@ganju/utils 0.0.3 → 0.0.5

package/dist/accessToken.d.ts

@@ -0,0 +1,25 @@
+/** The SHA-256 of a presented token, in the encoding the column stores. */
+export declare const hashAccessToken: (token: string) => Promise<string>;
+/**
+ * Cheap enough to run before the database is touched: a bearer token that does
+ * not carry the prefix is an OAuth token, and belongs on the other path.
+ */
+export declare const isAccessToken: (token: string) => boolean;
+/**
+ * What the dashboard shows beside a token's name.
+ *
+ * Enough to tell two rows apart when someone is deciding which to revoke, and
+ * deliberately taken from the *front* of the secret rather than the end: a
+ * prefix narrows a brute-force search by exactly as much as a suffix would, and
+ * a value people are used to seeing truncated at the end reads as complete when
+ * it is the end that is shown.
+ */
+export declare const accessTokenHint: (token: string) => string;
+export interface MintedAccessToken {
+    /** The only time this value exists. Returned to the caller, never stored. */
+    token: string;
+    tokenHash: string;
+    hint: string;
+}
+export declare const mintAccessToken: () => Promise<MintedAccessToken>;
+//# sourceMappingURL=accessToken.d.ts.map

package/dist/accessToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessToken.d.ts","sourceRoot":"","sources":["../src/accessToken.ts"],"names":[],"mappings":"AA+BA,2EAA2E;AAC3E,eAAO,MAAM,eAAe,GAAU,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAMnE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,KAAG,OACG,CAAC;AAElD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,MAI1B,CAAC;AAEvB,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,eAAe,QAAa,OAAO,CAAC,iBAAiB,CASjE,CAAC"}

package/dist/accessToken.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mintAccessToken = exports.accessTokenHint = exports.isAccessToken = exports.hashAccessToken = void 0;
+const constants_1 = require("./constants");
+/**
+ * Minting and recognising a personal access token.
+ *
+ * The value exists in plaintext exactly once — in the response to the request
+ * that created it — and what the database holds is its SHA-256. That is the
+ * property the whole credential rests on: a leaked backup, a stray log line, or
+ * a support engineer reading the row learns nothing they could present as the
+ * token, and there is no path in the product that can print one back, because
+ * there is nothing to print.
+ *
+ * SHA-256 rather than a password hash on purpose. A password is a low-entropy
+ * secret a person chose, so the cost of hashing it is what stands between a
+ * stolen table and the passwords in it; this is 32 bytes from a CSPRNG, where
+ * that cost buys nothing and would be paid on every authenticated request. It
+ * is also the hash `oauth_client.client_secret` already uses in this system, so
+ * there is one answer here to "how is a machine credential stored".
+ */
+const HINT_SEPARATOR = '…';
+const base64url = (bytes) => {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+};
+/** The SHA-256 of a presented token, in the encoding the column stores. */
+const hashAccessToken = async (token) => {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(token));
+    return base64url(new Uint8Array(digest));
+};
+exports.hashAccessToken = hashAccessToken;
+/**
+ * Cheap enough to run before the database is touched: a bearer token that does
+ * not carry the prefix is an OAuth token, and belongs on the other path.
+ */
+const isAccessToken = (token) => token.startsWith(constants_1.constants.ACCESS_TOKEN_PREFIX);
+exports.isAccessToken = isAccessToken;
+/**
+ * What the dashboard shows beside a token's name.
+ *
+ * Enough to tell two rows apart when someone is deciding which to revoke, and
+ * deliberately taken from the *front* of the secret rather than the end: a
+ * prefix narrows a brute-force search by exactly as much as a suffix would, and
+ * a value people are used to seeing truncated at the end reads as complete when
+ * it is the end that is shown.
+ */
+const accessTokenHint = (token) => `${token.slice(0, constants_1.constants.ACCESS_TOKEN_PREFIX.length + constants_1.constants.ACCESS_TOKEN_HINT_CHARS)}${HINT_SEPARATOR}`;
+exports.accessTokenHint = accessTokenHint;
+const mintAccessToken = async () => {
+    const bytes = new Uint8Array(constants_1.constants.ACCESS_TOKEN_BYTES);
+    crypto.getRandomValues(bytes);
+    const token = `${constants_1.constants.ACCESS_TOKEN_PREFIX}${base64url(bytes)}`;
+    return {
+        token,
+        tokenHash: await (0, exports.hashAccessToken)(token),
+        hint: (0, exports.accessTokenHint)(token)
+    };
+};
+exports.mintAccessToken = mintAccessToken;

package/dist/constants.d.ts

@@ -519,6 +519,10 @@ export declare const constants: {
     CUSTOM_CODE_MAX_FILE_PATH: number;
     CUSTOM_CODE_VERSION_STATUSES: ("draft" | "published" | "archived")[];
     CUSTOM_CODE_SCRIPT_NAME_PREFIX: string;
+    CUSTOM_CODE_SCRIPT_NAME_MAX: number;
+    CUSTOM_CODE_UPLOAD_SUFFIX_CHARS: number;
+    CUSTOM_CODE_SWEEP_GRACE_MS: number;
+    CUSTOM_CODE_SWEEP_MAX_DELETES: number;
     CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX: string;
     CUSTOM_CODE_PREVIEW_TOKEN_TTL_MS: number;
     CUSTOM_CODE_TEST_TIMEOUT_MS: number;
@@ -560,8 +564,8 @@ export declare const constants: {
     CUSTOM_CODE_BROKER_SERVICE_ENV: string;
     CUSTOM_CODE_COMPATIBILITY_DATE: string;
     CUSTOM_CODE_SCRIPT_CPU_MS: number;
-    CUSTOM_CODE_SMOKE_TIMEOUT_MS: number;
-    CUSTOM_CODE_SMOKE_INTERVAL_MS: number;
+    CUSTOM_CODE_REGISTER_TIMEOUT_MS: number;
+    CUSTOM_CODE_REGISTER_INTERVAL_MS: number;
     CUSTOM_CODE_MAX_LOGS: number;
     CUSTOM_CODE_MAX_LOG_LENGTH: number;
     CUSTOM_CODE_SEND_FILE_TARGET_GMAIL: "gmail";
@@ -614,6 +618,15 @@ export declare const constants: {
     CLI_OAUTH_REDIRECT_PORTS: number[];
     CLI_OAUTH_SCOPES: string[];
     CLI_TOKEN_REFRESH_SKEW_SECONDS: number;
+    ACCESS_TOKEN_PREFIX: string;
+    ACCESS_TOKEN_BYTES: number;
+    ACCESS_TOKEN_HINT_CHARS: number;
+    ACCESS_TOKEN_NAME_MAX: number;
+    ACCESS_TOKEN_MAX_PER_PROJECT: number;
+    ACCESS_TOKEN_MAX_EXPIRY_DAYS: number;
+    ACCESS_TOKEN_LAST_USED_INTERVAL_MS: number;
+    ACCESS_TOKEN_UNSCOPED_PATHS: string[];
+    ACCESS_TOKEN_SCOPE_MESSAGE: string;
     CUSTOM_CODE_LOGS_DEFAULT_LIMIT: number;
     CUSTOM_CODE_LOGS_MAX_LIMIT: number;
     BOT_GRANT_TYPE: string;

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AA6JA,QAAA,MAAM,yBAAyB,EAAiB,UAAU,CAAC;AAC3D,QAAA,MAAM,+BAA+B,EAAuB,gBAAgB,CAAC;AAC7E,QAAA,MAAM,8BAA8B,EAAsB,eAAe,CAAC;AAC1E,QAAA,MAAM,wBAAwB,EAAgB,SAAS,CAAC;AAuCxD,QAAA,MAAM,sBAAsB,EAAiB,UAAU,CAAC;AACxD,QAAA,MAAM,4BAA4B,EAAuB,gBAAgB,CAAC;AAC1E,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAClD,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAmYlD,QAAA,MAAM,sBAAsB,EAAkB,WAAW,CAAC;AAC1D,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAGjD,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAkTjD,MAAM,MAAM,mBAAmB,GAC3B;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAg4BpE,UAAU,UAAU;IAElB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAMjC,sBAAsB,EAAE,MAAM,CAAC;IAM/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IAKnB,eAAe,EAAE,OAAO,CAAC;IAOzB,gBAAgB,EAAE,OAAO,CAAC;IAK1B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAqKD,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA5zDhB,OAAO,yBAAyB,GAChC,OAAO,+BAA+B,GACtC,OAAO,8BAA8B,GACrC,OAAO,wBAAwB;eAC5B,MAAM;;;;;;;;;;;;;;;;;;eAsCT,OAAO,sBAAsB,GAC7B,OAAO,4BAA4B,GACnC,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB;eACxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6YT,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,sBAAsB;eAC1B,MAAM;eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6NwB,MAAM,GAAG,MAAM;cAAQ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmsDnE,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AA6JA,QAAA,MAAM,yBAAyB,EAAiB,UAAU,CAAC;AAC3D,QAAA,MAAM,+BAA+B,EAAuB,gBAAgB,CAAC;AAC7E,QAAA,MAAM,8BAA8B,EAAsB,eAAe,CAAC;AAC1E,QAAA,MAAM,wBAAwB,EAAgB,SAAS,CAAC;AAuCxD,QAAA,MAAM,sBAAsB,EAAiB,UAAU,CAAC;AACxD,QAAA,MAAM,4BAA4B,EAAuB,gBAAgB,CAAC;AAC1E,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAClD,QAAA,MAAM,oBAAoB,EAAe,QAAQ,CAAC;AAmYlD,QAAA,MAAM,sBAAsB,EAAkB,WAAW,CAAC;AAC1D,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAGjD,QAAA,MAAM,mBAAmB,EAAe,QAAQ,CAAC;AAkTjD,MAAM,MAAM,mBAAmB,GAC3B;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9D;IACE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GACD;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAi9BpE,UAAU,UAAU;IAElB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAMjC,sBAAsB,EAAE,MAAM,CAAC;IAM/B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IAKnB,eAAe,EAAE,OAAO,CAAC;IAOzB,gBAAgB,EAAE,OAAO,CAAC;IAK1B,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAqKD,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA74DhB,OAAO,yBAAyB,GAChC,OAAO,+BAA+B,GACtC,OAAO,8BAA8B,GACrC,OAAO,wBAAwB;eAC5B,MAAM;;;;;;;;;;;;;;;;;;eAsCT,OAAO,sBAAsB,GAC7B,OAAO,4BAA4B,GACnC,OAAO,oBAAoB,GAC3B,OAAO,oBAAoB;eACxB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6YT,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,sBAAsB;eAC1B,MAAM;eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6NwB,MAAM,GAAG,MAAM;cAAQ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiyDnE,CAAC"}

