@buildinternet/uploads 0.13.0 → 0.13.1

package/dist/client.d.ts

@@ -1,4 +1,6 @@
 import type { UploadsClientConfig } from "./config.js";
+/** Scoped-operator-token permission scope. */
+export type TokenScope = "files:read" | "files:write" | "files:delete" | "operator:read" | "operator:write" | "workspace:invite" | "workspace:manage";
 /** Allowlisted object provenance (maps to X-Uploads-Meta-* on put). */
 export type ProvenanceInput = {
     client?: string;
@@ -212,7 +214,7 @@ export interface EnrollmentExchangeResult {
     apiUrl?: string;
     workspace: string;
     token: string;
-    scopes?: Array<"files:read" | "files:write" | "files:delete">;
+    scopes?: Array<TokenScope>;
     expiresAt?: string;
 }
 export interface EnrollmentCreateResult {
@@ -229,9 +231,16 @@ export declare function createEnrollment(apiUrl: string, adminToken: string, inp
     email?: string;
     enrollmentSeconds?: number;
     tokenExpiresInSeconds?: number;
-    scopes?: Array<"files:read" | "files:write" | "files:delete">;
+    scopes?: Array<TokenScope>;
 }): Promise<EnrollmentCreateResult>;
-/** Static OAuth client id allowlisted by the auth worker's `validateClient`. */
+/**
+ * OAuth client id for the device flow. Registered server-side as a managed
+ * official `oauth_client` row (seeded by apps/auth migration
+ * 20260719000000_seed_cli_oauth_client.sql — issue #251): public PKCE client,
+ * no secret, device-code grant only. The auth worker's device endpoints
+ * validate this id against that table, so operators can disable it from
+ * /admin/oauth. The literal must match the seeded row's client_id.
+ */
 export declare const DEVICE_CLIENT_ID = "uploads-cli";
 /**
  * User-Agent for device-flow requests. Stored on the Better Auth session row
@@ -302,7 +311,7 @@ export declare function createWorkspaceRequest(apiUrl: string, accessToken: stri
 export interface MintTokenResult {
     token: string;
     workspace: string;
-    scopes: Array<"files:read" | "files:write" | "files:delete">;
+    scopes: Array<TokenScope>;
     label: string | null;
     expiresAt: string | null;
 }
@@ -332,7 +341,7 @@ export declare function createWorkspaceInvite(apiUrl: string, accessToken: strin
  */
 export declare function mintWorkspaceToken(apiUrl: string, accessToken: string, input: {
     workspace: string;
-    scopes?: Array<"files:read" | "files:write" | "files:delete">;
+    scopes?: Array<TokenScope>;
     label?: string;
     ttlSeconds?: number;
 }): Promise<MintTokenResult>;

package/dist/client.js

@@ -37,7 +37,14 @@ export function createEnrollment(apiUrl, adminToken, input) {
 // D5). Better Auth's `device.code`/`device.token` endpoints take
 // `application/json` bodies, NOT the RFC's form-encoding — the JSON shapes
 // below are what the worker expects.
-/** Static OAuth client id allowlisted by the auth worker's `validateClient`. */
+/**
+ * OAuth client id for the device flow. Registered server-side as a managed
+ * official `oauth_client` row (seeded by apps/auth migration
+ * 20260719000000_seed_cli_oauth_client.sql — issue #251): public PKCE client,
+ * no secret, device-code grant only. The auth worker's device endpoints
+ * validate this id against that table, so operators can disable it from
+ * /admin/oauth. The literal must match the seeded row's client_id.
+ */
 export const DEVICE_CLIENT_ID = "uploads-cli";
 /**
  * User-Agent for device-flow requests. Stored on the Better Auth session row

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@buildinternet/uploads",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "CLI and client for uploads.sh — workspace-scoped image hosting for GitHub embeds",
   "type": "module",
   "sideEffects": false,