qarpeo 0.0.0-alpha.10

package/dist/runtime/server/utils/turnstile.mjs

@@ -0,0 +1,68 @@
+import { getRequestHeader, createError } from "nuxt/server";
+import { getQarpeoConfig } from "./config.mjs";
+export async function verifyTurnstileToken(event, token, remoteIp) {
+  const resolvedToken = token || getRequestHeader(event, "cf-turnstile-response") || getRequestHeader(event, "x-turnstile-token");
+  if (!resolvedToken) {
+    return {
+      success: false,
+      errorCodes: ["missing-input-response"]
+    };
+  }
+  if (resolvedToken === "XXXX.DUMMY.TOKEN.XXXX") {
+    return { success: true };
+  }
+  const authConfig = getQarpeoConfig(event).auth || {};
+  const turnstileConfig = typeof authConfig.turnstile === "object" ? authConfig.turnstile : {};
+  const secretKey = globalThis.process?.env?.NUXT_TURNSTILE_SECRET_KEY || globalThis.process?.env?.TURNSTILE_SECRET_KEY || turnstileConfig.secretKey;
+  if (!secretKey) {
+    if (globalThis.process?.env?.NODE_ENV !== "production") {
+      console.warn(
+        "[qarpeo:turnstile] NUXT_TURNSTILE_SECRET_KEY is not set. Allowing request in development mode."
+      );
+      return { success: true };
+    }
+    return {
+      success: false,
+      errorCodes: ["missing-secret-key"]
+    };
+  }
+  const ip = remoteIp || getRequestHeader(event, "cf-connecting-ip") || getRequestHeader(event, "x-forwarded-for")?.split(",")[0]?.trim();
+  const formData = new FormData();
+  formData.append("secret", secretKey);
+  formData.append("response", resolvedToken);
+  if (ip) {
+    formData.append("remoteip", ip);
+  }
+  try {
+    const res = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+      method: "POST",
+      body: formData
+    });
+    const outcome = await res.json();
+    return {
+      success: Boolean(outcome.success),
+      errorCodes: outcome["error-codes"],
+      challengeTs: outcome.challenge_ts,
+      hostname: outcome.hostname,
+      action: outcome.action,
+      cdata: outcome.cdata
+    };
+  } catch (err) {
+    console.error("[qarpeo:turnstile] Verification network error:", err.message);
+    return {
+      success: false,
+      errorCodes: ["internal-error"]
+    };
+  }
+}
+export async function requireTurnstile(event, token) {
+  const result = await verifyTurnstileToken(event, token);
+  if (!result.success) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      message: "Turnstile bot verification failed. Please complete the security challenge.",
+      data: { errorCodes: result.errorCodes }
+    });
+  }
+}

package/dist/runtime/server/utils/vapid.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Qarpeo VAPID Web Push helper — RFC 8292 & RFC 8291
+ * Uses only native crypto.subtle (zero external dependencies).
+ */
+/**
+ * Generate a new VAPID P-256 key pair.
+ * Returns base64url-encoded public and private keys.
+ */
+export declare function generateVapidKeys(): Promise<{
+    publicKey: string;
+    privateKey: string;
+}>;
+/**
+ * Build a RFC 8292 VAPID Authorization header value.
+ *
+ * @param endpoint Push subscription endpoint URL
+ * @param subject VAPID contact URI (mailto: or https:)
+ * @param publicKey Base64url VAPID public key
+ * @param privateKey Base64url VAPID private key (raw 32-byte scalar)
+ */
+export declare function signVapidHeader(endpoint: string, subject: string, publicKey: string, privateKey: string): Promise<string>;
+/**
+ * Encrypt a Web Push payload using ECDH + HKDF + AES-128-GCM.
+ * Returns the encrypted body and required headers.
+ */
+export declare function encryptWebPushPayload(subscription: {
+    endpoint: string;
+    keys: {
+        p256dh: string;
+        auth: string;
+    };
+}, payload: string | object): Promise<{
+    body: Uint8Array;
+    headers: Record<string, string>;
+}>;

