@vibesdotdev/hq 0.0.0-stage → 1.0.0-rc.1

package/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 VIBES DEV LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,50 @@
-# Temporary Holding Version
+# @vibesdotdev/hq
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Public agent operations framework: app pairing, friction signals, service
+catalogs and approval presentation. Isolated agent workspaces belong to
+`@vibesdotdev/workspace` (`./isolation/plugin`).
+See [SPEC.md](./SPEC.md) for ownership and refusal contracts.
+
+Compose `@vibesdotdev/hq/plugin` for universal descriptors and jobs.
+Native hosts additionally compose `@vibesdotdev/hq/consumer.plugin` for the
+`hq` and `friction` clients, approval UI, and Applets-owned consumer tool plugin.
+`@vibesdotdev/hq/cloud.plugin` supplies cloud descriptors and the cloud
+friction client and Applets-owned cloud tool plugin. Compose Applets' public plugin for its descriptors.
+The universal and cloud variants share the stable `hq` plugin id; choose one.
+
+CLI hosts compose `@vibesdotdev/hq/cli/plugin` alongside HQ, CLI, and
+`@vibesdotdev/config/setup/plugin`. The CLI registers retained installer
+contributions with Setup's `setup/installer` kind. Installer discovery and
+execution use Setup; the compatibility entrypoints remain exported.
+
+Resolve clients on the handed runtime:
+
+```ts
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import type { HqClient } from '@vibesdotdev/hq/client';
+
+const hq = await getVibesClient<HqClient>('hq', runtime);
+const status = await hq.services.status('my-service');
+```
+
+`./client/friction`, `./friction/*`, `./services`, `./services/schemas`,
+`./services/builtin`, `./dashboard`, and `./installers` are explicit contracts.
+`./applets` remains a compatibility surface; new consumers use Applets.
+
+Host permission guidance (`hq/host-permission-guidance`) and host health
+checks (`hq/host-health-check`) are open kinds HQ owns, with schemas in
+`src/schemas/host-guidance.ts`. HQ registers the macOS defaults
+(accessibility, full-disk-access and microphone settings guidance plus the
+Homebrew probe); another host or a user plugin adds entries by registering
+descriptors of the same kinds. The `permissions` and `health` commands resolve
+them with `runtime.query` at call time, so non-matching hosts report
+`not-applicable` with unchanged output shape.
+
+Run `bun run check`, `bun run test`, and `bun run build` from this directory.
+Check includes every source TS/TSX test. Build uses `tsconfig.build.json` and
+excludes tests, fixture support, and Svelte sources. No compiler, install, or
+package subprocess runs inside the unit suite.
+
+HqClient delegates channels and surface operations to the OS semantic client
+resolved on the handed runtime. Surface calls require an explicit trusted owner;
+owner isolation and typed OS refusals are preserved.

package/dist/agent-events/descriptors.d.ts

@@ -0,0 +1,33 @@
+export declare const heartbeatEventSourceDescriptor: {
+    kind: "agent/event-source";
+    id: string;
+    name: string;
+    description: string;
+    sourceType: string;
+    status: string;
+    agentIds: never[];
+    config: {
+        channel: string;
+        intervalMs: number;
+    };
+    enabled: true;
+    hardware: string[];
+    tags: string[];
+};
+export declare const continuationEventSourceDescriptor: {
+    kind: "agent/event-source";
+    id: string;
+    name: string;
+    description: string;
+    sourceType: string;
+    status: string;
+    agentIds: never[];
+    config: {
+        channel: string;
+        cron: string;
+    };
+    enabled: true;
+    hardware: string[];
+    tags: string[];
+};
+//# sourceMappingURL=descriptors.d.ts.map

package/dist/agent-events/descriptors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptors.d.ts","sourceRoot":"","sources":["../../src/agent-events/descriptors.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;CAezC,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;CAe5C,CAAC"}

