@timeback/sdk 0.1.6 → 0.1.8

package/dist/server/handlers/identity-only/handler.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Identity-Only Handlers
+ *
+ * This module is intentionally minimal and does NOT import Timeback API client code.
+ * It is safe to include in edge runtimes (e.g. Cloudflare Workers / workerd).
+ */
+import type { IdentityOnlyHandlerParams, IdentityOnlyHandlers } from './types';
+/**
+ * Create identity route handlers (identity-only mode).
+ *
+ * @param params - Handler configuration
+ * @returns Identity-only handlers
+ */
+export declare function createIdentityOnlyHandlers<TState = unknown>(params: IdentityOnlyHandlerParams<TState>): IdentityOnlyHandlers;
+//# sourceMappingURL=handler.d.ts.map

package/dist/server/handlers/identity-only/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/server/handlers/identity-only/handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAE9E;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,GAAG,OAAO,EAC1D,MAAM,EAAE,yBAAyB,CAAC,MAAM,CAAC,GACvC,oBAAoB,CAYtB"}

package/dist/server/handlers/identity-only/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Identity-Only Handler
+ *
+ * Route handlers for SSO authentication without Timeback user resolution (edge-safe).
+ */
+export { createIdentityOnlyHandlers } from './handler';
+export type { IdentityOnlyHandlerParams, IdentityOnlyHandlers } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/handlers/identity-only/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/handlers/identity-only/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAA;AACtD,YAAY,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA"}

package/dist/server/handlers/identity-only/oidc.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Identity-Only OIDC Flow
+ *
+ * Sign-in, callback, and token exchange for SSO authentication (edge-safe).
+ * This module is intentionally minimal and does NOT import Timeback API client code.
+ */
+import type { Environment, IdentityOnlyCallbackSuccessContext, SsoIdentityConfig } from '../../types';
+/**
+ * Handle sign-in request.
+ *
+ * @param req - Incoming request
+ * @param env - Environment configuration
+ * @param identity - Identity-only SSO configuration
+ * @returns Redirect response to IdP
+ */
+export declare function handleSignIn<TState>(req: Request, env: Environment, identity: SsoIdentityConfig<TState, IdentityOnlyCallbackSuccessContext<TState>>): Promise<Response>;
+/**
+ * Handle callback request for identity-only mode.
+ *
+ * @param req - Incoming request
+ * @param env - Environment configuration
+ * @param identity - Identity-only SSO configuration
+ * @returns Response from callback handler
+ */
+export declare function handleCallback<TState>(req: Request, env: Environment, identity: SsoIdentityConfig<TState, IdentityOnlyCallbackSuccessContext<TState>>): Promise<Response>;
+//# sourceMappingURL=oidc.d.ts.map

package/dist/server/handlers/identity-only/oidc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../../../../src/server/handlers/identity-only/oidc.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAcH,OAAO,KAAK,EACX,WAAW,EACX,kCAAkC,EAClC,iBAAiB,EACjB,MAAM,aAAa,CAAA;AAMpB;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,MAAM,EACxC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,kCAAkC,CAAC,MAAM,CAAC,CAAC,GAC7E,OAAO,CAAC,QAAQ,CAAC,CASnB;AA4ED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAC1C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,kCAAkC,CAAC,MAAM,CAAC,CAAC,GAC7E,OAAO,CAAC,QAAQ,CAAC,CAYnB"}

package/dist/server/handlers/identity-only/types.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Identity-Only Handler Types
+ *
+ * Feature-local types for identity-only SSO handlers (edge-safe).
+ */
+import type { CallbackErrorContext, Environment, IdentityOnlyCallbackSuccessContext, SsoIdentityConfig } from '../../types';
+/** Configuration for identity-only handlers. */
+export interface IdentityOnlyHandlerParams<TState = unknown> {
+    env: Environment;
+    identity: SsoIdentityConfig<TState, IdentityOnlyCallbackSuccessContext<TState>>;
+}
+/** Identity-only handlers returned by createIdentityOnlyHandlers. */
+export interface IdentityOnlyHandlers {
+    signIn: (req: Request) => Promise<Response>;
+    callback: (req: Request) => Promise<Response>;
+    signOut: () => Response;
+}
+export type { CallbackErrorContext, Environment, IdentityOnlyCallbackSuccessContext, SsoIdentityConfig, };
+//# sourceMappingURL=types.d.ts.map

