t3code-cli 0.12.0 → 0.14.0

package/dist/shared/composerInlineTokens.d.ts

@@ -0,0 +1,20 @@
+//#region upstream-t3code/packages/shared/src/composerInlineTokens.d.ts
+type ComposerInlineToken = {
+  readonly type: "mention";
+  readonly value: string;
+  readonly source: string;
+  readonly start: number;
+  readonly end: number;
+} | {
+  readonly type: "skill";
+  readonly value: string;
+  readonly source: string;
+  readonly start: number;
+  readonly end: number;
+};
+interface CollectComposerInlineTokensOptions {
+  readonly preserveTrailingFrom?: ReadonlyArray<ComposerInlineToken>;
+}
+declare function collectComposerInlineTokens(text: string, options?: CollectComposerInlineTokensOptions): ReadonlyArray<ComposerInlineToken>;
+//#endregion
+export { CollectComposerInlineTokensOptions, ComposerInlineToken, collectComposerInlineTokens };

package/dist/shared/composerInlineTokens.js

@@ -0,0 +1,72 @@
+//#region upstream-t3code/packages/shared/src/composerInlineTokens.ts
+const SKILL_TOKEN_REGEX = /(^|\s)\$([a-zA-Z][a-zA-Z0-9:_-]*)(?=\s)/g;
+const MENTION_TOKEN_REGEX = /(^|\s)@(?:"((?:\\.|[^"\\])*)"|([^\s@"]+))(?=\s)/g;
+const FILE_LINK_TOKEN_REGEX = /(^|\s)\[((?:\\.|[^\]\\])*)\]\(([^)\s]+)\)(?=\s)/g;
+const URI_SCHEME_REGEX = /^[A-Za-z][A-Za-z0-9+.-]*:/;
+const WINDOWS_DRIVE_PATH_REGEX = /^[A-Za-z]:[\\/]/;
+const SCOPED_PACKAGE_REFERENCE_REGEX = /^[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*(?:\/[^\s@"]+)*$/;
+function collectMentionTokens(text) {
+	const matches = [];
+	for (const match of text.matchAll(FILE_LINK_TOKEN_REGEX)) {
+		const fullMatch = match[0];
+		const prefix = match[1] ?? "";
+		const label = (match[2] ?? "").replace(/\\(.)/g, "$1");
+		const encodedPath = match[3] ?? "";
+		let path = encodedPath;
+		try {
+			path = decodeURIComponent(encodedPath);
+		} catch {}
+		const separatorIndex = Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\"));
+		const basename = separatorIndex >= 0 ? path.slice(separatorIndex + 1) : path;
+		const hasExternalScheme = URI_SCHEME_REGEX.test(path) && !WINDOWS_DRIVE_PATH_REGEX.test(path);
+		if (!path || hasExternalScheme || label !== basename) continue;
+		const start = (match.index ?? 0) + prefix.length;
+		const end = start + fullMatch.length - prefix.length;
+		matches.push({
+			type: "mention",
+			value: path,
+			source: text.slice(start, end),
+			start,
+			end
+		});
+	}
+	for (const match of text.matchAll(MENTION_TOKEN_REGEX)) {
+		const fullMatch = match[0];
+		const prefix = match[1] ?? "";
+		const quotedPath = match[2];
+		const path = quotedPath !== void 0 ? quotedPath.replace(/\\(.)/g, "$1") : match[3] ?? "";
+		if (!path || quotedPath === void 0 && SCOPED_PACKAGE_REFERENCE_REGEX.test(path)) continue;
+		const start = (match.index ?? 0) + prefix.length;
+		const end = start + fullMatch.length - prefix.length;
+		matches.push({
+			type: "mention",
+			value: path,
+			source: text.slice(start, end),
+			start,
+			end
+		});
+	}
+	return matches;
+}
+function collectComposerInlineTokens(text, options = {}) {
+	const matches = collectMentionTokens(text);
+	for (const match of text.matchAll(SKILL_TOKEN_REGEX)) {
+		const fullMatch = match[0];
+		const prefix = match[1] ?? "";
+		const value = match[2] ?? "";
+		if (!value) continue;
+		const start = (match.index ?? 0) + prefix.length;
+		const end = start + fullMatch.length - prefix.length;
+		matches.push({
+			type: "skill",
+			value,
+			source: text.slice(start, end),
+			start,
+			end
+		});
+	}
+	for (const token of options.preserveTrailingFrom ?? []) if (token.end === text.length && text.slice(token.start, token.end) === token.source && !matches.some((match) => match.type === token.type && match.start === token.start && match.end === token.end)) matches.push(token);
+	return [...matches].sort((left, right) => left.start - right.start);
+}
+//#endregion
+export { collectComposerInlineTokens };