package/dist/agent-events/descriptors.js

@@ -0,0 +1,34 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel/factory';
+export const heartbeatEventSourceDescriptor = createRuntimeAsset({
+    kind: 'agent/event-source',
+    id: 'presence.heartbeat',
+    name: 'Heartbeat',
+    description: 'Presence heartbeat channel for keeping machine activity fresh.',
+    sourceType: 'channel',
+    status: 'active',
+    agentIds: [],
+    config: {
+        channel: 'heartbeat',
+        intervalMs: 1_800_000
+    },
+    enabled: true,
+    hardware: ['consumer', 'cloud'],
+    tags: ['vibesOS', 'presence', 'heartbeat']
+});
+export const continuationEventSourceDescriptor = createRuntimeAsset({
+    kind: 'agent/event-source',
+    id: 'presence.continue',
+    name: 'Continuation',
+    description: 'Continuation channel for scheduled follow-up work.',
+    sourceType: 'channel',
+    status: 'active',
+    agentIds: [],
+    config: {
+        channel: 'continue',
+        cron: '0 9 * * *'
+    },
+    enabled: true,
+    hardware: ['consumer', 'cloud'],
+    tags: ['vibesOS', 'presence', 'continuation']
+});
+//# sourceMappingURL=descriptors.js.map

package/dist/agent-events/descriptors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptors.js","sourceRoot":"","sources":["../../src/agent-events/descriptors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,MAAM,CAAC,MAAM,8BAA8B,GAAG,kBAAkB,CAAC;IAChE,IAAI,EAAE,oBAAoB;IAC1B,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,gEAAgE;IAC7E,UAAU,EAAE,SAAS;IACrB,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE;QACP,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,SAAS;KACrB;IACD,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC;CAC1C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,kBAAkB,CAAC;IACnE,IAAI,EAAE,oBAAoB;IAC1B,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,oDAAoD;IACjE,UAAU,EAAE,SAAS;IACrB,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,EAAE;IACZ,MAAM,EAAE;QACP,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,WAAW;KACjB;IACD,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC;CAC7C,CAAC,CAAC"}

package/dist/app/auth/cloud-sync.consumer.d.ts

@@ -0,0 +1,12 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+export interface OsAppSyncSummary {
+    bridgeId: string;
+    direction: 'push' | 'pull';
+    pushed: number;
+    pulled: number;
+    skipped: number;
+    conflicts: number;
+    errors: number;
+}
+export declare function syncOsAppAuth(runtime: VibesRuntime, direction: 'push' | 'pull'): Promise<OsAppSyncSummary | null>;
+//# sourceMappingURL=cloud-sync.consumer.d.ts.map

package/dist/app/auth/cloud-sync.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-sync.consumer.d.ts","sourceRoot":"","sources":["../../../src/app/auth/cloud-sync.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKxD,MAAM,WAAW,gBAAgB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CACf;AAWD,wBAAsB,aAAa,CAClC,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,MAAM,GAAG,MAAM,GACxB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAyBlC"}

package/dist/app/auth/cloud-sync.consumer.js

@@ -0,0 +1,31 @@
+import { SyncBridge } from '@vibesdotdev/storage/sync/sync-bridge';
+import { resolveSyncTarget } from '@vibesdotdev/storage/sync/resolve-sync-target';
+function resolveBridgeDescriptor(runtime) {
+    const descriptors = runtime
+        .query('storage/sync-bridge')
+        .withId('hq.app-auth')
+        .enabled()
+        .descriptors();
+    return descriptors[0] ?? null;
+}
+export async function syncOsAppAuth(runtime, direction) {
+    const descriptor = resolveBridgeDescriptor(runtime);
+    if (!descriptor)
+        return null;
+    const { syncTarget, apiToken } = await resolveSyncTarget(runtime);
+    if (!syncTarget || syncTarget === 'unknown') {
+        throw new Error('No sync target is configured for this runtime.');
+    }
+    const bridge = new SyncBridge(descriptor, { runtime });
+    const result = await bridge.execute(syncTarget, { direction, dryRun: false, force: false }, apiToken);
+    return {
+        bridgeId: result.bridgeId,
+        direction,
+        pushed: result.pushed,
+        pulled: result.pulled,
+        skipped: result.skipped,
+        conflicts: result.conflicts,
+        errors: result.errors
+    };
+}
+//# sourceMappingURL=cloud-sync.consumer.js.map

