@hot-updater/server 0.36.7 → 1.0.0-rc.1

package/dist/adapters/prismaRows.cjs

@@ -0,0 +1,198 @@
+require("../_virtual/_rolldown/runtime.cjs");
+let _hot_updater_plugin_core = require("@hot-updater/plugin-core");
+//#region src/adapters/prismaRows.ts
+var PrismaAdapterError = class extends Error {
+	name = "PrismaAdapterError";
+	constructor(reason) {
+		super(`Invalid Prisma plugin state: ${reason}`);
+		this.reason = reason;
+	}
+};
+const isRecord = (value) => typeof value === "object" && value !== null;
+const hasDelegateMethods = (value) => isRecord(value) && typeof value["count"] === "function" && typeof value["create"] === "function" && typeof value["deleteMany"] === "function" && typeof value["findFirst"] === "function" && typeof value["findMany"] === "function" && typeof value["update"] === "function" && typeof value["upsert"] === "function";
+const modelDelegates = {
+	bundles: "bundles",
+	bundle_patches: "bundle_patches",
+	bundle_events: "bundle_events",
+	channels: "channels",
+	api_keys: "api_keys",
+	releases: "releases",
+	release_catalogs: "release_catalogs"
+};
+const getPrismaDelegate = (client, model) => {
+	const delegate = Object.entries(client).find(([key]) => key === modelDelegates[model])?.[1];
+	if (delegate === void 0) throw new PrismaAdapterError(`missing model delegate "${model}"`);
+	if (!hasDelegateMethods(delegate)) throw new PrismaAdapterError(`invalid model delegate "${model}"`);
+	return delegate;
+};
+const readString = (row, field) => {
+	const value = row[field];
+	if (typeof value !== "string") throw new PrismaAdapterError(`expected string field "${field}"`);
+	return value;
+};
+const readNullableString = (row, field) => {
+	const value = row[field];
+	if (value === null) return null;
+	if (typeof value !== "string") throw new PrismaAdapterError(`expected nullable string field "${field}"`);
+	return value;
+};
+const readByteSize = (row, field) => {
+	const value = row[field];
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new PrismaAdapterError(`expected byte-size field "${field}"`);
+	return value;
+};
+const parsePrismaBundleRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid bundle row");
+	const platform = value["platform"];
+	if (platform !== "android" && platform !== "ios") throw new PrismaAdapterError("expected platform \"android\" or \"ios\"");
+	const metadata = value["metadata"];
+	if (!(0, _hot_updater_plugin_core.isDatabaseMetadataObject)(metadata)) throw new PrismaAdapterError("invalid metadata field");
+	return {
+		id: readString(value, "id"),
+		platform,
+		file_hash: readString(value, "file_hash"),
+		git_commit_hash: readNullableString(value, "git_commit_hash"),
+		storage_uri: readString(value, "storage_uri"),
+		archive_byte_size: readByteSize(value, "archive_byte_size"),
+		metadata,
+		manifest_storage_uri: readNullableString(value, "manifest_storage_uri"),
+		manifest_file_hash: readNullableString(value, "manifest_file_hash"),
+		asset_base_storage_uri: readNullableString(value, "asset_base_storage_uri")
+	};
+};
+const parsePrismaChannelRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid channel row");
+	return {
+		id: readString(value, "id"),
+		name: readString(value, "name")
+	};
+};
+const parsePrismaPatchRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid patch row");
+	const orderIndex = value["order_index"];
+	if (typeof orderIndex !== "number") throw new PrismaAdapterError("invalid patch order_index field");
+	return {
+		id: readString(value, "id"),
+		bundle_id: readString(value, "bundle_id"),
+		base_bundle_id: readString(value, "base_bundle_id"),
+		base_file_hash: readString(value, "base_file_hash"),
+		patch_file_hash: readString(value, "patch_file_hash"),
+		patch_storage_uri: readString(value, "patch_storage_uri"),
+		byte_size: readByteSize(value, "byte_size"),
+		order_index: orderIndex
+	};
+};
+const readNumber = (row, field) => {
+	const value = row[field];
