@treeseed/sdk 0.13.0-rc.6 → 0.13.0-rc.8

package/dist/api/auth/d1-store/teams/assign-role.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function assignRoleMethod(this: D1AuthStore, userId: string, roleKey: string): Promise<void>;

package/dist/api/auth/d1-store/teams/assign-role.js

@@ -1,12 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { isoNow } from "../../d1-store.js";
-async function assignRoleMethod(userId, roleKey) {
-  const role = await this.first(`SELECT id FROM roles WHERE key = ?`, [roleKey]);
-  if (!role)
-    return;
-  await this.run(`INSERT OR IGNORE INTO user_role_bindings (id, user_id, role_id, created_at)
-			 VALUES (?, ?, ?, ?)`, [randomUUID(), userId, role.id, isoNow()]);
-}
-export {
-  assignRoleMethod
-};

package/dist/api/auth/d1-store/teams/bootstrap-roles-for-user.d.ts

@@ -1,3 +0,0 @@
-import type { UserIdentityProfileInput } from "../../../types.js";
-import { D1AuthStore } from "../../d1-store.js";
-export declare function bootstrapRolesForUserMethod(this: D1AuthStore, userId: string, identity: UserIdentityProfileInput): Promise<void>;

package/dist/api/auth/d1-store/teams/bootstrap-roles-for-user.js

@@ -1,22 +0,0 @@
-async function bootstrapRolesForUserMethod(userId, identity) {
-  await this.assignRole(userId, "member");
-  if ((await this.rolesForUser(userId)).includes("platform_admin"))
-    return;
-  const allowlist = this.config.bootstrapAdminAllowlist;
-  const email = identity.email?.trim().toLowerCase() ?? "";
-  const providerSubject = `${identity.provider}:${identity.providerSubject}`;
-  if (allowlist.includes(email) || allowlist.includes(providerSubject)) {
-    await this.assignRole(userId, "platform_admin");
-    await this.writeAuditEvent({
-      actorType: "system",
-      actorId: null,
-      eventType: "auth.bootstrap_admin",
-      targetType: "user",
-      targetId: userId,
-      data: { matched: allowlist.includes(providerSubject) ? providerSubject : email }
-    });
-  }
-}
-export {
-  bootstrapRolesForUserMethod
-};

package/dist/api/auth/d1-store/teams/permissions-for-roles.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function permissionsForRolesMethod(this: D1AuthStore, roleKeys: string[]): Promise<any>;

package/dist/api/auth/d1-store/teams/permissions-for-roles.js

@@ -1,15 +0,0 @@
-async function permissionsForRolesMethod(roleKeys) {
-  if (roleKeys.length === 0) {
-    return [];
-  }
-  const placeholders = roleKeys.map(() => "?").join(", ");
-  const rows = await this.all(`SELECT DISTINCT permissions.key AS key
-			 FROM roles
-			 INNER JOIN role_permissions ON role_permissions.role_id = roles.id
-			 INNER JOIN permissions ON permissions.id = role_permissions.permission_id
-			 WHERE roles.key IN (${placeholders})`, roleKeys);
-  return rows.map((row) => row.key);
-}
-export {
-  permissionsForRolesMethod
-};

package/dist/api/auth/d1-store/teams/reconcile-bootstrap-admins.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from '../../d1-store.js';
-export declare function reconcileBootstrapAdminsMethod(this: D1AuthStore): Promise<void>;

