@tangle-network/agent-app 0.45.53 → 0.45.55

package/dist/platform/guards.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Request guards for agent-app routes: session auth (302 redirect for pages,
+ * JSON 401 for APIs), admin allowlisting (404 — the route stays invisible to
+ * non-admins), and the billable-balance gate (402 with a stable code).
+ * Session resolution is a seam; thrown Responses follow the router convention
+ * of surfacing a thrown Response as the route result.
+ */
+/** Define options for configuring authentication guard behavior and session retrieval */
+export interface AuthGuardOptions<Session> {
+    /** e.g. a better-auth `auth.api.getSession` wrapped by the app. */
+    getSession(request: Request): Promise<Session | null | undefined>;
+    /** Default '/login'. */
+    loginPath?: string;
+}
+/** Resolve user authentication and session requirements for page and API requests */
+export interface AuthGuard<Session> {
+    /** Page guard — throws a 302 redirect Response to `loginPath`. */
+    requireUser(request: Request): Promise<Session>;
+    /** API guard — throws JSON 401 `{ error: 'Unauthorized', code: 'auth.unauthenticated' }`. */
+    requireApiUser(request: Request): Promise<Session>;
+    /** `apiResponse` selects the 401 JSON path over the redirect. */
+    requireSession(request: Request, opts?: {
+        apiResponse?: boolean;
+    }): Promise<Session>;
+    getOptionalSession(request: Request): Promise<Session | null>;
+}
+/** Create an authentication guard that enforces session presence and handles unauthorized access responses */
+export declare function createAuthGuard<Session>(opts: AuthGuardOptions<Session>): AuthGuard<Session>;
+/** Resolve a value or an HTTP response indicating failure in a guarded operation */
+export type GuardResolution<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    response: Response;
+};
+/**
+ * Adapt a guard that THROWS a Response (the quartet above — the router
+ * convention) to the `{ok: true, value} | {ok: false, response}` resolution
+ * shape the route factories take (`/chat-routes` `authorize`,
+ * `/interactions` `resolveConnection`, `/chat-routes` upload `authorize`).
+ * Every product wrote this try/catch by hand; it lives here once.
+ */
+export declare function guardResolution<T>(run: () => Promise<T>): Promise<GuardResolution<T>>;
+/** Comma/whitespace separated → trimmed, lowercased, empties dropped. */
+export declare function parseAdminEmails(raw: string | null | undefined): string[];
+/** Define options to resolve user session and control access based on allowed admin emails */
+export interface AdminGuardOptions<Session> {
+    requireUser(request: Request): Promise<Session>;
+    emailOf(session: Session): string | null | undefined;
+    /** Resolved per request; an EMPTY allowlist refuses everyone. */
+    allowedEmails(): string[];
+}
+/** Non-admins (and empty allowlists) get 404, keeping the route invisible —
+ *  better than a "forbidden" footprint that advertises its existence. */
+export declare function createAdminGuard<Session>(opts: AdminGuardOptions<Session>): (request: Request) => Promise<Session>;
+/** Describe the billable balance state including overage permission and remaining USD balance */
+export interface BillableBalanceState {
+    overageAllowed: boolean;
+    remainingBalanceUsd: number;
+}
+/** Define options to assert and customize billable balance enforcement behavior */
+export interface AssertBillableBalanceOptions {
+    env?: Record<string, string | undefined>;
+    /** App-specific enforcement override flag (e.g. 'GTM_BILLING_ENFORCEMENT'),
+     *  fed to `isTangleBillingEnforcementDisabled`. */
+    enforcementEnvVar?: string;
+    /** Default 'Add balance or upgrade your plan to invoke this agent.'. */
+    errorMessage?: string;
+    /** Merged into the 402 JSON body (e.g. `{ organizationId }`). */
+    errorBody?: Record<string, unknown>;
+}
+/**
+ * Gate a billable turn: passes when enforcement is disabled (dev default),
+ * the tier allows overage, or remaining balance is positive. Otherwise throws
+ * a 402 Response with the stable `billing.balance_required` code so clients
+ * can route to the billing screen.
+ */
+export declare function assertBillableBalance(state: BillableBalanceState, opts?: AssertBillableBalanceOptions): void;

package/dist/platform/hub.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Integrations-hub proxy routes: the app-side surface that forwards an
+ * authenticated user's requests to the platform's `/v1/integrations/*` API
+ * using their stored platform key. Auth, key lookup, and the wire client are
+ * structural seams (`HubProxyContext`); error detection is by name + shape so
+ * it survives bundlers duplicating module instances.
