@indecisivedev/openplan 0.2.0-alpha.2

package/dist/shoo.js

@@ -0,0 +1,92 @@
+import { createHash } from "node:crypto";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { config } from "./config.js";
+import { randomToken } from "./crypto.js";
+// shoo (shoo.dev) protocol facts, extracted from its source:
+// - Clients are auto-registered by redirect_uri origin; client_id is always
+//   derived as `origin:<origin>` and never needs a secret.
+// - /authorize requires redirect_uri, state, code_challenge (S256 only).
+// - /token takes application/x-www-form-urlencoded, and redirect_uri must be
+//   byte-identical to the one sent to /authorize. Codes are single-use, 120s.
+// - The id_token is ES256; aud is `origin:<origin>`; the stable per-site user
+//   id is `pairwise_sub` (deterministic, survives revoke + re-auth).
+// - The only error shoo redirects back is ?error=access_denied — everything
+//   else renders on shoo itself.
+let jwksCache = null;
+let issuerCache = null;
+export function buildPkce() {
+    const verifier = randomToken(32);
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    return { verifier, challenge, state: randomToken(24) };
+}
+export function buildAuthorizeUrl({ redirectUri, state, challenge }) {
+    const url = new URL(`${config.shooBaseUrl}/authorize`);
+    url.searchParams.set("redirect_uri", redirectUri);
+    url.searchParams.set("state", state);
+    url.searchParams.set("code_challenge", challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    // Request profile claims (email/email_verified/name/picture/pii_sub). shoo
+    // shows a one-time consent screen per user; declining it denies the sign-in.
+    url.searchParams.set("pii", "true");
+    return url.toString();
+}
+export async function exchangeCode({ code, verifier, redirectUri }) {
+    const response = await fetch(`${config.shooBaseUrl}/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            grant_type: "authorization_code",
+            redirect_uri: redirectUri,
+            code,
+            code_verifier: verifier
+        }),
+        signal: AbortSignal.timeout(10_000)
+    });
+    const parsed = await response.json().catch(() => ({}));
+    const body = parsed && typeof parsed === "object" ? parsed : {};
+    if (!response.ok) {
+        throw new Error(`shoo token exchange failed: ${String(body.error || response.status)}`);
+    }
+    if (typeof body.id_token !== "string") {
+        throw new Error("shoo token exchange returned no id_token.");
+    }
+    return body;
+}
+// Verifies the ES256 id_token against shoo's JWKS and returns its claims.
+// audOrigin must be this deployment's public origin (e.g. https://openplan.dev).
+export async function verifyIdToken(idToken, { audOrigin }) {
+    const audience = `origin:${new URL(audOrigin).origin}`;
+    const { payload } = await jwtVerify(idToken, getJwks(), {
+        issuer: await getIssuer(),
+        audience,
+        algorithms: ["ES256"]
+    });
+    if (typeof payload.pairwise_sub !== "string" || !payload.pairwise_sub) {
+        throw new Error("shoo id_token is missing pairwise_sub.");
+    }
+    return payload;
+}
+function getJwks() {
+    jwksCache ||= createRemoteJWKSet(new URL(`${config.shooBaseUrl}/.well-known/jwks.json`));
+    return jwksCache;
+}
+// The issuer string is whatever shoo's discovery document says (it may differ
+// from the base URL), so fetch it once instead of assuming.
+async function getIssuer() {
+    issuerCache ||= (async () => {
+        const response = await fetch(`${config.shooBaseUrl}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(10_000) });
+        if (!response.ok) {
+            throw new Error(`shoo discovery failed: ${response.status}`);
+        }
+        const body = await response.json();
+        if (!body || typeof body !== "object" || typeof body.issuer !== "string") {
+            throw new Error("shoo discovery document has no issuer.");
+        }
+        return body.issuer;
+    })().catch((error) => {
+        issuerCache = null;
+        throw error;
+    });
+    return issuerCache;
+}
+//# sourceMappingURL=shoo.js.map

