@vibesdotdev/auth 1.0.0-rc.5 → 1.0.0-rc.9

package/dist/features/authorization/superorg.js

@@ -0,0 +1,47 @@
+/**
+ * The platform superorganization.
+ *
+ * `vibesdotdev` owns the platform and holds the contracts that bind customer
+ * organizations: system maintenance, migration, and contractual obligations
+ * have to act INSIDE an organization's repositories, packages, hosts, storage,
+ * secrets, and deployments. That is a different authority from "a member of
+ * that org" — it is the platform owner acting on the org's behalf — so it has
+ * ONE declared identity here and every authorization surface reads this module
+ * instead of spelling the slug again.
+ *
+ * The slug is product identity, not deployment configuration: a host that
+ * renamed it would no longer be the platform. Membership is still verified by
+ * the owning surface (JWT claims for reads, Account's live membership check for
+ * mutations), and only owner/admin standing in this organization carries the
+ * cross-org authority. A viewer or member of `vibesdotdev` holds no cross-org
+ * right.
+ *
+ * This module is pure: no runtime, no I/O, no dependency beyond the claim shape
+ * its callers already carry. Platform, the registry worker, and any other
+ * consumer can import it without pulling a server runtime into their bundle.
+ */
+/** The product identity of the platform superorganization. */
+export const SUPERORG_ORGANIZATION_SLUG = 'vibesdotdev';
+/** The org roles that may act for the superorganization. */
+export const SUPERORG_ORGANIZATION_ROLES = ['owner', 'admin'];
+/** Whether an organization role carries superorganization authority. */
+export function isSuperorgOrganizationRole(role) {
+    return SUPERORG_ORGANIZATION_ROLES.some((allowed) => allowed === role);
+}
+/** Whether an organization record/claim names the superorganization. */
+export function isSuperorgOrganization(organization) {
+    return organization?.slug?.trim().toLowerCase() === SUPERORG_ORGANIZATION_SLUG;
+}
+/**
+ * Whether an org claim carries superorganization authority. Membership alone
+ * is not enough: the claim must name the superorganization AND hold an
+ * owner/admin role.
+ */
+export function isSuperorgClaim(claim) {
+    return isSuperorgOrganization(claim) && isSuperorgOrganizationRole(claim?.role);
+}
+/** The first superorganization claim in a claim set, when the caller holds one. */
+export function findSuperorgClaim(claims) {
+    return claims.find(isSuperorgClaim);
+}
+//# sourceMappingURL=superorg.js.map

package/dist/features/authorization/superorg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"superorg.js","sourceRoot":"","sources":["../../../src/features/authorization/superorg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,0BAA0B,GAAG,aAAa,CAAC;AAExD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAC;AAevE,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,IAA+B;IACzE,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CAAC,YAAiD;IACvF,OAAO,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,0BAA0B,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAA+C;IAC9E,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,0BAA0B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAChC,MAAwB;IAExB,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACrC,CAAC"}

