## Public API Report File for "@grackle-ai/auth"

> Do not edit this file. It is a report generated by [API Extractor](https://api-extractor.com/).

```ts

import type http from 'node:http';
import type { ServerResponse } from 'node:http';

// @public
export interface AuthCodeRecord {
    // (undocumented)
    clientId: string;
    // (undocumented)
    code: string;
    // (undocumented)
    codeChallenge: string;
    // (undocumented)
    createdAt: number;
    // (undocumented)
    expiresAt: number;
    // (undocumented)
    redirectUri: string;
    // (undocumented)
    resource: string;
}

// @public
export type AuthContext = {
    type: "api-key";
} | {
    type: "scoped";
    taskId: string;
    workspaceId?: string;
    personaId: string;
    taskSessionId: string;
} | {
    type: "oauth";
    clientId: string;
};

// @public
export function authenticateMcpRequest(req: http.IncomingMessage, apiKey: string): AuthContext | undefined;

// @public
export interface AuthLogger {
    // (undocumented)
    info(obj: object, msg: string, ...args: unknown[]): void;
    // (undocumented)
    warn(objOrMsg: object | string, msg?: string, ...args: unknown[]): void;
}

// @public
export function clearOAuthState(): void;

// @public
export function clearPairing(): void;

// @public
export function clearSessions(): void;

// @public
export interface ClientRecord {
    // (undocumented)
    clientId: string;
    // (undocumented)
    clientName: string;
    // (undocumented)
    createdAt: number;
    // (undocumented)
    redirectUris: string[];
}

// @public
export function computeCodeChallenge(codeVerifier: string): string;

// @public
export function consumeAuthorizationCode(code: string, clientId: string, redirectUri: string, codeVerifier: string, resource: string): AuthCodeRecord | undefined;

// @public
export function consumeRefreshToken(token: string, clientId: string): RefreshTokenRecord | undefined;

// @public
export function createAuthorizationCode(clientId: string, redirectUri: string, codeChallenge: string, resource: string): string;

// @public
export function createOAuthAccessToken(clientId: string, resource: string, signingSecret: string, ttlMs?: number): string;

// @public
export function createRefreshToken(clientId: string, resource: string): string;

// @public
export function createScopedToken(claims: Pick<ScopedTokenClaims, "sub" | "pid" | "per" | "sid">, signingSecret: string, ttlMs?: number): string;

// @public
export function createSession(apiKey: string, options?: {
    secure?: boolean;
}): string;

// @public
export const defaultAuthLogger: AuthLogger;

// @public
export function generatePairingCode(): string | undefined;

// @public
export function getClient(clientId: string): ClientRecord | undefined;

// @public
export function isRevokedTask(taskId: string): boolean;

// @public
export function loadOrCreateApiKey(homePath: string): string;

// @public
export const OAUTH_ACCESS_TOKEN_TTL_MS: number;

// @public
export const OAUTH_REFRESH_TOKEN_TTL_MS: number;

// @public
export interface OAuthTokenClaims {
    aud: string;
    exp: number;
    iat: number;
    sub: string;
    typ: "oauth";
}

// @public
export function parseCookies(header: string): Record<string, string>;

// @public
export function pruneRevocations(ttlMs?: number): void;

// @public
export function redeemPairingCode(code: string, remoteIp: string): boolean;

// @public
export interface RefreshTokenRecord {
    // (undocumented)
    clientId: string;
    // (undocumented)
    createdAt: number;
    // (undocumented)
    expiresAt: number;
    // (undocumented)
    resource: string;
    // (undocumented)
    token: string;
}

// @public
export function registerClient(redirectUris: string[], clientName?: string): ClientRecord | undefined;

// @public
export function revokeTask(taskId: string): void;

// @public
export interface ScopedTokenClaims {
    exp: number;
    iat: number;
    per: string;
    pid: string;
    sid: string;
    sub: string;
}

// @public
export const SESSION_COOKIE_NAME: string;

// @public
export function setAuthLogger(l: AuthLogger): void;

// @public
export function setSecurityHeaders(res: ServerResponse, requestHost?: string): void;

// @public
export function startOAuthCleanup(): void;

// @public
export function startPairingCleanup(): void;

// @public
export function startSessionCleanup(): void;

// @public
export function stopOAuthCleanup(): void;

// @public
export function stopPairingCleanup(): void;

// @public
export function stopSessionCleanup(): void;

// @public
export function validateSessionCookie(cookieHeader: string, apiKey: string): boolean;

// @public
export function verifyApiKey(token: string): boolean;

// @public
export function verifyCodeChallenge(codeVerifier: string, codeChallenge: string): boolean;

// @public
export function verifyOAuthAccessToken(token: string, signingSecret: string): OAuthTokenClaims | undefined;

// @public
export function verifyScopedToken(token: string, signingSecret: string): ScopedTokenClaims | undefined;

// @public
export const WEB_CONTENT_SECURITY_POLICY: string;

// Warnings were encountered during analysis:
//
// src/scoped-token.ts:168:1 - (ae-internal-missing-underscore) The name "clearRevocations" should be prefixed with an underscore because the declaration is marked as @internal

// (No @packageDocumentation comment for this package)

```