package/dist/shoo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shoo.js","sourceRoot":"","sources":["../src/shoo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,6DAA6D;AAC7D,4EAA4E;AAC5E,2DAA2D;AAC3D,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,qEAAqE;AACrE,4EAA4E;AAC5E,iCAAiC;AAEjC,IAAI,SAAS,GAAiD,IAAI,CAAC;AACnE,IAAI,WAAW,GAA2B,IAAI,CAAC;AAc/C,MAAM,UAAU,SAAS;IACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAChC,WAAW,EACX,KAAK,EACL,SAAS,EAKV;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,YAAY,CAAC,CAAC;IACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IACtD,2EAA2E;IAC3E,6EAA6E;IAC7E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EACjC,IAAI,EACJ,QAAQ,EACR,WAAW,EAKZ;IACC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,WAAW,QAAQ,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,WAAW;YACzB,IAAI;YACJ,aAAa,EAAE,QAAQ;SACxB,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAyB,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,EAAE,SAAS,EAAyB;IAEpC,MAAM,QAAQ,GAAG,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QACtD,MAAM,EAAE,MAAM,SAAS,EAAE;QACzB,QAAQ;QACR,UAAU,EAAE,CAAC,OAAO,CAAC;KACtB,CAAC,CAAC;IACH,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,OAAqB,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO;IACd,SAAS,KAAK,kBAAkB,CAC9B,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,wBAAwB,CAAC,CACvD,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAC5D,KAAK,UAAU,SAAS;IACtB,WAAW,KAAK,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,MAAM,CAAC,WAAW,mCAAmC,EACxD,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACxC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAAgC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtG,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAQ,IAA2B,CAAC,MAAM,CAAC;IAC7C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACnB,WAAW,GAAG,IAAI,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/sqlite-migrations.d.ts

@@ -0,0 +1,6 @@
+export interface SqliteMigration {
+    version: number;
+    name: string;
+    sql: string;
+}
+export declare const sqliteMigrations: SqliteMigration[];

