@scalemule/nextjs 0.0.37 → 0.0.39

package/dist/server/auth.mjs

@@ -765,7 +765,6 @@ function createServerClient(config) {
 }
 var SESSION_COOKIE_NAME = "sm_session";
 var USER_ID_COOKIE_NAME = "sm_user_id";
-var KNOWN_ACCOUNTS_COOKIE_NAME = "sm_known_accounts";
 ({
   secure: process.env.NODE_ENV === "production"});
 function createCookieHeader(name, value, options = {}) {
@@ -846,163 +845,6 @@ async function getSession() {
     // Note: actual expiry is managed by ScaleMule backend
   };
 }
-var MAX_KNOWN_ACCOUNTS = 10;
-function maskEmail(email) {
-  const [local, domain] = email.split("@");
-  if (!domain) return "***@***.***";
-  const tldDot = domain.lastIndexOf(".");
-  const tld = tldDot > 0 ? domain.slice(tldDot) : "";
-  const domainBase = tldDot > 0 ? domain.slice(0, tldDot) : domain;
-  return `${local[0] || "*"}***@${domainBase[0] || "*"}***${tld}`;
-}
-function stableColorIndex(userId) {
-  let hash = 0;
-  for (let i = 0; i < userId.length; i++) {
-    hash = (hash << 5) - hash + userId.charCodeAt(i) | 0;
-  }
-  return Math.abs(hash) % 8;
-}
-function applyPrivacyToEntry(entry, privacy) {
-  switch (privacy) {
-    case "full":
-      return entry;
-    case "masked":
-      return {
-        userId: entry.userId,
-        email: entry.email ? maskEmail(entry.email) : void 0,
-        fullName: entry.fullName ? `${entry.fullName[0].toUpperCase()}.` : void 0,
-        provider: entry.provider,
-        lastActiveAt: entry.lastActiveAt,
-        colorIndex: stableColorIndex(entry.userId)
-      };
-    case "minimal":
-      return {
-        userId: entry.userId,
-        provider: entry.provider,
-        lastActiveAt: entry.lastActiveAt,
-        displayLabel: "Account",
-        colorIndex: stableColorIndex(entry.userId)
-      };
-  }
-}
-function appendKnownAccountCookie(headers, account, existingCookie, options = {}, privacy) {
-  let accounts = {};
-  if (existingCookie) {
-    try {
-      accounts = JSON.parse(decodeURIComponent(existingCookie));
-    } catch {
-    }
-  }
-  const effectivePrivacy = privacy || "full";
-  for (const [userId, entry] of Object.entries(accounts)) {
-    accounts[userId] = applyPrivacyToEntry(entry, effectivePrivacy);
-  }
-  accounts[account.userId] = applyPrivacyToEntry(account, effectivePrivacy);
-  const entries = Object.entries(accounts);
-  if (entries.length > MAX_KNOWN_ACCOUNTS) {
-    entries.sort((a, b) => new Date(b[1].lastActiveAt).getTime() - new Date(a[1].lastActiveAt).getTime());
-    accounts = Object.fromEntries(entries.slice(0, MAX_KNOWN_ACCOUNTS));
-  }
-  const maxAge = 365 * 24 * 60 * 60;
-  const secure = options.secure ?? process.env.NODE_ENV === "production";
-  const sameSite = options.sameSite ?? "lax";
-  const path = options.path ?? "/";
-  let cookie = `${KNOWN_ACCOUNTS_COOKIE_NAME}=${encodeURIComponent(JSON.stringify(accounts))}; Path=${path}; Max-Age=${maxAge}; SameSite=${sameSite}`;
-  if (secure) {
-    cookie += "; Secure";
-  }
-  if (options.domain) {
-    cookie += `; Domain=${options.domain}`;
-  }
-  headers.append("Set-Cookie", cookie);
-}
-function removeKnownAccountFromCookie(headers, userId, existingCookie, options = {}) {
-  let accounts = {};
-  if (existingCookie) {
-    try {
-      accounts = JSON.parse(decodeURIComponent(existingCookie));
-    } catch {
-    }
-  }
-  delete accounts[userId];
-  const maxAge = 365 * 24 * 60 * 60;
-  const secure = options.secure ?? process.env.NODE_ENV === "production";
-  const sameSite = options.sameSite ?? "lax";
-  const path = options.path ?? "/";
-  let cookie = `${KNOWN_ACCOUNTS_COOKIE_NAME}=${encodeURIComponent(JSON.stringify(accounts))}; Path=${path}; Max-Age=${maxAge}; SameSite=${sameSite}`;
-  if (secure) {
-    cookie += "; Secure";
-  }
-  if (options.domain) {
-    cookie += `; Domain=${options.domain}`;
-  }
-  headers.append("Set-Cookie", cookie);
-}
-function clearKnownAccountsCookie(headers, options = {}) {
