@plumix/core 0.1.0

package/dist/rpc/procedures/auth/credentials/rename.d.ts

@@ -0,0 +1,67 @@
+export declare const rename: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../../index.js").AppContext, import("../../../../index.js").AuthenticatedAppContext<typeof import("../../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+    readonly id: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, undefined>, import("valibot").MaxLengthAction<string, 1024, undefined>]>;
+    readonly name: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, "name must be non-empty">, import("valibot").MaxLengthAction<string, 64, "name must be ≤ 64 chars">, import("valibot").RegexAction<string, "name must not contain newlines">]>;
+}, undefined>, import("@orpc/server").Schema<{
+    id: string;
+    name: string | null;
+}, {
+    id: string;
+    name: string | null;
+}>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly BAD_REQUEST: {
+        readonly message: "Invalid input";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+            readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+        }, undefined>;
+    };
+    readonly CONFLICT: {
+        readonly message: "Resource conflict";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+            readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly PAYLOAD_TOO_LARGE: {
+        readonly message: "Payload too large";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly limit: import("valibot").NumberSchema<undefined>;
+            readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly UNSUPPORTED_MEDIA_TYPE: {
+        readonly message: "Unsupported media type";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly mime: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly INVALID_BLOCK_CONTENT: {
+        readonly message: "Block content failed registry validation";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly path: import("valibot").StringSchema<undefined>;
+                readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=rename.d.ts.map

package/dist/rpc/procedures/auth/credentials/rename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename.d.ts","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/credentials/rename.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA0Bf,CAAC"}

package/dist/rpc/procedures/auth/credentials/rename.js

@@ -0,0 +1,27 @@
+import { and, eq } from "../../../../db/index.js";
+import { credentials } from "../../../../db/schema/credentials.js";
+import { authenticated } from "../../../authenticated.js";
+import { base } from "../../../base.js";
+import { credentialsRenameInputSchema } from "./schemas.js";
+// Self-scoped: the WHERE clause pins both `id` and `userId`, so a user
+// can only rename their own credentials. Cross-user attempts return
+// NOT_FOUND with no oracle (same shape as a non-existent id).
+export const rename = base
+    .use(authenticated)
+    .input(credentialsRenameInputSchema)
+    .handler(async ({ input, context, errors }) => {
+    const [row] = await context.db
+        .update(credentials)
+        .set({ name: input.name })
+        .where(and(eq(credentials.id, input.id), eq(credentials.userId, context.user.id)))
+        .returning({
+        id: credentials.id,
+        name: credentials.name,
+    });
+    if (!row) {
+        throw errors.NOT_FOUND({ data: { kind: "credential", id: input.id } });
+    }
+    await context.hooks.doAction("credential:renamed", { id: row.id, userId: context.user.id }, { actor: context.user, name: row.name ?? "" });
+    return row;
+});
+//# sourceMappingURL=rename.js.map

package/dist/rpc/procedures/auth/credentials/rename.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename.js","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/credentials/rename.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAE5D,uEAAuE;AACvE,oEAAoE;AACpE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI;KACvB,GAAG,CAAC,aAAa,CAAC;KAClB,KAAK,CAAC,4BAA4B,CAAC;KACnC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE;SAC3B,MAAM,CAAC,WAAW,CAAC;SACnB,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAC5B,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CACxC,CACF;SACA,SAAS,CAAC;QACT,EAAE,EAAE,WAAW,CAAC,EAAE;QAClB,IAAI,EAAE,WAAW,CAAC,IAAI;KACvB,CAAC,CAAC;IACL,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAC1B,oBAAoB,EACpB,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EACvC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAC9C,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC,CAAC,CAAC"}

package/dist/rpc/procedures/auth/credentials/schemas.d.ts

@@ -0,0 +1,10 @@
+import * as v from "valibot";
+export declare const credentialsListInputSchema: v.OptionalSchema<v.ObjectSchema<{}, undefined>, {}>;
+export declare const credentialsRenameInputSchema: v.ObjectSchema<{
+    readonly id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 1024, undefined>]>;
+    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, "name must be non-empty">, v.MaxLengthAction<string, 64, "name must be ≤ 64 chars">, v.RegexAction<string, "name must not contain newlines">]>;
+}, undefined>;
+export declare const credentialsDeleteInputSchema: v.ObjectSchema<{
+    readonly id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 1024, undefined>]>;
+}, undefined>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/rpc/procedures/auth/credentials/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/credentials/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAwB7B,eAAO,MAAM,0BAA0B,qDAA+B,CAAC;AAEvE,eAAO,MAAM,4BAA4B;;;aAGvC,CAAC;AAEH,eAAO,MAAM,4BAA4B;;aAEvC,CAAC"}