package/dist/sqlite-migrations.js

@@ -0,0 +1,214 @@
+export const sqliteMigrations = [
+    {
+        version: 1,
+        name: "initial-self-hosted-schema",
+        sql: `
+      CREATE TABLE accounts (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        is_admin INTEGER NOT NULL DEFAULT 0 CHECK (is_admin IN (0, 1)),
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      CREATE TABLE draft_access_policies (
+        id TEXT PRIMARY KEY,
+        mode TEXT NOT NULL CHECK (mode IN ('private', 'password', 'public')),
+        password_algorithm TEXT,
+        password_iterations INTEGER,
+        password_salt TEXT,
+        password_hash TEXT,
+        credential_revision INTEGER NOT NULL DEFAULT 1,
+        created_by_account_id TEXT NOT NULL REFERENCES accounts(id),
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        CHECK (
+          (mode = 'password' AND password_algorithm IS NOT NULL AND password_iterations IS NOT NULL
+            AND password_salt IS NOT NULL AND password_hash IS NOT NULL)
+          OR
+          (mode <> 'password' AND password_algorithm IS NULL AND password_iterations IS NULL
+            AND password_salt IS NULL AND password_hash IS NULL)
+        )
+      );
+
+      CREATE TABLE api_keys (
+        id TEXT PRIMARY KEY,
+        account_id TEXT NOT NULL REFERENCES accounts(id),
+        name TEXT NOT NULL,
+        key_hash TEXT NOT NULL UNIQUE,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        last_used_at TEXT,
+        revoked_at TEXT
+      );
+
+      CREATE TABLE drafts (
+        id TEXT PRIMARY KEY,
+        account_id TEXT NOT NULL REFERENCES accounts(id),
+        title TEXT NOT NULL,
+        description TEXT,
+        current_version_id TEXT,
+        repo_org TEXT,
+        repo_name TEXT,
+        repo_host TEXT,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        deleted_at TEXT,
+        disabled_at TEXT,
+        disabled_reason TEXT,
+        default_access_policy_id TEXT REFERENCES draft_access_policies(id)
+      );
+
+      CREATE TABLE draft_versions (
+        id TEXT PRIMARY KEY,
+        draft_id TEXT NOT NULL REFERENCES drafts(id),
+        version_number INTEGER NOT NULL,
+        object_key TEXT NOT NULL,
+        content_hash TEXT NOT NULL,
+        file_size INTEGER NOT NULL,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        created_by_api_key_id TEXT NOT NULL REFERENCES api_keys(id),
+        source_ip TEXT,
+        user_agent TEXT,
+        cli_version TEXT,
+        git_branch TEXT,
+        git_commit_sha TEXT,
+        git_commit_subject TEXT,
+        git_dirty INTEGER,
+        original_filename TEXT,
+        request_id TEXT,
+        has_inline_script INTEGER,
+        external_image_hosts TEXT,
+        ci_run_url TEXT,
+        ci_actor TEXT,
+        access_policy_id TEXT REFERENCES draft_access_policies(id),
+        UNIQUE (draft_id, version_number)
+      );
+
+      CREATE TABLE upload_events (
+        id TEXT PRIMARY KEY,
+        draft_id TEXT NOT NULL REFERENCES drafts(id),
+        draft_version_id TEXT REFERENCES draft_versions(id),
+        api_key_id TEXT NOT NULL REFERENCES api_keys(id),
+        event_type TEXT NOT NULL,
+        source_ip TEXT,
+        user_agent TEXT,
+        metadata_json TEXT NOT NULL DEFAULT '{}',
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      CREATE TABLE identities (
+        id TEXT PRIMARY KEY,
+        account_id TEXT NOT NULL REFERENCES accounts(id),
+        provider TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        email TEXT,
+        email_verified INTEGER,
+        display_name TEXT,
+        picture_url TEXT,
+        pii_subject TEXT,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        last_login_at TEXT,
+        UNIQUE (provider, subject)
+      );
+
+      CREATE TABLE local_credentials (
+        account_id TEXT PRIMARY KEY REFERENCES accounts(id) ON DELETE CASCADE,
+        username TEXT NOT NULL,
+        username_normalized TEXT NOT NULL UNIQUE,