package/dist/index.d.ts

@@ -47,6 +47,8 @@ export type { RoleListItem, PermissionListItem, UserRoleAssignment, PermissionTr
 export type { GuardConfig, RouteGuardConfig, ResourceGuardConfig } from './features/permissions/schemas/index.ts';
 export { authorizationPrincipalSchema, authorizationGateSchema, organizationAuthorizationRoleSchema, authorizationRequestSchema, authorizationDecisionReasonSchema, authorizationDecisionEvidenceSchema, authorizationDecisionSchema, authorize, hasOrganizationPermission, authorizeOrganizationPermission, organizationAuthorizationRequestSchema, organizationAuthorizationResultSchema } from './features/authorization/organization-policy.ts';
 export type { AuthorizationPrincipal, AuthorizationGate, AuthorizationRequest, AuthorizationDecision, OrganizationAuthorizationRole, OrganizationAuthorizationRequest, OrganizationAuthorizationResult } from './features/authorization/organization-policy.ts';
+export { SUPERORG_ORGANIZATION_ROLES, SUPERORG_ORGANIZATION_SLUG, findSuperorgClaim, isSuperorgClaim, isSuperorgOrganization, isSuperorgOrganizationRole } from './features/authorization/superorg.ts';
+export type { OrganizationClaimLike, OrganizationLike, SuperorgOrganizationRole } from './features/authorization/superorg.ts';
 export type { AuthUser, NamedRow, PermissionCheckResult, PermissionContext, PermissionDefinition, PermissionRequirement, PermissionRequirementWithResourceId, ResourceOwnership, RoleDefinition, SeedMappingRow, SeedPermissionInput, SeedPermissionRow, SeedRoleInput, SeedRoleRow, UserPermissionRow, UserRoleRow } from './features/permissions/schemas/index.ts';
 export { authUserSchema, namedRowSchema, permissionCheckResultSchema, permissionContextSchema, permissionDefinitionSchema, permissionRequirementSchema, permissionRequirementWithResourceIdSchema, resourceOwnershipSchema, roleDefinitionSchema, seedMappingRowSchema, seedPermissionInputSchema, seedPermissionRowSchema, seedRoleInputSchema, seedRoleRowSchema, userPermissionRowSchema, userRoleRowSchema } from './features/permissions/schemas/index.ts';
 export { default as authConfigDescriptor } from './runtime/auth.config.descriptor.ts';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACN,iCAAiC,EACjC,6BAA6B,EAC7B,wBAAwB,EACxB,iCAAiC,EACjC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,gBAAgB,EAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,gCAAgC,EAChC,sBAAsB,EACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,EAC/B,MAAM,0CAA0C,CAAC;AAClD,YAAY,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AACjG,YAAY,EACX,oBAAoB,EACpB,0BAA0B,EAC1B,iCAAiC,EACjC,uBAAuB,EACvB,QAAQ,EACR,sBAAsB,EACtB,MAAM,gCAAgC,CAAC;AAGxC,YAAY,EACX,OAAO,EACP,OAAO,EACP,WAAW,EACX,MAAM,EACN,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,sBAAsB,EACtB,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,SAAS,EACT,uBAAuB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,YAAY,EAAE,cAAc,IAAI,IAAI,EAAE,iBAAiB,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,YAAY,EACX,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,8BAA8B,EAC9B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,wBAAwB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,WAAW,EACX,0BAA0B,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,cAAc,EACd,cAAc,EACd,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,iCAAiC,EACjC,mCAAmC,EACnC,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC7B,eAAe,EACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,4BAA4B,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,6BAA6B,EAC7B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACN,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,eAAe,EACf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,EACxB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,+BAA+B,EAAE,qCAAqC,EAAE,KAAK,oCAAoC,EAAE,sCAAsC,EAAE,4CAA4C,EAAE,KAAK,2CAA2C,EAAE,MAAM,2BAA2B,CAAC;AAGtS,YAAY,EACX,aAAa,EACb,YAAY,EACZ,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,+BAA+B,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,YAAY,EACX,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,mCAAmC,CAAC;AAG3C,YAAY,EACX,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,IAAI,EACJ,cAAc,EACd,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,cAAc,EACd,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACX,eAAe,EACf,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACX,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACX,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,4BAA4B,EAC5B,uBAAuB,EACvB,mCAAmC,EACnC,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,2BAA2B,EAC3B,SAAS,EACT,yBAAyB,EACzB,+BAA+B,EAC/B,sCAAsC,EACtC,qCAAqC,EACrC,MAAM,iDAAiD,CAAC;AACzD,YAAY,EACX,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,6BAA6B,EAC7B,gCAAgC,EAChC,+BAA+B,EAC/B,MAAM,iDAAiD,CAAC;AACzD,YAAY,EACX,QAAQ,EACR,QAAQ,EACR,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,mCAAmC,EACnC,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,yCAAyC,EACzC,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAG9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACN,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2BAA2B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACN,iCAAiC,EACjC,6BAA6B,EAC7B,wBAAwB,EACxB,iCAAiC,EACjC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,gBAAgB,EAChB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,2BAA2B,EAC3B,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,wBAAwB,EACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,gCAAgC,EAChC,sBAAsB,EACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,EAC/B,MAAM,0CAA0C,CAAC;AAClD,YAAY,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AACjG,YAAY,EACX,oBAAoB,EACpB,0BAA0B,EAC1B,iCAAiC,EACjC,uBAAuB,EACvB,QAAQ,EACR,sBAAsB,EACtB,MAAM,gCAAgC,CAAC;AAGxC,YAAY,EACX,OAAO,EACP,OAAO,EACP,WAAW,EACX,MAAM,EACN,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,sBAAsB,EACtB,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,SAAS,EACT,uBAAuB,EACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,YAAY,EAAE,cAAc,IAAI,IAAI,EAAE,iBAAiB,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAClF,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,YAAY,EACX,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,4BAA4B,EAC5B,2BAA2B,EAC3B,8BAA8B,EAC9B,8BAA8B,EAC9B,6BAA6B,EAC7B,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,8BAA8B,EAC9B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,wBAAwB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,WAAW,EACX,0BAA0B,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,cAAc,EACd,cAAc,EACd,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,iCAAiC,EACjC,mCAAmC,EACnC,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,6BAA6B,EAC7B,mBAAmB,EACnB,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,mBAAmB,EACnB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC7B,eAAe,EACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,4BAA4B,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACN,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,6BAA6B,EAC7B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACN,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,iBAAiB,EACjB,SAAS,EACT,cAAc,EACd,eAAe,EACf,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,EACxB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACX,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,+BAA+B,EAAE,qCAAqC,EAAE,KAAK,oCAAoC,EAAE,sCAAsC,EAAE,4CAA4C,EAAE,KAAK,2CAA2C,EAAE,MAAM,2BAA2B,CAAC;AAGtS,YAAY,EACX,aAAa,EACb,YAAY,EACZ,aAAa,EACb,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,+BAA+B,EAC/B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACpG,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,YAAY,EACX,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,mCAAmC,CAAC;AAG3C,YAAY,EACX,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,IAAI,EACJ,cAAc,EACd,QAAQ,EACR,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,cAAc,EACd,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACX,eAAe,EACf,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACX,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,mBAAmB,EACnB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACX,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,4BAA4B,EAC5B,uBAAuB,EACvB,mCAAmC,EACnC,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,2BAA2B,EAC3B,SAAS,EACT,yBAAyB,EACzB,+BAA+B,EAC/B,sCAAsC,EACtC,qCAAqC,EACrC,MAAM,iDAAiD,CAAC;AACzD,YAAY,EACX,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,6BAA6B,EAC7B,gCAAgC,EAChC,+BAA+B,EAC/B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACN,2BAA2B,EAC3B,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,0BAA0B,EAC1B,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACX,qBAAqB,EACrB,gBAAgB,EAChB,wBAAwB,EACxB,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EACX,QAAQ,EACR,QAAQ,EACR,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,qBAAqB,EACrB,mCAAmC,EACnC,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,yCAAyC,EACzC,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAG9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACN,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2BAA2B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC"}

