@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.4

package/dist/bearer/request-session.store.descriptor.d.ts

@@ -0,0 +1,15 @@
+export declare const REQUEST_SESSION_STORE_ID = "auth/request-session";
+export declare const REQUEST_SESSION_BEARER_KEY = "VIBES_AUTH_TOKEN";
+/** Explicit-only bridge from the verified request principal to kernel credential references. */
+declare const descriptor: {
+    id: string;
+    kind: string;
+    name: string;
+    enabled: true;
+    backend: string;
+    selection: "by-id";
+    tiers: string[];
+    priority: number;
+};
+export default descriptor;
+//# sourceMappingURL=request-session.store.descriptor.d.ts.map

package/dist/bearer/request-session.store.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-session.store.descriptor.d.ts","sourceRoot":"","sources":["../../src/bearer/request-session.store.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,eAAO,MAAM,0BAA0B,qBAAqB,CAAC;AAE7D,gGAAgG;AAChG,QAAA,MAAM,UAAU;;;;;;;;;CAWf,CAAC;AACF,eAAe,UAAU,CAAC"}

package/dist/bearer/request-session.store.descriptor.js

@@ -0,0 +1,15 @@
+export const REQUEST_SESSION_STORE_ID = 'auth/request-session';
+export const REQUEST_SESSION_BEARER_KEY = 'VIBES_AUTH_TOKEN';
+/** Explicit-only bridge from the verified request principal to kernel credential references. */
+const descriptor = {
+    id: REQUEST_SESSION_STORE_ID,
+    kind: 'secrets/store',
+    name: 'Request session',
+    enabled: true,
+    backend: REQUEST_SESSION_STORE_ID,
+    selection: 'by-id',
+    tiers: ['local', 'dev', 'staging', 'production'],
+    priority: 0
+};
+export default descriptor;
+//# sourceMappingURL=request-session.store.descriptor.js.map

package/dist/bearer/request-session.store.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-session.store.descriptor.js","sourceRoot":"","sources":["../../src/bearer/request-session.store.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAE7D,gGAAgG;AAChG,MAAM,UAAU,GAAG;IAClB,EAAE,EAAE,wBAAwB;IAC5B,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,wBAAwB;IACjC,SAAS,EAAE,OAAO;IAClB,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC;IAChD,QAAQ,EAAE,CAAC;CAGX,CAAC;AACF,eAAe,UAAU,CAAC"}

package/dist/bearer/request-session.store.js

@@ -0,0 +1,21 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { resolveCallerBearer } from "./caller-bearer.js";
+import { REQUEST_SESSION_BEARER_KEY } from "./request-session.store.descriptor.js";
+/** A read-only view of this invocation's verified caller; no bearer is retained. */
+export default class RequestSessionStore {
+    runtime;
+    constructor(_descriptor, context) {
+        this.runtime = context.runtime;
+    }
+    async get(_tier, key) {
+        if (key !== REQUEST_SESSION_BEARER_KEY)
+            return undefined;
+        if (!this.runtime.declaredScope.capabilities?.requestPrincipals) {
+            throw new CapabilityError('This credential requires a verified request principal host.', 'UNAVAILABLE', {
+                reason: 'request-principal-unavailable', retryable: false
+            });
+        }
+        return (await resolveCallerBearer(this.runtime)) ?? undefined;
+    }
+}
+//# sourceMappingURL=request-session.store.js.map

package/dist/bearer/request-session.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-session.store.js","sourceRoot":"","sources":["../../src/bearer/request-session.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA6D,MAAM,qBAAqB,CAAC;AACjH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAEnF,oFAAoF;AACpF,MAAM,CAAC,OAAO,OAAO,mBAAmB;IACtB,OAAO,CAAa;IAErC,YAAY,WAA8B,EAAE,OAAoB;QAC/D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,GAAW;QACnC,IAAI,GAAG,KAAK,0BAA0B;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,EAAE,iBAAiB,EAAE,CAAC;YACjE,MAAM,IAAI,eAAe,CAAC,6DAA6D,EAAE,aAAa,EAAE;gBACvG,MAAM,EAAE,+BAA+B,EAAE,SAAS,EAAE,KAAK;aACzD,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC;IAC/D,CAAC;CACD"}