package/dist/runtime/server/utils/vapid.mjs

@@ -0,0 +1,211 @@
+function base64UrlEncode(buffer) {
+  const bytes = new Uint8Array(
+    "buffer" in buffer ? buffer.buffer : buffer,
+    "byteOffset" in buffer ? buffer.byteOffset : 0,
+    buffer.byteLength
+  );
+  let str = "";
+  for (const byte of bytes) str += String.fromCharCode(byte);
+  return btoa(str).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function base64UrlDecode(str) {
+  const padded = str.replace(/-/g, "+").replace(/_/g, "/");
+  const pad = padded.length % 4 === 0 ? 0 : 4 - padded.length % 4;
+  const b64 = padded + "=".repeat(pad);
+  const binary = atob(b64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function concatBuffers(...buffers) {
+  const totalLen = buffers.reduce((s, b) => s + b.byteLength, 0);
+  const out = new Uint8Array(totalLen);
+  let offset = 0;
+  for (const buf of buffers) {
+    out.set(new Uint8Array(buf), offset);
+    offset += buf.byteLength;
+  }
+  return out;
+}
+function encodeUint16BE(n) {
+  return new Uint8Array([n >> 8 & 255, n & 255]);
+}
+export async function generateVapidKeys() {
+  const keyPair = await crypto.subtle.generateKey(
+    { name: "ECDH", namedCurve: "P-256" },
+    true,
+    ["deriveKey", "deriveBits"]
+  );
+  const publicKeyRaw = await crypto.subtle.exportKey("raw", keyPair.publicKey);
+  const privateKeyPkcs8 = await crypto.subtle.exportKey("pkcs8", keyPair.privateKey);
+  const privateKeyBytes = new Uint8Array(privateKeyPkcs8).slice(-32);
+  return {
+    publicKey: base64UrlEncode(publicKeyRaw),
+    privateKey: base64UrlEncode(privateKeyBytes.buffer)
+  };
+}
+export async function signVapidHeader(endpoint, subject, publicKey, privateKey) {
+  const origin = new URL(endpoint).origin;
+  const expiry = Math.floor(Date.now() / 1e3) + 12 * 3600;
+  const header = base64UrlEncode(
+    new TextEncoder().encode(JSON.stringify({ typ: "JWT", alg: "ES256" }))
+  );
+  const payload = base64UrlEncode(
+    new TextEncoder().encode(JSON.stringify({ aud: origin, exp: expiry, sub: subject }))
+  );
+  const signingInput = `${header}.${payload}`;
+  const privateKeyBytes = base64UrlDecode(privateKey);
+  const publicKeyBytes = base64UrlDecode(publicKey);
+  const ecPrivateKey = concatBuffers(
+    // ECPrivateKey header: version 1, privateKey octet string
+    new Uint8Array([48, 119, 2, 1, 1, 4, 32]).buffer,
+    privateKeyBytes.buffer,
+    // namedCurve OID for P-256 [a0 0a 06 08 2a 86 48 ce 3d 03 01 07]
+    new Uint8Array([160, 10, 6, 8, 42, 134, 72, 206, 61, 3, 1, 7]).buffer,
+    // publicKey bit string [a1 44 03 42 00 ...]
+    new Uint8Array([161, 68, 3, 66, 0]).buffer,
+    publicKeyBytes.buffer
+  );
+  const pkcs8Header = new Uint8Array([
+    // SEQUENCE
+    48,
+    129,
+    135,
+    // version 0
+    2,
+    1,
+    0,
+    // AlgorithmIdentifier: EC + P-256 OID
+    48,
+    19,
+    6,
+    7,
+    42,
+    134,
+    72,
+    206,
+    61,
+    2,
+    1,
+    6,
+    8,
+    42,
+    134,
+    72,
+    206,
+    61,
+    3,
+    1,
+    7,
+    // OCTET STRING wrapping ECPrivateKey
+    4,
+    109
+  ]);
+  const pkcs8 = concatBuffers(pkcs8Header.buffer, ecPrivateKey.buffer);
+  const signingKey = await crypto.subtle.importKey(
+    "pkcs8",
+    pkcs8.buffer,
+    { name: "ECDSA", namedCurve: "P-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    signingKey,
