@vibesdotdev/auth 1.0.0-rc.5 → 1.0.0-rc.9

package/dist/server/registered-origin-resolver.js

@@ -1,5 +1,18 @@
 import { getVibesClient } from '@vibesdotdev/kernel/client';
-import { canonicalRegisteredOrigin } from "../schemas/registered-app.js";
+import { canonicalRegisteredOrigin, RegisteredOriginResolveResponseSchema } from "../schemas/registered-app.js";
+/**
+ * Share one in-flight lookup for this request. A refusal is not an answer:
+ * drop it so a retry asks again, and forward that refusal to the caller.
+ */
+function shareOriginLookup(answers, canonical, started) {
+    const pending = started.catch((error) => {
+        if (answers.get(canonical) === pending)
+            answers.delete(canonical);
+        throw error;
+    });
+    answers.set(canonical, pending);
+    return pending;
+}
 export function createRegisteredOriginResolver(runtime) {
     const perRequest = new WeakMap();
     const lookup = async (origin) => (await getVibesClient('auth', runtime)).resolveRegisteredOrigin(origin);
@@ -17,14 +30,45 @@ export function createRegisteredOriginResolver(runtime) {
         const cached = answers.get(canonical);
         if (cached)
             return cached;
-        const pending = lookup(canonical);
-        answers.set(canonical, pending);
-        // A refusal is not an answer: drop it so a retry in the same request asks again.
-        pending.catch(() => {
-            if (answers.get(canonical) === pending)
-                answers.delete(canonical);
+        return shareOriginLookup(answers, canonical, lookup(canonical));
+    };
+}
+export function createRegistrarOriginResolver(runtime, options = {}) {
+    const perRequest = new WeakMap();
+    const lookup = async (origin) => {
+        const token = options.credential ?? await (async () => {
+            const credential = await runtime.resolveCredential({ source: 'secret', key: 'VIBES_AUTH_INTERNAL_TOKEN' });
+            if (!credential.ok)
+                throw credential.error;
+            return credential.value.trim();
+        })();
+        const base = options.authOrigin ?? (await import('@vibesdotdev/infra-core/service')).serviceOrigin(runtime, 'auth');
+        const response = await (options.fetchImpl ?? fetch)(`${String(base).replace(/\/$/, '')}/api/internal/registered-apps/resolve`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
+            body: JSON.stringify({ origin })
         });
-        return pending;
+        if (!response.ok) {
+            throw new Error(`The registered-app registrar refused the lookup (HTTP ${response.status}).`);
+        }
+        const answer = RegisteredOriginResolveResponseSchema.parse(await response.json());
+        return answer.app;
+    };
+    return (origin, request) => {
+        const canonical = canonicalRegisteredOrigin(origin);
+        if (!canonical)
+            return Promise.resolve(null);
+        if (!request)
+            return lookup(canonical);
+        let answers = perRequest.get(request);
+        if (!answers) {
+            answers = new Map();
+            perRequest.set(request, answers);
+        }
+        const cached = answers.get(canonical);
+        if (cached)
+            return cached;
+        return shareOriginLookup(answers, canonical, lookup(canonical));
     };
 }
 //# sourceMappingURL=registered-origin-resolver.js.map

package/dist/server/registered-origin-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"registered-origin-resolver.js","sourceRoot":"","sources":["../../src/server/registered-origin-resolver.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,yBAAyB,EAAsB,MAAM,8BAA8B,CAAC;AAY7F,MAAM,UAAU,8BAA8B,CAAC,OAAmB;IACjE,MAAM,UAAU,GAAG,IAAI,OAAO,EAAuD,CAAC;IACtF,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE,CACvC,CAAC,MAAM,cAAc,CAAgB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAExF,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChC,iFAAiF;QACjF,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;YAClB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO;gBAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"registered-origin-resolver.js","sourceRoot":"","sources":["../../src/server/registered-origin-resolver.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EACN,yBAAyB,EACzB,qCAAqC,EAErC,MAAM,8BAA8B,CAAC;AAYtC;;;GAGG;AACH,SAAS,iBAAiB,CACzB,OAAmD,EACnD,SAAiB,EACjB,OAAsC;IAEtC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACvC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO;YAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,KAAK,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,OAAmB;IACjE,MAAM,UAAU,GAAG,IAAI,OAAO,EAAuD,CAAC;IACtF,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE,CACvC,CAAC,MAAM,cAAc,CAAgB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAExF,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,OAAO,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC;AACH,CAAC;AAqBD,MAAM,UAAU,6BAA6B,CAC5C,OAAmB,EACnB,UAA0C,EAAE;IAE5C,MAAM,UAAU,GAAG,IAAI,OAAO,EAAuD,CAAC;IACtF,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAiC,EAAE;QACtE,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE;YACrD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC,CAAC;YAC3G,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,MAAM,UAAU,CAAC,KAAK,CAAC;YAC3C,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,uCAAuC,EAAE;YAC9H,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,yDAAyD,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAG,qCAAqC,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,GAAG,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;YACpB,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,OAAO,iBAAiB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC;AACH,CAAC"}

package/dist/svelte/index.d.ts

@@ -74,6 +74,5 @@ export { clearLastAuthMethod, getLastAuthMethod, mapProviderIdToAuthMethod, setL
 export type { AuthMethod } from './auth-method.ts';
 export type { SignInNotice, SignInNoticeKind, PolicyDefinition, PolicyAcceptance, SignUpSuccessDetail } from './types.ts';
 export { authState } from './state.svelte.ts';
-export { authSveltePlugin } from './auth-svelte.plugin.ts';
 export { getAuthErrorMessage } from '../features/core/shared/auth-errors.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/svelte/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/svelte/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAC3F;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AACvG,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACnG,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAClG,YAAY,EACX,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,0CAA0C,CAAC;AAElD;;;;;GAKG;AACH,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AAClG,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,4CAA4C,CAAC;AACxF,YAAY,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;GAOG;AACH,OAAO,EACN,eAAe,EACf,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACX,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACN,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,MAAM,eAAe,CAAC;AACvB,YAAY,EACX,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACN,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,iBAAiB,EACjB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,YAAY,EACX,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/svelte/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAC3F;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAC7F,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AACvG,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACnG,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,kBAAkB,EAAE,MAAM,mDAAmD,CAAC;AAClG,YAAY,EACX,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,0CAA0C,CAAC;AAElD;;;;;GAKG;AACH,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AAClG,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,4CAA4C,CAAC;AACxF,YAAY,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,iBAAiB,EACjB,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;GAOG;AACH,OAAO,EACN,eAAe,EACf,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,MAAM,uBAAuB,CAAC;AAE/B,YAAY,EACX,2BAA2B,EAC3B,yBAAyB,EACzB,qBAAqB,EACrB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACN,gBAAgB,EAChB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,MAAM,eAAe,CAAC;AACvB,YAAY,EACX,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACN,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,iBAAiB,EACjB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,YAAY,EACX,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAI9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC"}