-  const path = options.path ?? "/";
-  let cookie = `${KNOWN_ACCOUNTS_COOKIE_NAME}=; Path=${path}; Max-Age=0`;
-  if (options.domain) {
-    cookie += `; Domain=${options.domain}`;
-  }
-  headers.append("Set-Cookie", cookie);
-}
-function getKnownAccountsFromRequest(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) return [];
-  const cookies3 = Object.fromEntries(
-    cookieHeader.split(";").map((c) => {
-      const [key, ...rest] = c.trim().split("=");
-      return [key, decodeURIComponent(rest.join("="))];
-    })
-  );
-  const raw = cookies3[KNOWN_ACCOUNTS_COOKIE_NAME];
-  if (!raw) return [];
-  try {
-    const accounts = JSON.parse(raw);
-    return Object.values(accounts);
-  } catch {
-    return [];
-  }
-}
-function getKnownAccountsCookieRaw(request) {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) return null;
-  const cookies3 = Object.fromEntries(
-    cookieHeader.split(";").map((c) => {
-      const [key, ...rest] = c.trim().split("=");
-      return [key, decodeURIComponent(rest.join("="))];
-    })
-  );
-  return cookies3[KNOWN_ACCOUNTS_COOKIE_NAME] || null;
-}
-function normalizeKnownAccountsCookie(request, privacy, options = {}) {
-  if (!privacy || privacy === "full") return null;
-  const raw = getKnownAccountsCookieRaw(request);
-  if (!raw) return null;
-  let accounts = {};
-  try {
-    accounts = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  let changed = false;
-  for (const [userId, entry] of Object.entries(accounts)) {
-    const normalized = applyPrivacyToEntry(entry, privacy);
-    if (JSON.stringify(normalized) !== JSON.stringify(entry)) {
-      accounts[userId] = normalized;
-      changed = true;
-    }
-  }
-  if (!changed) return null;
-  const maxAge = 365 * 24 * 60 * 60;
-  const secure = options.secure ?? process.env.NODE_ENV === "production";
-  const sameSite = options.sameSite ?? "lax";
-  const path = options.path ?? "/";
-  let cookie = `${KNOWN_ACCOUNTS_COOKIE_NAME}=${encodeURIComponent(JSON.stringify(accounts))}; Path=${path}; Max-Age=${maxAge}; SameSite=${sameSite}`;
-  if (secure) cookie += "; Secure";
-  if (options.domain) cookie += `; Domain=${options.domain}`;
-  return cookie;
-}
 
 // src/server/timing.ts
 function constantTimeEqual(a, b) {
@@ -1089,25 +931,7 @@ function createAuthRoutes(config = {}) {
           } catch {
             return successResponse({ user: registeredUser, message: "Registration successful" }, 201);
           }
-          const registerResponse = withSession(loginData, { user: registeredUser, sessionToken: loginData.session_token, userId: registeredUser.id }, cookieOptions);
-          if (config.enableAccountSwitcher) {
-            const existingKnown = getKnownAccountsCookieRaw(request);
-            appendKnownAccountCookie(
-              registerResponse.headers,
-              {
-                userId: registeredUser.id,
-                email: registeredUser.email,
-                fullName: registeredUser.full_name ?? void 0,
-                avatarUrl: registeredUser.avatar_url ?? void 0,
-                provider: "email",
-                lastActiveAt: (/* @__PURE__ */ new Date()).toISOString()
-              },
-              existingKnown,
-              cookieOptions,
-              config.accountSwitcherPrivacy
-            );
-          }
-          return registerResponse;
+          return withSession(loginData, { user: registeredUser, sessionToken: loginData.session_token, userId: registeredUser.id }, cookieOptions);
         }
         // ==================== Login ====================
         case "login": {
@@ -1138,25 +962,7 @@ function createAuthRoutes(config = {}) {
               email: loginData.user.email
             });
           }
-          const loginResponse = withSession(loginData, { user: loginData.user, sessionToken: loginData.session_token, userId: loginData.user.id }, cookieOptions);
-          if (config.enableAccountSwitcher) {