+        password_algorithm TEXT NOT NULL,
+        password_salt TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        password_parameters TEXT NOT NULL,
+        session_version INTEGER NOT NULL DEFAULT 1,
+        failed_attempts INTEGER NOT NULL DEFAULT 0,
+        locked_until TEXT,
+        password_changed_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      CREATE TABLE local_auth_events (
+        id TEXT PRIMARY KEY,
+        account_id TEXT REFERENCES accounts(id),
+        username_normalized TEXT,
+        event_type TEXT NOT NULL,
+        source_ip TEXT,
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      CREATE TABLE account_access_grants (
+        viewer_account_id TEXT NOT NULL REFERENCES accounts(id),
+        resource_account_id TEXT NOT NULL REFERENCES accounts(id),
+        created_by_api_key_id TEXT NOT NULL REFERENCES api_keys(id),
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        PRIMARY KEY (viewer_account_id, resource_account_id),
+        CHECK (viewer_account_id <> resource_account_id)
+      );
+
+      CREATE TABLE access_policy_events (
+        id TEXT PRIMARY KEY,
+        draft_id TEXT NOT NULL REFERENCES drafts(id),
+        draft_version_id TEXT REFERENCES draft_versions(id),
+        actor_account_id TEXT NOT NULL REFERENCES accounts(id),
+        actor_api_key_id TEXT REFERENCES api_keys(id),
+        previous_mode TEXT,
+        new_mode TEXT NOT NULL,
+        policy_id TEXT REFERENCES draft_access_policies(id),
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      CREATE TABLE site_settings (
+        key TEXT PRIMARY KEY,
+        enabled INTEGER NOT NULL CHECK (enabled IN (0, 1)),
+        updated_by_account_id TEXT NOT NULL REFERENCES accounts(id),
+        updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      CREATE TABLE admin_events (
+        id TEXT PRIMARY KEY,
+        actor_account_id TEXT NOT NULL REFERENCES accounts(id),
+        event_type TEXT NOT NULL,
+        setting_key TEXT NOT NULL,
+        previous_enabled INTEGER CHECK (previous_enabled IS NULL OR previous_enabled IN (0, 1)),
+        new_enabled INTEGER NOT NULL CHECK (new_enabled IN (0, 1)),
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+      );
+
+      CREATE INDEX draft_versions_draft_id_idx ON draft_versions(draft_id);
+      CREATE INDEX upload_events_draft_id_idx ON upload_events(draft_id);
+      CREATE INDEX drafts_account_id_idx ON drafts(account_id);
+      CREATE INDEX account_access_grants_resource_idx ON account_access_grants(resource_account_id, viewer_account_id);
+      CREATE INDEX access_policy_events_draft_idx ON access_policy_events(draft_id, created_at DESC);
+      CREATE INDEX admin_events_setting_idx ON admin_events(setting_key, created_at DESC);
+      CREATE INDEX local_auth_events_account_idx ON local_auth_events(account_id, created_at DESC);
+    `
+    },
+    {
+        version: 2,
+        name: "durable-upload-state",
+        sql: `
+      ALTER TABLE draft_versions ADD COLUMN status TEXT NOT NULL DEFAULT 'ready'
+        CHECK (status IN ('pending', 'ready', 'failed'));
+      ALTER TABLE draft_versions ADD COLUMN failure_reason TEXT;
+      ALTER TABLE draft_versions ADD COLUMN finalized_at TEXT;
+      ALTER TABLE draft_versions ADD COLUMN draft_metadata_json TEXT;
+      CREATE INDEX draft_versions_status_idx ON draft_versions(status, created_at);
+    `
+    },
+    {
+        version: 3,
+        name: "access-policy-event-details",
+        sql: `
+      ALTER TABLE access_policy_events ADD COLUMN credential_revision INTEGER;
+      ALTER TABLE access_policy_events ADD COLUMN request_id TEXT;
+    `
+    },
+    {
+        version: 4,
+        name: "api-key-lineage",
+        sql: `
+      ALTER TABLE api_keys ADD COLUMN parent_api_key_id TEXT REFERENCES api_keys(id);
+      CREATE INDEX api_keys_parent_idx ON api_keys(parent_api_key_id);
+    `
+    }
+];
+//# sourceMappingURL=sqlite-migrations.js.map

