@treeseed/sdk 0.13.0-rc.5 → 0.13.0-rc.8

package/dist/api/auth/d1-store/support/principals/exchange-trusted-user-assertion.js

@@ -1,50 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { addSeconds, now } from "../../../d1-store.js";
-import { createAccessToken } from "../../../tokens.js";
-async function exchangeTrustedUserAssertionMethod(claims) {
-  await this.ensureInitialized();
-  const principalRecord = await this.principalForUser(claims.userId);
-  const expiresAt = addSeconds(now(), this.config.webExchangeTtlSeconds);
-  const accessToken = createAccessToken({
-    sub: principalRecord.principal.id,
-    displayName: principalRecord.principal.displayName,
-    scopes: principalRecord.principal.scopes,
-    roles: principalRecord.principal.roles,
-    permissions: principalRecord.principal.permissions,
-    metadata: {
-      ...principalRecord.principal.metadata,
-      actingSessionId: claims.sessionId,
-      identityId: claims.identityId,
-      teamId: claims.teamId ?? null,
-      projectId: claims.projectId ?? null,
-      membershipId: claims.membershipId ?? null,
-      teamRoles: [...new Set((claims.teamRoles ?? []).filter((entry) => typeof entry === "string" && entry.trim()))],
-      teamCapabilities: [...new Set((claims.teamCapabilities ?? []).filter((entry) => typeof entry === "string" && entry.trim()))],
-      authTime: claims.authTime
-    },
-    iat: Math.floor(Date.now() / 1e3),
-    exp: Math.floor(expiresAt.getTime() / 1e3),
-    iss: this.config.issuer,
-    jti: randomUUID(),
-    tokenType: "access"
-  }, this.config.authSecret);
-  await this.writeAuditEvent({
-    actorType: "service",
-    actorId: this.config.webServiceId,
-    eventType: "auth.web_exchange",
-    targetType: "user",
-    targetId: claims.userId,
-    data: { sessionId: claims.sessionId }
-  });
-  return {
-    ok: true,
-    accessToken,
-    tokenType: "Bearer",
-    expiresAt: expiresAt.toISOString(),
-    expiresInSeconds: this.config.webExchangeTtlSeconds,
-    principal: principalRecord.principal
-  };
-}
-export {
-  exchangeTrustedUserAssertionMethod
-};

package/dist/api/auth/d1-store/support/principals/load-user.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function loadUserMethod(this: D1AuthStore, userId: string): Promise<any>;

package/dist/api/auth/d1-store/support/principals/load-user.js

@@ -1,6 +0,0 @@
-async function loadUserMethod(userId) {
-  return this.first(`SELECT * FROM users WHERE id = ?`, [userId]);
-}
-export {
-  loadUserMethod
-};

package/dist/api/auth/d1-store/support/principals/permissions-for-user.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function permissionsForUserMethod(this: D1AuthStore, userId: string): Promise<any>;

package/dist/api/auth/d1-store/support/principals/permissions-for-user.js

@@ -1,11 +0,0 @@
-async function permissionsForUserMethod(userId) {
-  const rows = await this.all(`SELECT DISTINCT permissions.key AS key
-			 FROM user_role_bindings
-			 INNER JOIN role_permissions ON role_permissions.role_id = user_role_bindings.role_id
-			 INNER JOIN permissions ON permissions.id = role_permissions.permission_id
-			 WHERE user_role_bindings.user_id = ?`, [userId]);
-  return rows.map((row) => row.key);
-}
-export {
-  permissionsForUserMethod
-};

package/dist/api/auth/d1-store/support/principals/principal-for-user.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore, PrincipalRecord } from "../../../d1-store.js";
-export declare function principalForUserMethod(this: D1AuthStore, userId: string): Promise<PrincipalRecord>;

package/dist/api/auth/d1-store/support/principals/principal-for-user.js

@@ -1,27 +0,0 @@
-import { parseJson } from "../../../d1-store.js";
-async function principalForUserMethod(userId) {
-  const user = await this.loadUser(userId);
-  if (!user) {
-    throw new Error(`Unknown user "${userId}".`);
-  }
-  const roles = await this.rolesForUser(userId);
-  const permissions = await this.permissionsForUser(userId);
-  return {
-    userId,
-    principal: {
-      id: user.id,
-      displayName: user.display_name ?? void 0,
-      roles,
-      permissions,
-      scopes: this.scopesForPrincipal(permissions),
-      metadata: {
-        ...parseJson(user.metadata_json, {}),
-        email: user.email ?? void 0,
-        username: user.username ?? void 0
-      }
-    }
-  };
-}
-export {
-  principalForUserMethod
-};

