@treeseed/sdk 0.13.0-rc.6 → 0.13.0-rc.8

package/dist/api/auth/d1-provider.js

@@ -1,95 +0,0 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { D1AuthStore } from "./d1-store.js";
-function encodePayload(payload) {
-  return Buffer.from(JSON.stringify(payload)).toString("base64url");
-}
-function decodePayload(value) {
-  return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-}
-function signPayload(payload, secret) {
-  return createHmac("sha256", secret).update(payload).digest("base64url");
-}
-function safeEqual(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
-}
-class D1AuthProvider {
-  constructor(config, options = {}) {
-    this.config = config;
-    if (!options.db) {
-      throw new Error("D1AuthProvider requires an explicit database binding or adapter.");
-    }
-    this.store = new D1AuthStore(config, options.db);
-  }
-  config;
-  id = "d1";
-  store;
-  startDeviceFlow(request) {
-    return this.store.startDeviceFlow(request);
-  }
-  pollDeviceFlow(request) {
-    return this.store.pollDeviceFlow(request);
-  }
-  refreshAccessToken(request) {
-    return this.store.refreshAccessToken(request);
-  }
-  issueUserSession(userId, options = {}) {
-    return this.store.issueUserSession(userId, options);
-  }
-  approveDeviceFlow(request) {
-    return this.store.approveDeviceFlow(request);
-  }
-  authenticateBearerToken(token) {
-    return this.store.authenticateBearerToken(token);
-  }
-  authenticateServiceCredential(serviceId, secret) {
-    return this.store.authenticateService(serviceId, secret);
-  }
-  createPersonalAccessToken(userId, input) {
-    return this.store.createPersonalAccessToken(userId, input);
-  }
-  listPersonalAccessTokens(userId) {
-    return this.store.listPersonalAccessTokens(userId);
-  }
-  revokePersonalAccessToken(userId, tokenId) {
-    return this.store.revokePersonalAccessToken(userId, tokenId);
-  }
-  syncUserIdentity(identity) {
-    return this.store.syncUser(identity);
-  }
-  createUser(input) {
-    return this.store.createUser(input);
-  }
-  setUserRoles(userId, roles) {
-    return this.store.setUserRoles(userId, roles);
-  }
-  createServiceToken(input) {
-    return this.store.createServiceCredential(input);
-  }
-  rotateServiceToken(serviceId) {
-    return this.store.rotateServiceCredential(serviceId);
-  }
-  createTrustedUserAssertion(claims) {
-    const payload = encodePayload(claims);
-    const signature = signPayload(payload, this.config.webAssertionSecret);
-    return `${payload}.${signature}`;
-  }
-  verifyTrustedUserAssertion(assertion) {
-    const [payload, signature] = assertion.split(".");
-    if (!payload || !signature) return null;
-    const expectedSignature = signPayload(payload, this.config.webAssertionSecret);
-    if (!safeEqual(signature, expectedSignature)) return null;
-    const claims = decodePayload(payload);
-    if (!claims.expiresAt || new Date(claims.expiresAt).getTime() <= Date.now()) {
-      return null;
-    }
-    return claims;
-  }
-  exchangeTrustedUserAssertion(claims) {
-    return this.store.exchangeTrustedUserAssertion(claims);
-  }
-}
-export {
-  D1AuthProvider
-};

package/dist/api/auth/d1-store/accounts/identity/can-adopt-username-match.d.ts

@@ -1,3 +0,0 @@
-import type { UserIdentityProfileInput } from "../../../../types.js";
-import { D1AuthStore, UserRow } from "../../../d1-store.js";
-export declare function canAdoptUsernameMatchMethod(this: D1AuthStore, identity: UserIdentityProfileInput, user: UserRow | null): boolean;

package/dist/api/auth/d1-store/accounts/identity/can-adopt-username-match.js

@@ -1,13 +0,0 @@
-function canAdoptUsernameMatchMethod(identity, user) {
-  if (!user?.id || !identity.username)
-    return false;
-  const profile = identity.profile && typeof identity.profile === "object" ? identity.profile : {};
-  if (identity.provider === "acceptance" || profile.acceptance === true)
-    return true;
-  const existingEmail = typeof user.email === "string" ? user.email.trim().toLowerCase() : "";
-  const requestedEmail = typeof identity.email === "string" ? identity.email.trim().toLowerCase() : "";
-  return Boolean(requestedEmail && existingEmail && requestedEmail === existingEmail && identity.emailVerified);
-}
-export {
-  canAdoptUsernameMatchMethod
-};

