@boxxy/auth-oauth 0.2.6 → 0.2.7

package/src/test-utils/seed-pre-package-auth.ts

@@ -0,0 +1,162 @@
+import type { Database } from 'bun:sqlite';
+import { createHash } from 'node:crypto';
+import { PRE_PACKAGE_SCHEMA } from './pre-package-schema.ts';
+
+export interface PrePackageGrant {
+  readonly clientName: string;
+  readonly scopes: readonly string[];
+
+  // how many times the client refreshed; each refresh rotated out the token pair before it
+  readonly refreshes: number;
+
+  // what the old `boxxy_grant_use` table held for the grant
+  readonly lastUsedAt: string | null;
+
+  // true: every token of the grant expired an hour ago
+  readonly isExpired?: boolean;
+}
+
+export interface PrePackageAuth {
+  readonly origin: string;
+  readonly grants: readonly PrePackageGrant[];
+  readonly passkeyID: string;
+  readonly now: number;
+}
+
+// One per seeded grant, in the order of the input: its IDs, and its newest token pair.
+export interface SeededPrePackageGrant {
+  readonly grantID: string;
+  readonly clientID: string;
+  readonly accessToken: string;
+  readonly refreshToken: string;
+}
+
+const OWNER_ID = 'owner-user-row';
+const HOUR_MS = 60 * 60_000;
+
+// Writes the auth database the way boxxy's own OAuth server left it before the package: one owner
+// `user` row that every token, session and consent points at, and the grant-use table. No old
+// module is left to seed through, so the rows go in directly, as that server wrote them.
+export function seedPrePackageAuth(
+  sqlite: Database,
+  input: PrePackageAuth,
+): SeededPrePackageGrant[] {
+  const at = (offsetMs: number) => new Date(input.now + offsetMs).toISOString();
+
+  return sqlite.transaction(() => {
+    for (const statement of PRE_PACKAGE_SCHEMA) {
+      sqlite.run(statement);
+    }
+
+    sqlite.run(
+      `INSERT INTO "user" (id, name, email, emailVerified, createdAt, updatedAt) VALUES (?, 'owner', 'owner@boxxy.invalid', 1, ?, ?)`,
+      [OWNER_ID, at(-HOUR_MS), at(-HOUR_MS)],
+    );
+
+    sqlite.run(
+      `INSERT INTO session (id, expiresAt, token, createdAt, updatedAt, userId) VALUES ('owner-session', ?, 'owner-session-token', ?, ?, ?)`,
+      [at(HOUR_MS), at(-HOUR_MS), at(-HOUR_MS), OWNER_ID],
+    );
+
+    sqlite.run(
+      `INSERT INTO oauthResource (id, identifier, name, customClaims, dpopBoundAccessTokensRequired, disabled, createdAt, updatedAt, policyVersion, metadata) VALUES ('resource-1', ?, ?, 'null', 0, 0, ?, ?, 1, 'null')`,
+      [`${input.origin}/mcp`, `${input.origin}/mcp`, at(-HOUR_MS), at(-HOUR_MS)],
+    );
+
+    sqlite.run(
+      `INSERT INTO boxxy_passkey (id, public_key, counter, transports, created_at, last_used_at) VALUES (?, 'pQECAyYgASFYIA', 1, '["internal"]', ?, ?)`,
+      [input.passkeyID, at(-HOUR_MS), at(-HOUR_MS)],
+    );
+
+    return input.grants.map((grant, index) =>
+      seedGrant(sqlite, grant, { index, at, resource: JSON.stringify([`${input.origin}/mcp`]) }),
+    );
+  })();
+}
+
+interface GrantContext {
+  readonly index: number;
+  readonly at: (offsetMs: number) => string;
