@iveri/contracts 0.38.0 → 0.39.0

package/dist/esm/api/conduit/match-operator.enum.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"match-operator.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/match-operator.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,oBAAY,aAAa;IACrB,+CAA+C;IAC/C,MAAM,WAAW;IAEjB,wDAAwD;IACxD,QAAQ,aAAa;IAErB,mFAAmF;IACnF,WAAW,gBAAgB;IAE3B,wEAAwE;IACxE,MAAM,WAAW;CACpB"}

package/dist/esm/api/conduit/match-operator.enum.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"match-operator.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/match-operator.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,aAYX;AAZD,WAAY,aAAa;IACrB,+CAA+C;IAC/C,kCAAiB,CAAA;IAEjB,wDAAwD;IACxD,sCAAqB,CAAA;IAErB,mFAAmF;IACnF,4CAA2B,CAAA;IAE3B,wEAAwE;IACxE,kCAAiB,CAAA;AACrB,CAAC,EAZW,aAAa,KAAb,aAAa,QAYxB"}

package/dist/esm/api/conduit/provider.type.d.ts

@@ -1,138 +0,0 @@
-import type { IsoDateTime } from '../../type/iso-date-time.type.js';
-import type { Nullable } from '../../type/nil.type.js';
-import type { UUID } from '../../type/uuid.type.js';
-import type { HandshakeKind } from './handshake-kind.enum.js';
-import type { SignatureAlgorithm } from './signature-algorithm.enum.js';
-import type { SignatureEncoding } from './signature-encoding.enum.js';
-import type { SignatureHeaderScheme } from './signature-header-scheme.enum.js';
-/** Required in `signedPayloadTemplate`; substituted with the raw request bytes. */
-export declare const SIGNED_PAYLOAD_BODY_TOKEN = "{body}";
-/** Optional in `signedPayloadTemplate`; substituted with the timestamp exactly as received. */
-export declare const SIGNED_PAYLOAD_TIMESTAMP_TOKEN = "{timestamp}";
-/**
- * How to verify one provider's HMAC.
- *
- * A manifest holds **no secret**. It describes where a signature lives and how it is computed,
- * never the key it is computed with — which is why it is returned in full to anyone with
- * `conduit:provider:read` while the signing secret it is used against is returned to nobody.
- *
- * This is the response shape: every key is present, absent ones are `null`. The request shape
- * is {@link SignatureManifestInput}, where they may be omitted.
- */
-export interface SignatureManifest {
-    algorithm: SignatureAlgorithm;
-    encoding: SignatureEncoding;
-    /** Lowercase header the signature arrives in, e.g. `x-hub-signature-256`. */
-    headerName: string;
-    headerScheme: SignatureHeaderScheme;
-    /** Literal prefix stripped before comparison, e.g. `sha256=`. `DIRECT` scheme only. */
-    headerPrefix: Nullable<string>;
-    /** Key naming the signature inside a `KEY_VALUE_LIST` header, e.g. `v1`. */
-    signatureKey: Nullable<string>;
-    /** Separate header carrying the signed timestamp, when it is not in the signature header. */
-    timestampHeaderName: Nullable<string>;
-    /** Key naming the timestamp inside a `KEY_VALUE_LIST` header, e.g. `t`. */
-    timestampKey: Nullable<string>;
-    /** Replay window. Null disables the age check entirely. */
-    timestampToleranceSeconds: Nullable<number>;
-    /**
-     * What gets hashed. {@link SIGNED_PAYLOAD_BODY_TOKEN} is required;
-     * {@link SIGNED_PAYLOAD_TIMESTAMP_TOKEN} is optional — Slack's is `v0:{timestamp}:{body}`,
-     * Meta's is just `{body}`.
-     */
-    signedPayloadTemplate: string;
-}
-/** {@link SignatureManifest} as sent on create/update: nullable fields may simply be omitted. */
-export interface SignatureManifestInput {
-    algorithm: SignatureAlgorithm;
-    encoding: SignatureEncoding;
-    headerName: string;
-    headerScheme: SignatureHeaderScheme;