package/dist/app/auth/cloud-sync.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-sync.consumer.js","sourceRoot":"","sources":["../../../src/app/auth/cloud-sync.consumer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+CAA+C,CAAC;AAYlF,SAAS,uBAAuB,CAAC,OAAoC;IACpE,MAAM,WAAW,GAAG,OAAO;SACzB,KAAK,CAAuB,qBAAqB,CAAC;SAClD,MAAM,CAAC,aAAa,CAAC;SACrB,OAAO,EAAE;SACT,WAAW,EAAE,CAAC;IAChB,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAqB,EACrB,SAA0B;IAE1B,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAClC,UAAU,EACV,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAC1C,QAAQ,CACR,CAAC;IAEF,OAAO;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;KACrB,CAAC;AACH,CAAC"}

package/dist/app/auth/hq.app-auth-machine.record.descriptor.d.ts

@@ -0,0 +1,5 @@
+import type { StorageRecordDescriptorInput } from '@vibesdotdev/storage/schemas/record';
+export { OsLocalMachineProfileSchema } from './schemas/auth.ts';
+export declare const osAppAuthMachineRecordDescriptor: StorageRecordDescriptorInput;
+export default osAppAuthMachineRecordDescriptor;
+//# sourceMappingURL=hq.app-auth-machine.record.descriptor.d.ts.map

package/dist/app/auth/hq.app-auth-machine.record.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq.app-auth-machine.record.descriptor.d.ts","sourceRoot":"","sources":["../../../src/app/auth/hq.app-auth-machine.record.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAGxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAEhE,eAAO,MAAM,gCAAgC,EAAE,4BAwC9C,CAAC;AAEF,eAAe,gCAAgC,CAAC"}

package/dist/app/auth/hq.app-auth-machine.record.descriptor.js

@@ -0,0 +1,39 @@
+import { OsLocalMachineProfileSchema } from "./schemas/auth.js";
+export { OsLocalMachineProfileSchema } from "./schemas/auth.js";
+export const osAppAuthMachineRecordDescriptor = {
+    kind: 'storage/record',
+    id: 'os.app-auth-machine',
+    name: 'OS Local Machine Profile',
+    description: 'Single-row local machine profile for OS auth — auto-seeded on first read.',
+    schema: OsLocalMachineProfileSchema,
+    tableName: 'os_app_auth_machine',
+    primaryKey: 'id',
+    relations: {},
+    indexes: [],
+    version: 1,
+    timestamps: false,
+    autoId: false,
+    allowedAdapters: ['storage.localdb'],
+    defaultAdapter: 'storage.localdb',
+    adapterConfig: {
+        'storage.localdb': { dbName: 'os.db', scope: 'global' }
+    },
+    scope: 'global',
+    validateOnWrite: false,
+    validateOnRead: false,
+    versioning: false,
+    audit: false,
+    changeTracking: false,
+    internal: false,
+    softDelete: false,
+    namespace: 'os.app-auth-machine',
+    tags: ['os', 'app', 'auth', 'machine'],
+    sync: {
+        ownershipFilter: 'all',
+        conflictStrategy: 'newest',
+        sensitiveFields: [],
+        idField: 'id'
+    }
+};
+export default osAppAuthMachineRecordDescriptor;
+//# sourceMappingURL=hq.app-auth-machine.record.descriptor.js.map

