@a2a-exposed/control-core 0.7.33 → 0.7.34

package/dist/types/control/src/core/index.d.ts

@@ -9,13 +9,17 @@ export type { WakeSave, WakeSettings } from "../tenants/wake.js";
 export { MAX_WAKE_PLAIN, MAX_WAKE_SEALED, MAX_WAKE_VALUE, WAKE_SECRET_KEYS, openWakeSecrets, sealWakeSecrets, } from "../tenants/wake-secrets.js";
 export type { WakeSecretKey, WakeSecrets } from "../tenants/wake-secrets.js";
 export { RESERVED_NAMES, TENANT_NAME, tenantNameProblem } from "../tenants/reserved.js";
+export { httpsOrigin, newApprovalClient } from "../tenants/approval.js";
+export type { ApprovalClient } from "../tenants/approval.js";
 export { dataPlaneFromEnv, deliverOutbox, flushOutbox, pushFromRow, withOutboxLock, } from "../tenants/push.js";
 export type { DataPlane, DirectoryEntry, OutboxRow, OwnerCall, PlaneEnv, TenantPush, } from "../tenants/push.js";
 export type { ControlEnv } from "../env.js";
-export type { Sql, SqlStatement } from "../auth/invites.js";
+export type { Sql, SqlStatement } from "./sql.js";
 export { RUN_WORKER_FIRST } from "../routing.js";
 export { routes } from "./routes.js";
 export type { CoreRoutes } from "./routes.js";
+export * from "../provision/grant.js";
+export * from "../provision/setup.js";
 export * from "../provision/cloudflare-api.js";
 export * from "../provision/names.js";
 export * from "../provision/statements.js";

package/dist/types/control/src/core/sql.d.ts

@@ -0,0 +1,16 @@
+export interface SqlStatement {
+    bind(...values: unknown[]): SqlStatement;
+    first<T>(): Promise<T | null>;
+    run(): Promise<{
+        meta?: {
+            changes?: number;
+        };
+    }>;
+    all<T>(): Promise<{
+        results: T[];
+    }>;
+}
+export interface Sql {
+    prepare(query: string): SqlStatement;
+    batch(statements: SqlStatement[]): Promise<unknown>;
+}

package/dist/types/control/src/env.d.ts

@@ -12,7 +12,7 @@ export interface ControlEnv extends PlaneEnv {
     TENANT_DOMAIN?: string;
     /** `eu` or `fedramp`. Unset: the platform's default placement. */
     DATA_REGION?: string;
-    DB?: import("./auth/invites.js").Sql;
+    DB?: import("./core/sql.js").Sql;
     AUTH_SECRET?: string;
     GITHUB_CLIENT_ID?: string;
     GITHUB_CLIENT_SECRET?: string;
@@ -35,8 +35,8 @@ export interface ControlEnv extends PlaneEnv {
     /** Same secret as the data-plane Worker. Seals wake secrets. Unset: a new key cannot be saved. */
     TENANT_SECRETS_KEY?: string;
     /**
-     * Fine-grained token with Issues write on FEEDBACK_REPO only. A secret, not a var.
-     * Fallback when the GitHub App below is unset. Not a GITHUB_* name: that prefix is the sign-in OAuth app.
+     * Fine-grained token with Issues write on FEEDBACK_REPO. A secret.
+     * The feedback route files an issue with this token.
      */
     FEEDBACK_GITHUB_TOKEN?: string;
     /** GitHub App id that files feedback issues. A plain var. With the private key, preferred over the token. */

package/dist/types/control/src/provision/grant.d.ts

@@ -0,0 +1,54 @@
+import type { Sql } from "../core/sql.js";
+export interface CloudflareGrantRow {
+    userId: string;
+    /** Cloudflare user id from GET /user. The account chosen on the consent screen is not in the token response. */
+    accountId: string;
+    choice: string;
+    host: string;
+    requested_scope: string;
+    granted_scope: string | null;
+    refresh_enc: string | null;
+    access_expires_at: string | null;
+}
+export type RefreshResult = {
+    ok: true;
+    accessToken: string;
+    scope: string;
+} | {
+    ok: false;
+    error: "no_grant" | "no_refresh" | "busy" | "invalid_grant" | "uncertain" | "failed" | "unreadable";
+};
+/** `v1.<iv>.<ciphertext>`, or null when the secret or the token cannot be sealed. */
+export declare function sealCloudflareRefresh(secret: string, userId: string, token: string): Promise<string | null>;
+export declare function openCloudflareRefresh(secret: string, userId: string, sealed: string | null | undefined): Promise<string | null>;
+export declare function saveCloudflareGrant(db: Sql, secret: string, input: {
+    userId: string;
+    accountId: string;
+    choice: string;
+    host: string;
+    requestedScope: string;
+    /** Token `scope` string, or null when Cloudflare omitted it. */
+    grantedScope: string | null;
+    refreshToken: string | null;
+    expiresIn: unknown;
+    now?: number;
+}): Promise<void>;
+export declare function readCloudflareGrant(db: Sql, userId: string): Promise<CloudflareGrantRow | null>;
+export declare function deleteCloudflareGrant(db: Sql, userId: string): Promise<void>;
+/**
+ * Exchanges the stored refresh token and replaces it with the new one.
+ * A 400 or 401 drops the stored token: a single-use token is already dead.
+ * A timeout or a network error keeps it and returns `uncertain` or `failed`.
+ * Do not call this twice in parallel for the same user; the second waits on
+ * the lock and then sees the new token, or gets `busy` if the lock is still held.
+ */
+export declare function refreshCloudflareGrant(input: {
+    database: Sql;
+    secret: string;
+    clientId: string;
+    clientSecret: string;
+    userId: string;
+    fetchMs?: number;
+    now?: number;
+    fetchImpl?: typeof fetch;
+}): Promise<RefreshResult>;