+  readonly resource: string;
+}
+
+function seedGrant(
+  sqlite: Database,
+  grant: PrePackageGrant,
+  ctx: GrantContext,
+): SeededPrePackageGrant {
+  const clientID = `client-${ctx.index}`;
+  const grantID = `code-${ctx.index}`;
+  const scopes = JSON.stringify([...grant.scopes, 'offline_access']);
+  const createdAt = ctx.at(-2 * HOUR_MS);
+  const accessExpiresAt = grant.isExpired === true ? ctx.at(-HOUR_MS) : ctx.at(HOUR_MS);
+  const refreshExpiresAt = grant.isExpired === true ? ctx.at(-HOUR_MS) : ctx.at(30 * 24 * HOUR_MS);
+
+  sqlite.run(
+    `INSERT INTO oauthClient (id, clientId, disabled, scopes, clientCredentialsScopes, createdAt, updatedAt, name, redirectUris, tokenEndpointAuthMethod, applicationType, grantTypes, responseTypes, requirePKCE, dpopBoundAccessTokens) VALUES (?, ?, 0, '["read","write","offline_access"]', '[]', ?, ?, ?, '["https://client.example/callback"]', 'none', 'web', '["authorization_code","refresh_token"]', '["code"]', 1, 0)`,
+    [`row-${clientID}`, clientID, createdAt, createdAt, grant.clientName],
+  );
+
+  sqlite.run(
+    `INSERT INTO oauthConsent (id, clientId, userId, resources, requestedUserInfoClaims, scopes, createdAt, updatedAt) VALUES (?, ?, ?, ?, '[]', ?, ?, ?)`,
+    [`consent-${clientID}`, clientID, OWNER_ID, ctx.resource, scopes, createdAt, createdAt],
+  );
+
+  for (let pair = 0; pair <= grant.refreshes; pair++) {
+    const refreshID = `refresh-${grantID}-${pair}`;
+    const rotatedAt = pair < grant.refreshes ? createdAt : null;
+
+    sqlite.run(
+      `INSERT INTO oauthRefreshToken (id, token, clientId, userId, authorizationCodeId, resources, expiresAt, createdAt, revoked, rotatedAt, authTime, scopes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        refreshID,
+        toTokenHash(`refresh-token-${grantID}-${pair}`),
+        clientID,
+        OWNER_ID,
+        grantID,
+        ctx.resource,
+        refreshExpiresAt,
+        createdAt,
+        rotatedAt,
+        rotatedAt,
+        createdAt,
+        scopes,
+      ],
+    );
+
+    sqlite.run(
+      `INSERT INTO oauthAccessToken (id, token, clientId, userId, authorizationCodeId, resources, refreshId, expiresAt, createdAt, scopes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        `access-${grantID}-${pair}`,
+        toTokenHash(`access-token-${grantID}-${pair}`),
+        clientID,
+        OWNER_ID,
+        grantID,
+        ctx.resource,
+        refreshID,
+        accessExpiresAt,
+        createdAt,
+        scopes,
+      ],
+    );
+  }
+
+  if (grant.lastUsedAt !== null) {
+    sqlite.run(`INSERT INTO boxxy_grant_use (grant_id, last_used_at) VALUES (?, ?)`, [
+      grantID,
+      grant.lastUsedAt,
+    ]);
+  }
+
+  return {
+    grantID,
+    clientID,
+    accessToken: `access-token-${grantID}-${grant.refreshes}`,
+    refreshToken: `refresh-token-${grantID}-${grant.refreshes}`,
+  };
+}
+
+// better-auth stores each token as its SHA-256 digest, in base64url.
+function toTokenHash(token: string): string {
+  return createHash('sha256').update(token).digest('base64url');
+}