package/dist/cli/api-key/auth.api-key.cli-group.descriptor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Auth API Key CLI Group Descriptor
+ *
+ * Subgroup for API key management commands.
+ */
+import type { CLIGroupAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLIGroupAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.api-key.cli-group.descriptor.d.ts.map

package/dist/cli/api-key/auth.api-key.cli-group.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key.cli-group.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/api-key/auth.api-key.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,QAAA,MAAM,UAAU,EAAE,uBAWjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/api-key/auth.api-key.cli-group.descriptor.js

@@ -0,0 +1,18 @@
+/**
+ * Auth API Key CLI Group Descriptor
+ *
+ * Subgroup for API key management commands.
+ */
+const descriptor = {
+    kind: 'cli/group',
+    id: 'auth.api-key',
+    name: 'api-key',
+    description: 'Manage API keys',
+    parent: 'auth',
+    aliases: ['apikey'],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth.api-key.cli-group.descriptor.js.map

package/dist/cli/api-key/auth.api-key.cli-group.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key.cli-group.descriptor.js","sourceRoot":"","sources":["../../../src/cli/api-key/auth.api-key.cli-group.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,UAAU,GAA4B;IAC3C,IAAI,EAAE,WAAW;IACjB,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,iBAAiB;IAC9B,MAAM,EAAE,MAAM;IAEd,OAAO,EAAE,CAAC,QAAQ,CAAC;IACnB,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/api-key/create/auth.api-key-create.descriptor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Auth API Key Create CLI Command Descriptor
+ *
+ * Create a new API key.
+ */
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.api-key-create.descriptor.d.ts.map

package/dist/cli/api-key/create/auth.api-key-create.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-create.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/api-key/create/auth.api-key-create.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,QAAA,MAAM,UAAU,EAAE,yBAkCjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/api-key/create/auth.api-key-create.descriptor.js

@@ -0,0 +1,39 @@
+/**
+ * Auth API Key Create CLI Command Descriptor
+ *
+ * Create a new API key.
+ */
+const descriptor = {
+    kind: 'cli/command',
+    id: 'auth.api-key-create',
+    name: 'create',
+    description: 'Create a new API key',
+    group: 'auth.api-key',
+    arguments: [
+        {
+            name: 'name',
+            description: 'Name for the API key',
+            required: true,
+            variadic: false
+        }
+    ],
+    options: [
+        {
+            flags: '-d, --description <description>',
+            description: 'API key description'
+        },
+        {
+            flags: '-e, --expires-in <duration>',
+            description: 'Expiration duration (e.g., "30d", "1y")'
+        },
+        {
+            flags: '--json',
+            description: 'Emit pure JSON (includes one-time key material)'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth.api-key-create.descriptor.js.map

package/dist/cli/api-key/create/auth.api-key-create.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-create.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/api-key/create/auth.api-key-create.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,sBAAsB;IACnC,KAAK,EAAE,cAAc;IAErB,SAAS,EAAE;QACV;YACC,IAAI,EAAE,MAAM;YACZ,WAAW,EAAE,sBAAsB;YACnC,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;SACf;KACD;IAED,OAAO,EAAE;QACR;YACC,KAAK,EAAE,iCAAiC;YACxC,WAAW,EAAE,qBAAqB;SAClC;QACD;YACC,KAAK,EAAE,6BAA6B;YACpC,WAAW,EAAE,yCAAyC;SACtD;QACD;YACC,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,iDAAiD;SAC9D;KACD;IAED,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/api-key/create/auth.api-key-create.impl.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Auth API Key Create CLI Command Implementation
+ *
+ * Creates a new API key for the authenticated user.
+ */
+declare const _default: import("@vibesdotdev/cli").CommandImplementation;
+export default _default;
+//# sourceMappingURL=auth.api-key-create.impl.d.ts.map