package/dist/app/auth/hq.app-auth-machine.record.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq.app-auth-machine.record.descriptor.js","sourceRoot":"","sources":["../../../src/app/auth/hq.app-auth-machine.record.descriptor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAEhE,MAAM,CAAC,MAAM,gCAAgC,GAAiC;IAC7E,IAAI,EAAE,gBAAgB;IACtB,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,2EAA2E;IACxF,MAAM,EAAE,2BAA2B;IACnC,SAAS,EAAE,qBAAqB;IAChC,UAAU,EAAE,IAAI;IAEhB,SAAS,EAAE,EAAE;IAEb,OAAO,EAAE,EAAE;IAEX,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IAEb,eAAe,EAAE,CAAC,iBAAiB,CAAC;IACpC,cAAc,EAAE,iBAAiB;IACjC,aAAa,EAAE;QACd,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;KACvD;IACD,KAAK,EAAE,QAAQ;IAEf,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,KAAK;IACjB,KAAK,EAAE,KAAK;IACZ,cAAc,EAAE,KAAK;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,KAAK;IACjB,SAAS,EAAE,qBAAqB;IAChC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;IAEtC,IAAI,EAAE;QACL,eAAe,EAAE,KAAK;QACtB,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,EAAE;QACnB,OAAO,EAAE,IAAI;KACb;CACD,CAAC;AAEF,eAAe,gCAAgC,CAAC"}

package/dist/app/auth/hq.app-auth-pairings.record.descriptor.d.ts

@@ -0,0 +1,5 @@
+import type { StorageRecordDescriptorInput } from '@vibesdotdev/storage/schemas/record';
+export { OsAppPairingRecordSchema } from './schemas/auth.ts';
+export declare const osAppAuthPairingsRecordDescriptor: StorageRecordDescriptorInput;
+export default osAppAuthPairingsRecordDescriptor;
+//# sourceMappingURL=hq.app-auth-pairings.record.descriptor.d.ts.map

package/dist/app/auth/hq.app-auth-pairings.record.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq.app-auth-pairings.record.descriptor.d.ts","sourceRoot":"","sources":["../../../src/app/auth/hq.app-auth-pairings.record.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAGxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,eAAO,MAAM,iCAAiC,EAAE,4BA4C/C,CAAC;AAEF,eAAe,iCAAiC,CAAC"}

package/dist/app/auth/hq.app-auth-pairings.record.descriptor.js

@@ -0,0 +1,43 @@
+import { OsAppPairingRecordSchema } from "./schemas/auth.js";
+export { OsAppPairingRecordSchema } from "./schemas/auth.js";
+export const osAppAuthPairingsRecordDescriptor = {
+    kind: 'storage/record',
+    id: 'os.app-auth-pairings',
+    name: 'OS App Auth Pairings',
+    description: 'App pairing records linking tokens to machines.',
+    schema: OsAppPairingRecordSchema,
+    tableName: 'os_app_auth_pairings',
+    primaryKey: 'id',
+    relations: {},
+    indexes: [
+        { fields: ['appId'], unique: false },
+        { fields: ['tokenId'], unique: false },
+        { fields: ['machineId'], unique: false }
+    ],
+    version: 1,
+    timestamps: false,
+    autoId: false,
+    allowedAdapters: ['storage.localdb'],
+    defaultAdapter: 'storage.localdb',
+    adapterConfig: {
+        'storage.localdb': { dbName: 'os.db', scope: 'global' }
+    },
+    scope: 'global',
+    validateOnWrite: false,
+    validateOnRead: false,
+    versioning: false,
+    audit: false,
+    changeTracking: false,
+    internal: false,
+    softDelete: false,
+    namespace: 'os.app-auth-pairings',
+    tags: ['os', 'app', 'auth', 'pairing'],
+    sync: {
+        ownershipFilter: 'all',
+        conflictStrategy: 'newest',
+        sensitiveFields: [],
+        idField: 'id'
+    }
+};
+export default osAppAuthPairingsRecordDescriptor;
+//# sourceMappingURL=hq.app-auth-pairings.record.descriptor.js.map

