@spfn/auth 0.3.0-beta.1 → 0.3.0-beta.2

package/README.md

@@ -720,9 +720,18 @@ Programmatic checks (server): `hasPermission`, `hasAnyPermission`, `hasAllPermis
 
 Yes, and that is the point of the operator half of this package. The day after you deploy,
 someone has to refund an order, look up a user, publish a change, retry a failed job. The
-usual answer is to build screens for each of those. `@spfn/auth` already knows who your
-operators are and which of them may do what; [`@spfn/mcp`](../mcp/README.md) turns those
-operations into tools an AI agent can run, so the screens never get built.
+usual answer is to build screens for each of those. SPFN's answer is to expose those
+operations to an agent instead, and there are two transports for that:
+
+- **CLI-first (the default)**: develop ops as routes with
+  [`createOpsRouter`](../core/README.md#how-do-i-operate-the-app-from-the-terminal),
+  authenticate them with [ops tokens](#ops-tokens-spfn-ops), and drive them with
+  `spfn ops` from the same terminal the app was built in.
+- **MCP**: [`@spfn/mcp`](../mcp/README.md) turns operations into tools a chat client's
+  agent can run — the fit when operators work outside a terminal.
+
+`@spfn/auth` already knows who your operators are and which of them may do what; the MCP
+wiring below shows how those answers reach `@spfn/mcp`.
 
 The connection is app code, deliberately. `@spfn/mcp` does not read this package's RBAC on
 its own — it asks you for a `validateToken` and a `listTools`, and those are where auth's
@@ -832,6 +841,68 @@ For short-lived authenticated handshakes (e.g. SSE) where a `Bearer` header is a
 with `authApi.issueOneTimeToken`, protect the consuming route with the `oneTimeTokenAuth`
 middleware. Call `initOneTimeTokenManager({ ttl, store })` during setup for a custom TTL/store.
 
+## Ops tokens (`spfn ops`)
+
+The machine credential behind the CLI-first ops surface
+([`@spfn/core/ops`](../core/README.md#how-do-i-operate-the-app-from-the-terminal)). An ops
+token is not a user session: it carries a label and a scope list, only its SHA-256 hash is
+stored, and the secret is shown exactly once at issuance.
+
+```typescript
+// src/server/ops.ts — the app develops its own ops as routes
+import { createOpsRouter, opsRoute } from '@spfn/core/ops';
+import { opsTokenAuth, requireOpsScope } from '@spfn/auth/server';
+
+export const opsRouter = createOpsRouter({
+    listSignups: opsRoute.get('/signups')
+        .use([requireOpsScope('waitlist:read')])
+        .handler(async () => signupsRepository.list()),
+}, { auth: opsTokenAuth });
+```
+
+`opsRoute` comes from `@spfn/core` **0.3.0-beta.2** onwards; before that release an ops
+route spelled its own `/_ops/` prefix with `route`.
+
+Issue and manage tokens against the running app, signed in as an administrator. The CLI
+prompts for the administrator's email and password, so nothing here needs database access:
+
+```bash
+spfn ops token issue --name laptop --scopes 'waitlist:read' --app https://api.example.com
+spfn ops token issue --name laptop --scopes '*' --to-keychain --app https://api.example.com
+spfn ops token list --app https://api.example.com
+spfn ops token revoke 3 --app https://api.example.com
+```
+
+Behind those commands are three admin-only routes, mounted with the rest of the auth
+router:
+
+| Route | What it does |
+| --- | --- |
+| `POST /_auth/ops-tokens` | Issue. The secret is in this answer and nowhere else. |
+| `GET /_auth/ops-tokens` | List. Only hashes were stored, so no secret can be returned. |
+| `DELETE /_auth/ops-tokens/:id` | Revoke. Permanent, and effective immediately. |
+
+Each requires `authenticate` plus `requireRole('admin', 'superadmin')`. The administrator
+seeded from `SPFN_AUTH_ADMIN_*` (see [Admin seeding](#admin-seeding))
+signs in with a password, so this works in an app whose end users only sign in socially.
+
+Issuance takes `expiresInDays` from 1 to 36500 (about a century), or `null` for a token that
+never expires. There is an upper bound because a day count becomes a date by arithmetic, and
+a big enough count produces an invalid date rather than a distant one — a refusal the route
+should answer with a message, not with whatever the driver says about a value it cannot store.
+
+SPFN authenticates a request with a JWT the client signs itself, so the CLI generates a key
+pair, hands the public half over at login, signs the one call it needs, and revokes the key
+before the command ends — on the failing path as much as the succeeding one.
+`@spfn/auth/crypto` exports the two functions that take part (`generateKeyPair`,
+`generateClientToken`) without pulling in the auth server; it exists from **0.3.0-beta.2**,
+which is the floor the `spfn` CLI declares for this package.
+
+Verification refuses uniformly: an expired, revoked, or never-issued token all answer the
+same 401, so whether a presented secret ever existed is not inferable. A valid token
+missing a route's scope answers 403 naming only the missing scope. `'*'` grants every
+scope.
+
 ## Mobile clientProofV1 (`@spfn/auth/client-proof`)
 