package/src/test-utils/setup-temp-dir.ts

@@ -1,5 +1,3 @@
-// Copied from atc: packages/test-utils/src/setup-temp-dir.ts at commit 4fe647cf.
-
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';

package/src/utils/types.ts

@@ -1,5 +1,3 @@
-// Copied from atc: packages/core/src/types.ts at commit 4fe647cf.
-
 export interface AuthClock {
   readonly now: () => number;
 

package/dist/auth/answer-authorize-request.d.ts

@@ -1,2 +0,0 @@
-import type { HTTPServerContext, Requester } from './types.ts';
-export declare function answerAuthorizeRequest(ctx: HTTPServerContext, url: URL, requester: Requester): Promise<Response>;

package/dist/auth/answer-consent-request.d.ts

@@ -1,10 +0,0 @@
-import type { HTTPServerContext, Requester } from './types.ts';
-interface ConsentRequest {
-    readonly method: 'GET' | 'POST';
-    readonly url: URL;
-    readonly cookie: string | null;
-    readonly body: string;
-    readonly requester: Requester;
-}
-export declare function answerConsentRequest(ctx: HTTPServerContext, request: ConsentRequest): Promise<Response>;
-export {};

package/dist/auth/answer-enroll-request.d.ts

@@ -1,9 +0,0 @@
-import type { HTTPServerContext, Requester } from './types.ts';
-interface EnrollRequest {
-    readonly method: 'GET' | 'POST';
-    readonly url: URL;
-    readonly body: string;
-    readonly requester: Requester;
-}
-export declare function answerEnrollRequest(ctx: HTTPServerContext, request: EnrollRequest): Promise<Response>;
-export {};

package/dist/auth/answer-login-request.d.ts

@@ -1,9 +0,0 @@
-import type { HTTPServerContext, Requester } from './types.ts';
-interface LoginRequest {
-    readonly method: 'GET' | 'POST';
-    readonly url: URL;
-    readonly body: string;
-    readonly requester: Requester;
-}
-export declare function answerLoginRequest(ctx: HTTPServerContext, request: LoginRequest): Promise<Response>;
-export {};

package/dist/auth/approval-window-seconds.d.ts

@@ -1 +0,0 @@
-export declare const APPROVAL_WINDOW_SECONDS = 600;

package/dist/auth/build-consent-binding.d.ts

@@ -1 +0,0 @@
-export declare function buildConsentBinding(oauthQuery: string): string;

package/dist/auth/create-approval-state.d.ts

@@ -1,41 +0,0 @@
-interface ApprovalRequest {
-    readonly key: string;
-    readonly clientID: string;
-    readonly clientName: string;
-    readonly redirectURI: string;
-}
-interface PendingApproval extends ApprovalRequest {
-    readonly correlationID: string;
-    failures: number;
-    readonly expiresAt: number;
-    challenge: {
-        readonly value: string;
-        readonly expiresAt: number;
-    } | null;
-}
-export type TakenChallenge = {
-    readonly kind: 'taken';
-    readonly challenge: string;
-} | {
-    readonly kind: 'expired';
-} | {
-    readonly kind: 'missing';
-};
-interface ApprovedRequest {
-    readonly binding: string;
-    readonly correlationID: string;
-    readonly expiresAt: number;
-}
-export interface ApprovalState {
-    readonly createPending: (request: ApprovalRequest) => PendingApproval | null;
-    readonly findPending: (key: string) => PendingApproval | null;
-    readonly mintChallenge: (key: string) => string | null;
-    readonly claimChallenge: (key: string) => TakenChallenge;
-    readonly recordFailure: (key: string) => 'retry' | 'locked';
-    readonly removePending: (key: string) => void;
-    readonly recordApproved: (sessionID: string, approved: Omit<ApprovedRequest, 'expiresAt'>) => void;
-    readonly findApproved: (sessionID: string) => ApprovedRequest | null;
-    readonly removeApproved: (sessionID: string) => void;
-}
-export declare function createApprovalState(pendingMs: number, now: () => number): ApprovalState;
-export {};

package/dist/auth/create-enrollment-state.d.ts

@@ -1,6 +0,0 @@
-import type { TakenChallenge } from './create-approval-state.ts';
-export interface EnrollmentState {
-    readonly mintChallenge: (tokenHash: string) => string;
-    readonly claimChallenge: (tokenHash: string) => TakenChallenge;
-}
-export declare function createEnrollmentState(now: () => number): EnrollmentState;

package/dist/auth/create-enrollment-token.d.ts

@@ -1,6 +0,0 @@
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-export declare function createEnrollmentToken(db: Kysely<MCPAuthSchema>, now: number): Promise<{
-    readonly token: string;
-    readonly expiresAt: number;
-}>;

package/dist/auth/create-owner-plugin.d.ts

@@ -1,38 +0,0 @@
-import { z } from 'zod';
-export declare function createOwnerPlugin(): {
-    id: "boxxy-owner";
-    endpoints: {
-        signInOwner: import("better-auth").StrictEndpoint<"/boxxy/sign-in-owner", {
-            method: "POST";
-            body: z.ZodObject<{
-                oauth_query: z.ZodOptional<z.ZodString>;
-            }, z.core.$strip>;
-            metadata: {
-                SERVER_ONLY: true;
-            };
-        }, {
-            signedIn: boolean;
-        }>;
-        verifyMCPAccessToken: import("better-auth").StrictEndpoint<"/boxxy/verify-access-token", {
-            method: "POST";
-            body: z.ZodObject<{
-                token: z.ZodString;
-            }, z.core.$strip>;
-            metadata: {
-                SERVER_ONLY: true;
-            };
-        }, import("@better-auth/oauth-provider").ActiveAccessTokenPayload>;
-        createFixedClient: import("better-auth").StrictEndpoint<"/boxxy/create-fixed-client", {
-            method: "POST";
-            body: z.ZodObject<{
-                name: z.ZodString;
-                redirectURIs: z.ZodArray<z.ZodString>;
-            }, z.core.$strip>;
-            metadata: {
-                SERVER_ONLY: true;
-            };
-        }, {
-            clientID: string;
-        }>;
-    };
-};

