@lenne.tech/nest-server 11.41.3 → 11.41.5

package/.claude/rules/architecture.md

@@ -56,6 +56,7 @@ consumer follows. See `.claude/rules/configurable-features.md` for the full opti
 
 | Module | Purpose |
 |--------|---------|
+| **ApiToken** | Opt-in bearer tokens: USER tokens (act as their user, no global roles) and TENANT tokens (lowest tenant role, own tenant only); deny by default via `@ApiTokenScopes()`; signed short-lived assertions |
 | **Auth** | JWT authentication, refresh tokens, role-based access |
 | **BetterAuth** | Modern auth integration (2FA, Passkey, Social) |
 | **ErrorCode** | Centralized error codes with unique identifiers |

package/.claude/rules/configurable-features.md

@@ -321,6 +321,7 @@ This pattern is currently applied to:
 | Translate Response Interceptor | `security.translateResponseInterceptor` | Boolean Shorthand | `true` (enabled) |
 | Secret Fields Removal | `security.secretFields` | Array | `['password', 'verificationToken', ...]` |
 | Multi-Tenancy | `multiTenancy` | Presence Implies Enabled | **`excludeSchemas` is an OFF SWITCH for isolation, per model** — a listed schema gets no tenant filter at all; since 11.35.0 the plugin WARNS once per model when the excluded schema declares `tenantId` (i.e. was built for isolation). The framework's own docs recommended `['User', 'Session']` until then; that is withdrawn — it is only right for the global-user model. Since 11.35.0 GraphQL operations over the WEBSOCKET also run inside a `RequestContext` (`CoreModule` installs a context-aware `execute`/`subscribe` pair inside `subscriptions`, where `ApolloDriver` forwards it): the tenant comes from the handshake header validated against an active membership, else from the subscriber's memberships, and an unresolvable tenant leaves the safety net to refuse the read rather than returning everything. `headerName: 'x-tenant-id'`, `membershipModel: 'TenantMember'`, `adminBypass: true`, `excludeSchemas: []`, `roleHierarchy: { member: 1, manager: 2, owner: 3 }`, `cacheTtlMs: 30000` (0 disables, process-local). System roles (`S_EVERYONE`, `S_USER`, `S_VERIFIED`) are checked as OR alternatives before real roles; method-level system roles take precedence; membership validated for context when system role grants access + header present. Hierarchy roles use level comparison, normal roles use exact match. Use `DefaultHR` or `createHierarchyRoles()` for type-safe role constants. Bypass: `RequestContext.runWithBypassTenantGuard()`. Cache invalidation: `invalidateUser(userId)` / `invalidateAll()` are **instance** methods on the singleton `CoreTenantGuard` — inject it and call `this.tenantGuard?.invalidateUser(userId)`, never `CoreTenantGuard.invalidateUser(...)` (there is no static). With `redis` configured, both additionally BROADCAST the invalidation to every replica (`<keyPrefix>:tenant-cache:invalidate` pub/sub); without Redis they clear the local process only, so other replicas stay stale until `cacheTtlMs`. A received broadcast clears locally without re-publishing |
+| API Tokens | `apiTokens` | Boolean Shorthand + Presence Implies Enabled — absent = off | `prefix: 'ltt'`, `scopes: []` (vocabulary; empty = no token creatable, boot warning), `manageRole`: highest hierarchy role, `maxAssertionLifetimeSeconds: 900` (invalid → default, never unbounded — Family C), `rateLimit: { max: 600, windowSeconds: 60 }` per token (**on by default**, `false` disables; Redis-shared when configured), `userTokens: true`, `tenantTokens: true` (effective only with `multiTenancy`), `encryptionKey` → `SECRETS_ENCRYPTION_KEY` → dev default (boot FAILS in production/staging). Top-level, NOT under `multiTenancy`: user tokens must work without it. **Deny by default**: every guard refuses a token on a route without `@ApiTokenScopes()`, public routes included, via ONE shared function (`enforceApiTokenRoute`) called BEFORE each guard's public-route shortcut. USER tokens act as their user with global roles REMOVED (no admin bypass); TENANT tokens act with the lowest hierarchy role in their own tenant, and a route guarded ONLY by `S_SELF` / `S_CREATOR` refuses them (a tenant token is nobody's self — skipping those roles would grant for any target). A tenant token depends on no member, so it outlives an off-boarded or deleted tenant until the project calls `deleteAllForTenant()`. The boot refuses a hierarchy in which that lowest role reaches `manageRole`. A prefixed credential that fails answers 401 on every route (not anonymous); `CoreBetterAuthMiddleware` skips prefixed credentials entirely, cookie fallback included. A password reset that ends the user's sessions ends their USER tokens too (legacy reset always; IAM reset while `betterAuth.emailAndPassword.revokeSessionsOnPasswordReset` is on), wired through `core-api-token.registry.ts` so neither reset path imports the optional module. Implementation: `src/core/modules/api-token/` |
 | BetterAuth Tenant Skip | `betterAuth.skipTenantCheck` | Explicit Boolean | `true` (default). When `true` and no `X-Tenant-Id` header is sent, IAM endpoints (controller + resolver) skip `CoreTenantGuard` tenant validation. When header IS present, normal membership validation runs regardless. Set `false` for tenant-aware auth scenarios (subdomain-based, invite links, SSO per tenant) |
 | Debug Process Input | `debugProcessInput` | Explicit Boolean | `false` (default). When `true`, logs a debug message when `prepareInput()` changes the input type during `process()`. Has performance cost due to `JSON.stringify` on every `process()` call — enable only for debugging |
 | JSONTransport Production Guard | `email.smtp` with `jsonTransport` | Runtime Guard | Throws `Error` when `email.smtp` has a truthy `jsonTransport` property in `production` or `staging` environments (read from config `env` field). JSONTransport silently discards all outgoing mail — the guard prevents accidental misconfiguration that causes password-reset, 2FA, and verification emails to vanish. Use `{ jsonTransport: true }` only in CI/e2e/local environments |

package/.claude/rules/role-system.md

@@ -403,10 +403,24 @@ Hierarchy roles use **level comparison** (higher includes lower). Normal roles u
 
 Both work in `@Roles()` (method-level) and `@Restricted()` (field-level) via unified `checkRoleAccess()`.
 
+## Delegation needs a REGISTERED tenant guard (11.41.4)
+
+The role guards hand non-system roles to `CoreTenantGuard` because that guard resolves them against
+the membership. They used to decide from configuration alone (`isMultiTenancyActive()`), so with
+`multiTenancy` configured but no tenant guard registered, `@Roles(RoleEnum.ADMIN)` admitted every
+authenticated caller: the role went to a guard that never ran. They now ask
+`delegatesRolesToTenantGuard()`, which also requires `hasActiveTenantGuard()`
+(`core-tenant-guard.registry.ts`, filled by `CoreTenantModule` and by `CoreTenantGuard` itself) and
+otherwise lets the role guard check `user.roles` — fail-closed, warned once. Pinned by
+`tests/unit/tenant-guard-delegation.spec.ts` (mutation `role-guards-delegate-without-tenant-guard`).
+
+**Configured is not registered.** When you add a guard that delegates to another one, ask whether
+the other one RUNS, not whether it is configured.
