@treeseed/sdk 0.13.0-rc.5 → 0.13.0-rc.8

package/dist/workflow/operations/workspace-lifecycle/workflow-stage.js

@@ -5,7 +5,7 @@ import { hasMeaningfulChanges, repoRoot } from "../../../operations/services/tre
 import { workspaceRoot } from "../../../operations/services/treedx/workspaces/workspace-tools.js";
 import { resolveWorkflowSession } from "../../session.js";
 import { managedWorkflowWorktreeMetadata } from "../../worktrees.js";
-import { ensureLocalStateExcluded, resolveProjectRootOrThrow, withContextEnv, workflowError } from "../commerce/catalog/run-release-production-guarantees.js";
+import { ensureLocalStateExcluded, resolveProjectRootOrThrow, withContextEnv, workflowError } from "../release-support/helpers/run-release-production-guarantees.js";
 import { buildStagePromotionPlan, checkedOutStagePromotionRepos, createStageCandidateManifest, normalizeStageCiMode, normalizeStageCleanupMode, normalizeStageVerifyMode, stageConflictError, stagePreflightBlockers, stagingCandidateWorkflowGates, writeStageCandidateManifest } from "../coordination/staging-candidate-workflow-gates.js";
 import { helpersForCwd, waitForWorkflowGates, worktreePayload } from "../packages/normalize-release-candidate-mode.js";
 import { acquireWorkflowRun, completeWorkflowRun, executeJournalStep, skipJournalStep } from "../packages/prepare-fresh-release-run.js";

package/dist/workflow/operations/workspace-lifecycle/workflow-switch.js

@@ -6,7 +6,7 @@ import { workspaceRoot } from "../../../operations/services/treedx/workspaces/wo
 import { resolveWorkflowState } from "../../../operations/workflow-state.js";
 import { resolveWorkflowSession } from "../../session.js";
 import { effectiveWorkflowWorktreeMode, ensureManagedWorkflowWorktree, plannedManagedWorkflowWorktreePath } from "../../worktrees.js";
-import { resolveProjectRootOrThrow, withContextEnv, workflowError } from "../commerce/catalog/run-release-production-guarantees.js";
+import { resolveProjectRootOrThrow, withContextEnv, workflowError } from "../release-support/helpers/run-release-production-guarantees.js";
 import { assertSessionBranchSafety, branchPreviewInitialized, reconcileBranchPreview, reconcileWorkflowBranchPreview } from "../packages/collect-published-release-artifact-checks.js";
 import { helpersForCwd, shouldDispatchSwitchToManagedWorktree, worktreePayload } from "../packages/normalize-release-candidate-mode.js";
 import { acquireWorkflowRun, completeWorkflowRun, executeJournalStep } from "../packages/prepare-fresh-release-run.js";

package/dist/workflow/operations/workspace-lifecycle/workflow-update.js

@@ -6,7 +6,7 @@ import { PRODUCTION_BRANCH, STAGING_BRANCH } from "../../../operations/services/
 import { workspaceRoot } from "../../../operations/services/treedx/workspaces/workspace-tools.js";
 import { resolveWorkflowSession } from "../../session.js";
 import { readWorkflowRunJournal } from "../../runs.js";
-import { resolveProjectRootOrThrow, withContextEnv, workflowError } from "../commerce/catalog/run-release-production-guarantees.js";
+import { resolveProjectRootOrThrow, withContextEnv, workflowError } from "../release-support/helpers/run-release-production-guarantees.js";
 import { worktreePayload } from "../packages/normalize-release-candidate-mode.js";
 import { acquireWorkflowRun, completeWorkflowRun, executeJournalStep } from "../packages/prepare-fresh-release-run.js";
 import { createNextSteps } from "../packages/release-admin-message.js";

package/dist/workflow/operations.d.ts

@@ -1,5 +1,5 @@
-export * from './operations/commerce/catalog/back-merge-production-into-staging.js';
-export * from './operations/commerce/catalog/run-release-production-guarantees.js';
+export * from './operations/release-support/helpers/back-merge-production-into-staging.js';
+export * from './operations/release-support/helpers/run-release-production-guarantees.js';
 export * from './operations/configuration/workflow-config.js';
 export * from './operations/coordination/staging-candidate-workflow-gates.js';
 export * from './operations/coordination/integration-change-set.js';