package/dist/server/handlers/identity-only/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/server/handlers/identity-only/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACX,oBAAoB,EACpB,WAAW,EACX,kCAAkC,EAClC,iBAAiB,EACjB,MAAM,aAAa,CAAA;AAEpB,gDAAgD;AAChD,MAAM,WAAW,yBAAyB,CAAC,MAAM,GAAG,OAAO;IAC1D,GAAG,EAAE,WAAW,CAAA;IAChB,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,kCAAkC,CAAC,MAAM,CAAC,CAAC,CAAA;CAC/E;AAED,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3C,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7C,OAAO,EAAE,MAAM,QAAQ,CAAA;CACvB;AAGD,YAAY,EACX,oBAAoB,EACpB,WAAW,EACX,kCAAkC,EAClC,iBAAiB,GACjB,CAAA"}

package/dist/server/handlers/index.d.ts

@@ -3,7 +3,10 @@
  *
  * Route handlers for Timeback server operations.
  */
-export { createIdentityHandlers } from './identity-full';
 export { createActivityHandler } from './activity';
-export { createUserHandler } from './user';
+export { createIdentityHandlers } from './identity';
+export { createUserHandler, createUserVerifyHandler } from './user';
+export type { ActivityHandler, ActivityHandlerConfig } from './activity';
+export type { IdentityHandlerParams, IdentityHandlers } from './identity';
+export type { UserHandler, UserHandlerConfig, UserVerifyHandler, UserVerifyHandlerConfig } from './user';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/handlers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/handlers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,QAAQ,CAAA;AAEnE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AACxE,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACzE,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,QAAQ,CAAA"}

package/dist/server/{lib/build-user-profile.d.ts → handlers/user/enrollments.d.ts}

@@ -1,4 +1,9 @@
-import type { AppConfig } from '../types';
+/**
+ * User Enrollment Utilities
+ *
+ * Helpers for processing enrollments and building profile data.
+ */
+import type { AppConfig } from '../../types';
 type EnrollmentGoals = NonNullable<AppConfig['courses'][number]['metadata']>['goals'];
 type EnrollmentLike = {
     course: {
@@ -59,4 +64,4 @@ export declare function getUtcDayRange(date: Date): {
  */
 export declare function sumXp(facts: ActivityFacts): number;
 export {};
-//# sourceMappingURL=build-user-profile.d.ts.map
+//# sourceMappingURL=enrollments.d.ts.map

package/dist/server/handlers/user/enrollments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollments.d.ts","sourceRoot":"","sources":["../../../../src/server/handlers/user/enrollments.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C,KAAK,eAAe,GAAG,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAErF,KAAK,cAAc,GAAG;IACrB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,QAAQ,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,eAAe,CAAA;KAAE,CAAA;CACtC,CAAA;AAED,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,eAAe,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAAC,CAAA;AAEhG;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAC7B,MAAM,EAAE,SAAS,GAAG,YAAY,GAC9B,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAW3C;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACtC,WAAW,EAAE,cAAc,EAAE,EAC7B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,GACnD,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAUnD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACvC,WAAW,EAAE,cAAc,EAAE,GAC3B,eAAe,GAAG,SAAS,CAE7B;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,IAAI,CAAA;CAAE,CAQrE;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CASlD"}

package/dist/server/handlers/user/handler.d.ts

@@ -0,0 +1,17 @@
+/**
+ * User Handler
+ *
+ * HTTP route handler for user profile data.
+ */
+import type { UserHandler, UserHandlerConfig } from './types';
+/**
+ * Create the user profile handler.
+ *
+ * Returns the current user's profile, including identity and enriched data
+ * from the Timeback API.
+ *
+ * @param config - Handler configuration
+ * @returns The user profile request handler
+ */
+export declare function createUserHandler(config: UserHandlerConfig): UserHandler;
+//# sourceMappingURL=handler.d.ts.map

package/dist/server/handlers/user/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/server/handlers/user/handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAcH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AA6C7D;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAiDxE"}