+ */
+import { type TangleExecutionEnvironment, type TangleExecutionKeySource } from '../runtime/model';
+/** Hub bearer provenance mirrors the execution-key source union. */
+export type TangleHubBearerSource = TangleExecutionKeySource;
+/** Represent a resolved bearer token with its associated TangleHub bearer source */
+export interface ResolvedTangleHubBearer {
+    bearer: string;
+    source: TangleHubBearerSource;
+}
+/** Resolve options required to obtain a user's TangleHub bearer token including environment and API key retrieval */
+export interface ResolveUserTangleHubBearerOptions {
+    userId: string;
+    /** Deployment context. Only local development may use env credentials. */
+    environment?: TangleExecutionEnvironment;
+    /** Env to read for the local-development bearer. */
+    env?: Record<string, string | undefined>;
+    /** App-owned lookup for the caller's linked platform API key. */
+    getUserApiKey: () => string | null | undefined | Promise<string | null | undefined>;
+}
+/** Resolve options for retrieving a TangleHub bearer token for a specified user */
+export interface ResolveUserTangleHubBearerForUserOptions<UserId = string> {
+    userId: UserId;
+    environment?: TangleExecutionEnvironment;
+    env?: Record<string, string | undefined>;
+    getUserApiKey: (userId: UserId) => string | null | undefined | Promise<string | null | undefined>;
+}
+/** Represent missing Tangle platform link error for a specified user ID */
+export declare class TangleBearerMissingError extends Error {
+    readonly userId: string;
+    constructor(userId: string);
+}
+/**
+ * Resolve the Tangle bearer used by the integration hub proxy.
+ *
+ * Local development may use a server env key so apps can exercise the hub
+ * without completing cross-site SSO. Deployed contexts must use the caller's
+ * linked platform key; this keeps integration ownership aligned with the user.
+ */
+export declare function resolveUserTangleHubBearer(opts: ResolveUserTangleHubBearerOptions): Promise<ResolvedTangleHubBearer>;
+/** Resolve the TangleHub bearer token for a specified user based on provided options */
+export declare function resolveUserTangleHubBearerForUser<UserId = string>(opts: ResolveUserTangleHubBearerForUserOptions<UserId>): Promise<ResolvedTangleHubBearer>;
+/** Structural guard (name + userId shape) — robust when the error class is
+ *  constructed in a different module instance than the one checking it. */
+export declare function isTangleBearerMissingError(error: unknown): error is TangleBearerMissingError;
+/** Structural detection of the platform hub wire error (name + numeric status). */
+export declare function isPlatformHubErrorLike(error: unknown): error is Error & {
+    status: number;
+    code?: string;
+};
+/** Structural subset of the platform hub wire client — extra methods are fine. */
+export interface HubClientLike {
+    catalog(): Promise<unknown>;
+    listConnections(): Promise<unknown>;
+    revokeConnection(connectionId: string): Promise<unknown>;
+    startAuth(input: {
+        providerId: string;
+        connectorId: string;
+        returnUrl: string;
+        requestedScopes?: string[];
+    }): Promise<{
+        authorizationUrl: string;
+        state: string;
+    }>;
+    listHealthchecks(): Promise<unknown>;
+}
+/** Define methods to require user ID, get bearer token, and create a hub client bound to the bearer */
+export interface HubProxyContext {
+    /** Resolve the authenticated user id. Throw the app's own auth Response /
+     *  redirect to reject — it propagates untouched. */
+    requireUserId(request: Request): Promise<string>;
+    /** The user's platform bearer; throw `TangleBearerMissingError` when unlinked. */
+    getBearer(userId: string): Promise<string>;
+    /** A hub client bound to the bearer. */
+    createHubClient(bearer: string): HubClientLike;
+}
+/** Define arguments for configuring a proxy route with request and optional parameters */
+export interface HubProxyRouteArgs {
+    request: Request;
+    params?: Record<string, string | undefined>;
+}
+/** Define routes for hub proxy handling catalog, connections, healthchecks, and authorization actions */
+export interface HubProxyRoutes {
+    /** GET → `{ catalog }`. */
+    catalog(args: HubProxyRouteArgs): Promise<Response>;
+    /** GET → `{ connections }`. */
+    connections(args: HubProxyRouteArgs): Promise<Response>;
+    /** DELETE → the platform revocation result verbatim; 405 otherwise. */
+    connectionDelete(args: {