package/dist/rpc/procedures/auth/credentials/schemas.js

@@ -0,0 +1,20 @@
+import * as v from "valibot";
+// Defensive bound on credential id values from the URL/body. WebAuthn
+// credential IDs are typically tens to a few hundred bytes; 1024 chars
+// of base64url-equivalent text is generous. Match the cap the passkey
+// register/login routes already use.
+const credentialIdSchema = v.pipe(v.string(), v.minLength(1), v.maxLength(1024));
+// Human-readable label shown in the credential list. CR/LF blocked
+// defense-in-depth — same rationale as `siteName` and login-link
+// labels: a future audit-log consumer could splice into a line-
+// oriented format.
+const credentialNameSchema = v.pipe(v.string(), v.trim(), v.minLength(1, "name must be non-empty"), v.maxLength(64, "name must be ≤ 64 chars"), v.regex(/^[^\r\n]+$/, "name must not contain newlines"));
+export const credentialsListInputSchema = v.optional(v.object({}), {});
+export const credentialsRenameInputSchema = v.object({
+    id: credentialIdSchema,
+    name: credentialNameSchema,
+});
+export const credentialsDeleteInputSchema = v.object({
+    id: credentialIdSchema,
+});
+//# sourceMappingURL=schemas.js.map

package/dist/rpc/procedures/auth/credentials/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/credentials/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,qCAAqC;AACrC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EACd,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAClB,CAAC;AAEF,mEAAmE;AACnE,iEAAiE;AACjE,gEAAgE;AAChE,mBAAmB;AACnB,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CACjC,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,wBAAwB,CAAC,EACxC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,yBAAyB,CAAC,EAC1C,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,gCAAgC,CAAC,CACxD,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,oBAAoB;CAC3B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,EAAE,EAAE,kBAAkB;CACvB,CAAC,CAAC"}

package/dist/rpc/procedures/auth/device-flow/approve.d.ts

@@ -0,0 +1,66 @@
+export declare const approve: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../../index.js").AppContext, import("../../../../index.js").AuthenticatedAppContext<typeof import("../../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+    readonly userCode: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").ToUpperCaseAction, import("valibot").TransformAction<string, string>, import("valibot").RegexAction<string, "user code must be 8 alphanum chars">]>;
+    readonly tokenName: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, "name must be non-empty">, import("valibot").MaxLengthAction<string, 64, "name must be ≤ 64 chars">, import("valibot").RegexAction<string, "name must not contain newlines">]>;
+    readonly scopes: import("valibot").OptionalSchema<import("valibot").UnionSchema<[import("valibot").NullSchema<undefined>, import("valibot").SchemaWithPipe<readonly [import("valibot").ArraySchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, "capability must be non-empty">, import("valibot").MaxLengthAction<string, 96, "capability must be ≤ 96 chars">, import("valibot").RegexAction<string, "capability uses [A-Za-z0-9_:.\\-*] only">]>, undefined>, import("valibot").MaxLengthAction<string[], 128, "≤ 128 scopes">]>], undefined>, null>;
+}, undefined>, import("@orpc/server").Schema<{
+    ok: true;
+}, {
+    ok: true;
+}>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly BAD_REQUEST: {
+        readonly message: "Invalid input";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+            readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+        }, undefined>;
+    };
+    readonly CONFLICT: {
+        readonly message: "Resource conflict";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+            readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly PAYLOAD_TOO_LARGE: {
+        readonly message: "Payload too large";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly limit: import("valibot").NumberSchema<undefined>;
+            readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly UNSUPPORTED_MEDIA_TYPE: {
+        readonly message: "Unsupported media type";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly mime: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly INVALID_BLOCK_CONTENT: {
+        readonly message: "Block content failed registry validation";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly path: import("valibot").StringSchema<undefined>;
+                readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=approve.d.ts.map

package/dist/rpc/procedures/auth/device-flow/approve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve.d.ts","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/device-flow/approve.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAwBhB,CAAC"}