package/dist/api/auth/d1-store/support/principals/scopes-for-principal.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function scopesForPrincipalMethod(this: D1AuthStore, permissions: string[]): string[];

package/dist/api/auth/d1-store/support/principals/scopes-for-principal.js

@@ -1,13 +0,0 @@
-function scopesForPrincipalMethod(permissions) {
-  const scopes = /* @__PURE__ */ new Set(["auth:me"]);
-  if (permissions.includes("*:*:*") || permissions.includes("sdk:execute:global"))
-    scopes.add("sdk");
-  if (permissions.includes("*:*:*") || permissions.includes("agent:execute:global"))
-    scopes.add("agent");
-  if (permissions.includes("*:*:*") || permissions.includes("operations:execute:global"))
-    scopes.add("operations");
-  return [...scopes];
-}
-export {
-  scopesForPrincipalMethod
-};

package/dist/api/auth/d1-store/support/principals/sync-user.d.ts

@@ -1,7 +0,0 @@
-import type { UserIdentityProfileInput } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function syncUserMethod(this: D1AuthStore, identity: UserIdentityProfileInput): Promise<{
-    identityId: any;
-    principal: import("../../../../types.js").ApiPrincipal;
-    userId: string;
-}>;

package/dist/api/auth/d1-store/support/principals/sync-user.js

@@ -1,96 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { isoNow } from "../../../d1-store.js";
-async function syncUserMethod(identity) {
-  await this.ensureInitialized();
-  const nowIso = isoNow();
-  const existingIdentity = await this.loadIdentityByProvider(identity.provider, identity.providerSubject);
-  let userId = existingIdentity?.user_id;
-  if (!userId) {
-    const emailLinkedUser = identity.email && identity.emailVerified ? await this.loadUserByVerifiedEmail(identity.email) : null;
-    const usernameLinkedUser = !emailLinkedUser && identity.username ? await this.loadUserByUsername(identity.username) : null;
-    const linkedUser = emailLinkedUser ?? (this.canAdoptUsernameMatch(identity, usernameLinkedUser) ? usernameLinkedUser : null);
-    userId = linkedUser?.id ?? randomUUID();
-    if (linkedUser) {
-      await this.run(`UPDATE users
-					 SET email = COALESCE(?, email),
-					     username = COALESCE(username, ?),
-					     display_name = COALESCE(?, display_name),
-					     metadata_json = ?,
-					     updated_at = ?
-					 WHERE id = ?`, [
-        identity.email ?? null,
-        identity.username ?? null,
-        identity.displayName ?? null,
-        JSON.stringify(this.userMetadata(identity, linkedUser.username ?? null)),
-        nowIso,
-        userId
-      ]);
-    } else {
-      await this.run(`INSERT INTO users (id, email, username, display_name, status, metadata_json, created_at, updated_at)
-					 VALUES (?, ?, ?, ?, 'active', ?, ?, ?)`, [
-        userId,
-        identity.email ?? null,
-        identity.username ?? null,
-        identity.displayName ?? null,
-        JSON.stringify(this.userMetadata(identity)),
-        nowIso,
-        nowIso
-      ]);
-    }
-    await this.run(`INSERT INTO user_identities (id, user_id, provider, provider_subject, email, email_verified, profile_json, created_at, updated_at)
-				 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-      randomUUID(),
-      userId,
-      identity.provider,
-      identity.providerSubject,
-      identity.email ?? null,
-      identity.emailVerified ? 1 : 0,
-      JSON.stringify(identity.profile ?? {}),
-      nowIso,
-      nowIso
-    ]);
-  } else {
-    await this.run(`UPDATE users
-				 SET email = COALESCE(?, email),
-				     username = COALESCE(username, ?),
-				     display_name = COALESCE(?, display_name),
-				     metadata_json = ?,
-				     updated_at = ?
-				 WHERE id = ?`, [
-      identity.email ?? null,
-      identity.username ?? null,
-      identity.displayName ?? null,
-      JSON.stringify(this.userMetadata(identity)),
-      nowIso,
-      userId
-    ]);
-    await this.run(`UPDATE user_identities
-				 SET email = ?, email_verified = ?, profile_json = ?, updated_at = ?
-				 WHERE provider = ? AND provider_subject = ?`, [
-      identity.email ?? null,
-      identity.emailVerified ? 1 : 0,
-      JSON.stringify(identity.profile ?? {}),
-      nowIso,
-      identity.provider,
-      identity.providerSubject
-    ]);
-  }
-  await this.bootstrapRolesForUser(userId, identity);
-  await this.writeAuditEvent({
-    actorType: "service",
-    actorId: this.config.webServiceId,
-    eventType: "auth.user_synced",
-    targetType: "user",
-    targetId: userId,
-    data: { provider: identity.provider }
-  });
-  const principal = await this.principalForUser(userId);
-  const syncedIdentity = await this.loadIdentityByProvider(identity.provider, identity.providerSubject);
-  return {
-    ...principal,
-    identityId: syncedIdentity?.id ?? null
-  };
-}
-export {
-  syncUserMethod
-};