+        request: Request;
+        params: {
+            connectionId: string;
+        };
+    }): Promise<Response>;
+    /** GET → `{ healthchecks }`. */
+    healthchecks(args: HubProxyRouteArgs): Promise<Response>;
+    /** POST `{ providerId, connectorId, returnUrl, requestedScopes? }` →
+     *  `{ authorizationUrl, state }`; 405 non-POST; 400 on bad JSON / missing fields. */
+    authStart(args: HubProxyRouteArgs): Promise<Response>;
+}
+/** Resolve hub proxy routes with authentication and error handling based on the given context */
+export declare function createHubProxyRoutes(ctx: HubProxyContext): HubProxyRoutes;

package/dist/platform/index.d.ts

@@ -1,114 +1,9 @@
-export { c as AdminGuardOptions, d as AssertBillableBalanceOptions, A as AuthGuard, e as AuthGuardOptions, B as BetterAuthSessionCookieMinterOptions, f as BetterAuthSessionCookieSource, g as BillableBalanceState, G as GuardResolution, S as SsoStateConfig, b as TangleSsoAccountStore, a as TangleSsoAuthClient, h as TangleSsoExchangeResult, i as TangleSsoHandlerOptions, T as TangleSsoHandlers, j as TangleSsoSessionCookieArgs, k as TangleSsoUserCreateError, l as assertBillableBalance, m as createAdminGuard, n as createAuthGuard, o as createBetterAuthSessionCookieMinter, p as createSignedSsoState, q as createTangleSsoHandlers, r as guardResolution, s as parseAdminEmails, t as signSessionCookieValue, v as verifySignedSsoState } from '../sso-Cm00S61u.js';
-import { a as TangleExecutionEnvironment, b as TangleExecutionKeySource } from '../model-CdCDfBA9.js';
-export { D as DEFAULT_SEAT_BILLING_ENABLED_ENV_VAR, a as DEFAULT_TANGLE_TIER_POLICY, F as FREE_TIER_SPEND_CAP_USD, P as PlatformBalanceSnapshot, b as PlatformBillingHttp, c as PlatformBillingHttpError, d as PlatformBillingHttpOptions, e as PlatformIdentityStore, f as PlatformSubscriptionInfo, g as PlatformUsageProductRow, h as ProductEntitlement, i as ProductSeatOffer, j as ProductSeatOfferPeriod, S as SeatBillingFlagOptions, k as SeatStatus, T as TanglePlanTier, l as TangleTierPolicy, m as TangleTierState, n as createPlatformBillingHttp, o as createTanglePlatformBillingClient, p as getProductEntitlement, q as isPlatformBillingHttpError, r as isProductEntitled, s as isSeatBillingEnabled, t as normalizeTanglePlanTier, u as readTangleTierState, v as seatCheckoutUrl } from '../billing-BuNlaKlE.js';
-import '../billing/index.js';
-
 /**
- * Integrations-hub proxy routes: the app-side surface that forwards an
- * authenticated user's requests to the platform's `/v1/integrations/*` API
- * using their stored platform key. Auth, key lookup, and the wire client are
- * structural seams (`HubProxyContext`); error detection is by name + shape so
- * it survives bundlers duplicating module instances.
+ * App-side glue for running a product on the Tangle platform
+ * (id.tangle.tools): cross-site SSO login orchestration. The wire clients
+ * and persistence are structural seams; this module owns the protocol.
  */
-
-/** Hub bearer provenance mirrors the execution-key source union. */
-type TangleHubBearerSource = TangleExecutionKeySource;
-/** Represent a resolved bearer token with its associated TangleHub bearer source */
-interface ResolvedTangleHubBearer {
-    bearer: string;
-    source: TangleHubBearerSource;
-}
-/** Resolve options required to obtain a user's TangleHub bearer token including environment and API key retrieval */
-interface ResolveUserTangleHubBearerOptions {
-    userId: string;
-    /** Deployment context. Only local development may use env credentials. */
-    environment?: TangleExecutionEnvironment;
-    /** Env to read for the local-development bearer. */
-    env?: Record<string, string | undefined>;
-    /** App-owned lookup for the caller's linked platform API key. */
-    getUserApiKey: () => string | null | undefined | Promise<string | null | undefined>;
-}
-/** Resolve options for retrieving a TangleHub bearer token for a specified user */
-interface ResolveUserTangleHubBearerForUserOptions<UserId = string> {
-    userId: UserId;
-    environment?: TangleExecutionEnvironment;
-    env?: Record<string, string | undefined>;
-    getUserApiKey: (userId: UserId) => string | null | undefined | Promise<string | null | undefined>;
-}
-/** Represent missing Tangle platform link error for a specified user ID */
-declare class TangleBearerMissingError extends Error {
-    readonly userId: string;
-    constructor(userId: string);
-}
-/**
- * Resolve the Tangle bearer used by the integration hub proxy.