package/dist/cli/api-key/create/auth.api-key-create.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-create.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/api-key/create/auth.api-key-create.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;AAYH,wBA+CG"}

package/dist/cli/api-key/create/auth.api-key-create.impl.js

@@ -0,0 +1,56 @@
+/**
+ * Auth API Key Create CLI Command Implementation
+ *
+ * Creates a new API key for the authenticated user.
+ */
+import * as z from 'zod/v4';
+import { defineCommandImplementation } from '@vibesdotdev/cli';
+import { writeJson } from '@vibesdotdev/cli/output';
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { executeAuthApiKey } from "../../services/api-key.js";
+import { buildAuthCLIContext } from "../../context-bridge.js";
+import { openAuthCommandOutput, parseCommandInput } from "../../command-io.js";
+const argumentsSchema = z.object({ name: z.string().optional() });
+export default defineCommandImplementation({
+    options: z.object({
+        description: z.string().optional(),
+        expiresIn: z.string().optional(),
+        json: z.boolean().optional()
+    }),
+    async execute(args, options, command) {
+        const { name } = parseCommandInput(argumentsSchema, args);
+        const asJson = options.json === true;
+        const context = await buildAuthCLIContext(command.runtime);
+        const out = await openAuthCommandOutput(context.runtime);
+        const result = await executeAuthApiKey({
+            action: 'create',
+            name,
+            description: options.description,
+            expiresIn: options.expiresIn,
+            output: asJson ? 'json' : 'table'
+        }, context);
+        if (!result.success) {
+            if (asJson) {
+                await writeJson(context.runtime, { success: false, message: result.message });
+            }
+            else {
+                out.warn(result.message);
+            }
+            requestCLIExit(1);
+        }
+        if (asJson) {
+            // Pure JSON only — one-time key material is in the payload for automation.
+            await writeJson(context.runtime, result);
+            return;
+        }
+        out.line(result.message);
+        const apiKey = result.apiKeys[0];
+        if (apiKey) {
+            out.line(`\n  Name: ${apiKey.name}`);
+            out.line(`  ID:   ${apiKey.id}`);
+            out.line(`  Key:  ${result.newKey ?? apiKey.key}`);
+            out.warn('\n  Store this key securely - it will not be shown again');
+        }
+    }
+});
+//# sourceMappingURL=auth.api-key-create.impl.js.map

package/dist/cli/api-key/create/auth.api-key-create.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-create.impl.js","sourceRoot":"","sources":["../../../../src/cli/api-key/create/auth.api-key-create.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE/E,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAElE,eAAe,2BAA2B,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACrC;YACC,MAAM,EAAE,QAAQ;YAChB,IAAI;YACJ,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SACjC,EACD,OAAO,CACP,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,MAAM,EAAE,CAAC;gBACZ,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACZ,2EAA2E;YAC3E,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YACrC,GAAG,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YACnD,GAAG,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QACtE,CAAC;IACF,CAAC;CACD,CAAC,CAAC"}

package/dist/cli/api-key/list/auth.api-key-list.descriptor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Auth API Key List CLI Command Descriptor
+ *
+ * List all API keys for the authenticated user.
+ */
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.api-key-list.descriptor.d.ts.map

package/dist/cli/api-key/list/auth.api-key-list.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-list.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/api-key/list/auth.api-key-list.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,QAAA,MAAM,UAAU,EAAE,yBAiBjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/api-key/list/auth.api-key-list.descriptor.js