package/dist/index.js

@@ -23,6 +23,7 @@ export { oauthProviderDisplaySchema } from "./features/oauth/schemas/index.js";
 export { createRoleSchema, updateRoleSchema, assignRoleSchema, createPermissionSchema, grantPermissionsSchema, revokePermissionsSchema, checkPermissionSchema, permissionActionSchema, permissionResourceSchema, systemRoles, isSystemRole } from "./features/permissions/schemas/index.js";
 export { roleSelectionSchema, permissionFilterSchema, roleAssignmentModalSchema, permissionViewStateSchema } from "./features/permissions/schemas/index.js";
 export { authorizationPrincipalSchema, authorizationGateSchema, organizationAuthorizationRoleSchema, authorizationRequestSchema, authorizationDecisionReasonSchema, authorizationDecisionEvidenceSchema, authorizationDecisionSchema, authorize, hasOrganizationPermission, authorizeOrganizationPermission, organizationAuthorizationRequestSchema, organizationAuthorizationResultSchema } from "./features/authorization/organization-policy.js";
+export { SUPERORG_ORGANIZATION_ROLES, SUPERORG_ORGANIZATION_SLUG, findSuperorgClaim, isSuperorgClaim, isSuperorgOrganization, isSuperorgOrganizationRole } from "./features/authorization/superorg.js";
 export { authUserSchema, namedRowSchema, permissionCheckResultSchema, permissionContextSchema, permissionDefinitionSchema, permissionRequirementSchema, permissionRequirementWithResourceIdSchema, resourceOwnershipSchema, roleDefinitionSchema, seedMappingRowSchema, seedPermissionInputSchema, seedPermissionRowSchema, seedRoleInputSchema, seedRoleRowSchema, userPermissionRowSchema, userRoleRowSchema } from "./features/permissions/schemas/index.js";
 // Runtime descriptors
 export { default as authConfigDescriptor } from "./runtime/auth.config.descriptor.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACN,iCAAiC,EACjC,6BAA6B,EAC7B,wBAAwB,EACxB,iCAAiC,EACjC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,gBAAgB,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,gCAAgC,EAChC,sBAAsB,EACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,EAC/B,MAAM,0CAA0C,CAAC;AA4BlD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AA0BlF,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,8BAA8B,EAC9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACN,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,oBAAoB,CAAC;AAS5B,OAAO,EACN,cAAc,EACd,cAAc,EACd,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,iCAAiC,EACjC,mCAAmC,EACnC,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,MAAM,oBAAoB,CAAC;AAiB5B,OAAO,EACN,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,EACN,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC7B,eAAe,EACf,MAAM,oBAAoB,CAAC;AAiB5B,OAAO,EACN,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,6BAA6B,EAC7B,MAAM,oBAAoB,CAAC;AAmB5B,gBAAgB;AAChB,OAAO,EACN,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,mCAAmC,CAAC;AAO3C,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,EACxB,MAAM,mCAAmC,CAAC;AAQ3C,OAAO,EACN,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,mCAAmC,CAAC;AAW3C,OAAO,EACN,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,MAAM,mCAAmC,CAAC;AAQ3C,OAAO,EAAE,+BAA+B,EAAE,qCAAqC,EAA6C,sCAAsC,EAAE,4CAA4C,EAAoD,MAAM,2BAA2B,CAAC;AAYtS,OAAO,EACN,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,+BAA+B,EAC/B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAqB/E,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,MAAM,yCAAyC,CAAC;AAUjD,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,yCAAyC,CAAC;AAgBjD,OAAO,EACN,4BAA4B,EAC5B,uBAAuB,EACvB,mCAAmC,EACnC,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,2BAA2B,EAC3B,SAAS,EACT,yBAAyB,EACzB,+BAA+B,EAC/B,sCAAsC,EACtC,qCAAqC,EACrC,MAAM,iDAAiD,CAAC;AA4BzD,OAAO,EACN,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,yCAAyC,EACzC,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,yCAAyC,CAAC;AAEjD,sBAAsB;AACtB,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAE9F,WAAW;AACX,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACN,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2BAA2B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACN,iCAAiC,EACjC,6BAA6B,EAC7B,wBAAwB,EACxB,iCAAiC,EACjC,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,iCAAiC,EACjC,4BAA4B,EAC5B,+BAA+B,EAC/B,2BAA2B,EAC3B,8BAA8B,EAC9B,gBAAgB,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EACN,gCAAgC,EAChC,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,gCAAgC,EAChC,sBAAsB,EACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACN,8BAA8B,EAC9B,+BAA+B,EAC/B,MAAM,0CAA0C,CAAC;AA4BlD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AA0BlF,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,4BAA4B,EAC5B,8BAA8B,EAC9B,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EACN,4BAA4B,EAC5B,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,MAAM,oBAAoB,CAAC;AAS5B,OAAO,EACN,cAAc,EACd,cAAc,EACd,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,8BAA8B,EAC9B,6BAA6B,EAC7B,iCAAiC,EACjC,mCAAmC,EACnC,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,MAAM,oBAAoB,CAAC;AAiB5B,OAAO,EACN,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,oBAAoB,CAAC;AAU5B,OAAO,EACN,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC7B,eAAe,EACf,MAAM,oBAAoB,CAAC;AAiB5B,OAAO,EACN,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,6BAA6B,EAC7B,MAAM,oBAAoB,CAAC;AAmB5B,gBAAgB;AAChB,OAAO,EACN,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,0BAA0B,EAC1B,qBAAqB,EACrB,MAAM,mCAAmC,CAAC;AAO3C,OAAO,EACN,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,EACxB,MAAM,mCAAmC,CAAC;AAQ3C,OAAO,EACN,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,mCAAmC,CAAC;AAW3C,OAAO,EACN,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,MAAM,mCAAmC,CAAC;AAQ3C,OAAO,EAAE,+BAA+B,EAAE,qCAAqC,EAA6C,sCAAsC,EAAE,4CAA4C,EAAoD,MAAM,2BAA2B,CAAC;AAYtS,OAAO,EACN,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACN,qBAAqB,EACrB,+BAA+B,EAC/B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAqB/E,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,wBAAwB,EACxB,WAAW,EACX,YAAY,EACZ,MAAM,yCAAyC,CAAC;AAUjD,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,yCAAyC,CAAC;AAgBjD,OAAO,EACN,4BAA4B,EAC5B,uBAAuB,EACvB,mCAAmC,EACnC,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,2BAA2B,EAC3B,SAAS,EACT,yBAAyB,EACzB,+BAA+B,EAC/B,sCAAsC,EACtC,qCAAqC,EACrC,MAAM,iDAAiD,CAAC;AAUzD,OAAO,EACN,2BAA2B,EAC3B,0BAA0B,EAC1B,iBAAiB,EACjB,eAAe,EACf,sBAAsB,EACtB,0BAA0B,EAC1B,MAAM,sCAAsC,CAAC;AAwB9C,OAAO,EACN,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,EAC3B,yCAAyC,EACzC,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,yCAAyC,CAAC;AAEjD,sBAAsB;AACtB,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAC9F,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAE9F,WAAW;AACX,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EACN,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,2BAA2B,EAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC"}