-            const existingKnown = getKnownAccountsCookieRaw(request);
-            appendKnownAccountCookie(
-              loginResponse.headers,
-              {
-                userId: loginData.user.id,
-                email: loginData.user.email,
-                fullName: loginData.user.full_name ?? void 0,
-                avatarUrl: loginData.user.avatar_url ?? void 0,
-                provider: "email",
-                lastActiveAt: (/* @__PURE__ */ new Date()).toISOString()
-              },
-              existingKnown,
-              cookieOptions,
-              config.accountSwitcherPrivacy
-            );
-          }
-          return loginResponse;
+          return withSession(loginData, { user: loginData.user, sessionToken: loginData.session_token, userId: loginData.user.id }, cookieOptions);
         }
         // ==================== Logout ====================
         case "logout": {
@@ -1303,59 +1109,6 @@ function createAuthRoutes(config = {}) {
           }
           return successResponse({ message: "Password changed successfully" });
         }
-        // ==================== Switch Account ====================
-        // Clears the active session so the user can re-authenticate as a different account.
-        // The known accounts cookie is preserved — only the session cookie is cleared.
-        case "switch-account": {
-          if (!config.enableAccountSwitcher) {
-            return errorResponse("NOT_FOUND", "Account switcher not enabled", 404);
-          }
-          const session = await getSession();
-          if (session) {
-            try {
-              await sm.auth.logout(session.sessionToken);
-            } catch {
-            }
-          }
-          const switchResponse = clearSession({ message: "Session cleared for account switch" }, cookieOptions);
-          const knownAccounts = getKnownAccountsFromRequest(request);
-          return new Response(
-            JSON.stringify({ success: true, data: { message: "Session cleared for account switch", knownAccounts } }),
-            { status: 200, headers: switchResponse.headers }
-          );
-        }
-        // ==================== Forget Account ====================
-        // Remove a specific account from the known accounts cookie.
-        case "forget-account": {
-          if (!config.enableAccountSwitcher) {
-            return errorResponse("NOT_FOUND", "Account switcher not enabled", 404);
-          }
-          const { user_id } = body;
-          if (!user_id) {
-            return errorResponse("VALIDATION_ERROR", "user_id required", 400);
-          }
-          const headers = new Headers();
-          headers.set("Content-Type", "application/json");
-          const existingKnown = getKnownAccountsCookieRaw(request);
-          removeKnownAccountFromCookie(headers, user_id, existingKnown, cookieOptions);
-          return new Response(
-            JSON.stringify({ success: true, data: { message: "Account forgotten" } }),
-            { status: 200, headers }
-          );
-        }
-        // ==================== Forget All Accounts ====================
-        case "forget-all-accounts": {
-          if (!config.enableAccountSwitcher) {
-            return errorResponse("NOT_FOUND", "Account switcher not enabled", 404);
-          }
-          const headers = new Headers();
-          headers.set("Content-Type", "application/json");
-          clearKnownAccountsCookie(headers, cookieOptions);
-          return new Response(
-            JSON.stringify({ success: true, data: { message: "All accounts forgotten" } }),
-            { status: 200, headers }
-          );
-        }
         default:
           return errorResponse("NOT_FOUND", `Unknown endpoint: ${path}`, 404);
       }
@@ -1371,25 +1124,20 @@ function createAuthRoutes(config = {}) {
       switch (path) {
         // ==================== Get Current User ====================