package/dist/server/handlers/user/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * User Handler
+ *
+ * Route handler for user profile data.
+ */
+export { createUserHandler } from './handler';
+export { createUserVerifyHandler } from './verify';
+export { buildUserProfile } from './profile';
+export type { ResolvedUser, UserHandler, UserHandlerConfig, UserVerifyHandler, UserVerifyHandlerConfig, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/handlers/user/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/handlers/user/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,YAAY,EACX,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,GACvB,MAAM,SAAS,CAAA"}

package/dist/server/handlers/user/profile.d.ts

@@ -0,0 +1,22 @@
+/**
+ * User Profile Building
+ *
+ * Utilities for building enriched user profile data.
+ */
+import type { TimebackClient } from '@timeback/core';
+import type { TimebackProfile } from '../../../shared/types';
+import type { AppConfig } from '../../types';
+import type { ResolvedUser } from './types';
+/**
+ * Build enriched user profile from Timeback data.
+ *
+ * Fetches enrollments and analytics to build a complete profile.
+ *
+ * @param client - Timeback API client
+ * @param user - Resolved user info
+ * @param appConfig - App configuration
+ * @param apiEnv - API environment
+ * @returns Enriched user profile
+ */
+export declare function buildUserProfile(client: TimebackClient, user: ResolvedUser, appConfig: AppConfig, apiEnv: 'staging' | 'production'): Promise<TimebackProfile>;
+//# sourceMappingURL=profile.d.ts.map

package/dist/server/handlers/user/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/server/handlers/user/profile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAQ5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE3C;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACrC,MAAM,EAAE,cAAc,EACtB,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,SAAS,GAAG,YAAY,GAC9B,OAAO,CAAC,eAAe,CAAC,CAoC1B"}

package/dist/server/handlers/user/types.d.ts

@@ -0,0 +1,35 @@
+/**
+ * User Handler Types
+ *
+ * Feature-local types for the user profile handler.
+ */
+import type { ApiCredentials, AppConfig, Environment, IdentityConfig } from '../../types';
+/** Configuration for the user handler. */
+export interface UserHandlerConfig {
+    env: Environment;
+    identity: IdentityConfig;
+    api: ApiCredentials;
+    appConfig: AppConfig;
+}
+/** User handler type. */
+export type UserHandler = (req: Request) => Promise<Response>;
+/** Configuration for the user verify handler. */
+export interface UserVerifyHandlerConfig {
+    env: Environment;
+    identity: IdentityConfig;
+    api: ApiCredentials;
+}
+/** User verify handler type. */
+export type UserVerifyHandler = (req: Request) => Promise<Response>;
+/** Resolved Timeback user info. */
+export interface ResolvedUser {
+    id: string;
+    email: string;
+    name?: string;
+    school?: {
+        id: string;
+        name: string;
+    };
+    grade?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/server/handlers/user/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/server/handlers/user/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEzF,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,WAAW,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;IACnB,SAAS,EAAE,SAAS,CAAA;CACpB;AAED,yBAAyB;AACzB,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE7D,iDAAiD;AACjD,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,WAAW,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;CACnB;AAED,gCAAgC;AAChC,MAAM,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEnE,mCAAmC;AACnC,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,KAAK,CAAC,EAAE,MAAM,CAAA;CACd"}

package/dist/server/handlers/user/verify.d.ts

@@ -0,0 +1,25 @@
+/**
+ * User Verify Handler
+ *
+ * Lightweight endpoint to check whether the current user can be resolved in Timeback.
+ *
+ * This is intentionally cheaper than `/user/me`:
+ * - In custom identity mode, it resolves the Timeback user by email
+ * - In SSO mode, it expects your app session to provide the Timeback identity via `getUser()`
+ * - It does NOT fetch enrollments/analytics or build an enriched profile
+ */
+import type { UserVerifyHandler, UserVerifyHandlerConfig } from './types';
+/**
+ * Create the user verification handler.
+ *
+ * Returns:
+ * - `200 { verified: true, timebackId: "..." }` when the user can be resolved
+ * - `200 { verified: false }` when the user does not exist in Timeback
+ * - `401` when the request is not authenticated
+ * - `409` when the user resolution is ambiguous
+ *
+ * @param config - Handler configuration
+ * @returns Verify handler
+ */
+export declare function createUserVerifyHandler(config: UserVerifyHandlerConfig): UserVerifyHandler;
+//# sourceMappingURL=verify.d.ts.map