- *
- * Local development may use a server env key so apps can exercise the hub
- * without completing cross-site SSO. Deployed contexts must use the caller's
- * linked platform key; this keeps integration ownership aligned with the user.
- */
-declare function resolveUserTangleHubBearer(opts: ResolveUserTangleHubBearerOptions): Promise<ResolvedTangleHubBearer>;
-/** Resolve the TangleHub bearer token for a specified user based on provided options */
-declare function resolveUserTangleHubBearerForUser<UserId = string>(opts: ResolveUserTangleHubBearerForUserOptions<UserId>): Promise<ResolvedTangleHubBearer>;
-/** Structural guard (name + userId shape) — robust when the error class is
- *  constructed in a different module instance than the one checking it. */
-declare function isTangleBearerMissingError(error: unknown): error is TangleBearerMissingError;
-/** Structural detection of the platform hub wire error (name + numeric status). */
-declare function isPlatformHubErrorLike(error: unknown): error is Error & {
-    status: number;
-    code?: string;
-};
-/** Structural subset of the platform hub wire client — extra methods are fine. */
-interface HubClientLike {
-    catalog(): Promise<unknown>;
-    listConnections(): Promise<unknown>;
-    revokeConnection(connectionId: string): Promise<unknown>;
-    startAuth(input: {
-        providerId: string;
-        connectorId: string;
-        returnUrl: string;
-        requestedScopes?: string[];
-    }): Promise<{
-        authorizationUrl: string;
-        state: string;
-    }>;
-    listHealthchecks(): Promise<unknown>;
-}
-/** Define methods to require user ID, get bearer token, and create a hub client bound to the bearer */
-interface HubProxyContext {
-    /** Resolve the authenticated user id. Throw the app's own auth Response /
-     *  redirect to reject — it propagates untouched. */
-    requireUserId(request: Request): Promise<string>;
-    /** The user's platform bearer; throw `TangleBearerMissingError` when unlinked. */
-    getBearer(userId: string): Promise<string>;
-    /** A hub client bound to the bearer. */
-    createHubClient(bearer: string): HubClientLike;
-}
-/** Define arguments for configuring a proxy route with request and optional parameters */
-interface HubProxyRouteArgs {
-    request: Request;
-    params?: Record<string, string | undefined>;
-}
-/** Define routes for hub proxy handling catalog, connections, healthchecks, and authorization actions */
-interface HubProxyRoutes {
-    /** GET → `{ catalog }`. */
-    catalog(args: HubProxyRouteArgs): Promise<Response>;
-    /** GET → `{ connections }`. */
-    connections(args: HubProxyRouteArgs): Promise<Response>;
-    /** DELETE → the platform revocation result verbatim; 405 otherwise. */
-    connectionDelete(args: {
-        request: Request;
-        params: {
-            connectionId: string;
-        };
-    }): Promise<Response>;
-    /** GET → `{ healthchecks }`. */
-    healthchecks(args: HubProxyRouteArgs): Promise<Response>;
-    /** POST `{ providerId, connectorId, returnUrl, requestedScopes? }` →
-     *  `{ authorizationUrl, state }`; 405 non-POST; 400 on bad JSON / missing fields. */
-    authStart(args: HubProxyRouteArgs): Promise<Response>;
-}
-/** Resolve hub proxy routes with authentication and error handling based on the given context */
-declare function createHubProxyRoutes(ctx: HubProxyContext): HubProxyRoutes;
-
-export { type HubClientLike, type HubProxyContext, type HubProxyRouteArgs, type HubProxyRoutes, type ResolveUserTangleHubBearerForUserOptions, type ResolveUserTangleHubBearerOptions, type ResolvedTangleHubBearer, TangleBearerMissingError, type TangleHubBearerSource, createHubProxyRoutes, isPlatformHubErrorLike, isTangleBearerMissingError, resolveUserTangleHubBearer, resolveUserTangleHubBearerForUser };
+export * from './sso';
+export * from './hub';
+export * from './billing';
+export * from './guards';

package/dist/{sso-Cm00S61u.d.ts → platform/sso.d.ts}

@@ -1,83 +1,3 @@
-/**
- * Request guards for agent-app routes: session auth (302 redirect for pages,
- * JSON 401 for APIs), admin allowlisting (404 — the route stays invisible to
- * non-admins), and the billable-balance gate (402 with a stable code).
- * Session resolution is a seam; thrown Responses follow the router convention
- * of surfacing a thrown Response as the route result.