package/dist/api/auth/d1-store/accounts/identity/ensure-auth-schema.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function ensureAuthSchemaMethod(this: D1AuthStore): Promise<void>;

package/dist/api/auth/d1-store/accounts/identity/ensure-auth-schema.js

@@ -1,14 +0,0 @@
-import { AUTH_SCHEMA_SQL } from "../../../d1-store.js";
-async function ensureAuthSchemaMethod() {
-  for (const statement of AUTH_SCHEMA_SQL)
-    await this.run(statement);
-  const result = await this.db.prepare("PRAGMA table_info(users)").all();
-  const columns = new Set((result.results ?? []).map((row) => row.name));
-  if (!columns.has("username")) {
-    await this.run("ALTER TABLE users ADD COLUMN username TEXT");
-  }
-  await this.run("CREATE UNIQUE INDEX IF NOT EXISTS idx_users_username ON users(username)");
-}
-export {
-  ensureAuthSchemaMethod
-};

package/dist/api/auth/d1-store/accounts/identity/load-user-by-username.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function loadUserByUsernameMethod(this: D1AuthStore, username: string): Promise<any>;

package/dist/api/auth/d1-store/accounts/identity/load-user-by-username.js

@@ -1,6 +0,0 @@
-async function loadUserByUsernameMethod(username) {
-  return this.first(`SELECT * FROM users WHERE LOWER(username) = LOWER(?) AND status = 'active' LIMIT 1`, [username]);
-}
-export {
-  loadUserByUsernameMethod
-};

package/dist/api/auth/d1-store/accounts/identity/load-user-by-verified-email.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function loadUserByVerifiedEmailMethod(this: D1AuthStore, email: string): Promise<any>;

package/dist/api/auth/d1-store/accounts/identity/load-user-by-verified-email.js

@@ -1,6 +0,0 @@
-async function loadUserByVerifiedEmailMethod(email) {
-  return this.first(`SELECT * FROM users WHERE LOWER(email) = LOWER(?) AND status = 'active' LIMIT 1`, [email]);
-}
-export {
-  loadUserByVerifiedEmailMethod
-};

package/dist/api/auth/d1-store/accounts/sessions/authenticate-service.d.ts

@@ -1,6 +0,0 @@
-import type { ApiCredential, ApiPrincipal } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function authenticateServiceMethod(this: D1AuthStore, serviceId: string, secret: string): Promise<{
-    principal: ApiPrincipal;
-    credential: ApiCredential;
-} | null>;

package/dist/api/auth/d1-store/accounts/sessions/authenticate-service.js

@@ -1,34 +0,0 @@
-import { equalHash, isoNow, parseJson, stableHash } from "../../../d1-store.js";
-async function authenticateServiceMethod(serviceId, secret) {
-  await this.ensureInitialized();
-  const row = await this.first(`SELECT id, name, secret_hash, roles_json, permissions_json, revoked_at
-			 FROM service_credentials
-			 WHERE service_id = ?`, [serviceId]);
-  if (!row || row.revoked_at)
-    return null;
-  const incomingHash = stableHash(secret, this.config.authSecret);
-  if (!equalHash(row.secret_hash, incomingHash))
-    return null;
-  await this.run(`UPDATE service_credentials SET last_used_at = ?, updated_at = ? WHERE id = ?`, [isoNow(), isoNow(), row.id]);
-  const roles = parseJson(row.roles_json, []);
-  const permissions = [
-    .../* @__PURE__ */ new Set([
-      ...await this.permissionsForRoles(roles),
-      ...parseJson(row.permissions_json, [])
-    ])
-  ];
-  return {
-    principal: {
-      id: serviceId,
-      displayName: row.name,
-      roles,
-      permissions,
-      scopes: this.scopesForPrincipal(permissions),
-      metadata: { serviceId }
-    },
-    credential: { type: "service_secret", id: row.id, label: row.name }
-  };
-}
-export {
-  authenticateServiceMethod
-};

package/dist/api/auth/d1-store/accounts/sessions/issue-user-session.d.ts

@@ -1,7 +0,0 @@
-import type { TokenRefreshResponse } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function issueUserSessionMethod(this: D1AuthStore, userId: string, options?: {
-    sessionType?: string;
-    scopes?: string[];
-    data?: Record<string, unknown>;
-}): Promise<TokenRefreshResponse>;