+
 ## Role Check Implementation
 
 The role system is evaluated in:
-- `RolesGuard` / `BetterAuthRolesGuard` - Checks method-level `@Roles()` decorators (passes through non-system roles to `CoreTenantGuard` when multiTenancy active)
+- `RolesGuard` / `BetterAuthRolesGuard` - Checks method-level `@Roles()` decorators (passes through non-system roles to `CoreTenantGuard` when multiTenancy is active AND a tenant guard is registered — see below)
 - `CoreTenantGuard` - Validates tenant membership and checks hierarchy/normal roles
 - `CheckResponseInterceptor` - Filters fields based on `@Restricted()` decorators
 - `CheckSecurityInterceptor` - Processes `securityCheck()` methods

package/.claude/rules/testing.md

@@ -266,7 +266,7 @@ pnpm run check:mutations -- --id=<id>       # one mutation
 pnpm run check:mutations -- --list          # the registry, without running anything
 pnpm run check:mutations -- --allow-dirty   # when the fix and its evidence share a working tree
 pnpm run check:mutations -- --jobs=4        # N mutations at a time (default: 2, or 4 on >=12 cores)
-pnpm run check:mutations -- --no-infra      # only the 67 that need no MongoDB
+pnpm run check:mutations -- --no-infra      # only the 79 that need no MongoDB
 pnpm run check:mutations -- --since=<ref>   # only mutations touching files changed since <ref>
 ```
 
@@ -285,7 +285,7 @@ when the registry, a vitest config or a setup file changed, since those can move
 commit, so selective re-running would save ~10 minutes a release. The price is a cache that has to
 model each spec's full dependency closure correctly, and getting that wrong produces a stale PASS
 for a test that has since gone vacuous — exactly what the gate is there to prevent. Bad trade
-at 113 mutations — past the threshold this paragraph has carried since the gate was written,
+at 128 mutations — past the threshold this paragraph has carried since the gate was written,
 now reached exactly. The full run is approaching half an hour. **The re-evaluation is due now**: the
 next person to add a mutation should decide whether selective re-running has become worth its
 failure mode (a stale PASS for a test that has since gone vacuous), not bump this number again.
@@ -327,9 +327,9 @@ exactly the environment where the answer matters.
 
 ### The cost is vitest's cold start, not the tests
 
-Worth knowing before optimising the wrong thing: the specs behind all 46 e2e mutations add up to
+Worth knowing before optimising the wrong thing: the specs behind all 49 e2e mutations add up to
 **~40 seconds**. The step takes ~740s. The remaining ~700s is paying vitest's startup — process
-spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 113 times.
+spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 128 times.
 That work is largely single-threaded I/O and barely scales with cores: the full registry measures
 **744s on a 12-core laptop and 777s on a 4-vCPU CI runner**.
 
@@ -645,6 +645,18 @@ relative path. The starter does neither: it subclasses the shipped `Core*` class
 **subclass** notices, a `devDependency` used at runtime by framework code, and behaviour that
 differs under the starter's configuration.
 
+**The copy is updated the way a consumer updates, not merely re-pointed (11.41.4).** Before the
+checks, `alignConsumerPins()` applies the starter's own `pnpm run update` rule
+(`extras/sync-packages.mjs`) to the tarball's manifest: a pin the starter already declares in the
+SAME section is raised to the framework's version when that is newer — never lowered, added or moved
+across sections. Without it the gate tested a state no documented path produces, and refused 11.41.4
+although the tarball was sound: the starter still pinned `@nestjs/common` 11.2.1 against the
+tarball's 11.2.6, `@nestjs/schedule` was installed twice and `CronJobs extends CoreCronJobs` stopped
+type-checking. Every release that raises a shared exact pin would hit the same wall, because the
+starter is bumped only AFTER the npm publish. The gate prints each raised pin — those are the pins
+every consumer has to raise too, so the migration guide must list them. Pinned by
+`tests/unit/check-consumer-align.spec.ts` (mutation `consumer-gate-skips-pin-alignment`).
+
 Wired into `.github/workflows/publish.yml` before the publish step, with `--fast`. Deliberately not
 on every push (~5 minutes), and deliberately not the starter's full `check` in CI: that also runs
 the starter's own `pnpm audit` / `format:check` / `lint`, none of which say anything about our

package/CLAUDE.md

@@ -163,7 +163,8 @@ pnpm run reinit         # Clean reinstall + tests + build
 **Key Components:**
 - `CoreModule` - Dynamic module with GraphQL (optional, disable via `graphQl: false`), MongoDB, security
 - `src/core/common/` - Decorators, helpers, interceptors, services
-- `src/core/modules/` - Auth, BetterAuth, ErrorCode, File, HealthCheck, Hub, Migrate, Permissions, SystemSetup, Tus, User
+- `src/core/modules/` - ApiToken, Auth, BetterAuth, ErrorCode, File, HealthCheck, Hub, Migrate, Permissions, SystemSetup, Tus, User
+  - **ApiToken** - Opt-in (`apiTokens`) USER and TENANT tokens + signed assertions. Denied on every route without `@ApiTokenScopes()`; all three guards share `enforceApiTokenRoute()`. See `src/core/modules/api-token/README.md`.
   - **Hub** - Build-free ADMIN-gated operator cockpit at `/hub` (config-gated per environment; 16 panels, runtime collectors, mailbox, admin actions). See `src/core/modules/hub/README.md`.
   - **Permissions** - ADMIN-gated security-map report (routes + roles + `@Restricted` fields); also surfaced in the Hub's "Routes / Permissions" panel.
 - **Optional central infrastructure** (11.33.0+) - `CoreRedisService` (`redis` config) and `CoreS3Service` (`s3` config) turn process-local state into shared state for multi-replica deployments: rate-limit counters, cron deduplication, GraphQL subscriptions, tenant-cache invalidation, Hub collectors, file storage (`file.storage: 's3'`; the driver is otherwise derived — S3 → GridFS → filesystem — and an unavailable one fails the boot rather than falling back) and TUS staging. Both are inert without their config, and their client libraries are **optional peer dependencies** (`ioredis`, `bullmq`, `@aws-sdk/client-s3`, `@aws-sdk/s3-request-presigner`, `@tus/s3-store`) — a project that uses neither installs nothing extra. When adding a distributed feature, always keep the non-configured fallback path.
@@ -251,8 +252,10 @@ docker build --build-arg API_DIR=projects/api -t api .   # Monorepo
 Key files: `Dockerfile`, `docker-entrypoint.sh` (migrations + server start), `.dockerignore`
 
 The migration store uses `NSC__MONGOOSE__URI` env var (not `config.env.ts`) for Docker compatibility.
-Set `NSC__MIGRATE__STRICT=true` in production images to fail the boot when a recorded migration
-file is missing (default: tolerate with a warning) — see `src/core/modules/migrate/README.md`.
+A migration that RAN AND FAILED aborts the boot; `MIGRATIONS_ALLOW_FAILURE=true` (long form
+`MIGRATE_FAILURE_POLICY=warn`) starts anyway for one deploy. A recorded migration whose file was
+pruned only warns — set `NSC__MIGRATE__STRICT=true` only for images that must carry the full
+migration history — see `src/core/modules/migrate/README.md`.
 
 ## Environment Configuration
 

package/FRAMEWORK-API.md

@@ -1,6 +1,6 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-09-21 (v11.41.3)
+> Auto-generated from source code as of 2026-10-01 (v11.41.5)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()
@@ -14,6 +14,7 @@
 
   - `ai?`: `boolean | IAi | undefined` — Configuration for the AI assistant module.
   - `appUrl?`: `string | undefined` — Base URL of the frontend/app application.
+  - `apiTokens?`: `boolean | IApiTokens | undefined` (default: `undefined (disabled)`) — API tokens: bearer credentials for machine clients and embedded pages that cannot carry a session
   - `auth?`: `IAuth | undefined` — Authentication system configuration
   - `automaticObjectIdFiltering?`: `boolean | undefined` — Automatically detect ObjectIds in string values in FilterQueries
   - `baseUrl?`: `string | undefined` — Base URL of the API server.