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new PrismaAdapterError(`expected number field "${field}"`);
+	return value;
+};
+const parsePrismaBundleEventRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid event row");
+	const type = readString(value, "type");
+	const platform = readString(value, "platform");
+	const fromBundleId = readNullableString(value, "from_bundle_id");
+	const updateStrategy = readNullableString(value, "update_strategy");
+	if (platform !== "ios" && platform !== "android" || !((type === "UPDATE_APPLIED" || type === "RECOVERED" || type === "RELEASE_ADOPTED") && typeof fromBundleId === "string" && (updateStrategy === "fingerprint" || updateStrategy === "appVersion") || type === "UNCHANGED" && fromBundleId === null && updateStrategy === null)) throw new PrismaAdapterError("invalid event shape");
+	return {
+		id: readString(value, "id"),
+		type,
+		install_id: readString(value, "install_id"),
+		user_id: readNullableString(value, "user_id"),
+		username: readNullableString(value, "username"),
+		from_release_id: readNullableString(value, "from_release_id"),
+		from_bundle_id: fromBundleId,
+		to_release_id: readNullableString(value, "to_release_id"),
+		to_bundle_id: readString(value, "to_bundle_id"),
+		platform,
+		app_version: readString(value, "app_version"),
+		channel: readString(value, "channel"),
+		cohort: readString(value, "cohort"),
+		update_strategy: updateStrategy,
+		fingerprint_hash: readNullableString(value, "fingerprint_hash"),
+		sdk_version: readNullableString(value, "sdk_version"),
+		received_at_ms: readNumber(value, "received_at_ms")
+	};
+};
+const parsePrismaApiKeyRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid API key row");
+	const role = readString(value, "role");
+	if (role !== "client") throw new PrismaAdapterError("invalid API key role");
+	const revokedAt = value["revoked_at_ms"];
+	return {
+		id: readString(value, "id"),
+		hash: readString(value, "hash"),
+		name: readString(value, "name"),
+		prefix: readString(value, "prefix"),
+		role,
+		created_at_ms: readNumber(value, "created_at_ms"),
+		revoked_at_ms: revokedAt === null ? null : readNumber(value, "revoked_at_ms")
+	};
+};
+const parsePrismaReleaseRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid Release row");
+	const platform = readString(value, "platform");
+	const kind = readString(value, "kind");
+	const strategy = readString(value, "strategy");
+	const operation = readString(value, "operation");
+	const targetCohorts = value["target_cohorts"];
+	if (platform !== "ios" && platform !== "android" || kind !== "BUNDLE" && kind !== "EMBEDDED" || strategy !== "APP_VERSION" && strategy !== "FINGERPRINT" || operation !== "DEPLOY" && operation !== "PROMOTE" && operation !== "ROLLBACK" || !Array.isArray(targetCohorts) || !targetCohorts.every((cohort) => typeof cohort === "string")) throw new PrismaAdapterError("invalid Release fields");
+	const enabled = value["enabled"];
+	const shouldForceUpdate = value["should_force_update"];
+	if (typeof enabled !== "boolean" || typeof shouldForceUpdate !== "boolean") throw new PrismaAdapterError("invalid Release policy fields");
+	return {
+		bundle_id: readNullableString(value, "bundle_id"),
+		channel_id: readString(value, "channel_id"),
+		created_at_ms: readNumber(value, "created_at_ms"),
+		enabled,
+		fingerprint_hash: readNullableString(value, "fingerprint_hash"),
+		id: readString(value, "id"),
+		kind,
+		message: readNullableString(value, "message"),
+		operation,
+		platform,
+		revision: readNumber(value, "revision"),
+		rollout_cohort_count: readNumber(value, "rollout_cohort_count"),
+		scope_key: readString(value, "scope_key"),
+		should_force_update: shouldForceUpdate,
+		source_release_id: readNullableString(value, "source_release_id"),
+		strategy,
+		target_app_version: readNullableString(value, "target_app_version"),
+		target_cohorts: targetCohorts,
