@clearance/api 0.1.4

package/LICENSE

@@ -0,0 +1,29 @@
+MIT License
+
+Copyright (c) 2026 Clearance contributors
+
+This project includes substantial portions of software originally developed
+by Bereket Engida and used under the following license terms.
+
+---
+
+The MIT License (MIT)
+Copyright (c) 2024 - present, Bereket Engida
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/LICENSE.md

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+Copyright (c) 2024 - present, Bereket Engida
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the “Software”), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

package/dist/server.d.ts

@@ -0,0 +1,54 @@
+import { Hono } from "hono";
+import type { Context } from "hono";
+import { type ManagementStore, type ResourceScope } from "@clearance/management";
+import type { IncomingMessage, Server, ServerResponse } from "node:http";
+export declare const DEFAULT_MAX_REQUEST_BODY_BYTES: number;
+export declare function resolveMaxRequestBodyBytes(env?: Record<string, string | undefined>): number;
+declare function getStore(): Promise<ManagementStore>;
+/**
+ * Long-lived API process: refresh so external CLI writes are visible before
+ * serving. Flushes pending local mutations first.
+ */
+declare function storeForRequest(): Promise<ManagementStore>;
+/**
+ * Operator principal scope (server-side only)
+ * -------------------------------------------
+ * CLEARANCE_OPERATOR_TOKEN authenticates the operator. Project/environment
+ * authority is derived exclusively from server configuration:
+ *   CLEARANCE_PROJECT_ID + CLEARANCE_ENV_ID, or the store's initialized
+ *   meta.config after `init` (local single-project profile).
+ *
+ * Client headers `X-Clearance-Project-Id` / `X-Clearance-Environment-Id` are
+ * never used as authority. If present they must match principal scope
+ * (consistency check only) — they cannot broaden or select another scope.
+ *
+ * Resource routes reject with SCOPE_REQUIRED when principal scope is absent.
+ * Init and health remain usable without scope (bootstrapping).
+ */
+declare function principalScope(store: ManagementStore): ResourceScope;
+declare function scopeForRequest(store: ManagementStore, c: Context): ResourceScope;
+/** @deprecated Use principalScope — kept for tests that import scopeFromStore */
+declare function scopeFromStore(store: ManagementStore): {
+    projectId?: string;
+    environmentId?: string;
+};
+/** @deprecated Prefer scopeForRequest — header check only, never authority */
+declare function assertScope(store: ManagementStore, headerProject?: string | null, headerEnv?: string | null): ResourceScope;
+declare const app: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+/**
+ * Build the response body that is safe to persist for a later replay.
+ * Generated temporary passwords are one-time delivery credentials: retaining
+ * one in either the Postgres companion table or the development memory backend
+ * would extend its lifetime to the idempotency TTL. A replay still returns the
+ * original user and status while explicitly reporting the omitted secret.
+ */
+declare function idempotencyReplayBody(path: string, body: string): string | null;
+declare function readBoundedRequestBody(req: IncomingMessage): Promise<Buffer | undefined>;
+/** Node HTTP bridge with a hard limit before Hono authentication/body parsing. */
+declare function nodeRequestHandler(req: IncomingMessage, res: ServerResponse): Promise<void>;
+declare function installGracefulShutdown(server: Server, store: ManagementStore, options?: {
+    registerSignals?: boolean;
+    timeoutMs?: number;
+}): (signal: string) => Promise<void>;
+declare function start(): Promise<Server<typeof IncomingMessage, typeof ServerResponse>>;
+export { app, getStore, storeForRequest, start, assertScope, scopeFromStore, principalScope, scopeForRequest, nodeRequestHandler, readBoundedRequestBody, idempotencyReplayBody, installGracefulShutdown, };