 Server side of the spfn-mobile native SDK auth profile (issue #46; asymmetric revision in

package/dist/{authenticate-DlTGaBT8.d.ts → authenticate-55LeXHqZ.d.ts}

@@ -1252,6 +1252,50 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
         userId: number;
         roleId: number;
     }>;
+    issueOpsToken: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            name: _sinclair_typebox.TString;
+            scopes: _sinclair_typebox.TArray<_sinclair_typebox.TString>;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<[_sinclair_typebox.TNumber, _sinclair_typebox.TNull]>>;
+        }>;
+    }, {}, {
+        token: string;
+        opsToken: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        };
+    }>;
+    listOpsTokens: _spfn_core_route.RouteDef<{}, {}, {
+        opsTokens: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        }[];
+    }>;
+    revokeOpsToken: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+        }>;
+    }, {}, {
+        opsToken: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        };
+    }>;
 }>;
 
 /**

package/dist/crypto.d.ts

@@ -0,0 +1,61 @@
+import { K as KeyAlgorithmType } from './types-DYyhze28.js';
+import { Algorithm } from 'jsonwebtoken';
+
+/**
+ * @spfn/auth - Client Crypto Helpers
+ *
+ * ES256 (ECDSA P-256) key generation and JWT signing for Next.js
+ * Keys are stored in DER format (Base64 encoded) for efficiency
+ *
+ * Key Sizes:
+ * - ES256 (ECDSA P-256): ~91 bytes (Base64: ~120 chars)
+ * - RS256 (RSA 2048):   ~294 bytes (Base64: ~392 chars)
+ */
+
+type Unit = 'Years' | 'Year' | 'Yrs' | 'Yr' | 'Y' | 'Weeks' | 'Week' | 'W' | 'Days' | 'Day' | 'D' | 'Hours' | 'Hour' | 'Hrs' | 'Hr' | 'H' | 'Minutes' | 'Minute' | 'Mins' | 'Min' | 'M' | 'Seconds' | 'Second' | 'Secs' | 'Sec' | 's' | 'Milliseconds' | 'Millisecond' | 'Msecs' | 'Msec' | 'Ms';
+type UnitAnyCase = Unit | Uppercase<Unit> | Lowercase<Unit>;
+type StringValue = `${number}` | `${number}${UnitAnyCase}` | `${number} ${UnitAnyCase}`;
+interface KeyPair {
+    privateKey: string;
+    publicKey: string;
+    keyId: string;
+    fingerprint: string;
+    algorithm: KeyAlgorithmType;
+}
+/**
+ * Generate ECDSA P-256 key pair (ES256)
+ * Recommended for optimal size and performance
+ */
+declare function generateKeyPairES256(): KeyPair;
+/**
+ * Generate RSA 2048 key pair (RS256)
+ * Fallback option, larger size but wider compatibility
+ */
+declare function generateKeyPairRS256(): KeyPair;
+/**
+ * Generate key pair (defaults to ES256)
+ */
+declare function generateKeyPair(algorithm?: KeyAlgorithmType): KeyPair;
+/**
+ * Generate JWT signed with client private key (DER format)
+ */
+declare function generateClientToken(payload: Record<string, any>, privateKeyB64: string, algorithm: Algorithm, options?: {
+    expiresIn?: StringValue | number;
+    issuer?: string;
+}): string;
+/**
+ * Get key size information
+ */
+declare function getKeySize(publicKeyB64: string): {
+    bytes: number;
+    base64Length: number;
+};
+/**
+ * Check if key should be rotated based on creation date
+ */
+declare function shouldRotateKey(createdAt: Date, rotationDays?: number): {
+    shouldRotate: boolean;
+    daysRemaining: number;
+};
+
+export { KeyAlgorithmType, type KeyPair, generateClientToken, generateKeyPair, generateKeyPairES256, generateKeyPairRS256, getKeySize, shouldRotateKey };