+		updated_at_ms: readNumber(value, "updated_at_ms")
+	};
+};
+const parsePrismaReleaseCatalogRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid catalog row");
+	const platform = readString(value, "platform");
+	const strategy = readString(value, "strategy");
+	const isTombstone = value["is_tombstone"];
+	if (platform !== "ios" && platform !== "android" || strategy !== "APP_VERSION" && strategy !== "FINGERPRINT" || typeof isTombstone !== "boolean") throw new PrismaAdapterError("invalid catalog fields");
+	return {
+		catalog_id: readString(value, "catalog_id"),
+		byte_size: readNumber(value, "byte_size"),
+		catalog_hash: readString(value, "catalog_hash"),
+		channel_id: readString(value, "channel_id"),
+		channel_key: readString(value, "channel_key"),
+		fingerprint_hash: readNullableString(value, "fingerprint_hash"),
+		generation: readNumber(value, "generation"),
+		is_tombstone: isTombstone,
+		payload: readString(value, "payload"),
+		platform,
+		scope_key: readString(value, "scope_key"),
+		strategy,
+		updated_at_ms: readNumber(value, "updated_at_ms")
+	};
+};
+const parsePrismaRows = (rows, parse) => rows.map(parse);
+//#endregion
+exports.PrismaAdapterError = PrismaAdapterError;
+exports.getPrismaDelegate = getPrismaDelegate;
+exports.parsePrismaApiKeyRow = parsePrismaApiKeyRow;
+exports.parsePrismaBundleEventRow = parsePrismaBundleEventRow;
+exports.parsePrismaBundleRow = parsePrismaBundleRow;
+exports.parsePrismaChannelRow = parsePrismaChannelRow;
+exports.parsePrismaPatchRow = parsePrismaPatchRow;
+exports.parsePrismaReleaseCatalogRow = parsePrismaReleaseCatalogRow;
+exports.parsePrismaReleaseRow = parsePrismaReleaseRow;
+exports.parsePrismaRows = parsePrismaRows;

package/dist/adapters/prismaRows.mjs

@@ -0,0 +1,188 @@
+import { isDatabaseMetadataObject } from "@hot-updater/plugin-core";
+//#region src/adapters/prismaRows.ts
+var PrismaAdapterError = class extends Error {
+	name = "PrismaAdapterError";
+	constructor(reason) {
+		super(`Invalid Prisma plugin state: ${reason}`);
+		this.reason = reason;
+	}
+};
+const isRecord = (value) => typeof value === "object" && value !== null;
+const hasDelegateMethods = (value) => isRecord(value) && typeof value["count"] === "function" && typeof value["create"] === "function" && typeof value["deleteMany"] === "function" && typeof value["findFirst"] === "function" && typeof value["findMany"] === "function" && typeof value["update"] === "function" && typeof value["upsert"] === "function";
+const modelDelegates = {
+	bundles: "bundles",
+	bundle_patches: "bundle_patches",
+	bundle_events: "bundle_events",
+	channels: "channels",
+	api_keys: "api_keys",
+	releases: "releases",
+	release_catalogs: "release_catalogs"
+};
+const getPrismaDelegate = (client, model) => {
+	const delegate = Object.entries(client).find(([key]) => key === modelDelegates[model])?.[1];
+	if (delegate === void 0) throw new PrismaAdapterError(`missing model delegate "${model}"`);
+	if (!hasDelegateMethods(delegate)) throw new PrismaAdapterError(`invalid model delegate "${model}"`);
+	return delegate;
+};
+const readString = (row, field) => {
+	const value = row[field];
+	if (typeof value !== "string") throw new PrismaAdapterError(`expected string field "${field}"`);
+	return value;
+};
+const readNullableString = (row, field) => {
+	const value = row[field];
+	if (value === null) return null;
+	if (typeof value !== "string") throw new PrismaAdapterError(`expected nullable string field "${field}"`);
+	return value;
+};
+const readByteSize = (row, field) => {
+	const value = row[field];
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new PrismaAdapterError(`expected byte-size field "${field}"`);
+	return value;
+};
+const parsePrismaBundleRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid bundle row");
+	const platform = value["platform"];
+	if (platform !== "android" && platform !== "ios") throw new PrismaAdapterError("expected platform \"android\" or \"ios\"");
