@treeseed/sdk 0.13.0-rc.2 → 0.13.0-rc.21

package/dist/agent-tools/communication-tool-definitions.js

@@ -1,85 +0,0 @@
-import { GENERIC_RESULT_SCHEMA } from "./agent-tool-execution-target.js";
-const identity = { type: "string", minLength: 1, maxLength: 256 };
-const idempotency = { type: "string", minLength: 8, maxLength: 256 };
-const COMMUNICATION_TOOL_DEFINITIONS = [
-  {
-    id: "treeseed.discussion.read",
-    title: "Read assignment discussion",
-    description: "Read bounded TreeDX-backed discussion messages scoped to the current assignment project.",
-    inputSchema: { type: "object", properties: { discussionId: identity, query: { type: "string", maxLength: 500 }, after: { type: "string" }, limit: { type: "integer", minimum: 1, maximum: 100 } }, additionalProperties: false },
-    outputSchema: GENERIC_RESULT_SCHEMA,
-    executionTarget: "provider_runner",
-    mutability: "read",
-    telemetryCategory: "content",
-    requirements: ["provider_runner_runtime"]
-  },
-  {
-    id: "treeseed.discussion.follow",
-    title: "Follow assignment discussion",
-    description: "Read durable messages and lifecycle events after an exact cursor. Transient token deltas are not reconstructed.",
-    inputSchema: { type: "object", properties: { discussionId: identity, after: { type: "string" }, limit: { type: "integer", minimum: 1, maximum: 100 } }, required: ["discussionId"], additionalProperties: false },
-    outputSchema: GENERIC_RESULT_SCHEMA,
-    executionTarget: "provider_runner",
-    mutability: "read",
-    telemetryCategory: "content",
-    requirements: ["provider_runner_runtime"]
-  },
-  {
-    id: "treeseed.discussion.respond",
-    title: "Respond to assignment discussion",
-    description: "Commit the authoritative assignment-authored response through TreeDX after completed discussion.read and discussion.follow receipts. With requiredResponse=true this tool owns suspended-summary authoring, the assignment checkpoint, lease release, and continuation provenance; call it before a terminal summary or content commit.",
-    inputSchema: { type: "object", properties: { discussionId: identity, replyTo: identity, sourceMessageRefs: { type: "array", uniqueItems: true, maxItems: 24, items: identity }, topic: { type: "string", minLength: 1, maxLength: 500 }, message: { type: "string", minLength: 1, maxLength: 12e3 }, recipients: { type: "array", uniqueItems: true, maxItems: 16, items: identity }, requiredResponse: { type: "boolean" }, expectedStateVersion: { type: "integer", minimum: 1 }, idempotencyKey: idempotency }, required: ["message", "sourceMessageRefs", "expectedStateVersion", "idempotencyKey"], additionalProperties: false },
-    outputSchema: GENERIC_RESULT_SCHEMA,
-    executionTarget: "provider_runner",
-    mutability: "shared_state_write",
-    telemetryCategory: "content",
-    requirements: ["provider_runner_runtime"]
-  },
-  {
-    id: "treeseed.discussion.request_handoff",
-    title: "Request agent discussion handoff",
-    description: "Request an API-governed, bounded agent-to-agent communication invocation without widening authority or productive time.",
-    inputSchema: { type: "object", properties: { discussionId: identity, sourceMessageRefs: { type: "array", uniqueItems: true, maxItems: 24, items: identity }, recipientAgentIds: { type: "array", uniqueItems: true, minItems: 1, maxItems: 2, items: identity }, subject: { type: "string", minLength: 1, maxLength: 1e3 }, expectedStateVersion: { type: "integer", minimum: 1 }, idempotencyKey: idempotency }, required: ["discussionId", "sourceMessageRefs", "recipientAgentIds", "subject", "expectedStateVersion", "idempotencyKey"], additionalProperties: false },