package/dist/constants.js

@@ -1041,9 +1041,36 @@ const CUSTOM_CODE_MAIN_MODULE = 'index.js';
 // object read on every deploy.
 const CUSTOM_CODE_MAX_FILES = 25;
 const CUSTOM_CODE_MAX_FILE_PATH = 100;
-// WfP script name: `artifact_<artifactId>`. The id, never the slug — slugs are
-// user-editable and a rename would orphan the deployed script.
+// WfP script name: `artifact_<artifactId>_<upload>`. The id, never the slug —
+// slugs are user-editable and a rename would orphan the deployed script.
+//
+// The trailing segment is minted per upload rather than derived from anything,
+// which is the whole point: uploading over a name that already exists is not
+// read-your-writes, so a deploy that replaces a script can serve the previous
+// edition for up to half a minute. A name nothing has ever used cannot, and
+// costs nothing to mint. Everything a publish used to do to survive that race —
+// waiting on an edition marker, refusing with a 503, putting the previous bundle
+// back when validation failed — went with the reuse that caused it.
 const CUSTOM_CODE_SCRIPT_NAME_PREFIX = 'artifact_';
+// Worker names cap at 63 characters, and `artifact_<uuid>` already spends 45.
+// That leaves 17 for a separator and a suffix, so a second uuid does not fit and
+// neither does a hex-32 digest. Twelve hex characters is 48 bits against a
+// namespace holding at most a few hundred names for any one artifact — not a
+// collision worth checking for, and an upload to a name in use would fail loudly
+// rather than quietly serve the wrong code.
+const CUSTOM_CODE_SCRIPT_NAME_MAX = 63;
+const CUSTOM_CODE_UPLOAD_SUFFIX_CHARS = 12;
+// How long a superseded script stays in the namespace before the hourly sweep
+// may collect it.
+//
+// Deleting at publish time would race the thing it deletes: a tool call that
+// resolved the old pointer a moment earlier is still in flight, and the pointer
+// moving does not recall it. An hour is far longer than any call can take, and
+// the wait costs $0.02 per script per month against an allowance of 1,000.
+const CUSTOM_CODE_SWEEP_GRACE_MS = 60 * 60 * 1_000;
+// Deletes per sweep. A backlog drains over several hourly runs rather than
+// making one run unbounded — the same shape the retention purge uses.
+const CUSTOM_CODE_SWEEP_MAX_DELETES = 200;
 // A second script per artifact, `artifact_<id>_preview`, that the Test panel
 // deploys a draft into and calls.
 //
@@ -1228,15 +1255,17 @@ const CUSTOM_CODE_COMPATIBILITY_DATE = '2025-11-17';
 // tighter than our own workers' 30s — this is the technical cap that bounds
 // what one adversarial call can cost us, so an infinite loop in a customer's
 // tool is billed as five seconds rather than as whatever it wanted.
-// How long publish waits for the edition it just uploaded to be the one the
-// dispatcher answers with, and how often it asks.
+// How long a deploy waits for a freshly minted script name to become
+// dispatchable, and how often it asks.
 //
-// Bounded rather than open-ended because this runs inside the publish request:
-// past this, publishing would be a request nobody waits out. Exceeding it is
-// reported as "try again" rather than published, which is the safe direction —
-// the alternative is advertising tools backed by a script that is not there yet.
-const CUSTOM_CODE_SMOKE_TIMEOUT_MS = 20_000;
-const CUSTOM_CODE_SMOKE_INTERVAL_MS = 1_000;
+// Every upload goes to a name that has never been used, which is
+// read-your-writes: ~2s end to end against the deployed namespace, against the
+// 20-41s a replacement could take. So this bounds how long a brand-new name
+// takes to register, never how long an old edition takes to stop answering —
+// there is no old edition. It is short for that reason, and a script that
+// answers with the wrong edition now fails outright instead of being waited on.
+const CUSTOM_CODE_REGISTER_TIMEOUT_MS = 8_000;
+const CUSTOM_CODE_REGISTER_INTERVAL_MS = 500;
 const CUSTOM_CODE_SCRIPT_CPU_MS = 5_000;
 // The ctx.log() caps also live in ./sdkConstants — the buffer that enforces them
 // runs inside the isolate.
@@ -1410,6 +1439,46 @@ const ARTIFACT_SCOPE_PREFIX = 'artifact:';
 // loopback matching, where the port is ignored for a 127.0.0.0/8 redirect, but
 // that is one library's behaviour and this is a login that has already opened
 // someone's browser by the time it would fail.
+// A personal access token — the durable credential a machine with no browser
+// uses, where an OAuth access token's one hour is not enough. Bound to one
+// project, because that is the unit a deploy pipeline works on: one repository,
+// one artifact, one credential in its CI settings.
+//
+// The prefix is part of the value rather than decoration: it is what lets the
+// middleware tell one of these from an OAuth token before it decides which
+// lookup to make, and it is what secret scanners match on when one leaks into a
+// repository. The rest is 32 random bytes, base64url — the token is the only
+// place the value ever exists in plaintext, since what is stored is its hash.
+const ACCESS_TOKEN_PREFIX = 'ganju_pat_';
+const ACCESS_TOKEN_BYTES = 32;
+// Enough of the secret to recognise a row by, and not enough to be worth
+// stealing. Shown in the dashboard and by `ganju token list` beside the name.
+const ACCESS_TOKEN_HINT_CHARS = 6;
+const ACCESS_TOKEN_NAME_MAX = 100;
+// A ceiling per project, so a compromised session cannot quietly mint an
+// unbounded set of credentials that each survive the session being ended.
+const ACCESS_TOKEN_MAX_PER_PROJECT = 20;
+// An expiry is optional, because a scheduled deploy that dies on a date nobody
+// wrote down is its own kind of outage — but a year is the longest we will
+// write one for.
+const ACCESS_TOKEN_MAX_EXPIRY_DAYS = 365;
+// `last_used_at` is a convenience, not an audit log, so it is written at most
+// this often per token rather than on every request. The question it answers —
+// "is anything still using this, or can I revoke it" — does not get a better
+// answer from minute-level precision, and the write would otherwise land on the
+// hot path of every CI request.
+const ACCESS_TOKEN_LAST_USED_INTERVAL_MS = 5 * 60 * 1000;
+// The only path a personal access token may reach without naming the project it
+// is scoped to, and only on GET. `/me` reports who the token is, which is how
+// the CLI confirms a machine is authenticated at all, and tells it nothing it
+// does not already hold.
+//
+// Everything else is refused, organization routes included — billing, members,
+// the model configs and the other projects are not what a deploy credential is
+// for. The list is deliberately this short: a route added later is closed by
+// omission rather than open by it.
+const ACCESS_TOKEN_UNSCOPED_PATHS = ['/me'];
+const ACCESS_TOKEN_SCOPE_MESSAGE = 'This token is scoped to a different project';
 // Recent custom-tool invocations, as `ganju logs` reads them.
 const CUSTOM_CODE_LOGS_DEFAULT_LIMIT = 20;
 const CUSTOM_CODE_LOGS_MAX_LIMIT = 100;
@@ -2139,6 +2208,10 @@ exports.constants = {
     CUSTOM_CODE_MAX_FILE_PATH,
     CUSTOM_CODE_VERSION_STATUSES,
     CUSTOM_CODE_SCRIPT_NAME_PREFIX,
+    CUSTOM_CODE_SCRIPT_NAME_MAX,
+    CUSTOM_CODE_UPLOAD_SUFFIX_CHARS,
+    CUSTOM_CODE_SWEEP_GRACE_MS,
+    CUSTOM_CODE_SWEEP_MAX_DELETES,
     CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX,
     CUSTOM_CODE_PREVIEW_TOKEN_TTL_MS,
     CUSTOM_CODE_TEST_TIMEOUT_MS,
@@ -2180,8 +2253,8 @@ exports.constants = {
     CUSTOM_CODE_BROKER_SERVICE_ENV,
     CUSTOM_CODE_COMPATIBILITY_DATE,
     CUSTOM_CODE_SCRIPT_CPU_MS,
-    CUSTOM_CODE_SMOKE_TIMEOUT_MS,
-    CUSTOM_CODE_SMOKE_INTERVAL_MS,
+    CUSTOM_CODE_REGISTER_TIMEOUT_MS,
+    CUSTOM_CODE_REGISTER_INTERVAL_MS,
     CUSTOM_CODE_MAX_LOGS: sdkConstants_1.CUSTOM_CODE_MAX_LOGS,
     CUSTOM_CODE_MAX_LOG_LENGTH: sdkConstants_1.CUSTOM_CODE_MAX_LOG_LENGTH,
     CUSTOM_CODE_SEND_FILE_TARGET_GMAIL,
@@ -2234,6 +2307,15 @@ exports.constants = {
     CLI_OAUTH_REDIRECT_PORTS: cliConstants_1.CLI_OAUTH_REDIRECT_PORTS,
     CLI_OAUTH_SCOPES: cliConstants_1.CLI_OAUTH_SCOPES,
     CLI_TOKEN_REFRESH_SKEW_SECONDS: cliConstants_1.CLI_TOKEN_REFRESH_SKEW_SECONDS,
+    ACCESS_TOKEN_PREFIX,
+    ACCESS_TOKEN_BYTES,
+    ACCESS_TOKEN_HINT_CHARS,
+    ACCESS_TOKEN_NAME_MAX,
+    ACCESS_TOKEN_MAX_PER_PROJECT,
+    ACCESS_TOKEN_MAX_EXPIRY_DAYS,
+    ACCESS_TOKEN_LAST_USED_INTERVAL_MS,
+    ACCESS_TOKEN_UNSCOPED_PATHS,
+    ACCESS_TOKEN_SCOPE_MESSAGE,
     CUSTOM_CODE_LOGS_DEFAULT_LIMIT,
     CUSTOM_CODE_LOGS_MAX_LIMIT,
     BOT_GRANT_TYPE,