package/dist/crypto.js

@@ -0,0 +1,108 @@
+// src/server/lib/crypto.ts
+import crypto from "crypto";
+import jwt from "jsonwebtoken";
+function generateKeyPairES256() {
+  const keyId = crypto.randomUUID();
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("ec", {
+    namedCurve: "P-256",
+    // ES256
+    publicKeyEncoding: {
+      type: "spki",
+      format: "der"
+    },
+    privateKeyEncoding: {
+      type: "pkcs8",
+      format: "der"
+    }
+  });
+  const privateKeyB64 = privateKey.toString("base64");
+  const publicKeyB64 = publicKey.toString("base64");
+  const fingerprint = crypto.createHash("sha256").update(publicKey).digest("hex");
+  return {
+    privateKey: privateKeyB64,
+    publicKey: publicKeyB64,
+    keyId,
+    fingerprint,
+    algorithm: "ES256"
+  };
+}
+function generateKeyPairRS256() {
+  const keyId = crypto.randomUUID();
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    publicKeyEncoding: {
+      type: "spki",
+      format: "der"
+    },
+    privateKeyEncoding: {
+      type: "pkcs8",
+      format: "der"
+    }
+  });
+  const privateKeyB64 = privateKey.toString("base64");
+  const publicKeyB64 = publicKey.toString("base64");
+  const fingerprint = crypto.createHash("sha256").update(publicKey).digest("hex");
+  return {
+    privateKey: privateKeyB64,
+    publicKey: publicKeyB64,
+    keyId,
+    fingerprint,
+    algorithm: "RS256"
+  };
+}
+function generateKeyPair(algorithm = "ES256") {
+  return algorithm === "ES256" ? generateKeyPairES256() : generateKeyPairRS256();
+}
+function generateClientToken(payload, privateKeyB64, algorithm, options) {
+  try {
+    const privateKeyDER = Buffer.from(privateKeyB64, "base64");
+    const privateKeyObject = crypto.createPrivateKey({
+      key: privateKeyDER,
+      format: "der",
+      type: "pkcs8"
+    });
+    const privateKeyPEM = privateKeyObject.export({
+      type: "pkcs8",
+      format: "pem"
+    });
+    const signOptions = {
+      algorithm,
+      issuer: options?.issuer || "spfn-client",
+      expiresIn: options?.expiresIn ?? "15m"
+      // Default to 15 minutes
+    };
+    return jwt.sign(payload, privateKeyPEM, signOptions);
+  } catch (error) {
+    throw new Error(
+      `Failed to generate client token: ${error instanceof Error ? error.message : "Unknown error"}`
+    );
+  }
+}
+function getKeySize(publicKeyB64) {
+  const keyDER = Buffer.from(publicKeyB64, "base64");
+  return {
+    bytes: keyDER.length,
+    base64Length: publicKeyB64.length
+  };
+}
+function shouldRotateKey(createdAt, rotationDays = 90) {
+  const now = /* @__PURE__ */ new Date();
+  const ageInDays = Math.floor(
+    (now.getTime() - createdAt.getTime()) / (1e3 * 60 * 60 * 24)
+  );
+  const daysRemaining = Math.max(0, rotationDays - ageInDays);
+  return {
+    shouldRotate: daysRemaining <= 7,
+    // Warn 7 days before expiry
+    daysRemaining
+  };
+}