@@ -0,0 +1,24 @@
+/**
+ * Auth API Key List CLI Command Descriptor
+ *
+ * List all API keys for the authenticated user.
+ */
+const descriptor = {
+    kind: 'cli/command',
+    id: 'auth.api-key-list',
+    name: 'list',
+    description: 'List all API keys',
+    group: 'auth.api-key',
+    aliases: ['ls'],
+    options: [
+        {
+            flags: '--json',
+            description: 'Emit pure JSON on stdout'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth.api-key-list.descriptor.js.map

package/dist/cli/api-key/list/auth.api-key-list.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-list.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/api-key/list/auth.api-key-list.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,mBAAmB;IAChC,KAAK,EAAE,cAAc;IAErB,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,OAAO,EAAE;QACR;YACC,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,0BAA0B;SACvC;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/api-key/list/auth.api-key-list.impl.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Auth API Key List CLI Command Implementation
+ *
+ * Lists all API keys for the authenticated user.
+ */
+declare const _default: import("@vibesdotdev/cli").CommandImplementation;
+export default _default;
+//# sourceMappingURL=auth.api-key-list.impl.d.ts.map

package/dist/cli/api-key/list/auth.api-key-list.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-list.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/api-key/list/auth.api-key-list.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;AAUH,wBA+BG"}

package/dist/cli/api-key/list/auth.api-key-list.impl.js

@@ -0,0 +1,39 @@
+/**
+ * Auth API Key List CLI Command Implementation
+ *
+ * Lists all API keys for the authenticated user.
+ */
+import * as z from 'zod/v4';
+import { defineCommandImplementation } from '@vibesdotdev/cli';
+import { writeJson } from '@vibesdotdev/cli/output';
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { executeAuthApiKey } from "../../services/api-key.js";
+import { buildAuthCLIContext } from "../../context-bridge.js";
+import { openAuthCommandOutput } from "../../command-io.js";
+export default defineCommandImplementation({
+    options: z.object({ json: z.boolean().optional() }),
+    async execute(_args, options, command) {
+        const asJson = options.json === true;
+        const context = await buildAuthCLIContext(command.runtime);
+        const out = await openAuthCommandOutput(context.runtime);
+        const result = await executeAuthApiKey({ action: 'list', output: asJson ? 'json' : 'table' }, context);
+        if (!result.success) {
+            if (asJson) {
+                await writeJson(context.runtime, { success: false, message: result.message });
+            }
+            else {
+                out.warn(result.message);
+            }
+            requestCLIExit(1);
+        }
+        if (asJson) {
+            await writeJson(context.runtime, result);
+            return;
+        }
+        for (const key of result.apiKeys) {
+            out.line(`  ${key.id}  ${key.name}  created: ${key.createdAt.toLocaleDateString()}`);
+        }
+        out.line(result.message);
+    }
+});
+//# sourceMappingURL=auth.api-key-list.impl.js.map

package/dist/cli/api-key/list/auth.api-key-list.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-list.impl.js","sourceRoot":"","sources":["../../../../src/cli/api-key/list/auth.api-key-list.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,eAAe,2BAA2B,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO;QACpC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACrC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,EACrD,OAAO,CACP,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,MAAM,EAAE,CAAC;gBACZ,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;CACD,CAAC,CAAC"}

package/dist/cli/api-key/revoke/auth.api-key-revoke.descriptor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Auth API Key Revoke CLI Command Descriptor
+ *
+ * Revoke an existing API key.
+ */
+import type { CLICommandAssetDescriptor } from '@vibesdotdev/kernel/schemas/asset';
+declare const descriptor: CLICommandAssetDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth.api-key-revoke.descriptor.d.ts.map

package/dist/cli/api-key/revoke/auth.api-key-revoke.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-revoke.descriptor.d.ts","sourceRoot":"","sources":["../../../../src/cli/api-key/revoke/auth.api-key-revoke.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAEnF,QAAA,MAAM,UAAU,EAAE,yBA0BjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/api-key/revoke/auth.api-key-revoke.descriptor.js