package/dist/sqlite-migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-migrations.js","sourceRoot":"","sources":["../src/sqlite-migrations.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,4BAA4B;QAClC,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAkLJ;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,sBAAsB;QAC5B,GAAG,EAAE;;;;;;;KAOJ;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,6BAA6B;QACnC,GAAG,EAAE;;;KAGJ;KACF;IACD;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,iBAAiB;QACvB,GAAG,EAAE;;;KAGJ;KACF;CACF,CAAC"}

package/dist/storage.d.ts

@@ -0,0 +1,14 @@
+export interface DraftObjectStore {
+    putHtml(key: string, html: string): Promise<void>;
+    getHtml(key: string): Promise<string>;
+    exists(key: string): Promise<boolean>;
+    delete(key: string): Promise<void>;
+    probe(): Promise<void>;
+}
+export declare const draftObjectStore: DraftObjectStore;
+export declare function assertStorageConfigured(): void;
+export declare function putHtmlObject(key: string, html: string): Promise<void>;
+export declare function getHtmlObject(key: string): Promise<string>;
+export declare function objectExists(key: string): Promise<boolean>;
+export declare function deleteHtmlObject(key: string): Promise<void>;
+export declare function probeStorage(): Promise<void>;

package/dist/storage.js

@@ -0,0 +1,86 @@
+import { DeleteObjectCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { config, requireEnv } from "./config.js";
+class S3DraftObjectStore {
+    client;
+    async putHtml(key, html) {
+        await this.getClient().send(new PutObjectCommand({
+            Bucket: bucketName(),
+            Key: key,
+            Body: html,
+            ContentType: "text/html; charset=utf-8",
+            CacheControl: "no-store"
+        }));
+    }
+    async getHtml(key) {
+        const result = await this.getClient().send(new GetObjectCommand({
+            Bucket: bucketName(),
+            Key: key
+        }));
+        if (!result.Body)
+            throw new Error(`Stored HTML object has no body: ${key}`);
+        return result.Body.transformToString("utf-8");
+    }
+    async exists(key) {
+        try {
+            await this.getClient().send(new HeadObjectCommand({ Bucket: bucketName(), Key: key }));
+            return true;
+        }
+        catch (error) {
+            const status = error.$metadata?.httpStatusCode;
+            if (status === 404)
+                return false;
+            throw error;
+        }
+    }
+    async delete(key) {
+        await this.getClient().send(new DeleteObjectCommand({ Bucket: bucketName(), Key: key }));
+    }
+    async probe() {
+        await this.getClient().send(new HeadBucketCommand({ Bucket: bucketName() }));
+    }
+    getClient() {
+        if (this.client)
+            return this.client;
+        this.client = new S3Client({
+            endpoint: requireEnv("AWS_ENDPOINT_URL", config.s3.endpoint),
+            region: requireEnv("AWS_DEFAULT_REGION", config.s3.region),
+            forcePathStyle: config.s3.forcePathStyle,
+            credentials: {
+                accessKeyId: requireEnv("AWS_ACCESS_KEY_ID", config.s3.accessKeyId),
+                secretAccessKey: requireEnv("AWS_SECRET_ACCESS_KEY", config.s3.secretAccessKey)
+            }
+        });
+        return this.client;
+    }
+}
+export const draftObjectStore = new S3DraftObjectStore();
+export function assertStorageConfigured() {
+    requireEnv("AWS_ENDPOINT_URL", config.s3.endpoint);
+    requireEnv("AWS_ACCESS_KEY_ID", config.s3.accessKeyId);
+    requireEnv("AWS_SECRET_ACCESS_KEY", config.s3.secretAccessKey);
+    requireEnv("AWS_S3_BUCKET_NAME", config.s3.bucketName);
+}
+export async function putHtmlObject(key, html) {
+    assertStorageConfigured();
+    await draftObjectStore.putHtml(key, html);
+}
+export async function getHtmlObject(key) {
+    assertStorageConfigured();
+    return draftObjectStore.getHtml(key);
+}
+export async function objectExists(key) {
+    assertStorageConfigured();
+    return draftObjectStore.exists(key);
+}
+export async function deleteHtmlObject(key) {
+    assertStorageConfigured();
+    await draftObjectStore.delete(key);
+}
+export async function probeStorage() {
+    assertStorageConfigured();
+    await draftObjectStore.probe();
+}
+function bucketName() {
+    return requireEnv("AWS_S3_BUCKET_NAME", config.s3.bucketName);
+}
+//# sourceMappingURL=storage.js.map

package/dist/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,QAAQ,EACT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUjD,MAAM,kBAAkB;IACd,MAAM,CAAuB;IAErC,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAY;QACrC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;YAC/C,MAAM,EAAE,UAAU,EAAE;YACpB,GAAG,EAAE,GAAG;YACR,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,0BAA0B;YACvC,YAAY,EAAE,UAAU;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;YAC9D,MAAM,EAAE,UAAU,EAAE;YACpB,GAAG,EAAE,GAAG;SACT,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAI,KAAqD,CAAC,SAAS,EAAE,cAAc,CAAC;YAChG,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IAEO,SAAS;QACf,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,CAAC;YACzB,QAAQ,EAAE,UAAU,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;YAC5D,MAAM,EAAE,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC;YAC1D,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,cAAc;YACxC,WAAW,EAAE;gBACX,WAAW,EAAE,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC;gBACnE,eAAe,EAAE,UAAU,CAAC,uBAAuB,EAAE,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC;aAChF;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAqB,IAAI,kBAAkB,EAAE,CAAC;AAE3E,MAAM,UAAU,uBAAuB;IACrC,UAAU,CAAC,kBAAkB,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IACnD,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;IACvD,UAAU,CAAC,uBAAuB,EAAE,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;IAC/D,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,IAAY;IAC3D,uBAAuB,EAAE,CAAC;IAC1B,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,uBAAuB,EAAE,CAAC;IAC1B,OAAO,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,uBAAuB,EAAE,CAAC;IAC1B,OAAO,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,uBAAuB,EAAE,CAAC;IAC1B,MAAM,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,uBAAuB,EAAE,CAAC;IAC1B,MAAM,gBAAgB,CAAC,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;AAChE,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,24 @@
+export interface AuthContext {
+    /** Internal credential snapshot; never serialize or log. */
+    readonly keyHash: string;
+    id: string;
+    account_id: string;
+    name: string;
+    account_name: string;
+}
+export interface SessionPayload {
+    accountId: string;
+    accountName?: string;
+    email?: string | null;
+    pictureUrl?: string | null;
+    exp: number;
+    [key: string]: unknown;
+}
+declare global {
+    namespace Express {
+        interface Request {
+            auth: AuthContext;
+        }
+    }
+}
+export {};