package/dist/policy/auth-policy.d.ts

@@ -0,0 +1,86 @@
+/**
+ * `auth.policy` — the declared authentication policy, owned and enforced by
+ * the auth runtime (never stored by a console that nothing reads).
+ *
+ * - `password`: length and character-class rules every credential password
+ *   must satisfy. Enforced server-side where a password is accepted
+ *   (sign-up, reset, change, set).
+ * - `session`: how long a session lives and when its expiry rolls. Applied
+ *   when the auth runtime builds its session configuration.
+ * - `twoFactor.requirement`: `required` means a signed-in user without a
+ *   second factor is admitted only to enrollment until they enroll. Every
+ *   interactive principal can: a password user confirms with the password, a
+ *   passwordless user with a recent provider sign-in.
+ *
+ * Values resolve through the runtime
+ * (`ConfigManifest.forRuntime(runtime, 'auth.policy')`): these schema defaults,
+ * overlaid by the host composition and any stored edit. A console (System
+ * Web) edits this manifest; it never keeps a second copy.
+ */
+import * as z from 'zod/v4';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+export declare const AUTH_POLICY_MANIFEST_ID = "auth.policy";
+export declare const PasswordPolicySchema: z.ZodObject<{
+    minLength: z.ZodDefault<z.ZodNumber>;
+    maxLength: z.ZodDefault<z.ZodNumber>;
+    requireUppercase: z.ZodDefault<z.ZodBoolean>;
+    requireLowercase: z.ZodDefault<z.ZodBoolean>;
+    requireNumber: z.ZodDefault<z.ZodBoolean>;
+    requireSpecial: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const SessionPolicySchema: z.ZodObject<{
+    lifetimeSeconds: z.ZodDefault<z.ZodNumber>;
+    refreshAfterSeconds: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const TwoFactorRequirementSchema: z.ZodEnum<{
+    optional: "optional";
+    required: "required";
+}>;
+export declare const AuthPolicySchema: z.ZodObject<{
+    password: z.ZodPrefault<z.ZodObject<{
+        minLength: z.ZodDefault<z.ZodNumber>;
+        maxLength: z.ZodDefault<z.ZodNumber>;
+        requireUppercase: z.ZodDefault<z.ZodBoolean>;
+        requireLowercase: z.ZodDefault<z.ZodBoolean>;
+        requireNumber: z.ZodDefault<z.ZodBoolean>;
+        requireSpecial: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    session: z.ZodPrefault<z.ZodObject<{
+        lifetimeSeconds: z.ZodDefault<z.ZodNumber>;
+        refreshAfterSeconds: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
+    twoFactor: z.ZodPrefault<z.ZodObject<{
+        requirement: z.ZodDefault<z.ZodEnum<{
+            optional: "optional";
+            required: "required";
+        }>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AuthPolicy = z.infer<typeof AuthPolicySchema>;
+export type PasswordPolicy = z.infer<typeof PasswordPolicySchema>;
+/** The one reason a password fails the policy; the set a caller shows is the whole list. */
+export declare const PasswordViolationSchema: z.ZodEnum<{
+    "password-too-short": "password-too-short";
+    "password-too-long": "password-too-long";
+    "password-needs-uppercase": "password-needs-uppercase";
+    "password-needs-lowercase": "password-needs-lowercase";
+    "password-needs-number": "password-needs-number";
+    "password-needs-special": "password-needs-special";
+}>;
+export type PasswordViolation = z.infer<typeof PasswordViolationSchema>;
+/** Every rule `password` breaks under `policy`; empty when it satisfies the policy. */
+export declare function passwordViolations(policy: PasswordPolicy, password: string): PasswordViolation[];
+/** Refuse a password that breaks the policy with a typed, value-free error. */
+export declare function assertPasswordMeetsPolicy(policy: PasswordPolicy, password: string): void;
+/** The policy as the auth runtime resolves it now: schema defaults, composition, stored edit. */
+export declare function loadAuthPolicy(runtime: RuntimeRef): Promise<AuthPolicy>;
+/** Session lifetime and roll interval in the units the session store takes. */
+export declare function sessionLifetime(policy: AuthPolicy): {
+    expiresIn: number;
+    updateAge: number;
+};
+/** True when a user without a second factor must enroll before anything else. */
+export declare function twoFactorEnrollmentRequired(policy: AuthPolicy, user: {
+    twoFactorEnabled: boolean;
+}): boolean;
+//# sourceMappingURL=auth-policy.d.ts.map

package/dist/policy/auth-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.d.ts","sourceRoot":"","sources":["../../src/policy/auth-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGvE,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAKrD,eAAO,MAAM,oBAAoB;;;;;;;kBAO/B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;kBAK9B,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;EAAmC,CAAC;AAE3E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;kBAa1B,CAAC;AAEJ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB;;;;;;;EAOlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAShG;AAED,+EAA+E;AAC/E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQxF;AAED,iGAAiG;AACjG,wBAAsB,cAAc,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAe7E;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAE5F;AAED,iFAAiF;AACjF,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE;IAAE,gBAAgB,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAE5G"}

package/dist/policy/auth-policy.js

@@ -0,0 +1,113 @@
+/**
+ * `auth.policy` — the declared authentication policy, owned and enforced by
+ * the auth runtime (never stored by a console that nothing reads).
+ *
+ * - `password`: length and character-class rules every credential password
+ *   must satisfy. Enforced server-side where a password is accepted
+ *   (sign-up, reset, change, set).
+ * - `session`: how long a session lives and when its expiry rolls. Applied
+ *   when the auth runtime builds its session configuration.
+ * - `twoFactor.requirement`: `required` means a signed-in user without a
+ *   second factor is admitted only to enrollment until they enroll. Every
+ *   interactive principal can: a password user confirms with the password, a
+ *   passwordless user with a recent provider sign-in.
+ *
+ * Values resolve through the runtime
+ * (`ConfigManifest.forRuntime(runtime, 'auth.policy')`): these schema defaults,
+ * overlaid by the host composition and any stored edit. A console (System
+ * Web) edits this manifest; it never keeps a second copy.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { ConfigManifest } from '@vibesdotdev/config/manifest/config-manifest';
+export const AUTH_POLICY_MANIFEST_ID = 'auth.policy';
+const NINETY_DAYS_SECONDS = 60 * 60 * 24 * 90;
+const ONE_DAY_SECONDS = 60 * 60 * 24;
+export const PasswordPolicySchema = z.strictObject({
+    minLength: z.number().int().min(8).max(128).default(8),
+    maxLength: z.number().int().min(8).max(256).default(128),
+    requireUppercase: z.boolean().default(false),
+    requireLowercase: z.boolean().default(false),
+    requireNumber: z.boolean().default(false),
+    requireSpecial: z.boolean().default(false)
+});
+export const SessionPolicySchema = z.strictObject({
+    /** Seconds a session lives from its last roll. */
+    lifetimeSeconds: z.number().int().min(300).max(60 * 60 * 24 * 365).default(NINETY_DAYS_SECONDS),
+    /** Seconds after which use of a session rolls its expiry forward. */
+    refreshAfterSeconds: z.number().int().min(60).default(ONE_DAY_SECONDS)
+});
+export const TwoFactorRequirementSchema = z.enum(['optional', 'required']);
+export const AuthPolicySchema = z
+    .strictObject({
+    password: PasswordPolicySchema.prefault({}),
+    session: SessionPolicySchema.prefault({}),
+    twoFactor: z.strictObject({ requirement: TwoFactorRequirementSchema.default('optional') }).prefault({})
+})
+    .refine((policy) => policy.password.maxLength >= policy.password.minLength, {
+    path: ['password', 'maxLength'],
+    message: 'The maximum password length must not be below the minimum.'
+})
+    .refine((policy) => policy.session.refreshAfterSeconds <= policy.session.lifetimeSeconds, {
+    path: ['session', 'refreshAfterSeconds'],
+    message: 'A session must be refreshable within its lifetime.'
+});
+/** The one reason a password fails the policy; the set a caller shows is the whole list. */
+export const PasswordViolationSchema = z.enum([
+    'password-too-short',
+    'password-too-long',
+    'password-needs-uppercase',
+    'password-needs-lowercase',
+    'password-needs-number',
+    'password-needs-special'
+]);
+/** Every rule `password` breaks under `policy`; empty when it satisfies the policy. */
+export function passwordViolations(policy, password) {
+    const violations = [];
+    if (password.length < policy.minLength)
+        violations.push('password-too-short');
+    if (password.length > policy.maxLength)
+        violations.push('password-too-long');
+    if (policy.requireUppercase && !/\p{Lu}/u.test(password))
+        violations.push('password-needs-uppercase');
+    if (policy.requireLowercase && !/\p{Ll}/u.test(password))
+        violations.push('password-needs-lowercase');
+    if (policy.requireNumber && !/\p{N}/u.test(password))
+        violations.push('password-needs-number');
+    if (policy.requireSpecial && !/[^\p{L}\p{N}\s]/u.test(password))
+        violations.push('password-needs-special');
+    return violations;
+}
+/** Refuse a password that breaks the policy with a typed, value-free error. */
+export function assertPasswordMeetsPolicy(policy, password) {
+    const violations = passwordViolations(policy, password);
+    if (violations.length === 0)
+        return;
+    throw new CapabilityError('The password does not meet the password policy.', 'INVALID_INPUT', {
+        reason: 'password-policy-violation',
+        recoveryHint: 'Choose a password that satisfies the listed rules.',
+        details: { violations }
+    });
+}
+/** The policy as the auth runtime resolves it now: schema defaults, composition, stored edit. */
+export async function loadAuthPolicy(runtime) {
+    // A host that never composed the manifest has no declared policy; defaults are not guessed for it.
+    if (!ConfigManifest.isRegistered(runtime, AUTH_POLICY_MANIFEST_ID)) {
+        throw new CapabilityError("This host reads the authentication policy but does not compose the 'auth.policy' manifest.", 'UNAVAILABLE', {
+            reason: 'auth-policy-not-composed',
+            retryable: false,
+            details: { manifest: AUTH_POLICY_MANIFEST_ID },
+            recoveryHint: "Select '@vibesdotdev/auth/plugin' in this host's composition, which registers 'auth.policy'."
+        });
+    }
+    return AuthPolicySchema.parse(await ConfigManifest.forRuntime(runtime, AUTH_POLICY_MANIFEST_ID).load());
+}
+/** Session lifetime and roll interval in the units the session store takes. */
+export function sessionLifetime(policy) {
+    return { expiresIn: policy.session.lifetimeSeconds, updateAge: policy.session.refreshAfterSeconds };
+}
+/** True when a user without a second factor must enroll before anything else. */
+export function twoFactorEnrollmentRequired(policy, user) {
+    return policy.twoFactor.requirement === 'required' && !user.twoFactorEnabled;
+}
+//# sourceMappingURL=auth-policy.js.map

