anhedral 0.8.5 → 0.9.0

package/dist/access.js

@@ -0,0 +1,93 @@
+import path from 'node:path';
+import { atomicJson, readConfig, targetDirectory, } from './project-state.js';
+import { listCloudflare } from './cloudflare.js';
+export function validatePrivateAudience(project, root) {
+    if (!project.access?.emails.length ||
+        project.access.emails.some((email) => !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)))
+        throw new Error('Private delivery requires explicit allowed email addresses.');
+    for (const target of project.targets) {
+        const config = readConfig(targetDirectory(root, target));
+        if (target.id === 'realtime' ||
+            config.durable_objects?.bindings?.some((item) => item.class_name === 'Rooms'))
+            throw new Error('Worker-level Access does not support WebSockets. Use a reviewed hostname Access workflow or application identity for realtime products.');
+    }
+}
+function policiesMatch(policies, emails) {
+    if (policies.length !== 1 || policies[0].decision !== 'allow')
+        return false;
+    const policy = policies[0];
+    if (!Array.isArray(policy.include) ||
+        !policy.include.length ||
+        policy.exclude?.length ||
+        policy.require?.length)
+        return false;
+    const actual = [];
+    for (const rule of policy.include) {
+        if (!rule || Object.keys(rule).length !== 1 || typeof rule.email?.email !== 'string')
+            return false;
+        actual.push(rule.email.email.toLowerCase());
+    }
+    return (JSON.stringify([...new Set(actual)].sort()) === JSON.stringify([...new Set(emails)].sort()));
+}
+/** Protect the entire Worker, including every route and preview, before product code is deployed. */
+export async function reconcileAccess(root, project, request, create) {
+    validatePrivateAudience(project, root);
+    const receipts = [];
+    const workers = await listCloudflare(request, '/workers/workers');
+    const apps = await listCloudflare(request, '/access/apps');
+    for (const target of project.targets) {
+        const matches = workers.filter((item) => item.name === target.workerName);
+        if (matches.length > 1)
+            throw new Error('Ambiguous Worker identity.');
+        let worker = matches[0];
+        if (!worker && create)
+            worker = (await request('POST', '/workers/workers', { name: target.workerName }))
+                .result;
+        if (!worker || typeof worker.id !== 'string' || !/^[a-f0-9]{32}$/i.test(worker.id))
+            throw new Error('Provider did not return an immutable Worker ID.');
+        const destinations = [{ type: 'worker', worker_id: worker.id }];
+        const candidates = apps.filter((app) => Array.isArray(app.destinations) &&
+            app.destinations.some((destination) => destination.worker_id === worker.id));
+        if (candidates.length > 1)
+            throw new Error('Multiple Access applications target this Worker; reconcile policies explicitly.');
+        let app = candidates[0];
+        if (!app && create) {
+            app = (await request('POST', '/access/apps', {
+                name: `Anhedral ${project.id} ${target.id}`,
+                type: 'self_hosted',
+                session_duration: '24h',
+                destinations,
+                policies: [
+                    {
+                        name: 'Application members',
+                        decision: 'allow',
+                        include: project.access.emails.map((email) => ({ email: { email } })),
+                    },
+                ],
+            })).result;
+            apps.push(app);
+        }
+        if (!app ||
+            typeof app.id !== 'string' ||
+            !/^[a-f0-9-]{36}$/i.test(app.id) ||
+            app.type !== 'self_hosted' ||
+            !Array.isArray(app.destinations) ||
+            app.destinations.length !== 1 ||
+            app.destinations[0].type !== 'worker' ||
+            app.destinations[0].worker_id !== worker.id)
+            throw new Error('Whole-Worker private Access protection is missing or differs from the requested policy.');
+        const policies = await listCloudflare(request, `/access/apps/${app.id}/policies`);
+        if (!policiesMatch(policies, project.access.emails))
+            throw new Error('Access policies differ from the explicit application members; no unrelated policy was overwritten.');
+        receipts.push({ target: target.id, workerId: worker.id, applicationId: app.id });
+        if (create)
+            atomicJson(path.join(root, '.anhedral/access.json'), {
+                schemaVersion: 1,
+                projectId: project.id,
+                accountId: project.accountId,
+                checkedAt: new Date().toISOString(),
+                receipts,
+            });
+    }
+    return receipts;
+}

package/dist/auth-schema-snapshot.d.ts

@@ -0,0 +1,346 @@
+export declare const betterAuthSqliteSnapshot: {
+    version: string;
+    dialect: string;
+    id: string;
+    prevId: string;
+    tables: {
+        account: {
+            name: string;
+            columns: {
+                id: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                account_id: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                provider_id: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                user_id: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                access_token: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                refresh_token: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                id_token: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                access_token_expires_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                refresh_token_expires_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                scope: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                password: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                created_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                updated_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+            };
+            indexes: {
+                account_user_id_idx: {
+                    name: string;
+                    columns: string[];
+                    isUnique: boolean;
+                };
+            };
+            foreignKeys: {
+                account_user_id_user_id_fk: {
+                    name: string;
+                    tableFrom: string;
+                    tableTo: string;
+                    columnsFrom: string[];
+                    columnsTo: string[];
+                    onDelete: string;
+                    onUpdate: string;
+                };
+            };
+            compositePrimaryKeys: {};
+            uniqueConstraints: {};
+            checkConstraints: {};
+        };
+        session: {
+            name: string;
+            columns: {
+                id: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                expires_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                token: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                created_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                updated_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                ip_address: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                user_agent: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                user_id: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+            };
+            indexes: {
+                session_token_unique: {
+                    name: string;
+                    columns: string[];
+                    isUnique: boolean;
+                };
+                session_user_id_idx: {
+                    name: string;
+                    columns: string[];
+                    isUnique: boolean;
+                };
+            };
+            foreignKeys: {
+                session_user_id_user_id_fk: {
+                    name: string;
+                    tableFrom: string;
+                    tableTo: string;
+                    columnsFrom: string[];
+                    columnsTo: string[];
+                    onDelete: string;
+                    onUpdate: string;
+                };
+            };
+            compositePrimaryKeys: {};
+            uniqueConstraints: {};
+            checkConstraints: {};
+        };
+        user: {
+            name: string;
+            columns: {
+                id: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                name: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                email: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                email_verified: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                    default: boolean;
+                };
+                image: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                created_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                updated_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+            };
+            indexes: {
+                user_email_unique: {
+                    name: string;
+                    columns: string[];
+                    isUnique: boolean;
+                };
+            };
+            foreignKeys: {};
+            compositePrimaryKeys: {};
+            uniqueConstraints: {};
+            checkConstraints: {};
+        };
+        verification: {
+            name: string;
+            columns: {
+                id: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                identifier: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                value: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                expires_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                created_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+                updated_at: {
+                    name: string;
+                    type: string;
+                    primaryKey: boolean;
+                    notNull: boolean;
+                    autoincrement: boolean;
+                };
+            };
+            indexes: {
+                verification_identifier_idx: {
+                    name: string;
+                    columns: string[];
+                    isUnique: boolean;
+                };
+            };
+            foreignKeys: {};
+            compositePrimaryKeys: {};
+            uniqueConstraints: {};
+            checkConstraints: {};
+        };
+    };
+    views: {};
+    enums: {};
+    _meta: {
+        schemas: {};
+        tables: {};
+        columns: {};
+    };
+    internal: {
+        indexes: {};
+    };
+};