package/dist/api/auth/d1-store/support/principals/user-metadata.d.ts

@@ -1,9 +0,0 @@
-import type { UserIdentityProfileInput } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function userMetadataMethod(this: D1AuthStore, identity: UserIdentityProfileInput, existingUsername?: string | null): {
-    emailVerified: boolean;
-    authProvider: string;
-    username: string | null;
-    firstName: string | null;
-    lastName: string | null;
-};

package/dist/api/auth/d1-store/support/principals/user-metadata.js

@@ -1,13 +0,0 @@
-function userMetadataMethod(identity, existingUsername = null) {
-  const profile = identity.profile ?? {};
-  return {
-    emailVerified: identity.emailVerified ?? false,
-    authProvider: identity.provider,
-    username: identity.username ?? existingUsername,
-    firstName: typeof profile.firstName === "string" ? profile.firstName : null,
-    lastName: typeof profile.lastName === "string" ? profile.lastName : null
-  };
-}
-export {
-  userMetadataMethod
-};

package/dist/api/auth/d1-store/support/queries/execute-statement.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function runMethod(this: D1AuthStore, query: string, params?: unknown[]): Promise<void>;

package/dist/api/auth/d1-store/support/queries/execute-statement.js

@@ -1,6 +0,0 @@
-async function runMethod(query, params = []) {
-  await this.db.prepare(query).bind(...params).run();
-}
-export {
-  runMethod
-};

package/dist/api/auth/d1-store/support/queries/query-all.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function allMethod<T = Record<string, unknown>>(this: D1AuthStore, query: string, params?: unknown[]): Promise<T[]>;

package/dist/api/auth/d1-store/support/queries/query-all.js

@@ -1,7 +0,0 @@
-async function allMethod(query, params = []) {
-  const result = await this.db.prepare(query).bind(...params).all();
-  return result.results ?? [];
-}
-export {
-  allMethod
-};

package/dist/api/auth/d1-store/support/queries/query-first.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function firstMethod<T = Record<string, unknown>>(this: D1AuthStore, query: string, params?: unknown[]): Promise<T | null>;

package/dist/api/auth/d1-store/support/queries/query-first.js

@@ -1,6 +0,0 @@
-async function firstMethod(query, params = []) {
-  return this.db.prepare(query).bind(...params).first();
-}
-export {
-  firstMethod
-};

package/dist/api/auth/d1-store/teams/assign-role.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function assignRoleMethod(this: D1AuthStore, userId: string, roleKey: string): Promise<void>;

package/dist/api/auth/d1-store/teams/assign-role.js

@@ -1,12 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { isoNow } from "../../d1-store.js";
-async function assignRoleMethod(userId, roleKey) {
-  const role = await this.first(`SELECT id FROM roles WHERE key = ?`, [roleKey]);
-  if (!role)
-    return;
-  await this.run(`INSERT OR IGNORE INTO user_role_bindings (id, user_id, role_id, created_at)
-			 VALUES (?, ?, ?, ?)`, [randomUUID(), userId, role.id, isoNow()]);
-}
-export {
-  assignRoleMethod
-};