-    outputSchema: GENERIC_RESULT_SCHEMA,
-    executionTarget: "provider_runner",
-    mutability: "shared_state_write",
-    telemetryCategory: "capacity",
-    requirements: ["provider_runner_runtime"]
-  },
-  {
-    id: "treeseed.discussion.create_artifact",
-    title: "Create linked discussion artifact",
-    description: "Create a permitted proposal, question, or linked note from exact Discussion messages through assignment-scoped TreeDX authority.",
-    inputSchema: { type: "object", properties: { discussionId: identity, sourceMessageRefs: { type: "array", uniqueItems: true, minItems: 1, maxItems: 24, items: identity }, model: { type: "string", enum: ["proposal", "question", "note"] }, path: identity, content: { type: "string", minLength: 1, maxLength: 5e4 }, expectedStateVersion: { type: "integer", minimum: 1 }, idempotencyKey: idempotency }, required: ["discussionId", "sourceMessageRefs", "model", "path", "content", "expectedStateVersion", "idempotencyKey"], additionalProperties: false },
-    outputSchema: GENERIC_RESULT_SCHEMA,
-    executionTarget: "provider_runner",
-    mutability: "content_write",
-    telemetryCategory: "content",
-    requirements: ["provider_runner_runtime", "treedx_proxy_handle", "treedx_writable_workspace"]
-  },
-  {
-    id: "treeseed.operation.prepare_handoff",
-    title: "Prepare governed operation handoff",
-    description: "Prepare exact operation inputs and approval provenance. It never creates acting authority directly.",
-    inputSchema: { type: "object", properties: { discussionId: identity, target: identity, expectedEffect: { type: "string", minLength: 1, maxLength: 4e3 }, sourceMessageRefs: { type: "array", uniqueItems: true, minItems: 1, maxItems: 24, items: identity }, requiredAuthority: { type: "array", uniqueItems: true, items: identity }, proposalId: identity, decisionId: identity, expectedStateVersion: { type: "integer", minimum: 1 }, idempotencyKey: idempotency }, required: ["discussionId", "target", "expectedEffect", "sourceMessageRefs", "requiredAuthority", "expectedStateVersion", "idempotencyKey"], additionalProperties: false },
-    outputSchema: GENERIC_RESULT_SCHEMA,
-    executionTarget: "provider_runner",
-    mutability: "shared_state_write",
-    telemetryCategory: "governance",
-    requirements: ["provider_runner_runtime"]
-  },
-  {
-    id: "treeseed.client_session.request_action",
-    title: "Request semantic client action",
-    description: "Request a bounded navigation, reveal, filter, draft, or confirmation action from an authenticated matching client session.",
-    inputSchema: { type: "object", properties: { kind: { type: "string", enum: ["navigate", "reveal-resource", "set-view-filter", "populate-draft", "present-confirmation"] }, payload: { type: "object", additionalProperties: true }, ttlSeconds: { type: "integer", minimum: 1, maximum: 300 }, expectedStateVersion: { type: "integer", minimum: 1 }, idempotencyKey: idempotency }, required: ["kind", "payload", "ttlSeconds", "expectedStateVersion", "idempotencyKey"], additionalProperties: false },
-    outputSchema: GENERIC_RESULT_SCHEMA,
-    executionTarget: "provider_runner",
-    mutability: "shared_state_write",
-    telemetryCategory: "client",
-    requirements: ["provider_runner_runtime"]
-  }
-];
-export {
-  COMMUNICATION_TOOL_DEFINITIONS
-};