-    headerPrefix?: Nullable<string>;
-    signatureKey?: Nullable<string>;
-    timestampHeaderName?: Nullable<string>;
-    timestampKey?: Nullable<string>;
-    timestampToleranceSeconds?: Nullable<number>;
-    signedPayloadTemplate: string;
-}
-/**
- * How to answer one provider's URL-verification challenge.
- *
- * The fields split by {@link HandshakeKind} — a `QUERY_ECHO` manifest populates the four query
- * parameter names and nulls the rest, a `JSON_ECHO` manifest does the opposite.
- */
-export interface HandshakeManifest {
-    kind: HandshakeKind;
-    /** Query parameter holding the value to echo back, e.g. `hub.challenge`. */
-    challengeParam: Nullable<string>;
-    /** Query parameter holding the token to compare against the endpoint's, e.g. `hub.verify_token`. */
-    verifyTokenParam: Nullable<string>;
-    /** Query parameter naming the operation, e.g. `hub.mode`. */
-    modeParam: Nullable<string>;
-    /** Value `modeParam` must hold for this to be a handshake, e.g. `subscribe`. */
-    expectedMode: Nullable<string>;
-    /** Top-level body field identifying a handshake, e.g. `type`. */
-    triggerField: Nullable<string>;
-    /** Value `triggerField` must hold, e.g. `url_verification`. */
-    triggerValue: Nullable<string>;
-    /** Body field holding the value to echo back, e.g. `challenge`. */
-    challengeField: Nullable<string>;
-}
-/** {@link HandshakeManifest} as sent on create/update: nullable fields may simply be omitted. */
-export interface HandshakeManifestInput {
-    kind: HandshakeKind;
-    challengeParam?: Nullable<string>;
-    verifyTokenParam?: Nullable<string>;
-    modeParam?: Nullable<string>;
-    expectedMode?: Nullable<string>;
-    triggerField?: Nullable<string>;
-    triggerValue?: Nullable<string>;
-    challengeField?: Nullable<string>;
-}
-/** One provider on the wire. `GET /api/v1/provider`. */
-export interface Provider {
-    /** Null for a built-in — it is not a row and cannot be edited or deleted. */
-    id: Nullable<UUID>;
-    key: string;
-    name: string;
-    description: Nullable<string>;
-    /** Null when this provider signs nothing. */
-    signature: Nullable<SignatureManifest>;
-    /** Null when this provider has no URL challenge. */
-    handshake: Nullable<HandshakeManifest>;
-    /**
-     * Ships with Conduit, in code rather than as a seeded row. Override it by creating your own
-     * under the same key — resolution checks a tenant's rows first.
-     */
-    isBuiltIn: boolean;
-    /** Null for a built-in. */
-    createdAt: Nullable<IsoDateTime>;
-    /** Null for a built-in. */
-    updatedAt: Nullable<IsoDateTime>;
-}
-/**
- * Not paginated: the list is the built-ins plus whatever one customer has defined by hand.
- * Wrapped in an object rather than returned as a bare array so a `total` or a cursor can be
- * added later without breaking every client.
- */
-export interface ProvidersList {
-    items: Provider[];
-}
-/** `POST /api/v1/provider`. */
-export interface CreateProviderBody {
-    key: string;
-    name: string;
-    description?: Nullable<string>;
-    signature?: Nullable<SignatureManifestInput>;
-    handshake?: Nullable<HandshakeManifestInput>;
-}
-/** `PATCH /api/v1/provider/:id`. */
-export interface UpdateProviderBody {
-    name?: string;
-    description?: Nullable<string>;
-    /** Send `null` to stop verifying this provider's signatures. */
-    signature?: Nullable<SignatureManifestInput>;
-    /** Send `null` to stop answering this provider's challenge. */
-    handshake?: Nullable<HandshakeManifestInput>;
-}
-//# sourceMappingURL=provider.type.d.ts.map