package/dist/customCodeToken.d.ts

@@ -24,18 +24,53 @@ export declare const mintCustomCodeToken: (payload: Omit<CustomCodeTokenPayload,
  */
 export declare const verifyCustomCodeToken: (token: string, secret: string, now?: number) => Promise<CustomCodeTokenPayload | null>;
 /**
- * The dispatch-namespace script name for an artifact: `artifact_<id>`.
+ * The legacy dispatch-namespace script name for an artifact: `artifact_<id>`.
  *
  * The id, never the slug — slugs are user-editable and a rename would orphan the
  * deployed script while the database still pointed at a live version.
+ *
+ * Nothing uploads to this name any more; every deploy mints its own. It survives
+ * as the fallback for a version published before `script_name` existed, whose
+ * bundle really is sitting under this name. Tightening a rule must never stop an
+ * already-published version from serving, because that failure is invisible to
+ * whoever owns it — the same reason the boot loop still accepts a stored tool key
+ * the current catalog no longer offers.
  */
 export declare const customCodeScriptName: (artifactId: string) => string;
 /**
- * The script name a test run deploys into: `artifact_<id>_preview`.
+ * The legacy preview script name: `artifact_<id>_preview`.
  *
- * A second script rather than a second version of the live one, because a test
- * must not be able to disturb what MCP clients are being served — and the only
- * way to be certain of that is for it to run under a name nothing dispatches to.
+ * Kept for the same reason as the one above, and for one more: it is the prefix
+ * the sweep matches to recognise a preview script left behind by a test run that
+ * did not clean up after itself.
  */
 export declare const customCodePreviewScriptName: (artifactId: string) => string;
+/**
+ * A dispatch-namespace name no upload has ever used:
+ * `artifact_<id>_<12 hex chars>`.
+ *
+ * Minted rather than derived, and that is the entire design. Uploading over an
+ * existing name is not read-your-writes — a replacement can serve the previous
+ * edition for tens of seconds — so a deploy that always writes to a new name is
+ * correct by construction rather than by waiting to see whether it worked.
+ *
+ * The suffix deliberately carries no meaning. The two candidates that did are
+ * both wrong: the bundle digest collides whenever a deploy reverts to bytes that
+ * shipped before, which is exactly what a rollback is, and the version id is one
+ * string across every re-upload of a single draft, which is every test run of it.
+ *
+ * Twelve hex characters is what fits. Worker names cap at 63 and
+ * `artifact_<uuid>` spends 45 of them.
+ */
+export declare const customCodeUploadName: (artifactId: string) => string;
+/**
+ * A preview name no test run has ever used:
+ * `artifact_<id>_preview_<12 hex chars>`.
+ *
+ * The sharper version of the same race. Every test used to deploy over one
+ * preview name, so a test could report the run before it — which reads as "my
+ * edit did nothing" from the one tool whose whole job is to say what an edit
+ * does. Nothing stores this: it is minted, used, and deleted inside one request.
+ */
+export declare const customCodePreviewUploadName: (artifactId: string) => string;
 //# sourceMappingURL=customCodeToken.d.ts.map

package/dist/customCodeToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"customCodeToken.d.ts","sourceRoot":"","sources":["../src/customCodeToken.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,sBAAsB;IAGrC,CAAC,EAAE,MAAM,CAAC;IACV,UAAU,EAAE,MAAM,CAAC;IAGnB,SAAS,EAAE,MAAM,CAAC;IAIlB,GAAG,EAAE,MAAM,CAAC;IAOZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAGlB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA0BD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC9B,SAAS,IAAI,CAAC,sBAAsB,EAAE,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACD,QAAQ,MAAM,EACd,WAAU,MAAmB,KAC5B,OAAO,CAAC,MAAM,CAmBhB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,MAAM,MAAM,KACX,OAAO,CAAC,sBAAsB,GAAG,IAAI,CA+DvC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,MAAM,KAAG,MACE,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GAAI,YAAY,MAAM,KAAG,MACoB,CAAC"}
+{"version":3,"file":"customCodeToken.d.ts","sourceRoot":"","sources":["../src/customCodeToken.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,sBAAsB;IAGrC,CAAC,EAAE,MAAM,CAAC;IACV,UAAU,EAAE,MAAM,CAAC;IAGnB,SAAS,EAAE,MAAM,CAAC;IAIlB,GAAG,EAAE,MAAM,CAAC;IAOZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAGlB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA0BD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC9B,SAAS,IAAI,CAAC,sBAAsB,EAAE,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,EACD,QAAQ,MAAM,EACd,WAAU,MAAmB,KAC5B,OAAO,CAAC,MAAM,CAmBhB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,MAAM,MAAM,KACX,OAAO,CAAC,sBAAsB,GAAG,IAAI,CA+DvC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,MAAM,KAAG,MACE,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,GAAI,YAAY,MAAM,KAAG,MACoB,CAAC;AAEtF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oBAAoB,GAAI,YAAY,MAAM,KAAG,MACR,CAAC;AAEnD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,GAAI,YAAY,MAAM,KAAG,MACR,CAAC"}