+export {
+  generateClientToken,
+  generateKeyPair,
+  generateKeyPairES256,
+  generateKeyPairRS256,
+  getKeySize,
+  shouldRotateKey
+};
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/server/lib/crypto.ts"],"sourcesContent":["/**\n * @spfn/auth - Client Crypto Helpers\n *\n * ES256 (ECDSA P-256) key generation and JWT signing for Next.js\n * Keys are stored in DER format (Base64 encoded) for efficiency\n *\n * Key Sizes:\n * - ES256 (ECDSA P-256): ~91 bytes (Base64: ~120 chars)\n * - RS256 (RSA 2048):   ~294 bytes (Base64: ~392 chars)\n */\n\nimport { type KeyAlgorithmType } from '../types';\nimport crypto from 'crypto';\nimport jwt, { type Algorithm, type SignOptions } from 'jsonwebtoken';\n\ntype Unit =\n    | 'Years'\n    | 'Year'\n    | 'Yrs'\n    | 'Yr'\n    | 'Y'\n    | 'Weeks'\n    | 'Week'\n    | 'W'\n    | 'Days'\n    | 'Day'\n    | 'D'\n    | 'Hours'\n    | 'Hour'\n    | 'Hrs'\n    | 'Hr'\n    | 'H'\n    | 'Minutes'\n    | 'Minute'\n    | 'Mins'\n    | 'Min'\n    | 'M'\n    | 'Seconds'\n    | 'Second'\n    | 'Secs'\n    | 'Sec'\n    | 's'\n    | 'Milliseconds'\n    | 'Millisecond'\n    | 'Msecs'\n    | 'Msec'\n    | 'Ms';\n\ntype UnitAnyCase = Unit | Uppercase<Unit> | Lowercase<Unit>;\n\ntype StringValue =\n    | `${number}`\n    | `${number}${UnitAnyCase}`\n    | `${number} ${UnitAnyCase}`;\n\nexport interface KeyPair\n{\n    privateKey: string;     // Base64 encoded DER\n    publicKey: string;      // Base64 encoded DER\n    keyId: string;          // UUID\n    fingerprint: string;    // SHA-256 hash\n    algorithm: KeyAlgorithmType;\n}\n\n/**\n * Generate ECDSA P-256 key pair (ES256)\n * Recommended for optimal size and performance\n */\nexport function generateKeyPairES256(): KeyPair\n{\n    const keyId = crypto.randomUUID();\n\n    const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', {\n        namedCurve: 'P-256', // ES256\n        publicKeyEncoding: {\n            type: 'spki',\n            format: 'der',\n        },\n        privateKeyEncoding: {\n            type: 'pkcs8',\n            format: 'der',\n        },\n    });\n\n    // Convert Buffer to Base64\n    const privateKeyB64 = privateKey.toString('base64');\n    const publicKeyB64 = publicKey.toString('base64');\n\n    // Generate fingerprint (SHA-256 of public key)\n    const fingerprint = crypto\n        .createHash('sha256')\n        .update(publicKey)\n        .digest('hex');\n\n    return {\n        privateKey: privateKeyB64,\n        publicKey: publicKeyB64,\n        keyId,\n        fingerprint,\n        algorithm: 'ES256',\n    };\n}\n\n/**\n * Generate RSA 2048 key pair (RS256)\n * Fallback option, larger size but wider compatibility\n */\nexport function generateKeyPairRS256(): KeyPair\n{\n    const keyId = crypto.randomUUID();\n\n    const { privateKey, publicKey } = crypto.generateKeyPairSync('rsa', {\n        modulusLength: 2048,\n        