@@ -0,0 +1,31 @@
+/**
+ * Auth API Key Revoke CLI Command Descriptor
+ *
+ * Revoke an existing API key.
+ */
+const descriptor = {
+    kind: 'cli/command',
+    id: 'auth.api-key-revoke',
+    name: 'revoke',
+    description: 'Revoke an API key',
+    group: 'auth.api-key',
+    arguments: [
+        {
+            name: 'keyId',
+            description: 'ID of the API key to revoke',
+            required: true,
+            variadic: false
+        }
+    ],
+    options: [
+        {
+            flags: '--json',
+            description: 'Emit pure JSON on stdout'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth.api-key-revoke.descriptor.js.map

package/dist/cli/api-key/revoke/auth.api-key-revoke.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-revoke.descriptor.js","sourceRoot":"","sources":["../../../../src/cli/api-key/revoke/auth.api-key-revoke.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,UAAU,GAA8B;IAC7C,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,mBAAmB;IAChC,KAAK,EAAE,cAAc;IAErB,SAAS,EAAE;QACV;YACC,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,6BAA6B;YAC1C,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;SACf;KACD;IAED,OAAO,EAAE;QACR;YACC,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,0BAA0B;SACvC;KACD;IAED,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/cli/api-key/revoke/auth.api-key-revoke.impl.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Auth API Key Revoke CLI Command Implementation
+ *
+ * Revokes an existing API key.
+ */
+declare const _default: import("@vibesdotdev/cli").CommandImplementation;
+export default _default;
+//# sourceMappingURL=auth.api-key-revoke.impl.d.ts.map

package/dist/cli/api-key/revoke/auth.api-key-revoke.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-revoke.impl.d.ts","sourceRoot":"","sources":["../../../../src/cli/api-key/revoke/auth.api-key-revoke.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;AAYH,wBAgCG"}

package/dist/cli/api-key/revoke/auth.api-key-revoke.impl.js

@@ -0,0 +1,42 @@
+/**
+ * Auth API Key Revoke CLI Command Implementation
+ *
+ * Revokes an existing API key.
+ */
+import * as z from 'zod/v4';
+import { defineCommandImplementation } from '@vibesdotdev/cli';
+import { writeJson } from '@vibesdotdev/cli/output';
+import { requestCLIExit } from '@vibesdotdev/cli/providers';
+import { executeAuthApiKey } from "../../services/api-key.js";
+import { buildAuthCLIContext } from "../../context-bridge.js";
+import { openAuthCommandOutput, parseCommandInput } from "../../command-io.js";
+const argumentsSchema = z.object({ keyId: z.string().optional() });
+export default defineCommandImplementation({
+    options: z.object({ json: z.boolean().optional() }),
+    async execute(args, options, command) {
+        const { keyId } = parseCommandInput(argumentsSchema, args);
+        const asJson = options.json === true;
+        const context = await buildAuthCLIContext(command.runtime);
+        const out = await openAuthCommandOutput(context.runtime);
+        const result = await executeAuthApiKey({
+            action: 'revoke',
+            keyId,
+            output: asJson ? 'json' : 'table'
+        }, context);
+        if (!result.success) {
+            if (asJson) {
+                await writeJson(context.runtime, { success: false, message: result.message });
+            }
+            else {
+                out.warn(result.message);
+            }
+            requestCLIExit(1);
+        }
+        if (asJson) {
+            await writeJson(context.runtime, result);
+            return;
+        }
+        out.line(result.message);
+    }
+});
+//# sourceMappingURL=auth.api-key-revoke.impl.js.map