package/dist/agents/agent-tools.d.ts

@@ -1,3 +0,0 @@
-export * from '../agent-tools/agent-tool-definitions.js';
-export * from '../agent-tools/agent-tool-execution-target.js';
-export * from '../agent-tools/agent-tool-index.js';

package/dist/agents/agent-tools.js

@@ -1,3 +0,0 @@
-export * from "../agent-tools/agent-tool-definitions.js";
-export * from "../agent-tools/agent-tool-execution-target.js";
-export * from "../agent-tools/agent-tool-index.js";

package/dist/agents/cli-tools.d.ts

@@ -1,3 +0,0 @@
-import type { AgentCliOptions } from '../types/agents.js';
-export declare function normalizeAgentCliOptions(input: unknown): AgentCliOptions;
-export declare function buildCopilotAllowToolArgs(allowTools?: AgentCliOptions['allowTools']): string[];

package/dist/agents/cli-tools.js

@@ -1,46 +0,0 @@
-const AGENT_CLI_ALLOW_TOOLS = [
-  "shell(git)",
-  "shell(npm)",
-  "web"
-];
-const ALLOWED_TOOL_SET = new Set(AGENT_CLI_ALLOW_TOOLS);
-function normalizeStringArray(value, field) {
-  if (value === void 0 || value === null) {
-    return [];
-  }
-  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
-    throw new Error(`Invalid agent cli.${field}: expected an array of strings.`);
-  }
-  return value.map(String);
-}
-function normalizeAgentCliOptions(input) {
-  if (input === void 0 || input === null) {
-    return {
-      allowTools: [],
-      additionalArgs: []
-    };
-  }
-  if (typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("Invalid agent cli config: expected an object.");
-  }
-  const cli = input;
-  const rawAllowTools = normalizeStringArray(cli.allowTools, "allowTools");
-  const invalidTools = rawAllowTools.filter((tool) => !ALLOWED_TOOL_SET.has(tool));
-  if (invalidTools.length) {
-    throw new Error(
-      `Invalid agent cli.allowTools entries: ${invalidTools.join(", ")}. Allowed tools: ${AGENT_CLI_ALLOW_TOOLS.join(", ")}.`
-    );
-  }
-  return {
-    model: typeof cli.model === "string" ? cli.model : void 0,
-    allowTools: [...new Set(rawAllowTools)],
-    additionalArgs: normalizeStringArray(cli.additionalArgs, "additionalArgs")
-  };
-}
-function buildCopilotAllowToolArgs(allowTools = []) {
-  return (allowTools ?? []).flatMap((tool) => ["--allow-tool", tool]);
-}
-export {
-  buildCopilotAllowToolArgs,
-  normalizeAgentCliOptions
-};

package/dist/agents/copilot.d.ts

@@ -1,24 +0,0 @@
-import { type Tool } from '@github/copilot-sdk';
-export type CopilotTool = Tool;
-export type CopilotTaskInput = {
-    prompt: string;
-    cwd?: string;
-    model?: string;
-    allowTools?: string[];
-    tools?: CopilotTool[];
-    env?: NodeJS.ProcessEnv;
-    timeoutMs?: number;
-    provider?: {
-        type: 'openai';
-        baseUrl?: string;
-        apiKey?: string;
-        wireApi?: 'completions' | 'responses';
-    };
-};
-export type CopilotTaskResult = {
-    status: 'completed' | 'failed';
-    summary: string;
-    stdout: string;
-    stderr: string;
-};
-export declare function runCopilotTask(input: CopilotTaskInput): Promise<CopilotTaskResult>;