package/dist/shared/composerTrigger.d.ts

@@ -0,0 +1,26 @@
+//#region upstream-t3code/packages/shared/src/composerTrigger.d.ts
+type ComposerTriggerKind = "path" | "slash-command" | "slash-model" | "skill";
+type ComposerSlashCommand = "model" | "plan" | "default";
+interface ComposerTrigger {
+  kind: ComposerTriggerKind;
+  query: string;
+  rangeStart: number;
+  rangeEnd: number;
+}
+declare function serializeComposerMentionPath(path: string): string;
+declare function serializeComposerFileLink(path: string): string;
+/**
+ * Detect an active trigger (@path, $skill, /command) at the cursor position.
+ *
+ * Accepts an optional `isWhitespaceChar` override so callers with inline
+ * placeholder characters (e.g. terminal context chips on web) can treat
+ * those as token boundaries.
+ */
+declare function detectComposerTrigger(text: string, cursorInput: number, isWhitespaceChar?: (char: string) => boolean): ComposerTrigger | null;
+declare function parseStandaloneComposerSlashCommand(text: string): Exclude<ComposerSlashCommand, "model"> | null;
+declare function replaceTextRange(text: string, rangeStart: number, rangeEnd: number, replacement: string): {
+  text: string;
+  cursor: number;
+};
+//#endregion
+export { ComposerSlashCommand, ComposerTrigger, ComposerTriggerKind, detectComposerTrigger, parseStandaloneComposerSlashCommand, replaceTextRange, serializeComposerFileLink, serializeComposerMentionPath };

package/dist/shared/composerTrigger.js

@@ -0,0 +1,97 @@
+//#region upstream-t3code/packages/shared/src/composerTrigger.ts
+const SIMPLE_MENTION_PATH_REGEX = /^[^\s@"\\]+$/;
+function serializeComposerMentionPath(path) {
+	if (SIMPLE_MENTION_PATH_REGEX.test(path)) return path;
+	return `"${path.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"`;
+}
+function composerFileLinkBasename(path) {
+	const separatorIndex = Math.max(path.lastIndexOf("/"), path.lastIndexOf("\\"));
+	return separatorIndex >= 0 ? path.slice(separatorIndex + 1) : path;
+}
+function escapeMarkdownLinkLabel(label) {
+	return label.replaceAll("\\", "\\\\").replaceAll("[", "\\[").replaceAll("]", "\\]");
+}
+function encodeMarkdownLinkDestination(path) {
+	return encodeURI(path).replaceAll("(", "%28").replaceAll(")", "%29").replaceAll("#", "%23").replaceAll("?", "%3F").replaceAll("\\", "%5C");
+}
+function serializeComposerFileLink(path) {
+	return `[${escapeMarkdownLinkLabel(composerFileLinkBasename(path))}](${encodeMarkdownLinkDestination(path)})`;
+}
+function clampCursor(text, cursor) {
+	if (!Number.isFinite(cursor)) return text.length;
+	return Math.max(0, Math.min(text.length, Math.floor(cursor)));
+}
+function isWhitespace(char) {
+	return char === " " || char === "\n" || char === "	" || char === "\r";
+}
+/**
+* Detect an active trigger (@path, $skill, /command) at the cursor position.
+*
+* Accepts an optional `isWhitespaceChar` override so callers with inline
+* placeholder characters (e.g. terminal context chips on web) can treat
+* those as token boundaries.
+*/
+function detectComposerTrigger(text, cursorInput, isWhitespaceChar) {
+	const cursor = clampCursor(text, cursorInput);
+	const lineStart = text.lastIndexOf("\n", Math.max(0, cursor - 1)) + 1;
+	const linePrefix = text.slice(lineStart, cursor);
+	if (linePrefix.startsWith("/")) {
+		const commandMatch = /^\/(\S*)$/.exec(linePrefix);
+		if (commandMatch) {
+			const commandQuery = commandMatch[1] ?? "";
+			if (commandQuery.toLowerCase() === "model") return {
+				kind: "slash-model",
+				query: "",
+				rangeStart: lineStart,
+				rangeEnd: cursor
+			};
+			return {
+				kind: "slash-command",
+				query: commandQuery,
+				rangeStart: lineStart,
+				rangeEnd: cursor
+			};
+		}
+		const modelMatch = /^\/model(?:\s+(.*))?$/.exec(linePrefix);
+		if (modelMatch) return {
+			kind: "slash-model",
+			query: (modelMatch[1] ?? "").trim(),
+			rangeStart: lineStart,
+			rangeEnd: cursor
+		};
+	}
+	const wsCheck = isWhitespaceChar ?? isWhitespace;
+	let tokenIdx = cursor - 1;
+	while (tokenIdx >= 0 && !wsCheck(text[tokenIdx] ?? "")) tokenIdx -= 1;
+	const tokenStart = tokenIdx + 1;
+	const token = text.slice(tokenStart, cursor);
+	if (token.startsWith("$")) return {
+		kind: "skill",
+		query: token.slice(1),
+		rangeStart: tokenStart,
+		rangeEnd: cursor
+	};
+	if (!token.startsWith("@")) return null;
+	return {
+		kind: "path",
+		query: token.slice(1),
+		rangeStart: tokenStart,
+		rangeEnd: cursor
+	};
+}
+function parseStandaloneComposerSlashCommand(text) {
+	const match = /^\/(plan|default)\s*$/i.exec(text.trim());
+	if (!match) return null;
+	if (match[1]?.toLowerCase() === "plan") return "plan";
+	return "default";
+}
+function replaceTextRange(text, rangeStart, rangeEnd, replacement) {
+	const safeStart = Math.max(0, Math.min(text.length, rangeStart));
+	const safeEnd = Math.max(safeStart, Math.min(text.length, rangeEnd));
+	return {
+		text: `${text.slice(0, safeStart)}${replacement}${text.slice(safeEnd)}`,
+		cursor: safeStart + replacement.length
+	};
+}
+//#endregion
+export { detectComposerTrigger, parseStandaloneComposerSlashCommand, replaceTextRange, serializeComposerFileLink, serializeComposerMentionPath };