package/dist/svelte/index.js

@@ -67,5 +67,7 @@ export { findSessionToken, formatAuthSessionLastActive, getAuthSessionBrowserNam
 export { evaluatePassword, getPasswordScore, getPasswordStrengthClass, getPasswordStrengthLabel } from "./password.js";
 export { clearLastAuthMethod, getLastAuthMethod, mapProviderIdToAuthMethod, setLastAuthMethod } from "./auth-method.js";
 export { authState } from "./state.svelte.js";
-export { authSveltePlugin } from "./auth-svelte.plugin.js";
+// The browser-scope surface plugin (the `*.impl.browser` users augmentation) is public at
+// `@vibesdotdev/auth/svelte/plugin`, not here: SSR renders components through this barrel,
+// and a re-export would carry the plugin's browser loader into every server and Worker graph.
 export { getAuthErrorMessage } from "../features/core/shared/auth-errors.js";

package/dist/system/internal-api/client.d.ts

@@ -1,5 +1,5 @@
 import type * as z from 'zod/v4';
-import { userOAuthAccountSelectionSchema, type PermissionsCheckRequest, type UserOAuthAccount, type UserOAuthAccountDetail, type UserOAuthAccountUnlinkResponse, type UserPromoteStaffResponse, type UserSlugRequest } from './schemas.ts';
+import { userOAuthAccountSelectionSchema, type DelegatedTokenMintRequest, type DelegatedTokenMintResponse, type DelegatedTokenValidateRequest, type DelegatedTokenValidateResponse, type PermissionsCheckRequest, type UserOAuthAccount, type UserOAuthAccountDetail, type UserOAuthAccountUnlinkResponse, type UserPromoteStaffResponse, type UserSlugRequest } from './schemas.ts';
 export interface AuthInternalClientConfig {
     /** A function resolves request-bound service routing after host initialization. */
     baseUrl: string | (() => string);
@@ -19,6 +19,15 @@ export interface AuthInternalClientConfig {
     timeout?: number;
 }
 export interface AuthInternalClient {
+    /** Mint a resource-scoped token for a code session's user (lane C); returned once, never stored. */
+    mintDelegatedToken(input: DelegatedTokenMintRequest): Promise<DelegatedTokenMintResponse>;
+    /** Revoke every delegated token minted for a session; answers how many were live. */
+    revokeDelegatedTokens(sessionId: string): Promise<number>;
+    /**
+     * Whether a delegated token was minted for this service's resource. Answers
+     * `valid: false` for a wrong audience, expiry, revocation or any other refusal.
+     */
+    validateDelegatedToken(input: DelegatedTokenValidateRequest): Promise<DelegatedTokenValidateResponse>;
     checkPermission(input: PermissionsCheckRequest): Promise<boolean>;
     isSuperuser(userId: string): Promise<boolean>;
     isStaff(userId: string): Promise<boolean>;

package/dist/system/internal-api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,CAAC;AAIjC,OAAO,EAYN,+BAA+B,EAO/B,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,wBAAwB;IACxC,mFAAmF;IACnF,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACjC;;;;;;;;;;OAUG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACzE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IAClC,eAAe,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACzJ,kBAAkB,CACjB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC3C,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC/D;AAiCD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,GAAG,kBAAkB,CAoG7F"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,CAAC;AAIjC,OAAO,EAYN,+BAA+B,EAU/B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EAGnC,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,wBAAwB;IACxC,mFAAmF;IACnF,OAAO,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACjC;;;;;;;;;;OAUG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IACzE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IAClC,oGAAoG;IACpG,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC1F,qFAAqF;IACrF,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D;;;OAGG;IACH,sBAAsB,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACtG,eAAe,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/D,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IACzJ,kBAAkB,CACjB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC3C,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;CAC/D;AAiCD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,GAAG,kBAAkB,CAuH7F"}