package/dist/rpc/procedures/auth/device-flow/approve.js

@@ -0,0 +1,42 @@
+import { approveDeviceCode, lookupDeviceCodeByUserCode, } from "../../../../auth/device-flow.js";
+import { authenticated } from "../../../authenticated.js";
+import { base } from "../../../base.js";
+import { assertLookupOk } from "./lookup-helpers.js";
+import { deviceFlowApproveInputSchema } from "./schemas.js";
+// Approve a pending device-flow session. The browser-side authed user
+// confirms "yes, this is my CLI", optionally narrows scopes + names
+// the token that will be minted, and the server flips the row's
+// status to `approved` + binds `userId`. The polling client's next
+// call to the public token endpoint then atomically consumes the row
+// and returns the API token.
+//
+// Looks up first to surface specific error reasons (expired vs
+// already_approved vs already_denied vs not_found) — the underlying
+// `approveDeviceCode` primitive race-guards on `status = pending`,
+// so a code that flipped between this lookup and the update will
+// fall through and return `false`, which we don't currently
+// distinguish from the lookup outcomes; concurrent same-user
+// approve/approve is benign (idempotent) and concurrent
+// approve/deny is rare enough that the lookup-pre-check is
+// sufficient for the v0.1.0 UX.
+export const approve = base
+    .use(authenticated)
+    .input(deviceFlowApproveInputSchema)
+    .handler(async ({ input, context, errors }) => {
+    const found = await lookupDeviceCodeByUserCode(context.db, input.userCode);
+    const ok = assertLookupOk(found, input.userCode, errors);
+    await approveDeviceCode(context.db, {
+        id: ok.id,
+        userId: context.user.id,
+        tokenName: input.tokenName,
+        scopes: input.scopes,
+    });
+    await context.hooks.doAction("device_code:approved", {
+        id: ok.id,
+        userCode: input.userCode,
+        tokenName: input.tokenName,
+        scopes: input.scopes ?? null,
+    }, { actor: context.user });
+    return { ok: true };
+});
+//# sourceMappingURL=approve.js.map

package/dist/rpc/procedures/auth/device-flow/approve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve.js","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/device-flow/approve.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAE5D,sEAAsE;AACtE,oEAAoE;AACpE,gEAAgE;AAChE,mEAAmE;AACnE,qEAAqE;AACrE,6BAA6B;AAC7B,EAAE;AACF,+DAA+D;AAC/D,oEAAoE;AACpE,mEAAmE;AACnE,iEAAiE;AACjE,4DAA4D;AAC5D,6DAA6D;AAC7D,wDAAwD;AACxD,2DAA2D;AAC3D,gCAAgC;AAChC,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI;KACxB,GAAG,CAAC,aAAa,CAAC;KAClB,KAAK,CAAC,4BAA4B,CAAC;KACnC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5C,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEzD,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE;QAClC,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAC1B,sBAAsB,EACtB;QACE,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;KAC7B,EACD,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CACxB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;AAC/B,CAAC,CAAC,CAAC"}

package/dist/rpc/procedures/auth/device-flow/deny.d.ts

@@ -0,0 +1,64 @@
+export declare const deny: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../../index.js").AppContext, import("../../../../index.js").AuthenticatedAppContext<typeof import("../../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+    readonly userCode: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").ToUpperCaseAction, import("valibot").TransformAction<string, string>, import("valibot").RegexAction<string, "user code must be 8 alphanum chars">]>;
+}, undefined>, import("@orpc/server").Schema<{
+    ok: true;
+}, {
+    ok: true;
+}>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly BAD_REQUEST: {
+        readonly message: "Invalid input";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+            readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+        }, undefined>;
+    };
+    readonly CONFLICT: {
+        readonly message: "Resource conflict";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+            readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly PAYLOAD_TOO_LARGE: {
+        readonly message: "Payload too large";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly limit: import("valibot").NumberSchema<undefined>;
+            readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly UNSUPPORTED_MEDIA_TYPE: {
+        readonly message: "Unsupported media type";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly mime: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly INVALID_BLOCK_CONTENT: {
+        readonly message: "Block content failed registry validation";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly path: import("valibot").StringSchema<undefined>;
+                readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=deny.d.ts.map

package/dist/rpc/procedures/auth/device-flow/deny.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny.d.ts","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/device-flow/deny.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAcb,CAAC"}