package/dist/api/auth/d1-store/teams/reconcile-bootstrap-admins.js

@@ -1,34 +0,0 @@
-async function reconcileBootstrapAdminsMethod() {
-  const allowlist = this.config.bootstrapAdminAllowlist;
-  if (allowlist.length === 0) return;
-  const candidates = await this.all(
-    `SELECT users.id AS user_id,
-			users.email,
-			user_identities.provider,
-			user_identities.provider_subject
-		 FROM users
-		 LEFT JOIN user_identities ON user_identities.user_id = users.id`
-  );
-  const matches = /* @__PURE__ */ new Map();
-  for (const candidate of candidates) {
-    const email = candidate.email?.trim().toLowerCase() ?? "";
-    const providerSubject = candidate.provider && candidate.provider_subject ? `${candidate.provider}:${candidate.provider_subject}` : "";
-    const matched = allowlist.includes(providerSubject) ? providerSubject : email;
-    if (matched && allowlist.includes(matched)) matches.set(candidate.user_id, matched);
-  }
-  for (const [userId, matched] of matches) {
-    if ((await this.rolesForUser(userId)).includes("platform_admin")) continue;
-    await this.assignRole(userId, "platform_admin");
-    await this.writeAuditEvent({
-      actorType: "system",
-      actorId: null,
-      eventType: "auth.bootstrap_admin",
-      targetType: "user",
-      targetId: userId,
-      data: { matched }
-    });
-  }
-}
-export {
-  reconcileBootstrapAdminsMethod
-};

package/dist/api/auth/d1-store/teams/replace-roles.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function replaceRolesMethod(this: D1AuthStore, userId: string, roleKeys: string[]): Promise<void>;

package/dist/api/auth/d1-store/teams/replace-roles.js

@@ -1,9 +0,0 @@
-async function replaceRolesMethod(userId, roleKeys) {
-  await this.run(`DELETE FROM user_role_bindings WHERE user_id = ?`, [userId]);
-  for (const roleKey of roleKeys) {
-    await this.assignRole(userId, roleKey);
-  }
-}
-export {
-  replaceRolesMethod
-};

package/dist/api/auth/d1-store/teams/roles-for-user.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function rolesForUserMethod(this: D1AuthStore, userId: string): Promise<any>;

package/dist/api/auth/d1-store/teams/roles-for-user.js

@@ -1,10 +0,0 @@
-async function rolesForUserMethod(userId) {
-  const rows = await this.all(`SELECT roles.key AS key
-			 FROM user_role_bindings
-			 INNER JOIN roles ON roles.id = user_role_bindings.role_id
-			 WHERE user_role_bindings.user_id = ?`, [userId]);
-  return rows.map((row) => row.key);
-}
-export {
-  rolesForUserMethod
-};

package/dist/api/auth/d1-store/teams/set-user-roles.d.ts

@@ -1,2 +0,0 @@
-import { D1AuthStore } from "../../d1-store.js";
-export declare function setUserRolesMethod(this: D1AuthStore, userId: string, roles: string[]): Promise<import("../../d1-store.js").PrincipalRecord>;

package/dist/api/auth/d1-store/teams/set-user-roles.js

@@ -1,25 +0,0 @@
-async function setUserRolesMethod(userId, roles) {
-  await this.ensureInitialized();
-  const requestedRoles = [...new Set(roles.map((role) => role.trim()).filter(Boolean))];
-  const currentRoles = await this.rolesForUser(userId);
-  if (currentRoles.includes("platform_admin") && !requestedRoles.includes("platform_admin")) {
-    const count = await this.first(`SELECT COUNT(DISTINCT bindings.user_id) AS count
-			FROM user_role_bindings bindings
-			INNER JOIN roles ON roles.id = bindings.role_id
-			WHERE roles.key = 'platform_admin'`);
-    if (Number(count?.count ?? 0) <= 1) throw new Error("The final platform administrator cannot be removed.");
-  }
-  await this.replaceRoles(userId, requestedRoles.length > 0 ? requestedRoles : ["member"]);
-  await this.writeAuditEvent({
-    actorType: "service",
-    actorId: this.config.webServiceId,
-    eventType: "auth.user_roles_set",
-    targetType: "user",
-    targetId: userId,
-    data: { roles: requestedRoles }
-  });
-  return this.principalForUser(userId);
-}
-export {
-  setUserRolesMethod
-};