package/dist/system/internal-api/client.js

@@ -1,7 +1,7 @@
 import { vibesApiClient } from '@vibesdotdev/client';
 import { CapabilityError } from '@vibesdotdev/kernel';
 import { authInternalEndpoints } from "./endpoints.js";
-import { permissionsCheckRequestSchema, permissionsCheckResponseSchema, permissionsIsSuperuserRequestSchema, permissionsIsSuperuserResponseSchema, permissionsIsStaffRequestSchema, permissionsIsStaffResponseSchema, permissionsIsOrgAdminRequestSchema, permissionsIsOrgAdminResponseSchema, permissionsIsTeamAdminRequestSchema, permissionsIsTeamAdminResponseSchema, userOAuthAccountDetailResponseSchema, userOAuthAccountSelectionSchema, userOAuthAccountsResponseSchema, userOAuthAccountUnlinkResponseSchema, userPromoteStaffRequestSchema, userPromoteStaffResponseSchema, userSlugRequestSchema, userSlugResponseSchema } from "./schemas.js";
+import { permissionsCheckRequestSchema, permissionsCheckResponseSchema, permissionsIsSuperuserRequestSchema, permissionsIsSuperuserResponseSchema, permissionsIsStaffRequestSchema, permissionsIsStaffResponseSchema, permissionsIsOrgAdminRequestSchema, permissionsIsOrgAdminResponseSchema, permissionsIsTeamAdminRequestSchema, permissionsIsTeamAdminResponseSchema, userOAuthAccountDetailResponseSchema, userOAuthAccountSelectionSchema, userOAuthAccountsResponseSchema, userOAuthAccountUnlinkResponseSchema, userPromoteStaffRequestSchema, userPromoteStaffResponseSchema, delegatedTokenMintRequestSchema, delegatedTokenMintResponseSchema, delegatedTokenRevokeResponseSchema, delegatedTokenValidateRequestSchema, delegatedTokenValidateResponseSchema, userSlugRequestSchema, userSlugResponseSchema } from "./schemas.js";
 /** A request this client refuses to send: the caller's input fails the endpoint's request schema. */
 function parseRequest(schema, input) {
     const parsed = schema.safeParse(input);
@@ -105,6 +105,22 @@ export function createAuthInternalClient(config) {
             });
             return parseResponse(userSlugResponseSchema, response).slug;
         },
+        async mintDelegatedToken(input) {
+            const body = parseRequest(delegatedTokenMintRequestSchema, input);
+            const response = await getApi().post(authInternalEndpoints.delegatedTokens, body, { headers: await authHeaders() });
+            return parseResponse(delegatedTokenMintResponseSchema, response);
+        },
+        async revokeDelegatedTokens(sessionId) {
+            const response = await getApi().post(authInternalEndpoints.delegatedTokensRevoke, { sessionId }, { headers: await authHeaders() });
+            return parseResponse(delegatedTokenRevokeResponseSchema, response).revoked;
+        },
+        async validateDelegatedToken(input) {
+            const body = parseRequest(delegatedTokenValidateRequestSchema, input);
+            const response = await getApi().post(authInternalEndpoints.delegatedTokensValidate, body, {
+                headers: await authHeaders()
+            });
+            return parseResponse(delegatedTokenValidateResponseSchema, response);
+        },
         async promoteStaff(email) {
             const body = parseRequest(userPromoteStaffRequestSchema, { email });
             const response = await getApi().post(authInternalEndpoints.userPromoteStaff, body, {

package/dist/system/internal-api/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/system/internal-api/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAwB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,gCAAgC,EAChC,kCAAkC,EAClC,mCAAmC,EACnC,mCAAmC,EACnC,oCAAoC,EACpC,oCAAoC,EACpC,+BAA+B,EAC/B,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,EAOtB,MAAM,cAAc,CAAC;AAqCtB,qGAAqG;AACrG,SAAS,YAAY,CAAsB,MAAS,EAAE,KAAiB;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,yCAAyC,EAAE,eAAe,EAAE;YACrF,MAAM,EAAE,+BAA+B;YACvC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,yHAAyH;AACzH,SAAS,aAAa,CAAsB,MAAS,EAAE,QAAiB;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,iFAAiF,EAAE,UAAU,EAAE;YACxH,MAAM,EAAE,gCAAgC;YACxC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,iEAAiE;AACjE,SAAS,OAAO,CAAI,MAAqB;IACxC,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAgC;IACxE,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,MAAM,SAAS,GAAoB;YAClC,EAAE,EAAE,eAAe;YACnB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACvB,CAAC;QACF,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,+EAA+E;IAC/E,gFAAgF;IAChF,qEAAqE;IACrE,MAAM,WAAW,GAAG,KAAK,IAAqC,EAAE;QAC/D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC,CAAC;IAEF,OAAO;QACN,KAAK,CAAC,eAAe,CAAC,KAAK;YAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE;gBAClF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,IAAI,EAAE;gBACxF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC;QAClF,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM;YACnB,MAAM,IAAI,GAAG,YAAY,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,IAAI,EAAE;gBACpF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,gCAAgC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC1E,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc;YACtC,MAAM,IAAI,GAAG,YAAY,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,qBAAqB,EAAE,IAAI,EAAE;gBACvF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC;QAChF,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM;YAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,IAAI,EAAE;gBACxF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC;QAClF,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM;YAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;gBACpF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC;QAC1E,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS;YAClD,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;YAC7G,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAClC,qBAAqB,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,EAC1D,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,KAAK,EAAE,CACvC,CAAC;YACF,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC9E,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,MAAM,EAAE,UAAU;YAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,MAAM,CACrC,qBAAqB,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,EAChE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAChC,CAAC;YACF,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE;YACtC,MAAM,IAAI,GAAG,YAAY,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBAClF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,KAAK;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE;gBAClF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/system/internal-api/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAwB,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,gCAAgC,EAChC,kCAAkC,EAClC,mCAAmC,EACnC,mCAAmC,EACnC,oCAAoC,EACpC,oCAAoC,EACpC,+BAA+B,EAC/B,+BAA+B,EAC/B,oCAAoC,EACpC,6BAA6B,EAC7B,8BAA8B,EAC9B,+BAA+B,EAC/B,gCAAgC,EAChC,kCAAkC,EAClC,mCAAmC,EACnC,oCAAoC,EAKpC,qBAAqB,EACrB,sBAAsB,EAOtB,MAAM,cAAc,CAAC;AA8CtB,qGAAqG;AACrG,SAAS,YAAY,CAAsB,MAAS,EAAE,KAAiB;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,yCAAyC,EAAE,eAAe,EAAE;YACrF,MAAM,EAAE,+BAA+B;YACvC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,yHAAyH;AACzH,SAAS,aAAa,CAAsB,MAAS,EAAE,QAAiB;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,iFAAiF,EAAE,UAAU,EAAE;YACxH,MAAM,EAAE,gCAAgC;YACxC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK;SACnB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,iEAAiE;AACjE,SAAS,OAAO,CAAI,MAAqB;IACxC,OAAO,MAAM,YAAY,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAgC;IACxE,MAAM,MAAM,GAAG,GAAG,EAAE;QACnB,MAAM,SAAS,GAAoB;YAClC,EAAE,EAAE,eAAe;YACnB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;SACvB,CAAC;QACF,OAAO,cAAc,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,+EAA+E;IAC/E,gFAAgF;IAChF,qEAAqE;IACrE,MAAM,WAAW,GAAG,KAAK,IAAqC,EAAE;QAC/D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC,CAAC;IAEF,OAAO;QACN,KAAK,CAAC,eAAe,CAAC,KAAK;YAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE;gBAClF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QACxE,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,IAAI,EAAE;gBACxF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC;QAClF,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM;YACnB,MAAM,IAAI,GAAG,YAAY,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,IAAI,EAAE;gBACpF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,gCAAgC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC1E,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,cAAc;YACtC,MAAM,IAAI,GAAG,YAAY,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,qBAAqB,EAAE,IAAI,EAAE;gBACvF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC;QAChF,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM;YAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,mCAAmC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,sBAAsB,EAAE,IAAI,EAAE;gBACxF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC,WAAW,CAAC;QAClF,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAM;YAC7B,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE;gBACpF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC;QAC1E,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS;YAClD,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC;YAC7G,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAClC,qBAAqB,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,EAC1D,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,KAAK,EAAE,CACvC,CAAC;YACF,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC9E,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,MAAM,EAAE,UAAU;YAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,MAAM,CACrC,qBAAqB,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,EAChE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAChC,CAAC;YACF,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE;YACtC,MAAM,IAAI,GAAG,YAAY,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBAClF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,KAAK;YAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YAClE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAC,CAAC;YACpH,OAAO,aAAa,CAAC,gCAAgC,EAAE,QAAQ,CAAC,CAAC;QAClE,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,SAAS;YACpC,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,EAAE,CAAC,CAAC;YACnI,OAAO,aAAa,CAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC;QAC5E,CAAC;QAED,KAAK,CAAC,sBAAsB,CAAC,KAAK;YACjC,MAAM,IAAI,GAAG,YAAY,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,uBAAuB,EAAE,IAAI,EAAE;gBACzF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,oCAAoC,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,KAAK;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,IAAI,EAAE;gBAClF,OAAO,EAAE,MAAM,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,aAAa,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/system/internal-api/endpoints.d.ts