package/dist/rpc/procedures/auth/device-flow/deny.js

@@ -0,0 +1,27 @@
+import { denyDeviceCode, lookupDeviceCodeByUserCode, } from "../../../../auth/device-flow.js";
+import { authenticated } from "../../../authenticated.js";
+import { base } from "../../../base.js";
+import { assertLookupOk } from "./lookup-helpers.js";
+import { deviceFlowDenyInputSchema } from "./schemas.js";
+// Explicitly reject a pending device-flow approval. The polling
+// client gets `access_denied` (RFC 8628 §3.5) on its next exchange
+// and stops polling — faster feedback than waiting out the TTL.
+//
+// Privacy tradeoff: surfacing `denied` does leak "user is online and
+// rejected this prompt" to the polling client. We accept it for the
+// UX win — operators concerned about the signal can simply not
+// expose a Deny button (the row expires naturally).
+//
+// Same lookup-then-act shape as approve so a code that expired
+// between page render and click surfaces the right error.
+export const deny = base
+    .use(authenticated)
+    .input(deviceFlowDenyInputSchema)
+    .handler(async ({ input, context, errors }) => {
+    const found = await lookupDeviceCodeByUserCode(context.db, input.userCode);
+    const ok = assertLookupOk(found, input.userCode, errors);
+    await denyDeviceCode(context.db, { id: ok.id });
+    await context.hooks.doAction("device_code:denied", { id: ok.id, userCode: input.userCode }, { actor: context.user });
+    return { ok: true };
+});
+//# sourceMappingURL=deny.js.map

package/dist/rpc/procedures/auth/device-flow/deny.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny.js","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/device-flow/deny.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,0BAA0B,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,gEAAgE;AAChE,mEAAmE;AACnE,gEAAgE;AAChE,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,+DAA+D;AAC/D,oDAAoD;AACpD,EAAE;AACF,+DAA+D;AAC/D,0DAA0D;AAC1D,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI;KACrB,GAAG,CAAC,aAAa,CAAC;KAClB,KAAK,CAAC,yBAAyB,CAAC;KAChC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5C,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAEzD,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAC1B,oBAAoB,EACpB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EACvC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CACxB,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;AAC/B,CAAC,CAAC,CAAC"}