package/dist/workflow/operations.js

@@ -1,5 +1,5 @@
-export * from "./operations/commerce/catalog/back-merge-production-into-staging.js";
-export * from "./operations/commerce/catalog/run-release-production-guarantees.js";
+export * from "./operations/release-support/helpers/back-merge-production-into-staging.js";
+export * from "./operations/release-support/helpers/run-release-production-guarantees.js";
 export * from "./operations/configuration/workflow-config.js";
 export * from "./operations/coordination/staging-candidate-workflow-gates.js";
 export * from "./operations/coordination/integration-change-set.js";

package/dist/workflow-state/readiness-for-environment.d.ts

@@ -10,6 +10,7 @@ export declare function safeResolveRemoteSession(cwd: string, hostId?: string |
     accessToken: string;
     refreshToken: string;
     expiresAt: any;
+    audience: any;
     principal: any;
 } | null;
 export declare function safeResolveMachineEnvironmentValues(cwd: string, scope: 'local' | 'staging' | 'prod'): {};

package/dist/workflow-state/resolve-workflow-state.js

@@ -308,7 +308,7 @@ function resolveWorkflowState(cwd, options = {}) {
       state.auth.wrangler = state.auth.wrangler || hasStatusConfigValue(statusConfigByScope, "TREESEED_CLOUDFLARE_API_TOKEN");
       state.auth.railway = state.auth.railway || hasStatusConfigValue(statusConfigByScope, "TREESEED_RAILWAY_API_TOKEN");
       state.auth.copilot = state.auth.copilot || state.auth.gh;
-      state.marketConnection.baseUrl = state.marketConnection.baseUrl ?? sharedConfigValues.TREESEED_API_BASE_URL ?? deployConfig.runtime?.marketBaseUrl ?? deployConfig.hosting?.marketBaseUrl ?? null;
+      state.marketConnection.baseUrl = state.marketConnection.baseUrl ?? sharedConfigValues.TREESEED_API_BASE_URL ?? deployConfig.runtime?.controlPlaneBaseUrl ?? deployConfig.hosting?.controlPlaneBaseUrl ?? null;
       state.marketConnection.teamId = state.marketConnection.teamId ?? sharedConfigValues.TREESEED_HOSTING_TEAM_ID ?? deployConfig.runtime?.teamId ?? deployConfig.hosting?.teamId ?? null;
       state.marketConnection.projectId = state.marketConnection.projectId ?? sharedConfigValues.TREESEED_PROJECT_ID ?? deployConfig.runtime?.projectId ?? deployConfig.hosting?.projectId ?? null;
       state.marketConnection.hubMode = deployConfig.hub?.mode ?? null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-	"version": "0.13.0-rc.5",
+  "version": "0.13.0-rc.8",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "Apache-2.0",
   "repository": {
@@ -51,7 +51,6 @@
     "test:unit:fast": "vitest run --config ./vitest.fast.config.ts",
     "test:guarantees": "vitest run --config ./vitest.guarantees.config.ts",
     "test:guarantees:coverage": "vitest run --config ./vitest.guarantees.config.ts --coverage",
-    "test:capacity-cleanup-live": "node --import tsx ./scripts/testing/test-live-acceptance-cleanup-service.ts",
     "test:workflow:lifecycle": "vitest run --config ./vitest.workflow.config.ts",
     "test:release": "npm run test:unit",
     "test:smoke": "node --import tsx ./scripts/testing/test-smoke.ts",
@@ -135,6 +134,10 @@
       "types": "./dist/standards/openapi/index.d.ts",
       "default": "./dist/standards/openapi/index.js"
     },
+    "./standards/mcp": {
+      "types": "./dist/standards/mcp/index.d.ts",
+      "default": "./dist/standards/mcp/index.js"
+    },