package/dist/cli/api-key/revoke/auth.api-key-revoke.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.api-key-revoke.impl.js","sourceRoot":"","sources":["../../../../src/cli/api-key/revoke/auth.api-key-revoke.impl.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE/E,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEnE,eAAe,2BAA2B,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;IACnD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO;QACnC,MAAM,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACrC;YACC,MAAM,EAAE,QAAQ;YAChB,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;SACjC,EACD,OAAO,CACP,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,MAAM,EAAE,CAAC;gBACZ,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1B,CAAC;YACD,cAAc,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;CACD,CAAC,CAAC"}

package/dist/cli/client/api.d.ts

@@ -0,0 +1,10 @@
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import type { ApiClientImplementation } from '@vibesdotdev/client';
+import type { AuthAPI } from '../schemas/types.ts';
+/**
+ * Create an auth client using the environment-configured api/client#auth
+ *
+ * This follows the CLI API client pattern documented in the cheatsheet.
+ */
+export declare function createAuthClient(client: ApiClientImplementation, runtime: RuntimeRef): AuthAPI;
+//# sourceMappingURL=api.d.ts.map

package/dist/cli/client/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/cli/client/api.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EACX,OAAO,EAOP,MAAM,qBAAqB,CAAC;AAE7B;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAgF9F"}

package/dist/cli/client/api.js

@@ -0,0 +1,81 @@
+import { getLogger } from '@vibesdotdev/logging';
+import { attempt, failureLabel } from "../../features/utils/attempt.js";
+/**
+ * Create an auth client using the environment-configured api/client#auth
+ *
+ * This follows the CLI API client pattern documented in the cheatsheet.
+ */
+export function createAuthClient(client, runtime) {
+    const logger = getLogger('auth.cli-client', runtime);
+    return {
+        apiKeys: {
+            async list() {
+                return client.request('/api/auth/api-keys', { method: 'GET' });
+            },
+            async create(data) {
+                return client.request('/api/auth/api-keys', {
+                    method: 'POST',
+                    body: data
+                });
+            },
+            async delete(id) {
+                await client.request(`/api/auth/api-keys/${encodeURIComponent(id)}`, { method: 'DELETE' });
+            }
+        },
+        async validate() {
+            // Prefer the first-party profile endpoint which works for both session and API key auth
+            const profile = await attempt(() => client.request('/api/user/me', { method: 'GET' }));
+            if (profile.ok) {
+                if (profile.value?.id) {
+                    return {
+                        valid: true,
+                        user: {
+                            id: profile.value.id,
+                            email: profile.value.email,
+                            name: profile.value.name ?? undefined
+                        }
+                    };
+                }
+            }
+            else {
+                logger.debug('Profile endpoint validation failed; falling back to the session endpoint', {
+                    failure: failureLabel(profile.failure)
+                });
+            }
+            const session = await attempt(() => client.request('/api/auth/get-session', { method: 'GET' }));
+            if (session.ok) {
+                if (session.value?.user?.id) {
+                    return {
+                        valid: true,
+                        user: {
+                            id: session.value.user.id,
+                            email: session.value.user.email,
+                            name: session.value.user.name ?? undefined
+                        }
+                    };
+                }
+            }
+            else {
+                logger.debug('Session endpoint validation failed; reporting unauthenticated', {
+                    failure: failureLabel(session.failure)
+                });
+            }
+            return { valid: false };
+        },
+        async permissions() {
+            const result = await attempt(() => client.request('/api/auth/permissions', { method: 'GET' }));
+            if (result.ok) {
+                return {
+                    permissions: result.value.permissions.map((permission) => {
+                        return `${permission.resource}:${permission.action}`;
+                    })
+                };
+            }
+            logger.warn('Failed to fetch permissions; reporting an empty set', {
+                failure: failureLabel(result.failure)
+            });
+            return { permissions: [] };
+        }
+    };
+}
+//# sourceMappingURL=api.js.map