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/upload-state.d.ts

@@ -0,0 +1,19 @@
+export interface PendingDraftMetadata {
+    title: string;
+    description: string | null;
+    repoOrg: string | null;
+    repoName: string | null;
+    repoHost: string | null;
+    eventType: "draft.created" | "draft.updated";
+    requestMetadata: Record<string, unknown>;
+}
+export declare function finalizeReservedVersion(versionId: string): Promise<boolean>;
+export declare function recordUploadWriteError(versionId: string, error: unknown): Promise<void>;
+export declare function reconcilePendingUploads({ olderThanMs, limit }?: {
+    olderThanMs?: number;
+    limit?: number;
+}): Promise<{
+    finalized: number;
+    failed: number;
+    pending: number;
+}>;

package/dist/upload-state.js

@@ -0,0 +1,118 @@
+import { pool, withTransaction } from "./db.js";
+import { newInternalId } from "./ids.js";
+import { objectExists } from "./storage.js";
+export async function finalizeReservedVersion(versionId) {
+    return withTransaction(async (client) => {
+        const result = await client.query("SELECT * FROM draft_versions WHERE id = $1 FOR UPDATE", [versionId]);
+        const version = result.rows[0];
+        if (!version || version.status === "failed")
+            return false;
+        if (version.status === "ready")
+            return true;
+        const metadata = parseMetadata(version.draft_metadata_json);
+        const current = await client.query(`
+        SELECT (
+          SELECT current_version.version_number
+          FROM draft_versions current_version
+          WHERE current_version.id = d.current_version_id
+        ) AS version_number
+        FROM drafts d
+        WHERE d.id = $1
+        FOR UPDATE
+        LIMIT 1
+      `, [version.draft_id]);
+        const currentVersionNumber = current.rows[0]?.version_number;
+        const advancesCurrent = currentVersionNumber === null || currentVersionNumber === undefined
+            || Number(currentVersionNumber) < Number(version.version_number);
+        await client.query(`
+        UPDATE draft_versions
+        SET status = 'ready', failure_reason = NULL, finalized_at = CURRENT_TIMESTAMP
+        WHERE id = $1
+      `, [version.id]);
+        if (advancesCurrent) {
+            await client.query(`
+          UPDATE drafts
+          SET current_version_id = $1,
+              title = $2,
+              description = COALESCE($3, description),
+              repo_org = COALESCE($4, repo_org),
+              repo_name = COALESCE($5, repo_name),
+              repo_host = COALESCE($6, repo_host),
+              updated_at = CURRENT_TIMESTAMP
+          WHERE id = $7
+        `, [
+                version.id,
+                metadata.title,
+                metadata.description,
+                metadata.repoOrg,
+                metadata.repoName,
+                metadata.repoHost,
+                version.draft_id
+            ]);
+        }
+        await client.query(`
+        INSERT INTO upload_events (
+          id, draft_id, draft_version_id, api_key_id, event_type,
+          source_ip, user_agent, metadata_json
+        ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+      `, [
+            newInternalId(),
+            version.draft_id,
+            version.id,
+            version.created_by_api_key_id,
+            metadata.eventType,
+            version.source_ip,
+            version.user_agent,
+            metadata.requestMetadata
+        ]);
+        return true;
+    });
+}
+export async function recordUploadWriteError(versionId, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    await pool.query("UPDATE draft_versions SET failure_reason = $1 WHERE id = $2 AND status = 'pending'", [message.slice(0, 1000), versionId]);
+}
+export async function reconcilePendingUploads({ olderThanMs = 60_000, limit = 100 } = {}) {
+    const cutoff = new Date(Date.now() - olderThanMs).toISOString();
+    const result = await pool.query(`
+      SELECT * FROM draft_versions
+      WHERE status = 'pending' AND created_at < $1
+      ORDER BY created_at ASC
+      LIMIT $2
+    `, [cutoff, limit]);
+    let finalized = 0;
+    let failed = 0;
+    let pending = 0;
+    for (const version of result.rows) {
+        try {
+            if (await objectExists(version.object_key)) {
+                if (await finalizeReservedVersion(version.id))
+                    finalized += 1;
+            }
+            else {
+                await pool.query(`
+            UPDATE draft_versions
+            SET status = 'failed',
+                failure_reason = COALESCE(failure_reason, 'Object was not found during reconciliation.'),
+                finalized_at = CURRENT_TIMESTAMP
+            WHERE id = $1 AND status = 'pending'
+          `, [version.id]);
+                failed += 1;
+            }
+        }
+        catch (error) {
+            await recordUploadWriteError(version.id, error);
+            pending += 1;
+        }
+    }
+    return { finalized, failed, pending };
+}
+function parseMetadata(value) {
+    if (!value)
+        throw new Error("Pending draft metadata is missing.");
+    const parsed = typeof value === "string" ? JSON.parse(value) : value;
+    if (!parsed.title || !parsed.eventType)
+        throw new Error("Pending draft metadata is invalid.");
+    return parsed;
+}
+//# sourceMappingURL=upload-state.js.map