package/dist/shared/connectAuth.d.ts

@@ -0,0 +1,58 @@
+//#region upstream-t3code/packages/shared/src/connectAuth.d.ts
+/**
+ * The CLI prints URLs against this origin and the web bundle uses it to
+ * decide whether it is the hosted deployment — the two must agree, so the
+ * default lives here.
+ */
+declare const DEFAULT_HOSTED_APP_URL = "https://app.t3.codes";
+/**
+ * Requested at authorize time by the hosted page and honored by the CLI's
+ * token exchange; keep both sides on this single definition.
+ */
+declare const CONNECT_OAUTH_SCOPES: readonly ["openid", "profile", "email"];
+interface ConnectAuthorizeRequest {
+  readonly state: string;
+  readonly challenge: string;
+}
+/**
+ * The URL a headless CLI prints for the user to open on a machine with a
+ * browser. `state` and `code_challenge` ride the fragment so they never reach
+ * the hosted app's server or CDN logs; neither is a secret.
+ */
+declare function buildConnectAuthorizeRequestUrl(input: {
+  readonly hostedAppUrl: string;
+  readonly state: string;
+  readonly challenge: string;
+}): string;
+declare function readConnectAuthorizeRequest(url: URL): ConnectAuthorizeRequest | null;
+declare function connectCallbackUrl(hostedAppUrl: string): string;
+declare function buildConnectClerkAuthorizeUrl(input: {
+  readonly authorizationEndpoint: string;
+  readonly clientId: string;
+  readonly redirectUri: string;
+  readonly scopes: ReadonlyArray<string>;
+  readonly state: string;
+  readonly challenge: string;
+}): string;
+interface ConnectAuthCode {
+  readonly code: string;
+  readonly state: string;
+}
+/**
+ * The single blob the hosted callback page displays and the CLI accepts.
+ * Bundling `state` with the authorization code lets the CLI keep the loopback
+ * flow's CSRF check without any backend: it verifies the returned state
+ * matches the one it generated. Clerk authorization codes and the CLI's
+ * base64url states never contain ".".
+ */
+declare function encodeConnectAuthCode(input: ConnectAuthCode): string;
+/**
+ * Validates an out-of-band authorization code against the state of the request this process
+ * generated. Returns the parsed code or a user-facing error message; both
+ * the prompt's live validation and the authoritative post-prompt check go
+ * through here so they cannot drift.
+ */
+declare function checkConnectAuthCode(blob: string, expectedState: string): ConnectAuthCode | string;
+declare function parseConnectAuthCode(blob: string): ConnectAuthCode | null;
+//#endregion
+export { CONNECT_OAUTH_SCOPES, ConnectAuthCode, ConnectAuthorizeRequest, DEFAULT_HOSTED_APP_URL, buildConnectAuthorizeRequestUrl, buildConnectClerkAuthorizeUrl, checkConnectAuthCode, connectCallbackUrl, encodeConnectAuthCode, parseConnectAuthCode, readConnectAuthorizeRequest };