     "./operator-contracts": {
       "types": "./dist/operator-contracts/index.d.ts",
       "default": "./dist/operator-contracts/index.js"
@@ -163,22 +166,6 @@
       "types": "./dist/content/validation/index.d.ts",
       "default": "./dist/content/validation/index.js"
     },
-    "./api": {
-      "types": "./dist/api/index.d.ts",
-      "default": "./dist/api/index.js"
-    },
-    "./api/auth/d1-provider": {
-      "types": "./dist/api/auth/d1-provider.d.ts",
-      "default": "./dist/api/auth/d1-provider.js"
-    },
-    "./api/auth/rbac": {
-      "types": "./dist/api/auth/rbac.d.ts",
-      "default": "./dist/api/auth/rbac.js"
-    },
-    "./api/trusted-assertion": {
-      "types": "./dist/api/auth/trusted-assertion.d.ts",
-      "default": "./dist/api/auth/trusted-assertion.js"
-    },
     "./workflow": {
       "types": "./dist/operations/workflow.d.ts",
       "default": "./dist/operations/workflow.js"
@@ -211,13 +198,9 @@
       "types": "./dist/operations/workflow-support.d.ts",
       "default": "./dist/operations/workflow-support.js"
     },
-    "./market-client": {
-      "types": "./dist/entrypoints/clients/market-client.d.ts",
-      "default": "./dist/entrypoints/clients/market-client.js"
-    },
-    "./market-gateway": {
-      "types": "./dist/gateway/index.d.ts",
-      "default": "./dist/gateway/index.js"
+    "./control-plane-client": {
+      "types": "./dist/entrypoints/clients/control-plane-client.d.ts",
+      "default": "./dist/entrypoints/clients/control-plane-client.js"
     },
     "./account-contracts": {
       "types": "./dist/accounts/account-contracts.d.ts",
@@ -316,8 +299,8 @@
       "default": "./dist/treedx/repositories/treedx-backends.js"
     },
     "./template-catalog": {
-      "types": "./dist/commerce/catalog/template-catalog.d.ts",
-      "default": "./dist/commerce/catalog/template-catalog.js"
+      "types": "./dist/templates/template-catalog.d.ts",
+      "default": "./dist/templates/template-catalog.js"
     },
     "./d1-store": {
       "types": "./dist/persistence/d1-store.d.ts",
@@ -400,14 +383,6 @@
       "types": "./dist/capacity-provider/contracts/index.d.ts",
       "default": "./dist/capacity-provider/contracts/index.js"
     },
-    "./platform-operations": {
-      "types": "./dist/operations/platform-operations.d.ts",
-      "default": "./dist/operations/platform-operations.js"
-    },
-    "./platform-operation-store": {
-      "types": "./dist/operations/platform-operation-store.d.ts",
-      "default": "./dist/operations/platform-operation-store.js"
-    },
     "./operations/github-credentials": {
       "types": "./dist/operations/services/configuration/github-credentials.d.ts",
       "default": "./dist/operations/services/configuration/github-credentials.js"
@@ -444,10 +419,6 @@
       "types": "./dist/db/schema.d.ts",
       "default": "./dist/db/schema.js"
     },
-    "./db/market-schema": {
-      "types": "./dist/db/market-schema.d.ts",
-      "default": "./dist/db/market-schema.js"
-    },
     "./db/d1": {
       "types": "./dist/db/d1.d.ts",
       "default": "./dist/db/d1.js"

package/dist/api/auth/d1-database.d.ts

@@ -1,3 +0,0 @@
-import type { D1DatabaseLike } from '../../types/cloudflare.js';
-import type { ApiConfig } from '../types.js';
-export declare function resolveApiD1Database(config: ApiConfig): D1DatabaseLike;