- */
-/** Define options for configuring authentication guard behavior and session retrieval */
-interface AuthGuardOptions<Session> {
-    /** e.g. a better-auth `auth.api.getSession` wrapped by the app. */
-    getSession(request: Request): Promise<Session | null | undefined>;
-    /** Default '/login'. */
-    loginPath?: string;
-}
-/** Resolve user authentication and session requirements for page and API requests */
-interface AuthGuard<Session> {
-    /** Page guard — throws a 302 redirect Response to `loginPath`. */
-    requireUser(request: Request): Promise<Session>;
-    /** API guard — throws JSON 401 `{ error: 'Unauthorized', code: 'auth.unauthenticated' }`. */
-    requireApiUser(request: Request): Promise<Session>;
-    /** `apiResponse` selects the 401 JSON path over the redirect. */
-    requireSession(request: Request, opts?: {
-        apiResponse?: boolean;
-    }): Promise<Session>;
-    getOptionalSession(request: Request): Promise<Session | null>;
-}
-/** Create an authentication guard that enforces session presence and handles unauthorized access responses */
-declare function createAuthGuard<Session>(opts: AuthGuardOptions<Session>): AuthGuard<Session>;
-/** Resolve a value or an HTTP response indicating failure in a guarded operation */
-type GuardResolution<T> = {
-    ok: true;
-    value: T;
-} | {
-    ok: false;
-    response: Response;
-};
-/**
- * Adapt a guard that THROWS a Response (the quartet above — the router
- * convention) to the `{ok: true, value} | {ok: false, response}` resolution
- * shape the route factories take (`/chat-routes` `authorize`,
- * `/interactions` `resolveConnection`, `/chat-routes` upload `authorize`).
- * Every product wrote this try/catch by hand; it lives here once.
- */
-declare function guardResolution<T>(run: () => Promise<T>): Promise<GuardResolution<T>>;
-/** Comma/whitespace separated → trimmed, lowercased, empties dropped. */
-declare function parseAdminEmails(raw: string | null | undefined): string[];
-/** Define options to resolve user session and control access based on allowed admin emails */
-interface AdminGuardOptions<Session> {
-    requireUser(request: Request): Promise<Session>;
-    emailOf(session: Session): string | null | undefined;
-    /** Resolved per request; an EMPTY allowlist refuses everyone. */
-    allowedEmails(): string[];
-}
-/** Non-admins (and empty allowlists) get 404, keeping the route invisible —
- *  better than a "forbidden" footprint that advertises its existence. */
-declare function createAdminGuard<Session>(opts: AdminGuardOptions<Session>): (request: Request) => Promise<Session>;
-/** Describe the billable balance state including overage permission and remaining USD balance */
-interface BillableBalanceState {
-    overageAllowed: boolean;
-    remainingBalanceUsd: number;
-}
-/** Define options to assert and customize billable balance enforcement behavior */
-interface AssertBillableBalanceOptions {
-    env?: Record<string, string | undefined>;
-    /** App-specific enforcement override flag (e.g. 'GTM_BILLING_ENFORCEMENT'),
-     *  fed to `isTangleBillingEnforcementDisabled`. */
-    enforcementEnvVar?: string;
-    /** Default 'Add balance or upgrade your plan to invoke this agent.'. */
-    errorMessage?: string;
-    /** Merged into the 402 JSON body (e.g. `{ organizationId }`). */
-    errorBody?: Record<string, unknown>;
-}
-/**
- * Gate a billable turn: passes when enforcement is disabled (dev default),
- * the tier allows overage, or remaining balance is positive. Otherwise throws
- * a 402 Response with the stable `billing.balance_required` code so clients
- * can route to the billing screen.
- */
-declare function assertBillableBalance(state: BillableBalanceState, opts?: AssertBillableBalanceOptions): void;
-
 /**
  * Cross-site Tangle SSO for agent apps: signed-state CSRF cookies plus the
  * full start/callback orchestration against the platform's /cross-site
@@ -87,7 +7,7 @@ declare function assertBillableBalance(state: BillableBalanceState, opts?: Asser
  * WebCrypto only — runs in workerd without node compatibility flags.