package/dist/shared/connectAuth.js

@@ -0,0 +1,89 @@
+import { Sa as readHashParams } from "../shared.js";
+//#region upstream-t3code/packages/shared/src/connectAuth.ts
+const CONNECT_AUTH_STATE_PARAM = "state";
+const CONNECT_AUTH_CHALLENGE_PARAM = "challenge";
+const CONNECT_AUTH_CODE_SEPARATOR = ".";
+const CONNECT_AUTHORIZE_PATH = "/connect";
+const CONNECT_CALLBACK_PATH = "/connect/callback";
+/**
+* The CLI prints URLs against this origin and the web bundle uses it to
+* decide whether it is the hosted deployment — the two must agree, so the
+* default lives here.
+*/
+const DEFAULT_HOSTED_APP_URL = "https://app.t3.codes";
+/**
+* Requested at authorize time by the hosted page and honored by the CLI's
+* token exchange; keep both sides on this single definition.
+*/
+const CONNECT_OAUTH_SCOPES = [
+	"openid",
+	"profile",
+	"email"
+];
+/**
+* The URL a headless CLI prints for the user to open on a machine with a
+* browser. `state` and `code_challenge` ride the fragment so they never reach
+* the hosted app's server or CDN logs; neither is a secret.
+*/
+function buildConnectAuthorizeRequestUrl(input) {
+	const url = new URL(CONNECT_AUTHORIZE_PATH, input.hostedAppUrl);
+	url.hash = new URLSearchParams([[CONNECT_AUTH_STATE_PARAM, input.state], [CONNECT_AUTH_CHALLENGE_PARAM, input.challenge]]).toString();
+	return url.toString();
+}
+function readConnectAuthorizeRequest(url) {
+	const params = readHashParams(url);
+	const state = params.get(CONNECT_AUTH_STATE_PARAM)?.trim() ?? "";
+	const challenge = params.get(CONNECT_AUTH_CHALLENGE_PARAM)?.trim() ?? "";
+	if (!state || !challenge) return null;
+	return {
+		state,
+		challenge
+	};
+}
+function connectCallbackUrl(hostedAppUrl) {
+	return new URL(CONNECT_CALLBACK_PATH, hostedAppUrl).toString();
+}
+function buildConnectClerkAuthorizeUrl(input) {
+	const url = new URL(input.authorizationEndpoint);
+	url.searchParams.set("client_id", input.clientId);
+	url.searchParams.set("redirect_uri", input.redirectUri);
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("scope", input.scopes.join(" "));
+	url.searchParams.set("state", input.state);
+	url.searchParams.set("code_challenge", input.challenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	return url.toString();
+}
+/**
+* The single blob the hosted callback page displays and the CLI accepts.
+* Bundling `state` with the authorization code lets the CLI keep the loopback
+* flow's CSRF check without any backend: it verifies the returned state
+* matches the one it generated. Clerk authorization codes and the CLI's
+* base64url states never contain ".".
+*/
+function encodeConnectAuthCode(input) {
+	return `${input.code}${CONNECT_AUTH_CODE_SEPARATOR}${input.state}`;
+}
+/**
+* Validates an out-of-band authorization code against the state of the request this process
+* generated. Returns the parsed code or a user-facing error message; both
+* the prompt's live validation and the authoritative post-prompt check go
+* through here so they cannot drift.
+*/
+function checkConnectAuthCode(blob, expectedState) {
+	const parsed = parseConnectAuthCode(blob);
+	if (parsed === null) return "That does not look like a T3 Connect code. Copy the full code.";
+	if (parsed.state !== expectedState) return "That code belongs to a different connect request. Open the URL above and try again.";
+	return parsed;
+}
+function parseConnectAuthCode(blob) {
+	const trimmed = blob.trim();
+	const separatorIndex = trimmed.lastIndexOf(CONNECT_AUTH_CODE_SEPARATOR);
+	if (separatorIndex <= 0 || separatorIndex === trimmed.length - 1) return null;
+	return {
+		code: trimmed.slice(0, separatorIndex),
+		state: trimmed.slice(separatorIndex + 1)
+	};
+}
+//#endregion
+export { CONNECT_OAUTH_SCOPES, DEFAULT_HOSTED_APP_URL, buildConnectAuthorizeRequestUrl, buildConnectClerkAuthorizeUrl, checkConnectAuthCode, connectCallbackUrl, encodeConnectAuthCode, parseConnectAuthCode, readConnectAuthorizeRequest };