package/dist/esm/api/conduit/provider.type.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"provider.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/provider.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE/E,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAElD,+FAA+F;AAC/F,eAAO,MAAM,8BAA8B,gBAAgB,CAAC;AAE5D;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAC9B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,QAAQ,EAAE,iBAAiB,CAAC;IAE5B,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IAEnB,YAAY,EAAE,qBAAqB,CAAC;IAEpC,uFAAuF;IACvF,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B,6FAA6F;IAC7F,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEtC,2EAA2E;IAC3E,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B,2DAA2D;IAC3D,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5C;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;CACjC;AAED,iGAAiG;AACjG,MAAM,WAAW,sBAAsB;IACnC,SAAS,EAAE,kBAAkB,CAAC;IAC9B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,qBAAqB,CAAC;IACpC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,yBAAyB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,qBAAqB,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAC9B,IAAI,EAAE,aAAa,CAAC;IAIpB,4EAA4E;IAC5E,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjC,oGAAoG;IACpG,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEnC,6DAA6D;IAC7D,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE5B,gFAAgF;IAChF,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAI/B,iEAAiE;IACjE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B,+DAA+D;IAC/D,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B,mEAAmE;IACnE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACpC;AAED,iGAAiG;AACjG,MAAM,WAAW,sBAAsB;IACnC,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACrC;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACrB,6EAA6E;IAC7E,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEnB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,6CAA6C;IAC7C,SAAS,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAEvC,oDAAoD;IACpD,SAAS,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAEvC;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;IAEnB,2BAA2B;IAC3B,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEjC,2BAA2B;IAC3B,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC1B,KAAK,EAAE,QAAQ,EAAE,CAAC;CACrB;AAED,+BAA+B;AAC/B,MAAM,WAAW,kBAAkB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC7C,SAAS,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;CAChD;AAED,oCAAoC;AACpC,MAAM,WAAW,kBAAkB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B,gEAAgE;IAChE,SAAS,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAE7C,+DAA+D;IAC/D,SAAS,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;CAChD"}

package/dist/esm/api/conduit/provider.type.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"provider.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/provider.type.ts"],"names":[],"mappings":"AASA,mFAAmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAElD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,8BAA8B,GAAG,aAAa,CAAC"}

package/dist/esm/api/conduit/replay.type.d.ts

@@ -1,48 +0,0 @@
-import type { IsoDateTime } from '../../type/iso-date-time.type.js';
-import type { Nullable } from '../../type/nil.type.js';
-import type { UUID } from '../../type/uuid.type.js';
-/** One replay attempt and whatever came back. */
-export interface Replay {
-    id: UUID;
-    captureId: UUID;
-    targetUrl: string;
-    method: string;
-    /** The body differed from the capture's, so the original signature no longer verifies. */
-    isEdited: boolean;
-    /** Null when no response arrived — a timeout, a refused connection. See `errorMessage`. */
-    responseStatus: Nullable<number>;
-    responseHeaders: Nullable<Record<string, string | string[]>>;
-    /** First 64 KB of the response body. */
-    responseBodyPreview: Nullable<string>;
-    responseBodyTruncated: boolean;
-    /**
-     * Why it failed. **A failed replay is still a 200 from the replay endpoint** — the target
-     * being down is the answer you asked for, not an error on Conduit's side.
-     */
-    errorMessage: Nullable<string>;
-    durationMs: number;
-    executedByUserId: Nullable<UUID>;
-    createdAt: IsoDateTime;
-}
-/**
- * Unpaginated: one capture accrues a handful of replays while someone fixes a receiver, not
- * thousands.
- */
-export interface ReplaysList {
-    items: Replay[];
-}
-/** `POST /api/v1/capture/:id/replay`. */
-export interface ExecuteReplayBody {
-    targetUrl: string;
-    /** Defaults to the capture's method. */
-    method?: Nullable<string>;
-    /** Merged over the captured headers. Signature headers are forwarded deliberately. */
-    headers?: Nullable<Record<string, string>>;
-    /**
-     * Replacement body, base64. Omitting it resends the captured bytes exactly, which is the
-     * only way the original signature still verifies — editing necessarily invalidates it, and
-     * the resulting replay is flagged `isEdited`.
-     */
-    bodyBase64?: Nullable<string>;
-}
-//# sourceMappingURL=replay.type.d.ts.map