@@ -208,6 +209,7 @@ When `passkey` is enabled, `trustedOrigins` is required (compile-time enforcemen
 
 ### ICoreModuleOverrides
 
+  - `apiToken?`: `{ model?: Type<any>; service?: Type<any>; } | undefined` — Override API token collaborators with project-specific subclasses (`apiTokens` config).
   - `ai?`: `{ budgetService?: Type<any>; connectionResolver?: Type<any>; connectionServic...` — Override AI module collaborators with project-specific subclasses.
   - `betterAuth?`: `{ controller?: Type<any>; resolver?: Type<any>; } | undefined` — Override BetterAuth controller and/or resolver.
   - `errorCode?`: `{ controller?: Type<any>; service?: Type<any>; } | undefined` — Override ErrorCode controller and/or service.
@@ -347,6 +349,7 @@ Generic: `CrudService<Model, CreateInput, UpdateInput>`
 | Module | Docs | Path |
 |--------|------|------|
 | `ai` | README, CHECKLIST | `src/core/modules/ai/` |
+| `api-token` | README, CHECKLIST | `src/core/modules/api-token/` |
 | `auth` | README | `src/core/modules/auth/` |
 | `better-auth` | README, CHECKLIST | `src/core/modules/better-auth/` |
 | `error-code` | CHECKLIST | `src/core/modules/error-code/` |

package/dist/core/common/helpers/graceful-shutdown.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"graceful-shutdown.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graceful-shutdown.helper.ts"],"names":[],"mappings":";;AAoDA,0DA+DC;AAnHD,2CAA0D;AAE1D,+DAA2D;AAG3D,MAAM,gBAAgB,GAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAOjE,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAerC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAyB1C,SAAgB,uBAAuB,CAA6B,GAAM;IACxE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAkB,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,8BAAa,CAAC,kBAAkB,CAAqB,iBAAiB,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAElF,IAAI,CAAC,OAAO,EAAE,CAAC;QAEb,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,sBAAsB,OAAO,yBAAyB,qBAAqB,sCAAsC;YAC/G,mFAAmF,CACtF,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,GAAG,0BAA0B,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CACT,sBAAsB,OAAO,iFAAiF;YAC5G,uFAAuF;YACvF,6GAA6G;YAC7G,gFAAgF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAIlE,IAAI,YAAY,GAAG,KAAK,CAAC;IAIzB,IAAI,KAAiC,CAAC;IAEtC,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAQ,EAAE;QAC9C,IAAI,YAAY,EAAE,CAAC;YAEjB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,uCAAuC,CAAC,CAAC;YAC9D,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;YACD,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,mCAAmC,gBAAgB,wCAAwC,CAAC,CAAC;QAEjH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,GAAG;iBACA,KAAK,EAAE;iBACP,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;iBAC3C,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QACpH,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"graceful-shutdown.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graceful-shutdown.helper.ts"],"names":[],"mappings":";;AA6DA,0DA+DC;AA5HD,2CAA0D;AAE1D,+DAA2D;AAG3D,MAAM,gBAAgB,GAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAOjE,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAerC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAkC1C,SAAgB,uBAAuB,CAA6B,GAAM;IACxE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAkB,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,8BAAa,CAAC,kBAAkB,CAAqB,iBAAiB,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAElF,IAAI,CAAC,OAAO,EAAE,CAAC;QAEb,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC1B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,OAAO,GAAG,qBAAqB,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,sBAAsB,OAAO,yBAAyB,qBAAqB,sCAAsC;YAC/G,mFAAmF,CACtF,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,GAAG,0BAA0B,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CACT,sBAAsB,OAAO,iFAAiF;YAC5G,uFAAuF;YACvF,6GAA6G;YAC7G,gFAAgF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAIlE,IAAI,YAAY,GAAG,KAAK,CAAC;IAIzB,IAAI,KAAiC,CAAC;IAEtC,MAAM,MAAM,GAAG,CAAC,MAAsB,EAAQ,EAAE;QAC9C,IAAI,YAAY,EAAE,CAAC;YAEjB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,uCAAuC,CAAC,CAAC;YAC9D,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,GAAG,SAAS,CAAC;YACpB,CAAC;YACD,KAAK,GAAG,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,YAAY,GAAG,IAAI,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,mCAAmC,gBAAgB,wCAAwC,CAAC,CAAC;QAEjH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,GAAG;iBACA,KAAK,EAAE;iBACP,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;iBAC3C,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;QACpH,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAErB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/common/helpers/logging.helper.js

@@ -60,6 +60,8 @@ function redactSensitiveText(text) {
     return (text
         .replace(/eyJ[\w-]{6,}\.[\w-]{6,}\.[\w-]{4,}/g, (match) => maskToken(match))
         .replace(/(\/(?:request-password-reset|reset-password|forget-password|forgot-password|set-password|change-email|magic-?link|verify|reset|confirm|activate|invite)\/)([A-Za-z0-9._~-]{16,})/gi, (_m, prefix, token) => `${prefix}${maskToken(token)}`)
+        .replace(/\b[a-z][a-z0-9]{1,15}_[0-9a-f]{24}_[0-9a-f]{64}\b/g, (match) => maskToken(match))
+        .replace(/\b[a-z][a-z0-9]{1,15}s_[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])/g, (match) => maskToken(match))
         .replace(/(authorization["']?\s*[:=]\s*["']?)(?:Bearer\s+)?([^\s"',;]+)/gi, (_m, prefix, value) => `${prefix}${maskToken(value)}`)
         .replace(/((?:^|[\s,;])cookie["']?\s*[:=]\s*)([^\n]+)/gi, (_m, prefix, value) => `${prefix}${maskCookieHeader(value)}`)
         .replace(/((?:password|passwd|pwd|token|secret|api[-_]?key|client[-_]?secret|refresh[-_]?token|access[-_]?token|private[-_]?key)["']?\s*[:=]\s*["']?)([^\s"',;&}]+)/gi, (_m, prefix, value) => `${prefix}${maskSensitive(value)}`));

package/dist/core/common/helpers/logging.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"logging.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/logging.helper.ts"],"names":[],"mappings":";;AAwBA,oCAEC;AAYD,4CAMC;AAaD,8BAYC;AAWD,wBAEC;AAeD,sCAeC;AAaD,8BAQC;AAkBD,kDAsCC;AArKD,SAAgB,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAYD,SAAgB,gBAAgB,CAAC,YAAuC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAaD,SAAgB,SAAS,CAAC,KAAgC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,MAAM,EAAE,CAAC;AAC/D,CAAC;AAWD,SAAgB,MAAM,CAAC,EAA6B;IAClD,OAAO,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC;AAeD,SAAgB,aAAa,CAC3B,KAAgC,EAChC,eAAuB,CAAC,EACxB,aAAqB,CAAC;IAEtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,CAAC;AAC7B,CAAC;AAaD,SAAgB,SAAS,CAAC,KAAgC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAkBD,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,IAAI;SAED,OAAO,CAAC,qCAAqC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;SAW3E,OAAO,CACN,oLAAoL,EACpL,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CACtD;SAEA,OAAO,CACN,iEAAiE,EACjE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CACtD;SAEA,OAAO,CACN,+CAA+C,EAC/C,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAC7D;SAEA,OAAO,CACN,6JAA6J,EAC7J,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAC1D,CACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"logging.