+	const metadata = value["metadata"];
+	if (!isDatabaseMetadataObject(metadata)) throw new PrismaAdapterError("invalid metadata field");
+	return {
+		id: readString(value, "id"),
+		platform,
+		file_hash: readString(value, "file_hash"),
+		git_commit_hash: readNullableString(value, "git_commit_hash"),
+		storage_uri: readString(value, "storage_uri"),
+		archive_byte_size: readByteSize(value, "archive_byte_size"),
+		metadata,
+		manifest_storage_uri: readNullableString(value, "manifest_storage_uri"),
+		manifest_file_hash: readNullableString(value, "manifest_file_hash"),
+		asset_base_storage_uri: readNullableString(value, "asset_base_storage_uri")
+	};
+};
+const parsePrismaChannelRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid channel row");
+	return {
+		id: readString(value, "id"),
+		name: readString(value, "name")
+	};
+};
+const parsePrismaPatchRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid patch row");
+	const orderIndex = value["order_index"];
+	if (typeof orderIndex !== "number") throw new PrismaAdapterError("invalid patch order_index field");
+	return {
+		id: readString(value, "id"),
+		bundle_id: readString(value, "bundle_id"),
+		base_bundle_id: readString(value, "base_bundle_id"),
+		base_file_hash: readString(value, "base_file_hash"),
+		patch_file_hash: readString(value, "patch_file_hash"),
+		patch_storage_uri: readString(value, "patch_storage_uri"),
+		byte_size: readByteSize(value, "byte_size"),
+		order_index: orderIndex
+	};
+};
+const readNumber = (row, field) => {
+	const value = row[field];
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new PrismaAdapterError(`expected number field "${field}"`);
+	return value;
+};
+const parsePrismaBundleEventRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid event row");
+	const type = readString(value, "type");
+	const platform = readString(value, "platform");
+	const fromBundleId = readNullableString(value, "from_bundle_id");
+	const updateStrategy = readNullableString(value, "update_strategy");
+	if (platform !== "ios" && platform !== "android" || !((type === "UPDATE_APPLIED" || type === "RECOVERED" || type === "RELEASE_ADOPTED") && typeof fromBundleId === "string" && (updateStrategy === "fingerprint" || updateStrategy === "appVersion") || type === "UNCHANGED" && fromBundleId === null && updateStrategy === null)) throw new PrismaAdapterError("invalid event shape");
+	return {
+		id: readString(value, "id"),
+		type,
+		install_id: readString(value, "install_id"),
+		user_id: readNullableString(value, "user_id"),
+		username: readNullableString(value, "username"),
+		from_release_id: readNullableString(value, "from_release_id"),
+		from_bundle_id: fromBundleId,
+		to_release_id: readNullableString(value, "to_release_id"),
+		to_bundle_id: readString(value, "to_bundle_id"),
+		platform,
+		app_version: readString(value, "app_version"),
+		channel: readString(value, "channel"),
+		cohort: readString(value, "cohort"),
+		update_strategy: updateStrategy,
+		fingerprint_hash: readNullableString(value, "fingerprint_hash"),
+		sdk_version: readNullableString(value, "sdk_version"),
+		received_at_ms: readNumber(value, "received_at_ms")
+	};
+};
+const parsePrismaApiKeyRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid API key row");
+	const role = readString(value, "role");
+	if (role !== "client") throw new PrismaAdapterError("invalid API key role");
+	const revokedAt = value["revoked_at_ms"];
+	return {
+		id: readString(value, "id"),
+		hash: readString(value, "hash"),
+		name: readString(value, "name"),
+		prefix: readString(value, "prefix"),
+		role,
+		created_at_ms: readNumber(value, "created_at_ms"),
+		revoked_at_ms: revokedAt === null ? null : readNumber(value, "revoked_at_ms")
+	};
+};
+const parsePrismaReleaseRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid Release row");
+	const platform = readString(value, "platform");