package/dist/api/auth/d1-store/accounts/sessions/issue-user-session.js

@@ -1,69 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { addSeconds, isoNow, now, stableHash } from "../../../d1-store.js";
-import { createAccessToken, nextOpaqueToken } from "../../../tokens.js";
-async function issueUserSessionMethod(userId, options = {}) {
-  await this.ensureInitialized();
-  const principalRecord = await this.principalForUser(userId);
-  const refreshToken = nextOpaqueToken("refresh");
-  const sessionId = randomUUID();
-  const refreshTokenHash = stableHash(refreshToken, this.config.authSecret);
-  const expiresAt = addSeconds(now(), this.config.accessTokenTtlSeconds);
-  const refreshExpiresAt = addSeconds(now(), this.config.refreshTokenTtlSeconds);
-  const requestedScopes = options.scopes && options.scopes.length > 0 ? [...new Set(options.scopes)] : principalRecord.principal.scopes;
-  await this.run(`INSERT INTO auth_sessions (id, user_id, session_type, refresh_token_hash, scopes_json, expires_at, revoked_at, data_json, created_at, updated_at)
-			 VALUES (?, ?, ?, ?, ?, ?, NULL, ?, ?, ?)`, [
-    sessionId,
-    userId,
-    options.sessionType?.trim() || "web",
-    refreshTokenHash,
-    JSON.stringify(requestedScopes),
-    refreshExpiresAt.toISOString(),
-    JSON.stringify(options.data ?? {}),
-    isoNow(),
-    isoNow()
-  ]);
-  const accessToken = createAccessToken({
-    sub: principalRecord.principal.id,
-    displayName: principalRecord.principal.displayName,
-    scopes: requestedScopes,
-    roles: principalRecord.principal.roles,
-    permissions: principalRecord.principal.permissions,
-    metadata: {
-      ...principalRecord.principal.metadata,
-      sessionId
-    },
-    iat: Math.floor(Date.now() / 1e3),
-    exp: Math.floor(expiresAt.getTime() / 1e3),
-    iss: this.config.issuer,
-    jti: randomUUID(),
-    tokenType: "access"
-  }, this.config.authSecret);
-  await this.writeAuditEvent({
-    actorType: "user",
-    actorId: userId,
-    eventType: "auth.session_issued",
-    targetType: "auth_session",
-    targetId: sessionId,
-    data: { sessionType: options.sessionType ?? "web" }
-  });
-  return {
-    ok: true,
-    status: "approved",
-    accessToken,
-    refreshToken,
-    tokenType: "Bearer",
-    expiresAt: expiresAt.toISOString(),
-    expiresInSeconds: this.config.accessTokenTtlSeconds,
-    principal: {
-      ...principalRecord.principal,
-      scopes: requestedScopes,
-      metadata: {
-        ...principalRecord.principal.metadata ?? {},
-        sessionId
-      }
-    }
-  };
-}
-export {
-  issueUserSessionMethod
-};

package/dist/api/auth/d1-store/accounts/tokens/authenticate-bearer-token.d.ts

@@ -1,6 +0,0 @@
-import type { ApiCredential, ApiPrincipal } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function authenticateBearerTokenMethod(this: D1AuthStore, token: string): Promise<{
-    principal: ApiPrincipal;
-    credential: ApiCredential;
-} | null>;