package/dist/api/auth/d1-store.d.ts

@@ -1,133 +0,0 @@
-import type { D1DatabaseLike } from '../../types/cloudflare.js';
-import type { ApiConfig, ApiCredential, ApiPrincipal, DeviceCodeApproveRequest, DeviceCodePollRequest, DeviceCodePollResponse, DeviceCodeStartRequest, DeviceCodeStartResponse, TokenRefreshRequest, TokenRefreshResponse, TrustedUserAssertionClaims, UserIdentityProfileInput } from '../types.js';
-export declare function approvalUrl(baseUrl: string, userCode?: string | null): string;
-export declare const AUTH_SCHEMA_SQL: string[];
-export type DeviceCodeRow = {
-    id: string;
-    device_code: string;
-    user_code: string;
-    requested_scopes_json: string;
-    expires_at: string;
-    interval_seconds: number;
-    status: string;
-    user_id: string | null;
-};
-export type UserRow = {
-    id: string;
-    email: string | null;
-    username: string | null;
-    display_name: string | null;
-    status: string;
-    metadata_json: string | null;
-    created_at: string;
-    updated_at: string;
-};
-export type PrincipalRecord = {
-    principal: ApiPrincipal;
-    userId: string;
-};
-export interface PersonalAccessTokenResult {
-    id: string;
-    token: string;
-    prefix: string;
-    name: string;
-    expiresAt: string | null;
-}
-export interface ServiceCredentialResult {
-    id: string;
-    serviceId: string;
-    secret: string;
-}
-export declare function now(): Date;
-export declare function isoNow(): string;
-export declare function addSeconds(date: Date, seconds: number): Date;
-export declare function parseJson<T>(value: string | null | undefined, fallback: T): T;
-export declare function stableHash(value: string, secret: string): string;
-export declare function equalHash(left: string, right: string): boolean;
-export declare class D1AuthStore {
-    readonly config: ApiConfig;
-    readonly db: D1DatabaseLike;
-    initializationPromise: Promise<void> | null;
-    constructor(config: ApiConfig, db: D1DatabaseLike);
-}
-export interface D1AuthStore {
-    run(query: string, params?: unknown[]): any;
-    first<T = Record<string, unknown>>(query: string, params?: unknown[]): any;
-    all<T = Record<string, unknown>>(query: string, params?: unknown[]): any;
-    ensureInitialized(): any;
-    ensureAuthSchema(): any;
-    seedCatalog(): any;
-    seedConfiguredServices(): any;
-    loadUser(userId: string): any;
-    loadIdentityByProvider(provider: string, providerSubject: string): any;
-    loadUserByVerifiedEmail(email: string): any;
-    loadUserByUsername(username: string): any;
-    canAdoptUsernameMatch(identity: UserIdentityProfileInput, user: UserRow | null): any;
-    rolesForUser(userId: string): any;
-    permissionsForUser(userId: string): any;
-    permissionsForRoles(roleKeys: string[]): any;
-    scopesForPrincipal(permissions: string[]): any;
-    principalForUser(userId: string): Promise<PrincipalRecord>;
-    assignRole(userId: string, roleKey: string): any;
-    replaceRoles(userId: string, roleKeys: string[]): any;
-    bootstrapRolesForUser(userId: string, identity: UserIdentityProfileInput): any;
-    reconcileBootstrapAdmins(): Promise<void>;
-    writeAuditEvent(input: {
-        actorType: string;
-        actorId: string | null;
-        eventType: string;
-        targetType: string | null;
-        targetId: string | null;
-        data?: Record<string, unknown>;
-    }): any;
-    userMetadata(identity: UserIdentityProfileInput, existingUsername?: string | null): any;
-    syncUser(identity: UserIdentityProfileInput): any;
-    createUser(input: {
-        email?: string | null;
-        username?: string | null;
-        displayName?: string | null;
-        metadata?: Record<string, unknown>;
-    }): any;
-    setUserRoles(userId: string, roles: string[]): any;
-    startDeviceFlow(request: DeviceCodeStartRequest): Promise<DeviceCodeStartResponse>;
-    approveDeviceFlow(request: DeviceCodeApproveRequest): Promise<{
-        ok: true;
-    }>;
-    pollDeviceFlow(request: DeviceCodePollRequest): Promise<DeviceCodePollResponse>;
-    issueUserSession(userId: string, options?: {
-        sessionType?: string;
-        scopes?: string[];
-        data?: Record<string, unknown>;
-    }): Promise<TokenRefreshResponse>;
-    refreshAccessToken(request: TokenRefreshRequest): Promise<TokenRefreshResponse>;
-    createPersonalAccessToken(userId: string, input: {
-        name: string;
-        scopes?: string[];
-        expiresAt?: string | null;
-    }): any;
-    listPersonalAccessTokens(userId: string): any;
-    revokePersonalAccessToken(userId: string, tokenId: string): any;
-    upsertServiceCredential(input: {
-        serviceId: string;
-        name: string;
-        secret: string;
-        roles?: string[];
-        permissions?: string[];
-    }): any;
-    createServiceCredential(input: {
-        serviceId: string;
-        name: string;
-        roles?: string[];
-        permissions?: string[];
-    }): Promise<ServiceCredentialResult>;
-    rotateServiceCredential(serviceId: string): any;
-    authenticateBearerToken(token: string): Promise<{
-        principal: ApiPrincipal;
-        credential: ApiCredential;
-    } | null>;
-    authenticateService(serviceId: string, secret: string): Promise<{
-        principal: ApiPrincipal;
-        credential: ApiCredential;
-    } | null>;
-    exchangeTrustedUserAssertion(claims: TrustedUserAssertionClaims): any;
-}