package/dist/esm/api/conduit/replay.type.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"replay.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/replay.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,iDAAiD;AACjD,MAAM,WAAW,MAAM;IACnB,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,0FAA0F;IAC1F,QAAQ,EAAE,OAAO,CAAC;IAElB,2FAA2F;IAC3F,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;IAE7D,wCAAwC;IACxC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEtC,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;OAGG;IACH,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,iBAAiB;IAC9B,SAAS,EAAE,MAAM,CAAC;IAElB,wCAAwC;IACxC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE1B,sFAAsF;IACtF,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE3C;;;;OAIG;IACH,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACjC"}

package/dist/esm/api/conduit/replay.type.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=replay.type.js.map

package/dist/esm/api/conduit/replay.type.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"replay.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/replay.type.ts"],"names":[],"mappings":""}

package/dist/esm/api/conduit/route.type.d.ts

@@ -1,124 +0,0 @@
-import type { IsoDateTime } from '../../type/iso-date-time.type.js';
-import type { Maybe, Nullable } from '../../type/nil.type.js';
-import type { UUID } from '../../type/uuid.type.js';
-import type { MatchOperator } from './match-operator.enum.js';
-/** One condition on a request header. */
-export interface HeaderMatcher {
-    /** Lowercase. Inbound header names are lowercased, so anything else never matches. */
-    name: string;
-    operator: MatchOperator;
-    /** Ignored when the operator is `exists`. */
-    value: Nullable<string>;
-}
-/**
- * One condition on a field inside a JSON body.
- *
- * `path` is a **dotted path**, not JSONPath: `type`, `data.object.id`, `entry.0.changes.0.field`.
- * Numeric segments index arrays.
- *
- * Deliberately not JSONPath and not a regular expression. An expression evaluator running over
- * an attacker-controlled webhook body is a different risk class from a path walk —
- * `jsonpath-plus` shipped a remote code execution hole doing exactly this job (CVE-2024-21534).
- * A dotted path has nothing in it to exploit, and it covers every real routing rule: branch on
- * an event type, a channel, an object id.
- */
-export interface BodyMatcher {
-    path: string;
-    operator: MatchOperator;
-    /** Ignored when the operator is `exists`. */
-    value: Nullable<string>;
-}
-/** A matcher as sent on a request, where the operand may simply be omitted. */
-export interface HeaderMatcherInput extends Omit<HeaderMatcher, 'value'> {
-    value?: Maybe<string>;
-}
-/** A body matcher as sent on a request. See {@link HeaderMatcherInput}. */
-export interface BodyMatcherInput extends Omit<BodyMatcher, 'value'> {
-    value?: Maybe<string>;
-}
-/**
- * Which captures fan out to which destinations.
- *
- * **Every criterion is nullable, and null means "any".** A route with all of them null matches
- * every request on the tenant, which is what a customer writes first. Criteria are ANDed; there
- * is no OR and no negation, because two routes express an OR and one rule that can express
- * arbitrary boolean logic is a language.
- */
-export interface Route {
-    id: UUID;
-    name: string;
-    description: Nullable<string>;
-    /** Null matches any endpoint. */
-    endpointId: Nullable<UUID>;
-    /** Null matches any provider. */
-    providerKey: Nullable<string>;
-    /** Null matches any method. */
-    method: Nullable<string>;
-    /**
-     * Glob over the path after the ingress token. `*` spans one segment, `**` spans any number,
-     * and both ends are anchored — `/orders` does not match `/orders/created`. A glob rather
-     * than a regular expression: a customer-supplied pattern evaluated on the ingress path would
-     * be a ReDoS primitive. Null matches any path.
-     */
-    pathPattern: Nullable<string>;
-    /** Empty rather than null when there are no conditions, so a client handles one spelling. */
-    headerMatchers: HeaderMatcher[];
-    bodyMatchers: BodyMatcher[];
-    /** In order. At least one. */
-    destinationIds: UUID[];
-    /** Evaluation order, lowest first. Only observable through `stopOnMatch`. */
-    priority: number;
-    /**
-     * Stop evaluating further routes once this one matches.
-     *
-     * Default false, so the natural behaviour is fan-out — two routes matching one request both
-     * fire, which is what "also send this to the audit service" means.
-     */
-    stopOnMatch: boolean;
-    isActive: boolean;
-    createdAt: IsoDateTime;
-    updatedAt: IsoDateTime;
-}
-/** `GET /api/v1/routes`. Ordered by priority then age — the order they are evaluated in. */
-export interface RoutesPage {
-    items: Route[];
-    total: number;
-    limit: number;
-    offset: number;
-}
-/** `POST /api/v1/routes`. */
-export interface CreateRouteBody {
-    name: string;
-    description?: Nullable<string>;
-    endpointId?: Nullable<UUID>;
-    providerKey?: Nullable<string>;
-    method?: Nullable<string>;
-    pathPattern?: Nullable<string>;
-    headerMatchers?: Nullable<HeaderMatcherInput[]>;
-    bodyMatchers?: Nullable<BodyMatcherInput[]>;
-    destinationIds: UUID[];
-    priority?: Nullable<number>;
-    stopOnMatch?: Nullable<boolean>;
-}
-/**
- * `PATCH /api/v1/routes/:id`.
- *
- * For the criteria, `null` and omission differ: omitting leaves the stored criterion alone,
- * sending `null` widens the route to "any" for it. A form must send `null` rather than `''` to
- * clear one — an empty string is a criterion nothing matches, which looks like the route broke.
- */
-export interface UpdateRouteBody {
-    name?: string;
-    description?: Nullable<string>;
-    endpointId?: Nullable<UUID>;
-    providerKey?: Nullable<string>;
-    method?: Nullable<string>;
-    pathPattern?: Nullable<string>;
-    headerMatchers?: Nullable<HeaderMatcherInput[]>;
-    bodyMatchers?: Nullable<BodyMatcherInput[]>;
-    destinationIds?: UUID[];
-    priority?: number;
-    stopOnMatch?: boolean;
-    isActive?: boolean;
-}
-//# sourceMappingURL=route.type.d.ts.map