package/dist/policy/auth-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.js","sourceRoot":"","sources":["../../src/policy/auth-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAE9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAErD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC9C,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAErC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC;IACjD,kDAAkD;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/F,qEAAqE;IACrE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;CACtE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC/B,YAAY,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC3C,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,0BAA0B,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;CACvG,CAAC;KACD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE;IAC3E,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC;IAC/B,OAAO,EAAE,4DAA4D;CACrE,CAAC;KACD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE;IACzF,IAAI,EAAE,CAAC,SAAS,EAAE,qBAAqB,CAAC;IACxC,OAAO,EAAE,oDAAoD;CAC7D,CAAC,CAAC;AAKJ,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,oBAAoB;IACpB,mBAAmB;IACnB,0BAA0B;IAC1B,0BAA0B;IAC1B,uBAAuB;IACvB,wBAAwB;CACxB,CAAC,CAAC;AAGH,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,MAAsB,EAAE,QAAgB;IAC1E,MAAM,UAAU,GAAwB,EAAE,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtG,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtG,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC3G,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CAAC,MAAsB,EAAE,QAAgB;IACjF,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACpC,MAAM,IAAI,eAAe,CAAC,iDAAiD,EAAE,eAAe,EAAE;QAC7F,MAAM,EAAE,2BAA2B;QACnC,YAAY,EAAE,oDAAoD;QAClE,OAAO,EAAE,EAAE,UAAU,EAAE;KACvB,CAAC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAmB;IACvD,mGAAmG;IACnG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,OAAO,EAAE,uBAAuB,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,eAAe,CACxB,4FAA4F,EAC5F,aAAa,EACb;YACC,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE;YAC9C,YAAY,EAAE,8FAA8F;SAC5G,CACD,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,MAAM,cAAc,CAAC,UAAU,CAAa,OAAO,EAAE,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,MAAkB;IACjD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;AACrG,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,2BAA2B,CAAC,MAAkB,EAAE,IAAmC;IAClG,OAAO,MAAM,CAAC,SAAS,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;AAC9E,CAAC"}

package/dist/runtime/auth-policy.config.descriptor.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `auth.policy` config manifest descriptor — the authentication policy the
+ * auth runtime enforces (see `../policy/auth-policy.ts`). A console edits
+ * this manifest; auth-web reads it where it accepts passwords, builds
+ * sessions, and admits signed-in users.
+ */
+import type { ConfigManifestDescriptor } from '@vibesdotdev/config/schemas/config-manifest-descriptor';
+declare const descriptor: ConfigManifestDescriptor;
+export default descriptor;
+//# sourceMappingURL=auth-policy.config.descriptor.d.ts.map

package/dist/runtime/auth-policy.config.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.config.descriptor.d.ts","sourceRoot":"","sources":["../../src/runtime/auth-policy.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAGvG,QAAA,MAAM,UAAU,EAAE,wBA0CjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/runtime/auth-policy.config.descriptor.js

@@ -0,0 +1,46 @@
+import { AUTH_POLICY_MANIFEST_ID, AuthPolicySchema } from "../policy/auth-policy.js";
+const descriptor = {
+    kind: 'config/manifest',
+    id: AUTH_POLICY_MANIFEST_ID,
+    name: 'Authentication policy',
+    description: 'Password rules, session lifetime, and the second-factor requirement the auth runtime enforces',
+    namespace: AUTH_POLICY_MANIFEST_ID,
+    schema: AuthPolicySchema,
+    allowedAdapters: ['storage.json', 'storage.localdb'],
+    scope: 'global',
+    customTables: false,
+    version: 1,
+    internal: false,
+    tier: 'system',
+    category: 'auth',
+    fields: {
+        'password.minLength': { ui: { label: 'Minimum length', component: 'number', group: 'password' } },
+        'password.maxLength': { ui: { label: 'Maximum length', component: 'number', group: 'password' } },
+        'password.requireUppercase': { ui: { label: 'Require an uppercase letter', component: 'switch', group: 'password' } },
+        'password.requireLowercase': { ui: { label: 'Require a lowercase letter', component: 'switch', group: 'password' } },
+        'password.requireNumber': { ui: { label: 'Require a number', component: 'switch', group: 'password' } },
+        'password.requireSpecial': { ui: { label: 'Require a special character', component: 'switch', group: 'password' } },
+        'session.lifetimeSeconds': { ui: { label: 'Session lifetime (seconds)', component: 'number', group: 'session' } },
+        'session.refreshAfterSeconds': { ui: { label: 'Roll expiry after (seconds)', component: 'number', group: 'session' } },
+        'twoFactor.requirement': {
+            ui: {
+                label: 'Second factor',
+                description: 'Required: signed-in users without a second factor may only enroll until they do.',
+                component: 'select',
+                group: 'twoFactor'
+            },
+            options: [
+                { value: 'optional', label: 'Optional' },
+                { value: 'required', label: 'Required' }
+            ]
+        }
+    },
+    groups: [
+        { id: 'password', label: 'Passwords', order: 1 },
+        { id: 'session', label: 'Sessions', order: 2 },
+        { id: 'twoFactor', label: 'Second factor', order: 3 }
+    ],
+    enabled: true
+};
+export default descriptor;
+//# sourceMappingURL=auth-policy.config.descriptor.js.map