+    new TextEncoder().encode(signingInput)
+  );
+  const jwtToken = `${signingInput}.${base64UrlEncode(signature)}`;
+  return `vapid t=${jwtToken}, k=${publicKey}`;
+}
+export async function encryptWebPushPayload(subscription, payload) {
+  const plaintext = typeof payload === "string" ? payload : JSON.stringify(payload);
+  const plaintextBytes = new TextEncoder().encode(plaintext);
+  const receiverPublicKeyBytes = base64UrlDecode(subscription.keys.p256dh);
+  const authSecret = base64UrlDecode(subscription.keys.auth);
+  const senderKeyPair = await crypto.subtle.generateKey(
+    { name: "ECDH", namedCurve: "P-256" },
+    true,
+    ["deriveBits"]
+  );
+  const senderPublicKeyRaw = await crypto.subtle.exportKey("raw", senderKeyPair.publicKey);
+  const senderPublicKey = new Uint8Array(senderPublicKeyRaw);
+  const receiverPublicKey = await crypto.subtle.importKey(
+    "raw",
+    receiverPublicKeyBytes,
+    { name: "ECDH", namedCurve: "P-256" },
+    false,
+    []
+  );
+  const sharedSecretBits = await crypto.subtle.deriveBits(
+    { name: "ECDH", public: receiverPublicKey },
+    senderKeyPair.privateKey,
+    256
+  );
+  const sharedSecret = new Uint8Array(sharedSecretBits);
+  const salt = crypto.getRandomValues(new Uint8Array(16));
+  const prk = await hkdf(
+    authSecret,
+    sharedSecret,
+    buildInfo("Content-Encoding: auth\0", new Uint8Array(0), new Uint8Array(0)),
+    32
+  );
+  const cek = await hkdf(
+    salt,
+    prk,
+    buildInfo(
+      "Content-Encoding: aesgcm\0",
+      receiverPublicKeyBytes,
+      senderPublicKey
+    ),
+    16
+  );
+  const nonce = await hkdf(
+    salt,
+    prk,
+    buildInfo("Content-Encoding: nonce\0", receiverPublicKeyBytes, senderPublicKey),
+    12
+  );
+  const encryptKey = await crypto.subtle.importKey("raw", cek, { name: "AES-GCM" }, false, [
+    "encrypt"
+  ]);
+  const paddingLength = 0;
+  const paddedContent = concatBuffers(
+    encodeUint16BE(paddingLength).buffer,
+    new Uint8Array(paddingLength).buffer,
+    plaintextBytes.buffer
+  );
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv: nonce },
+    encryptKey,
+    paddedContent
+  );
+  const cryptoKey = `dh=${base64UrlEncode(senderPublicKeyRaw)}`;
+  const encryptionHeader = `salt=${base64UrlEncode(salt.buffer)}`;
+  return {
+    body: new Uint8Array(ciphertext),
+    headers: {
+      "Content-Encoding": "aesgcm",
+      "Crypto-Key": cryptoKey,
+      Encryption: encryptionHeader,
+      "Content-Type": "application/octet-stream"
+    }
+  };
+}
+async function hkdf(salt, ikm, info, length) {
+  const saltKey = await crypto.subtle.importKey("raw", salt, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const prk = new Uint8Array(await crypto.subtle.sign("HMAC", saltKey, ikm));
+  const prkKey = await crypto.subtle.importKey("raw", prk, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const counter = new Uint8Array([1]);
+  const okm = new Uint8Array(await crypto.subtle.sign("HMAC", prkKey, concatBuffers(info.buffer, counter.buffer)));
+  return okm.slice(0, length);
+}
+function buildInfo(encoding, receiverKey, senderKey) {
+  const encBytes = new TextEncoder().encode(encoding);
+  return concatBuffers(
+    encBytes.buffer,
+    encodeUint16BE(receiverKey.length).buffer,
+    receiverKey.buffer,
+    encodeUint16BE(senderKey.length).buffer,
+    senderKey.buffer
+  );
+}