  */
 /** Define configuration options for managing SSO state including secret, lifetime, and clock injection */
-interface SsoStateConfig {
+export interface SsoStateConfig {
     /** HMAC-SHA256 secret (e.g. the app's auth secret). */
     secret: string;
     /** State lifetime in ms. Default 600 000. */
@@ -97,11 +17,11 @@ interface SsoStateConfig {
 }
 /** Mint a `<randomHex32>.<timestamp36>.<hmacHex>` state value. The timestamp
  *  is inside the signed payload, so expiry survives cookie-attribute tampering. */
-declare function createSignedSsoState(config: SsoStateConfig): Promise<string>;
+export declare function createSignedSsoState(config: SsoStateConfig): Promise<string>;
 /** Verify the MAC (constant-time) and the signed TTL. */
-declare function verifySignedSsoState(state: string, config: SsoStateConfig): Promise<boolean>;
+export declare function verifySignedSsoState(state: string, config: SsoStateConfig): Promise<boolean>;
 /** Describe the result of exchanging SSO credentials including API key, user info, and optional plan details */
-interface TangleSsoExchangeResult {
+export interface TangleSsoExchangeResult {
     apiKey: string;
     user: {
         id: string;
@@ -114,7 +34,7 @@ interface TangleSsoExchangeResult {
 }
 /** Structural mirror of the platform auth wire client — any object with these
  *  two methods satisfies it without this module importing the concrete class. */
-interface TangleSsoAuthClient {
+export interface TangleSsoAuthClient {
     authorizeUrl(options: {
         state: string;
         redirectUri?: string;
@@ -124,7 +44,7 @@ interface TangleSsoAuthClient {
 /** Thrown by `upsertUserByEmail` when the app-local user row cannot be
  *  created; the callback handler maps it to `?error=tangle_user_create_failed`.
  *  Any other store error propagates. */
-declare class TangleSsoUserCreateError extends Error {
+export declare class TangleSsoUserCreateError extends Error {
     constructor(message?: string);
 }
 /**
@@ -134,7 +54,7 @@ declare class TangleSsoUserCreateError extends Error {
  * and each app persists with the key it needs. `createSession` runs first so
  * the token is always available to `saveTangleLink`.
  */
-interface TangleSsoAccountStore {
+export interface TangleSsoAccountStore {
     /** Find-or-create the app-local user. `tangleUserId` is the platform's
      *  stable user id — match on it first when the app stores it (emails are
      *  mutable on the platform; the id is not), falling back to email for
@@ -167,7 +87,7 @@ interface TangleSsoAccountStore {
     }): Promise<void>;
 }
 /** Successful-login context handed to the `setSessionCookie` seam. */
-interface TangleSsoSessionCookieArgs {
+export interface TangleSsoSessionCookieArgs {
     /** Session token returned by `store.createSession`. */
     token: string;
     /** Session expiry (now + `sessionTtlSeconds`). */
@@ -186,12 +106,12 @@ interface TangleSsoSessionCookieArgs {
  * as a null session). The joined value is percent-encoded once at cookie
  * serialization, matching better-call's `serializeSignedCookie` byte-exactly.
  */
-declare function signSessionCookieValue(token: string, secret: string): Promise<string>;
+export declare function signSessionCookieValue(token: string, secret: string): Promise<string>;
 /** Structural slice of a `betterAuth()` instance — only what cookie minting
  *  reads. No better-auth import: the signing contract is implemented by
  *  `signSessionCookieValue`, byte-compatible with better-auth's own
  *  `makeSignature`. */
-interface BetterAuthSessionCookieSource {
+export interface BetterAuthSessionCookieSource {
     $context: PromiseLike<{
         secret: string;
         authCookies: {
@@ -211,7 +131,7 @@ interface BetterAuthSessionCookieSource {
     }>;
 }
 /** Define options to customize warning behavior for shadowed cookie names in authentication sessions */
-interface BetterAuthSessionCookieMinterOptions {
+export interface BetterAuthSessionCookieMinterOptions {
     /** Receives the shadowed-cookie-name warning (see below). Default
      *  console.warn. */
     warn?: (message: string) => void;
@@ -236,9 +156,9 @@ interface BetterAuthSessionCookieMinterOptions {
  * Throws on a domain-scoped session cookie for the same reason: a
  * `Domain=`-wide session cookie is exactly the shadowing footgun.