package/dist/api/auth/d1-store.js

@@ -1,225 +0,0 @@
-import { createHash, timingSafeEqual } from "node:crypto";
-import * as extractedMethods from "./d1-store/methods.js";
-function approvalUrl(baseUrl, userCode) {
-  const url = new URL("/auth/device/approve", `${baseUrl.replace(/\/+$/u, "")}/`);
-  if (userCode) {
-    url.searchParams.set("user_code", userCode);
-  }
-  return url.toString();
-}
-const AUTH_SCHEMA_SQL = [
-  `CREATE TABLE IF NOT EXISTS users (
-		id TEXT PRIMARY KEY,
-		email TEXT,
-		username TEXT UNIQUE,
-		display_name TEXT,
-		status TEXT NOT NULL DEFAULT 'active',
-		metadata_json TEXT,
-		created_at TEXT NOT NULL,
-		updated_at TEXT NOT NULL
-	)`,
-  `CREATE TABLE IF NOT EXISTS user_identities (
-		id TEXT PRIMARY KEY,
-		user_id TEXT NOT NULL,
-		provider TEXT NOT NULL,
-		provider_subject TEXT NOT NULL,
-		email TEXT,
-		email_verified INTEGER NOT NULL DEFAULT 0,
-		profile_json TEXT,
-		created_at TEXT NOT NULL,
-		updated_at TEXT NOT NULL,
-		FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
-	)`,
-  `CREATE UNIQUE INDEX IF NOT EXISTS idx_user_identities_provider_subject
-		ON user_identities(provider, provider_subject)`,
-  `CREATE TABLE IF NOT EXISTS roles (
-		id TEXT PRIMARY KEY,
-		key TEXT NOT NULL UNIQUE,
-		description TEXT,
-		created_at TEXT NOT NULL
-	)`,
-  `CREATE TABLE IF NOT EXISTS permissions (
-		id TEXT PRIMARY KEY,
-		key TEXT NOT NULL UNIQUE,
-		resource TEXT NOT NULL,
-		action TEXT NOT NULL,
-		scope TEXT NOT NULL,
-		description TEXT,
-		created_at TEXT NOT NULL
-	)`,
-  `CREATE TABLE IF NOT EXISTS role_permissions (
-		role_id TEXT NOT NULL,
-		permission_id TEXT NOT NULL,
-		created_at TEXT NOT NULL,
-		PRIMARY KEY (role_id, permission_id),
-		FOREIGN KEY (role_id) REFERENCES roles(id) ON DELETE CASCADE,
-		FOREIGN KEY (permission_id) REFERENCES permissions(id) ON DELETE CASCADE
-	)`,
-  `CREATE TABLE IF NOT EXISTS user_role_bindings (
-		id TEXT PRIMARY KEY,
-		user_id TEXT NOT NULL,
-		role_id TEXT NOT NULL,
-		created_at TEXT NOT NULL,
-		FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
-		FOREIGN KEY (role_id) REFERENCES roles(id) ON DELETE CASCADE
-	)`,
-  `CREATE UNIQUE INDEX IF NOT EXISTS idx_user_role_bindings_user_role
-		ON user_role_bindings(user_id, role_id)`,
-  `CREATE TABLE IF NOT EXISTS api_tokens (
-		id TEXT PRIMARY KEY,
-		user_id TEXT NOT NULL,
-		kind TEXT NOT NULL,
-		name TEXT NOT NULL,
-		token_prefix TEXT NOT NULL,
-		token_hash TEXT NOT NULL,
-		scopes_json TEXT NOT NULL,
-		expires_at TEXT,
-		last_used_at TEXT,
-		revoked_at TEXT,
-		metadata_json TEXT,
-		created_at TEXT NOT NULL,
-		updated_at TEXT NOT NULL,
-		FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
-	)`,
-  `CREATE INDEX IF NOT EXISTS idx_api_tokens_user_id
-		ON api_tokens(user_id)`,
-  `CREATE INDEX IF NOT EXISTS idx_api_tokens_prefix
-		ON api_tokens(token_prefix)`,