package/dist/api/auth/d1-database.js

@@ -1,20 +0,0 @@
-import { NodeSqliteD1Database } from "../../db/node-sqlite.js";
-import { CloudflareHttpD1Database } from "../../persistence/d1-http.js";
-function resolveApiD1Database(config) {
-  if (config.cloudflareAccountId && config.cloudflareApiToken && config.d1DatabaseId) {
-    return new CloudflareHttpD1Database({
-      accountId: config.cloudflareAccountId,
-      apiToken: config.cloudflareApiToken,
-      databaseId: config.d1DatabaseId
-    });
-  }
-  if (config.d1LocalPersistTo || config.d1DatabaseName) {
-    return new NodeSqliteD1Database(config.d1LocalPersistTo);
-  }
-  throw new Error(
-    "Treeseed API auth requires either CLOUDFLARE_ACCOUNT_ID + CLOUDFLARE_API_TOKEN + TREESEED_API_D1_DATABASE_ID for remote D1 access, or TREESEED_API_D1_LOCAL_PERSIST_TO for local SQLite-backed D1-compatible access."
-  );
-}
-export {
-  resolveApiD1Database
-};

package/dist/api/auth/d1-provider.d.ts

@@ -1,54 +0,0 @@
-import type { D1DatabaseLike } from '../../types/cloudflare.js';
-import type { ApiAuthProvider, ApiConfig, ApiCredential, ApiPrincipal, DeviceCodeApproveRequest, DeviceCodePollRequest, DeviceCodePollResponse, DeviceCodeStartRequest, DeviceCodeStartResponse, TokenRefreshRequest, TokenRefreshResponse, TrustedUserAssertionClaims, UserIdentityProfileInput } from '../types.js';
-export declare class D1AuthProvider implements ApiAuthProvider {
-    private readonly config;
-    readonly id = "d1";
-    private readonly store;
-    constructor(config: ApiConfig, options?: {
-        db?: D1DatabaseLike;
-    });
-    startDeviceFlow(request: DeviceCodeStartRequest): Promise<DeviceCodeStartResponse>;
-    pollDeviceFlow(request: DeviceCodePollRequest): Promise<DeviceCodePollResponse>;
-    refreshAccessToken(request: TokenRefreshRequest): Promise<TokenRefreshResponse>;
-    issueUserSession(userId: string, options?: {
-        sessionType?: string;
-        scopes?: string[];
-        data?: Record<string, unknown>;
-    }): Promise<TokenRefreshResponse>;
-    approveDeviceFlow(request: DeviceCodeApproveRequest): Promise<{
-        ok: true;
-    }>;
-    authenticateBearerToken(token: string): Promise<{
-        principal: ApiPrincipal;
-        credential: ApiCredential;
-    } | null>;
-    authenticateServiceCredential(serviceId: string, secret: string): Promise<{
-        principal: ApiPrincipal;
-        credential: ApiCredential;
-    } | null>;
-    createPersonalAccessToken(userId: string, input: {
-        name: string;
-        scopes?: string[];
-        expiresAt?: string | null;
-    }): any;
-    listPersonalAccessTokens(userId: string): any;
-    revokePersonalAccessToken(userId: string, tokenId: string): any;
-    syncUserIdentity(identity: UserIdentityProfileInput): any;
-    createUser(input: {
-        email?: string | null;
-        username?: string | null;
-        displayName?: string | null;
-        metadata?: Record<string, unknown>;
-    }): any;
-    setUserRoles(userId: string, roles: string[]): any;
-    createServiceToken(input: {
-        serviceId: string;
-        name: string;
-        roles?: string[];
-        permissions?: string[];
-    }): Promise<import("./d1-store.js").ServiceCredentialResult>;
-    rotateServiceToken(serviceId: string): any;
-    createTrustedUserAssertion(claims: TrustedUserAssertionClaims): string;
-    verifyTrustedUserAssertion(assertion: string): TrustedUserAssertionClaims | null;
-    exchangeTrustedUserAssertion(claims: TrustedUserAssertionClaims): any;
-}