         case "me": {
-          const normCookie = config.enableAccountSwitcher ? normalizeKnownAccountsCookie(request, config.accountSwitcherPrivacy, cookieOptions) : null;
-          const withNorm = (resp) => {
-            if (normCookie) resp.headers.append("Set-Cookie", normCookie);
-            return resp;
-          };
           const session = await getSession();
           if (!session) {
-            return withNorm(errorResponse("UNAUTHORIZED", "Authentication required", 401));
+            return errorResponse("UNAUTHORIZED", "Authentication required", 401);
           }
           let userData;
           try {
             userData = await sm.auth.me(session.sessionToken);
           } catch {
-            return withNorm(clearSession(
+            return clearSession(
               { error: { code: "SESSION_EXPIRED", message: "Session expired" } },
               cookieOptions
-            ));
+            );
           }
-          return withNorm(successResponse({ user: userData, sessionToken: session.sessionToken, userId: session.userId }));
+          return successResponse({ user: userData, sessionToken: session.sessionToken, userId: session.userId });
         }
         // ==================== Get Session Status ====================
         case "session": {
@@ -1399,14 +1147,6 @@ function createAuthRoutes(config = {}) {
             userId: session?.userId || null
           });
         }
-        // ==================== Get Known Accounts ====================
-        case "known-accounts": {
-          if (!config.enableAccountSwitcher) {
-            return errorResponse("NOT_FOUND", "Account switcher not enabled", 404);
-          }
-          const knownAccounts = getKnownAccountsFromRequest(request);
-          return successResponse({ knownAccounts });
-        }
         default:
           return errorResponse("NOT_FOUND", `Unknown endpoint: ${path}`, 404);
       }

package/dist/server/index.d.mts

@@ -1,6 +1,6 @@
-import { S as ServerConfig } from '../webhook-handler-CNKQ1k2a.mjs';
-export { a as ScaleMuleServer, V as VideoFailedEvent, b as VideoReadyEvent, c as VideoTranscodedEvent, d as VideoUploadedEvent, W as WebhookEvent, e as WebhookRoutesConfig, f as createServerClient, g as createWebhookHandler, h as createWebhookRoutes, p as parseWebhookEvent, r as registerVideoWebhook, i as resolveGatewayUrl, v as verifyWebhookSignature } from '../webhook-handler-CNKQ1k2a.mjs';
-import { p as ClientContext, A as ApiError } from '../index-BIIUrnPr.mjs';
+import { S as ServerConfig } from '../webhook-handler-Cz9jtet2.mjs';
+export { a as ScaleMuleServer, V as VideoFailedEvent, b as VideoReadyEvent, c as VideoTranscodedEvent, d as VideoUploadedEvent, W as WebhookEvent, e as WebhookRoutesConfig, f as createServerClient, g as createWebhookHandler, h as createWebhookRoutes, p as parseWebhookEvent, r as registerVideoWebhook, i as resolveGatewayUrl, v as verifyWebhookSignature } from '../webhook-handler-Cz9jtet2.mjs';
+import { p as ClientContext, A as ApiError } from '../index-BoENfro3.mjs';
 import { NextRequest, NextResponse } from 'next/server';
 
 /**
@@ -110,12 +110,6 @@ declare function buildFlagContext(clientContext: Pick<ClientContext, 'ip'> | und
  */
 declare const SESSION_COOKIE_NAME = "sm_session";
 declare const USER_ID_COOKIE_NAME = "sm_user_id";
-/**
- * Known accounts cookie — stores display metadata (email, name, avatar) for
- * accounts that have logged in on this device. NOT httpOnly so client JS can
- * read it to render the account switcher UI. Contains NO tokens or secrets.
- */
-declare const KNOWN_ACCOUNTS_COOKIE_NAME = "sm_known_accounts";
 interface SessionCookieOptions {
     /** Cookie max age in seconds (default: 7 days) */
     maxAge?: number;
@@ -187,51 +181,6 @@ declare function getSession(): Promise<SessionData | null>;
  * Use this when you need to read cookies from a Request directly.