@@ -11,5 +11,12 @@ export declare const authInternalEndpoints: {
     readonly userSlug: (userId: string) => string;
     readonly userPromoteStaff: "/api/internal/users/promote-staff";
     readonly registeredAppsResolve: "/api/internal/registered-apps/resolve";
+    readonly delegatedTokens: "/api/internal/delegated-tokens";
+    readonly delegatedTokensRevoke: "/api/internal/delegated-tokens/revoke";
+    /**
+     * Public validate route: the presented token is the authentication and the
+     * answer is bound to its audience, so no internal bearer is required.
+     */
+    readonly delegatedTokensValidate: "/api/oauth/delegated-tokens/validate";
 };
 //# sourceMappingURL=endpoints.d.ts.map

package/dist/system/internal-api/endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/endpoints.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAEvD,eAAO,MAAM,qBAAqB;;;;;;yCAML,MAAM;wCAEP,MAAM,cAAc,MAAM;8CAEpB,MAAM,cAAc,MAAM;gCAExC,MAAM;;;CAIhB,CAAC"}
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/endpoints.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAEvD,eAAO,MAAM,qBAAqB;;;;;;yCAML,MAAM;wCAEP,MAAM,cAAc,MAAM;8CAEpB,MAAM,cAAc,MAAM;gCAExC,MAAM;;;;;IAMzB;;;OAGG;;CAEM,CAAC"}

package/dist/system/internal-api/endpoints.js

@@ -10,6 +10,13 @@ export const authInternalEndpoints = {
     userOAuthAccountUnlink: (userId, providerId) => `${AUTH_INTERNAL_BASE_PATH}/users/${encodeURIComponent(userId)}/oauth-accounts/${encodeURIComponent(providerId)}`,
     userSlug: (userId) => `${AUTH_INTERNAL_BASE_PATH}/users/${encodeURIComponent(userId)}/slug`,
     userPromoteStaff: `${AUTH_INTERNAL_BASE_PATH}/users/promote-staff`,
-    registeredAppsResolve: `${AUTH_INTERNAL_BASE_PATH}/registered-apps/resolve`
+    registeredAppsResolve: `${AUTH_INTERNAL_BASE_PATH}/registered-apps/resolve`,
+    delegatedTokens: `${AUTH_INTERNAL_BASE_PATH}/delegated-tokens`,
+    delegatedTokensRevoke: `${AUTH_INTERNAL_BASE_PATH}/delegated-tokens/revoke`,
+    /**
+     * Public validate route: the presented token is the authentication and the
+     * answer is bound to its audience, so no internal bearer is required.
+     */
+    delegatedTokensValidate: '/api/oauth/delegated-tokens/validate'
 };
 //# sourceMappingURL=endpoints.js.map

package/dist/system/internal-api/endpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../../src/system/internal-api/endpoints.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEvD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,gBAAgB,EAAE,GAAG,uBAAuB,oBAAoB;IAChE,sBAAsB,EAAE,GAAG,uBAAuB,2BAA2B;IAC7E,kBAAkB,EAAE,GAAG,uBAAuB,uBAAuB;IACrE,qBAAqB,EAAE,GAAG,uBAAuB,2BAA2B;IAC5E,sBAAsB,EAAE,GAAG,uBAAuB,4BAA4B;IAC9E,iBAAiB,EAAE,CAAC,MAAc,EAAE,EAAE,CACrC,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,iBAAiB;IAChF,gBAAgB,EAAE,CAAC,MAAc,EAAE,UAAkB,EAAE,EAAE,CACxD,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,kBAAkB,CAAC,UAAU,CAAC,EAAE;IAClH,sBAAsB,EAAE,CAAC,MAAc,EAAE,UAAkB,EAAE,EAAE,CAC9D,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,kBAAkB,CAAC,UAAU,CAAC,EAAE;IAClH,QAAQ,EAAE,CAAC,MAAc,EAAE,EAAE,CAC5B,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,OAAO;IACtE,gBAAgB,EAAE,GAAG,uBAAuB,sBAAsB;IAClE,qBAAqB,EAAE,GAAG,uBAAuB,0BAA0B;CAClE,CAAC"}
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../../src/system/internal-api/endpoints.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEvD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,gBAAgB,EAAE,GAAG,uBAAuB,oBAAoB;IAChE,sBAAsB,EAAE,GAAG,uBAAuB,2BAA2B;IAC7E,kBAAkB,EAAE,GAAG,uBAAuB,uBAAuB;IACrE,qBAAqB,EAAE,GAAG,uBAAuB,2BAA2B;IAC5E,sBAAsB,EAAE,GAAG,uBAAuB,4BAA4B;IAC9E,iBAAiB,EAAE,CAAC,MAAc,EAAE,EAAE,CACrC,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,iBAAiB;IAChF,gBAAgB,EAAE,CAAC,MAAc,EAAE,UAAkB,EAAE,EAAE,CACxD,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,kBAAkB,CAAC,UAAU,CAAC,EAAE;IAClH,sBAAsB,EAAE,CAAC,MAAc,EAAE,UAAkB,EAAE,EAAE,CAC9D,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,kBAAkB,CAAC,UAAU,CAAC,EAAE;IAClH,QAAQ,EAAE,CAAC,MAAc,EAAE,EAAE,CAC5B,GAAG,uBAAuB,UAAU,kBAAkB,CAAC,MAAM,CAAC,OAAO;IACtE,gBAAgB,EAAE,GAAG,uBAAuB,sBAAsB;IAClE,qBAAqB,EAAE,GAAG,uBAAuB,0BAA0B;IAC3E,eAAe,EAAE,GAAG,uBAAuB,mBAAmB;IAC9D,qBAAqB,EAAE,GAAG,uBAAuB,0BAA0B;IAC3E;;;OAGG;IACH,uBAAuB,EAAE,sCAAsC;CACtD,CAAC"}