package/dist/api/auth/d1-store/accounts/tokens/authenticate-bearer-token.js

@@ -1,42 +0,0 @@
-import { isoNow, parseJson, stableHash } from "../../../d1-store.js";
-import { principalFromAccessTokenPayload, verifyAccessToken } from "../../../tokens.js";
-async function authenticateBearerTokenMethod(token) {
-  await this.ensureInitialized();
-  const patHash = stableHash(token, this.config.authSecret);
-  const pat = await this.first(`SELECT id, user_id, name, scopes_json, expires_at, revoked_at
-			 FROM api_tokens
-			 WHERE token_hash = ?`, [patHash]);
-  if (pat && !pat.revoked_at && (!pat.expires_at || new Date(pat.expires_at).getTime() > Date.now())) {
-    await this.run(`UPDATE api_tokens SET last_used_at = ? WHERE id = ?`, [isoNow(), pat.id]);
-    const principal = (await this.principalForUser(pat.user_id)).principal;
-    return {
-      principal: { ...principal, scopes: parseJson(pat.scopes_json, principal.scopes) },
-      credential: { type: "personal_access_token", id: pat.id, label: pat.name }
-    };
-  }
-  const payload = verifyAccessToken(token, this.config.authSecret);
-  if (!payload)
-    return null;
-  const sessionId = typeof payload.metadata?.sessionId === "string" ? payload.metadata.sessionId.trim() : "";
-  if (sessionId) {
-    const session = await this.first(`SELECT id, user_id, expires_at, revoked_at
-				 FROM auth_sessions
-				 WHERE id = ?`, [sessionId]);
-    const sessionExpiresAt = session ? new Date(session.expires_at).getTime() : 0;
-    if (!session || session.user_id !== payload.sub || session.revoked_at || !Number.isFinite(sessionExpiresAt) || sessionExpiresAt <= Date.now()) {
-      return null;
-    }
-    await this.run(`UPDATE auth_sessions SET updated_at = ? WHERE id = ?`, [isoNow(), session.id]);
-  }
-  return {
-    principal: principalFromAccessTokenPayload(payload),
-    credential: {
-      type: payload.tokenType === "service" ? "service_token" : "access_token",
-      id: payload.jti,
-      label: payload.tokenType
-    }
-  };
-}
-export {
-  authenticateBearerTokenMethod
-};

package/dist/api/auth/d1-store/accounts/tokens/create-personal-access-token.d.ts

@@ -1,12 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function createPersonalAccessTokenMethod(this: D1AuthStore, userId: string, input: {
-    name: string;
-    scopes?: string[];
-    expiresAt?: string | null;
-}): Promise<{
-    id: `${string}-${string}-${string}-${string}-${string}`;
-    token: string;
-    prefix: string;
-    name: string;
-    expiresAt: string | null;
-}>;

package/dist/api/auth/d1-store/accounts/tokens/create-personal-access-token.js

@@ -1,36 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { isoNow, stableHash } from "../../../d1-store.js";
-import { nextOpaqueToken } from "../../../tokens.js";
-async function createPersonalAccessTokenMethod(userId, input) {
-  await this.ensureInitialized();
-  const nowIso = isoNow();
-  const token = nextOpaqueToken("pat");
-  const id = randomUUID();
-  const tokenHash = stableHash(token, this.config.authSecret);
-  const prefix = token.slice(0, 12);
-  await this.run(`INSERT INTO api_tokens (id, user_id, kind, name, token_prefix, token_hash, scopes_json, expires_at, last_used_at, revoked_at, metadata_json, created_at, updated_at)
-			 VALUES (?, ?, 'personal_access_token', ?, ?, ?, ?, ?, NULL, NULL, ?, ?, ?)`, [
-    id,
-    userId,
-    input.name,
-    prefix,
-    tokenHash,
-    JSON.stringify(input.scopes?.length ? input.scopes : ["auth:me"]),
-    input.expiresAt ?? null,
-    JSON.stringify({}),
-    nowIso,
-    nowIso
-  ]);
-  await this.writeAuditEvent({
-    actorType: "user",
-    actorId: userId,
-    eventType: "auth.pat_created",
-    targetType: "api_token",
-    targetId: id,
-    data: { name: input.name }
-  });
-  return { id, token, prefix, name: input.name, expiresAt: input.expiresAt ?? null };
-}
-export {
-  createPersonalAccessTokenMethod
-};

package/dist/api/auth/d1-store/accounts/tokens/list-personal-access-tokens.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function listPersonalAccessTokensMethod(this: D1AuthStore, userId: string): Promise<any>;

package/dist/api/auth/d1-store/accounts/tokens/list-personal-access-tokens.js

@@ -1,10 +0,0 @@
-async function listPersonalAccessTokensMethod(userId) {
-  await this.ensureInitialized();
-  return this.all(`SELECT id, name, token_prefix, expires_at, last_used_at, revoked_at, created_at
-			 FROM api_tokens
-			 WHERE user_id = ?
-			 ORDER BY created_at DESC`, [userId]);
-}
-export {
-  listPersonalAccessTokensMethod
-};

package/dist/api/auth/d1-store/accounts/tokens/refresh-access-token.d.ts

@@ -1,3 +0,0 @@
-import type { TokenRefreshRequest, TokenRefreshResponse } from "../../../../types.js";
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function refreshAccessTokenMethod(this: D1AuthStore, request: TokenRefreshRequest): Promise<TokenRefreshResponse>;