package/dist/cli/client/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/cli/client/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAYxE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA+B,EAAE,OAAmB;IACpF,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO;QACN,OAAO,EAAE;YACR,KAAK,CAAC,IAAI;gBACT,OAAO,MAAM,CAAC,OAAO,CAAuB,oBAAoB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACtF,CAAC;YAED,KAAK,CAAC,MAAM,CAAC,IAAI;gBAChB,OAAO,MAAM,CAAC,OAAO,CAAyB,oBAAoB,EAAE;oBACnE,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,IAAI;iBACV,CAAC,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,MAAM,CAAC,EAAU;gBACtB,MAAM,MAAM,CAAC,OAAO,CAAO,sBAAsB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClG,CAAC;SACD;QAED,KAAK,CAAC,QAAQ;YACb,wFAAwF;YACxF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAqB,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC3G,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;oBACvB,OAAO;wBACN,KAAK,EAAE,IAAI;wBACX,IAAI,EAAE;4BACL,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;4BACpB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;4BAC1B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS;yBACrC;qBACD,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,KAAK,CAAC,0EAA0E,EAAE;oBACxF,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;iBACtC,CAAC,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAClC,MAAM,CAAC,OAAO,CAAsB,uBAAuB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC/E,CAAC;YACF,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,IAAI,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;oBAC7B,OAAO;wBACN,KAAK,EAAE,IAAI;wBACX,IAAI,EAAE;4BACL,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;4BACzB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;4BAC/B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS;yBAC1C;qBACD,CAAC;gBACH,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,MAAM,CAAC,KAAK,CAAC,+DAA+D,EAAE;oBAC7E,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;iBACtC,CAAC,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,WAAW;YAChB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CACjC,MAAM,CAAC,OAAO,CAA6B,uBAAuB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CACtF,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACN,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;wBACxD,OAAO,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;oBACtD,CAAC,CAAC;iBACF,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;gBAClE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;YACH,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAC5B,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/cli/command-io.d.ts

@@ -0,0 +1,31 @@
+/**
+ * What every `vibes auth` command reads at its execute boundary and writes to.
+ *
+ * Commander hands a command its positional values and options as
+ * `CommandOptions` (already parsed to text, numbers, flags and text lists). A
+ * command parses the fields it reads with its own schema through
+ * {@link parseCommandInput}; a value outside the schema refuses `INVALID_INPUT`
+ * `auth-command-input-invalid`, naming the fields, never their values.
+ *
+ * Output goes through the handed runtime's selected host text output
+ * (`runtime/stdio`), never the process console: results on stdout, diagnostics
+ * on stderr. A host without text output refuses `UNAVAILABLE`
+ * `stdio-unavailable` before the command writes.
+ */
+import * as z from 'zod/v4';
+import type { CommandOptions } from '@vibesdotdev/cli';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+/** The fields of `input` a command reads, parsed with `schema`; anything outside it refuses and names the fields. */
+export declare function parseCommandInput<TSchema extends z.ZodType>(schema: TSchema, input: CommandOptions): z.output<TSchema>;
+/** Where a `vibes auth` command writes what it reports. */
+export interface AuthCommandOutput {
+    /** `text` and a newline on stdout; with no text, an empty line. */
+    line(text?: string): void;
+    /** `text` and a newline on stderr: a diagnostic, never a result. */
+    warn(text: string): void;
+    /** `text` verbatim on stdout (no newline added). */
+    write(text: string): void;
+}
+/** Resolve the handed runtime's host text output for one command run. */
+export declare function openAuthCommandOutput(runtime: Pick<RuntimeRef, 'hasKind' | 'query'>): Promise<AuthCommandOutput>;
+//# sourceMappingURL=command-io.d.ts.map

package/dist/cli/command-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-io.d.ts","sourceRoot":"","sources":["../../src/cli/command-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAoC,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAExF,qHAAqH;AACrH,wBAAgB,iBAAiB,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAStH;AAED,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IACjC,mEAAmE;IACnE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oEAAoE;IACpE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oDAAoD;IACpD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,yEAAyE;AACzE,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOtH"}