+	const kind = readString(value, "kind");
+	const strategy = readString(value, "strategy");
+	const operation = readString(value, "operation");
+	const targetCohorts = value["target_cohorts"];
+	if (platform !== "ios" && platform !== "android" || kind !== "BUNDLE" && kind !== "EMBEDDED" || strategy !== "APP_VERSION" && strategy !== "FINGERPRINT" || operation !== "DEPLOY" && operation !== "PROMOTE" && operation !== "ROLLBACK" || !Array.isArray(targetCohorts) || !targetCohorts.every((cohort) => typeof cohort === "string")) throw new PrismaAdapterError("invalid Release fields");
+	const enabled = value["enabled"];
+	const shouldForceUpdate = value["should_force_update"];
+	if (typeof enabled !== "boolean" || typeof shouldForceUpdate !== "boolean") throw new PrismaAdapterError("invalid Release policy fields");
+	return {
+		bundle_id: readNullableString(value, "bundle_id"),
+		channel_id: readString(value, "channel_id"),
+		created_at_ms: readNumber(value, "created_at_ms"),
+		enabled,
+		fingerprint_hash: readNullableString(value, "fingerprint_hash"),
+		id: readString(value, "id"),
+		kind,
+		message: readNullableString(value, "message"),
+		operation,
+		platform,
+		revision: readNumber(value, "revision"),
+		rollout_cohort_count: readNumber(value, "rollout_cohort_count"),
+		scope_key: readString(value, "scope_key"),
+		should_force_update: shouldForceUpdate,
+		source_release_id: readNullableString(value, "source_release_id"),
+		strategy,
+		target_app_version: readNullableString(value, "target_app_version"),
+		target_cohorts: targetCohorts,
+		updated_at_ms: readNumber(value, "updated_at_ms")
+	};
+};
+const parsePrismaReleaseCatalogRow = (value) => {
+	if (!isRecord(value)) throw new PrismaAdapterError("invalid catalog row");
+	const platform = readString(value, "platform");
+	const strategy = readString(value, "strategy");
+	const isTombstone = value["is_tombstone"];
+	if (platform !== "ios" && platform !== "android" || strategy !== "APP_VERSION" && strategy !== "FINGERPRINT" || typeof isTombstone !== "boolean") throw new PrismaAdapterError("invalid catalog fields");
+	return {
+		catalog_id: readString(value, "catalog_id"),
+		byte_size: readNumber(value, "byte_size"),
+		catalog_hash: readString(value, "catalog_hash"),
+		channel_id: readString(value, "channel_id"),
+		channel_key: readString(value, "channel_key"),
+		fingerprint_hash: readNullableString(value, "fingerprint_hash"),
+		generation: readNumber(value, "generation"),
+		is_tombstone: isTombstone,
+		payload: readString(value, "payload"),
+		platform,
+		scope_key: readString(value, "scope_key"),
+		strategy,
+		updated_at_ms: readNumber(value, "updated_at_ms")
+	};
+};
+const parsePrismaRows = (rows, parse) => rows.map(parse);
+//#endregion
+export { PrismaAdapterError, getPrismaDelegate, parsePrismaApiKeyRow, parsePrismaBundleEventRow, parsePrismaBundleRow, parsePrismaChannelRow, parsePrismaPatchRow, parsePrismaReleaseCatalogRow, parsePrismaReleaseRow, parsePrismaRows };

package/dist/apiKeys.cjs

@@ -0,0 +1,139 @@
+//#region src/apiKeys.ts
+const API_KEY_HEADER_NAME = "x-api-key";
+const BASE64URL_32_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
+const bytesToBase64Url = (bytes) => {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+};
+const isApiKey = (value) => {
+	if (!BASE64URL_32_PATTERN.test(value)) return false;
+	try {
+		const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+		const binary = atob(`${base64}=`);
+		const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+		return bytes.byteLength === 32 && bytesToBase64Url(bytes) === value;
+	} catch {
+		return false;
+	}
+};
+const normalizeApiKeyHeaderName = (value = API_KEY_HEADER_NAME) => {
+	if (typeof value !== "string" || value.length === 0) throw new TypeError("clientAccess.headerName must be a valid header name.");
+	try {
+		const headers = new Headers();
+		headers.set(value, "");