package/dist/api/auth/d1-store/accounts/tokens/refresh-access-token.js

@@ -1,46 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { addSeconds, isoNow, now, parseJson, stableHash } from "../../../d1-store.js";
-import { createAccessToken, nextOpaqueToken } from "../../../tokens.js";
-async function refreshAccessTokenMethod(request) {
-  await this.ensureInitialized();
-  const refreshHash = stableHash(request.refreshToken, this.config.authSecret);
-  const row = await this.first(`SELECT * FROM auth_sessions WHERE refresh_token_hash = ? AND revoked_at IS NULL`, [refreshHash]);
-  if (!row || new Date(row.expires_at).getTime() <= Date.now()) {
-    throw new Error("Refresh token is invalid or expired.");
-  }
-  const principalRecord = await this.principalForUser(row.user_id);
-  const nextRefreshToken = nextOpaqueToken("refresh");
-  const nextRefreshHash = stableHash(nextRefreshToken, this.config.authSecret);
-  const nextRefreshExpiresAt = addSeconds(now(), this.config.refreshTokenTtlSeconds);
-  await this.run(`UPDATE auth_sessions SET refresh_token_hash = ?, expires_at = ?, updated_at = ? WHERE id = ?`, [nextRefreshHash, nextRefreshExpiresAt.toISOString(), isoNow(), row.id]);
-  const requestedScopes = parseJson(row.scopes_json, principalRecord.principal.scopes);
-  const expiresAt = addSeconds(now(), this.config.accessTokenTtlSeconds);
-  const accessToken = createAccessToken({
-    sub: principalRecord.principal.id,
-    displayName: principalRecord.principal.displayName,
-    scopes: requestedScopes,
-    roles: principalRecord.principal.roles,
-    permissions: principalRecord.principal.permissions,
-    metadata: principalRecord.principal.metadata,
-    iat: Math.floor(Date.now() / 1e3),
-    exp: Math.floor(expiresAt.getTime() / 1e3),
-    iss: this.config.issuer,
-    jti: randomUUID(),
-    tokenType: "access"
-  }, this.config.authSecret);
-  return {
-    ok: true,
-    accessToken,
-    refreshToken: nextRefreshToken,
-    tokenType: "Bearer",
-    expiresAt: expiresAt.toISOString(),
-    expiresInSeconds: this.config.accessTokenTtlSeconds,
-    principal: {
-      ...principalRecord.principal,
-      scopes: requestedScopes
-    }
-  };
-}
-export {
-  refreshAccessTokenMethod
-};

package/dist/api/auth/d1-store/accounts/tokens/revoke-personal-access-token.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function revokePersonalAccessTokenMethod(this: D1AuthStore, userId: string, tokenId: string): Promise<void>;

package/dist/api/auth/d1-store/accounts/tokens/revoke-personal-access-token.js

@@ -1,15 +0,0 @@
-import { isoNow } from "../../../d1-store.js";
-async function revokePersonalAccessTokenMethod(userId, tokenId) {
-  await this.ensureInitialized();
-  await this.run(`UPDATE api_tokens SET revoked_at = ? WHERE id = ? AND user_id = ?`, [isoNow(), tokenId, userId]);
-  await this.writeAuditEvent({
-    actorType: "user",
-    actorId: userId,
-    eventType: "auth.pat_revoked",
-    targetType: "api_token",
-    targetId: tokenId
-  });
-}
-export {
-  revokePersonalAccessTokenMethod
-};

package/dist/api/auth/d1-store/capacity/providers/load-identity-by-provider.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function loadIdentityByProviderMethod(this: D1AuthStore, provider: string, providerSubject: string): Promise<any>;

package/dist/api/auth/d1-store/capacity/providers/load-identity-by-provider.js

@@ -1,6 +0,0 @@
-async function loadIdentityByProviderMethod(provider, providerSubject) {
-  return this.first(`SELECT * FROM user_identities WHERE provider = ? AND provider_subject = ?`, [provider, providerSubject]);
-}
-export {
-  loadIdentityByProviderMethod
-};

package/dist/api/auth/d1-store/commerce/catalog/seed-catalog.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../../d1-store.js";
-export declare function seedCatalogMethod(this: D1AuthStore): Promise<void>;