package/dist/runtime/storage.d.ts

@@ -0,0 +1 @@
+export type * from "./app/composables/storage";

package/dist/runtime/types/ai.d.ts

@@ -0,0 +1,68 @@
+import type { GenerateImageOptions, GenerateImageResult, GenerateSpeechOptions, GenerateSpeechResult, TranscribeAudioInput, TranscribeAudioOptions, TranscribeAudioResult, StreamTextOptions } from "../../types";
+export type { GenerateImageOptions, GenerateImageResult, GenerateSpeechOptions, GenerateSpeechResult, TranscribeAudioInput, TranscribeAudioOptions, TranscribeAudioResult, StreamTextOptions, };
+export interface AiOptions {
+    /** Optional Cloudflare AI Gateway routing options */
+    gateway?: {
+        id: string;
+        skipCache?: boolean;
+        cacheTtl?: number;
+    };
+    /** Additional driver or provider-specific options */
+    [key: string]: any;
+}
+export interface AiBinding {
+    /**
+     * Runs an inference task against the specified model.
+     *
+     * @param model Model identifier, e.g. `@cf/meta/llama-3.1-8b-instruct`
+     * @param inputs Inputs required by the model (prompt, messages, text, etc.)
+     * @param options Optional AI Gateway or inference options
+     */
+    run(model: string, inputs: Record<string, any>, options?: AiOptions): Promise<any>;
+}
+export interface QarpeoAI {
+    /**
+     * Run an inference task using Cloudflare Workers AI.
+     *
+     * @param model Model identifier, e.g. `@cf/meta/llama-3.1-8b-instruct` or
+     *   `@cf/baai/bge-base-en-v1.5`
+     * @param inputs Inputs required by the model (prompt, messages, text, etc.)
+     * @param options Optional AI Gateway or inference options
+     */
+    run<T = any>(model: string, inputs: Record<string, any>, options?: AiOptions): Promise<T>;
+    /** Access the raw underlying Cloudflare Workers AI binding. */
+    raw(bindingName?: string): AiBinding;
+    /**
+     * Generate an image from a text prompt or options using Cloudflare Workers AI.
+     *
+     * @default model "@cf/black-forest-labs/flux-1-schnell"
+     */
+    generateImage(options: string | GenerateImageOptions): Promise<GenerateImageResult>;
+    /** Alias for `generateImage`. */
+    textToImage(options: string | GenerateImageOptions): Promise<GenerateImageResult>;
+    /**
+     * Generate spoken audio from text using Cloudflare Workers AI.
+     *
+     * @default model "@cf/meta/mms-tts-eng"
+     */
+    generateSpeech(options: string | GenerateSpeechOptions): Promise<GenerateSpeechResult>;
+    /** Alias for `generateSpeech`. */
+    textToSpeech(options: string | GenerateSpeechOptions): Promise<GenerateSpeechResult>;
+    /**
+     * Transcribe speech audio to text using Cloudflare Workers AI Whisper.
+     *
+     * @default model "@cf/openai/whisper"
+     */
+    transcribeAudio(options: TranscribeAudioInput | TranscribeAudioOptions): Promise<TranscribeAudioResult>;
+    /** Alias for `transcribeAudio`. */
+    speechToText(options: TranscribeAudioInput | TranscribeAudioOptions): Promise<TranscribeAudioResult>;
+    /** Generate complete text from a prompt or chat messages. */
+    generateText(options: StreamTextOptions): Promise<string>;
+    /** Stream text generation as a Server-Sent Events response. */
+    streamText(options: StreamTextOptions): Promise<Response>;
+    /** Generate vector embeddings for text. */
+    embed(text: string | string[], options?: {
+        model?: string;
+        binding?: string;
+    }): Promise<number[][]>;
+}

package/dist/runtime/types/analytics.d.ts

@@ -0,0 +1,30 @@
+export interface AnalyticsEngineDataPoint {
+    /**
+     * Up to 1 index string to filter and group events (e.g. user ID, account ID, region). Indexed
+     * fields are searchable in the Analytics Engine SQL API.
+     */
+    indexes?: (string | null)[];
+    /**
+     * Up to 20 blob (string) values attached to the data point. Use these for dimensions like event
+     * type, country, path, browser, etc.
+     */
+    blobs?: (string | null)[];
+    /**
+     * Up to 20 double (numeric) values attached to the data point. Use these for measurements like
+     * response time, bytes transferred, score, count, etc.
+     */
+    doubles?: number[];
+}
+export interface AnalyticsEngineDataset {
+    /**
+     * Writes a structured data point to the Analytics Engine dataset. Writes are fire-and-forget —
+     * they never block a response.
+     *
+     * @param event The structured data point to write
+     */
+    writeDataPoint(event: AnalyticsEngineDataPoint): void;
+}
+export interface QarpeoAnalytics extends AnalyticsEngineDataset {
+    /** Access the raw underlying Cloudflare AnalyticsEngineDataset binding. */
+    raw(bindingName?: string): AnalyticsEngineDataset;
+}