package/dist/api/auth/d1-provider.js

@@ -1,95 +0,0 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { D1AuthStore } from "./d1-store.js";
-function encodePayload(payload) {
-  return Buffer.from(JSON.stringify(payload)).toString("base64url");
-}
-function decodePayload(value) {
-  return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-}
-function signPayload(payload, secret) {
-  return createHmac("sha256", secret).update(payload).digest("base64url");
-}
-function safeEqual(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
-}
-class D1AuthProvider {
-  constructor(config, options = {}) {
-    this.config = config;
-    if (!options.db) {
-      throw new Error("D1AuthProvider requires an explicit database binding or adapter.");
-    }
-    this.store = new D1AuthStore(config, options.db);
-  }
-  config;
-  id = "d1";
-  store;
-  startDeviceFlow(request) {
-    return this.store.startDeviceFlow(request);
-  }
-  pollDeviceFlow(request) {
-    return this.store.pollDeviceFlow(request);
-  }
-  refreshAccessToken(request) {
-    return this.store.refreshAccessToken(request);
-  }
-  issueUserSession(userId, options = {}) {
-    return this.store.issueUserSession(userId, options);
-  }
-  approveDeviceFlow(request) {
-    return this.store.approveDeviceFlow(request);
-  }
-  authenticateBearerToken(token) {
-    return this.store.authenticateBearerToken(token);
-  }
-  authenticateServiceCredential(serviceId, secret) {
-    return this.store.authenticateService(serviceId, secret);
-  }
-  createPersonalAccessToken(userId, input) {
-    return this.store.createPersonalAccessToken(userId, input);
-  }
-  listPersonalAccessTokens(userId) {
-    return this.store.listPersonalAccessTokens(userId);
-  }
-  revokePersonalAccessToken(userId, tokenId) {
-    return this.store.revokePersonalAccessToken(userId, tokenId);
-  }
-  syncUserIdentity(identity) {
-    return this.store.syncUser(identity);
-  }
-  createUser(input) {
-    return this.store.createUser(input);
-  }
-  setUserRoles(userId, roles) {
-    return this.store.setUserRoles(userId, roles);
-  }
-  createServiceToken(input) {
-    return this.store.createServiceCredential(input);
-  }
-  rotateServiceToken(serviceId) {
-    return this.store.rotateServiceCredential(serviceId);
-  }
-  createTrustedUserAssertion(claims) {
-    const payload = encodePayload(claims);
-    const signature = signPayload(payload, this.config.webAssertionSecret);
-    return `${payload}.${signature}`;
-  }
-  verifyTrustedUserAssertion(assertion) {
-    const [payload, signature] = assertion.split(".");
-    if (!payload || !signature) return null;
-    const expectedSignature = signPayload(payload, this.config.webAssertionSecret);
-    if (!safeEqual(signature, expectedSignature)) return null;
-    const claims = decodePayload(payload);
-    if (!claims.expiresAt || new Date(claims.expiresAt).getTime() <= Date.now()) {
-      return null;
-    }
-    return claims;
-  }
-  exchangeTrustedUserAssertion(claims) {
-    return this.store.exchangeTrustedUserAssertion(claims);
-  }
-}
-export {
-  D1AuthProvider
-};

package/dist/api/auth/d1-store/accounts/identity/can-adopt-username-match.d.ts

@@ -1,3 +0,0 @@
-import type { UserIdentityProfileInput } from "../../../../types.js";
-import { D1AuthStore, UserRow } from "../../../d1-store.js";
-export declare function canAdoptUsernameMatchMethod(this: D1AuthStore, identity: UserIdentityProfileInput, user: UserRow | null): boolean;

package/dist/api/auth/d1-store/accounts/identity/can-adopt-username-match.js

@@ -1,13 +0,0 @@
-function canAdoptUsernameMatchMethod(identity, user) {
-  if (!user?.id || !identity.username)
-    return false;
-  const profile = identity.profile && typeof identity.profile === "object" ? identity.profile : {};
-  if (identity.provider === "acceptance" || profile.acceptance === true)
-    return true;
-  const existingEmail = typeof user.email === "string" ? user.email.trim().toLowerCase() : "";
-  const requestedEmail = typeof identity.email === "string" ? identity.email.trim().toLowerCase() : "";
-  return Boolean(requestedEmail && existingEmail && requestedEmail === existingEmail && identity.emailVerified);
-}
-export {
-  canAdoptUsernameMatchMethod
-};