package/dist/server/handlers/user/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../../src/server/handlers/user/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,OAAO,KAAK,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA;AA0BzE;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,GAAG,iBAAiB,CA0D1F"}

package/dist/server/index.d.ts

@@ -5,5 +5,5 @@
  */
 export { createTimeback } from './timeback';
 export { createTimebackIdentity } from './timeback-identity';
-export type { TimebackConfig, TimebackInstance, Environment, ApiCredentials, IdentityConfig, SsoIdentityConfig, CustomIdentityConfig, Handlers, IdentityOnlyConfig, IdentityOnlyInstance, IdentityOnlyHandlers, BuildStateContext, CallbackSuccessContext, IdentityOnlyCallbackSuccessContext, CallbackErrorContext, OIDCTokens, OIDCUserInfo, IdpData, TimebackUserResolutionErrorCode, } from './types';
+export type { TimebackConfig, TimebackInstance, Environment, EnvironmentInput, ApiCredentials, IdentityConfig, SsoIdentityConfig, CustomIdentityConfig, Handlers, IdentityOnlyConfig, IdentityOnlyInstance, IdentityOnlyHandlers, BuildStateContext, CallbackSuccessContext, IdentityOnlyCallbackSuccessContext, CallbackErrorContext, OIDCTokens, OIDCUserInfo, IdpData, TimebackUserResolutionErrorCode, } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,YAAY,EAEX,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EAER,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EAEpB,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,oBAAoB,EACpB,UAAU,EACV,YAAY,EACZ,OAAO,EAEP,+BAA+B,GAC/B,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,YAAY,EAEX,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EAER,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EAEpB,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,oBAAoB,EACpB,UAAU,EACV,YAAY,EACZ,OAAO,EAEP,+BAA+B,GAC/B,MAAM,SAAS,CAAA"}

package/dist/server/lib/index.d.ts

@@ -1,12 +1,11 @@
 /**
  * Server Library
  *
- * Internal utilities for the server SDK.
+ * Shared utilities for the server SDK.
  */
 export { getIssuer, buildAuthorizationUrl, exchangeCodeForTokens, getUserInfo } from './oidc';
-export { jsonResponse, redirectResponse, encodeBase64Url, decodeBase64Url, mapEnvForApi, } from './utils';
+export { deriveCourseStructureIds, jsonResponse, redirectResponse, encodeBase64Url, decodeBase64Url, mapEnvForApi, normalizeEnv, safeIdSegment, sameInstant, hashSuffix64Base36, sha256Hex, } from './utils';
 export { ssoLog, oidcLog, createScopedLogger } from './logger';
-export { ActivityCourseResolutionError, lookupTimebackIdByEmail, resolveActivityCourse, resolveStatusForUserResolutionError, resolveTimebackUserByEmail, TimebackUserResolutionError, } from './resolve';
-export { buildActivityContext, buildActivityMetrics, buildTimeSpentMetrics, InvalidSensorUrlError, MissingSyncedCourseIdError, sendCaliperEnvelope, } from './build-activity-events';
-export { buildCourseLookup, getUtcDayRange, mapEnrollmentsToCourses, pickGoalsFromEnrollments, sumXp, } from './build-user-profile';
+export { lookupTimebackIdByEmail, resolveStatusForUserResolutionError, resolveTimebackUserByEmail, TimebackUserResolutionError, } from './resolve';
+export { buildErrorContext, computeRedirectUri, handleIdpError, handleMissingCode, initiateSignIn, parseCallback, tryDecodeState, } from './sso';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/lib/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAC7F,OAAO,EACN,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,YAAY,GACZ,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC9D,OAAO,EACN,6BAA6B,EAC7B,uBAAuB,EACvB,qBAAqB,EACrB,mCAAmC,EACnC,0BAA0B,EAC1B,2BAA2B,GAC3B,MAAM,WAAW,CAAA;AAClB,OAAO,EACN,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,mBAAmB,GACnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACN,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,wBAAwB,EACxB,KAAK,GACL,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/lib/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAC7F,OAAO,EACN,wBAAwB,EACxB,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,GACT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC9D,OAAO,EACN,uBAAuB,EACvB,mCAAmC,EACnC,0BAA0B,EAC1B,2BAA2B,GAC3B,MAAM,WAAW,CAAA;AAClB,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,cAAc,GACd,MAAM,OAAO,CAAA"}