package/dist/app/auth/hq.app-auth-pairings.record.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq.app-auth-pairings.record.descriptor.js","sourceRoot":"","sources":["../../../src/app/auth/hq.app-auth-pairings.record.descriptor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,MAAM,CAAC,MAAM,iCAAiC,GAAiC;IAC9E,IAAI,EAAE,gBAAgB;IACtB,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,iDAAiD;IAC9D,MAAM,EAAE,wBAAwB;IAChC,SAAS,EAAE,sBAAsB;IACjC,UAAU,EAAE,IAAI;IAEhB,SAAS,EAAE,EAAE;IAEb,OAAO,EAAE;QACR,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACpC,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACtC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;KACxC;IAED,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IAEb,eAAe,EAAE,CAAC,iBAAiB,CAAC;IACpC,cAAc,EAAE,iBAAiB;IACjC,aAAa,EAAE;QACd,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;KACvD;IACD,KAAK,EAAE,QAAQ;IAEf,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,KAAK;IACjB,KAAK,EAAE,KAAK;IACZ,cAAc,EAAE,KAAK;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,KAAK;IACjB,SAAS,EAAE,sBAAsB;IACjC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;IAEtC,IAAI,EAAE;QACL,eAAe,EAAE,KAAK;QACtB,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,EAAE;QACnB,OAAO,EAAE,IAAI;KACb;CACD,CAAC;AAEF,eAAe,iCAAiC,CAAC"}

package/dist/app/auth/hq.app-auth-tokens.record.descriptor.d.ts

@@ -0,0 +1,5 @@
+import type { StorageRecordDescriptorInput } from '@vibesdotdev/storage/schemas/record';
+export { OsAppTokenRecordSchema } from './schemas/auth.ts';
+export declare const osAppAuthTokensRecordDescriptor: StorageRecordDescriptorInput;
+export default osAppAuthTokensRecordDescriptor;
+//# sourceMappingURL=hq.app-auth-tokens.record.descriptor.d.ts.map

package/dist/app/auth/hq.app-auth-tokens.record.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq.app-auth-tokens.record.descriptor.d.ts","sourceRoot":"","sources":["../../../src/app/auth/hq.app-auth-tokens.record.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAExF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,eAAO,MAAM,+BAA+B,EAAE,4BA4C7C,CAAC;AAEF,eAAe,+BAA+B,CAAC"}

package/dist/app/auth/hq.app-auth-tokens.record.descriptor.js

@@ -0,0 +1,42 @@
+import { OsAppTokenRecordSchema } from "./schemas/auth.js";
+export { OsAppTokenRecordSchema } from "./schemas/auth.js";
+export const osAppAuthTokensRecordDescriptor = {
+    kind: 'storage/record',
+    id: 'os.app-auth-tokens',
+    name: 'OS App Auth Tokens',
+    description: 'App token records for OS auth. tokenHash is already sha256 of secret — treat row as confidential.',
+    schema: OsAppTokenRecordSchema,
+    tableName: 'os_app_auth_tokens',
+    primaryKey: 'id',
+    relations: {},
+    indexes: [
+        { fields: ['appId'], unique: false },
+        { fields: ['revokedAt'], unique: false }
+    ],
+    version: 1,
+    timestamps: false,
+    autoId: false,
+    allowedAdapters: ['storage.localdb'],
+    defaultAdapter: 'storage.localdb',
+    adapterConfig: {
+        'storage.localdb': { dbName: 'os.db', scope: 'global' }
+    },
+    scope: 'global',
+    validateOnWrite: true,
+    validateOnRead: false,
+    versioning: false,
+    audit: false,
+    changeTracking: false,
+    internal: false,
+    softDelete: false,
+    namespace: 'os.app-auth-tokens',
+    tags: ['os', 'app', 'auth', 'token'],
+    sync: {
+        ownershipFilter: 'all',
+        conflictStrategy: 'newest',
+        sensitiveFields: ['tokenHash', 'tokenPreview'],
+        idField: 'id'
+    }
+};
+export default osAppAuthTokensRecordDescriptor;
+//# sourceMappingURL=hq.app-auth-tokens.record.descriptor.js.map