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/logging.helper.ts"],"names":[],"mappings":";;AAwBA,oCAEC;AAYD,4CAMC;AAaD,8BAYC;AAWD,wBAEC;AAeD,sCAeC;AAaD,8BAQC;AAkBD,kDA6CC;AA5KD,SAAgB,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAYD,SAAgB,gBAAgB,CAAC,YAAuC;IACtE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAaD,SAAgB,SAAS,CAAC,KAAgC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,MAAM,EAAE,CAAC;AAC/D,CAAC;AAWD,SAAgB,MAAM,CAAC,EAA6B;IAClD,OAAO,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC;AAeD,SAAgB,aAAa,CAC3B,KAAgC,EAChC,eAAuB,CAAC,EACxB,aAAqB,CAAC;IAEtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,OAAO,GAAG,KAAK,MAAM,GAAG,EAAE,CAAC;AAC7B,CAAC;AAaD,SAAgB,SAAS,CAAC,KAAgC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAkBD,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,IAAI;SAED,OAAO,CAAC,qCAAqC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;SAW3E,OAAO,CACN,oLAAoL,EACpL,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CACtD;SAIA,OAAO,CAAC,oDAAoD,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;SAC1F,OAAO,CAAC,gFAAgF,EAAE,CAAC,KAAK,EAAE,EAAE,CACnG,SAAS,CAAC,KAAK,CAAC,CACjB;SAEA,OAAO,CACN,iEAAiE,EACjE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CACtD;SAEA,OAAO,CACN,+CAA+C,EAC/C,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAC7D;SAEA,OAAO,CACN,6JAA6J,EAC7J,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAC1D,CACJ,CAAC;AACJ,CAAC"}

package/dist/core/common/helpers/process-diagnostics.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"process-diagnostics.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/process-diagnostics.helper.ts"],"names":[],"mappings":";;AAwNA,8DAyEC;AA0BD,8DAKC;AAlQD,qCAAoC;AAEpC,qDAAuD;AASvD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AA6BpC,SAAS,gBAAgB,CAAC,OAAe;IAGvC,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7G,OAAO,IAAA,oCAAmB,EAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAoBD,MAAM,wBAAwB,GAAsB;IAClD,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,CAAC,EAAE,GAAG,OAAO,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;QAMT,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE;QACxB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;CACF,CAAC;AAwCF,MAAM,mBAAmB,GAA8B,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAGlG,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAU,CAAC;AAQ/C,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAG3B,OAAO,KAAK,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAeD,SAAgB,yBAAyB,CAAC,UAAqC,EAAE;IAC/E,MAAM,MAAM,GAAwB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;IAC9D,MAAM,MAAM,GAAsB,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC;IAC7E,MAAM,IAAI,GAA2B,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,oBAAoB,GAAmB,OAAO,CAAC,oBAAoB,IAAI,KAAK,CAAC;IACnF,MAAM,iBAAiB,GAAW,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC;IAKtE,MAAM,WAAW,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3G,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE7B,MAAM,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAe,EAAE,EAAE;QAClD,IAAI,oBAAoB,KAAK,MAAM,EAAE,CAAC;YACpC,WAAW,CAAC,wBAAwB,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,CAAC,CAAC,CAAC;YACR,OAAO;QACT,CAAC;QACD,cAAc,CAAC,wBAAwB,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAc,EAAE,EAAE;QAChD,WAAW,CAAC,uBAAuB,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,CAAC,CAAC;IACV,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAa,EAAE,EAAE;QAGlC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,WAAW,CAAC,oCAAoC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,QAAwB,EAAQ,EAAE;YAIjD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChD,WAAW,CACT,qBAAqB,QAAQ,oDAC3B,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sCACf,EAAE,CACH,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACvC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClB,OAAO;YACT,CAAC;YAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;gBAG1B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC/B,WAAW,CAAC,4CAA4C,iBAAiB,mBAAmB,CAAC,CAAC;oBAC9F,IAAI,CAAC,CAAC,CAAC,CAAC;gBACV,CAAC,EAAE,iBAAiB,CAAC,CAAC;gBAEtB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;YACrB,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AA0BD,SAAgB,yBAAyB,CAAC,KAAc,EAAE,UAAsC,EAAE;IAChG,MAAM,MAAM,GAAsB,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC;IAC7E,MAAM,IAAI,GAA2B,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,8CAA8C,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACrG,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC"}
+{"version":3,"file":"process-diagnostics.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/process-diagnostics.helper.ts"],"names":[],"mappings":";;AA4NA,8DAyEC;AA0BD,8DAKC;AAtQD,qCAAoC;AAEpC,qDAAuD;AASvD,MAAM,oBAAoB,GAAG,MAAM,CAAC;AA6BpC,SAAS,gBAAgB,CAAC,OAAe;IAGvC,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7G,OAAO,IAAA,oCAAmB,EAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAoBD,MAAM,wBAAwB,GAAsB;IAClD,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE;QACzB,IAAI,CAAC;YACH,IAAA,mBAAS,EAAC,CAAC,EAAE,GAAG,OAAO,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;QAMT,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE;QACxB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;CACF,CAAC;AAwCF,MAAM,mBAAmB,GAA8B,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAGlG,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAU,CAAC;AAQ/C,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAG3B,OAAO,KAAK,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAmBD,SAAgB,yBAAyB,CAAC,UAAqC,EAAE;IAC/E,MAAM,MAAM,GAAwB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;IAC9D,MAAM,MAAM,GAAsB,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC;IAC7E,MAAM,IAAI,GAA2B,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,MAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACrF,MAAM,oBAAoB,GAAmB,OAAO,CAAC,oBAAoB,IAAI,KAAK,CAAC;IACnF,MAAM,iBAAiB,GAAW,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC;IAKtE,MAAM,WAAW,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IACvF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3G,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE7B,MAAM,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAe,EAAE,EAAE;QAClD,IAAI,oBAAoB,KAAK,MAAM,EAAE,CAAC;YACpC,WAAW,CAAC,wBAAwB,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,CAAC,CAAC,CAAC;YACR,OAAO;QACT,CAAC;QACD,cAAc,CAAC,wBAAwB,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAc,EAAE,EAAE;QAChD,WAAW,CAAC,uBAAuB,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,CAAC,CAAC,CAAC;IACV,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAa,EAAE,EAAE;QAGlC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,WAAW,CAAC,oCAAoC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,QAAwB,EAAQ,EAAE;YAIjD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChD,WAAW,CACT,qBAAqB,QAAQ,oDAC3B,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sCACf,EAAE,CACH,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACvC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAClB,OAAO;YACT,CAAC;YAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;gBAG1B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC/B,WAAW,CAAC,4CAA4C,iBAAiB,mBAAmB,CAAC,CAAC;oBAC9F,IAAI,CAAC,CAAC,CAAC,CAAC;gBACV,CAAC,EAAE,iBAAiB,CAAC,CAAC;gBAEtB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;YACrB,CAAC;QACH,CAAC,CAAC;QACF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AA0BD,SAAgB,yBAAyB,CAAC,KAAc,EAAE,UAAsC,EAAE;IAChG,MAAM,MAAM,GAAsB,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC;IAC7E,MAAM,IAAI,GAA2B,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,8CAA8C,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACrG,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC"}