package/dist/customCodeToken.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.customCodePreviewScriptName = exports.customCodeScriptName = exports.verifyCustomCodeToken = exports.mintCustomCodeToken = void 0;
+exports.customCodePreviewUploadName = exports.customCodeUploadName = exports.customCodePreviewScriptName = exports.customCodeScriptName = exports.verifyCustomCodeToken = exports.mintCustomCodeToken = void 0;
 const base64_1 = require("./base64");
 const constants_1 = require("./constants");
 const encoder = new TextEncoder();
@@ -97,19 +97,90 @@ const verifyCustomCodeToken = async (token, secret, now) => {
 };
 exports.verifyCustomCodeToken = verifyCustomCodeToken;
 /**
- * The dispatch-namespace script name for an artifact: `artifact_<id>`.
+ * The legacy dispatch-namespace script name for an artifact: `artifact_<id>`.
  *
  * The id, never the slug — slugs are user-editable and a rename would orphan the
  * deployed script while the database still pointed at a live version.
+ *
+ * Nothing uploads to this name any more; every deploy mints its own. It survives
+ * as the fallback for a version published before `script_name` existed, whose
+ * bundle really is sitting under this name. Tightening a rule must never stop an
+ * already-published version from serving, because that failure is invisible to
+ * whoever owns it — the same reason the boot loop still accepts a stored tool key
+ * the current catalog no longer offers.
  */
 const customCodeScriptName = (artifactId) => `${constants_1.constants.CUSTOM_CODE_SCRIPT_NAME_PREFIX}${artifactId}`;
 exports.customCodeScriptName = customCodeScriptName;
 /**
- * The script name a test run deploys into: `artifact_<id>_preview`.
+ * The legacy preview script name: `artifact_<id>_preview`.
  *
- * A second script rather than a second version of the live one, because a test
- * must not be able to disturb what MCP clients are being served — and the only
- * way to be certain of that is for it to run under a name nothing dispatches to.
+ * Kept for the same reason as the one above, and for one more: it is the prefix
+ * the sweep matches to recognise a preview script left behind by a test run that
+ * did not clean up after itself.
  */
 const customCodePreviewScriptName = (artifactId) => `${(0, exports.customCodeScriptName)(artifactId)}${constants_1.constants.CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX}`;
 exports.customCodePreviewScriptName = customCodePreviewScriptName;
+/**
+ * A dispatch-namespace name no upload has ever used:
+ * `artifact_<id>_<12 hex chars>`.
+ *
+ * Minted rather than derived, and that is the entire design. Uploading over an
+ * existing name is not read-your-writes — a replacement can serve the previous
+ * edition for tens of seconds — so a deploy that always writes to a new name is
+ * correct by construction rather than by waiting to see whether it worked.
+ *
+ * The suffix deliberately carries no meaning. The two candidates that did are
+ * both wrong: the bundle digest collides whenever a deploy reverts to bytes that
+ * shipped before, which is exactly what a rollback is, and the version id is one
+ * string across every re-upload of a single draft, which is every test run of it.
+ *
+ * Twelve hex characters is what fits. Worker names cap at 63 and
+ * `artifact_<uuid>` spends 45 of them.
+ */
+const customCodeUploadName = (artifactId) => mintUploadName((0, exports.customCodeScriptName)(artifactId));
+exports.customCodeUploadName = customCodeUploadName;
+/**
+ * A preview name no test run has ever used:
+ * `artifact_<id>_preview_<12 hex chars>`.
+ *
+ * The sharper version of the same race. Every test used to deploy over one
+ * preview name, so a test could report the run before it — which reads as "my
+ * edit did nothing" from the one tool whose whole job is to say what an edit
+ * does. Nothing stores this: it is minted, used, and deleted inside one request.
+ */
+const customCodePreviewUploadName = (artifactId) => mintUploadName((0, exports.customCodePreviewScriptName)(artifactId));
+exports.customCodePreviewUploadName = customCodePreviewUploadName;
+/**
+ * Append `_<hex>` to a base name, spending whatever the 63-character ceiling
+ * leaves and no more.
+ *
+ * The budget is genuinely tight, and the two names spend it differently:
+ *
+ * | name | base | separator | suffix | total |
+ * |---|---|---|---|---|
+ * | live | `artifact_<uuid>` = 45 | 1 | 12 | 58 |
+ * | preview | + `_preview` = 53 | 1 | 8 | 62 |
+ *
+ * Twelve hex characters is 48 bits and eight is 32, against a namespace holding
+ * a few hundred names for any one artifact — and a preview name lives for the
+ * seconds one test run takes. Neither is a collision worth checking for, and an
+ * upload to a name already in use fails loudly rather than quietly serving the
+ * wrong code, which is the failure that matters.
+ *
+ * The ceiling is asserted rather than assumed: it is one number away from being
+ * silently exceeded by a longer prefix, and a name Cloudflare refuses would
+ * surface as a failed publish with nothing explaining why.
+ */
+const mintUploadName = (base) => {
+    const available = constants_1.constants.CUSTOM_CODE_SCRIPT_NAME_MAX - base.length - 1;
+    // Even, because each byte renders as two hex characters.
+    const chars = Math.min(constants_1.constants.CUSTOM_CODE_UPLOAD_SUFFIX_CHARS, available) & ~1;
+    if (chars < 4) {
+        throw new Error(`A dispatch script name based on "${base}" leaves no room for a unique suffix.`);
+    }
+    const bytes = new Uint8Array(chars / 2);
+    crypto.getRandomValues(bytes);
+    return `${base}_${Array.from(bytes)
+        .map(byte => byte.toString(16).padStart(2, '0'))
+        .join('')}`;
+};