package/dist/api/auth/d1-store/commerce/catalog/seed-catalog.js

@@ -1,27 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { isoNow } from "../../../d1-store.js";
-import { DEFAULT_PERMISSIONS, DEFAULT_ROLES } from "../../../rbac.js";
-async function seedCatalogMethod() {
-  const createdAt = isoNow();
-  for (const permission of DEFAULT_PERMISSIONS) {
-    await this.run(`INSERT OR IGNORE INTO permissions (id, key, resource, action, scope, description, created_at)
-				 VALUES (?, ?, ?, ?, ?, ?, ?)`, [randomUUID(), permission.key, permission.resource, permission.action, permission.scope, permission.description, createdAt]);
-  }
-  for (const role of DEFAULT_ROLES) {
-    await this.run(`INSERT OR IGNORE INTO roles (id, key, description, created_at)
-				 VALUES (?, ?, ?, ?)`, [randomUUID(), role.key, role.description, createdAt]);
-    const roleRow = await this.first(`SELECT id FROM roles WHERE key = ?`, [role.key]);
-    if (!roleRow)
-      continue;
-    for (const permissionKey of role.permissions) {
-      const permissionRow = await this.first(`SELECT id FROM permissions WHERE key = ?`, [permissionKey]);
-      if (permissionRow) {
-        await this.run(`INSERT OR IGNORE INTO role_permissions (role_id, permission_id, created_at)
-						 VALUES (?, ?, ?)`, [roleRow.id, permissionRow.id, createdAt]);
-      }
-    }
-  }
-}
-export {
-  seedCatalogMethod
-};

package/dist/api/auth/d1-store/configuration/create-service-credential.d.ts

@@ -1,7 +0,0 @@
-import { D1AuthStore, ServiceCredentialResult } from "../../d1-store.js";
-export declare function createServiceCredentialMethod(this: D1AuthStore, input: {
-    serviceId: string;
-    name: string;
-    roles?: string[];
-    permissions?: string[];
-}): Promise<ServiceCredentialResult>;

package/dist/api/auth/d1-store/configuration/create-service-credential.js

@@ -1,10 +0,0 @@
-import { nextOpaqueToken } from "../../tokens.js";
-async function createServiceCredentialMethod(input) {
-  await this.ensureInitialized();
-  const secret = nextOpaqueToken("svc");
-  const id = await this.upsertServiceCredential({ ...input, secret });
-  return { id, serviceId: input.serviceId, secret };
-}
-export {
-  createServiceCredentialMethod
-};

package/dist/api/auth/d1-store/configuration/rotate-service-credential.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function rotateServiceCredentialMethod(this: D1AuthStore, serviceId: string): Promise<import("../../d1-store.js").ServiceCredentialResult>;

package/dist/api/auth/d1-store/configuration/rotate-service-credential.js

@@ -1,17 +0,0 @@
-import { parseJson } from "../../d1-store.js";
-async function rotateServiceCredentialMethod(serviceId) {
-  await this.ensureInitialized();
-  const row = await this.first(`SELECT name, roles_json, permissions_json FROM service_credentials WHERE service_id = ? AND revoked_at IS NULL`, [serviceId]);
-  if (!row) {
-    throw new Error(`Unknown active service credential "${serviceId}".`);
-  }
-  return this.createServiceCredential({
-    serviceId,
-    name: row.name,
-    roles: parseJson(row.roles_json, []),
-    permissions: parseJson(row.permissions_json, [])
-  });
-}
-export {
-  rotateServiceCredentialMethod
-};

package/dist/api/auth/d1-store/configuration/upsert-service-credential.d.ts

@@ -1,8 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function upsertServiceCredentialMethod(this: D1AuthStore, input: {
-    serviceId: string;
-    name: string;
-    secret: string;
-    roles?: string[];
-    permissions?: string[];
-}): Promise<any>;

