jwt-session-handle.js";
+export default class BoundSessionVerifier extends BaseRuntimeClient {
+    async verify(input) {
+        return verifyBoundAuthJwt(input.token, input.authOrigin, input.fetcher, {
+            runtime: this.runtime, jwksFetchTimeoutMs: input.jwksFetchTimeoutMs,
+            viaServiceBinding: input.viaServiceBinding
+        });
+    }
+}
+//# sourceMappingURL=bound-session-verifier.impl.js.map

package/dist/server/bound-session-verifier.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bound-session-verifier.impl.js","sourceRoot":"","sources":["../../src/server/bound-session-verifier.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAG/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,CAAC,OAAO,OAAO,oBAAqB,SAAQ,iBAA+B;IAChF,KAAK,CAAC,MAAM,CAAC,KAAkD;QAC9D,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE;YACvE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YACnE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC1C,CAAC,CAAC;IACJ,CAAC;CACD"}

package/dist/server/browser-session-code-handoff.d.ts

@@ -0,0 +1,33 @@
+import type { RequestEvent } from '@sveltejs/kit';
+import { type RequestPrincipal } from '@vibesdotdev/kernel';
+/** Host-only cookie holding the PKCE verifier and return path between begin and complete. */
+export declare const BROWSER_SESSION_HANDOFF_COOKIE = "vibes.auth.handoff";
+export interface BrowserSessionCodeHandoffOptions {
+    /** Auth client id the code is bound to (e.g. `hq-local`). */
+    clientId: string;
+    authOrigin: string | ((event: RequestEvent) => string | Promise<string>);
+    /** Same-origin callback route that calls `complete`. Defaults to `/auth/callback`. */
+    callbackPath?: string;
+    /** Host admission for the exact verified bearer, before its cookie is written. */
+    admit?: (event: RequestEvent, principal: RequestPrincipal) => Promise<void>;
+    /** Server-side transport to Auth. Defaults to the global `fetch` (no browser cookies forwarded). */
+    fetcher?: typeof fetch;
+}
+/**
+ * Browser sign-in for hosts that Auth cannot grant cross-origin cookie reads
+ * (for example loopback native companions). `begin` keeps a PKCE verifier in a
+ * host-only HttpOnly cookie and returns Auth's authorize URL for a top-level
+ * navigation. Auth answers on the callback with a short-lived single-use code;
+ * `complete` exchanges it server-to-server, verifies the returned JWT, applies
+ * host admission and sets the host-only session cookie. No token enters a URL
+ * or browser script, and Auth needs no CORS grant for the host's origin.
+ */
+export declare function createBrowserSessionCodeHandoff(options: BrowserSessionCodeHandoffOptions): {
+    /** Start sign-in; returns the Auth URL to redirect the browser to. */
+    begin(event: RequestEvent, next: string | null | undefined): Promise<string>;
+    /** Finish sign-in on the callback; returns the safe same-host return path. */
+    complete(event: RequestEvent): Promise<{
+        next: string;
+    }>;
+};
+//# sourceMappingURL=browser-session-code-handoff.d.ts.map

package/dist/server/browser-session-code-handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-session-code-handoff.d.ts","sourceRoot":"","sources":["../../src/server/browser-session-code-handoff.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAY7E,6FAA6F;AAC7F,eAAO,MAAM,8BAA8B,uBAAuB,CAAC;AAKnE,MAAM,WAAW,gCAAgC;IAChD,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,oGAAoG;IACpG,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,gCAAgC;IAavF,sEAAsE;iBACnD,YAAY,QAAQ,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAelF,8EAA8E;oBACxD,YAAY,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;EA8B/D"}