package/dist/api/auth/d1-store/accounts/identity/ensure-auth-schema.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function ensureAuthSchemaMethod(this: D1AuthStore): Promise<void>;

package/dist/api/auth/d1-store/accounts/identity/ensure-auth-schema.js

@@ -1,14 +0,0 @@
-import { AUTH_SCHEMA_SQL } from "../../../d1-store.js";
-async function ensureAuthSchemaMethod() {
-  for (const statement of AUTH_SCHEMA_SQL)
-    await this.run(statement);
-  const result = await this.db.prepare("PRAGMA table_info(users)").all();
-  const columns = new Set((result.results ?? []).map((row) => row.name));
-  if (!columns.has("username")) {
-    await this.run("ALTER TABLE users ADD COLUMN username TEXT");
-  }
-  await this.run("CREATE UNIQUE INDEX IF NOT EXISTS idx_users_username ON users(username)");
-}
-export {
-  ensureAuthSchemaMethod
-};

package/dist/api/auth/d1-store/accounts/identity/load-user-by-username.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function loadUserByUsernameMethod(this: D1AuthStore, username: string): Promise<any>;

package/dist/api/auth/d1-store/accounts/identity/load-user-by-username.js

@@ -1,6 +0,0 @@
-async function loadUserByUsernameMethod(username) {
-  return this.first(`SELECT * FROM users WHERE LOWER(username) = LOWER(?) AND status = 'active' LIMIT 1`, [username]);
-}
-export {
-  loadUserByUsernameMethod
-};

package/dist/api/auth/d1-store/accounts/identity/load-user-by-verified-email.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function loadUserByVerifiedEmailMethod(this: D1AuthStore, email: string): Promise<any>;

package/dist/api/auth/d1-store/accounts/identity/load-user-by-verified-email.js

@@ -1,6 +0,0 @@
-async function loadUserByVerifiedEmailMethod(email) {
-  return this.first(`SELECT * FROM users WHERE LOWER(email) = LOWER(?) AND status = 'active' LIMIT 1`, [email]);
-}
-export {
-  loadUserByVerifiedEmailMethod
-};

package/dist/api/auth/d1-store/accounts/sessions/authenticate-service.d.ts

@@ -1,6 +0,0 @@
-import type { ApiCredential, ApiPrincipal } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function authenticateServiceMethod(this: D1AuthStore, serviceId: string, secret: string): Promise<{
-    principal: ApiPrincipal;
-    credential: ApiCredential;
-} | null>;

package/dist/api/auth/d1-store/accounts/sessions/authenticate-service.js

@@ -1,34 +0,0 @@
-import { equalHash, isoNow, parseJson, stableHash } from "../../../d1-store.js";
-async function authenticateServiceMethod(serviceId, secret) {
-  await this.ensureInitialized();
-  const row = await this.first(`SELECT id, name, secret_hash, roles_json, permissions_json, revoked_at
-			 FROM service_credentials
-			 WHERE service_id = ?`, [serviceId]);
-  if (!row || row.revoked_at)
-    return null;
-  const incomingHash = stableHash(secret, this.config.authSecret);
-  if (!equalHash(row.secret_hash, incomingHash))
-    return null;
-  await this.run(`UPDATE service_credentials SET last_used_at = ?, updated_at = ? WHERE id = ?`, [isoNow(), isoNow(), row.id]);
-  const roles = parseJson(row.roles_json, []);
-  const permissions = [
-    .../* @__PURE__ */ new Set([
-      ...await this.permissionsForRoles(roles),
-      ...parseJson(row.permissions_json, [])
-    ])
-  ];
-  return {
-    principal: {
-      id: serviceId,
-      displayName: row.name,
-      roles,
-      permissions,
-      scopes: this.scopesForPrincipal(permissions),
-      metadata: { serviceId }
-    },
-    credential: { type: "service_secret", id: row.id, label: row.name }
-  };
-}
-export {
-  authenticateServiceMethod
-};