package/dist/runtime/types/auth-globals.d.ts

@@ -0,0 +1,14 @@
+declare const getAuthSession: (event: any) => Promise<any>
+declare const setAuthSession: (event: any, session: any, config?: any) => Promise<any>
+declare const replaceAuthSession: (event: any, session: any, config?: any) => Promise<any>
+declare const clearAuthSession: (event: any, config?: any) => Promise<boolean>
+declare const requireAuthSession: (event: any, opts?: any) => Promise<any>
+declare const getUserSession: (event: any) => Promise<any>
+declare const setUserSession: (event: any, session: any, config?: any) => Promise<any>
+declare const replaceUserSession: (event: any, session: any, config?: any) => Promise<any>
+declare const clearUserSession: (event: any, config?: any) => Promise<boolean>
+declare const requireUserSession: (event: any, opts?: any) => Promise<any>
+declare const useUserSession: () => any
+declare const useRuntimeConfig: (event?: any) => any
+declare const navigateTo: any
+declare const defineNuxtRouteMiddleware: any

package/dist/runtime/types/auth.d.ts

@@ -0,0 +1,153 @@
+export interface QarpeoUser {
+    id: string;
+    email: string;
+    name?: string | null;
+    avatarUrl?: string | null;
+    emailVerified?: boolean;
+    role?: string;
+    [key: string]: any;
+}
+export interface QarpeoOrganization {
+    id: string;
+    name: string;
+    slug: string;
+    logoUrl?: string | null;
+    createdAt: number;
+}
+export interface QarpeoMember {
+    id: string;
+    organizationId: string;
+    userId: string;
+    role: "owner" | "admin" | "member" | string;
+    createdAt: number;
+    user?: QarpeoUser;
+}
+export interface QarpeoInvitation {
+    id: string;
+    organizationId: string;
+    email: string;
+    role: string;
+    tokenHash: string;
+    expiresAt: number;
+    createdAt: number;
+}
+export interface QarpeoApiToken {
+    id: string;
+    name: string;
+    scopes: string[];
+    lastUsedAt?: number | null;
+    expiresAt?: number | null;
+    createdAt: number;
+}
+export interface QarpeoSession {
+    user: QarpeoUser;
+    provider?: string;
+    loggedInAt?: number;
+    /** Device session ID registered in D1 `_qarpeo_sessions` table (Phase 3) */
+    sessionId?: string;
+    /** Active organization (Phase 5) */
+    currentOrganizationId?: string | null;
+    currentOrganization?: QarpeoOrganization | null;
+    currentRole?: string | null;
+    /** Impersonation context (Phase 6) */
+    impersonator?: QarpeoUser | null;
+    /** Tenant this session was issued on — prevents cross-tenant session reuse */
+    tenantId?: string | null;
+    /** Multi-Factor Authentication enforcement status */
+    mfaRequired?: boolean;
+    mfaVerified?: boolean;
+    /** Enterprise SSO connection ID if authenticated via SAML or OIDC */
+    ssoConnectionId?: string;
+    [key: string]: any;
+}
+export interface QarpeoSSOConnection {
+    id: string;
+    organizationId?: string | null;
+    providerType: "saml" | "oidc";
+    name: string;
+    domain?: string | null;
+    clientId?: string | null;
+    clientSecret?: string | null;
+    issuer?: string | null;
+    ssoUrl: string;
+    tokenUrl?: string | null;
+    userinfoUrl?: string | null;
+    cert?: string | null;
+    enabled: boolean;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface DeleteAccountOptions {
+    confirm?: boolean;
+    phrase?: string;
+    turnstileToken?: string;
+    cascadeOrg?: boolean;
+}
+export interface QarpeoDeviceSession {
+    id: string;
+    clientType: string;
+    userAgent: string | null;
+    ipAddress: string | null;
+    lastActive: number;
+    expiresAt: number;
+    isCurrent: boolean;
+}
+export interface QarpeoAuthContext {
+    user: QarpeoUser;
+    session: QarpeoSession | null;
+    organization: QarpeoOrganization | null;
+    role: string | null;
+    isImpersonating: boolean;
+    impersonator: QarpeoUser | null;
+    token: {
+        id: string;
+        scopes: string[];
+    } | null;
+    isAdmin: boolean;
+    hasScope: (scope: string) => boolean;
+}
+export interface RequireAuthOptions {
+    role?: string | string[];
+    organization?: boolean;
+    scope?: string | string[];
+}
+export type AuthRouteRule = boolean | {
+    role?: string | string[];
+    organization?: boolean;
+    redirect?: string;
+};
+declare module "nitro/types" {
+    interface NitroRuntimeHooks {
+        "qarpeo:auth:oauth:success": (ctx: {
+            event: any;
+            provider: string;
+            user: QarpeoUser & {
+                isNew: boolean;
+            };
+            tokens: any;
+        }) => void | Promise<void>;
+        "qarpeo:auth:session:create": (ctx: {
+            event: any;
+            user: QarpeoUser;
+            session: QarpeoSession;
+        }) => void | Promise<void>;
+        "qarpeo:auth:otp:send": (ctx: {
+            email: string;
+            code: string;
+            type?: "otp" | "magic-link";
+        }) => void | Promise<void>;
+        "qarpeo:auth:magic-link:send": (ctx: {
+            email: string;
+            url: string;
+        }) => void | Promise<void>;
+        "qarpeo:auth:organization:invite": (ctx: {
+            organization: QarpeoOrganization;
+            invitation: QarpeoInvitation;
+            inviteUrl: string;
+        }) => void | Promise<void>;
+        "qarpeo:auth:organization:create": (ctx: {
+            organization: QarpeoOrganization;
+            owner: QarpeoUser;
+        }) => void | Promise<void>;
+    }
+}