package/dist/runtime/auth-policy.config.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-policy.config.descriptor.js","sourceRoot":"","sources":["../../src/runtime/auth-policy.config.descriptor.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAErF,MAAM,UAAU,GAA6B;IAC5C,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,+FAA+F;IAC5G,SAAS,EAAE,uBAAuB;IAClC,MAAM,EAAE,gBAAgB;IACxB,eAAe,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;IACpD,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,KAAK;IACf,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,MAAM;IAChB,MAAM,EAAE;QACP,oBAAoB,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QACjG,oBAAoB,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QACjG,2BAA2B,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QACrH,2BAA2B,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QACpH,wBAAwB,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QACvG,yBAAyB,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;QACnH,yBAAyB,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,4BAA4B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;QACjH,6BAA6B,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,6BAA6B,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;QACtH,uBAAuB,EAAE;YACxB,EAAE,EAAE;gBACH,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,kFAAkF;gBAC/F,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,WAAW;aAClB;YACD,OAAO,EAAE;gBACR,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;gBACxC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;aACxC;SACD;KACD;IACD,MAAM,EAAE;QACP,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;QAChD,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QAC9C,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE;KACrD;IACD,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/runtime/auth.config.descriptor.js

@@ -25,7 +25,7 @@ const descriptor = {
     // Storage configuration
     namespace: 'auth',
     schema: authCredentialsSchema,
-    allowedAdapters: ['storage.localdb'],
+    allowedAdapters: ['storage.localdb', 'storage.json'],
     scope: 'global',
     customTables: false,
     version: 1,

package/dist/runtime/auth.config.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.config.descriptor.js","sourceRoot":"","sources":["../../src/runtime/auth.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,UAAU,GAA6B;IAC5C,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,2CAA2C;IAExD,wBAAwB;IACxB,SAAS,EAAE,MAAM;IACjB,MAAM,EAAE,qBAAqB;IAC7B,eAAe,EAAE,CAAC,iBAAiB,CAAC;IACpC,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,KAAK;IAEf,+EAA+E;IAC/E,eAAe,EAAE;QAChB,mBAAmB;QACnB,oBAAoB;QACpB,0BAA0B;QAC1B,0BAA0B;KAC1B;IAED,iCAAiC;IACjC,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAElB,wBAAwB;IACxB,MAAM,EAAE;QACP,mBAAmB,EAAE;YACpB,EAAE,EAAE;gBACH,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,qCAAqC;gBAClD,SAAS,EAAE,QAAQ;aACnB;SACD;QACD,oBAAoB,EAAE;YACrB,EAAE,EAAE;gBACH,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,4BAA4B;gBACzC,SAAS,EAAE,QAAQ;aACnB;SACD;QACD,0BAA0B,EAAE;YAC3B,EAAE,EAAE;gBACH,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,0BAA0B;gBACvC,SAAS,EAAE,QAAQ;aACnB;SACD;QACD,0BAA0B,EAAE;YAC3B,EAAE,EAAE;gBACH,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,wCAAwC;gBACrD,SAAS,EAAE,QAAQ;aACnB;SACD;KACD;IAED,aAAa;IACb,UAAU,EAAE;QACX,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,CAAC;KACR;IAED,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"auth.config.descriptor.js","sourceRoot":"","sources":["../../src/runtime/auth.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,UAAU,GAA6B;IAC5C,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,2CAA2C;IAExD,wBAAwB;IACxB,SAAS,EAAE,MAAM;IACjB,MAAM,EAAE,qBAAqB;IAC7B,eAAe,EAAE,CAAC,iBAAiB,EAAE,cAAc,CAAC;IACpD,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,KAAK;IAEf,+EAA+E;IAC/E,eAAe,EAAE;QAChB,mBAAmB;QACnB,oBAAoB;QACpB,0BAA0B;QAC1B,0BAA0B;KAC1B;IAED,iCAAiC;IACjC,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAElB,wBAAwB;IACxB,MAAM,EAAE;QACP,mBAAmB,EAAE;YACpB,EAAE,EAAE;gBACH,KAAK,EAAE,WAAW;gBAClB,WAAW,EAAE,qCAAqC;gBAClD,SAAS,EAAE,QAAQ;aACnB;SACD;QACD,oBAAoB,EAAE;YACrB,EAAE,EAAE;gBACH,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,4BAA4B;gBACzC,SAAS,EAAE,QAAQ;aACnB;SACD;QACD,0BAA0B,EAAE;YAC3B,EAAE,EAAE;gBACH,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,0BAA0B;gBACvC,SAAS,EAAE,QAAQ;aACnB;SACD;QACD,0BAA0B,EAAE;YAC3B,EAAE,EAAE;gBACH,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,wCAAwC;gBACrD,SAAS,EAAE,QAAQ;aACnB;SACD;KACD;IAED,aAAa;IACb,UAAU,EAAE;QACX,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,CAAC;KACR;IAED,OAAO,EAAE,IAAI;CACb,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/runtime/auth.plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.plugin.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.plugin.ts"],"names":[],"mappings":"AAuBA,QAAA,MAAM,aAAa,6CA+CjB,CAAC;AAEH,eAAe,aAAa,CAAC"}
+{"version":3,"file":"auth.plugin.d.ts","sourceRoot":"","sources":["../../src/runtime/auth.plugin.ts"],"names":[],"mappings":"AAwBA,QAAA,MAAM,aAAa,6CAgDjB,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/runtime/auth.plugin.js