package/dist/core/common/interfaces/server-options.interface.d.ts

@@ -23,7 +23,7 @@ import { CronJobConfigWithTimeZone } from './cron-job-config-with-time-zone.inte
 import { CronJobConfigWithUtcOffset } from './cron-job-config-with-utc-offset.interface';
 import { MailjetOptions } from './mailjet-options.interface';
 export type BetterAuthFieldType = 'boolean' | 'date' | 'json' | 'number' | 'number[]' | 'string' | 'string[]';
-export type MailTransportOptions = JSONTransport | JSONTransport.Options | SendmailTransport | SendmailTransport.Options | SESTransport | SESTransport.Options | SMTPPool | SMTPPool.Options | SMTPTransport | SMTPTransport.Options | StreamTransport | StreamTransport.Options | string;
+export type MailTransportOptions = JSONTransport.default | JSONTransport.Options | SendmailTransport.default | SendmailTransport.Options | SESTransport.default | SESTransport.Options | SMTPPool.default | SMTPPool.Options | SMTPTransport.default | SMTPTransport.Options | StreamTransport.default | StreamTransport.Options | string;
 export interface IAuth {
     legacyEndpoints?: IAuthLegacyEndpoints;
     preventUserEnumeration?: boolean;
@@ -157,6 +157,21 @@ export interface IMultiTenancy {
     additionalMembershipRoles?: string[];
     cacheTtlMs?: number;
 }
+export interface IApiTokens {
+    enabled?: boolean;
+    encryptionKey?: string;
+    manageRole?: string;
+    maxAssertionLifetimeSeconds?: number;
+    prefix?: string;
+    rateLimit?: boolean | {
+        enabled?: boolean;
+        max?: number;
+        windowSeconds?: number;
+    };
+    scopes?: string[];
+    tenantTokens?: boolean;
+    userTokens?: boolean;
+}
 export interface ICookiesConfig {
     enabled?: boolean;
     exposeTokenInBody?: boolean;
@@ -242,6 +257,7 @@ export interface IAi {
 export interface IServerOptions {
     ai?: boolean | IAi;
     appUrl?: string;
+    apiTokens?: boolean | IApiTokens;
     auth?: IAuth;
     automaticObjectIdFiltering?: boolean;
     baseUrl?: string;
@@ -487,6 +503,10 @@ interface IBetterAuthWithPasskey extends IBetterAuthBase {
     trustedOrigins: string[];
 }
 export interface ICoreModuleOverrides {
+    apiToken?: {
+        model?: Type<any>;
+        service?: Type<any>;
+    };
     ai?: {
         budgetService?: Type<any>;
         connectionResolver?: Type<any>;

package/dist/core/modules/ai/helpers/ai-mcp-oauth.helper.d.ts

@@ -1,7 +1,7 @@
 export declare function mountAiMcpOAuth(app: {
     get: (token: any) => any;
     use: (...args: any[]) => any;
-}, options: {
-    baseUrl: string;
+}, options?: {
+    baseUrl?: string;
     mcpPath?: string;
 }): Promise<void>;

package/dist/core/modules/ai/helpers/ai-mcp-oauth.helper.js

@@ -1,16 +1,56 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mountAiMcpOAuth = mountAiMcpOAuth;
+const common_1 = require("@nestjs/common");
+const cookies_helper_1 = require("../../../common/helpers/cookies.helper");
+const config_service_1 = require("../../../common/services/config.service");
 const core_ai_mcp_oauth_service_1 = require("../services/core-ai-mcp-oauth.service");
-async function mountAiMcpOAuth(app, options) {
+async function mountAiMcpOAuth(app, options = {}) {
+    const { baseUrl, source } = resolveMcpOAuthBaseUrl(options.baseUrl);
+    const issuerUrl = parseAbsoluteUrl(baseUrl, source);
     const { mcpAuthRouter } = await Promise.resolve().then(() => require('@modelcontextprotocol/sdk/server/auth/router.js'));
     const oauthService = app.get(core_ai_mcp_oauth_service_1.CoreAiMcpOAuthService);
     const mcpPath = options.mcpPath ?? '/ai/mcp';
-    const router = mcpAuthRouter({
-        issuerUrl: new URL(options.baseUrl),
-        provider: oauthService.buildOAuthProvider(),
-        resourceServerUrl: new URL(`${options.baseUrl.replace(/\/$/, '')}${mcpPath}`),
-    });
+    let router;
+    try {
+        router = mcpAuthRouter({
+            issuerUrl,
+            provider: oauthService.buildOAuthProvider(),
+            resourceServerUrl: new URL(`${baseUrl.replace(/\/$/, '')}${mcpPath}`),
+        });
+    }
+    catch (error) {
+        const reason = error.message;
+        throw new Error(`mountAiMcpOAuth: OAuth issuer "${baseUrl}" (from ${source}) rejected: ${reason}`, {
+            cause: error,
+        });
+    }
     app.use(router);
+    new common_1.Logger('mountAiMcpOAuth').log(`MCP OAuth issuer: ${issuerUrl.href} (from ${source})`);
+}
+function resolveMcpOAuthBaseUrl(explicit) {
+    const given = explicit?.trim();
+    if (given) {
+        return { baseUrl: given, source: 'options.baseUrl' };
+    }
+    const config = config_service_1.ConfigService.configFastButReadOnly;
+    const resolved = (0, cookies_helper_1.resolveServerUrls)({ baseUrl: config?.baseUrl, env: config?.env });
+    if (resolved.baseUrl) {
+        return {
+            baseUrl: resolved.baseUrl,
+            source: resolved.baseUrlSource === 'localhost-default' ? `localhost default (env: ${config?.env})` : 'config.baseUrl',
+        };
+    }
+    throw new Error(`mountAiMcpOAuth: no public server URL for the OAuth issuer (env: ${config?.env ?? 'unset'}). ` +
+        'Set `baseUrl` in the server config (NSC__BASE_URL) or pass `options.baseUrl`. ' +
+        'A guessed localhost URL would send MCP clients to their own machine.');
+}
+function parseAbsoluteUrl(value, source) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        throw new Error(`mountAiMcpOAuth: "${value}" (from ${source}) is not an absolute URL`);
+    }
 }
 //# sourceMappingURL=ai-mcp-oauth.helper.js.map

package/dist/core/modules/ai/helpers/ai-mcp-oauth.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-mcp-oauth.helper.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth.helper.ts"],"names":[],"mappings":";;AAmBA,0CAeC;AAlCD,qFAA8E;AAmBvE,KAAK,UAAU,eAAe,CACnC,GAA+D,EAC/D,OAA8C;IAE9C,MAAM,EAAE,aAAa,EAAE,GAAG,2CAAa,iDAAiD,EAAC,CAAC;IAC1F,MAAM,YAAY,GAA0B,GAAG,CAAC,GAAG,CAAC,iDAAqB,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC;IAE7C,MAAM,MAAM,GAAG,aAAa,CAAC;QAC3B,SAAS,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;QACnC,QAAQ,EAAE,YAAY,CAAC,kBAAkB,EAAS;QAClD,iBAAiB,EAAE,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC;KAC9E,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"ai-mcp-oauth.helper.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/helpers/ai-mcp-oauth.helper.ts"],"names":[],"mappings":";;AAqCA,0CA6BC;AAlED,2CAAwC;AAExC,2EAA2E;AAC3E,4EAAwE;AACxE,qFAA8E;AAiCvE,KAAK,UAAU,eAAe,CACnC,GAA+D,EAC/D,UAAkD,EAAE;IAEpD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,EAAE,aAAa,EAAE,GAAG,2CAAa,iDAAiD,EAAC,CAAC;IAC1F,MAAM,YAAY,GAA0B,GAAG,CAAC,GAAG,CAAC,iDAAqB,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC;IAE7C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC;YACrB,SAAS;YACT,QAAQ,EAAE,YAAY,CAAC,kBAAkB,EAAS;YAClD,iBAAiB,EAAE,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC;SACtE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAIf,MAAM,MAAM,GAAI,KAAe,CAAC,OAAO,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,WAAW,MAAM,eAAe,MAAM,EAAE,EAAE;YACjG,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChB,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,qBAAqB,SAAS,CAAC,IAAI,UAAU,MAAM,GAAG,CAAC,CAAC;AAC5F,CAAC;AAMD,SAAS,sBAAsB,CAAC,QAA4B;IAC1D,MAAM,KAAK,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,8BAAa,CAAC,qBAAqB,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAA,kCAAiB,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EACJ,QAAQ,CAAC,aAAa,KAAK,mBAAmB,CAAC,CAAC,CAAC,2BAA2B,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,gBAAgB;SAChH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,oEAAoE,MAAM,EAAE,GAAG,IAAI,OAAO,KAAK;QAC7F,gFAAgF;QAChF,sEAAsE,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc;IACrD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,WAAW,MAAM,0BAA0B,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}