package/dist/esm/api/conduit/route.type.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"route.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/route.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC1B,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,6CAA6C;IAC7C,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;IACpE,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC;IAChE,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,KAAK;IAClB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,iCAAiC;IACjC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE3B,iCAAiC;IACjC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,+BAA+B;IAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEzB;;;;;OAKG;IACH,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,6FAA6F;IAC7F,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,YAAY,EAAE,WAAW,EAAE,CAAC;IAE5B,8BAA8B;IAC9B,cAAc,EAAE,IAAI,EAAE,CAAC;IAEvB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IACvB,KAAK,EAAE,KAAK,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,6BAA6B;AAC7B,MAAM,WAAW,eAAe;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAChD,YAAY,CAAC,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5C,cAAc,EAAE,IAAI,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAChD,YAAY,CAAC,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACtB"}

package/dist/esm/api/conduit/route.type.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=route.type.js.map

package/dist/esm/api/conduit/route.type.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"route.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/route.type.ts"],"names":[],"mappings":""}

package/dist/esm/api/conduit/signature-algorithm.enum.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature-algorithm.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/signature-algorithm.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,oBAAY,kBAAkB;IAC1B,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;CACpB"}

package/dist/esm/api/conduit/signature-algorithm.enum.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature-algorithm.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/signature-algorithm.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC1B,mCAAa,CAAA;IACb,uCAAiB,CAAA;IACjB,uCAAiB,CAAA;AACrB,CAAC,EAJW,kBAAkB,KAAlB,kBAAkB,QAI7B"}

package/dist/esm/api/conduit/signature-encoding.enum.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature-encoding.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/signature-encoding.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,oBAAY,iBAAiB;IACzB,GAAG,QAAQ;IACX,MAAM,WAAW;CACpB"}

package/dist/esm/api/conduit/signature-encoding.enum.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature-encoding.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/signature-encoding.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,iBAGX;AAHD,WAAY,iBAAiB;IACzB,gCAAW,CAAA;IACX,sCAAiB,CAAA;AACrB,CAAC,EAHW,iBAAiB,KAAjB,iBAAiB,QAG5B"}