  */
-declare function createBetterAuthSessionCookieMinter(auth: BetterAuthSessionCookieSource, options?: BetterAuthSessionCookieMinterOptions): (args: TangleSsoSessionCookieArgs) => Promise<string[]>;
+export declare function createBetterAuthSessionCookieMinter(auth: BetterAuthSessionCookieSource, options?: BetterAuthSessionCookieMinterOptions): (args: TangleSsoSessionCookieArgs) => Promise<string[]>;
 /** Define configuration options for handling Tangle SSO authentication and session management */
-interface TangleSsoHandlerOptions {
+export interface TangleSsoHandlerOptions {
     auth: TangleSsoAuthClient;
     store: TangleSsoAccountStore;
     /** HMAC secret for the state cookie. */
@@ -281,7 +201,7 @@ interface TangleSsoHandlerOptions {
     now?: () => number;
 }
 /** Define handlers for SSO start and callback routes managing authentication flow and session cookies */
-interface TangleSsoHandlers {
+export interface TangleSsoHandlers {
     /** GET start route: mint + sign state, set the state cookie, 302 to the
      *  platform authorize URL. `?redirect=` carries the post-login path. */
     start(request: Request): Promise<Response>;
@@ -293,6 +213,4 @@ interface TangleSsoHandlers {
     callback(request: Request): Promise<Response>;
 }
 /** Create Tangle SSO handlers to manage authentication state, callbacks, and session cookies */
-declare function createTangleSsoHandlers(opts: TangleSsoHandlerOptions): TangleSsoHandlers;
-
-export { type AuthGuard as A, type BetterAuthSessionCookieMinterOptions as B, type GuardResolution as G, type SsoStateConfig as S, type TangleSsoHandlers as T, type TangleSsoAuthClient as a, type TangleSsoAccountStore as b, type AdminGuardOptions as c, type AssertBillableBalanceOptions as d, type AuthGuardOptions as e, type BetterAuthSessionCookieSource as f, type BillableBalanceState as g, type TangleSsoExchangeResult as h, type TangleSsoHandlerOptions as i, type TangleSsoSessionCookieArgs as j, TangleSsoUserCreateError as k, assertBillableBalance as l, createAdminGuard as m, createAuthGuard as n, createBetterAuthSessionCookieMinter as o, createSignedSsoState as p, createTangleSsoHandlers as q, guardResolution as r, parseAdminEmails as s, signSessionCookieValue as t, verifySignedSsoState as v };
+export declare function createTangleSsoHandlers(opts: TangleSsoHandlerOptions): TangleSsoHandlers;

package/dist/preflight/cli.d.ts

@@ -1,13 +1,10 @@
 #!/usr/bin/env node
-import { PreflightProbe } from './index.js';
-
+import { type PreflightProbe } from './index';
 /**
  * Load the probe list from a config module. Fail loud on every miss — a
  * preflight that silently probes nothing and exits 0 is worse than no
  * preflight, because it reports the deploy as verified.
  */
-declare function loadProbes(configPath: string): Promise<PreflightProbe[]>;
+export declare function loadProbes(configPath: string): Promise<PreflightProbe[]>;
 /** Run the probes named by `argv` and resolve with the process exit code. */
-declare function runPreflightCli(argv: readonly string[]): Promise<number>;
-
-export { loadProbes, runPreflightCli };
+export declare function runPreflightCli(argv: readonly string[]): Promise<number>;

package/dist/preflight/index.d.ts

@@ -23,7 +23,7 @@
  * must never reach a browser bundle.
  */
 /** One probe's outcome. `detail` should name the secret to rotate on failure. */
-interface PreflightProbeResult {
+export interface PreflightProbeResult {
     ok: boolean;
     detail?: string;
 }
@@ -32,13 +32,13 @@ interface PreflightProbeResult {
  * `{ ok, detail }`. `critical` defaults to `true` — a failed critical probe
  * fails the whole preflight (and the deploy).
  */
-interface PreflightProbe {
+export interface PreflightProbe {
     name: string;
     run: () => Promise<PreflightProbeResult>;
     critical?: boolean;
 }
 /** Per-probe verdict enriched with the resolved criticality and measured latency. */
-interface PreflightProbeVerdict {
+export interface PreflightProbeVerdict {
     name: string;
     ok: boolean;
     critical: boolean;
@@ -46,7 +46,7 @@ interface PreflightProbeVerdict {
     detail?: string;
 }
 /** Aggregate of every probe verdict plus the overall pass/fail decision. */
-interface PreflightReport {
+export interface PreflightReport {
     /** `false` if any critical probe failed. */
     ok: boolean;
     probes: PreflightProbeVerdict[];
@@ -56,7 +56,7 @@ interface PreflightReport {
     durationMs: number;
 }
 /** Configuration for a required non-empty production value. */
-interface RequiredValueProbeConfig {
+export interface RequiredValueProbeConfig {
     /** Human-readable value name, normally the environment variable name. */
     name: string;
     /** Value supplied by the caller. It is checked but never included in output. */
@@ -73,9 +73,9 @@ interface RequiredValueProbeConfig {
  * endpoint to probe. Credentials with a live API should use a liveness probe
  * instead, because presence alone cannot detect an expired key.