package/dist/app/auth/hq.app-auth-tokens.record.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hq.app-auth-tokens.record.descriptor.js","sourceRoot":"","sources":["../../../src/app/auth/hq.app-auth-tokens.record.descriptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,MAAM,CAAC,MAAM,+BAA+B,GAAiC;IAC5E,IAAI,EAAE,gBAAgB;IACtB,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EACV,mGAAmG;IACpG,MAAM,EAAE,sBAAsB;IAC9B,SAAS,EAAE,oBAAoB;IAC/B,UAAU,EAAE,IAAI;IAEhB,SAAS,EAAE,EAAE;IAEb,OAAO,EAAE;QACR,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACpC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;KACxC;IAED,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IAEb,eAAe,EAAE,CAAC,iBAAiB,CAAC;IACpC,cAAc,EAAE,iBAAiB;IACjC,aAAa,EAAE;QACd,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE;KACvD;IACD,KAAK,EAAE,QAAQ;IAEf,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,KAAK;IACjB,KAAK,EAAE,KAAK;IACZ,cAAc,EAAE,KAAK;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,KAAK;IACjB,SAAS,EAAE,oBAAoB;IAC/B,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;IAEpC,IAAI,EAAE;QACL,eAAe,EAAE,KAAK;QACtB,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC;QAC9C,OAAO,EAAE,IAAI;KACb;CACD,CAAC;AAEF,eAAe,+BAA+B,CAAC"}