package/dist/esm/api/conduit/signature-header-scheme.enum.d.ts

@@ -1,19 +0,0 @@
-/**
- * How the signature is packed into its header.
- *
- * Two shapes cover every provider we have met:
- *
- * - `DIRECT` — the header *is* the signature, optionally behind a prefix:
- *   `x-hub-signature-256: sha256=a1b2…`
- * - `KEY_VALUE_LIST` — a comma-separated list the signature is one entry of, because the
- *   provider also ships a timestamp in the same header:
- *   `stripe-signature: t=1737031234,v1=a1b2…`
- *
- * Modelling the packing separately from the digest is what keeps "add TikTok" a manifest rather
- * than a code change.
- */
-export declare enum SignatureHeaderScheme {
-    DIRECT = "direct",
-    KEY_VALUE_LIST = "key-value-list"
-}
-//# sourceMappingURL=signature-header-scheme.enum.d.ts.map

package/dist/esm/api/conduit/signature-header-scheme.enum.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature-header-scheme.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/signature-header-scheme.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,oBAAY,qBAAqB;IAC7B,MAAM,WAAW;IACjB,cAAc,mBAAmB;CACpC"}

package/dist/esm/api/conduit/signature-header-scheme.enum.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature-header-scheme.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/signature-header-scheme.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC7B,0CAAiB,CAAA;IACjB,0DAAiC,CAAA;AACrC,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC"}

package/dist/esm/api/conduit/signature-verdict.enum.d.ts

@@ -1,50 +0,0 @@
-/**
- * The outcome of a signature check.
- *
- * **Not a boolean, and that is the entire point of the feature.** "Invalid" is the least useful
- * thing you can tell someone whose webhook is failing: the interesting cases are all the ways
- * verification could not even run. Six of these eight are "we did not check", each for a
- * different and separately fixable reason, and collapsing them into `false` is what makes
- * webhook debugging take an afternoon.
- *
- * Stored on every capture so the list view can be filtered by it, and returned by the
- * diagnostic alongside the evidence.
- *
- * A UI must not colour all six red. Only {@link SignatureVerdict.INVALID} and
- * {@link SignatureVerdict.TIMESTAMP_OUT_OF_TOLERANCE} indicate something wrong; the other five
- * "could not verify" verdicts mean nobody configured verification, and painting those as
- * failures sends people to debug a provider that is behaving correctly.
- */
-export declare enum SignatureVerdict {
-    /** Computed digest matched the received one, and any timestamp was inside tolerance. */
-    VALID = "valid",
-    /**
-     * Everything needed was present and the digests differ.
-     *
-     * The only verdict that suggests something is actually wrong — and even then, usually with
-     * the secret or the manifest rather than with the request. The diagnostic's hints exist for
-     * this case.
-     */
-    INVALID = "invalid",
-    /** The endpoint names no provider, so there is no manifest describing what to check. */
-    NO_PROVIDER = "no-provider",
-    /** The manifest describes no signature scheme — this provider signs nothing. */
-    NOT_SIGNED = "not-signed",
-    /** No signing secret is configured on the endpoint. Nothing to compute a digest with. */
-    MISSING_SECRET = "missing-secret",
-    /** The manifest's header is absent from the request. Often the provider is not who you think. */
-    MISSING_SIGNATURE = "missing-signature",
-    /**
-     * The header is present but does not parse — a `key-value-list` without the expected key, or
-     * a prefix that is not there. Distinct from `INVALID` because no digest was ever compared.
-     */
-    MALFORMED_SIGNATURE = "malformed-signature",
-    /**
-     * Digest matched, but the signed timestamp is outside the provider's replay window.
-     *
-     * Separate from both `VALID` and `INVALID` on purpose: the signature is genuine, so this is
-     * either a replay or a clock-skew problem, and those have opposite fixes.
-     */
-    TIMESTAMP_OUT_OF_TOLERANCE = "timestamp-out-of-tolerance"
-}
-//# sourceMappingURL=signature-verdict.enum.d.ts.map

package/dist/esm/api/conduit/signature-verdict.enum.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature-verdict.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/signature-verdict.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,gBAAgB;IACxB,wFAAwF;IACxF,KAAK,UAAU;IAEf;;;;;;OAMG;IACH,OAAO,YAAY;IAEnB,wFAAwF;IACxF,WAAW,gBAAgB;IAE3B,gFAAgF;IAChF,UAAU,eAAe;IAEzB,yFAAyF;IACzF,cAAc,mBAAmB;IAEjC,iGAAiG;IACjG,iBAAiB,sBAAsB;IAEvC;;;OAGG;IACH,mBAAmB,wBAAwB;IAE3C;;;;;OAKG;IACH,0BAA0B,+BAA+B;CAC5D"}