package/dist/core/modules/ai/services/core-ai-mcp-oauth.service.js

@@ -20,6 +20,7 @@ const node_crypto_1 = require("node:crypto");
 const mongoose_2 = require("mongoose");
 const cookies_helper_1 = require("../../../common/helpers/cookies.helper");
 const config_service_1 = require("../../../common/services/config.service");
+const core_api_token_helpers_1 = require("../../api-token/core-api-token.helpers");
 let CoreAiMcpOAuthService = CoreAiMcpOAuthService_1 = class CoreAiMcpOAuthService {
     connection;
     logger = new common_1.Logger(CoreAiMcpOAuthService_1.name);
@@ -176,7 +177,12 @@ let CoreAiMcpOAuthService = CoreAiMcpOAuthService_1 = class CoreAiMcpOAuthServic
     }
     buildOAuthProvider(accessTtlSeconds = 3600) {
         return {
-            authorize: (client, params, res) => this.authorizeConsent(client, params, res),
+            authorize: async (client, params, res) => {
+                if ((0, core_api_token_helpers_1.getApiTokenContext)(res?.req?.user)) {
+                    throw new Error('access_denied: an API token cannot authorize an OAuth client');
+                }
+                return this.authorizeConsent(client, params, res);
+            },
             challengeForAuthorizationCode: async (_client, authorizationCode) => {
                 const stored = await this.getAuthorizationCode(authorizationCode);
                 return stored?.codeChallenge ?? '';

package/dist/core/modules/ai/services/core-ai-mcp-oauth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-ai-mcp-oauth.service.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/services/core-ai-mcp-oauth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAkE;AAClE,+CAAoD;AACpD,6CAAmF;AACnF,uCAAsC;AAEtC,2EAA6E;AAC7E,4EAAwE;AA6CjE,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAWmB;IAVhC,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAGhD,iBAAiB,GAAG,mBAAmB,CAAC;IACxC,eAAe,GAAG,iBAAiB,CAAC;IACpC,iBAAiB,GAAG,yBAAyB,CAAC;IAEzD,cAAc,GAAG,KAAK,CAAC;IACvB,YAAY,GAAG,KAAK,CAAC;IAE7B,YAAmD,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAO7E,YAAY;QACV,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC9B,CAAC;IAGD,oBAAoB;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAA,oCAAmB,EAAC,8BAAa,CAAC,GAAG,CAAS,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YAC1G,MAAM,IAAI,KAAK,CACb,8FAA8F;gBAC5F,2FAA2F;gBAC3F,uDAAuD,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAGS,YAAY;QACpB,MAAM,GAAG,GAAG,8BAAa,CAAC,GAAG,CAAsB,QAAQ,CAAC,CAAC;QAC7D,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;IACxD,CAAC;IAGS,aAAa;QACrB,OAAO,CACL,8BAAa,CAAC,GAAG,CAAS,oBAAoB,CAAC;YAC/C,8BAAa,CAAC,GAAG,CAAS,qBAAqB,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,0BAA0B;YACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CACnC,CAAC;IACJ,CAAC;IASD,eAAe,CAAC,MAAc,EAAE,QAAgB,EAAE,UAAU,GAAG,IAAI;QACjE,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU;YAC/C,GAAG,EAAE,MAAM;YACX,IAAI,EAAE,YAAY;SACnB,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,OAAO,GAAG,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IAClD,CAAC;IAKD,iBAAiB,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;YAC7G,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBAClF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAKD,UAAU,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAM,GAAG,MAAM;QAC7D,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAEtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAKD,UAAU,CAAC,KAAK,GAAG,EAAE;QACnB,OAAO,IAAA,yBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IASD,KAAK,CAAC,cAAc,CAAC,MAAwB;QAC3C,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,EAAE,EAAE;aACZ,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC;aAClC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAWD,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,wBAAwB,EAAE,GAAG,CAAC,wBAAwB;YACtD,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,0BAA0B,EAAE,GAAG,CAAC,0BAA0B;SAC3D,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,qBAAqB,CACzB,IAAY,EACZ,IAAiE;QAEjE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC;YACzD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI;YACJ,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAKD,KAAK,CAAC,oBAAoB,CACxB,IAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,CAAC;IAKD,KAAK,CAAC,wBAAwB,CAC5B,IAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,KAAK,GAAI,GAAW,EAAE,KAAK,IAAI,GAAG,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAChG,CAAC;IAKD,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,QAAgB;QACtD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACjH,OAAO,KAAK,CAAC;IACf,CAAC;IAWD,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,QAAgB;QAEhB,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrG,MAAM,KAAK,GAAI,GAAW,EAAE,KAAK,IAAI,GAAG,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5E,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACtE,CAAC;IAMD,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,2CAAa,SAAS,EAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAa,EAAE,CAAC;YAChG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE;iBACxB,UAAU,CAAC,OAAO,CAAC;iBACnB,OAAO,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAUD,kBAAkB,CAAC,gBAAgB,GAAG,IAAI;QACxC,OAAO;YACL,SAAS,EAAE,CAAC,MAAW,EAAE,MAAW,EAAE,GAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC;YAC7F,6BAA6B,EAAE,KAAK,EAAE,OAAY,EAAE,iBAAyB,EAAE,EAAE;gBAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;gBAClE,OAAO,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;YACrC,CAAC;YACD,YAAY,EAAE;gBACZ,SAAS,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACzD,cAAc,EAAE,CAAC,MAAwB,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;aAC1E;YACD,yBAAyB,EAAE,KAAK,EAAE,MAAW,EAAE,iBAAyB,EAAE,EAAE;gBAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;gBACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;oBACpF,UAAU,EAAE,gBAAgB;oBAC5B,aAAa,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC;oBAC3E,UAAU,EAAE,QAAQ;iBACrB,CAAC;YACJ,CAAC;YACD,oBAAoB,EAAE,KAAK,EAAE,MAAW,EAAE,YAAoB,EAAE,EAAE;gBAMhE,MAAM,cAAc,GAAG,MAAM,EAAE,SAAS,CAAC;gBACzC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBACpC,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;gBAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC;oBACtF,UAAU,EAAE,gBAAgB;oBAC5B,aAAa,EAAE,OAAO,CAAC,QAAQ;oBAC/B,UAAU,EAAE,QAAQ;iBACrB,CAAC;YACJ,CAAC;YACD,iBAAiB,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;gBACzC,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YACtF,CAAC;SACF,CAAC;IACJ,CAAC;IAOS,KAAK,CAAC,gBAAgB,CAAC,OAAY,EAAE,OAAY,EAAE,IAAS;QACpE,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;IACJ,CAAC;IASS,IAAI,CAAC,UAAkB;QAC/B,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACvF,CAAC;IAKS,SAAS,CAAC,CAAS,EAAE,CAAS;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAA,6BAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAMS,SAAS;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6FAA6F;oBAC3F,iGAAiG,CACpG,CAAC;gBACF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,OAAO,uDAAuD,CAAC;QACjE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAKS,EAAE;QACV,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5B,CAAC;IAKS,KAAK,CAAC,aAAa;QAC3B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAEnG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5G,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAwC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;CACF,CAAA;AAzYY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAYE,WAAA,IAAA,2BAAgB,GAAE,CAAA;qCAAgC,qBAAU;GAX9D,qBAAqB,CAyYjC"}