package/dist/app/auth/schemas/auth.d.ts

@@ -0,0 +1,146 @@
+import * as z from 'zod/v4';
+export declare const OsAppCapabilitySchema: z.ZodEnum<{
+    "runtime.query": "runtime.query";
+    "runtime.invoke": "runtime.invoke";
+    "daemon.control": "daemon.control";
+    "workers.dispatch": "workers.dispatch";
+    "session.read": "session.read";
+    "session.write": "session.write";
+    "session.handoff": "session.handoff";
+}>;
+export declare const OsAppTokenRecordSchema: z.ZodObject<{
+    id: z.ZodString;
+    appId: z.ZodString;
+    tokenHash: z.ZodString;
+    tokenPreview: z.ZodString;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "runtime.query": "runtime.query";
+        "runtime.invoke": "runtime.invoke";
+        "daemon.control": "daemon.control";
+        "workers.dispatch": "workers.dispatch";
+        "session.read": "session.read";
+        "session.write": "session.write";
+        "session.handoff": "session.handoff";
+    }>>;
+    description: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    lastUsedAt: z.ZodOptional<z.ZodString>;
+    revokedAt: z.ZodOptional<z.ZodString>;
+    syncEnabled: z.ZodBoolean;
+    source: z.ZodEnum<{
+        synced: "synced";
+        local: "local";
+    }>;
+}, z.core.$strip>;
+export type OsAppTokenRecordSchema = z.infer<typeof OsAppTokenRecordSchema>;
+export declare const OsAppPairingRecordSchema: z.ZodObject<{
+    id: z.ZodString;
+    appId: z.ZodString;
+    tokenId: z.ZodString;
+    machineId: z.ZodString;
+    machineName: z.ZodString;
+    hardware: z.ZodEnum<{
+        bridge: "bridge";
+        consumer: "consumer";
+        cloud: "cloud";
+        desktop: "desktop";
+        mobile: "mobile";
+    }>;
+    trustLevel: z.ZodEnum<{
+        "same-user": "same-user";
+        "paired-machine": "paired-machine";
+    }>;
+    metadata: z.ZodRecord<z.ZodString, z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    revokedAt: z.ZodOptional<z.ZodString>;
+    source: z.ZodEnum<{
+        synced: "synced";
+        local: "local";
+    }>;
+}, z.core.$strip>;
+export type OsAppPairingRecordSchema = z.infer<typeof OsAppPairingRecordSchema>;
+export declare const OsLocalMachineProfileSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    host: z.ZodString;
+}, z.core.$strip>;
+export type OsLocalMachineProfileSchema = z.infer<typeof OsLocalMachineProfileSchema>;
+export declare const OsAppSyncRecordSchema: z.ZodObject<{
+    id: z.ZodString;
+    recordType: z.ZodEnum<{
+        token: "token";
+        pairing: "pairing";
+    }>;
+    updatedAt: z.ZodString;
+    payload: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodNull]>>;
+}, z.core.$strip>;
+export declare const PairingMetadataSchema: z.ZodRecord<z.ZodString, z.ZodString>;
+export declare const CreateAppTokenInputSchema: z.ZodObject<{
+    appId: z.ZodString;
+    capabilities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        "runtime.query": "runtime.query";
+        "runtime.invoke": "runtime.invoke";
+        "daemon.control": "daemon.control";
+        "workers.dispatch": "workers.dispatch";
+        "session.read": "session.read";
+        "session.write": "session.write";
+        "session.handoff": "session.handoff";
+    }>>>;
+    description: z.ZodOptional<z.ZodString>;
+    expiresInDays: z.ZodOptional<z.ZodNumber>;
+    syncEnabled: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type CreateAppTokenInput = z.infer<typeof CreateAppTokenInputSchema>;
+export declare const CreateAppTokenResultSchema: z.ZodObject<{
+    record: z.ZodObject<{
+        id: z.ZodString;
+        appId: z.ZodString;
+        tokenHash: z.ZodString;
+        tokenPreview: z.ZodString;
+        capabilities: z.ZodArray<z.ZodEnum<{
+            "runtime.query": "runtime.query";
+            "runtime.invoke": "runtime.invoke";
+            "daemon.control": "daemon.control";
+            "workers.dispatch": "workers.dispatch";
+            "session.read": "session.read";
+            "session.write": "session.write";
+            "session.handoff": "session.handoff";
+        }>>;
+        description: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodString>;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+        lastUsedAt: z.ZodOptional<z.ZodString>;
+        revokedAt: z.ZodOptional<z.ZodString>;
+        syncEnabled: z.ZodBoolean;
+        source: z.ZodEnum<{
+            synced: "synced";
+            local: "local";
+        }>;
+    }, z.core.$strip>;
+    secret: z.ZodString;
+}, z.core.$strip>;
+export type CreateAppTokenResult = z.infer<typeof CreateAppTokenResultSchema>;
+export declare const CreatePairingInputSchema: z.ZodObject<{
+    hardware: z.ZodEnum<{
+        bridge: "bridge";
+        consumer: "consumer";
+        cloud: "cloud";
+        desktop: "desktop";
+        mobile: "mobile";
+    }>;
+    appId: z.ZodString;
+    machineId: z.ZodString;
+    tokenId: z.ZodString;
+    machineName: z.ZodString;
+    trustLevel: z.ZodEnum<{
+        "same-user": "same-user";
+        "paired-machine": "paired-machine";
+    }>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type CreatePairingInput = z.infer<typeof CreatePairingInputSchema>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/app/auth/schemas/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/app/auth/schemas/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,qBAAqB;;;;;;;;EAAwI,CAAC;AAE3K,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;iBAcjC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAG5E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;iBAanC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAGhF,eAAO,MAAM,2BAA2B;;;;iBAItC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAGtF,eAAO,MAAM,qBAAqB;;;;;;;;iBAKhC,CAAC;AACH,eAAO,MAAM,qBAAqB,uCAAmC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAmE,CAAC;AAC3G,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;iBAEoB,CAAC;AAC1D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/app/auth/schemas/auth.js