package/dist/esm/api/conduit/signature-verdict.enum.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature-verdict.enum.js","sourceRoot":"","sources":["../../../../src/api/conduit/signature-verdict.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,gBAsCX;AAtCD,WAAY,gBAAgB;IACxB,wFAAwF;IACxF,mCAAe,CAAA;IAEf;;;;;;OAMG;IACH,uCAAmB,CAAA;IAEnB,wFAAwF;IACxF,+CAA2B,CAAA;IAE3B,gFAAgF;IAChF,6CAAyB,CAAA;IAEzB,yFAAyF;IACzF,qDAAiC,CAAA;IAEjC,iGAAiG;IACjG,2DAAuC,CAAA;IAEvC;;;OAGG;IACH,+DAA2C,CAAA;IAE3C;;;;;OAKG;IACH,6EAAyD,CAAA;AAC7D,CAAC,EAtCW,gBAAgB,KAAhB,gBAAgB,QAsC3B"}

package/dist/esm/api/conduit/signature.type.d.ts

@@ -1,54 +0,0 @@
-import type { Nullable } from '../../type/nil.type.js';
-import type { SignatureAlgorithm } from './signature-algorithm.enum.js';
-import type { SignatureEncoding } from './signature-encoding.enum.js';
-import type { SignatureVerdict } from './signature-verdict.enum.js';
-/** Why a timestamp was or was not inside its replay window. */
-export interface TimestampDiagnostic {
-    /** Where the timestamp was read from — a header name, or a key inside one. */
-    source: string;
-    /** Exactly as received. A provider sending milliseconds shows up here. */
-    rawValue: string;
-    /** Seconds old. Negative means the provider's clock is ahead of ours. */
-    ageSeconds: Nullable<number>;
-    toleranceSeconds: number;
-    withinTolerance: boolean;
-}
-/**
- * The evidence behind a {@link SignatureVerdict}, not the verdict alone.
- * `GET /api/v1/capture/:id/signature`.
- *
- * **The signing secret never appears here**, in any form — not the value, not a hash, not a
- * length.
- */
-export interface SignatureDiagnostic {
-    verdict: SignatureVerdict;
-    /** One sentence, safe to render directly. */
-    summary: string;
-    providerKey: Nullable<string>;
-    algorithm: Nullable<SignatureAlgorithm>;
-    encoding: Nullable<SignatureEncoding>;
-    headerName: Nullable<string>;
-    /** The header exactly as received, before any prefix was stripped. */
-    receivedHeader: Nullable<string>;
-    /** The digest read out of that header. */
-    receivedSignature: Nullable<string>;
-    /** What we computed, in the manifest's encoding. */
-    computedSignature: Nullable<string>;
-    /**
-     * Readable rendering of the exact bytes hashed — truncated and lossy, for recognising the
-     * shape. When the bytes themselves matter, use `signedPayloadByteLength` and `bodySha256`.
-     */
-    signedPayloadPreview: Nullable<string>;
-    signedPayloadByteLength: Nullable<number>;
-    /** Hex SHA-256 of the body. Compare against what the provider says it sent. */
-    bodySha256: string;
-    bodyByteLength: number;
-    timestamp: Nullable<TimestampDiagnostic>;
-    /**
-     * Specific, verified observations — each produced by recomputing the digest a different way
-     * and finding that it matched. **Every hint is a verified alternative, never a guess**, so
-     * acting on one always fixes the problem.
-     */
-    hints: string[];
-}
-//# sourceMappingURL=signature.type.d.ts.map