package/dist/api/auth/d1-store/teams/bootstrap-roles-for-user.d.ts

@@ -1,3 +0,0 @@
-import type { UserIdentityProfileInput } from "../../../types.js";
-import { D1AuthStore } from "../../d1-store.js";
-export declare function bootstrapRolesForUserMethod(this: D1AuthStore, userId: string, identity: UserIdentityProfileInput): Promise<void>;

package/dist/api/auth/d1-store/teams/bootstrap-roles-for-user.js

@@ -1,22 +0,0 @@
-async function bootstrapRolesForUserMethod(userId, identity) {
-  await this.assignRole(userId, "member");
-  if ((await this.rolesForUser(userId)).includes("platform_admin"))
-    return;
-  const allowlist = this.config.bootstrapAdminAllowlist;
-  const email = identity.email?.trim().toLowerCase() ?? "";
-  const providerSubject = `${identity.provider}:${identity.providerSubject}`;
-  if (allowlist.includes(email) || allowlist.includes(providerSubject)) {
-    await this.assignRole(userId, "platform_admin");
-    await this.writeAuditEvent({
-      actorType: "system",
-      actorId: null,
-      eventType: "auth.bootstrap_admin",
-      targetType: "user",
-      targetId: userId,
-      data: { matched: allowlist.includes(providerSubject) ? providerSubject : email }
-    });
-  }
-}
-export {
-  bootstrapRolesForUserMethod
-};

package/dist/api/auth/d1-store/teams/permissions-for-roles.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function permissionsForRolesMethod(this: D1AuthStore, roleKeys: string[]): Promise<any>;

package/dist/api/auth/d1-store/teams/permissions-for-roles.js

@@ -1,15 +0,0 @@
-async function permissionsForRolesMethod(roleKeys) {
-  if (roleKeys.length === 0) {
-    return [];
-  }
-  const placeholders = roleKeys.map(() => "?").join(", ");
-  const rows = await this.all(`SELECT DISTINCT permissions.key AS key
-			 FROM roles
-			 INNER JOIN role_permissions ON role_permissions.role_id = roles.id
-			 INNER JOIN permissions ON permissions.id = role_permissions.permission_id
-			 WHERE roles.key IN (${placeholders})`, roleKeys);
-  return rows.map((row) => row.key);
-}
-export {
-  permissionsForRolesMethod
-};

package/dist/api/auth/d1-store/teams/reconcile-bootstrap-admins.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from '../../d1-store.js';
-export declare function reconcileBootstrapAdminsMethod(this: D1AuthStore): Promise<void>;

package/dist/api/auth/d1-store/teams/reconcile-bootstrap-admins.js

@@ -1,34 +0,0 @@
-async function reconcileBootstrapAdminsMethod() {
-  const allowlist = this.config.bootstrapAdminAllowlist;
-  if (allowlist.length === 0) return;
-  const candidates = await this.all(
-    `SELECT users.id AS user_id,
-			users.email,
-			user_identities.provider,
-			user_identities.provider_subject
-		 FROM users
-		 LEFT JOIN user_identities ON user_identities.user_id = users.id`
-  );
-  const matches = /* @__PURE__ */ new Map();
-  for (const candidate of candidates) {
-    const email = candidate.email?.trim().toLowerCase() ?? "";
-    const providerSubject = candidate.provider && candidate.provider_subject ? `${candidate.provider}:${candidate.provider_subject}` : "";
-    const matched = allowlist.includes(providerSubject) ? providerSubject : email;
-    if (matched && allowlist.includes(matched)) matches.set(candidate.user_id, matched);
-  }
-  for (const [userId, matched] of matches) {
-    if ((await this.rolesForUser(userId)).includes("platform_admin")) continue;
-    await this.assignRole(userId, "platform_admin");
-    await this.writeAuditEvent({
-      actorType: "system",
-      actorId: null,
-      eventType: "auth.bootstrap_admin",
-      targetType: "user",
-      targetId: userId,
-      data: { matched }
-    });
-  }
-}
-export {
-  reconcileBootstrapAdminsMethod
-};