package/dist/system/internal-api/index.d.ts

@@ -1,5 +1,5 @@
 export { createAuthInternalClient, type AuthInternalClient, type AuthInternalClientConfig } from './client.ts';
 export { authInternalEndpoints, AUTH_INTERNAL_BASE_PATH } from './endpoints.ts';
-export { permissionsCheckRequestSchema, permissionsCheckResponseSchema, permissionsIsSuperuserRequestSchema, permissionsIsSuperuserResponseSchema, permissionsIsStaffRequestSchema, permissionsIsStaffResponseSchema, userPromoteStaffRequestSchema, userPromoteStaffResponseSchema, permissionsIsOrgAdminRequestSchema, permissionsIsOrgAdminResponseSchema, permissionsIsTeamAdminRequestSchema, permissionsIsTeamAdminResponseSchema, userOAuthAccountSchema, userOAuthAccountsResponseSchema, userOAuthAccountDetailSchema, userOAuthAccountSelectionSchema, userOAuthAccountDetailResponseSchema, userOAuthAccountUnlinkResponseSchema, userSlugRequestSchema, userSlugResponseSchema, testPersonaSlugSchema, testMintSessionRequestSchema, testMintSessionCookieSchema, testMintSessionResponseSchema } from './schemas.ts';
+export { permissionsCheckRequestSchema, permissionsCheckResponseSchema, permissionsIsSuperuserRequestSchema, permissionsIsSuperuserResponseSchema, permissionsIsStaffRequestSchema, permissionsIsStaffResponseSchema, userPromoteStaffRequestSchema, userPromoteStaffResponseSchema, permissionsIsOrgAdminRequestSchema, permissionsIsOrgAdminResponseSchema, permissionsIsTeamAdminRequestSchema, permissionsIsTeamAdminResponseSchema, userOAuthAccountSchema, userOAuthAccountsResponseSchema, userOAuthAccountDetailSchema, userOAuthAccountSelectionSchema, userOAuthAccountDetailResponseSchema, userOAuthAccountUnlinkResponseSchema, userSlugRequestSchema, userSlugResponseSchema, testPersonaSlugSchema, testMintSessionRequestSchema, testMintSessionCookieSchema, testMintSessionResponseSchema, delegatedTokenMintRequestSchema, delegatedTokenMintResponseSchema, type DelegatedTokenMintRequest, type DelegatedTokenMintResponse } from './schemas.ts';
 export type { PermissionsCheckRequest, PermissionsCheckResponse, PermissionsIsSuperuserRequest, PermissionsIsSuperuserResponse, PermissionsIsStaffRequest, PermissionsIsStaffResponse, UserPromoteStaffRequest, UserPromoteStaffResponse, PermissionsIsOrgAdminRequest, PermissionsIsOrgAdminResponse, PermissionsIsTeamAdminRequest, PermissionsIsTeamAdminResponse, UserOAuthAccount, UserOAuthAccountsResponse, UserOAuthAccountDetail, UserOAuthAccountDetailResponse, UserOAuthAccountUnlinkResponse, UserSlugRequest, UserSlugResponse, TestPersonaSlug, TestMintSessionRequest, TestMintSessionCookie, TestMintSessionResponse } from './schemas.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/system/internal-api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,gCAAgC,EAChC,6BAA6B,EAC7B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,mCAAmC,EACnC,oCAAoC,EACpC,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,oCAAoC,EACpC,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,MAAM,cAAc,CAAC;AACtB,YAAY,EACX,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,gCAAgC,EAChC,6BAA6B,EAC7B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,mCAAmC,EACnC,oCAAoC,EACpC,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,oCAAoC,EACpC,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,+BAA+B,EAC/B,gCAAgC,EAChC,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,MAAM,cAAc,CAAC;AACtB,YAAY,EACX,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,8BAA8B,EAC9B,yBAAyB,EACzB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,yBAAyB,EACzB,sBAAsB,EACtB,8BAA8B,EAC9B,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,MAAM,cAAc,CAAC"}