package/dist/upload-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-state.js","sourceRoot":"","sources":["../src/upload-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAwB5C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAiB;IAC7D,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,uDAAuD,EACvD,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;;;;;;;;;;OAUC,EACD,CAAC,OAAO,CAAC,QAAQ,CAAC,CACnB,CAAC;QACF,MAAM,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC;QAC7D,MAAM,eAAe,GAAG,oBAAoB,KAAK,IAAI,IAAI,oBAAoB,KAAK,SAAS;eACtF,MAAM,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,KAAK,CAChB;;;;OAIC,EACD,CAAC,OAAO,CAAC,EAAE,CAAC,CACb,CAAC;QACF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;;;;;;SAUC,EACD;gBACE,OAAO,CAAC,EAAE;gBACV,QAAQ,CAAC,KAAK;gBACd,QAAQ,CAAC,WAAW;gBACpB,QAAQ,CAAC,OAAO;gBAChB,QAAQ,CAAC,QAAQ;gBACjB,QAAQ,CAAC,QAAQ;gBACjB,OAAO,CAAC,QAAQ;aACjB,CACF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;OAKC,EACD;YACE,aAAa,EAAE;YACf,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,EAAE;YACV,OAAO,CAAC,qBAAqB;YAC7B,QAAQ,CAAC,SAAS;YAClB,OAAO,CAAC,SAAS;YACjB,OAAO,CAAC,UAAU;YAClB,QAAQ,CAAC,eAAe;SACzB,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,SAAiB,EAAE,KAAc;IAC5E,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,IAAI,CAAC,KAAK,CACd,oFAAoF,EACpF,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,WAAW,GAAG,MAAM,EACpB,KAAK,GAAG,GAAG,KAIT,EAAE;IACJ,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;KAKC,EACD,CAAC,MAAM,EAAE,KAAK,CAAC,CAChB,CAAC;IACF,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3C,IAAI,MAAM,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;oBAAE,SAAS,IAAI,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,KAAK,CACd;;;;;;WAMC,EACD,CAAC,OAAO,CAAC,EAAE,CAAC,CACb,CAAC;gBACF,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YAChD,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,KAA2C;IAChE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAyB,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7F,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/web-auth.d.ts

@@ -0,0 +1,33 @@
+import type { Request } from "express";
+import type { SessionPayload } from "./types.js";
+export declare const SESSION_COOKIE = "openplan_session";
+export declare const AUTH_STATE_COOKIE = "openplan_auth_state";
+type SignedPayload = Record<string, unknown> & {
+    exp: number;
+};
+export interface AuthStatePayload extends SignedPayload {
+    state: string;
+    verifier: string;
+    next: string;
+    nonce?: string;
+    authProvider?: "shoo" | "oidc";
+    oidcBinding?: string;
+}
+export declare function signToken(payload: Record<string, unknown>, secret: string, ttlSeconds: number): string;
+export declare function verifyToken(token: unknown, secret: string): SignedPayload | null;
+export declare function createSessionCookie({ accountId, accountName, email, pictureUrl, authProvider, oidcBinding, sessionVersion }: {
+    accountId: string;
+    accountName: string;
+    email?: string | null;
+    pictureUrl?: string | null;
+    authProvider?: "shoo" | "local" | "oidc";
+    oidcBinding?: string;
+    sessionVersion?: number;
+}): string;
+export declare function clearSessionCookie(): string;
+export declare function createAuthStateCookie(payload: Omit<AuthStatePayload, "exp">): string;
+export declare function clearAuthStateCookie(): string;
+export declare function readSession(req: Request): SessionPayload | null;
+export declare function readAuthState(req: Request): AuthStatePayload | null;
+export declare function readCookie(req: Request, name: string): string | null;
+export {};