package/dist/api/auth/d1-store/teams/replace-roles.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function replaceRolesMethod(this: D1AuthStore, userId: string, roleKeys: string[]): Promise<void>;

package/dist/api/auth/d1-store/teams/replace-roles.js

@@ -1,9 +0,0 @@
-async function replaceRolesMethod(userId, roleKeys) {
-  await this.run(`DELETE FROM user_role_bindings WHERE user_id = ?`, [userId]);
-  for (const roleKey of roleKeys) {
-    await this.assignRole(userId, roleKey);
-  }
-}
-export {
-  replaceRolesMethod
-};

package/dist/api/auth/d1-store/teams/roles-for-user.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function rolesForUserMethod(this: D1AuthStore, userId: string): Promise<any>;

package/dist/api/auth/d1-store/teams/roles-for-user.js

@@ -1,10 +0,0 @@
-async function rolesForUserMethod(userId) {
-  const rows = await this.all(`SELECT roles.key AS key
-			 FROM user_role_bindings
-			 INNER JOIN roles ON roles.id = user_role_bindings.role_id
-			 WHERE user_role_bindings.user_id = ?`, [userId]);
-  return rows.map((row) => row.key);
-}
-export {
-  rolesForUserMethod
-};

package/dist/api/auth/d1-store/teams/set-user-roles.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function setUserRolesMethod(this: D1AuthStore, userId: string, roles: string[]): Promise<import("../../d1-store.js").PrincipalRecord>;

package/dist/api/auth/d1-store/teams/set-user-roles.js

@@ -1,25 +0,0 @@
-async function setUserRolesMethod(userId, roles) {
-  await this.ensureInitialized();
-  const requestedRoles = [...new Set(roles.map((role) => role.trim()).filter(Boolean))];
-  const currentRoles = await this.rolesForUser(userId);
-  if (currentRoles.includes("platform_admin") && !requestedRoles.includes("platform_admin")) {
-    const count = await this.first(`SELECT COUNT(DISTINCT bindings.user_id) AS count
-			FROM user_role_bindings bindings
-			INNER JOIN roles ON roles.id = bindings.role_id
-			WHERE roles.key = 'platform_admin'`);
-    if (Number(count?.count ?? 0) <= 1) throw new Error("The final platform administrator cannot be removed.");
-  }
-  await this.replaceRoles(userId, requestedRoles.length > 0 ? requestedRoles : ["member"]);
-  await this.writeAuditEvent({
-    actorType: "service",
-    actorId: this.config.webServiceId,
-    eventType: "auth.user_roles_set",
-    targetType: "user",
-    targetId: userId,
-    data: { roles: requestedRoles }
-  });
-  return this.principalForUser(userId);
-}
-export {
-  setUserRolesMethod
-};