package/dist/auth/create-passkey.d.ts

@@ -1,11 +0,0 @@
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-export interface NewPasskey {
-    readonly tokenHash: string;
-    readonly id: string;
-    readonly publicKey: string;
-    readonly counter: number;
-    readonly transports: readonly string[];
-    readonly now: number;
-}
-export declare function createPasskey(db: Kysely<MCPAuthSchema>, passkey: NewPasskey): Promise<boolean>;

package/dist/auth/derive-token-hash.d.ts

@@ -1 +0,0 @@
-export declare function deriveTokenHash(token: string): string;

package/dist/auth/is-allowed-redirect-uri.d.ts

@@ -1 +0,0 @@
-export declare function isAllowedRedirectURI(raw: string): boolean;

package/dist/auth/load-web-authn.d.ts

@@ -1,6 +0,0 @@
-import type { verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
-export interface WebAuthn {
-    readonly verifyAuthenticationResponse: typeof verifyAuthenticationResponse;
-    readonly verifyRegistrationResponse: typeof verifyRegistrationResponse;
-}
-export declare function loadWebAuthn(): Promise<WebAuthn>;

package/dist/auth/mcp-auth-database.d.ts

@@ -1,5 +0,0 @@
-import type { Dialect } from 'kysely';
-export interface MCPAuthDatabase {
-    readonly dialect: Dialect;
-    readonly close: () => void;
-}

package/dist/auth/mcp-auth-schema.d.ts

@@ -1,54 +0,0 @@
-export interface MCPAuthSchema {
-    readonly oauthClient: {
-        readonly id: string;
-        readonly clientId: string;
-        readonly name: string | null;
-        readonly redirectUris: string;
-        readonly createdAt: string | null;
-    };
-    readonly oauthAccessToken: {
-        readonly id: string;
-        readonly token: string;
-        readonly clientId: string;
-        readonly sessionId: string | null;
-        readonly authorizationCodeId: string | null;
-    };
-    readonly oauthRefreshToken: {
-        readonly id: string;
-        readonly clientId: string;
-        readonly sessionId: string | null;
-        readonly authorizationCodeId: string | null;
-        readonly scopes: string;
-        readonly createdAt: string;
-        readonly expiresAt: string;
-        readonly revoked: string | null;
-    };
-    readonly oauthConsent: {
-        readonly id: string;
-        readonly clientId: string;
-    };
-    readonly oauthResource: {
-        readonly identifier: string;
-    };
-    readonly session: {
-        readonly id: string;
-        readonly expiresAt: string;
-    };
-    readonly boxxy_grant_use: {
-        readonly grant_id: string;
-        readonly last_used_at: string;
-    };
-    readonly boxxy_passkey: {
-        readonly id: string;
-        readonly public_key: string;
-        readonly counter: number;
-        readonly transports: string;
-        readonly created_at: string;
-        readonly last_used_at: string | null;
-    };
-    readonly boxxy_enrollment_token: {
-        readonly token_hash: string;
-        readonly created_at: string;
-        readonly expires_at: string;
-    };
-}