package/dist/server/lib/resolve.d.ts

@@ -1,9 +1,7 @@
 /**
- * Resolution Utilities
+ * User Resolution Utilities
  *
- * Functions for resolving Timeback users and activity courses.
- *
- * ## User Resolution
+ * Functions for resolving Timeback users by email.
  *
  * - `resolveTimebackUserByEmail` — Full user resolution returning profile + IdP claims.
  *   Used by SSO callback to build the authenticated user object.
@@ -13,15 +11,10 @@
  *
  * - `resolveStatusForUserResolutionError` — Maps error codes to HTTP status.
  *   Used by handlers to return appropriate status codes on resolution failure.
- *
- * ## Course Resolution
- *
- * - `resolveActivityCourse` — Resolves a course selector to a config entry.
- *   Used by activity handler to match client payload to configured courses.
  */
 import { TimebackClient } from '@timeback/core';
-import type { ActivityCourseRef, TimebackAuthUser } from '../../shared/types';
-import type { ApiCredentials, AppConfig, Environment, OIDCUserInfo, TimebackUserResolutionErrorCode } from '../types';
+import type { TimebackAuthUser } from '../../shared/types';
+import type { ApiCredentials, Environment, OIDCUserInfo, TimebackUserResolutionErrorCode } from '../types';
 /**
  * Error thrown when Timeback user resolution fails.
  */
@@ -77,36 +70,5 @@ export declare function resolveTimebackUserByEmail(params: ResolveTimebackUserBy
  * @throws {TimebackUserResolutionError} If lookup fails
  */
 export declare function lookupTimebackIdByEmail(params: LookupTimebackIdByEmailParams): Promise<string>;
-/**
- * Error thrown when a course selector cannot be resolved against config.
- */
-export declare class ActivityCourseResolutionError extends Error {
-    readonly code: 'unknown_course' | 'ambiguous_course';
-    readonly selector: ActivityCourseRef;
-    readonly count?: number;
-    constructor(code: ActivityCourseResolutionError['code'], selector: ActivityCourseRef, count?: number);
-    /**
-     * Get a human-readable description of the selector.
-     *
-     * @returns Human-readable selector description
-     */
-    get selectorDescription(): string;
-}
-/**
- * Resolve a course config entry from an activity course selector.
- *
- * **Use case:** Activity handler — match the client's course selector
- * to a configured course in `timeback.config.json`.
- *
- * Supports two selector modes:
- * - **subjectGrade**: Match by `(subject, grade)`
- * - **courseCode**: Match by `courseCode`
- *
- * @param courses - Configured courses from `timeback.config.json`
- * @param courseRef - Course selector from the client payload
- * @returns Matched course config entry
- * @throws {ActivityCourseResolutionError} When selector is unknown or ambiguous
- */
-export declare function resolveActivityCourse(courses: AppConfig['courses'], courseRef: ActivityCourseRef): AppConfig['courses'][number];
 export {};
 //# sourceMappingURL=resolve.d.ts.map