package/dist/api/auth/d1-store.d.ts

@@ -1,133 +0,0 @@
-import type { D1DatabaseLike } from '../../types/cloudflare.js';
-import type { ApiConfig, ApiCredential, ApiPrincipal, DeviceCodeApproveRequest, DeviceCodePollRequest, DeviceCodePollResponse, DeviceCodeStartRequest, DeviceCodeStartResponse, TokenRefreshRequest, TokenRefreshResponse, TrustedUserAssertionClaims, UserIdentityProfileInput } from '../types.js';
-export declare function approvalUrl(baseUrl: string, userCode?: string | null): string;
-export declare const AUTH_SCHEMA_SQL: string[];
-export type DeviceCodeRow = {
-    id: string;
-    device_code: string;
-    user_code: string;
-    requested_scopes_json: string;
-    expires_at: string;
-    interval_seconds: number;
-    status: string;
-    user_id: string | null;
-};
-export type UserRow = {
-    id: string;
-    email: string | null;
-    username: string | null;
-    display_name: string | null;
-    status: string;
-    metadata_json: string | null;
-    created_at: string;
-    updated_at: string;
-};
-export type PrincipalRecord = {
-    principal: ApiPrincipal;
-    userId: string;
-};
-export interface PersonalAccessTokenResult {
-    id: string;
-    token: string;
-    prefix: string;
-    name: string;
-    expiresAt: string | null;
-}
-export interface ServiceCredentialResult {
-    id: string;
-    serviceId: string;
-    secret: string;
-}
-export declare function now(): Date;
-export declare function isoNow(): string;
-export declare function addSeconds(date: Date, seconds: number): Date;
-export declare function parseJson<T>(value: string | null | undefined, fallback: T): T;
-export declare function stableHash(value: string, secret: string): string;
-export declare function equalHash(left: string, right: string): boolean;
-export declare class D1AuthStore {
-    readonly config: ApiConfig;
-    readonly db: D1DatabaseLike;
-    initializationPromise: Promise<void> | null;
-    constructor(config: ApiConfig, db: D1DatabaseLike);
-}
-export interface D1AuthStore {
-    run(query: string, params?: unknown[]): any;
-    first<T = Record<string, unknown>>(query: string, params?: unknown[]): any;
-    all<T = Record<string, unknown>>(query: string, params?: unknown[]): any;
-    ensureInitialized(): any;
-    ensureAuthSchema(): any;
-    seedCatalog(): any;
-    seedConfiguredServices(): any;
-    loadUser(userId: string): any;
-    loadIdentityByProvider(provider: string, providerSubject: string): any;
-    loadUserByVerifiedEmail(email: string): any;
-    loadUserByUsername(username: string): any;
-    canAdoptUsernameMatch(identity: UserIdentityProfileInput, user: UserRow | null): any;
-    rolesForUser(userId: string): any;
-    permissionsForUser(userId: string): any;
-    permissionsForRoles(roleKeys: string[]): any;
-    scopesForPrincipal(permissions: string[]): any;
-    principalForUser(userId: string): Promise<PrincipalRecord>;
-    assignRole(userId: string, roleKey: string): any;
-    replaceRoles(userId: string, roleKeys: string[]): any;
-    bootstrapRolesForUser(userId: string, identity: UserIdentityProfileInput): any;
-    reconcileBootstrapAdmins(): Promise<void>;
-    writeAuditEvent(input: {
-        actorType: string;
-        actorId: string | null;
-        eventType: string;
-        targetType: string | null;
-        targetId: string | null;
-        data?: Record<string, unknown>;
-    }): any;
-    userMetadata(identity: UserIdentityProfileInput, existingUsername?: string | null): any;
-    syncUser(identity: UserIdentityProfileInput): any;
-    createUser(input: {
-        email?: string | null;
-        username?: string | null;
-        displayName?: string | null;
-        metadata?: Record<string, unknown>;
-    }): any;
-    setUserRoles(userId: string, roles: string[]): any;
-    startDeviceFlow(request: DeviceCodeStartRequest): Promise<DeviceCodeStartResponse>;
-    approveDeviceFlow(request: DeviceCodeApproveRequest): Promise<{
-        ok: true;
-    }>;
-    pollDeviceFlow(request: DeviceCodePollRequest): Promise<DeviceCodePollResponse>;
-    issueUserSession(userId: string, options?: {
-        sessionType?: string;
-        scopes?: string[];
-        data?: Record<string, unknown>;
-    }): Promise<TokenRefreshResponse>;
-    refreshAccessToken(request: TokenRefreshRequest): Promise<TokenRefreshResponse>;
-    createPersonalAccessToken(userId: string, input: {
-        name: string;
-        scopes?: string[];
-        expiresAt?: string | null;
-    }): any;
-    listPersonalAccessTokens(userId: string): any;
-    revokePersonalAccessToken(userId: string, tokenId: string): any;
-    upsertServiceCredential(input: {
-        serviceId: string;
-        name: string;
-        secret: string;
-        roles?: string[];
-        permissions?: string[];
-    }): any;
-    createServiceCredential(input: {
-        serviceId: string;
-        name: string;
-        roles?: string[];
-        permissions?: string[];
-    }): Promise<ServiceCredentialResult>;
-    rotateServiceCredential(serviceId: string): any;
-    authenticateBearerToken(token: string): Promise<{
-        principal: ApiPrincipal;
-        credential: ApiCredential;
-    } | null>;
-    authenticateService(serviceId: string, secret: string): Promise<{
-        principal: ApiPrincipal;
-        credential: ApiCredential;
-    } | null>;
-    exchangeTrustedUserAssertion(claims: TrustedUserAssertionClaims): any;
-}