package/dist/index.d.ts

@@ -15,6 +15,7 @@ import type { OAuthProviderConfig } from './oauthProviders';
 import type { ExposableResource } from './exposedResource';
 import type { CustomCodeProject, ProjectPathIssue } from './customCodeProject';
 import type { AttachmentResource, ResolvedAttachment, ResolveAttachmentResult } from './attachment';
+import type { MintedAccessToken } from './accessToken';
 import type { CatalogGroup, CatalogTool, CatalogToolDescriptor, ToolGroupKey, ToolKey } from './toolCatalog';
 import type { Separator, ChunkMetadata, PreparedChunk } from './chunking';
 import type { RateLimitRetryOptions } from './retry';
@@ -868,6 +869,28 @@ export declare const utils: {
             userId: import("zod").ZodUUID;
             organizationId: import("zod").ZodUUID;
         }, import("zod/v4/core").$strip>;
+        ACCESS_TOKEN_CREATE: import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            expiresInDays: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodNumber>>;
+            userId: import("zod").ZodUUID;
+            organizationId: import("zod").ZodUUID;
+            projectId: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>;
+        ACCESS_TOKEN_CREATE_VIEW: import("zod").ZodObject<{
+            name: import("zod").ZodString;
+            expiresInDays: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodNumber>>;
+        }, import("zod/v4/core").$strip>;
+        ACCESS_TOKEN_LIST: import("zod").ZodObject<{
+            userId: import("zod").ZodUUID;
+            organizationId: import("zod").ZodUUID;
+            projectId: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>;
+        ACCESS_TOKEN_REMOVE: import("zod").ZodObject<{
+            tokenId: import("zod").ZodUUID;
+            userId: import("zod").ZodUUID;
+            organizationId: import("zod").ZodUUID;
+            projectId: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>;
         CHANNEL_CONFIG: import("zod").ZodObject<{
             debounceMs: import("zod").ZodOptional<import("zod").ZodNumber>;
         }, import("zod/v4/core").$loose>;
@@ -2206,6 +2229,10 @@ export declare const utils: {
         CUSTOM_CODE_MAX_FILE_PATH: number;
         CUSTOM_CODE_VERSION_STATUSES: ("draft" | "published" | "archived")[];
         CUSTOM_CODE_SCRIPT_NAME_PREFIX: string;
+        CUSTOM_CODE_SCRIPT_NAME_MAX: number;
+        CUSTOM_CODE_UPLOAD_SUFFIX_CHARS: number;
+        CUSTOM_CODE_SWEEP_GRACE_MS: number;
+        CUSTOM_CODE_SWEEP_MAX_DELETES: number;
         CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX: string;
         CUSTOM_CODE_PREVIEW_TOKEN_TTL_MS: number;
         CUSTOM_CODE_TEST_TIMEOUT_MS: number;
@@ -2247,8 +2274,8 @@ export declare const utils: {
         CUSTOM_CODE_BROKER_SERVICE_ENV: string;
         CUSTOM_CODE_COMPATIBILITY_DATE: string;
         CUSTOM_CODE_SCRIPT_CPU_MS: number;
-        CUSTOM_CODE_SMOKE_TIMEOUT_MS: number;
-        CUSTOM_CODE_SMOKE_INTERVAL_MS: number;
+        CUSTOM_CODE_REGISTER_TIMEOUT_MS: number;
+        CUSTOM_CODE_REGISTER_INTERVAL_MS: number;
         CUSTOM_CODE_MAX_LOGS: number;
         CUSTOM_CODE_MAX_LOG_LENGTH: number;
         CUSTOM_CODE_SEND_FILE_TARGET_GMAIL: "gmail";
@@ -2301,6 +2328,15 @@ export declare const utils: {
         CLI_OAUTH_REDIRECT_PORTS: number[];
         CLI_OAUTH_SCOPES: string[];
         CLI_TOKEN_REFRESH_SKEW_SECONDS: number;
+        ACCESS_TOKEN_PREFIX: string;
+        ACCESS_TOKEN_BYTES: number;
+        ACCESS_TOKEN_HINT_CHARS: number;
+        ACCESS_TOKEN_NAME_MAX: number;
+        ACCESS_TOKEN_MAX_PER_PROJECT: number;
+        ACCESS_TOKEN_MAX_EXPIRY_DAYS: number;
+        ACCESS_TOKEN_LAST_USED_INTERVAL_MS: number;
+        ACCESS_TOKEN_UNSCOPED_PATHS: string[];
+        ACCESS_TOKEN_SCOPE_MESSAGE: string;
         CUSTOM_CODE_LOGS_DEFAULT_LIMIT: number;
         CUSTOM_CODE_LOGS_MAX_LIMIT: number;
         BOT_GRANT_TYPE: string;
@@ -2353,6 +2389,8 @@ export declare const utils: {
     verifyCustomCodeToken: (token: string, secret: string, now?: number) => Promise<CustomCodeTokenPayload | null>;
     customCodeScriptName: (artifactId: string) => string;
     customCodePreviewScriptName: (artifactId: string) => string;
+    customCodeUploadName: (artifactId: string) => string;
+    customCodePreviewUploadName: (artifactId: string) => string;
     oauthProviders: Record<string, OAuthProviderConfig>;
     resolveAttachment: (resource: AttachmentResource, readObject: (key: string) => Promise<ArrayBuffer | null>, verb?: "attach" | "upload") => Promise<ResolveAttachmentResult>;
     isExposedResource: (resource: ExposableResource) => boolean;
@@ -2380,6 +2418,10 @@ export declare const utils: {
     languageFromHeader: (header?: string | null) => string;
     slugifyTitle: (title: string) => string;
     resourceUriFromTitle: (title: string) => string;
+    accessTokenHint: (token: string) => string;
+    hashAccessToken: (token: string) => Promise<string>;
+    isAccessToken: (token: string) => boolean;
+    mintAccessToken: () => Promise<MintedAccessToken>;
     TOOL_CATALOG: readonly [{
         readonly key: "gmail";
         readonly title: "Gmail";
@@ -2839,5 +2881,5 @@ export declare const utils: {
     PlanLimitError: typeof PlanLimitError;
     isPlanLimitError: (error: unknown) => error is PlanLimitError;
 };
-export type { CustomCodeProject, ProjectPathIssue, CatalogGroup, CatalogTool, CatalogToolDescriptor, ToolGroupKey, ToolKey, CalendarConfigField, JsonSchema, SchemaViolation, MimeAttachment, MimeMessageInput, GmailOperation, GmailSendRequest, GmailSendResponse, OutlookOperation, OutlookSendRequest, OutlookSendResponse, SlackOperation, SlackSendRequest, SlackSendResponse, SlackSendRemoteResourceRequest, TelegramSendRequest, TelegramSendResponse, TelegramSendRemoteResourceRequest, DiscordSendRequest, DiscordSendResponse, DiscordSendRemoteResourceRequest, WhatsappSendRequest, WhatsappSendResponse, WhatsappSendRemoteResourceRequest, EnvSource, Separator, ChunkMetadata, PreparedChunk, ExtractedDocument, ExtractedDocumentMetadata, ExtractedDocumentSource, RateLimitRetryOptions, QueueBatchLike, QueueMessageLike, ProcessQueueBatchHandlers, ChannelNotifier, ToolStatusEvent, BufferedChannelMessage, ChannelBufferEnvelope, ChannelBufferFlush, Source, ResourceUrlContext, SourceButton, RefreshOAuthTokenInput, RefreshedOAuthToken, HttpEndpointToolConfig, McpProxyToolConfig, McpProxyDiscoveredTool, McpProxyDiscoveredResource, McpProxyDiscoveredPrompt, McpProxyDiscovery, CustomCodeToolConfig, CustomCodeToolManifest, CustomCodeManifest, CustomCodeSendFile, CustomCodeCreateResource, CustomCodeTokenPayload, OAuthProviderConfig, AttachmentResource, ResolvedAttachment, ResolveAttachmentResult, ExposableResource, PlanLimitDetails, PlanLimits };
+export type { MintedAccessToken, CustomCodeProject, ProjectPathIssue, CatalogGroup, CatalogTool, CatalogToolDescriptor, ToolGroupKey, ToolKey, CalendarConfigField, JsonSchema, SchemaViolation, MimeAttachment, MimeMessageInput, GmailOperation, GmailSendRequest, GmailSendResponse, OutlookOperation, OutlookSendRequest, OutlookSendResponse, SlackOperation, SlackSendRequest, SlackSendResponse, SlackSendRemoteResourceRequest, TelegramSendRequest, TelegramSendResponse, TelegramSendRemoteResourceRequest, DiscordSendRequest, DiscordSendResponse, DiscordSendRemoteResourceRequest, WhatsappSendRequest, WhatsappSendResponse, WhatsappSendRemoteResourceRequest, EnvSource, Separator, ChunkMetadata, PreparedChunk, ExtractedDocument, ExtractedDocumentMetadata, ExtractedDocumentSource, RateLimitRetryOptions, QueueBatchLike, QueueMessageLike, ProcessQueueBatchHandlers, ChannelNotifier, ToolStatusEvent, BufferedChannelMessage, ChannelBufferEnvelope, ChannelBufferFlush, Source, ResourceUrlContext, SourceButton, RefreshOAuthTokenInput, RefreshedOAuthToken, HttpEndpointToolConfig, McpProxyToolConfig, McpProxyDiscoveredTool, McpProxyDiscoveredResource, McpProxyDiscoveredPrompt, McpProxyDiscovery, CustomCodeToolConfig, CustomCodeToolManifest, CustomCodeManifest, CustomCodeSendFile, CustomCodeCreateResource, CustomCodeTokenPayload, OAuthProviderConfig, AttachmentResource, ResolvedAttachment, ResolveAttachmentResult, ExposableResource, PlanLimitDetails, PlanLimits };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAyCvD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EACjC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAQ9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAW3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AAgBtB,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACR,MAAM,eAAe,CAAC;AAiBvB,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAErD,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAM1E,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,wBAAwB,EAIzB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAoB,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAlGhB,CAAC;;;;;;;;;;;;;;;;;;;;;;;kBAjHkB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA0DF,CAAC;oBAEd,CAAC;;;;aA0BkB,CAAC;mBAA8B,CAAC;WACvC,CAAC;gBACf,CAAC;gBAA4B,CAAA;;;mBAmBK,CAAC;oBACtC,CAAC;;;;;;;;;;;;;;;kBA1DmB,CAAC;;;;;;;sBAqCR,CAAC;;;;;;;;;CAuOf,CAAC;AAEF,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EAChC,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,SAAS,EACT,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,MAAM,EACN,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACX,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAyCvD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EACjC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EAClC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,UAAU,EAGX,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAU9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAW3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACxB,MAAM,cAAc,CAAC;AActB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AASvD,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACR,MAAM,eAAe,CAAC;AAiBvB,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAErD,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAM1E,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAEL,wBAAwB,EAIzB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAoB,MAAM,kBAAkB,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA5Gf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;kBAhHiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBA0DF,CAAC;oBAEd,CAAC;;;;aA0BkB,CAAC;mBAA8B,CAAC;WACvC,CAAC;gBACf,CAAC;gBAA4B,CAAA;;;mBAoBK,CAAC;oBACjC,CAAC;;;;;;;;;;;;;;;kBA3Dc,CAAC;;;;;;;sBAqCR,CAAC;;;;;;;;;CAsPf,CAAC;AAEF,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,qBAAqB,EACrB,YAAY,EACZ,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,kBAAkB,EAClB,mBAAmB,EACnB,gCAAgC,EAChC,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,SAAS,EACT,SAAS,EACT,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,MAAM,EACN,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACX,CAAC"}

package/dist/index.js

@@ -31,6 +31,7 @@ const languageCookieDomain_1 = require("./languageCookieDomain");
 const localizeZodIssue_1 = require("./localizeZodIssue");
 const slugifyTitle_1 = require("./slugifyTitle");
 const resourceUri_1 = require("./resourceUri");
+const accessToken_1 = require("./accessToken");
 const toolCatalog_1 = require("./toolCatalog");
 const tallyUsageKinds_1 = require("./tallyUsageKinds");
 const formatFilename_1 = require("./formatFilename");
@@ -89,6 +90,8 @@ exports.utils = {
     verifyCustomCodeToken: customCodeToken_1.verifyCustomCodeToken,
     customCodeScriptName: customCodeToken_1.customCodeScriptName,
     customCodePreviewScriptName: customCodeToken_1.customCodePreviewScriptName,
+    customCodeUploadName: customCodeToken_1.customCodeUploadName,
+    customCodePreviewUploadName: customCodeToken_1.customCodePreviewUploadName,
     oauthProviders: oauthProviders_1.oauthProviders,
     resolveAttachment: attachment_1.resolveAttachment,
     isExposedResource: exposedResource_1.isExposedResource,
@@ -111,6 +114,10 @@ exports.utils = {
     languageFromHeader: localizeZodIssue_1.languageFromHeader,
     slugifyTitle: slugifyTitle_1.slugifyTitle,
     resourceUriFromTitle: resourceUri_1.resourceUriFromTitle,
+    accessTokenHint: accessToken_1.accessTokenHint,
+    hashAccessToken: accessToken_1.hashAccessToken,
+    isAccessToken: accessToken_1.isAccessToken,
+    mintAccessToken: accessToken_1.mintAccessToken,
     TOOL_CATALOG: toolCatalog_1.TOOL_CATALOG,
     TOOL_KEYS: toolCatalog_1.TOOL_KEYS,
     describeCatalogTool: toolCatalog_1.describeCatalogTool,

package/dist/schema.d.ts

@@ -1255,6 +1255,28 @@ export declare const Schema: {
         userId: z.ZodUUID;
         organizationId: z.ZodUUID;
     }, z.core.$strip>;
+    ACCESS_TOKEN_CREATE: z.ZodObject<{
+        name: z.ZodString;
+        expiresInDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        userId: z.ZodUUID;
+        organizationId: z.ZodUUID;
+        projectId: z.ZodUUID;
+    }, z.core.$strip>;
+    ACCESS_TOKEN_CREATE_VIEW: z.ZodObject<{
+        name: z.ZodString;
+        expiresInDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>;
+    ACCESS_TOKEN_LIST: z.ZodObject<{
+        userId: z.ZodUUID;
+        organizationId: z.ZodUUID;
+        projectId: z.ZodUUID;
+    }, z.core.$strip>;
+    ACCESS_TOKEN_REMOVE: z.ZodObject<{
+        tokenId: z.ZodUUID;
+        userId: z.ZodUUID;
+        organizationId: z.ZodUUID;
+        projectId: z.ZodUUID;
+    }, z.core.$strip>;
     CHANNEL_CONFIG: z.ZodObject<{
         debounceMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$loose>;