package/dist/agents/copilot.js

@@ -1,91 +0,0 @@
-import { approveAll, CopilotClient } from "@github/copilot-sdk";
-import {
-  resolveGitHubCopilotToken,
-  resolveGitHubToken
-} from "../configuration/service-credentials.js";
-import {
-  createManagedToolEnv,
-  resolveToolBinary
-} from "../entrypoints/runtime/managed-dependencies.js";
-function configuredValue(env, key) {
-  const value = env[key];
-  return typeof value === "string" && value.trim() ? value.trim() : "";
-}
-function resolveCopilotAuthToken(env) {
-  return resolveGitHubCopilotToken(env) || resolveGitHubToken(env) || configuredValue(env, "COPILOT_GITHUB_TOKEN") || configuredValue(env, "GH_TOKEN") || configuredValue(env, "GITHUB_TOKEN");
-}
-async function runCopilotTask(input) {
-  const cwd = input.cwd ?? process.cwd();
-  const baseEnv = createManagedToolEnv(input.env ?? process.env);
-  const copilotAuthToken = resolveCopilotAuthToken(baseEnv);
-  const env = copilotAuthToken ? { ...baseEnv, COPILOT_GITHUB_TOKEN: copilotAuthToken } : baseEnv;
-  const cliPath = resolveToolBinary("copilot", { env });
-  if (!cliPath) {
-    return {
-      status: "failed",
-      summary: "Copilot task failed.",
-      stdout: "",
-      stderr: "Copilot CLI is unavailable."
-    };
-  }
-  const client = new CopilotClient({
-    cliPath,
-    cwd,
-    env,
-    gitHubToken: copilotAuthToken || void 0,
-    logLevel: "error",
-    useStdio: true
-  });
-  let session = null;
-  const messages = [];
-  const errors = [];
-  try {
-    session = await client.createSession({
-      clientName: "treeseed",
-      model: input.model,
-      availableTools: input.allowTools && input.allowTools.length > 0 ? input.allowTools : void 0,
-      tools: input.tools,
-      onPermissionRequest: approveAll,
-      provider: input.provider,
-      workingDirectory: cwd,
-      onEvent(event) {
-        if (event.type === "assistant.message" && event.data.content.trim()) {
-          messages.push(event.data.content);
-        }
-        if (event.type === "session.error") {
-          errors.push(event.data.message);
-        }
-      }
-    });
-    const finalMessage = await session.sendAndWait({ prompt: input.prompt }, input.timeoutMs ?? 10 * 60 * 1e3);
-    const stdout = finalMessage?.data.content ?? messages.at(-1) ?? messages.join("\n\n");
-    return {
-      status: errors.length > 0 ? "failed" : "completed",
-      summary: errors.length > 0 ? "Copilot task failed." : "Copilot task completed.",
-      stdout,
-      stderr: errors.join("\n")
-    };
-  } catch (error) {
-    return {
-      status: "failed",
-      summary: "Copilot task failed.",
-      stdout: messages.join("\n\n"),
-      stderr: [
-        ...errors,
-        error instanceof Error ? error.message : String(error)
-      ].filter(Boolean).join("\n")
-    };
-  } finally {
-    try {
-      await session?.disconnect();
-    } catch {
-    }
-    const stopErrors = await client.stop();
-    if (stopErrors.length > 0 && errors.length === 0) {
-      await client.forceStop();
-    }
-  }
-}
-export {
-  runCopilotTask
-};

package/dist/ai-appliance/index.d.ts

@@ -1,3 +0,0 @@
-export * from './contracts.js';
-export * from './validation.js';
-export * from './reconciliation.js';

package/dist/ai-appliance/index.js

@@ -1,3 +0,0 @@
-export * from "./contracts.js";
-export * from "./validation.js";
-export * from "./reconciliation.js";

package/dist/ai-appliance/reconciliation.d.ts

@@ -1,18 +0,0 @@
-import type { DesiredUnit } from '../reconcile/support/contracts/contracts.js';
-import type { AiApplianceManifest } from './contracts.js';
-export declare function compileAiApplianceUnits(tenantRoot: string, manifest: AiApplianceManifest, composeFile?: string): DesiredUnit[];
-export declare function reconcileAiAppliance(input: {
-    tenantRoot: string;
-    manifest: AiApplianceManifest;
-    plan: boolean;
-    composeFile?: string;
-    env?: NodeJS.ProcessEnv;
-    write?: (line: string) => void;
-}): Promise<{
-    target: import("../reconcile/index.js").ReconcileTarget;
-    units: DesiredUnit[];
-    plans: import("../reconcile/index.js").ReconcilePlan[];
-    results: import("../reconcile/index.js").ReconcileResult[];
-    state: import("../reconcile/index.js").ReconcileStateRecord;
-    timings: import("../entrypoints/runtime/timing.js").TimingEntry[];
-}>;