@@ -5,6 +5,7 @@ import authCoreProviderPlugin from "./plugin/core.provider.js";
 import authSupportPlugin from "./plugin/support.js";
 import authApiClientPlugin from "./plugin/api-client.js";
 import authLoginSucceededEventDescriptor from "../events/session-established.event.descriptor.js";
+import authLogoutStartedEventDescriptor from "../events/session-ending.event.descriptor.js";
 import authEmailConfigDescriptor from "../features/email/email.config.descriptor.js";
 import authOnClientAuthRejectedSubscription from "../events/on-client-auth-rejected.subscription.descriptor.js";
 // Docs
@@ -30,6 +31,7 @@ const defaultExport = createRuntimePlugin({
         providersDescriptor,
         keysDescriptor,
         authLoginSucceededEventDescriptor,
+        authLogoutStartedEventDescriptor,
         authDeviceSessionCapabilityDescriptor,
         authOnClientAuthRejectedSubscription
     ],

package/dist/runtime/auth.plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.plugin.js","sourceRoot":"","sources":["../../src/runtime/auth.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACN,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,MAAM,qDAAqD,CAAC;AAC7D,OAAO,sBAAsB,MAAM,2BAA2B,CAAC;AAC/D,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,mBAAmB,MAAM,wBAAwB,CAAC;AACzD,OAAO,iCAAiC,MAAM,mDAAmD,CAAC;AAClG,OAAO,yBAAyB,MAAM,8CAA8C,CAAC;AACrF,OAAO,oCAAoC,MAAM,8DAA8D,CAAC;AAEhH,OAAO;AACP,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,eAAe,MAAM,kCAAkC,CAAC;AAC/D,OAAO,kBAAkB,MAAM,qCAAqC,CAAC;AACrE,OAAO,eAAe,MAAM,kCAAkC,CAAC;AAC/D,OAAO,mBAAmB,MAAM,2CAA2C,CAAC;AAC5E,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAE7D,kIAAkI;AAClI,MAAM,aAAa,GAAG,mBAAmB,CAAC;IACzC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,iDAAiD;IAC9D,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC;IAClD,KAAK,EAAE,CAAC,gBAAgB,EAAE,+BAA+B,CAAC;IAC1D,WAAW,EAAE;QACZ,yBAAyB;QACzB,cAAc;QACd,eAAe;QACf,kBAAkB;QAClB,eAAe;QACf,mBAAmB;QACnB,cAAc;QACd,iCAAiC;QACjC,qCAAqC;QACrC,oCAAoC;KACpC;IACD,OAAO,EAAE;QACR,MAAM,CACL,wBAAwB,EACxB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAC5B,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CACjE;QACD,MAAM,CACL,oCAAoC,EACpC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAChC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAC/D;QACD,2EAA2E;QAC3E,sEAAsE;QACtE,sEAAsE;QACtE,sBAAsB;KACtB;IACD,eAAe,EAAE;QAChB;YACC,MAAM,EAAE,+BAA+B,CAAC,EAAE;YAC1C,OAAO,EAAE,qCAAqC,CAAC,EAAE;YACjD,QAAQ,EAAE,mCAAmC;SAC7C;KACD;IAED,KAAK,CAAC,UAAU,CAAC,OAAO;QACvB,MAAM,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QACrD,MAAM,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,aAAa,CAAC"}
+{"version":3,"file":"auth.plugin.js","sourceRoot":"","sources":["../../src/runtime/auth.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACN,qCAAqC,EACrC,mCAAmC,EACnC,+BAA+B,EAC/B,MAAM,qDAAqD,CAAC;AAC7D,OAAO,sBAAsB,MAAM,2BAA2B,CAAC;AAC/D,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,mBAAmB,MAAM,wBAAwB,CAAC;AACzD,OAAO,iCAAiC,MAAM,mDAAmD,CAAC;AAClG,OAAO,gCAAgC,MAAM,8CAA8C,CAAC;AAC5F,OAAO,yBAAyB,MAAM,8CAA8C,CAAC;AACrF,OAAO,oCAAoC,MAAM,8DAA8D,CAAC;AAEhH,OAAO;AACP,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,eAAe,MAAM,kCAAkC,CAAC;AAC/D,OAAO,kBAAkB,MAAM,qCAAqC,CAAC;AACrE,OAAO,eAAe,MAAM,kCAAkC,CAAC;AAC/D,OAAO,mBAAmB,MAAM,2CAA2C,CAAC;AAC5E,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAE7D,kIAAkI;AAClI,MAAM,aAAa,GAAG,mBAAmB,CAAC;IACzC,EAAE,EAAE,MAAM;IACV,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,iDAAiD;IAC9D,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC;IAClD,KAAK,EAAE,CAAC,gBAAgB,EAAE,+BAA+B,CAAC;IAC1D,WAAW,EAAE;QACZ,yBAAyB;QACzB,cAAc;QACd,eAAe;QACf,kBAAkB;QAClB,eAAe;QACf,mBAAmB;QACnB,cAAc;QACd,iCAAiC;QACjC,gCAAgC;QAChC,qCAAqC;QACrC,oCAAoC;KACpC;IACD,OAAO,EAAE;QACR,MAAM,CACL,wBAAwB,EACxB,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAC5B,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC,CACjE;QACD,MAAM,CACL,oCAAoC,EACpC,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAChC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAC/D;QACD,2EAA2E;QAC3E,sEAAsE;QACtE,sEAAsE;QACtE,sBAAsB;KACtB;IACD,eAAe,EAAE;QAChB;YACC,MAAM,EAAE,+BAA+B,CAAC,EAAE;YAC1C,OAAO,EAAE,qCAAqC,CAAC,EAAE;YACjD,QAAQ,EAAE,mCAAmC;SAC7C;KACD;IAED,KAAK,CAAC,UAAU,CAAC,OAAO;QACvB,MAAM,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;QACrD,MAAM,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IACnD,CAAC;CACD,CAAC,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/runtime/plugin/core.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.provider.d.ts","sourceRoot":"","sources":["../../../src/runtime/plugin/core.provider.ts"],"names":[],"mappings":"AAaA,QAAA,MAAM,aAAa,6CAqBjB,CAAC;AAEH,eAAe,aAAa,CAAC"}
+{"version":3,"file":"core.provider.d.ts","sourceRoot":"","sources":["../../../src/runtime/plugin/core.provider.ts"],"names":[],"mappings":"AAcA,QAAA,MAAM,aAAa,6CAsBjB,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/runtime/plugin/core.provider.js

@@ -2,6 +2,7 @@ import { createRuntimePlugin, loader } from '@vibesdotdev/kernel';
 import authContext from "../auth.context.descriptor.js";
 import authIdentityPlugin from "./identity.js";
 import autoVerifyConfig from "../auto-verify.config.descriptor.js";
+import authPolicyConfig from "../auth-policy.config.descriptor.js";
 import authApiClient from "../../client/auth.legacy-api-client.descriptor.js";
 import authProviderApi from "../providers/auth-provider.api.descriptor.js";
 import authProviderDb from "../providers/db.descriptor.js";
@@ -16,6 +17,7 @@ const defaultExport = createRuntimePlugin({
     descriptors: [
         authContext,
         autoVerifyConfig,
+        authPolicyConfig,
         authApiClient,
         authProviderApi,
         authProviderDb,