  */
 declare function getSessionFromRequest(request: Request): SessionData | null;
-/**
- * Known account entry stored in cookie.
- * Contains display metadata ONLY — no tokens, no secrets.
- */
-interface KnownAccountEntry {
-    userId: string;
-    email?: string;
-    fullName?: string;
-    avatarUrl?: string;
-    provider?: string;
-    lastActiveAt: string;
-    displayLabel?: string;
-    colorIndex?: number;
-}
-type AccountSwitcherPrivacy = 'full' | 'masked' | 'minimal';
-/**
- * Add an account to the known accounts cookie.
- * Called after successful login. The cookie is NOT httpOnly so client JS
- * can read it to render the account switcher UI.
- *
- * Appends Set-Cookie headers to an existing Headers object.
- */
-declare function appendKnownAccountCookie(headers: Headers, account: KnownAccountEntry, existingCookie: string | null, options?: SessionCookieOptions, privacy?: AccountSwitcherPrivacy): void;
-/**
- * Remove a specific account from the known accounts cookie.
- */
-declare function removeKnownAccountFromCookie(headers: Headers, userId: string, existingCookie: string | null, options?: SessionCookieOptions): void;
-/**
- * Clear the known accounts cookie entirely.
- */
-declare function clearKnownAccountsCookie(headers: Headers, options?: SessionCookieOptions): void;
-/**
- * Read known accounts from a Request's cookies.
- */
-declare function getKnownAccountsFromRequest(request: Request): KnownAccountEntry[];
-/**
- * Read the raw known accounts cookie value from a Request.
- */
-declare function getKnownAccountsCookieRaw(request: Request): string | null;
-/**
- * Normalize all entries in the known accounts cookie to the given privacy level.
- * Returns a Set-Cookie header string if any entries changed, or null if nothing changed.
- * Used on /me requests to migrate legacy full-PII cookies to the configured privacy level.
- */
-declare function normalizeKnownAccountsCookie(request: Request, privacy: AccountSwitcherPrivacy | undefined, options?: SessionCookieOptions): string | null;
 /**
  * Require authentication - throws Response if not authenticated
  *
@@ -271,19 +220,6 @@ interface AuthRoutesConfig {
     cookies?: SessionCookieOptions;
     /** Enable CSRF validation on state-changing requests (POST/DELETE/PATCH) */
     csrf?: boolean;
-    /**
-     * Enable the account switcher — remembers which accounts have logged in on
-     * this device (metadata only, no tokens). Switching requires re-authentication.
-     * Adds routes: switch-account, forget-account, forget-all-accounts, known-accounts.
-     */
-    enableAccountSwitcher?: boolean;
-    /**
-     * Privacy level for account switcher display metadata.