package/dist/api/auth/d1-store/configuration/upsert-service-credential.js

@@ -1,20 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { isoNow, stableHash } from "../../d1-store.js";
-async function upsertServiceCredentialMethod(input) {
-  const nowIso = isoNow();
-  const existing = await this.first(`SELECT id FROM service_credentials WHERE service_id = ?`, [input.serviceId]);
-  const secretHash = stableHash(input.secret, this.config.authSecret);
-  if (existing) {
-    await this.run(`UPDATE service_credentials
-				 SET name = ?, secret_hash = ?, roles_json = ?, permissions_json = ?, revoked_at = NULL, updated_at = ?
-				 WHERE id = ?`, [input.name, secretHash, JSON.stringify(input.roles ?? []), JSON.stringify(input.permissions ?? []), nowIso, existing.id]);
-    return existing.id;
-  }
-  const id = randomUUID();
-  await this.run(`INSERT INTO service_credentials (id, service_id, name, secret_hash, roles_json, permissions_json, revoked_at, last_used_at, created_at, updated_at)
-			 VALUES (?, ?, ?, ?, ?, ?, NULL, NULL, ?, ?)`, [id, input.serviceId, input.name, secretHash, JSON.stringify(input.roles ?? []), JSON.stringify(input.permissions ?? []), nowIso, nowIso]);
-  return id;
-}
-export {
-  upsertServiceCredentialMethod
-};

package/dist/api/auth/d1-store/methods.d.ts

@@ -1,40 +0,0 @@
-export { canAdoptUsernameMatchMethod } from './accounts/identity/can-adopt-username-match.js';
-export { ensureAuthSchemaMethod } from './accounts/identity/ensure-auth-schema.js';
-export { loadUserByUsernameMethod } from './accounts/identity/load-user-by-username.js';
-export { loadUserByVerifiedEmailMethod } from './accounts/identity/load-user-by-verified-email.js';
-export { authenticateServiceMethod } from './accounts/sessions/authenticate-service.js';
-export { issueUserSessionMethod } from './accounts/sessions/issue-user-session.js';
-export { authenticateBearerTokenMethod } from './accounts/tokens/authenticate-bearer-token.js';
-export { createPersonalAccessTokenMethod } from './accounts/tokens/create-personal-access-token.js';
-export { listPersonalAccessTokensMethod } from './accounts/tokens/list-personal-access-tokens.js';
-export { refreshAccessTokenMethod } from './accounts/tokens/refresh-access-token.js';
-export { revokePersonalAccessTokenMethod } from './accounts/tokens/revoke-personal-access-token.js';
-export { loadIdentityByProviderMethod } from './capacity/providers/load-identity-by-provider.js';
-export { seedCatalogMethod } from './commerce/catalog/seed-catalog.js';
-export { createServiceCredentialMethod } from './configuration/create-service-credential.js';
-export { rotateServiceCredentialMethod } from './configuration/rotate-service-credential.js';
-export { upsertServiceCredentialMethod } from './configuration/upsert-service-credential.js';
-export { approveDeviceFlowMethod } from './runtime/approve-device-flow.js';
-export { pollDeviceFlowMethod } from './runtime/poll-device-flow.js';
-export { startDeviceFlowMethod } from './runtime/start-device-flow.js';
-export { seedConfiguredServicesMethod } from './seeds/seed-configured-services.js';
-export { writeAuditEventMethod } from './support/audit/write-audit-event.js';
-export { ensureInitializedMethod } from './support/lifecycle/ensure-initialized.js';
-export { createUserMethod } from './support/principals/create-user.js';
-export { exchangeTrustedUserAssertionMethod } from './support/principals/exchange-trusted-user-assertion.js';
-export { loadUserMethod } from './support/principals/load-user.js';
-export { permissionsForUserMethod } from './support/principals/permissions-for-user.js';
-export { principalForUserMethod } from './support/principals/principal-for-user.js';
-export { scopesForPrincipalMethod } from './support/principals/scopes-for-principal.js';
-export { syncUserMethod } from './support/principals/sync-user.js';
-export { userMetadataMethod } from './support/principals/user-metadata.js';
-export { runMethod } from './support/queries/execute-statement.js';
-export { allMethod } from './support/queries/query-all.js';
-export { firstMethod } from './support/queries/query-first.js';
-export { assignRoleMethod } from './teams/assign-role.js';
-export { bootstrapRolesForUserMethod } from './teams/bootstrap-roles-for-user.js';
-export { reconcileBootstrapAdminsMethod } from './teams/reconcile-bootstrap-admins.js';
-export { permissionsForRolesMethod } from './teams/permissions-for-roles.js';
-export { replaceRolesMethod } from './teams/replace-roles.js';
-export { rolesForUserMethod } from './teams/roles-for-user.js';
-export { setUserRolesMethod } from './teams/set-user-roles.js';