+		return headers.keys().next().value;
+	} catch {
+		throw new TypeError("clientAccess.headerName must be a valid header name.");
+	}
+};
+const hashApiKey = async (apiKey) => {
+	if (!isApiKey(apiKey)) throw new TypeError("API key must be a canonical 32-byte base64url value.");
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(apiKey));
+	return bytesToBase64Url(new Uint8Array(digest));
+};
+const apiKeyId = () => {
+	const bytes = new Uint8Array(16);
+	crypto.getRandomValues(bytes);
+	return `api-${bytesToBase64Url(bytes)}`;
+};
+const normalizeApiKeyName = (name) => {
+	const normalized = name.trim();
+	if (normalized.length === 0 || normalized.length > 64 || /[\p{Cc}\p{Cf}]/u.test(normalized)) throw new TypeError("API key names must contain 1-64 visible characters.");
+	return normalized;
+};
+const toApiKeyMetadata = ({ hash: _hash, ...metadata }) => Object.freeze(metadata);
+const registerApiKey = async (input) => {
+	const hash = await hashApiKey(input.apiKey);
+	const createdAtMs = input.createdAtMs ?? Date.now();
+	if (!Number.isSafeInteger(createdAtMs) || createdAtMs < 0) throw new TypeError("API key creation time must be non-negative.");
+	const record = Object.freeze({
+		created_at_ms: createdAtMs,
+		hash,
+		id: apiKeyId(),
+		name: normalizeApiKeyName(input.name),
+		prefix: input.apiKey.slice(0, 6),
+		revoked_at_ms: null,
+		role: "client"
+	});
+	if (await input.apiKeys.create(record) === "existing") {
+		const existing = await input.apiKeys.findByHash(hash);
+		if (existing === null || existing.revoked_at_ms !== null) throw new Error("The API key has been revoked.");
+		return Object.freeze({
+			apiKey: input.apiKey,
+			record: toApiKeyMetadata(existing)
+		});
+	}
+	return Object.freeze({
+		apiKey: input.apiKey,
+		record: toApiKeyMetadata(record)
+	});
+};
+const createApiKey = (input) => {
+	const bytes = new Uint8Array(32);
+	crypto.getRandomValues(bytes);
+	return registerApiKey({
+		apiKey: bytesToBase64Url(bytes),
+		apiKeys: input.apiKeys,
+		name: input.name
+	});
+};
+/**
+* Provisions the client API key used by managed init.
+*
+* A saved plaintext key is registered idempotently; otherwise a new key is
+* created. Callers must persist or display the returned plaintext because the
+* database stores only its hash.
+*/
+const provisionApiKey = (input) => {
+	const existingApiKey = input.existingApiKey?.trim();
+	return existingApiKey ? registerApiKey({
+		apiKey: existingApiKey,
+		apiKeys: input.apiKeys,
+		name: input.name
+	}) : createApiKey({
+		apiKeys: input.apiKeys,
+		name: input.name
+	});
+};
+const authenticateApiKey = async (input) => {
+	const apiKey = input.request.headers.get(normalizeApiKeyHeaderName(input.headerName));
+	if (apiKey === null || !isApiKey(apiKey)) return false;
+	const hash = await hashApiKey(apiKey);
+	await input.beforeLookup?.();
+	const record = await input.apiKeys.findByHash(hash);
+	return record !== null && record.hash === hash && record.role === "client" && record.revoked_at_ms === null;
+};
+const createApiKeyManagement = (input) => Object.freeze({
+	async create({ name }) {
+		await input.beforeOperation();
+		const created = await createApiKey({
+			apiKeys: input.apiKeys,
+			name
+		});
+		return Object.freeze({
+			apiKey: created.apiKey,
+			record: created.record
+		});
+	},
+	async list() {
+		await input.beforeOperation();
+		return Object.freeze((await input.apiKeys.list()).map(toApiKeyMetadata));
+	},
+	async revoke({ id }) {
+		await input.beforeOperation();
+		const record = await input.apiKeys.revoke({
+			id,
+			revokedAtMs: Date.now()
+		});
+		return record === null ? null : toApiKeyMetadata(record);
+	}
+});
+//#endregion
+exports.API_KEY_HEADER_NAME = API_KEY_HEADER_NAME;
+exports.authenticateApiKey = authenticateApiKey;
+exports.createApiKey = createApiKey;
+exports.createApiKeyManagement = createApiKeyManagement;
+exports.normalizeApiKeyHeaderName = normalizeApiKeyHeaderName;