package/dist/server/lib/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/server/lib/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAM/C,OAAO,KAAK,EACX,iBAAiB,EAEjB,gBAAgB,EAEhB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,KAAK,EACX,cAAc,EACd,SAAS,EACT,WAAW,EACX,YAAY,EACZ,+BAA+B,EAC/B,MAAM,UAAU,CAAA;AAQjB;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;aAGpC,IAAI,EAAE,+BAA+B;IAFtD,YACC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,+BAA+B,EAIrD;CACD;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,2BAA2B,GAAG,MAAM,CAE5F;AAMD,UAAU,gCAAgC;IACzC,uCAAuC;IACvC,GAAG,EAAE,WAAW,CAAA;IAChB,uCAAuC;IACvC,cAAc,EAAE,cAAc,CAAA;IAC9B,kCAAkC;IAClC,QAAQ,EAAE,YAAY,CAAA;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACvB;AAED,UAAU,6BAA6B;IACtC,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,MAAM,EAAE,cAAc,CAAA;CACtB;AA2FD;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,gCAAgC,GACtC,OAAO,CAAC,gBAAgB,CAAC,CAsD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC5C,MAAM,EAAE,6BAA6B,GACnC,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAMD;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;IACvD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,kBAAkB,CAAA;IACpD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IAEvB,YACC,IAAI,EAAE,6BAA6B,CAAC,MAAM,CAAC,EAC3C,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,CAAC,EAAE,MAAM,EAMd;IAED;;;;OAIG;IACH,IAAI,mBAAmB,IAAI,MAAM,CAKhC;CACD;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACpC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAC7B,SAAS,EAAE,iBAAiB,GAC1B,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAoB9B"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/server/lib/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAM/C,OAAO,KAAK,EAAkB,gBAAgB,EAAmB,MAAM,oBAAoB,CAAA;AAC3F,OAAO,KAAK,EACX,cAAc,EACd,WAAW,EACX,YAAY,EACZ,+BAA+B,EAC/B,MAAM,UAAU,CAAA;AAQjB;;GAEG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;aAGpC,IAAI,EAAE,+BAA+B;IAFtD,YACC,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,+BAA+B,EAIrD;CACD;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,GAAG,EAAE,2BAA2B,GAAG,MAAM,CAE5F;AAMD,UAAU,gCAAgC;IACzC,uCAAuC;IACvC,GAAG,EAAE,WAAW,CAAA;IAChB,uCAAuC;IACvC,cAAc,EAAE,cAAc,CAAA;IAC9B,kCAAkC;IAClC,QAAQ,EAAE,YAAY,CAAA;IACtB;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAA;CACvB;AAED,UAAU,6BAA6B;IACtC,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,qCAAqC;IACrC,MAAM,EAAE,cAAc,CAAA;CACtB;AA2FD;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,gCAAgC,GACtC,OAAO,CAAC,gBAAgB,CAAC,CAsD3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC5C,MAAM,EAAE,6BAA6B,GACnC,OAAO,CAAC,MAAM,CAAC,CAmBjB"}

package/dist/server/lib/sso.d.ts

@@ -0,0 +1,86 @@
+/**
+ * SSO Flow Helpers
+ *
+ * Shared utilities for SSO sign-in and callback handling.
+ * Used by both full SDK and identity-only handlers.
+ */
+import type { BuildStateContext, CallbackErrorContext, Environment } from '../types';
+/**
+ * Build callback error context.
+ *
+ * @param error - The error that occurred
+ * @param errorCode - Optional error code (IdP or internal)
+ * @param state - Decoded state (if provided)
+ * @param req - Incoming request
+ * @returns Callback error context
+ */
+export declare function buildErrorContext<TState>(error: Error, errorCode: string | undefined, state: TState | undefined, req: Request): CallbackErrorContext<TState>;
+/**
+ * Try to decode base64url-encoded state.
+ *
+ * @param stateParam - Base64url encoded state
+ * @returns Decoded state or undefined
+ */
+export declare function tryDecodeState<TState>(stateParam: string): TState | undefined;
+/**
+ * Handle IdP error response.
+ *
+ * @param errorParam - Error code from IdP
+ * @param url - Callback URL
+ * @param state - Decoded state (if provided)
+ * @param req - Incoming request
+ * @param onCallbackError - Optional custom error handler
+ * @returns Error response
+ */
+export declare function handleIdpError<TState>(errorParam: string, url: URL, state: TState | undefined, req: Request, onCallbackError?: (ctx: CallbackErrorContext<TState>) => Response | Promise<Response>): Response | Promise<Response>;
+/**
+ * Handle missing authorization code in callback URL.
+ *
+ * @param state - Decoded state (if provided)
+ * @param req - Incoming request
+ * @param onCallbackError - Optional custom error handler
+ * @returns Error response
+ */
+export declare function handleMissingCode<TState>(state: TState | undefined, req: Request, onCallbackError?: (ctx: CallbackErrorContext<TState>) => Response | Promise<Response>): Response | Promise<Response>;
+/** Parameters for initiating sign-in. */
+interface SignInParams<TState> {
+    req: Request;
+    env: Environment;
+    clientId: string;
+    issuer?: string;
+    redirectUri?: string;
+    buildState?: (ctx: BuildStateContext) => TState;
+}
+/**
+ * Initiate SSO sign-in flow.
+ *
+ * Builds the authorization URL and returns a redirect response.
+ *
+ * @param params - Sign-in parameters
+ * @returns Redirect response to IdP
+ */
+export declare function initiateSignIn<TState>(params: SignInParams<TState>): Promise<Response>;
+/** Parsed callback parameters. */
+interface ParsedCallback<TState> {
+    url: URL;
+    code: string | null;
+    errorParam: string | null;
+    state: TState | undefined;
+}
+/**
+ * Parse callback request parameters.
+ *
+ * @param req - Incoming callback request
+ * @returns Parsed callback parameters
+ */
+export declare function parseCallback<TState>(req: Request): ParsedCallback<TState>;
+/**
+ * Compute redirect URI for callback.
+ *
+ * @param url - Callback URL
+ * @param configuredRedirectUri - Configured redirect URI (if any)
+ * @returns Computed redirect URI
+ */
+export declare function computeRedirectUri(url: URL, configuredRedirectUri?: string): string;
+export {};
+//# sourceMappingURL=sso.d.ts.map