package/dist/types/control/src/provision/inbox-row.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "../auth/invites.js";
+import type { Sql } from "../core/sql.js";
 export interface InboxRow {
     id: string;
     userId: string;

package/dist/types/control/src/provision/inbox.d.ts

@@ -1,5 +1,5 @@
-import { type SetupHost } from "../auth/cloudflare-setup.js";
-import type { Sql } from "../auth/invites.js";
+import type { Sql } from "../core/sql.js";
+import { type SetupHost } from "./setup.js";
 import { hashOwnerToken, readCloudflareInbox, type InboxRow } from "./inbox-row.js";
 import { PERMISSION_WAIT } from "./permission-wait.js";
 export { hashOwnerToken, readCloudflareInbox };

package/dist/types/control/src/provision/remove.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "../auth/invites.js";
+import type { Sql } from "../core/sql.js";
 import { type InboxRow } from "./inbox-row.js";
 export type RemovalId = "address" | "worker" | "database" | "dashboard";
 export interface RemovalItem {

package/dist/types/control/src/tenants/approval.d.ts

@@ -0,0 +1,16 @@
+export interface ApprovalClient {
+    clientId: string;
+    secretHash: string;
+    redirectUris: string[];
+    clientSecret: string;
+    approval: Record<string, unknown>;
+}
+/** https origin, or "" when the value is empty, not https, or carries userinfo. */
+export declare function httpsOrigin(value: string | undefined): string;
+/** Confidential client for one tenant. Null when there is no https issuer or public host. */
+export declare function newApprovalClient(input: {
+    accountId: string;
+    issuer: string;
+    publicUrl: string | null;
+    label?: string;
+}): Promise<ApprovalClient | null>;

package/dist/types/control/src/tenants/create.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "../auth/invites.js";
+import type { Sql } from "../core/sql.js";
 import { type DataPlane } from "./push.js";
 export interface CreatedTenant {
     id: string;

package/dist/types/control/src/tenants/delete.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "../auth/invites.js";
+import type { Sql } from "../core/sql.js";
 import { type DataPlane } from "./push.js";
 export type DeleteResult = {
     ok: true;

package/dist/types/control/src/tenants/push.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "../auth/invites.js";
+import type { Sql } from "../core/sql.js";
 /** Versioned copy the data-plane Durable Object stores. Older versions are ignored there. */
 export interface TenantPush {
     version: number;

package/dist/types/control/src/tenants/rotate.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "../auth/invites.js";
+import type { Sql } from "../core/sql.js";
 import { type DataPlane } from "./push.js";
 export type RotateResult = {
     ok: true;

package/dist/types/control/src/tenants/wake.d.ts

@@ -1,4 +1,4 @@
-import type { Sql } from "../auth/invites.js";
+import type { Sql } from "../core/sql.js";
 import { type DataPlane } from "./push.js";
 /** The same list the Worker renders. Claude Code is one of them. */
 export declare const WAKE_PRESETS: readonly ["grok-bot", "claude-code", "openclaw-wake", "openclaw-agent", "hermes", "generic"];

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@a2a-exposed/control-core",
-	"version": "0.7.33",
+	"version": "0.7.34",
 	"description": "Tenants, Cloudflare inbox provisioning, routing, and control-plane migrations for a2a-exposed.",
 	"type": "module",
 	"scripts": {

package/dist/types/control/src/auth/invites.d.ts

@@ -1,38 +0,0 @@
-export interface SqlStatement {
-    bind(...values: unknown[]): SqlStatement;
-    first<T>(): Promise<T | null>;
-    run(): Promise<{
-        meta?: {
-            changes?: number;
-        };
-    }>;
-    all<T>(): Promise<{
-        results: T[];
-    }>;
-}
-export interface Sql {
-    prepare(query: string): SqlStatement;
-    batch(statements: SqlStatement[]): Promise<unknown>;
-}
-export declare function newInviteCode(): string;
-export declare function validInviteCode(code: string): boolean;
-export declare function hasAccount(db: Sql, email: string): Promise<boolean>;
-export declare function insertInvite(db: Sql, input?: {
-    code?: string;
-    email?: string;
-    expiresAt?: string | null;
-}): Promise<string>;
-/** A live code. When `email` is set, a code locked to another address does not pass. */
-export declare function invitePending(db: Sql, code: string, email?: string): Promise<boolean>;
-/** SHA-256 of a magic-link token, base64url without padding. The plaintext token is not stored. */
-export declare function tokenHash(token: string): Promise<string>;
-/**
- * Binds an invite to a magic-link token so the emailed link works in another browser.
- * The row lives in `verification` under `a2a-invite:<hash>` and is not the Better Auth record
- * (that record's schema rejects extra fields).
- */
-export declare function rememberMagicInvite(db: Sql, token: string, code: string, email: string, ttlSeconds: number): Promise<void>;
-/** Reads and deletes the invite bound to this magic-link token. Empty when missing, expired, or for another email. */
-export declare function takeMagicInvite(db: Sql, token: string, email: string): Promise<string>;
-/** Marks one unused code as used. A second caller gets false. */
-export declare function consumeInvite(db: Sql, code: string, email: string): Promise<boolean>;