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA+qBxB,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FrB,CAAC;AAyDN,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;iBAmCpB,CAAC;AAWH,QAAA,MAAM,kBAAkB;;;;;;;;;;iBA+CtB,CAAC;AAiCH,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAapB,CAAC;AAYH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgCxB,CAAC;AA4LH,QAAA,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4DpC,CAAC;AA4BL,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAkDzB,CAAC;AAwGH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsGlB,CAAC;AAGF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAG1E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIlE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAMtE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAGtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIvE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,kCAAkC,CAC1C,CAAC;AAKF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAKD,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAKD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC1E;AAMD,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,0BAA0B,EAAE,CAAC;IACzC,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACtC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA6tBxB,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FrB,CAAC;AAyDN,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;iBAmCpB,CAAC;AAWH,QAAA,MAAM,kBAAkB;;;;;;;;;;iBA+CtB,CAAC;AAiCH,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAapB,CAAC;AAYH,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgCxB,CAAC;AA4LH,QAAA,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4DpC,CAAC;AA4BL,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAkDzB,CAAC;AAwGH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0GlB,CAAC;AAGF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAG1E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIlE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAMtE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAGtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMtE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIvE,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,kCAAkC,CAC1C,CAAC;AAKF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAKD,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAKD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC1E;AAMD,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,0BAA0B,EAAE,CAAC;IACzC,OAAO,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACtC"}

package/dist/schema.js

@@ -519,6 +519,48 @@ const ORGANIZATION_REMOVE_LLM = zod_1.z.object({
     userId: zod_1.z.uuid(),
     organizationId: zod_1.z.uuid()
 });
+// Personal access tokens. `name` is required rather than optional because it is
+// the only thing anyone has to go on when deciding whether revoking a row will
+// break a deploy, and a list of unnamed credentials is a list nobody prunes.
+//
+// `expiresInDays` is what the caller sends; `expiresAt` is what the row stores.
+// A duration is what someone actually decides ("ninety days"), and computing the
+// date on the server means a clock the client got wrong cannot mint a token that
+// outlives what was asked for. Null is a token that does not expire, which is a
+// real answer for a scheduled deploy and is why it is spelled explicitly rather
+// than reached by leaving the field out.
+const ACCESS_TOKEN_CREATE = zod_1.z.object({
+    name: zod_1.z.string().trim().min(1).max(constants_1.constants.ACCESS_TOKEN_NAME_MAX),
+    expiresInDays: zod_1.z
+        .number()
+        .int()
+        .min(1)
+        .max(constants_1.constants.ACCESS_TOKEN_MAX_EXPIRY_DAYS)
+        .nullable()
+        .optional(),
+    userId: zod_1.z.uuid(),
+    organizationId: zod_1.z.uuid(),
+    projectId: zod_1.z.uuid()
+});
+const ACCESS_TOKEN_LIST = zod_1.z.object({
+    userId: zod_1.z.uuid(),
+    organizationId: zod_1.z.uuid(),
+    projectId: zod_1.z.uuid()
+});
+const ACCESS_TOKEN_REMOVE = zod_1.z.object({
+    tokenId: zod_1.z.uuid(),
+    userId: zod_1.z.uuid(),
+    organizationId: zod_1.z.uuid(),
+    projectId: zod_1.z.uuid()
+});
+// The ids the route already carries come off: the dashboard reads them from the
+// URL it is on, so a form asking for them again is a second place for them to be
+// wrong.
+const ACCESS_TOKEN_CREATE_VIEW = ACCESS_TOKEN_CREATE.omit({
+    userId: true,
+    organizationId: true,
+    projectId: true
+});
 const ORGANIZATION_CREATE_LLM_VIEW = ORGANIZATION_CREATE_LLM.omit({
     userId: true,
     organizationId: true
@@ -1345,6 +1387,10 @@ exports.Schema = {
     ORGANIZATION_UPDATE_LLM,
     ORGANIZATION_UPDATE_LLM_VIEW,
     ORGANIZATION_REMOVE_LLM,
+    ACCESS_TOKEN_CREATE,
+    ACCESS_TOKEN_CREATE_VIEW,
+    ACCESS_TOKEN_LIST,
+    ACCESS_TOKEN_REMOVE,
     CHANNEL_CONFIG,
     CHANNEL_CREATE,
     CHANNEL_CREATE_VIEW,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ganju/utils",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Shared constants, schemas and helpers for Ganju",
   "license": "Apache-2.0",
   "author": "MontoyaAndres <andresmontoyafcb@gmail.com>",

package/src/accessToken.ts

@@ -0,0 +1,79 @@
+import { constants } from './constants';
+
+/**
+ * Minting and recognising a personal access token.
+ *
+ * The value exists in plaintext exactly once — in the response to the request
+ * that created it — and what the database holds is its SHA-256. That is the
+ * property the whole credential rests on: a leaked backup, a stray log line, or
+ * a support engineer reading the row learns nothing they could present as the
+ * token, and there is no path in the product that can print one back, because
+ * there is nothing to print.
+ *
+ * SHA-256 rather than a password hash on purpose. A password is a low-entropy
+ * secret a person chose, so the cost of hashing it is what stands between a
+ * stolen table and the passwords in it; this is 32 bytes from a CSPRNG, where
+ * that cost buys nothing and would be paid on every authenticated request. It
+ * is also the hash `oauth_client.client_secret` already uses in this system, so
+ * there is one answer here to "how is a machine credential stored".
+ */
+
+const HINT_SEPARATOR = '…';
+
+const base64url = (bytes: Uint8Array): string => {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+};
+
+/** The SHA-256 of a presented token, in the encoding the column stores. */
+export const hashAccessToken = async (token: string): Promise<string> => {
+  const digest = await crypto.subtle.digest(
+    'SHA-256',
+    new TextEncoder().encode(token)
+  );
+  return base64url(new Uint8Array(digest));
+};
+
+/**
+ * Cheap enough to run before the database is touched: a bearer token that does
+ * not carry the prefix is an OAuth token, and belongs on the other path.
+ */
+export const isAccessToken = (token: string): boolean =>
+  token.startsWith(constants.ACCESS_TOKEN_PREFIX);
+
+/**
+ * What the dashboard shows beside a token's name.
+ *
+ * Enough to tell two rows apart when someone is deciding which to revoke, and
+ * deliberately taken from the *front* of the secret rather than the end: a
+ * prefix narrows a brute-force search by exactly as much as a suffix would, and
+ * a value people are used to seeing truncated at the end reads as complete when
+ * it is the end that is shown.
+ */
+export const accessTokenHint = (token: string): string =>
+  `${token.slice(
+    0,
+    constants.ACCESS_TOKEN_PREFIX.length + constants.ACCESS_TOKEN_HINT_CHARS
+  )}${HINT_SEPARATOR}`;
+
+export interface MintedAccessToken {
+  /** The only time this value exists. Returned to the caller, never stored. */
+  token: string;
+  tokenHash: string;
+  hint: string;
+}
+
+export const mintAccessToken = async (): Promise<MintedAccessToken> => {
+  const bytes = new Uint8Array(constants.ACCESS_TOKEN_BYTES);
+  crypto.getRandomValues(bytes);
+  const token = `${constants.ACCESS_TOKEN_PREFIX}${base64url(bytes)}`;
+  return {
+    token,
+    tokenHash: await hashAccessToken(token),
+    hint: accessTokenHint(token)
+  };
+};

package/src/constants.ts

@@ -1239,10 +1239,40 @@ const CUSTOM_CODE_MAIN_MODULE = 'index.js';
 const CUSTOM_CODE_MAX_FILES = 25;
 const CUSTOM_CODE_MAX_FILE_PATH = 100;
 