+{"version":3,"file":"core-ai-mcp-oauth.service.js","sourceRoot":"","sources":["../../../../../src/core/modules/ai/services/core-ai-mcp-oauth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAkE;AAClE,+CAAoD;AACpD,6CAAmF;AACnF,uCAAsC;AAEtC,2EAA6E;AAC7E,4EAAwE;AACxE,mFAA4E;AA6CrE,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAWmB;IAVhC,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAGhD,iBAAiB,GAAG,mBAAmB,CAAC;IACxC,eAAe,GAAG,iBAAiB,CAAC;IACpC,iBAAiB,GAAG,yBAAyB,CAAC;IAEzD,cAAc,GAAG,KAAK,CAAC;IACvB,YAAY,GAAG,KAAK,CAAC;IAE7B,YAAmD,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAO7E,YAAY;QACV,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC9B,CAAC;IAGD,oBAAoB;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,IAAA,oCAAmB,EAAC,8BAAa,CAAC,GAAG,CAAS,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YAC1G,MAAM,IAAI,KAAK,CACb,8FAA8F;gBAC5F,2FAA2F;gBAC3F,uDAAuD,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;IAGS,YAAY;QACpB,MAAM,GAAG,GAAG,8BAAa,CAAC,GAAG,CAAsB,QAAQ,CAAC,CAAC;QAC7D,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;IACxD,CAAC;IAGS,aAAa;QACrB,OAAO,CACL,8BAAa,CAAC,GAAG,CAAS,oBAAoB,CAAC;YAC/C,8BAAa,CAAC,GAAG,CAAS,qBAAqB,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,0BAA0B;YACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CACnC,CAAC;IACJ,CAAC;IASD,eAAe,CAAC,MAAc,EAAE,QAAgB,EAAE,UAAU,GAAG,IAAI;QACjE,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU;YAC/C,GAAG,EAAE,MAAM;YACX,IAAI,EAAE,YAAY;SACnB,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9E,OAAO,GAAG,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IAClD,CAAC;IAKD,iBAAiB,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;YAC7G,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBAClF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAKD,UAAU,CAAC,QAAgB,EAAE,SAAiB,EAAE,MAAM,GAAG,MAAM;QAC7D,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAEtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAKD,UAAU,CAAC,KAAK,GAAG,EAAE;QACnB,OAAO,IAAA,yBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IASD,KAAK,CAAC,cAAc,CAAC,MAAwB;QAC3C,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,EAAE,EAAE;aACZ,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC;aAClC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAWD,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,wBAAwB,EAAE,GAAG,CAAC,wBAAwB;YACtD,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,0BAA0B,EAAE,GAAG,CAAC,0BAA0B;SAC3D,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,qBAAqB,CACzB,IAAY,EACZ,IAAiE;QAEjE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC;YACzD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI;YACJ,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAKD,KAAK,CAAC,oBAAoB,CACxB,IAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,CAAC;IAKD,KAAK,CAAC,wBAAwB,CAC5B,IAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,MAAM,KAAK,GAAI,GAAW,EAAE,KAAK,IAAI,GAAG,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAChG,CAAC;IAKD,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,QAAgB;QACtD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACjH,OAAO,KAAK,CAAC;IACf,CAAC;IAWD,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,QAAgB;QAEhB,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrG,MAAM,KAAK,GAAI,GAAW,EAAE,KAAK,IAAI,GAAG,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5E,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACtE,CAAC;IAMD,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,2CAAa,SAAS,EAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAa,EAAE,CAAC;YAChG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE;iBACxB,UAAU,CAAC,OAAO,CAAC;iBACnB,OAAO,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAUD,kBAAkB,CAAC,gBAAgB,GAAG,IAAI;QACxC,OAAO;YACL,SAAS,EAAE,KAAK,EAAE,MAAW,EAAE,MAAW,EAAE,GAAQ,EAAE,EAAE;gBAOtD,IAAI,IAAA,2CAAkB,EAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBAClF,CAAC;gBACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YACD,6BAA6B,EAAE,KAAK,EAAE,OAAY,EAAE,iBAAyB,EAAE,EAAE;gBAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;gBAClE,OAAO,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC;YACrC,CAAC;YACD,YAAY,EAAE;gBACZ,SAAS,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACzD,cAAc,EAAE,CAAC,MAAwB,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;aAC1E;YACD,yBAAyB,EAAE,KAAK,EAAE,MAAW,EAAE,iBAAyB,EAAE,EAAE;gBAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC;gBACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;oBACpF,UAAU,EAAE,gBAAgB;oBAC5B,aAAa,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC;oBAC3E,UAAU,EAAE,QAAQ;iBACrB,CAAC;YACJ,CAAC;YACD,oBAAoB,EAAE,KAAK,EAAE,MAAW,EAAE,YAAoB,EAAE,EAAE;gBAMhE,MAAM,cAAc,GAAG,MAAM,EAAE,SAAS,CAAC;gBACzC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBACpC,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;gBAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO;oBACL,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC;oBACtF,UAAU,EAAE,gBAAgB;oBAC5B,aAAa,EAAE,OAAO,CAAC,QAAQ;oBAC/B,UAAU,EAAE,QAAQ;iBACrB,CAAC;YACJ,CAAC;YACD,iBAAiB,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE;gBACzC,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YACtF,CAAC;SACF,CAAC;IACJ,CAAC;IAOS,KAAK,CAAC,gBAAgB,CAAC,OAAY,EAAE,OAAY,EAAE,IAAS;QACpE,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;IACJ,CAAC;IASS,IAAI,CAAC,UAAkB;QAC/B,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACvF,CAAC;IAKS,SAAS,CAAC,CAAS,EAAE,CAAS;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAA,6BAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAMS,SAAS;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6FAA6F;oBAC3F,iGAAiG,CACpG,CAAC;gBACF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,OAAO,uDAAuD,CAAC;QACjE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAKS,EAAE;QACV,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;IAC5B,CAAC;IAKS,KAAK,CAAC,aAAa;QAC3B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAEnG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5G,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAwC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;CACF,CAAA;AApZY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAYE,WAAA,IAAA,2BAAgB,GAAE,CAAA;qCAAgC,qBAAU;GAX9D,qBAAqB,CAoZjC"}

package/dist/core/modules/api-token/core-api-token.constants.d.ts

@@ -0,0 +1,6 @@
+export declare const API_TOKEN_MODEL_TOKEN = "ApiToken";
+export declare const API_TOKEN_SCOPES_KEY = "apiTokenScopes";
+export declare enum ApiTokenKind {
+    TENANT = "tenant",
+    USER = "user"
+}