package/dist/shared/devHome.d.ts

@@ -0,0 +1,21 @@
+import * as Effect from "effect/Effect";
+import * as Path from "effect/Path";
+import * as FileSystem from "effect/FileSystem";
+//#region upstream-t3code/packages/shared/src/devHome.d.ts
+/**
+ * The path of the linked git worktree containing `cwd`, or undefined when
+ * `cwd` is not inside one. Git marks a linked worktree by making `.git` a file
+ * whose `gitdir:` points into the repository's `.git/worktrees`.
+ *
+ * Walks up to the repository root, so running from a subdirectory resolves the
+ * same worktree as running from the top.
+ */
+declare const resolveGitWorktreePath: (cwd: string) => Effect.Effect<string | undefined, never, FileSystem.FileSystem | Path.Path>;
+/**
+ * The worktree-local data directory for `cwd`, or undefined outside a linked
+ * worktree. Deliberately does not require the directory to exist yet: falling
+ * back because it is missing would send callers at the shared home.
+ */
+declare const resolveWorktreeT3Home: (cwd: string) => Effect.Effect<string | undefined, never, FileSystem.FileSystem | Path.Path>;
+//#endregion
+export { resolveGitWorktreePath, resolveWorktreeT3Home };

package/dist/shared/devHome.js

@@ -0,0 +1,65 @@
+import { Bk as isSome, OE as FileSystem, TE as Path, _O as orElseSucceed, aO as gen, hO as option } from "../shared.js";
+//#region upstream-t3code/packages/shared/src/devHome.ts
+/**
+* Where development state lives, and how to keep it away from the shared
+* `~/.t3` that a user's installed T3 Code runs against.
+*
+* A linked git worktree gets its own (gitignored) `.t3`: feature work in a
+* throwaway branch must not share a database with the real app, and an ambient
+* `T3CODE_HOME` counts as an explicit base dir — flipping the state directory
+* from `<base>/dev` to `<base>/userdata`, the live production database.
+*/
+/**
+* A `.git` file points at the real git directory. A linked worktree's lives at
+* `<common-dir>/worktrees/<name>`; a submodule's at
+* `<super-git-dir>/modules/<name>`. Both are files, so the pointer — not the
+* file-vs-directory distinction alone — is what identifies a worktree.
+*
+* The common dir is not necessarily named `.git`: a worktree of a bare repo
+* points at `<repo>.git/worktrees/<name>`, and `$GIT_COMMON_DIR` can be
+* anything. So match on the `worktrees/<name>` tail, which git always uses,
+* rather than on the name of the directory containing it.
+*/
+const pointsAtLinkedWorktree = (gitFileContents, path) => {
+	const gitdir = gitFileContents.split(/\r?\n/).map((line) => line.trim()).find((line) => line.startsWith("gitdir:"))?.slice(7).trim();
+	if (gitdir === void 0 || gitdir.length === 0) return false;
+	const segments = path.normalize(gitdir.replaceAll("\\", "/")).split(/[/\\]/).filter((segment) => segment.length > 0);
+	return segments.length >= 3 && segments.at(-2) === "worktrees";
+};
+/**
+* The path of the linked git worktree containing `cwd`, or undefined when
+* `cwd` is not inside one. Git marks a linked worktree by making `.git` a file
+* whose `gitdir:` points into the repository's `.git/worktrees`.
+*
+* Walks up to the repository root, so running from a subdirectory resolves the
+* same worktree as running from the top.
+*/
+const resolveGitWorktreePath = (cwd) => gen(function* () {
+	const fileSystem = yield* FileSystem;
+	const path = yield* Path;
+	let directory = path.resolve(cwd);
+	for (;;) {
+		const gitPath = path.join(directory, ".git");
+		const info = yield* fileSystem.stat(gitPath).pipe(option);
+		if (isSome(info)) {
+			if (info.value.type !== "File") return;
+			const contents = yield* fileSystem.readFileString(gitPath).pipe(orElseSucceed(() => ""));
+			return pointsAtLinkedWorktree(contents, path) ? directory : void 0;
+		}
+		const parent = path.dirname(directory);
+		if (parent === directory) return;
+		directory = parent;
+	}
+});
+/**
+* The worktree-local data directory for `cwd`, or undefined outside a linked
+* worktree. Deliberately does not require the directory to exist yet: falling
+* back because it is missing would send callers at the shared home.
+*/
+const resolveWorktreeT3Home = (cwd) => gen(function* () {
+	const worktreePath = yield* resolveGitWorktreePath(cwd);
+	if (worktreePath === void 0) return;
+	return (yield* Path).join(worktreePath, ".t3");
+});
+//#endregion
+export { resolveGitWorktreePath, resolveWorktreeT3Home };