-  `CREATE TABLE IF NOT EXISTS service_credentials (
-		id TEXT PRIMARY KEY,
-		service_id TEXT NOT NULL UNIQUE,
-		name TEXT NOT NULL,
-		secret_hash TEXT NOT NULL,
-		roles_json TEXT NOT NULL,
-		permissions_json TEXT NOT NULL,
-		revoked_at TEXT,
-		created_at TEXT NOT NULL,
-		updated_at TEXT NOT NULL,
-		last_used_at TEXT
-	)`,
-  `CREATE TABLE IF NOT EXISTS auth_sessions (
-		id TEXT PRIMARY KEY,
-		user_id TEXT NOT NULL,
-		session_type TEXT NOT NULL,
-		refresh_token_hash TEXT NOT NULL,
-		scopes_json TEXT NOT NULL,
-		expires_at TEXT NOT NULL,
-		revoked_at TEXT,
-		data_json TEXT,
-		created_at TEXT NOT NULL,
-		updated_at TEXT NOT NULL,
-		FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
-	)`,
-  `CREATE INDEX IF NOT EXISTS idx_auth_sessions_user_id
-		ON auth_sessions(user_id)`,
-  `CREATE TABLE IF NOT EXISTS audit_events (
-		id TEXT PRIMARY KEY,
-		actor_type TEXT NOT NULL,
-		actor_id TEXT,
-		event_type TEXT NOT NULL,
-		target_type TEXT,
-		target_id TEXT,
-		data_json TEXT,
-		created_at TEXT NOT NULL
-	)`,
-  `CREATE INDEX IF NOT EXISTS idx_audit_events_target
-		ON audit_events(target_type, target_id)`,
-  `CREATE TABLE IF NOT EXISTS device_codes (
-		id TEXT PRIMARY KEY,
-		device_code TEXT NOT NULL UNIQUE,
-		user_code TEXT NOT NULL UNIQUE,
-		requested_scopes_json TEXT NOT NULL,
-		expires_at TEXT NOT NULL,
-		interval_seconds INTEGER NOT NULL,
-		status TEXT NOT NULL,
-		user_id TEXT,
-		created_at TEXT NOT NULL,
-		updated_at TEXT NOT NULL
-	)`
-];
-function now() {
-  return /* @__PURE__ */ new Date();
-}
-function isoNow() {
-  return now().toISOString();
-}
-function addSeconds(date, seconds) {
-  return new Date(date.getTime() + seconds * 1e3);
-}
-function parseJson(value, fallback) {
-  if (!value)
-    return fallback;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return fallback;
-  }
-}
-function stableHash(value, secret) {
-  return createHash("sha256").update(`${secret}:${value}`).digest("hex");
-}
-function equalHash(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  return leftBuffer.length === rightBuffer.length && timingSafeEqual(leftBuffer, rightBuffer);
-}
-class D1AuthStore {
-  constructor(config, db) {
-    this.config = config;
-    this.db = db;
-  }
-  config;
-  db;
-  initializationPromise = null;
-}
-D1AuthStore.prototype.run = extractedMethods.runMethod;
-D1AuthStore.prototype.first = extractedMethods.firstMethod;
-D1AuthStore.prototype.all = extractedMethods.allMethod;
-D1AuthStore.prototype.ensureInitialized = extractedMethods.ensureInitializedMethod;
-D1AuthStore.prototype.ensureAuthSchema = extractedMethods.ensureAuthSchemaMethod;
-D1AuthStore.prototype.seedCatalog = extractedMethods.seedCatalogMethod;
-D1AuthStore.prototype.seedConfiguredServices = extractedMethods.seedConfiguredServicesMethod;
-D1AuthStore.prototype.loadUser = extractedMethods.loadUserMethod;