-// WfP script name: `artifact_<artifactId>`. The id, never the slug — slugs are
-// user-editable and a rename would orphan the deployed script.
+// WfP script name: `artifact_<artifactId>_<upload>`. The id, never the slug —
+// slugs are user-editable and a rename would orphan the deployed script.
+//
+// The trailing segment is minted per upload rather than derived from anything,
+// which is the whole point: uploading over a name that already exists is not
+// read-your-writes, so a deploy that replaces a script can serve the previous
+// edition for up to half a minute. A name nothing has ever used cannot, and
+// costs nothing to mint. Everything a publish used to do to survive that race —
+// waiting on an edition marker, refusing with a 503, putting the previous bundle
+// back when validation failed — went with the reuse that caused it.
 const CUSTOM_CODE_SCRIPT_NAME_PREFIX = 'artifact_';
 
+// Worker names cap at 63 characters, and `artifact_<uuid>` already spends 45.
+// That leaves 17 for a separator and a suffix, so a second uuid does not fit and
+// neither does a hex-32 digest. Twelve hex characters is 48 bits against a
+// namespace holding at most a few hundred names for any one artifact — not a
+// collision worth checking for, and an upload to a name in use would fail loudly
+// rather than quietly serve the wrong code.
+const CUSTOM_CODE_SCRIPT_NAME_MAX = 63;
+const CUSTOM_CODE_UPLOAD_SUFFIX_CHARS = 12;
+
+// How long a superseded script stays in the namespace before the hourly sweep
+// may collect it.
+//
+// Deleting at publish time would race the thing it deletes: a tool call that
+// resolved the old pointer a moment earlier is still in flight, and the pointer
+// moving does not recall it. An hour is far longer than any call can take, and
+// the wait costs $0.02 per script per month against an allowance of 1,000.
+const CUSTOM_CODE_SWEEP_GRACE_MS = 60 * 60 * 1_000;
+
+// Deletes per sweep. A backlog drains over several hourly runs rather than
+// making one run unbounded — the same shape the retention purge uses.
+const CUSTOM_CODE_SWEEP_MAX_DELETES = 200;
+
 // A second script per artifact, `artifact_<id>_preview`, that the Test panel
 // deploys a draft into and calls.
 //
@@ -1453,15 +1483,17 @@ const CUSTOM_CODE_COMPATIBILITY_DATE = '2025-11-17';
 // tighter than our own workers' 30s — this is the technical cap that bounds
 // what one adversarial call can cost us, so an infinite loop in a customer's
 // tool is billed as five seconds rather than as whatever it wanted.
-// How long publish waits for the edition it just uploaded to be the one the
-// dispatcher answers with, and how often it asks.
+// How long a deploy waits for a freshly minted script name to become
+// dispatchable, and how often it asks.
 //
-// Bounded rather than open-ended because this runs inside the publish request:
-// past this, publishing would be a request nobody waits out. Exceeding it is
-// reported as "try again" rather than published, which is the safe direction —
-// the alternative is advertising tools backed by a script that is not there yet.
-const CUSTOM_CODE_SMOKE_TIMEOUT_MS = 20_000;
-const CUSTOM_CODE_SMOKE_INTERVAL_MS = 1_000;
+// Every upload goes to a name that has never been used, which is
+// read-your-writes: ~2s end to end against the deployed namespace, against the
+// 20-41s a replacement could take. So this bounds how long a brand-new name
+// takes to register, never how long an old edition takes to stop answering —
+// there is no old edition. It is short for that reason, and a script that
+// answers with the wrong edition now fails outright instead of being waited on.
+const CUSTOM_CODE_REGISTER_TIMEOUT_MS = 8_000;
+const CUSTOM_CODE_REGISTER_INTERVAL_MS = 500;
 
 const CUSTOM_CODE_SCRIPT_CPU_MS = 5_000;
 
@@ -1663,6 +1695,55 @@ const ARTIFACT_SCOPE_PREFIX = 'artifact:';
 // that is one library's behaviour and this is a login that has already opened
 // someone's browser by the time it would fail.
 
+// A personal access token — the durable credential a machine with no browser
+// uses, where an OAuth access token's one hour is not enough. Bound to one
+// project, because that is the unit a deploy pipeline works on: one repository,
+// one artifact, one credential in its CI settings.
+//
+// The prefix is part of the value rather than decoration: it is what lets the
+// middleware tell one of these from an OAuth token before it decides which
+// lookup to make, and it is what secret scanners match on when one leaks into a
+// repository. The rest is 32 random bytes, base64url — the token is the only
+// place the value ever exists in plaintext, since what is stored is its hash.
+const ACCESS_TOKEN_PREFIX = 'ganju_pat_';
+const ACCESS_TOKEN_BYTES = 32;
+
+// Enough of the secret to recognise a row by, and not enough to be worth
+// stealing. Shown in the dashboard and by `ganju token list` beside the name.
+const ACCESS_TOKEN_HINT_CHARS = 6;
+
+const ACCESS_TOKEN_NAME_MAX = 100;
+
+// A ceiling per project, so a compromised session cannot quietly mint an
+// unbounded set of credentials that each survive the session being ended.
+const ACCESS_TOKEN_MAX_PER_PROJECT = 20;
+
+// An expiry is optional, because a scheduled deploy that dies on a date nobody
+// wrote down is its own kind of outage — but a year is the longest we will
+// write one for.
+const ACCESS_TOKEN_MAX_EXPIRY_DAYS = 365;
+
+// `last_used_at` is a convenience, not an audit log, so it is written at most
+// this often per token rather than on every request. The question it answers —
+// "is anything still using this, or can I revoke it" — does not get a better
+// answer from minute-level precision, and the write would otherwise land on the
+// hot path of every CI request.
+const ACCESS_TOKEN_LAST_USED_INTERVAL_MS = 5 * 60 * 1000;
+
+// The only path a personal access token may reach without naming the project it
+// is scoped to, and only on GET. `/me` reports who the token is, which is how
+// the CLI confirms a machine is authenticated at all, and tells it nothing it
+// does not already hold.
+//
+// Everything else is refused, organization routes included — billing, members,
+// the model configs and the other projects are not what a deploy credential is
+// for. The list is deliberately this short: a route added later is closed by
+// omission rather than open by it.
+const ACCESS_TOKEN_UNSCOPED_PATHS = ['/me'];
+
+const ACCESS_TOKEN_SCOPE_MESSAGE =
+  'This token is scoped to a different project';
+
 // Recent custom-tool invocations, as `ganju logs` reads them.
 const CUSTOM_CODE_LOGS_DEFAULT_LIMIT = 20;
 const CUSTOM_CODE_LOGS_MAX_LIMIT = 100;
@@ -2465,6 +2546,10 @@ export const constants = {
   CUSTOM_CODE_MAX_FILE_PATH,
   CUSTOM_CODE_VERSION_STATUSES,
   CUSTOM_CODE_SCRIPT_NAME_PREFIX,
+  CUSTOM_CODE_SCRIPT_NAME_MAX,
+  CUSTOM_CODE_UPLOAD_SUFFIX_CHARS,
+  CUSTOM_CODE_SWEEP_GRACE_MS,
+  CUSTOM_CODE_SWEEP_MAX_DELETES,
   CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX,
   CUSTOM_CODE_PREVIEW_TOKEN_TTL_MS,
   CUSTOM_CODE_TEST_TIMEOUT_MS,
@@ -2506,8 +2591,8 @@ export const constants = {
   CUSTOM_CODE_BROKER_SERVICE_ENV,
   CUSTOM_CODE_COMPATIBILITY_DATE,
   CUSTOM_CODE_SCRIPT_CPU_MS,
-  CUSTOM_CODE_SMOKE_TIMEOUT_MS,
-  CUSTOM_CODE_SMOKE_INTERVAL_MS,
+  CUSTOM_CODE_REGISTER_TIMEOUT_MS,
+  CUSTOM_CODE_REGISTER_INTERVAL_MS,
   CUSTOM_CODE_MAX_LOGS,
   CUSTOM_CODE_MAX_LOG_LENGTH,
   CUSTOM_CODE_SEND_FILE_TARGET_GMAIL,
@@ -2560,6 +2645,15 @@ export const constants = {
   CLI_OAUTH_REDIRECT_PORTS,
   CLI_OAUTH_SCOPES,
   CLI_TOKEN_REFRESH_SKEW_SECONDS,
+  ACCESS_TOKEN_PREFIX,
+  ACCESS_TOKEN_BYTES,
+  ACCESS_TOKEN_HINT_CHARS,
+  ACCESS_TOKEN_NAME_MAX,
+  ACCESS_TOKEN_MAX_PER_PROJECT,
+  ACCESS_TOKEN_MAX_EXPIRY_DAYS,
+  ACCESS_TOKEN_LAST_USED_INTERVAL_MS,
+  ACCESS_TOKEN_UNSCOPED_PATHS,
+  ACCESS_TOKEN_SCOPE_MESSAGE,
   CUSTOM_CODE_LOGS_DEFAULT_LIMIT,
   CUSTOM_CODE_LOGS_MAX_LIMIT,
   BOT_GRANT_TYPE,

package/src/customCodeToken.ts

@@ -179,20 +179,100 @@ export const verifyCustomCodeToken = async (
 };
 