package/dist/server/browser-session-code-handoff.js

@@ -0,0 +1,87 @@
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { authReturnPath } from "../client/browser-session.js";
+import { browserSessionCodeAuthorizeUrl, browserSessionCodeChallenge, exchangeBrowserSessionCode } from "../client/browser-session-code.js";
+import { generatePkceChallenge } from "../client/mobile-auth.js";
+import { browserSessionCodeSchema, pkceCodeVerifierSchema } from "../schemas/browser-session-code.js";
+import { attemptSync } from "../features/utils/attempt.js";
+import { bindVerifiedSessionJwt } from "./jwt-session-handle.js";
+/** Host-only cookie holding the PKCE verifier and return path between begin and complete. */
+export const BROWSER_SESSION_HANDOFF_COOKIE = 'vibes.auth.handoff';
+const HANDOFF_MAX_AGE_SECONDS = 10 * 60;
+const handoffCookieSchema = z.object({ v: pkceCodeVerifierSchema, n: z.string().max(4096) });
+/**
+ * Browser sign-in for hosts that Auth cannot grant cross-origin cookie reads
+ * (for example loopback native companions). `begin` keeps a PKCE verifier in a
+ * host-only HttpOnly cookie and returns Auth's authorize URL for a top-level
+ * navigation. Auth answers on the callback with a short-lived single-use code;
+ * `complete` exchanges it server-to-server, verifies the returned JWT, applies
+ * host admission and sets the host-only session cookie. No token enters a URL
+ * or browser script, and Auth needs no CORS grant for the host's origin.
+ */
+export function createBrowserSessionCodeHandoff(options) {
+    const callbackPath = authReturnPath(options.callbackPath ?? '/auth/callback', 'https://session.invalid');
+    const authOriginFor = async (event) => options.authOrigin instanceof Function ? await options.authOrigin(event) : options.authOrigin;
+    const redirectUriFor = (event) => new URL(callbackPath, event.url.origin).toString();
+    const cookieOptions = (event) => ({
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: event.url.protocol === 'https:',
+        path: new URL(callbackPath, event.url.origin).pathname
+    });
+    return {
+        /** Start sign-in; returns the Auth URL to redirect the browser to. */
+        async begin(event, next) {
+            const pkce = await generatePkceChallenge();
+            const returnPath = authReturnPath(next, event.url.origin);
+            event.cookies.set(BROWSER_SESSION_HANDOFF_COOKIE, JSON.stringify({ v: pkce.codeVerifier, n: returnPath }), {
+                ...cookieOptions(event),
+                maxAge: HANDOFF_MAX_AGE_SECONDS
+            });
+            return browserSessionCodeAuthorizeUrl({
+                authOrigin: await authOriginFor(event),
+                clientId: options.clientId,
+                redirectUri: redirectUriFor(event),
+                codeChallenge: await browserSessionCodeChallenge(pkce.codeVerifier)
+            });
+        },
+        /** Finish sign-in on the callback; returns the safe same-host return path. */
+        async complete(event) {
+            const raw = event.cookies.get(BROWSER_SESSION_HANDOFF_COOKIE);
+            // Single attempt per begin: the verifier is gone whatever happens next.
+            event.cookies.delete(BROWSER_SESSION_HANDOFF_COOKIE, cookieOptions(event));
+            const handoff = parseHandoffCookie(raw);
+            const code = browserSessionCodeSchema.safeParse(event.url.searchParams.get('code'));
+            if (!handoff || !code.success) {
+                throw new CapabilityError('This sign-in was not started here or has expired. Please sign in again.', 'AUTH_REQUIRED', {
+                    reason: 'browser-session-handoff-missing',
+                    retryable: false
+                });
+            }
+            const authOrigin = await authOriginFor(event);
+            const jwt = await exchangeBrowserSessionCode(options.fetcher ?? globalThis.fetch, {
+                authOrigin,
+                clientId: options.clientId,
+                redirectUri: redirectUriFor(event),
+                code: code.data,
+                codeVerifier: handoff.v
+            });
+            const bound = await bindVerifiedSessionJwt(event, jwt, { authOrigin, admit: options.admit });
+            if (!bound) {
+                throw new CapabilityError('Your session could not be verified. Please sign in again.', 'AUTH_REQUIRED', {
+                    reason: 'browser-session-code-unverified',
+                    retryable: false
+                });
+            }
+            return { next: authReturnPath(handoff.n, event.url.origin) };
+        }
+    };
+}
+/** A tampered or truncated cookie is simply not a handoff. */
+function parseHandoffCookie(value) {
+    if (!value)
+        return null;
+    const parsed = attemptSync(() => handoffCookieSchema.safeParse(JSON.parse(value)));
+    return parsed.ok && parsed.value.success ? parsed.value.data : null;
+}
+//# sourceMappingURL=browser-session-code-handoff.js.map

package/dist/server/browser-session-code-handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-session-code-handoff.js","sourceRoot":"","sources":["../../src/server/browser-session-code-handoff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAyB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EACN,8BAA8B,EAC9B,2BAA2B,EAC3B,0BAA0B,EAC1B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACtG,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,CAAC,MAAM,8BAA8B,GAAG,oBAAoB,CAAC;AACnE,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,CAAC;AAExC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAc7F;;;;;;;;GAQG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAyC;IACxF,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,IAAI,gBAAgB,EAAE,yBAAyB,CAAC,CAAC;IACzG,MAAM,aAAa,GAAG,KAAK,EAAE,KAAmB,EAAE,EAAE,CACnD,OAAO,CAAC,UAAU,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/F,MAAM,cAAc,GAAG,CAAC,KAAmB,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnG,MAAM,aAAa,GAAG,CAAC,KAAmB,EAAE,EAAE,CAAC,CAAC;QAC/C,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAc;QACxB,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACvC,IAAI,EAAE,IAAI,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ;KACtD,CAAC,CAAC;IAEH,OAAO;QACN,sEAAsE;QACtE,KAAK,CAAC,KAAK,CAAC,KAAmB,EAAE,IAA+B;YAC/D,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1D,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;gBAC1G,GAAG,aAAa,CAAC,KAAK,CAAC;gBACvB,MAAM,EAAE,uBAAuB;aAC/B,CAAC,CAAC;YACH,OAAO,8BAA8B,CAAC;gBACrC,UAAU,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC;gBACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC;gBAClC,aAAa,EAAE,MAAM,2BAA2B,CAAC,IAAI,CAAC,YAAY,CAAC;aACnE,CAAC,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,KAAK,CAAC,QAAQ,CAAC,KAAmB;YACjC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC9D,wEAAwE;YACxE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YACpF,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,eAAe,CAAC,yEAAyE,EAAE,eAAe,EAAE;oBACrH,MAAM,EAAE,iCAAiC;oBACzC,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,EAAE;gBACjF,UAAU;gBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,YAAY,EAAE,OAAO,CAAC,CAAC;aACvB,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,IAAI,eAAe,CAAC,2DAA2D,EAAE,eAAe,EAAE;oBACvG,MAAM,EAAE,iCAAiC;oBACzC,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9D,CAAC;KACD,CAAC;AACH,CAAC;AAID,8DAA8D;AAC9D,SAAS,kBAAkB,CAAC,KAAyB;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC"}