package/dist/rpc/procedures/auth/device-flow/index.d.ts

@@ -0,0 +1,194 @@
+export declare const deviceFlowRouter: {
+    readonly lookup: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../../index.js").AppContext, import("../../../../index.js").AuthenticatedAppContext<typeof import("../../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+        readonly userCode: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").ToUpperCaseAction, import("valibot").TransformAction<string, string>, import("valibot").RegexAction<string, "user code must be 8 alphanum chars">]>;
+    }, undefined>, import("@orpc/server").Schema<{
+        ok: true;
+    }, {
+        ok: true;
+    }>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+        readonly UNAUTHORIZED: {
+            readonly message: "Authentication required";
+        };
+        readonly BAD_REQUEST: {
+            readonly message: "Invalid input";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly reason: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly FORBIDDEN: {
+            readonly message: "Permission denied";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly capability: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly NOT_FOUND: {
+            readonly message: "Resource not found";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly kind: import("valibot").StringSchema<undefined>;
+                readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+            }, undefined>;
+        };
+        readonly CONFLICT: {
+            readonly message: "Resource conflict";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly reason: import("valibot").StringSchema<undefined>;
+                readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>;
+        };
+        readonly PAYLOAD_TOO_LARGE: {
+            readonly message: "Payload too large";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly limit: import("valibot").NumberSchema<undefined>;
+                readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            }, undefined>;
+        };
+        readonly UNSUPPORTED_MEDIA_TYPE: {
+            readonly message: "Unsupported media type";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly mime: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly INVALID_BLOCK_CONTENT: {
+            readonly message: "Block content failed registry validation";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly code: import("valibot").StringSchema<undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                    readonly path: import("valibot").StringSchema<undefined>;
+                    readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+        };
+    }>, Record<never, never>>;
+    readonly approve: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../../index.js").AppContext, import("../../../../index.js").AuthenticatedAppContext<typeof import("../../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+        readonly userCode: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").ToUpperCaseAction, import("valibot").TransformAction<string, string>, import("valibot").RegexAction<string, "user code must be 8 alphanum chars">]>;
+        readonly tokenName: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").MinLengthAction<string, 1, "name must be non-empty">, import("valibot").MaxLengthAction<string, 64, "name must be ≤ 64 chars">, import("valibot").RegexAction<string, "name must not contain newlines">]>;
+        readonly scopes: import("valibot").OptionalSchema<import("valibot").UnionSchema<[import("valibot").NullSchema<undefined>, import("valibot").SchemaWithPipe<readonly [import("valibot").ArraySchema<import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, "capability must be non-empty">, import("valibot").MaxLengthAction<string, 96, "capability must be ≤ 96 chars">, import("valibot").RegexAction<string, "capability uses [A-Za-z0-9_:.\\-*] only">]>, undefined>, import("valibot").MaxLengthAction<string[], 128, "≤ 128 scopes">]>], undefined>, null>;
+    }, undefined>, import("@orpc/server").Schema<{
+        ok: true;
+    }, {
+        ok: true;
+    }>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+        readonly UNAUTHORIZED: {
+            readonly message: "Authentication required";
+        };
+        readonly BAD_REQUEST: {
+            readonly message: "Invalid input";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly reason: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly FORBIDDEN: {
+            readonly message: "Permission denied";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly capability: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly NOT_FOUND: {
+            readonly message: "Resource not found";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly kind: import("valibot").StringSchema<undefined>;
+                readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+            }, undefined>;
+        };
+        readonly CONFLICT: {
+            readonly message: "Resource conflict";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly reason: import("valibot").StringSchema<undefined>;
+                readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>;
+        };
+        readonly PAYLOAD_TOO_LARGE: {
+            readonly message: "Payload too large";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly limit: import("valibot").NumberSchema<undefined>;
+                readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            }, undefined>;
+        };
+        readonly UNSUPPORTED_MEDIA_TYPE: {
+            readonly message: "Unsupported media type";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly mime: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly INVALID_BLOCK_CONTENT: {
+            readonly message: "Block content failed registry validation";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly code: import("valibot").StringSchema<undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                    readonly path: import("valibot").StringSchema<undefined>;
+                    readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+        };
+    }>, Record<never, never>>;
+    readonly deny: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../../index.js").AppContext, import("../../../../index.js").AuthenticatedAppContext<typeof import("../../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+        readonly userCode: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").ToUpperCaseAction, import("valibot").TransformAction<string, string>, import("valibot").RegexAction<string, "user code must be 8 alphanum chars">]>;
+    }, undefined>, import("@orpc/server").Schema<{
+        ok: true;
+    }, {
+        ok: true;
+    }>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+        readonly UNAUTHORIZED: {
+            readonly message: "Authentication required";
+        };
+        readonly BAD_REQUEST: {
+            readonly message: "Invalid input";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly reason: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly FORBIDDEN: {
+            readonly message: "Permission denied";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly capability: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly NOT_FOUND: {
+            readonly message: "Resource not found";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly kind: import("valibot").StringSchema<undefined>;
+                readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+            }, undefined>;
+        };
+        readonly CONFLICT: {
+            readonly message: "Resource conflict";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly reason: import("valibot").StringSchema<undefined>;
+                readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>;
+        };
+        readonly PAYLOAD_TOO_LARGE: {
+            readonly message: "Payload too large";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly limit: import("valibot").NumberSchema<undefined>;
+                readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            }, undefined>;
+        };
+        readonly UNSUPPORTED_MEDIA_TYPE: {
+            readonly message: "Unsupported media type";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly mime: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly INVALID_BLOCK_CONTENT: {
+            readonly message: "Block content failed registry validation";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly code: import("valibot").StringSchema<undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                    readonly path: import("valibot").StringSchema<undefined>;
+                    readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+        };
+    }>, Record<never, never>>;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/rpc/procedures/auth/device-flow/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/device-flow/index.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAInB,CAAC"}

package/dist/rpc/procedures/auth/device-flow/index.js

@@ -0,0 +1,9 @@
+import { approve } from "./approve.js";
+import { deny } from "./deny.js";
+import { lookup } from "./lookup.js";
+export const deviceFlowRouter = {
+    lookup,
+    approve,
+    deny,
+};
+//# sourceMappingURL=index.js.map

package/dist/rpc/procedures/auth/device-flow/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/device-flow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM;IACN,OAAO;IACP,IAAI;CACI,CAAC"}

package/dist/rpc/procedures/auth/device-flow/lookup-helpers.d.ts

@@ -0,0 +1,19 @@
+import type { LookupUserCodeResult } from "../../../../auth/device-flow.js";
+interface RpcErrors {
+    NOT_FOUND(input: {
+        data: {
+            kind: string;
+            id: string;
+        };
+    }): Error;
+    CONFLICT(input: {
+        data: {
+            reason: string;
+        };
+    }): Error;
+}
+export declare function assertLookupOk(result: LookupUserCodeResult, userCode: string, errors: RpcErrors): {
+    id: string;
+};
+export {};
+//# sourceMappingURL=lookup-helpers.d.ts.map

package/dist/rpc/procedures/auth/device-flow/lookup-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/device-flow/lookup-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAY5E,UAAU,SAAS;IACjB,SAAS,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,KAAK,CAAC;IAChE,QAAQ,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,KAAK,CAAC;CACtD;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,GAChB;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAehB"}