package/dist/core/modules/api-token/core-api-token.constants.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiTokenKind = exports.API_TOKEN_SCOPES_KEY = exports.API_TOKEN_MODEL_TOKEN = void 0;
+exports.API_TOKEN_MODEL_TOKEN = 'ApiToken';
+exports.API_TOKEN_SCOPES_KEY = 'apiTokenScopes';
+var ApiTokenKind;
+(function (ApiTokenKind) {
+    ApiTokenKind["TENANT"] = "tenant";
+    ApiTokenKind["USER"] = "user";
+})(ApiTokenKind || (exports.ApiTokenKind = ApiTokenKind = {}));
+//# sourceMappingURL=core-api-token.constants.js.map

package/dist/core/modules/api-token/core-api-token.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-api-token.constants.js","sourceRoot":"","sources":["../../../../src/core/modules/api-token/core-api-token.constants.ts"],"names":[],"mappings":";;;AAOa,QAAA,qBAAqB,GAAG,UAAU,CAAC;AAKnC,QAAA,oBAAoB,GAAG,gBAAgB,CAAC;AAWrD,IAAY,YAGX;AAHD,WAAY,YAAY;IACtB,iCAAiB,CAAA;IACjB,6BAAa,CAAA;AACf,CAAC,EAHW,YAAY,4BAAZ,YAAY,QAGvB"}

package/dist/core/modules/api-token/core-api-token.decorators.d.ts

@@ -0,0 +1 @@
+export declare const ApiTokenScopes: (scope: string, ...moreScopes: string[]) => import("@nestjs/common").CustomDecorator<string>;

package/dist/core/modules/api-token/core-api-token.decorators.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiTokenScopes = void 0;
+const common_1 = require("@nestjs/common");
+const core_api_token_constants_1 = require("./core-api-token.constants");
+const ApiTokenScopes = (scope, ...moreScopes) => (0, common_1.SetMetadata)(core_api_token_constants_1.API_TOKEN_SCOPES_KEY, [scope, ...moreScopes]);
+exports.ApiTokenScopes = ApiTokenScopes;
+//# sourceMappingURL=core-api-token.decorators.js.map

package/dist/core/modules/api-token/core-api-token.decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-api-token.decorators.js","sourceRoot":"","sources":["../../../../src/core/modules/api-token/core-api-token.decorators.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAE7C,yEAAkE;AAyB3D,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,GAAG,UAAoB,EAAE,EAAE,CACvE,IAAA,oBAAW,EAAC,+CAAoB,EAAE,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;AAD/C,QAAA,cAAc,kBACiC"}

package/dist/core/modules/api-token/core-api-token.helpers.d.ts

@@ -0,0 +1,127 @@
+import type { IApiTokens, IMultiTenancy } from '../../common/interfaces/server-options.interface';
+import { ApiTokenKind } from './core-api-token.constants';
+export declare const API_TOKEN_DEFAULTS: {
+    readonly maxAssertionLifetimeSeconds: 900;
+    readonly prefix: "ltt";
+    readonly rateLimit: {
+        readonly max: 600;
+        readonly windowSeconds: 60;
+    };
+};
+export declare const API_TOKEN_CLOCK_TOLERANCE_SECONDS = 30;
+export declare const API_TOKEN_MAX_ASSERTION_LENGTH = 8192;
+export declare const API_TOKEN_HEADER = "x-api-key";
+export interface IResolvedApiTokenConfig {
+    enabled: boolean;
+    encryptionKey?: string;
+    manageRole?: string;
+    maxAssertionLifetimeSeconds: number;
+    multiTenancy: boolean;
+    prefix: string;
+    rateLimit: false | {
+        max: number;
+        windowSeconds: number;
+    };
+    scopes: string[];
+    tenantTokens: boolean;
+    userTokens: boolean;
+}
+export declare function resolveApiTokenConfig(config: null | undefined | {
+    apiTokens?: boolean | IApiTokens;
+    multiTenancy?: IMultiTenancy;
+}): IResolvedApiTokenConfig;
+export declare function getApiTokenConfig(): IResolvedApiTokenConfig;
+export declare function getApiTokenTenantMemberRole(): string;
+export declare function getApiTokenManageRole(config?: IResolvedApiTokenConfig): string;
+export declare function resolveApiTokenEncryptionKey(config?: IResolvedApiTokenConfig): string | undefined;
+export declare function assertApiTokenConfigIsUsable(): void;
+export interface IApiTokenCredential {
+    kind: 'assertion' | 'token';
+    value: string;
+}
+export declare function readApiTokenCredential(authorization: string | string[] | undefined, prefix: string): IApiTokenCredential | undefined;
+export declare function readApiTokenCredentialFromHeaders(headers: Record<string, any> | undefined, prefix: string): 'conflict' | IApiTokenCredential | undefined;
+export declare function hasApiTokenCredential(request: {
+    headers?: Record<string, any>;
+} | undefined): boolean;
+export declare function generateApiToken(prefix: string): {
+    publicId: string;
+    secret: string;
+    token: string;
+};
+export declare function parseApiToken(value: string, prefix: string): undefined | {
+    publicId: string;
+    secret: string;
+};
+export declare function hashApiTokenSecret(secret: string): string;
+export declare function safeEqualHex(a: string, b: string): boolean;
+export declare function generateApiTokenSigningKey(): string;
+export interface IApiTokenAssertionPayload {
+    claims?: Record<string, unknown>;
+    exp: number;
+    nonce?: string;
+    sub?: string;
+    tid: string;
+}
+export interface ISignApiTokenAssertionOptions {
+    claims?: Record<string, unknown>;
+    expiresAt?: Date | number;
+    expiresInSeconds?: number;
+    nonce?: string;
+    prefix?: string;
+    publicId: string;
+    signingKey: string;
+    subject?: string;
+}
+export declare function signApiTokenAssertion(options: ISignApiTokenAssertionOptions): string;
+export declare function decodeApiTokenAssertion(value: string, prefix: string): undefined | {
+    payload: IApiTokenAssertionPayload;
+    payloadSegment: string;
+    signature: string;
+};
+export declare function verifyApiTokenAssertionSignature(payloadSegment: string, signature: string, signingKey: string): boolean;
+export declare function checkApiTokenAssertionTiming(payload: Pick<IApiTokenAssertionPayload, 'exp'> & Partial<IApiTokenAssertionPayload>, maxLifetimeSeconds: number, now?: number): 'expired' | 'ok' | 'too-long';
+export interface IApiTokenContext {
+    assertion?: {
+        claims?: Record<string, unknown>;
+        expiresAt: Date;
+        nonce?: string;
+        subject?: string;
+    };
+    kind: ApiTokenKind;
+    maxTenantRole?: string;
+    name: string;
+    publicId: string;
+    scopes: string[];
+    tenantId?: string;
+    tokenId: string;
+    userId?: string;
+}
+export interface ITenantApiTokenPrincipal {
+    hasRole: (roles?: string | string[]) => boolean;
+    id: string;
+    name: string;
+    roles: string[];
+    scopes: string[];
+    tenantId: string;
+}
+export declare function getApiTokenContext(user: unknown): IApiTokenContext | undefined;
+export declare function attachApiTokenContext<T extends object>(user: T, context: IApiTokenContext): T;
+export declare function createTenantApiTokenPrincipal(context: Omit<IApiTokenContext, 'kind' | 'maxTenantRole' | 'userId'> & {
+    tenantId: string;
+}): ITenantApiTokenPrincipal;
+export declare function isTenantApiTokenPrincipal(user: unknown): user is ITenantApiTokenPrincipal;
+export declare function assertApiTokenScopes(context: IApiTokenContext, handler: any, controllerClass: any): void;
+export declare function assertTenantApiTokenRouteAccess(options: {
+    context: IApiTokenContext;
+    controllerClass: any;
+    handler: any;
+    request: any;
+}): void;
+export declare function enforceApiTokenRoute(options: {
+    controllerClass: any;
+    handler: any;
+    request: any;
+}): ApiTokenKind | undefined;
+export declare function getApiTokenTenantRestriction(user: unknown): string | undefined;
+export declare function capApiTokenTenantRole(user: unknown, membershipRole: string): null | string;