-     * - 'full': Store email, name, avatar as-is (default)
-     * - 'masked': Mask email, truncate name to initial
-     * - 'minimal': No PII — just a colored "Account" label
-     */
-    accountSwitcherPrivacy?: 'full' | 'masked' | 'minimal';
     /** Callbacks */
     onLogin?: (user: {
         id: string;
@@ -1075,4 +1011,4 @@ declare function invalidateBundleCache(key?: string): void;
  */
 declare function prefetchBundles(keys: string[]): Promise<void>;
 
-export { type AnalyticsRoutesConfig, type AnalyticsTrackingGateConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, KNOWN_ACCOUNTS_COOKIE_NAME, type KnownAccountEntry, type MySqlBundle, type NotificationRoutesConfig, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type PushRoutesConfig, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, appendKnownAccountCookie, buildClientContextHeaders, buildFlagContext, clearKnownAccountsCookie, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createNotificationRoutes, createPushRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getKnownAccountsCookieRaw, getKnownAccountsFromRequest, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, normalizeKnownAccountsCookie, prefetchBundles, prefetchSecrets, removeKnownAccountFromCookie, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };
+export { type AnalyticsRoutesConfig, type AnalyticsTrackingGateConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, type MySqlBundle, type NotificationRoutesConfig, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type PushRoutesConfig, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, buildFlagContext, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createNotificationRoutes, createPushRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, prefetchBundles, prefetchSecrets, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };

package/dist/server/index.d.ts

@@ -1,6 +1,6 @@
-import { S as ServerConfig } from '../webhook-handler-BobYTuNP.js';
-export { a as ScaleMuleServer, V as VideoFailedEvent, b as VideoReadyEvent, c as VideoTranscodedEvent, d as VideoUploadedEvent, W as WebhookEvent, e as WebhookRoutesConfig, f as createServerClient, g as createWebhookHandler, h as createWebhookRoutes, p as parseWebhookEvent, r as registerVideoWebhook, i as resolveGatewayUrl, v as verifyWebhookSignature } from '../webhook-handler-BobYTuNP.js';
-import { p as ClientContext, A as ApiError } from '../index-BIIUrnPr.js';
+import { S as ServerConfig } from '../webhook-handler-CjSSCdvI.js';
+export { a as ScaleMuleServer, V as VideoFailedEvent, b as VideoReadyEvent, c as VideoTranscodedEvent, d as VideoUploadedEvent, W as WebhookEvent, e as WebhookRoutesConfig, f as createServerClient, g as createWebhookHandler, h as createWebhookRoutes, p as parseWebhookEvent, r as registerVideoWebhook, i as resolveGatewayUrl, v as verifyWebhookSignature } from '../webhook-handler-CjSSCdvI.js';
+import { p as ClientContext, A as ApiError } from '../index-BoENfro3.js';
 import { NextRequest, NextResponse } from 'next/server';
 
 /**
@@ -110,12 +110,6 @@ declare function buildFlagContext(clientContext: Pick<ClientContext, 'ip'> | und
  */
 declare const SESSION_COOKIE_NAME = "sm_session";
 declare const USER_ID_COOKIE_NAME = "sm_user_id";
-/**
- * Known accounts cookie — stores display metadata (email, name, avatar) for
- * accounts that have logged in on this device. NOT httpOnly so client JS can
- * read it to render the account switcher UI. Contains NO tokens or secrets.
- */
-declare const KNOWN_ACCOUNTS_COOKIE_NAME = "sm_known_accounts";
 interface SessionCookieOptions {
     /** Cookie max age in seconds (default: 7 days) */
     maxAge?: number;
@@ -187,51 +181,6 @@ declare function getSession(): Promise<SessionData | null>;
  * Use this when you need to read cookies from a Request directly.
  */
 declare function getSessionFromRequest(request: Request): SessionData | null;
-/**
- * Known account entry stored in cookie.
- * Contains display metadata ONLY — no tokens, no secrets.
- */
-interface KnownAccountEntry {
-    userId: string;
-    email?: string;
-    fullName?: string;
-    avatarUrl?: string;
-    provider?: string;
-    lastActiveAt: string;
-    displayLabel?: string;
-    colorIndex?: number;
-}
-type AccountSwitcherPrivacy = 'full' | 'masked' | 'minimal';
-/**
- * Add an account to the known accounts cookie.
- * Called after successful login. The cookie is NOT httpOnly so client JS
- * can read it to render the account switcher UI.
- *
- * Appends Set-Cookie headers to an existing Headers object.
- */
-declare function appendKnownAccountCookie(headers: Headers, account: KnownAccountEntry, existingCookie: string | null, options?: SessionCookieOptions, privacy?: AccountSwitcherPrivacy): void;
-/**
- * Remove a specific account from the known accounts cookie.
- */
-declare function removeKnownAccountFromCookie(headers: Headers, userId: string, existingCookie: string | null, options?: SessionCookieOptions): void;
-/**
- * Clear the known accounts cookie entirely.
- */
-declare function clearKnownAccountsCookie(headers: Headers, options?: SessionCookieOptions): void;
-/**
- * Read known accounts from a Request's cookies.