package/dist/auth/open-mcp-auth.d.ts

@@ -1,80 +0,0 @@
-import type { BetterAuthPlugin } from 'better-auth';
-import { Kysely } from 'kysely';
-import type { MCPAuthDatabase } from './mcp-auth-database.ts';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-interface MCPAuthOptions {
-    readonly dbPath: string;
-    readonly origin: string | null;
-    readonly refreshReuseSeconds?: number;
-    readonly openDatabase: (path: string) => MCPAuthDatabase;
-}
-export declare function openMCPAuth(options: MCPAuthOptions): Promise<{
-    auth: import("better-auth").Auth<{
-        baseURL: string;
-        basePath: string;
-        secret: string;
-        database: {
-            db: Kysely<MCPAuthSchema>;
-            type: "sqlite";
-        };
-        telemetry: {
-            enabled: false;
-        };
-        logger: {
-            level: "error";
-        };
-        rateLimit: {
-            enabled: false;
-        };
-        advanced: {
-            database: {
-                validateSchema: false;
-            };
-        };
-        trustedOrigins: string[];
-        session: {
-            expiresIn: number;
-            disableSessionRefresh: true;
-        };
-        plugins: [BetterAuthPlugin, {
-            id: "boxxy-owner";
-            endpoints: {
-                signInOwner: import("better-auth").StrictEndpoint<"/boxxy/sign-in-owner", {
-                    method: "POST";
-                    body: import("zod").ZodObject<{
-                        oauth_query: import("zod").ZodOptional<import("zod").ZodString>;
-                    }, import("zod/v4/core").$strip>;
-                    metadata: {
-                        SERVER_ONLY: true;
-                    };
-                }, {
-                    signedIn: boolean;
-                }>;
-                verifyMCPAccessToken: import("better-auth").StrictEndpoint<"/boxxy/verify-access-token", {
-                    method: "POST";
-                    body: import("zod").ZodObject<{
-                        token: import("zod").ZodString;
-                    }, import("zod/v4/core").$strip>;
-                    metadata: {
-                        SERVER_ONLY: true;
-                    };
-                }, import("@better-auth/oauth-provider").ActiveAccessTokenPayload>;
-                createFixedClient: import("better-auth").StrictEndpoint<"/boxxy/create-fixed-client", {
-                    method: "POST";
-                    body: import("zod").ZodObject<{
-                        name: import("zod").ZodString;
-                        redirectURIs: import("zod").ZodArray<import("zod").ZodString>;
-                    }, import("zod/v4/core").$strip>;
-                    metadata: {
-                        SERVER_ONLY: true;
-                    };
-                }, {
-                    clientID: string;
-                }>;
-            };
-        }];
-    }>;
-    db: Kysely<MCPAuthSchema>;
-    close(): Promise<void>;
-}>;
-export {};

package/dist/auth/passkey-script.d.ts

@@ -1,4 +0,0 @@
-export declare const PASSKEY_SCRIPT: {
-    readonly source: "(() => {\n  const data = document.getElementById('boxxy-passkey');\n  const form = document.getElementById('boxxy-passkey-form');\n  const button = document.getElementById('boxxy-passkey-start');\n  const status = document.getElementById('boxxy-passkey-status');\n  if (data === null || form === null || button === null || status === null) return;\n  const spec = JSON.parse(data.textContent);\n  const toBytes = (value) => {\n    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');\n    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n    return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));\n  };\n  const toText = (buffer) => {\n    let text = '';\n    for (const byte of new Uint8Array(buffer)) text += String.fromCharCode(byte);\n    return btoa(text).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n  };\n  const toDescriptors = (list) => (list || []).map((item) => ({ ...item, id: toBytes(item.id) }));\n  button.addEventListener('click', async () => {\n    button.disabled = true;\n    status.textContent = '';\n    try {\n      const options = spec.options;\n      const credential = spec.mode === 'create'\n        ? await navigator.credentials.create({ publicKey: { ...options, challenge: toBytes(options.challenge), user: { ...options.user, id: toBytes(options.user.id) }, excludeCredentials: toDescriptors(options.excludeCredentials) } })\n        : await navigator.credentials.get({ publicKey: { ...options, challenge: toBytes(options.challenge), allowCredentials: toDescriptors(options.allowCredentials) } });\n      const reply = credential.response;\n      const response = spec.mode === 'create'\n        ? { clientDataJSON: toText(reply.clientDataJSON), attestationObject: toText(reply.attestationObject), transports: typeof reply.getTransports === 'function' ? reply.getTransports() : [] }\n        : { clientDataJSON: toText(reply.clientDataJSON), authenticatorData: toText(reply.authenticatorData), signature: toText(reply.signature), userHandle: reply.userHandle ? toText(reply.userHandle) : undefined };\n      form.elements.namedItem('credential').value = JSON.stringify({ id: credential.id, rawId: toText(credential.rawId), type: credential.type, response, clientExtensionResults: credential.getClientExtensionResults(), authenticatorAttachment: credential.authenticatorAttachment || undefined });\n      form.submit();\n    } catch (error) {\n      status.textContent = 'The passkey prompt ended without a passkey (' + (error && error.name ? error.name : 'Error') + '). Try again.';\n      button.disabled = false;\n    }\n  });\n})();";
-    readonly policySource: `'sha256-${string}'`;
-};