+exports.provisionApiKey = provisionApiKey;
+exports.registerApiKey = registerApiKey;

package/dist/apiKeys.d.cts

@@ -0,0 +1,50 @@
+import { ApiKeyModel, ApiKeyRow } from "@hot-updater/plugin-core";
+
+//#region src/apiKeys.d.ts
+declare const API_KEY_HEADER_NAME = "x-api-key";
+type ApiKeyMetadata = Omit<ApiKeyRow, "hash">;
+interface CreatedApiKey {
+  /** Plaintext credential. It cannot be recovered after this call returns. */
+  readonly apiKey: string;
+  /** Non-secret metadata. The persisted SHA-256 hash is never exposed. */
+  readonly record: ApiKeyMetadata;
+}
+interface ApiKeyManagementAPI {
+  /** Creates an API key and returns its plaintext exactly once. */
+  create(input: {
+    readonly name: string;
+  }): Promise<{
+    readonly apiKey: string;
+    readonly record: ApiKeyMetadata;
+  }>;
+  /** Lists non-secret API key metadata, including revoked keys. */
+  list(): Promise<readonly ApiKeyMetadata[]>;
+  /** Revokes an API key immediately and returns only non-secret metadata. */
+  revoke(input: {
+    readonly id: string;
+  }): Promise<ApiKeyMetadata | null>;
+}
+declare const registerApiKey: (input: {
+  readonly apiKey: string;
+  readonly apiKeys: ApiKeyModel;
+  readonly createdAtMs?: number;
+  readonly name: string;
+}) => Promise<CreatedApiKey>;
+declare const createApiKey: (input: {
+  readonly apiKeys: ApiKeyModel;
+  readonly name: string;
+}) => Promise<CreatedApiKey>;
+/**
+ * Provisions the client API key used by managed init.
+ *
+ * A saved plaintext key is registered idempotently; otherwise a new key is
+ * created. Callers must persist or display the returned plaintext because the
+ * database stores only its hash.
+ */
+declare const provisionApiKey: (input: {
+  readonly apiKeys: ApiKeyModel;
+  readonly existingApiKey?: string;
+  readonly name: string;
+}) => Promise<CreatedApiKey>;
+//#endregion
+export { API_KEY_HEADER_NAME, ApiKeyManagementAPI, ApiKeyMetadata, CreatedApiKey, createApiKey, provisionApiKey, registerApiKey };

package/dist/apiKeys.d.mts

@@ -0,0 +1,50 @@
+import { ApiKeyModel, ApiKeyRow } from "@hot-updater/plugin-core";
+
+//#region src/apiKeys.d.ts
+declare const API_KEY_HEADER_NAME = "x-api-key";
+type ApiKeyMetadata = Omit<ApiKeyRow, "hash">;
+interface CreatedApiKey {
+  /** Plaintext credential. It cannot be recovered after this call returns. */
+  readonly apiKey: string;
+  /** Non-secret metadata. The persisted SHA-256 hash is never exposed. */
+  readonly record: ApiKeyMetadata;
+}
+interface ApiKeyManagementAPI {
+  /** Creates an API key and returns its plaintext exactly once. */
+  create(input: {
+    readonly name: string;
+  }): Promise<{
+    readonly apiKey: string;
+    readonly record: ApiKeyMetadata;
+  }>;
+  /** Lists non-secret API key metadata, including revoked keys. */
+  list(): Promise<readonly ApiKeyMetadata[]>;
+  /** Revokes an API key immediately and returns only non-secret metadata. */
+  revoke(input: {
+    readonly id: string;
+  }): Promise<ApiKeyMetadata | null>;
+}
+declare const registerApiKey: (input: {
+  readonly apiKey: string;
+  readonly apiKeys: ApiKeyModel;
+  readonly createdAtMs?: number;
+  readonly name: string;
+}) => Promise<CreatedApiKey>;
+declare const createApiKey: (input: {
+  readonly apiKeys: ApiKeyModel;
+  readonly name: string;
+}) => Promise<CreatedApiKey>;
+/**
+ * Provisions the client API key used by managed init.
+ *
+ * A saved plaintext key is registered idempotently; otherwise a new key is
+ * created. Callers must persist or display the returned plaintext because the
+ * database stores only its hash.
+ */
+declare const provisionApiKey: (input: {
+  readonly apiKeys: ApiKeyModel;
+  readonly existingApiKey?: string;
+  readonly name: string;
+}) => Promise<CreatedApiKey>;
+//#endregion
+export { API_KEY_HEADER_NAME, ApiKeyManagementAPI, ApiKeyMetadata, CreatedApiKey, createApiKey, provisionApiKey, registerApiKey };