package/dist/system/internal-api/index.js

@@ -1,4 +1,4 @@
 export { createAuthInternalClient } from "./client.js";
 export { authInternalEndpoints, AUTH_INTERNAL_BASE_PATH } from "./endpoints.js";
-export { permissionsCheckRequestSchema, permissionsCheckResponseSchema, permissionsIsSuperuserRequestSchema, permissionsIsSuperuserResponseSchema, permissionsIsStaffRequestSchema, permissionsIsStaffResponseSchema, userPromoteStaffRequestSchema, userPromoteStaffResponseSchema, permissionsIsOrgAdminRequestSchema, permissionsIsOrgAdminResponseSchema, permissionsIsTeamAdminRequestSchema, permissionsIsTeamAdminResponseSchema, userOAuthAccountSchema, userOAuthAccountsResponseSchema, userOAuthAccountDetailSchema, userOAuthAccountSelectionSchema, userOAuthAccountDetailResponseSchema, userOAuthAccountUnlinkResponseSchema, userSlugRequestSchema, userSlugResponseSchema, testPersonaSlugSchema, testMintSessionRequestSchema, testMintSessionCookieSchema, testMintSessionResponseSchema } from "./schemas.js";
+export { permissionsCheckRequestSchema, permissionsCheckResponseSchema, permissionsIsSuperuserRequestSchema, permissionsIsSuperuserResponseSchema, permissionsIsStaffRequestSchema, permissionsIsStaffResponseSchema, userPromoteStaffRequestSchema, userPromoteStaffResponseSchema, permissionsIsOrgAdminRequestSchema, permissionsIsOrgAdminResponseSchema, permissionsIsTeamAdminRequestSchema, permissionsIsTeamAdminResponseSchema, userOAuthAccountSchema, userOAuthAccountsResponseSchema, userOAuthAccountDetailSchema, userOAuthAccountSelectionSchema, userOAuthAccountDetailResponseSchema, userOAuthAccountUnlinkResponseSchema, userSlugRequestSchema, userSlugResponseSchema, testPersonaSlugSchema, testMintSessionRequestSchema, testMintSessionCookieSchema, testMintSessionResponseSchema, delegatedTokenMintRequestSchema, delegatedTokenMintResponseSchema } from "./schemas.js";
 //# sourceMappingURL=index.js.map

package/dist/system/internal-api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/system/internal-api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,wBAAwB,EAGxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,gCAAgC,EAChC,6BAA6B,EAC7B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,mCAAmC,EACnC,oCAAoC,EACpC,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,oCAAoC,EACpC,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/system/internal-api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,wBAAwB,EAGxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,+BAA+B,EAC/B,gCAAgC,EAChC,6BAA6B,EAC7B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,mCAAmC,EACnC,oCAAoC,EACpC,sBAAsB,EACtB,+BAA+B,EAC/B,4BAA4B,EAC5B,+BAA+B,EAC/B,oCAAoC,EACpC,oCAAoC,EACpC,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,+BAA+B,EAC/B,gCAAgC,EAGhC,MAAM,cAAc,CAAC"}

package/dist/system/internal-api/schemas.d.ts

@@ -185,4 +185,61 @@ export type TestPersonaSlug = z.infer<typeof testPersonaSlugSchema>;
 export type TestMintSessionRequest = z.infer<typeof testMintSessionRequestSchema>;
 export type TestMintSessionCookie = z.infer<typeof testMintSessionCookieSchema>;
 export type TestMintSessionResponse = z.infer<typeof testMintSessionResponseSchema>;
+/**
+ * The closed delegated-token scope vocabulary. auth-web mints these; every
+ * service that validates a delegated token reads them from the wire.
+ * `session:invoke` lets a session runtime reach its own relay endpoint and
+ * nothing provider-scoped; it is the session passport's only scope.
+ */
+export declare const DELEGATED_TOKEN_SCOPES: readonly ["config:read", "secrets:resolve", "ai:connections", "session:invoke"];
+export type DelegatedTokenScope = (typeof DELEGATED_TOKEN_SCOPES)[number];
+/** A delegated token for a code session's user: scopes from auth's closed vocabulary, capped lifetime (lane C). */
+export declare const delegatedTokenMintRequestSchema: z.ZodObject<{
+    userId: z.ZodString;
+    sessionId: z.ZodString;
+    resources: z.ZodArray<z.ZodURL>;
+    scopes: z.ZodArray<z.ZodEnum<{
+        "config:read": "config:read";
+        "secrets:resolve": "secrets:resolve";
+        "ai:connections": "ai:connections";
+        "session:invoke": "session:invoke";
+    }>>;
+    secretKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    ttlSeconds: z.ZodNumber;
+}, z.core.$strict>;
+export declare const delegatedTokenMintResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    jti: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export declare const delegatedTokenRevokeResponseSchema: z.ZodObject<{
+    revoked: z.ZodNumber;
+}, z.core.$strip>;
+export type DelegatedTokenMintRequest = z.infer<typeof delegatedTokenMintRequestSchema>;
+export type DelegatedTokenMintResponse = z.infer<typeof delegatedTokenMintResponseSchema>;
+/**
+ * Ask auth whether a delegated token was minted for this resource. The route is
+ * public by design: presenting the token is the authentication, and auth binds
+ * the answer to `resource` (a token never validates for another audience).
+ */
+export declare const delegatedTokenValidateRequestSchema: z.ZodObject<{
+    token: z.ZodString;
+    resource: z.ZodURL;
+}, z.core.$strict>;
+export declare const delegatedTokenValidateResponseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    valid: z.ZodLiteral<false>;
+}, z.core.$strip>, z.ZodObject<{
+    valid: z.ZodLiteral<true>;
+    userId: z.ZodString;
+    sessionId: z.ZodString;
+    scopes: z.ZodArray<z.ZodEnum<{
+        "config:read": "config:read";
+        "secrets:resolve": "secrets:resolve";
+        "ai:connections": "ai:connections";
+        "session:invoke": "session:invoke";
+    }>>;
+    secretKeys: z.ZodArray<z.ZodString>;
+}, z.core.$strip>], "valid">;
+export type DelegatedTokenValidateRequest = z.infer<typeof delegatedTokenValidateRequestSchema>;
+export type DelegatedTokenValidateResponse = z.infer<typeof delegatedTokenValidateResponseSchema>;
 //# sourceMappingURL=schemas.d.ts.map