 /**
- * The dispatch-namespace script name for an artifact: `artifact_<id>`.
+ * The legacy dispatch-namespace script name for an artifact: `artifact_<id>`.
  *
  * The id, never the slug — slugs are user-editable and a rename would orphan the
  * deployed script while the database still pointed at a live version.
+ *
+ * Nothing uploads to this name any more; every deploy mints its own. It survives
+ * as the fallback for a version published before `script_name` existed, whose
+ * bundle really is sitting under this name. Tightening a rule must never stop an
+ * already-published version from serving, because that failure is invisible to
+ * whoever owns it — the same reason the boot loop still accepts a stored tool key
+ * the current catalog no longer offers.
  */
 export const customCodeScriptName = (artifactId: string): string =>
   `${constants.CUSTOM_CODE_SCRIPT_NAME_PREFIX}${artifactId}`;
 
 /**
- * The script name a test run deploys into: `artifact_<id>_preview`.
+ * The legacy preview script name: `artifact_<id>_preview`.
  *
- * A second script rather than a second version of the live one, because a test
- * must not be able to disturb what MCP clients are being served — and the only
- * way to be certain of that is for it to run under a name nothing dispatches to.
+ * Kept for the same reason as the one above, and for one more: it is the prefix
+ * the sweep matches to recognise a preview script left behind by a test run that
+ * did not clean up after itself.
  */
 export const customCodePreviewScriptName = (artifactId: string): string =>
   `${customCodeScriptName(artifactId)}${constants.CUSTOM_CODE_PREVIEW_SCRIPT_SUFFIX}`;
+
+/**
+ * A dispatch-namespace name no upload has ever used:
+ * `artifact_<id>_<12 hex chars>`.
+ *
+ * Minted rather than derived, and that is the entire design. Uploading over an
+ * existing name is not read-your-writes — a replacement can serve the previous
+ * edition for tens of seconds — so a deploy that always writes to a new name is
+ * correct by construction rather than by waiting to see whether it worked.
+ *
+ * The suffix deliberately carries no meaning. The two candidates that did are
+ * both wrong: the bundle digest collides whenever a deploy reverts to bytes that
+ * shipped before, which is exactly what a rollback is, and the version id is one
+ * string across every re-upload of a single draft, which is every test run of it.
+ *
+ * Twelve hex characters is what fits. Worker names cap at 63 and
+ * `artifact_<uuid>` spends 45 of them.
+ */
+export const customCodeUploadName = (artifactId: string): string =>
+  mintUploadName(customCodeScriptName(artifactId));
+
+/**
+ * A preview name no test run has ever used:
+ * `artifact_<id>_preview_<12 hex chars>`.
+ *
+ * The sharper version of the same race. Every test used to deploy over one
+ * preview name, so a test could report the run before it — which reads as "my
+ * edit did nothing" from the one tool whose whole job is to say what an edit
+ * does. Nothing stores this: it is minted, used, and deleted inside one request.
+ */
+export const customCodePreviewUploadName = (artifactId: string): string =>
+  mintUploadName(customCodePreviewScriptName(artifactId));
+
+/**
+ * Append `_<hex>` to a base name, spending whatever the 63-character ceiling
+ * leaves and no more.
+ *
+ * The budget is genuinely tight, and the two names spend it differently:
+ *
+ * | name | base | separator | suffix | total |
+ * |---|---|---|---|---|
+ * | live | `artifact_<uuid>` = 45 | 1 | 12 | 58 |
+ * | preview | + `_preview` = 53 | 1 | 8 | 62 |
+ *
+ * Twelve hex characters is 48 bits and eight is 32, against a namespace holding
+ * a few hundred names for any one artifact — and a preview name lives for the
+ * seconds one test run takes. Neither is a collision worth checking for, and an
+ * upload to a name already in use fails loudly rather than quietly serving the
+ * wrong code, which is the failure that matters.
+ *
+ * The ceiling is asserted rather than assumed: it is one number away from being
+ * silently exceeded by a longer prefix, and a name Cloudflare refuses would
+ * surface as a failed publish with nothing explaining why.
+ */
+const mintUploadName = (base: string): string => {
+  const available = constants.CUSTOM_CODE_SCRIPT_NAME_MAX - base.length - 1;
+  // Even, because each byte renders as two hex characters.
+  const chars =
+    Math.min(constants.CUSTOM_CODE_UPLOAD_SUFFIX_CHARS, available) & ~1;
+
+  if (chars < 4) {
+    throw new Error(
+      `A dispatch script name based on "${base}" leaves no room for a unique suffix.`
+    );
+  }
+
+  const bytes = new Uint8Array(chars / 2);
+  crypto.getRandomValues(bytes);
+
+  return `${base}_${Array.from(bytes)
+    .map(byte => byte.toString(16).padStart(2, '0'))
+    .join('')}`;
+};

package/src/index.ts

@@ -102,7 +102,9 @@ import {
   mintCustomCodeToken,
   verifyCustomCodeToken,
   customCodeScriptName,
-  customCodePreviewScriptName
+  customCodePreviewScriptName,
+  customCodeUploadName,
+  customCodePreviewUploadName
 } from './customCodeToken';
 import type { CustomCodeTokenPayload } from './customCodeToken';
 import { oauthProviders } from './oauthProviders';
@@ -133,6 +135,13 @@ import { languageCookieDomain } from './languageCookieDomain';
 import { localizeZodIssue, languageFromHeader } from './localizeZodIssue';
 import { slugifyTitle } from './slugifyTitle';
 import { resourceUriFromTitle } from './resourceUri';
+import {
+  accessTokenHint,
+  hashAccessToken,
+  isAccessToken,
+  mintAccessToken
+} from './accessToken';
+import type { MintedAccessToken } from './accessToken';
 import {
   TOOL_CATALOG,
   TOOL_KEYS,
@@ -257,6 +266,8 @@ export const utils = {
   verifyCustomCodeToken,
   customCodeScriptName,
   customCodePreviewScriptName,
+  customCodeUploadName,
+  customCodePreviewUploadName,
   oauthProviders,
   resolveAttachment,
   isExposedResource,
@@ -279,6 +290,10 @@ export const utils = {
   languageFromHeader,
   slugifyTitle,
   resourceUriFromTitle,
+  accessTokenHint,
+  hashAccessToken,
+  isAccessToken,
+  mintAccessToken,
   TOOL_CATALOG,
   TOOL_KEYS,
   describeCatalogTool,
@@ -323,6 +338,7 @@ export const utils = {
 };
 
 export type {
+  MintedAccessToken,
   CustomCodeProject,
   ProjectPathIssue,
   CatalogGroup,

package/src/schema.ts

@@ -603,6 +603,52 @@ const ORGANIZATION_REMOVE_LLM = z.object({
   organizationId: z.uuid()
 });
 
+// Personal access tokens. `name` is required rather than optional because it is
+// the only thing anyone has to go on when deciding whether revoking a row will
+// break a deploy, and a list of unnamed credentials is a list nobody prunes.
+//
+// `expiresInDays` is what the caller sends; `expiresAt` is what the row stores.
+// A duration is what someone actually decides ("ninety days"), and computing the
+// date on the server means a clock the client got wrong cannot mint a token that
+// outlives what was asked for. Null is a token that does not expire, which is a
+// real answer for a scheduled deploy and is why it is spelled explicitly rather
+// than reached by leaving the field out.
+const ACCESS_TOKEN_CREATE = z.object({
+  name: z.string().trim().min(1).max(constants.ACCESS_TOKEN_NAME_MAX),
+  expiresInDays: z
+    .number()
+    .int()
+    .min(1)
+    .max(constants.ACCESS_TOKEN_MAX_EXPIRY_DAYS)
+    .nullable()
+    .optional(),
+  userId: z.uuid(),
+  organizationId: z.uuid(),
+  projectId: z.uuid()
+});
+
+const ACCESS_TOKEN_LIST = z.object({
+  userId: z.uuid(),
+  organizationId: z.uuid(),
+  projectId: z.uuid()
+});
+
+const ACCESS_TOKEN_REMOVE = z.object({
+  tokenId: z.uuid(),
+  userId: z.uuid(),
+  organizationId: z.uuid(),
+  projectId: z.uuid()
+});
+
+// The ids the route already carries come off: the dashboard reads them from the
+// URL it is on, so a form asking for them again is a second place for them to be
+// wrong.
+const ACCESS_TOKEN_CREATE_VIEW = ACCESS_TOKEN_CREATE.omit({
+  userId: true,
+  organizationId: true,
+  projectId: true
+});
+
 const ORGANIZATION_CREATE_LLM_VIEW = ORGANIZATION_CREATE_LLM.omit({
   userId: true,
   organizationId: true
@@ -1513,6 +1559,10 @@ export const Schema = {
   ORGANIZATION_UPDATE_LLM,
   ORGANIZATION_UPDATE_LLM_VIEW,
   ORGANIZATION_REMOVE_LLM,
+  ACCESS_TOKEN_CREATE,
+  ACCESS_TOKEN_CREATE_VIEW,
+  ACCESS_TOKEN_LIST,
+  ACCESS_TOKEN_REMOVE,
   CHANNEL_CONFIG,
   CHANNEL_CREATE,
   CHANNEL_CREATE_VIEW,