package/dist/api/auth/d1-store/accounts/sessions/issue-user-session.d.ts

@@ -1,7 +0,0 @@
-import type { TokenRefreshResponse } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function issueUserSessionMethod(this: D1AuthStore, userId: string, options?: {
-    sessionType?: string;
-    scopes?: string[];
-    data?: Record<string, unknown>;
-}): Promise<TokenRefreshResponse>;

package/dist/api/auth/d1-store/accounts/sessions/issue-user-session.js

@@ -1,69 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { addSeconds, isoNow, now, stableHash } from "../../../d1-store.js";
-import { createAccessToken, nextOpaqueToken } from "../../../tokens.js";
-async function issueUserSessionMethod(userId, options = {}) {
-  await this.ensureInitialized();
-  const principalRecord = await this.principalForUser(userId);
-  const refreshToken = nextOpaqueToken("refresh");
-  const sessionId = randomUUID();
-  const refreshTokenHash = stableHash(refreshToken, this.config.authSecret);
-  const expiresAt = addSeconds(now(), this.config.accessTokenTtlSeconds);
-  const refreshExpiresAt = addSeconds(now(), this.config.refreshTokenTtlSeconds);
-  const requestedScopes = options.scopes && options.scopes.length > 0 ? [...new Set(options.scopes)] : principalRecord.principal.scopes;
-  await this.run(`INSERT INTO auth_sessions (id, user_id, session_type, refresh_token_hash, scopes_json, expires_at, revoked_at, data_json, created_at, updated_at)
-			 VALUES (?, ?, ?, ?, ?, ?, NULL, ?, ?, ?)`, [
-    sessionId,
-    userId,
-    options.sessionType?.trim() || "web",
-    refreshTokenHash,
-    JSON.stringify(requestedScopes),
-    refreshExpiresAt.toISOString(),
-    JSON.stringify(options.data ?? {}),
-    isoNow(),
-    isoNow()
-  ]);
-  const accessToken = createAccessToken({
-    sub: principalRecord.principal.id,
-    displayName: principalRecord.principal.displayName,
-    scopes: requestedScopes,
-    roles: principalRecord.principal.roles,
-    permissions: principalRecord.principal.permissions,
-    metadata: {
-      ...principalRecord.principal.metadata,
-      sessionId
-    },
-    iat: Math.floor(Date.now() / 1e3),
-    exp: Math.floor(expiresAt.getTime() / 1e3),
-    iss: this.config.issuer,
-    jti: randomUUID(),
-    tokenType: "access"
-  }, this.config.authSecret);
-  await this.writeAuditEvent({
-    actorType: "user",
-    actorId: userId,
-    eventType: "auth.session_issued",
-    targetType: "auth_session",
-    targetId: sessionId,
-    data: { sessionType: options.sessionType ?? "web" }
-  });
-  return {
-    ok: true,
-    status: "approved",
-    accessToken,
-    refreshToken,
-    tokenType: "Bearer",
-    expiresAt: expiresAt.toISOString(),
-    expiresInSeconds: this.config.accessTokenTtlSeconds,
-    principal: {
-      ...principalRecord.principal,
-      scopes: requestedScopes,
-      metadata: {
-        ...principalRecord.principal.metadata ?? {},
-        sessionId
-      }
-    }
-  };
-}
-export {
-  issueUserSessionMethod
-};

package/dist/api/auth/d1-store/accounts/tokens/authenticate-bearer-token.d.ts

@@ -1,6 +0,0 @@
-import type { ApiCredential, ApiPrincipal } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function authenticateBearerTokenMethod(this: D1AuthStore, token: string): Promise<{
-    principal: ApiPrincipal;
-    credential: ApiCredential;
-} | null>;