-D1AuthStore.prototype.loadIdentityByProvider = extractedMethods.loadIdentityByProviderMethod;
-D1AuthStore.prototype.loadUserByVerifiedEmail = extractedMethods.loadUserByVerifiedEmailMethod;
-D1AuthStore.prototype.loadUserByUsername = extractedMethods.loadUserByUsernameMethod;
-D1AuthStore.prototype.canAdoptUsernameMatch = extractedMethods.canAdoptUsernameMatchMethod;
-D1AuthStore.prototype.rolesForUser = extractedMethods.rolesForUserMethod;
-D1AuthStore.prototype.permissionsForUser = extractedMethods.permissionsForUserMethod;
-D1AuthStore.prototype.permissionsForRoles = extractedMethods.permissionsForRolesMethod;
-D1AuthStore.prototype.scopesForPrincipal = extractedMethods.scopesForPrincipalMethod;
-D1AuthStore.prototype.principalForUser = extractedMethods.principalForUserMethod;
-D1AuthStore.prototype.assignRole = extractedMethods.assignRoleMethod;
-D1AuthStore.prototype.replaceRoles = extractedMethods.replaceRolesMethod;
-D1AuthStore.prototype.bootstrapRolesForUser = extractedMethods.bootstrapRolesForUserMethod;
-D1AuthStore.prototype.reconcileBootstrapAdmins = extractedMethods.reconcileBootstrapAdminsMethod;
-D1AuthStore.prototype.writeAuditEvent = extractedMethods.writeAuditEventMethod;
-D1AuthStore.prototype.userMetadata = extractedMethods.userMetadataMethod;
-D1AuthStore.prototype.syncUser = extractedMethods.syncUserMethod;
-D1AuthStore.prototype.createUser = extractedMethods.createUserMethod;
-D1AuthStore.prototype.setUserRoles = extractedMethods.setUserRolesMethod;
-D1AuthStore.prototype.startDeviceFlow = extractedMethods.startDeviceFlowMethod;
-D1AuthStore.prototype.approveDeviceFlow = extractedMethods.approveDeviceFlowMethod;
-D1AuthStore.prototype.pollDeviceFlow = extractedMethods.pollDeviceFlowMethod;
-D1AuthStore.prototype.issueUserSession = extractedMethods.issueUserSessionMethod;
-D1AuthStore.prototype.refreshAccessToken = extractedMethods.refreshAccessTokenMethod;
-D1AuthStore.prototype.createPersonalAccessToken = extractedMethods.createPersonalAccessTokenMethod;
-D1AuthStore.prototype.listPersonalAccessTokens = extractedMethods.listPersonalAccessTokensMethod;
-D1AuthStore.prototype.revokePersonalAccessToken = extractedMethods.revokePersonalAccessTokenMethod;
-D1AuthStore.prototype.upsertServiceCredential = extractedMethods.upsertServiceCredentialMethod;
-D1AuthStore.prototype.createServiceCredential = extractedMethods.createServiceCredentialMethod;
-D1AuthStore.prototype.rotateServiceCredential = extractedMethods.rotateServiceCredentialMethod;
-D1AuthStore.prototype.authenticateBearerToken = extractedMethods.authenticateBearerTokenMethod;
-D1AuthStore.prototype.authenticateService = extractedMethods.authenticateServiceMethod;
-D1AuthStore.prototype.exchangeTrustedUserAssertion = extractedMethods.exchangeTrustedUserAssertionMethod;
-export {
-  AUTH_SCHEMA_SQL,
-  D1AuthStore,
-  addSeconds,
-  approvalUrl,
-  equalHash,
-  isoNow,
-  now,
-  parseJson,
-  stableHash
-};