- */
-declare function getKnownAccountsFromRequest(request: Request): KnownAccountEntry[];
-/**
- * Read the raw known accounts cookie value from a Request.
- */
-declare function getKnownAccountsCookieRaw(request: Request): string | null;
-/**
- * Normalize all entries in the known accounts cookie to the given privacy level.
- * Returns a Set-Cookie header string if any entries changed, or null if nothing changed.
- * Used on /me requests to migrate legacy full-PII cookies to the configured privacy level.
- */
-declare function normalizeKnownAccountsCookie(request: Request, privacy: AccountSwitcherPrivacy | undefined, options?: SessionCookieOptions): string | null;
 /**
  * Require authentication - throws Response if not authenticated
  *
@@ -271,19 +220,6 @@ interface AuthRoutesConfig {
     cookies?: SessionCookieOptions;
     /** Enable CSRF validation on state-changing requests (POST/DELETE/PATCH) */
     csrf?: boolean;
-    /**
-     * Enable the account switcher — remembers which accounts have logged in on
-     * this device (metadata only, no tokens). Switching requires re-authentication.
-     * Adds routes: switch-account, forget-account, forget-all-accounts, known-accounts.
-     */
-    enableAccountSwitcher?: boolean;
-    /**
-     * Privacy level for account switcher display metadata.
-     * - 'full': Store email, name, avatar as-is (default)
-     * - 'masked': Mask email, truncate name to initial
-     * - 'minimal': No PII — just a colored "Account" label
-     */
-    accountSwitcherPrivacy?: 'full' | 'masked' | 'minimal';
     /** Callbacks */
     onLogin?: (user: {
         id: string;
@@ -1075,4 +1011,4 @@ declare function invalidateBundleCache(key?: string): void;
  */
 declare function prefetchBundles(keys: string[]): Promise<void>;
 
-export { type AnalyticsRoutesConfig, type AnalyticsTrackingGateConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, KNOWN_ACCOUNTS_COOKIE_NAME, type KnownAccountEntry, type MySqlBundle, type NotificationRoutesConfig, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type PushRoutesConfig, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, appendKnownAccountCookie, buildClientContextHeaders, buildFlagContext, clearKnownAccountsCookie, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createNotificationRoutes, createPushRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getKnownAccountsCookieRaw, getKnownAccountsFromRequest, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, normalizeKnownAccountsCookie, prefetchBundles, prefetchSecrets, removeKnownAccountFromCookie, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };
+export { type AnalyticsRoutesConfig, type AnalyticsTrackingGateConfig, type AuthMiddlewareConfig, type AuthRoutesConfig, CSRF_COOKIE_NAME, CSRF_HEADER_NAME, type HandlerContext, type HandlerOptions, type MySqlBundle, type NotificationRoutesConfig, OAUTH_STATE_COOKIE_NAME, type OAuthBundle, type PostgresBundle, type PushRoutesConfig, type RedisBundle, type S3Bundle, SESSION_COOKIE_NAME, ScaleMuleError, ServerConfig, type SessionCookieOptions, type SessionData, type SmtpBundle, USER_ID_COOKIE_NAME, apiHandler, buildClientContextHeaders, buildFlagContext, clearOAuthState, clearSession, configureBundles, configureSecrets, createAnalyticsRoutes, createAuthMiddleware, createAuthRoutes, createNotificationRoutes, createPushRoutes, errorCodeToStatus, extractClientContext, extractClientContextFromReq, generateCSRFToken, getAppSecret, getAppSecretOrDefault, getBootstrapFlags, getBundle, getCSRFToken, getMySqlBundle, getOAuthBundle, getPostgresBundle, getRedisBundle, getS3Bundle, getSession, getSessionFromRequest, getSmtpBundle, invalidateBundleCache, invalidateSecretCache, prefetchBundles, prefetchSecrets, requireAppSecret, requireBundle, requireSession, setOAuthState, unwrap, validateCSRFToken, validateCSRFTokenAsync, validateOAuthState, validateOAuthStateAsync, withAuth, withCSRFProtection, withCSRFToken, withSession };