publicKeyEncoding: {\n            type: 'spki',\n            format: 'der',\n        },\n        privateKeyEncoding: {\n            type: 'pkcs8',\n            format: 'der',\n        },\n    });\n\n    const privateKeyB64 = privateKey.toString('base64');\n    const publicKeyB64 = publicKey.toString('base64');\n\n    const fingerprint = crypto\n        .createHash('sha256')\n        .update(publicKey)\n        .digest('hex');\n\n    return {\n        privateKey: privateKeyB64,\n        publicKey: publicKeyB64,\n        keyId,\n        fingerprint,\n        algorithm: 'RS256',\n    };\n}\n\n/**\n * Generate key pair (defaults to ES256)\n */\nexport function generateKeyPair(\n    algorithm: KeyAlgorithmType = 'ES256',\n): KeyPair\n{\n    return algorithm === 'ES256'\n        ? generateKeyPairES256()\n        : generateKeyPairRS256();\n}\n\n/**\n * Generate JWT signed with client private key (DER format)\n */\nexport function generateClientToken(\n    payload: Record<string, any>,\n    privateKeyB64: string,\n    algorithm: Algorithm,\n    options?: {\n        expiresIn?: StringValue | number;\n        issuer?: string;\n    },\n): string\n{\n    try\n    {\n        // Convert Base64 back to Buffer\n        const privateKeyDER = Buffer.from(privateKeyB64, 'base64');\n\n        // Create key object for signing\n        const privateKeyObject = crypto.createPrivateKey({\n            key: privateKeyDER,\n            format: 'der',\n            type: 'pkcs8',\n        });\n\n        // Export as PEM for jwt.sign\n        const privateKeyPEM = privateKeyObject.export({\n            type: 'pkcs8',\n            format: 'pem',\n        });\n\n        const signOptions: SignOptions = {\n            algorithm,\n            issuer: options?.issuer || 'spfn-client',\n            expiresIn: options?.expiresIn ?? '15m', // Default to 15 minutes\n        };\n\n        return jwt.sign(payload, privateKeyPEM, signOptions);\n    }\n    catch (error)\n    {\n        throw new Error(\n            `Failed to generate client token: ${error instanceof Error ? error.message : 'Unknown error'}`,\n        );\n    }\n}\n\n/**\n * Get key size information\n */\nexport function getKeySize(publicKeyB64: string): {\n    bytes: number;\n    base64Length: number;\n}\n{\n    const keyDER = Buffer.from(publicKeyB64, 'base64');\n\n    return {\n        bytes: keyDER.length,\n        base64Length: publicKeyB64.length,\n    };\n}\n\n/**\n * Check if key should be rotated based on creation date\n */\nexport function shouldRotateKey(\n    createdAt: Date,\n    rotationDays: number = 90,\n): {\n    shouldRotate: boolean;\n    daysRemaining: number;\n}\n{\n    const now = new Date();\n    const ageInDays = Math.floor(\n        (now.getTime() - createdAt.getTime()) / (1000 * 60 * 60 * 24),\n    );\n    const daysRemaining = Math.max(0, rotationDays - ageInDays);\n\n    return {\n        shouldRotate: daysRemaining <= 7, // Warn 7 days before expiry\n        daysRemaining,\n    };\n}\n"],"mappings":";AAYA,OAAO,YAAY;AACnB,OAAO,SAA+C;AAuD/C,SAAS,uBAChB;AACI,QAAM,QAAQ,OAAO,WAAW;AAEhC,QAAM,EAAE,YAAY,UAAU,IAAI,OAAO,oBAAoB,MAAM;AAAA,IAC/D,YAAY;AAAA;AAAA,IACZ,mBAAmB;AAAA,MACf,MAAM;AAAA,MACN,QAAQ;AAAA,IACZ;AAAA,IACA,oBAAoB;AAAA,MAChB,MAAM;AAAA,MACN,QAAQ;AAAA,IACZ;AAAA,EACJ,CAAC;AAGD,QAAM,gBAAgB,WAAW,SAAS,QAAQ;AAClD,QAAM,eAAe,UAAU,SAAS,QAAQ;AAGhD,QAAM,cAAc,OACf,WAAW,QAAQ,EACnB,OAAO,SAAS,EAChB,OAAO,KAAK;AAEjB,SAAO;AAAA,IACH,YAAY;AAAA,IACZ,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACf;AACJ;AAMO,SAAS,uBAChB;AACI,QAAM,QAAQ,OAAO,WAAW;AAEhC,QAAM,EAAE,YAAY,UAAU,IAAI,OAAO,oBAAoB,OAAO;AAAA,IAChE,eAAe;AAAA,IACf,mBAAmB;AAAA,MACf,MAAM;AAAA,MACN,QAAQ;AAAA,IACZ;AAAA,IACA,oBAAoB;AAAA,MAChB,MAAM;AAAA,MACN,QAAQ;AAAA,IACZ;AAAA,EACJ,CAAC;AAED,QAAM,gBAAgB,WAAW,SAAS,QAAQ;AAClD,QAAM,eAAe,UAAU,SAAS,QAAQ;AAEhD,QAAM,cAAc,OACf,WAAW,QAAQ,EACnB,OAAO,SAAS,EAChB,OAAO,KAAK;AAEjB,SAAO;AAAA,IACH,YAAY;AAAA,IACZ,WAAW;AAAA,IACX;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACf;AACJ;AAKO,SAAS,gBACZ,YAA8B,SAElC;AACI,SAAO,cAAc,UACf,qBAAqB,IACrB,qBAAqB;AAC/B;AAKO,SAAS,oBACZ,SACA,eACA,WACA,SAKJ;AACI,MACA;AAEI,UAAM,gBAAgB,OAAO,KAAK,eAAe,QAAQ;AAGzD,UAAM,mBAAmB,OAAO,iBAAiB;AAAA,MAC7C,KAAK;AAAA,MACL,QAAQ;AAAA,MACR,MAAM;AAAA,IACV,CAAC;AAGD,UAAM,gBAAgB,iBAAiB,OAAO;AAAA,MAC1C,MAAM;AAAA,MACN,QAAQ;AAAA,IACZ,CAAC;AAED,UAAM,cAA2B;AAAA,MAC7B;AAAA,MACA,QAAQ,SAAS,UAAU;AAAA,MAC3B,WAAW,SAAS,aAAa;AAAA;AAAA,IACrC;AAEA,WAAO,IAAI,KAAK,SAAS,eAAe,WAAW;AAAA,EACvD,SACO,OACP;AACI,UAAM,IAAI;AAAA,MACN,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,eAAe;AAAA,IAChG;AAAA,EACJ;AACJ;AAKO,SAAS,WAAW,cAI3B;AACI,QAAM,SAAS,OAAO,KAAK,cAAc,QAAQ;AAEjD,SAAO;AAAA,IACH,OAAO,OAAO;AAAA,IACd,cAAc,aAAa;AAAA,EAC/B;AACJ;AAKO,SAAS,gBACZ,WACA,eAAuB,IAK3B;AACI,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,YAAY,KAAK;AAAA,KAClB,IAAI,QAAQ,IAAI,UAAU,QAAQ,MAAM,MAAO,KAAK,KAAK;AAAA,EAC9D;AACA,QAAM,gBAAgB,KAAK,IAAI,GAAG,eAAe,SAAS;AAE1D,SAAO;AAAA,IACH,cAAc,iBAAiB;AAAA;AAAA,IAC/B;AAAA,EACJ;AACJ;","names":[]}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as _spfn_core_nextjs from '@spfn/core/nextjs';
-import { P as PermissionConfig, R as RoleConfig, m as mainAuthRouter, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, K as KeySummary, c as RevokeAllKeysResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, d as OAuthNativeResult, U as UserProfile, e as ProfileInfo } from './authenticate-DlTGaBT8.js';
-export { A as AuthInitOptions, f as AuthSession, g as PERMISSION_CATEGORIES, h as PermissionCategory, V as VERIFICATION_PURPOSES, i as VERIFICATION_TARGET_TYPES, j as VerificationPurpose, k as VerificationTargetType } from './authenticate-DlTGaBT8.js';
+import { P as PermissionConfig, R as RoleConfig, m as mainAuthRouter, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, K as KeySummary, c as RevokeAllKeysResult, I as IssueOneTimeTokenResult, O as OAuthStartResult, d as OAuthNativeResult, U as UserProfile, e as ProfileInfo } from './authenticate-55LeXHqZ.js';