package/dist/api/auth/d1-store/accounts/tokens/authenticate-bearer-token.js

@@ -1,42 +0,0 @@
-import { isoNow, parseJson, stableHash } from "../../../d1-store.js";
-import { principalFromAccessTokenPayload, verifyAccessToken } from "../../../tokens.js";
-async function authenticateBearerTokenMethod(token) {
-  await this.ensureInitialized();
-  const patHash = stableHash(token, this.config.authSecret);
-  const pat = await this.first(`SELECT id, user_id, name, scopes_json, expires_at, revoked_at
-			 FROM api_tokens
-			 WHERE token_hash = ?`, [patHash]);
-  if (pat && !pat.revoked_at && (!pat.expires_at || new Date(pat.expires_at).getTime() > Date.now())) {
-    await this.run(`UPDATE api_tokens SET last_used_at = ? WHERE id = ?`, [isoNow(), pat.id]);
-    const principal = (await this.principalForUser(pat.user_id)).principal;
-    return {
-      principal: { ...principal, scopes: parseJson(pat.scopes_json, principal.scopes) },
-      credential: { type: "personal_access_token", id: pat.id, label: pat.name }
-    };
-  }
-  const payload = verifyAccessToken(token, this.config.authSecret);
-  if (!payload)
-    return null;
-  const sessionId = typeof payload.metadata?.sessionId === "string" ? payload.metadata.sessionId.trim() : "";
-  if (sessionId) {
-    const session = await this.first(`SELECT id, user_id, expires_at, revoked_at
-				 FROM auth_sessions
-				 WHERE id = ?`, [sessionId]);
-    const sessionExpiresAt = session ? new Date(session.expires_at).getTime() : 0;
-    if (!session || session.user_id !== payload.sub || session.revoked_at || !Number.isFinite(sessionExpiresAt) || sessionExpiresAt <= Date.now()) {
-      return null;
-    }
-    await this.run(`UPDATE auth_sessions SET updated_at = ? WHERE id = ?`, [isoNow(), session.id]);
-  }
-  return {
-    principal: principalFromAccessTokenPayload(payload),
-    credential: {
-      type: payload.tokenType === "service" ? "service_token" : "access_token",
-      id: payload.jti,
-      label: payload.tokenType
-    }
-  };
-}
-export {
-  authenticateBearerTokenMethod
-};

package/dist/api/auth/d1-store/accounts/tokens/create-personal-access-token.d.ts

@@ -1,12 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function createPersonalAccessTokenMethod(this: D1AuthStore, userId: string, input: {
-    name: string;
-    scopes?: string[];
-    expiresAt?: string | null;
-}): Promise<{
-    id: `${string}-${string}-${string}-${string}-${string}`;
-    token: string;
-    prefix: string;
-    name: string;
-    expiresAt: string | null;
-}>;

package/dist/api/auth/d1-store/accounts/tokens/create-personal-access-token.js

@@ -1,36 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { isoNow, stableHash } from "../../../d1-store.js";
-import { nextOpaqueToken } from "../../../tokens.js";
-async function createPersonalAccessTokenMethod(userId, input) {
-  await this.ensureInitialized();
-  const nowIso = isoNow();
-  const token = nextOpaqueToken("pat");
-  const id = randomUUID();
-  const tokenHash = stableHash(token, this.config.authSecret);
-  const prefix = token.slice(0, 12);
-  await this.run(`INSERT INTO api_tokens (id, user_id, kind, name, token_prefix, token_hash, scopes_json, expires_at, last_used_at, revoked_at, metadata_json, created_at, updated_at)
-			 VALUES (?, ?, 'personal_access_token', ?, ?, ?, ?, ?, NULL, NULL, ?, ?, ?)`, [
-    id,
-    userId,
-    input.name,
-    prefix,
-    tokenHash,
-    JSON.stringify(input.scopes?.length ? input.scopes : ["auth:me"]),
-    input.expiresAt ?? null,
-    JSON.stringify({}),
-    nowIso,
-    nowIso
-  ]);
-  await this.writeAuditEvent({
-    actorType: "user",
-    actorId: userId,
-    eventType: "auth.pat_created",
-    targetType: "api_token",
-    targetId: id,
-    data: { name: input.name }
-  });
-  return { id, token, prefix, name: input.name, expiresAt: input.expiresAt ?? null };
-}
-export {
-  createPersonalAccessTokenMethod
-};

package/dist/api/auth/d1-store/accounts/tokens/list-personal-access-tokens.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function listPersonalAccessTokensMethod(this: D1AuthStore, userId: string): Promise<any>;