package/dist/auth/read-client-name.d.ts

@@ -1,3 +0,0 @@
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-export declare function readClientName(db: Kysely<MCPAuthSchema>, clientID: string): Promise<string | null>;

package/dist/auth/read-client-views.d.ts

@@ -1,9 +0,0 @@
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-export interface ClientView {
-    readonly clientID: string;
-    readonly name: string;
-    readonly redirectURIs: readonly string[];
-    readonly createdAt: string | null;
-}
-export declare function readClientViews(db: Kysely<MCPAuthSchema>): Promise<readonly ClientView[]>;

package/dist/auth/read-enrollment-token.d.ts

@@ -1,3 +0,0 @@
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-export declare function readEnrollmentToken(db: Kysely<MCPAuthSchema>, token: string, now: number): Promise<string | null>;

package/dist/auth/read-grant-views.d.ts

@@ -1,12 +0,0 @@
-import type { GrantScope } from '@boxxy/contract';
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-export interface GrantView {
-    readonly grantID: string;
-    readonly clientID: string;
-    readonly clientName: string;
-    readonly scopes: readonly GrantScope[];
-    readonly createdAt: string;
-    readonly lastUsedAt: string | null;
-}
-export declare function readGrantViews(db: Kysely<MCPAuthSchema>): Promise<readonly GrantView[]>;

package/dist/auth/read-owner-session-id.d.ts

@@ -1,2 +0,0 @@
-import type { HTTPServerContext } from './types.ts';
-export declare function readOwnerSessionID(ctx: HTTPServerContext, cookie: string | null): Promise<string | null>;

package/dist/auth/record-refused-exchange.d.ts

@@ -1,10 +0,0 @@
-import type { HTTPServerContext, Requester } from './types.ts';
-interface RefusedExchange {
-    readonly contentType: string | null;
-    readonly body: string;
-    readonly response: Response;
-    readonly path: string;
-    readonly requester: Requester;
-}
-export declare function recordRefusedExchange(ctx: Pick<HTTPServerContext, 'store' | 'security'>, exchange: RefusedExchange): Promise<void>;
-export {};

package/dist/auth/remove-client.d.ts

@@ -1,3 +0,0 @@
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-export declare function removeClient(db: Kysely<MCPAuthSchema>, clientID: string): Promise<boolean>;

package/dist/auth/remove-owner-session.d.ts

@@ -1,3 +0,0 @@
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-export declare function removeOwnerSession(db: Kysely<MCPAuthSchema>, sessionID: string): Promise<void>;

package/dist/auth/render-consent-page.d.ts

@@ -1,9 +0,0 @@
-import type { GrantScope } from '@boxxy/contract';
-interface ConsentPageView {
-    readonly oauthQuery: string;
-    readonly clientName: string;
-    readonly redirectURI: string;
-    readonly scopes: readonly GrantScope[];
-}
-export declare function renderConsentPage(view: ConsentPageView): string;
-export {};

package/dist/auth/render-enroll-page.d.ts

@@ -1,10 +0,0 @@
-interface EnrollPageView {
-    readonly ceremony: {
-        readonly token: string;
-        readonly options: unknown;
-    } | null;
-    readonly error: string | null;
-    readonly prefill?: string;
-}
-export declare function renderEnrollPage(view: EnrollPageView): string;
-export {};

package/dist/auth/render-login-page.d.ts

@@ -1,9 +0,0 @@
-interface LoginPageView {
-    readonly oauthQuery: string;
-    readonly clientName: string;
-    readonly redirectURI: string;
-    readonly options: unknown;
-    readonly error: string | null;
-}
-export declare function renderLoginPage(view: LoginPageView): string;
-export {};

package/dist/auth/revoke-grant.d.ts

@@ -1,3 +0,0 @@
-import type { Kysely } from 'kysely';
-import type { MCPAuthSchema } from './mcp-auth-schema.ts';
-export declare function revokeGrant(db: Kysely<MCPAuthSchema>, grantID: string): Promise<boolean>;

package/dist/auth/to-html-text.d.ts

@@ -1 +0,0 @@
-export declare function toHTMLText(text: string): string;

package/dist/auth/to-script-json.d.ts

@@ -1 +0,0 @@
-export declare function toScriptJSON(value: unknown): string;