package/dist/esm/api/conduit/signature.type.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature.type.d.ts","sourceRoot":"","sources":["../../../../src/api/conduit/signature.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAChC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IAEf,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IAEjB,yEAAyE;IACzE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,gBAAgB,CAAC;IAE1B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAEhB,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,SAAS,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACxC,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACtC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE7B,sEAAsE;IACtE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjC,0CAA0C;IAC1C,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEpC,oDAAoD;IACpD,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEpC;;;OAGG;IACH,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEvC,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE1C,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IAEnB,cAAc,EAAE,MAAM,CAAC;IAEvB,SAAS,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAEzC;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACnB"}

package/dist/esm/api/conduit/signature.type.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=signature.type.js.map

package/dist/esm/api/conduit/signature.type.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signature.type.js","sourceRoot":"","sources":["../../../../src/api/conduit/signature.type.ts"],"names":[],"mappings":""}

package/dist/esm/api/identity/access-token-payload.interface.d.ts

@@ -1,53 +0,0 @@
-import type { UserPermission } from '../../enum/user-permission.enum.js';
-import type { UUID } from '../../type/uuid.type.js';
-import type { PrincipalType } from './principal-type.enum.js';
-/**
- * Claims carried by an access token.
- *
- * **`iveri-identity-api` issues these; every other service only verifies them.** The shape is
- * therefore a contract owned by identity, and it lives here rather than in either repo because
- * both sides have to agree byte for byte — a service whose idea of these claims has drifted
- * does not fail loudly, it rejects every request or, worse, reads the wrong field and keeps
- * going. `conduit-api` carried a hand-copied duplicate of this interface until the `pt` claim
- * had to be added to both at once, which is exactly the drift the copy invited.
- *
- * Names are short and non-obvious (`tid`, `perms`) because this is JWT convention and because
- * the token travels on every request — the registered claims are three characters for the same
- * reason.
- *
- * **Permissions are embedded rather than resolved per request.** That is the whole point of a
- * JWT here: any Iveri service verifies a token with the shared secret and never calls identity
- * on the hot path. The cost is staleness — revoking a role does not invalidate access tokens
- * already issued, so a removed permission survives up to identity's `JWT_ACCESS_TOKEN_TTL`
- * (15 minutes by default), or `JWT_SERVICE_TOKEN_TTL` for a service token. Anything needing
- * immediate revocation must check state at the point of use, not rely on the token.
- */
-export interface AccessTokenPayload {
-    /**
-     * Subject — **the principal**, which is a user id or an API key id depending on {@link pt}.
-     *
-     * Read it together with `pt` or not at all. Treating it as a user id unconditionally is the
-     * one mistake this shape is arranged to prevent.
-     */
-    sub: UUID;
-    /**
-     * Which kind of principal `sub` names.
-     *
-     * Required, so adding the service-token path could not silently leave a consumer reading a
-     * machine's `sub` as a person's id.
-     */
-    pt: PrincipalType;
-    /** Tenant the token is scoped to. Becomes `RequestContext.tenantId`; never trusted from a header. */
-    tid: UUID;
-    /** Permissions resolved from the principal's roles — or from the API key's grant — at issue time. */
-    perms: UserPermission[];
-    /** Issued-at, seconds since epoch. Set by the signer. */
-    iat?: number;
-    /** Expiry, seconds since epoch. Set by the signer. */
-    exp?: number;
-    /** Issuer, verified on every decode so a token from another Iveri environment is rejected. */
-    iss?: string;
-    /** Audience, verified alongside `iss`. */
-    aud?: string;
-}
-//# sourceMappingURL=access-token-payload.interface.d.ts.map

package/dist/esm/api/identity/access-token-payload.interface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-token-payload.interface.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/access-token-payload.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,kBAAkB;IAC/B;;;;;OAKG;IACH,GAAG,EAAE,IAAI,CAAC;IAEV;;;;;OAKG;IACH,EAAE,EAAE,aAAa,CAAC;IAElB,qGAAqG;IACrG,GAAG,EAAE,IAAI,CAAC;IAEV,qGAAqG;IACrG,KAAK,EAAE,cAAc,EAAE,CAAC;IAExB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/esm/api/identity/access-token-payload.interface.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=access-token-payload.interface.js.map

package/dist/esm/api/identity/access-token-payload.interface.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-token-payload.interface.js","sourceRoot":"","sources":["../../../../src/api/identity/access-token-payload.interface.ts"],"names":[],"mappings":""}