package/dist/system/internal-api/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,eAAO,MAAM,6BAA6B;;;;;;iBAMxC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AAEH,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAEH,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AAEH,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;iBAYzC,CAAC;AAEH,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAEH,eAAO,MAAM,mCAAmC;;;iBAG9C,CAAC;AAEH,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAE1C,CAAC;AAEH,eAAO,MAAM,+BAA+B;;kBAE1C,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;iBASvC,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAE/C,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;iBAG/C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;EAUhC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;oBAGvC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;iBAStC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;iBAMxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,oCAAoC,CAC3C,CAAC;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/system/internal-api/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,eAAO,MAAM,6BAA6B;;;;;;iBAMxC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AAEH,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAEH,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AAEH,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;iBAE3C,CAAC;AAEH,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AAEH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;iBAYzC,CAAC;AAEH,eAAO,MAAM,kCAAkC;;;iBAG7C,CAAC;AAEH,eAAO,MAAM,mCAAmC;;iBAE9C,CAAC;AAEH,eAAO,MAAM,mCAAmC;;;iBAG9C,CAAC;AAEH,eAAO,MAAM,oCAAoC;;iBAE/C,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAC;AAEH,eAAO,MAAM,+BAA+B;;;;;;;;iBAE1C,CAAC;AAEH,eAAO,MAAM,+BAA+B;;kBAE1C,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;iBASvC,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;;;;;;;;iBAE/C,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;iBAG/C,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAEhC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;EAUhC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;oBAGvC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;iBAStC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;iBAMxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAClG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CACnD,OAAO,oCAAoC,CAC3C,CAAC;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,iFAKzB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,mHAAmH;AACnH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;kBAOjC,CAAC;AACZ,eAAO,MAAM,gCAAgC;;;;iBAAwF,CAAC;AACtI,eAAO,MAAM,kCAAkC;;iBAAwD,CAAC;AACxG,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F;;;;GAIG;AACH,eAAO,MAAM,mCAAmC;;;kBAGrC,CAAC;AACZ,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;4BAS/C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}

package/dist/system/internal-api/schemas.js

@@ -120,4 +120,46 @@ export const testMintSessionResponseSchema = z.object({
         email: z.string()
     })
 });
+/**
+ * The closed delegated-token scope vocabulary. auth-web mints these; every
+ * service that validates a delegated token reads them from the wire.
+ * `session:invoke` lets a session runtime reach its own relay endpoint and
+ * nothing provider-scoped; it is the session passport's only scope.
+ */
+export const DELEGATED_TOKEN_SCOPES = [
+    'config:read',
+    'secrets:resolve',
+    'ai:connections',
+    'session:invoke'
+];
+/** A delegated token for a code session's user: scopes from auth's closed vocabulary, capped lifetime (lane C). */
+export const delegatedTokenMintRequestSchema = z.object({
+    userId: z.string().min(1),
+    sessionId: z.string().min(1),
+    resources: z.array(z.url()).min(1),
+    scopes: z.array(z.enum(DELEGATED_TOKEN_SCOPES)).min(1),
+    secretKeys: z.array(z.string().min(1)).optional(),
+    ttlSeconds: z.number().int().positive()
+}).strict();
+export const delegatedTokenMintResponseSchema = z.object({ token: z.string().min(1), jti: z.string().min(1), expiresAt: z.string() });
+export const delegatedTokenRevokeResponseSchema = z.object({ revoked: z.number().int().nonnegative() });
+/**
+ * Ask auth whether a delegated token was minted for this resource. The route is
+ * public by design: presenting the token is the authentication, and auth binds
+ * the answer to `resource` (a token never validates for another audience).
+ */
+export const delegatedTokenValidateRequestSchema = z.object({
+    token: z.string().min(1),
+    resource: z.url()
+}).strict();
+export const delegatedTokenValidateResponseSchema = z.discriminatedUnion('valid', [
+    z.object({ valid: z.literal(false) }),
+    z.object({
+        valid: z.literal(true),
+        userId: z.string().min(1),
+        sessionId: z.string().min(1),
+        scopes: z.array(z.enum(DELEGATED_TOKEN_SCOPES)),
+        secretKeys: z.array(z.string())
+    })
+]);
 //# sourceMappingURL=schemas.js.map

package/dist/system/internal-api/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/system/internal-api/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEvC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,EAAE,YAAY;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,YAAY;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC;SACL,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC3B,CAAC;SACD,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,EAAE,YAAY;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,mFAAmF;IACnF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM;IACN,MAAM;IACN,KAAK;IACL,OAAO;IACP,OAAO;IACP,WAAW;IACX,WAAW;IACX,YAAY;IACZ,YAAY;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrD,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CAChD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,2BAA2B;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/system/internal-api/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEvC,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,YAAY;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,EAAE,YAAY;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,YAAY;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC;SACL,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC3B,CAAC;SACD,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,EAAE,YAAY;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,mFAAmF;IACnF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,MAAM;IACN,MAAM;IACN,KAAK;IACL,OAAO;IACP,OAAO;IACP,WAAW;IACX,WAAW;IACX,YAAY;IACZ,YAAY;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACrD,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CAChD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,MAAM,EAAE,2BAA2B;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;CACF,CAAC,CAAC;AA4BH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACrC,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;CACP,CAAC;AAGX,mHAAmH;AACnH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtI,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAIxG;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;CACjB,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE;IACjF,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACrC,CAAC,CAAC,MAAM,CAAC;QACR,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAC/C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC/B,CAAC;CACF,CAAC,CAAC"}