@@ -0,0 +1,53 @@
+import * as z from 'zod/v4';
+export const OsAppCapabilitySchema = z.enum(['runtime.query', 'runtime.invoke', 'daemon.control', 'workers.dispatch', 'session.read', 'session.write', 'session.handoff']);
+export const OsAppTokenRecordSchema = z.object({
+    id: z.string(),
+    appId: z.string(),
+    tokenHash: z.string(),
+    tokenPreview: z.string(),
+    capabilities: z.array(OsAppCapabilitySchema),
+    description: z.string().optional(),
+    expiresAt: z.string().optional(),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+    lastUsedAt: z.string().optional(),
+    revokedAt: z.string().optional(),
+    syncEnabled: z.boolean(),
+    source: z.enum(['local', 'synced'])
+});
+export const OsAppPairingRecordSchema = z.object({
+    id: z.string(),
+    appId: z.string(),
+    tokenId: z.string(),
+    machineId: z.string(),
+    machineName: z.string(),
+    hardware: z.enum(['consumer', 'bridge', 'desktop', 'mobile', 'cloud']),
+    trustLevel: z.enum(['same-user', 'paired-machine']),
+    metadata: z.record(z.string(), z.string()),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+    revokedAt: z.string().optional(),
+    source: z.enum(['local', 'synced'])
+});
+export const OsLocalMachineProfileSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    host: z.string()
+});
+export const OsAppSyncRecordSchema = z.object({
+    id: z.string(),
+    recordType: z.enum(['token', 'pairing']),
+    updatedAt: z.string(),
+    payload: z.record(z.string(), z.union([z.string(), z.boolean(), z.array(z.string()), z.null()]))
+});
+export const PairingMetadataSchema = z.record(z.string(), z.string());
+export const CreateAppTokenInputSchema = z.object({
+    appId: z.string(), capabilities: z.array(OsAppCapabilitySchema).optional(),
+    description: z.string().optional(), expiresInDays: z.number().optional(),
+    syncEnabled: z.boolean().optional()
+});
+export const CreateAppTokenResultSchema = z.object({ record: OsAppTokenRecordSchema, secret: z.string() });
+export const CreatePairingInputSchema = OsAppPairingRecordSchema.pick({
+    appId: true, tokenId: true, machineId: true, machineName: true, hardware: true, trustLevel: true
+}).extend({ metadata: PairingMetadataSchema.optional() });
+//# sourceMappingURL=auth.js.map

package/dist/app/auth/schemas/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/app/auth/schemas/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE3K,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;CACnC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;CACnC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;CAChG,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,wBAAwB,CAAC,IAAI,CAAC;IACrE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI;CAChG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC"}

package/dist/app/auth/service.consumer.d.ts

@@ -0,0 +1,17 @@
+import { type OsAppPairingRecord, type OsAppTokenRecord, type OsLocalMachineProfile, type CreatePairingInput } from './types.ts';
+import { type HqAuthRuntime } from './sync.consumer.ts';
+export type { CreatePairingInput, HqAuthRuntime };
+import { type CreateAppTokenInput, type CreateAppTokenResult } from './schemas/auth.ts';
+export type { CreateAppTokenInput, CreateAppTokenResult } from './schemas/auth.ts';
+export declare function createAppToken(runtime: HqAuthRuntime, input: CreateAppTokenInput): Promise<CreateAppTokenResult>;
+export declare function listAppTokens(runtime: HqAuthRuntime, includeRevoked?: boolean): Promise<OsAppTokenRecord[]>;
+export declare function revokeAppToken(runtime: HqAuthRuntime, tokenId: string): Promise<OsAppTokenRecord | null>;
+export declare function resolveTokenId(runtime: HqAuthRuntime, input: {
+    tokenId?: string;
+    tokenSecret?: string;
+}): Promise<string | null>;
+export declare function getTokenById(runtime: HqAuthRuntime, tokenId: string): Promise<OsAppTokenRecord | null>;
+export declare function getLocalMachineProfile(runtime: HqAuthRuntime): Promise<OsLocalMachineProfile>;
+export declare function createOrUpdatePairing(runtime: HqAuthRuntime, input: CreatePairingInput): Promise<OsAppPairingRecord>;
+export declare function listAppPairings(runtime: HqAuthRuntime, appId?: string): Promise<OsAppPairingRecord[]>;
+//# sourceMappingURL=service.consumer.d.ts.map

package/dist/app/auth/service.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.consumer.d.ts","sourceRoot":"","sources":["../../../src/app/auth/service.consumer.ts"],"names":[],"mappings":"AACA,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EAEvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAQN,KAAK,aAAa,EAClB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,CAAC;AAElD,OAAO,EAAuD,KAAK,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC7I,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAqBnF,wBAAsB,cAAc,CACnC,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,mBAAmB,GACxB,OAAO,CAAC,oBAAoB,CAAC,CAuB/B;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,EAAE,cAAc,UAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE/G;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAE9G;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmBzB;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAE5G;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAEnG;AAED,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,kBAAkB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAE3G"}