package/dist/ai-appliance/reconciliation.js

@@ -1,47 +0,0 @@
-import { reconcileTarget } from "../reconcile/engine/reconcile-target.js";
-import { validateAiApplianceManifest } from "./validation.js";
-const localTarget = { kind: "persistent", scope: "local" };
-function localDeployConfig(tenantRoot) {
-  return { name: "AI appliance", slug: "ai-appliance", siteUrl: "http://127.0.0.1", contactEmail: "local@localhost", __tenantRoot: tenantRoot };
-}
-function compileAiApplianceUnits(tenantRoot, manifest, composeFile = "compose.ai.yml") {
-  const validation = validateAiApplianceManifest(manifest);
-  if (!validation.ok) throw new Error(`AI appliance manifest is invalid: ${validation.diagnostics.map((entry) => `${entry.path}: ${entry.message}`).join("; ")}`);
-  const identity = { teamId: "local", projectId: "ai-appliance", slug: "ai-appliance", environment: "local", deploymentKey: "ai-appliance-local", environmentKey: "local" };
-  return [{
-    unitId: "local-docker-compose:ai-inference",
-    unitType: "local-docker-compose",
-    provider: "local",
-    identity,
-    target: localTarget,
-    logicalName: "AI inference appliance",
-    dependencies: [],
-    spec: {
-      composeFile,
-      composeFiles: [composeFile],
-      projectName: "treeseed-ai-inference",
-      cwd: ".",
-      dataDir: ".treeseed/ai",
-      buildPolicy: "never",
-      env: {
-        TREESEED_AI_MODEL: manifest.inference.model,
-        TREESEED_AI_MODEL_ALIAS: manifest.inference.publicAlias,
-        TREESEED_AI_MAX_MODEL_LENGTH: String(manifest.inference.maxModelLength),
-        TREESEED_AI_MAX_CONCURRENT_SEQUENCES: String(manifest.inference.maxConcurrentSequences),
-        TREESEED_AI_GPU_MEMORY_UTILIZATION: String(manifest.inference.gpuMemoryUtilization)
-      },
-      services: ["vllm"],
-      healthChecks: [{ id: "vllm-health", kind: "http", url: new URL("/health", manifest.inference.rawVllmUrl).toString() }]
-    },
-    secrets: {},
-    metadata: { packageId: "@treeseed/ai", serviceId: "inference" }
-  }];
-}
-async function reconcileAiAppliance(input) {
-  const units = compileAiApplianceUnits(input.tenantRoot, input.manifest, input.composeFile);
-  return reconcileTarget({ tenantRoot: input.tenantRoot, target: localTarget, units, planOnly: input.plan, env: input.env, write: input.write, deployConfig: localDeployConfig(input.tenantRoot) });
-}
-export {
-  compileAiApplianceUnits,
-  reconcileAiAppliance
-};

package/dist/api/auth/d1-database.d.ts

@@ -1,3 +0,0 @@
-import type { D1DatabaseLike } from '../../types/cloudflare.js';
-import type { ApiConfig } from '../types.js';
-export declare function resolveApiD1Database(config: ApiConfig): D1DatabaseLike;

package/dist/api/auth/d1-database.js

@@ -1,20 +0,0 @@
-import { NodeSqliteD1Database } from "../../db/node-sqlite.js";
-import { CloudflareHttpD1Database } from "../../persistence/d1-http.js";
-function resolveApiD1Database(config) {
-  if (config.cloudflareAccountId && config.cloudflareApiToken && config.d1DatabaseId) {
-    return new CloudflareHttpD1Database({
-      accountId: config.cloudflareAccountId,
-      apiToken: config.cloudflareApiToken,
-      databaseId: config.d1DatabaseId
-    });
-  }
-  if (config.d1LocalPersistTo || config.d1DatabaseName) {
-    return new NodeSqliteD1Database(config.d1LocalPersistTo);
-  }
-  throw new Error(
-    "Treeseed API auth requires either CLOUDFLARE_ACCOUNT_ID + CLOUDFLARE_API_TOKEN + TREESEED_API_D1_DATABASE_ID for remote D1 access, or TREESEED_API_D1_LOCAL_PERSIST_TO for local SQLite-backed D1-compatible access."
-  );
-}
-export {
-  resolveApiD1Database
-};