package/package.json

@@ -1,21 +1,21 @@
 {
   "name": "@vibesdotdev/auth",
-  "version": "1.0.0-rc.5",
+  "version": "1.0.0-rc.9",
   "dependencies": {
-    "@vibesdotdev/shared": "^1.0.0-rc.4",
-    "@vibesdotdev/account": "^1.0.0-rc.4",
-    "@vibesdotdev/ai-schemas": "^1.0.0-rc.3",
-    "@vibesdotdev/client": "^1.0.0-rc.3",
-    "@vibesdotdev/config": "^1.0.0-rc.5",
-    "@vibesdotdev/docs-contracts": "^1.0.0-rc.4",
-    "@vibesdotdev/email": "^1.0.0-rc.4",
-    "@vibesdotdev/filesystem": "^1.0.0-rc.3",
-    "@vibesdotdev/infra-core": "^1.0.0-rc.5",
-    "@vibesdotdev/logging": "^1.0.0-rc.5",
-    "@vibesdotdev/notifications": "^1.0.0-rc.3",
-    "@vibesdotdev/paths": "^1.0.0-rc.3",
-    "@vibesdotdev/kernel": "^1.0.0-rc.8",
-    "@vibesdotdev/storage": "^1.0.0-rc.5",
+    "@vibesdotdev/shared": "^1.0.0-rc.7",
+    "@vibesdotdev/account": "^1.0.0-rc.9",
+    "@vibesdotdev/ai-schemas": "^1.0.0-rc.6",
+    "@vibesdotdev/client": "^1.0.0-rc.5",
+    "@vibesdotdev/config": "^1.0.0-rc.10",
+    "@vibesdotdev/docs-contracts": "^1.0.0-rc.5",
+    "@vibesdotdev/email": "^1.0.0-rc.6",
+    "@vibesdotdev/filesystem": "^1.0.0-rc.6",
+    "@vibesdotdev/infra-core": "^1.0.0-rc.11",
+    "@vibesdotdev/logging": "^1.0.0-rc.9",
+    "@vibesdotdev/notifications": "^1.0.0-rc.5",
+    "@vibesdotdev/paths": "^1.0.0-rc.5",
+    "@vibesdotdev/kernel": "^1.0.0-rc.13",
+    "@vibesdotdev/storage": "^1.0.0-rc.9",
     "jose": "^6.2.12",
     "qrcode": "^1.5.4",
     "zod": "^4.6.7"
@@ -28,7 +28,7 @@
     "@sveltejs/vite-plugin-svelte": "^7.3.1",
     "@types/bun": "^1.4.3",
     "@types/react": "^19.3.0",
-    "@vibesdotdev/cli": "^1.0.0-rc.0",
+    "@vibesdotdev/cli": "^1.0.0-rc.9",
     "@vibesdotdev/kit": "^1.0.0-rc.0",
     "@vibesdotdev/tui": "^1.0.0-rc.0",
     "@vitest/browser-playwright": "^4.1.12",
@@ -41,6 +41,12 @@
     "vitest": "^4.1.12",
     "vitest-browser-svelte": "^2.2.1"
   },
+  "gitHead": "38ba95b62938d7946a4a9cc877103d746b92e74a",
+  "_vibes_source": {
+    "repo": "ssh://git@git.vibes.dev/vibesdotdev/framework.git",
+    "sha": "38ba95b62938d7946a4a9cc877103d746b92e74a",
+    "workspaceDigest": "sha256:91a6908a8a17017b221754104831aca52c38fd6425bee8334ee2673e58ae179d"
+  },
   "main": "./dist/index.js",
   "exports": {
     "./server/consumer-session-user": {
@@ -229,6 +235,12 @@
       "import": "./dist/features/authorization/organization-policy.js",
       "default": "./dist/features/authorization/organization-policy.js"
     },
+    "./authorization/superorg": {
+      "bun": "./dist/features/authorization/superorg.js",
+      "types": "./dist/features/authorization/superorg.d.ts",
+      "import": "./dist/features/authorization/superorg.js",
+      "default": "./dist/features/authorization/superorg.js"
+    },
     "./features/core/shared/auth-errors": {
       "bun": "./dist/features/core/shared/auth-errors.js",
       "types": "./dist/features/core/shared/auth-errors.d.ts",
@@ -433,6 +445,12 @@
       "import": "./dist/events/session-established.event.descriptor.js",
       "default": "./dist/events/session-established.event.descriptor.js"
     },
+    "./events/session-ending": {
+      "bun": "./dist/events/session-ending.event.descriptor.js",
+      "types": "./dist/events/session-ending.event.descriptor.d.ts",
+      "import": "./dist/events/session-ending.event.descriptor.js",
+      "default": "./dist/events/session-ending.event.descriptor.js"
+    },
     "./jwt": {
       "bun": "./dist/jwt/index.js",
       "types": "./dist/jwt/index.d.ts",
@@ -750,6 +768,12 @@
       "import": "./dist/svelte/types.js",
       "default": "./dist/svelte/types.js"
     },
+    "./policy": {
+      "bun": "./dist/policy/auth-policy.js",
+      "types": "./dist/policy/auth-policy.d.ts",
+      "import": "./dist/policy/auth-policy.js",
+      "default": "./dist/policy/auth-policy.js"
+    },
     "./system": {
       "bun": "./dist/system/index.js",
       "types": "./dist/system/index.d.ts",
@@ -816,7 +840,34 @@
     "README.md",
     "LICENSE",
     "!dist/**/__screenshots__/**",
-    "!dist/**/fixtures/**"
+    "!dist/**/fixtures/**",
+    "!**/.turbo/**",
+    "!**/.svelte-kit/**",
+    "!**/.vibes/**",
+    "!**/__tests__/**",
+    "!**/__stubs__/**",
+    "!**/*.test.js",
+    "!**/*.test.mjs",
+    "!**/*.test.cjs",
+    "!**/*.test.jsx",
+    "!**/*.test.ts",
+    "!**/*.test.mts",
+    "!**/*.test.cts",
+    "!**/*.test.tsx",
+    "!**/*.spec.js",
+    "!**/*.spec.mjs",
+    "!**/*.spec.cjs",
+    "!**/*.spec.jsx",
+    "!**/*.spec.ts",
+    "!**/*.spec.mts",
+    "!**/*.spec.cts",
+    "!**/*.spec.tsx",
+    "!**/SPEC.md",
+    "!**/tsconfig.json",
+    "!**/tsconfig.*.json",
+    "!**/*.tsbuildinfo",
+    "!**/.build-ok.json",
+    "!**/*.tgz"
   ],
   "scripts": {
     "lint": "node ../node_modules/@vibesdotdev/internal-oxlint-toolchain/ratchet.mjs .",
@@ -908,11 +959,5 @@
       "optional": true
     }
   },
-  "license": "MIT",
-  "gitHead": "f1ff526c235b10c970497738beb16b0651c428c8",
-  "_vibes_source": {
-    "repo": "ssh://git@git.vibes.dev/vibesdotdev/framework.git",
-    "sha": "f1ff526c235b10c970497738beb16b0651c428c8",
-    "workspaceDigest": "sha256:dbbd0450a00e46d8da3c438e7299d3565aec65ebf985b6b402972efc67589718"
-  }
+  "license": "MIT"
 }