+export { A as AuthInitOptions, f as AuthSession, g as PERMISSION_CATEGORIES, h as PermissionCategory, V as VERIFICATION_PURPOSES, i as VERIFICATION_TARGET_TYPES, j as VerificationPurpose, k as VerificationTargetType } from './authenticate-55LeXHqZ.js';
 import * as _spfn_core_route from '@spfn/core/route';
 import { HttpMethod } from '@spfn/core/route';
 export { A as ACCOUNT_DELETION_REQUESTED_BY, a as ACCOUNT_DELETION_REQUEST_STATUSES, b as AccountDeletionRequestStatus, c as AccountDeletionRequestedBy, I as INVITATION_STATUSES, d as InvitationStatus, e as KEY_ALGORITHM, f as KEY_DEVICE_NAME_MAX_LENGTH, g as KEY_PLATFORM, K as KeyAlgorithmType, h as KeyPlatformType, P as PURGE_STRATEGIES, i as PurgeStrategy, S as SOCIAL_PROVIDERS, j as SocialProvider, U as USER_STATUSES, k as UserStatus } from './types-DYyhze28.js';
@@ -563,6 +563,50 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         userId: number;
         roleId: number;
     }>;
+    issueOpsToken: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            name: _sinclair_typebox.TString;
+            scopes: _sinclair_typebox.TArray<_sinclair_typebox.TString>;
+            expiresInDays: _sinclair_typebox.TOptional<_sinclair_typebox.TUnion<[_sinclair_typebox.TNumber, _sinclair_typebox.TNull]>>;
+        }>;
+    }, {}, {
+        token: string;
+        opsToken: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        };
+    }>;
+    listOpsTokens: _spfn_core_route.RouteDef<{}, {}, {
+        opsTokens: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        }[];
+    }>;
+    revokeOpsToken: _spfn_core_route.RouteDef<{
+        params: _sinclair_typebox.TObject<{
+            id: _sinclair_typebox.TNumber;
+        }>;
+    }, {}, {
+        opsToken: {
+            id: number;
+            name: string;
+            scopes: string[];
+            expiresAt: string | null;
+            revokedAt: string | null;
+            lastUsedAt: string | null;
+            createdAt: string | null;
+        };
+    }>;
 }>>;
 type AuthRouter = typeof mainAuthRouter;
 

package/dist/index.js

@@ -298,7 +298,10 @@ var routeMap = {
   deleteAdminRole: { method: "DELETE", path: "/_auth/admin/roles/:id" },
   updateUserRole: { method: "PATCH", path: "/_auth/admin/users/:userId/role" },
   requestAccountDeletion: { method: "POST", path: "/_auth/deletion/request" },
-  cancelAccountDeletion: { method: "POST", path: "/_auth/deletion/cancel" }
+  cancelAccountDeletion: { method: "POST", path: "/_auth/deletion/cancel" },
+  issueOpsToken: { method: "POST", path: "/_auth/ops-tokens" },
+  listOpsTokens: { method: "GET", path: "/_auth/ops-tokens" },
+  revokeOpsToken: { method: "DELETE", path: "/_auth/ops-tokens/:id" }
 };
 
 // src/lib/types.ts