package/dist/runtime/types/browser.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Cloudflare Browser Rendering binding representation. Represents the Worker Fetcher used to
+ * communicate with the headless Chromium instance.
+ */
+export interface BrowserBinding {
+    /** Fetcher to communicate directly with the Cloudflare Browser Rendering session */
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    [key: string]: any;
+}
+export interface QarpeoBrowser {
+    /** Access the raw underlying Cloudflare Browser Rendering binding fetcher. */
+    raw(bindingName?: string): BrowserBinding;
+    /** The underlying browser binding fetcher. */
+    readonly binding: BrowserBinding;
+    /**
+     * Launch a headless Chromium browser instance using `@cloudflare/puppeteer`. Requires
+     * `@cloudflare/puppeteer` to be installed.
+     *
+     * @param options Optional launch options passed to `puppeteer.launch(binding, options)`
+     */
+    launch(options?: Record<string, any>): Promise<any>;
+    /**
+     * Connect to an existing browser session using `@cloudflare/puppeteer`. Requires
+     * `@cloudflare/puppeteer` to be installed.
+     *
+     * @param sessionId The browser session ID
+     */
+    connect(sessionId: string): Promise<any>;
+}

package/dist/runtime/types/d1.d.ts

@@ -0,0 +1,44 @@
+/** Cloudflare D1 Database types. */
+export interface D1Result<T = Record<string, unknown>> {
+    results: T[];
+    success: boolean;
+    meta: Record<string, unknown>;
+    error?: string;
+}
+export interface D1ExecResult {
+    count: number;
+    duration: number;
+}
+export interface D1PreparedStatement {
+    /** Bind parameters to the SQL query. */
+    bind(...values: unknown[]): D1PreparedStatement;
+    /**
+     * Return the first row matching the query. Optionally specify a column name to return only that
+     * column value.
+     */
+    first<T = Record<string, unknown>>(): Promise<T | null>;
+    first<T = unknown>(colName: string): Promise<T | null>;
+    /** Execute the query and return all result rows. */
+    all<T = Record<string, unknown>>(): Promise<D1Result<T>>;
+    /** Execute a write query (INSERT, UPDATE, DELETE) and return execution metadata. */
+    run<T = Record<string, unknown>>(): Promise<D1Result<T>>;
+    /** Return raw arrays of rows without column keys. */
+    raw<T = unknown[]>(): Promise<T[]>;
+}
+export interface D1Database {
+    /** Prepare a SQL query for execution. */
+    prepare(query: string): D1PreparedStatement;
+    /** Execute multiple prepared statements sequentially in a single batch. */
+    batch<T = Record<string, unknown>>(statements: D1PreparedStatement[]): Promise<D1Result<T>[]>;
+    /**
+     * Execute one or more SQL statements directly (supports multiple statements separated by
+     * semicolons).
+     */
+    exec(query: string): Promise<D1ExecResult>;
+    /** Dump the database as a SQLite binary format. */
+    dump(): Promise<ArrayBuffer>;
+}
+export interface QarpeoDB extends D1Database {
+    /** Access the raw underlying Cloudflare D1Database binding. */
+    raw(bindingName?: string): D1Database;
+}