  */
-declare function requiredValueProbe(config: RequiredValueProbeConfig): PreflightProbe;
+export declare function requiredValueProbe(config: RequiredValueProbeConfig): PreflightProbe;
 /** Define configuration options for probing an LLM router with authentication and model details */
-interface RouterChatProbeConfig {
+export interface RouterChatProbeConfig {
     /** LLM router base URL (LiteLLM / OpenAI-compatible), e.g. `https://router…`. */
     baseUrl: string;
     apiKey: string;
@@ -99,9 +99,9 @@ interface RouterChatProbeConfig {
  * (`max_tokens: 1`). 200 → live; 401/403 → dead router key; 503 → upstream
  * provider down (key still valid); timeout / unreachable → check the router URL.
  */
-declare function routerChatProbe(config: RouterChatProbeConfig): PreflightProbe;
+export declare function routerChatProbe(config: RouterChatProbeConfig): PreflightProbe;
 /** Define configuration options for probing sandbox authentication endpoints */
-interface SandboxAuthProbeConfig {
+export interface SandboxAuthProbeConfig {
     /** Sandbox API base URL. */
     baseUrl: string;
     apiKey: string;
@@ -123,9 +123,9 @@ interface SandboxAuthProbeConfig {
  * 200 → live; 401/403 → dead sandbox key; 503 → sandbox platform down (key
  * still valid); timeout / unreachable → check the sandbox URL.
  */
-declare function sandboxAuthProbe(config: SandboxAuthProbeConfig): PreflightProbe;
+export declare function sandboxAuthProbe(config: SandboxAuthProbeConfig): PreflightProbe;
 /** Define configuration options for performing an HTTP HEAD probe to check URL availability */
-interface HttpHeadProbeConfig {
+export interface HttpHeadProbeConfig {
     /** Probe name in the report. */
     name: string;
     /** URL to `HEAD`. */
@@ -150,9 +150,9 @@ interface HttpHeadProbeConfig {
  * Confirms the URL is live and resolving — the class of failure behind a stale
  * platform URL that still sits in the secret store.
  */
-declare function httpHeadProbe(config: HttpHeadProbeConfig): PreflightProbe;
+export declare function httpHeadProbe(config: HttpHeadProbeConfig): PreflightProbe;
 /** Define configuration options for probing that the Slack alerting channel is live */
-interface SlackAlertProbeConfig {
+export interface SlackAlertProbeConfig {
     /** Slack bot token (`xoxb-…`). */
     token: string | undefined;
     /** Probe name in the report. Default `'slack-alerting'`. */
@@ -183,15 +183,13 @@ interface SlackAlertProbeConfig {
  *
  * Non-critical by default — see `critical`.
  */
-declare function slackAlertProbe(config: SlackAlertProbeConfig): PreflightProbe;
+export declare function slackAlertProbe(config: SlackAlertProbeConfig): PreflightProbe;
 /**
  * Run every probe (concurrently), time each, and fold into a report. The run
  * fails (`ok: false`) iff a critical probe fails; a failed non-critical probe
  * is a warning that does not block the deploy.
  */
-declare function runPreflight(probes: PreflightProbe[]): Promise<PreflightReport>;
+export declare function runPreflight(probes: PreflightProbe[]): Promise<PreflightReport>;
 /** Render a report as an aligned, operator-readable table + verdict line. Pure
  *  (no I/O) so it is trivially testable and reusable by the bin. */
-declare function formatPreflightReport(report: PreflightReport): string;
-
-export { type HttpHeadProbeConfig, type PreflightProbe, type PreflightProbeResult, type PreflightProbeVerdict, type PreflightReport, type RequiredValueProbeConfig, type RouterChatProbeConfig, type SandboxAuthProbeConfig, type SlackAlertProbeConfig, formatPreflightReport, httpHeadProbe, requiredValueProbe, routerChatProbe, runPreflight, sandboxAuthProbe, slackAlertProbe };
+export declare function formatPreflightReport(report: PreflightReport): string;

package/dist/preset-cloudflare/headers.d.ts

@@ -0,0 +1,12 @@
+/** One path rule in Cloudflare's static-asset `_headers` file. */
+export interface CloudflareHeadersRule {
+    pattern: string;
+    headers: Readonly<Record<string, string>>;
+}
+/**
+ * Render native Cloudflare static-asset header rules.
+ *
+ * Values are validated before serialization so a product setting cannot add a
+ * second path rule or response header through a newline.
+ */
+export declare function renderCloudflareHeadersFile(rules: readonly CloudflareHeadersRule[]): string;