package/dist/api/auth/d1-provider.d.ts

@@ -1,54 +0,0 @@
-import type { D1DatabaseLike } from '../../types/cloudflare.js';
-import type { ApiAuthProvider, ApiConfig, ApiCredential, ApiPrincipal, DeviceCodeApproveRequest, DeviceCodePollRequest, DeviceCodePollResponse, DeviceCodeStartRequest, DeviceCodeStartResponse, TokenRefreshRequest, TokenRefreshResponse, TrustedUserAssertionClaims, UserIdentityProfileInput } from '../types.js';
-export declare class D1AuthProvider implements ApiAuthProvider {
-    private readonly config;
-    readonly id = "d1";
-    private readonly store;
-    constructor(config: ApiConfig, options?: {
-        db?: D1DatabaseLike;
-    });
-    startDeviceFlow(request: DeviceCodeStartRequest): Promise<DeviceCodeStartResponse>;
-    pollDeviceFlow(request: DeviceCodePollRequest): Promise<DeviceCodePollResponse>;
-    refreshAccessToken(request: TokenRefreshRequest): Promise<TokenRefreshResponse>;
-    issueUserSession(userId: string, options?: {
-        sessionType?: string;
-        scopes?: string[];
-        data?: Record<string, unknown>;
-    }): Promise<TokenRefreshResponse>;
-    approveDeviceFlow(request: DeviceCodeApproveRequest): Promise<{
-        ok: true;
-    }>;
-    authenticateBearerToken(token: string): Promise<{
-        principal: ApiPrincipal;
-        credential: ApiCredential;
-    } | null>;
-    authenticateServiceCredential(serviceId: string, secret: string): Promise<{
-        principal: ApiPrincipal;
-        credential: ApiCredential;
-    } | null>;
-    createPersonalAccessToken(userId: string, input: {
-        name: string;
-        scopes?: string[];
-        expiresAt?: string | null;
-    }): any;
-    listPersonalAccessTokens(userId: string): any;
-    revokePersonalAccessToken(userId: string, tokenId: string): any;
-    syncUserIdentity(identity: UserIdentityProfileInput): any;
-    createUser(input: {
-        email?: string | null;
-        username?: string | null;
-        displayName?: string | null;
-        metadata?: Record<string, unknown>;
-    }): any;
-    setUserRoles(userId: string, roles: string[]): any;
-    createServiceToken(input: {
-        serviceId: string;
-        name: string;
-        roles?: string[];
-        permissions?: string[];
-    }): Promise<import("./d1-store.js").ServiceCredentialResult>;
-    rotateServiceToken(serviceId: string): any;
-    createTrustedUserAssertion(claims: TrustedUserAssertionClaims): string;
-    verifyTrustedUserAssertion(assertion: string): TrustedUserAssertionClaims | null;
-    exchangeTrustedUserAssertion(claims: TrustedUserAssertionClaims): any;
-}