package/dist/server/lib/sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.d.ts","sourceRoot":"","sources":["../../../src/server/lib/sso.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAMpF;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EACvC,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,OAAO,GACV,oBAAoB,CAAC,MAAM,CAAC,CAS9B;AAMD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO7E;AAMD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,MAAM,EACpC,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,OAAO,EACZ,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GACnF,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAY9B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EACvC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,GAAG,EAAE,OAAO,EACZ,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,oBAAoB,CAAC,MAAM,CAAC,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GACnF,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAU9B;AAMD,yCAAyC;AACzC,UAAU,YAAY,CAAC,MAAM;IAC5B,GAAG,EAAE,OAAO,CAAA;IACZ,GAAG,EAAE,WAAW,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,MAAM,CAAA;CAC/C;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0B5F;AAMD,kCAAkC;AAClC,UAAU,cAAc,CAAC,MAAM;IAC9B,GAAG,EAAE,GAAG,CAAA;IACR,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAW1E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,CAAC,EAAE,MAAM,GAAG,MAAM,CAOnF"}

package/dist/server/lib/utils.d.ts

@@ -3,7 +3,89 @@
  *
  * Internal utility functions for the server SDK.
  */
-import type { Environment } from '../types';
+import type { Environment, EnvironmentInput } from '../types';
+/**
+ * Derived resource IDs for a course structure.
+ */
+interface CourseStructureIds {
+    /** Course sourcedId (unchanged) */
+    course: string;
+    /** Derived component ID: `${courseId}-component` */
+    component: string;
+    /** Derived resource ID: `${courseId}-resource` */
+    resource: string;
+    /** Derived componentResource ID: `${courseId}-cr` */
+    componentResource: string;
+}
+/**
+ * Derive all resource IDs from the allocated courseId.
+ *
+ * This follows the SDK pattern where child IDs are deterministic
+ * suffixes of the course ID, keeping config files clean.
+ *
+ * NOTE: This function is intentionally duplicated in `packages/cli/src/lib/course-structure.ts`.
+ *
+ * We accept the duplication because: (1) it's a tiny pure function with no dependencies,
+ * (2) the ID derivation pattern is stable and unlikely to change, and (3) extracting to a
+ * shared package would add cross-package dependency overhead for minimal benefit.
+ * If you modify this, update the CLI copy as well.
+ *
+ * @param courseId - The allocated OneRoster course ID
+ * @returns Derived IDs for all child resources
+ *
+ * @example
+ * ```typescript
+ * const ids = deriveCourseStructureIds('abc-123')
+ * // {
+ * //   course: 'abc-123',
+ * //   component: 'abc-123-component',
+ * //   resource: 'abc-123-resource',
+ * //   componentResource: 'abc-123-cr'
+ * // }
+ * ```
+ */
+export declare function deriveCourseStructureIds(courseId: string): CourseStructureIds;
+/**
+ * Build a safe ID segment from a string (URL-safe, no colons).
+ *
+ * `encodeURIComponent` escapes reserved characters into percent-encoded form.
+ * We additionally replace `%` with `_` so the resulting value:
+ * - stays URL-safe
+ * - avoids raw `%` characters (which can be awkward in some ID contexts)
+ *
+ * @param value - The value to make safe
+ * @returns A safe ID segment
+ */
+export declare function safeIdSegment(value: string): string;
+/**
+ * Compare two datetime strings, tolerating minor formatting differences.
+ *
+ * Falls back to string equality if either value is not parseable.
+ *
+ * @param a - First datetime string
+ * @param b - Second datetime string
+ * @returns True if both represent the same instant
+ */
+export declare function sameInstant(a: string, b: string): boolean;
+/**
+ * Create a compact deterministic hash suffix for IDs.
+ *
+ * Uses 64-bit FNV-1a over the input string and returns a base36-encoded suffix.
+ * This is **not** cryptographic, but is stable and compact for ID disambiguation.