package/dist/runtime/plugin/core.provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.provider.js","sourceRoot":"","sources":["../../../src/runtime/plugin/core.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,WAAW,MAAM,+BAA+B,CAAC;AACxD,OAAO,kBAAkB,MAAM,eAAe,CAAC;AAC/C,OAAO,gBAAgB,MAAM,qCAAqC,CAAC;AACnE,OAAO,aAAa,MAAM,mDAAmD,CAAC;AAC9E,OAAO,eAAe,MAAM,8CAA8C,CAAC;AAC3E,OAAO,cAAc,MAAM,+BAA+B,CAAC;AAC3D,OAAO,mBAAmB,MAAM,kDAAkD,CAAC;AACnF,OAAO,0BAA0B,MAAM,mDAAmD,CAAC;AAC3F,OAAO,oBAAoB,MAAM,sDAAsD,CAAC;AAExF,kIAAkI;AAClI,MAAM,aAAa,GAAG,mBAAmB,CAAC;IACzC,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,yBAAyB;IAC/B,WAAW,EAAE,sEAAsE;IACnF,WAAW,EAAE;QACZ,WAAW;QACX,gBAAgB;QAChB,aAAa;QACb,eAAe;QACf,cAAc;QACd,mBAAmB;QACnB,0BAA0B;QAC1B,oBAAoB;KACpB;IACD,KAAK,CAAC,UAAU,CAAC,OAAO;QACvB,MAAM,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE;QACR,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;KAC5F;CACD,CAAC,CAAC;AAEH,eAAe,aAAa,CAAC"}
+{"version":3,"file":"core.provider.js","sourceRoot":"","sources":["../../../src/runtime/plugin/core.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,WAAW,MAAM,+BAA+B,CAAC;AACxD,OAAO,kBAAkB,MAAM,eAAe,CAAC;AAC/C,OAAO,gBAAgB,MAAM,qCAAqC,CAAC;AACnE,OAAO,gBAAgB,MAAM,qCAAqC,CAAC;AACnE,OAAO,aAAa,MAAM,mDAAmD,CAAC;AAC9E,OAAO,eAAe,MAAM,8CAA8C,CAAC;AAC3E,OAAO,cAAc,MAAM,+BAA+B,CAAC;AAC3D,OAAO,mBAAmB,MAAM,kDAAkD,CAAC;AACnF,OAAO,0BAA0B,MAAM,mDAAmD,CAAC;AAC3F,OAAO,oBAAoB,MAAM,sDAAsD,CAAC;AAExF,kIAAkI;AAClI,MAAM,aAAa,GAAG,mBAAmB,CAAC;IACzC,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,yBAAyB;IAC/B,WAAW,EAAE,sEAAsE;IACnF,WAAW,EAAE;QACZ,WAAW;QACX,gBAAgB;QAChB,gBAAgB;QAChB,aAAa;QACb,eAAe;QACf,cAAc;QACd,mBAAmB;QACnB,0BAA0B;QAC1B,oBAAoB;KACpB;IACD,KAAK,CAAC,UAAU,CAAC,OAAO;QACvB,MAAM,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE;QACR,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;KAC5F;CACD,CAAC,CAAC;AAEH,eAAe,aAAa,CAAC"}

package/dist/schemas/admin/index.d.ts

@@ -71,6 +71,10 @@ export type AuthAdminSecuritySessionsPage = {
     sessions: AuthAdminSecuritySessionRecord[];
     pagination: AuthAdminSecurityPagination;
 };
+/** Why a privileged admin change is being made; required, recorded in auth's audit trail. */
+export interface AuthAdminMutationOptions {
+    reason: string;
+}
 export type AuthAdminSecurityApiKeyStatus = 'active' | 'revoked' | 'expired' | 'disabled' | 'all';
 export type AuthAdminSecurityApiKeyRecord = {
     id: string;
@@ -158,6 +162,7 @@ export type AuthAdminCreateUserInput = {
     name?: string;
     emailVerified?: boolean;
     isSuperuser?: boolean;
+    reason: string;
 };
 export type AuthAdminCreateUserResult = {
     success: boolean;
@@ -190,35 +195,28 @@ export type AuthAdminClient = {
     }): Promise<AuthAdminUsersPage>;
     getUser(userId: string): Promise<AuthAdminUserDetail | null>;
     createUser(input: AuthAdminCreateUserInput): Promise<AuthAdminCreateUserResult>;
-    setUserSuperuserStatus(userId: string, makeSuperuser: boolean): Promise<{
+    setUserSuperuserStatus(userId: string, makeSuperuser: boolean, options: AuthAdminMutationOptions): Promise<{
         success: boolean;
     }>;
-    setUserStatus(userId: string, status: AuthAdminUserStatus, options?: {
-        reason?: string | null;
-    }): Promise<AuthAdminSetStatusResult>;
-    bulkSetUserStatus(userIds: string[], status: AuthAdminUserStatus, options?: {
-        reason?: string | null;
-    }): Promise<AuthAdminBulkSetStatusResult>;
-    deleteUser(userId: string): Promise<{
+    setUserStatus(userId: string, status: AuthAdminUserStatus, options: AuthAdminMutationOptions): Promise<AuthAdminSetStatusResult>;
+    bulkSetUserStatus(userIds: string[], status: AuthAdminUserStatus, options: AuthAdminMutationOptions): Promise<AuthAdminBulkSetStatusResult>;
+    deleteUser(userId: string, options: AuthAdminMutationOptions): Promise<{
         success: boolean;
     }>;
-    revokeSessions(): Promise<{
+    /** Every privileged call below requires a non-empty `reason`; revoke-all spares the caller's own session and key. */
+    revokeSessions(options: AuthAdminMutationOptions): Promise<{
         success: boolean;
         revoked: number;
     }>;
-    revokeApiKeys(): Promise<{
+    revokeApiKeys(options: AuthAdminMutationOptions): Promise<{
         success: boolean;
         revoked: number;
     }>;
-    revokeSession(sessionId: string, options?: {
-        reason?: string | null;
-    }): Promise<{
+    revokeSession(sessionId: string, options: AuthAdminMutationOptions): Promise<{
         success: boolean;
         revoked: number;
     }>;
-    revokeApiKey(apiKeyId: string, options?: {
-        reason?: string | null;
-    }): Promise<{
+    revokeApiKey(apiKeyId: string, options: AuthAdminMutationOptions): Promise<{
         success: boolean;
         revoked: number;
     }>;
@@ -227,23 +225,27 @@ export type AuthAdminClient = {
     listRolePermissions(): Promise<RolePermissionRecord[]>;
     createRole(input: {
         name: string;
+        reason: string;
         description?: string;
         permissionIds?: string[];
     }): Promise<RoleRecord>;
     updateRole(input: {
         id: string;
+        reason: string;
         name: string;
         description?: string;
         permissionIds?: string[];
     }): Promise<void>;
     createPermission(input: {
         name: string;
+        reason: string;
         resource: string;
         action?: string;
         description?: string;
     }): Promise<PermissionRecord>;
     updatePermission(input: {
         id: string;
+        reason: string;
         name: string;
         resource: string;
         action?: string;