package/dist/api/auth/memory-provider.d.ts

@@ -1,82 +0,0 @@
-import type { ApiAuthProvider, ApiConfig, ApiPrincipal, DeviceCodeApproveRequest, DeviceCodePollRequest, DeviceCodePollResponse, DeviceCodeStartRequest, DeviceCodeStartResponse, TokenRefreshRequest, TokenRefreshResponse, TrustedUserAssertionClaims, UserIdentityProfileInput } from '../types.js';
-export declare class MemoryDeviceCodeAuthProvider implements ApiAuthProvider {
-    private readonly config;
-    readonly id = "memory";
-    private readonly devices;
-    private readonly refreshSessions;
-    constructor(config: ApiConfig);
-    startDeviceFlow(request: DeviceCodeStartRequest): Promise<DeviceCodeStartResponse>;
-    approveDeviceFlow(request: DeviceCodeApproveRequest): Promise<{
-        ok: true;
-    }>;
-    pollDeviceFlow(request: DeviceCodePollRequest): Promise<DeviceCodePollResponse>;
-    refreshAccessToken(request: TokenRefreshRequest): Promise<TokenRefreshResponse>;
-    issueUserSession(userId: string, options?: {
-        sessionType?: string;
-        scopes?: string[];
-        data?: Record<string, unknown>;
-    }): Promise<TokenRefreshResponse>;
-    authenticateBearerToken(token: string): Promise<{
-        principal: ApiPrincipal;
-        credential: {
-            type: "access_token";
-            id: string;
-            label: "service" | "access";
-        };
-    } | null>;
-    authenticateServiceCredential(_serviceId: string, _secret: string): Promise<null>;
-    createPersonalAccessToken(_userId: string, _input: {
-        name: string;
-        scopes?: string[];
-        expiresAt?: string | null;
-    }): Promise<{
-        id: string;
-        token: string;
-        prefix: string;
-        name: string;
-        expiresAt: string | null;
-    }>;
-    listPersonalAccessTokens(): Promise<never[]>;
-    revokePersonalAccessToken(): Promise<void>;
-    syncUserIdentity(identity: UserIdentityProfileInput): Promise<{
-        userId: string;
-        identityId: string;
-        principal: {
-            id: string;
-            displayName: string | undefined;
-            scopes: string[];
-            roles: string[];
-            permissions: string[];
-            metadata: {
-                username: string | undefined;
-                firstName: string | undefined;
-                lastName: string | undefined;
-            };
-        };
-    }>;
-    createServiceToken(_input: {
-        serviceId: string;
-        name: string;
-        roles?: string[];
-        permissions?: string[];
-    }): Promise<{
-        id: string;
-        serviceId: string;
-        secret: string;
-    }>;
-    rotateServiceToken(_serviceId: string): Promise<{
-        id: string;
-        serviceId: string;
-        secret: string;
-    }>;
-    createTrustedUserAssertion(claims: TrustedUserAssertionClaims): string;
-    verifyTrustedUserAssertion(assertion: string): TrustedUserAssertionClaims | null;
-    exchangeTrustedUserAssertion(claims: TrustedUserAssertionClaims): Promise<{
-        ok: true;
-        accessToken: string;
-        tokenType: "Bearer";
-        expiresAt: string;
-        expiresInSeconds: number;
-        principal: ApiPrincipal;
-    }>;
-}