package/dist/shared/devProxy.d.ts

@@ -0,0 +1,15 @@
+//#region upstream-t3code/packages/shared/src/devProxy.d.ts
+/**
+ * Backend paths the web dev server proxies in single-origin browser dev.
+ *
+ * Two consumers must agree on this list: the Vite proxy map
+ * (apps/web/vite.config.ts) that forwards these to the backend, and the
+ * server's dev catch-all (apps/server/src/http.ts) that 404s them instead of
+ * redirecting back to Vite. Drift is silent and nasty in both directions — a
+ * prefix only Vite knows gets answered with index.html; a prefix only the
+ * server knows redirect-loops through the proxy.
+ */
+declare const DEV_PROXIED_PATH_PREFIXES: readonly ["/api", "/oauth", "/.well-known", "/ws"];
+declare function isDevProxiedPath(pathname: string): boolean;
+//#endregion
+export { DEV_PROXIED_PATH_PREFIXES, isDevProxiedPath };

package/dist/shared/devProxy.js

@@ -0,0 +1,22 @@
+//#region upstream-t3code/packages/shared/src/devProxy.ts
+/**
+* Backend paths the web dev server proxies in single-origin browser dev.
+*
+* Two consumers must agree on this list: the Vite proxy map
+* (apps/web/vite.config.ts) that forwards these to the backend, and the
+* server's dev catch-all (apps/server/src/http.ts) that 404s them instead of
+* redirecting back to Vite. Drift is silent and nasty in both directions — a
+* prefix only Vite knows gets answered with index.html; a prefix only the
+* server knows redirect-loops through the proxy.
+*/
+const DEV_PROXIED_PATH_PREFIXES = [
+	"/api",
+	"/oauth",
+	"/.well-known",
+	"/ws"
+];
+function isDevProxiedPath(pathname) {
+	return DEV_PROXIED_PATH_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
+//#endregion
+export { DEV_PROXIED_PATH_PREFIXES, isDevProxiedPath };

package/dist/shared/dpop.d.ts

@@ -0,0 +1,32 @@
+import { n as normalizeDpopHtu, t as DpopPublicJwk$1 } from "../shared.js";
+import * as Schema from "effect/Schema";
+//#region upstream-t3code/packages/shared/src/dpop.d.ts
+declare const DpopPublicJwk: Schema.Struct<{
+  readonly kty: Schema.Literal<"EC">;
+  readonly crv: Schema.Literal<"P-256">;
+  readonly x: Schema.String;
+  readonly y: Schema.String;
+}>;
+type DpopPublicJwk = DpopPublicJwk$1;
+type DpopVerificationResult = {
+  readonly ok: true;
+  readonly thumbprint: string;
+  readonly jti: string;
+  readonly iat: number;
+} | {
+  readonly ok: false;
+  readonly reason: string;
+};
+declare function computeDpopJwkThumbprint(jwk: DpopPublicJwk$1): string;
+declare function computeDpopAccessTokenHash(accessToken: string): string;
+declare function verifyDpopProof(input: {
+  readonly proof: string | null | undefined;
+  readonly method: string;
+  readonly url: string;
+  readonly nowEpochSeconds: number;
+  readonly expectedThumbprint?: string;
+  readonly expectedAccessToken?: string;
+  readonly maxAgeSeconds?: number;
+}): DpopVerificationResult;
+//#endregion
+export { DpopPublicJwk, DpopVerificationResult, computeDpopAccessTokenHash, computeDpopJwkThumbprint, normalizeDpopHtu, verifyDpopProof };