package/dist/api/auth/d1-provider.js

@@ -1,95 +0,0 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { D1AuthStore } from "./d1-store.js";
-function encodePayload(payload) {
-  return Buffer.from(JSON.stringify(payload)).toString("base64url");
-}
-function decodePayload(value) {
-  return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-}
-function signPayload(payload, secret) {
-  return createHmac("sha256", secret).update(payload).digest("base64url");
-}
-function safeEqual(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
-}
-class D1AuthProvider {
-  constructor(config, options = {}) {
-    this.config = config;
-    if (!options.db) {
-      throw new Error("D1AuthProvider requires an explicit database binding or adapter.");
-    }
-    this.store = new D1AuthStore(config, options.db);
-  }
-  config;
-  id = "d1";
-  store;
-  startDeviceFlow(request) {
-    return this.store.startDeviceFlow(request);
-  }
-  pollDeviceFlow(request) {
-    return this.store.pollDeviceFlow(request);
-  }
-  refreshAccessToken(request) {
-    return this.store.refreshAccessToken(request);
-  }
-  issueUserSession(userId, options = {}) {
-    return this.store.issueUserSession(userId, options);
-  }
-  approveDeviceFlow(request) {
-    return this.store.approveDeviceFlow(request);
-  }
-  authenticateBearerToken(token) {
-    return this.store.authenticateBearerToken(token);
-  }
-  authenticateServiceCredential(serviceId, secret) {
-    return this.store.authenticateService(serviceId, secret);
-  }
-  createPersonalAccessToken(userId, input) {
-    return this.store.createPersonalAccessToken(userId, input);
-  }
-  listPersonalAccessTokens(userId) {
-    return this.store.listPersonalAccessTokens(userId);
-  }
-  revokePersonalAccessToken(userId, tokenId) {
-    return this.store.revokePersonalAccessToken(userId, tokenId);
-  }
-  syncUserIdentity(identity) {
-    return this.store.syncUser(identity);
-  }
-  createUser(input) {
-    return this.store.createUser(input);
-  }
-  setUserRoles(userId, roles) {
-    return this.store.setUserRoles(userId, roles);
-  }
-  createServiceToken(input) {
-    return this.store.createServiceCredential(input);
-  }
-  rotateServiceToken(serviceId) {
-    return this.store.rotateServiceCredential(serviceId);
-  }
-  createTrustedUserAssertion(claims) {
-    const payload = encodePayload(claims);
-    const signature = signPayload(payload, this.config.webAssertionSecret);
-    return `${payload}.${signature}`;
-  }
-  verifyTrustedUserAssertion(assertion) {
-    const [payload, signature] = assertion.split(".");
-    if (!payload || !signature) return null;
-    const expectedSignature = signPayload(payload, this.config.webAssertionSecret);
-    if (!safeEqual(signature, expectedSignature)) return null;
-    const claims = decodePayload(payload);
-    if (!claims.expiresAt || new Date(claims.expiresAt).getTime() <= Date.now()) {
-      return null;
-    }
-    return claims;
-  }
-  exchangeTrustedUserAssertion(claims) {
-    return this.store.exchangeTrustedUserAssertion(claims);
-  }
-}
-export {
-  D1AuthProvider
-};

package/dist/api/auth/d1-store/accounts/identity/can-adopt-username-match.d.ts

@@ -1,3 +0,0 @@
-import type { UserIdentityProfileInput } from "../../../../types.js";
-import { D1AuthStore, UserRow } from "../../../d1-store.js";
-export declare function canAdoptUsernameMatchMethod(this: D1AuthStore, identity: UserIdentityProfileInput, user: UserRow | null): boolean;

package/dist/api/auth/d1-store/accounts/identity/can-adopt-username-match.js

@@ -1,13 +0,0 @@
-function canAdoptUsernameMatchMethod(identity, user) {
-  if (!user?.id || !identity.username)
-    return false;
-  const profile = identity.profile && typeof identity.profile === "object" ? identity.profile : {};
-  if (identity.provider === "acceptance" || profile.acceptance === true)
-    return true;
-  const existingEmail = typeof user.email === "string" ? user.email.trim().toLowerCase() : "";
-  const requestedEmail = typeof identity.email === "string" ? identity.email.trim().toLowerCase() : "";
-  return Boolean(requestedEmail && existingEmail && requestedEmail === existingEmail && identity.emailVerified);
-}
-export {
-  canAdoptUsernameMatchMethod
-};

package/dist/api/auth/d1-store/accounts/identity/ensure-auth-schema.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function ensureAuthSchemaMethod(this: D1AuthStore): Promise<void>;