+ *
+ * @param value - String to hash
+ * @returns Base36 hash suffix (lowercase alphanumeric)
+ */
+export declare function hashSuffix64Base36(value: string): string;
+/**
+ * Create a SHA256 hex digest of a string.
+ *
+ * Used for deterministic IDs that must match timeback-api-2's hashing.
+ *
+ * @param value - String to hash
+ * @returns 64-character lowercase hex string
+ */
+export declare function sha256Hex(value: string): string;
 /**
  * Map SDK environment to the environment used for outbound Timeback API calls.
  *
@@ -18,6 +100,15 @@ import type { Environment } from '../types';
  * @returns Environment to use for TimebackClient
  */
 export declare function mapEnvForApi(env: Environment): 'staging' | 'production';
+/**
+ * Normalize a user-provided environment to a known SDK environment.
+ *
+ * Unknown values default to `staging`.
+ *
+ * @param env - User-provided environment value
+ * @returns Normalized SDK environment
+ */
+export declare function normalizeEnv(env: EnvironmentInput): Environment;
 /**
  * Create a JSON response.
  *
@@ -51,4 +142,5 @@ export declare function encodeBase64Url(data: unknown): string;
  * @returns Decoded object
  */
 export declare function decodeBase64Url<T>(encoded: string): T;
+export {};
 //# sourceMappingURL=utils.d.ts.map

package/dist/server/lib/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/server/lib/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AAE3C;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,YAAY,CAMvE;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,SAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAItF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAI7E;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAIrD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAKrD"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/server/lib/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAM7D;;GAEG;AACH,UAAU,kBAAkB;IAC3B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,qDAAqD;IACrD,iBAAiB,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAO7E;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAKzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAcxD;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,YAAY,CAMvE;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,WAAW,CAK/D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,SAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAItF;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAI7E;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAIrD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,CAAC,CAKrD"}

package/dist/server/timeback-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeback-identity.d.ts","sourceRoot":"","sources":["../../src/server/timeback-identity.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,GAAG,OAAO,EACtD,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAChC,oBAAoB,CAAC,MAAM,CAAC,CAY9B"}
+{"version":3,"file":"timeback-identity.d.ts","sourceRoot":"","sources":["../../src/server/timeback-identity.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAEvE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,GAAG,OAAO,EACtD,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAChC,oBAAoB,CAAC,MAAM,CAAC,CAY9B"}

package/dist/server/timeback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeback.d.ts","sourceRoot":"","sources":["../../src/server/timeback.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAa,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAsB1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAsB,cAAc,CAAC,MAAM,GAAG,OAAO,EACpD,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,GAC5B,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAuEnC"}
+{"version":3,"file":"timeback.d.ts","sourceRoot":"","sources":["../../src/server/timeback.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,KAAK,EAAa,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAyC1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,wBAAsB,cAAc,CAAC,MAAM,GAAG,OAAO,EACpD,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,GAC5B,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAiFnC"}