package/dist/api/auth/d1-store/accounts/identity/ensure-auth-schema.js

@@ -1,14 +0,0 @@
-import { AUTH_SCHEMA_SQL } from "../../../d1-store.js";
-async function ensureAuthSchemaMethod() {
-  for (const statement of AUTH_SCHEMA_SQL)
-    await this.run(statement);
-  const result = await this.db.prepare("PRAGMA table_info(users)").all();
-  const columns = new Set((result.results ?? []).map((row) => row.name));
-  if (!columns.has("username")) {
-    await this.run("ALTER TABLE users ADD COLUMN username TEXT");
-  }
-  await this.run("CREATE UNIQUE INDEX IF NOT EXISTS idx_users_username ON users(username)");
-}
-export {
-  ensureAuthSchemaMethod
-};

package/dist/api/auth/d1-store/accounts/identity/load-user-by-username.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function loadUserByUsernameMethod(this: D1AuthStore, username: string): Promise<any>;

package/dist/api/auth/d1-store/accounts/identity/load-user-by-username.js

@@ -1,6 +0,0 @@
-async function loadUserByUsernameMethod(username) {
-  return this.first(`SELECT * FROM users WHERE LOWER(username) = LOWER(?) AND status = 'active' LIMIT 1`, [username]);
-}
-export {
-  loadUserByUsernameMethod
-};

package/dist/api/auth/d1-store/accounts/identity/load-user-by-verified-email.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function loadUserByVerifiedEmailMethod(this: D1AuthStore, email: string): Promise<any>;

package/dist/api/auth/d1-store/accounts/identity/load-user-by-verified-email.js

@@ -1,6 +0,0 @@
-async function loadUserByVerifiedEmailMethod(email) {
-  return this.first(`SELECT * FROM users WHERE LOWER(email) = LOWER(?) AND status = 'active' LIMIT 1`, [email]);
-}
-export {
-  loadUserByVerifiedEmailMethod
-};

package/dist/api/auth/d1-store/accounts/sessions/authenticate-service.d.ts

@@ -1,6 +0,0 @@
-import type { ApiCredential, ApiPrincipal } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function authenticateServiceMethod(this: D1AuthStore, serviceId: string, secret: string): Promise<{
-    principal: ApiPrincipal;
-    credential: ApiCredential;
-} | null>;

package/dist/api/auth/d1-store/accounts/sessions/authenticate-service.js

@@ -1,34 +0,0 @@
-import { equalHash, isoNow, parseJson, stableHash } from "../../../d1-store.js";
-async function authenticateServiceMethod(serviceId, secret) {
-  await this.ensureInitialized();
-  const row = await this.first(`SELECT id, name, secret_hash, roles_json, permissions_json, revoked_at
-			 FROM service_credentials
-			 WHERE service_id = ?`, [serviceId]);
-  if (!row || row.revoked_at)
-    return null;
-  const incomingHash = stableHash(secret, this.config.authSecret);
-  if (!equalHash(row.secret_hash, incomingHash))
-    return null;
-  await this.run(`UPDATE service_credentials SET last_used_at = ?, updated_at = ? WHERE id = ?`, [isoNow(), isoNow(), row.id]);
-  const roles = parseJson(row.roles_json, []);
-  const permissions = [
-    .../* @__PURE__ */ new Set([
-      ...await this.permissionsForRoles(roles),
-      ...parseJson(row.permissions_json, [])
-    ])
-  ];
-  return {
-    principal: {
-      id: serviceId,
-      displayName: row.name,
-      roles,
-      permissions,
-      scopes: this.scopesForPrincipal(permissions),
-      metadata: { serviceId }
-    },
-    credential: { type: "service_secret", id: row.id, label: row.name }
-  };
-}
-export {
-  authenticateServiceMethod
-};

package/dist/api/auth/d1-store/accounts/sessions/issue-user-session.d.ts

@@ -1,7 +0,0 @@
-import type { TokenRefreshResponse } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function issueUserSessionMethod(this: D1AuthStore, userId: string, options?: {
-    sessionType?: string;
-    scopes?: string[];
-    data?: Record<string, unknown>;
-}): Promise<TokenRefreshResponse>;