@mesadev/sdk 0.42.1 → 0.44.0

package/dist/api/access-token.d.ts

@@ -1,44 +1,61 @@
 /**
- * Local access-token signing. Access tokens are short-lived HS256 JWTs whose
- * signing secret is derived from the raw API key the client holds, so a client
- * that holds an API key can sign them entirely offline — no network round-trip
- * to the server.
+ * Local access-token signing for API keys and Ed25519 signing private keys.
+ * Both formats are produced entirely offline with no network round trip.
  *
- * This is the SDK-side counterpart to the server's reference implementation in
- * `packages/core/src/auth/access-token-legacy.ts`. The cross-language contract
- * lives in `context/auth/legacy-access-token-protocol.md`. JSON key order
- * does not affect verification; each implementation may emit claims in any
- * order.
+ * This is the SDK-side counterpart to the server implementations in
+ * `packages/core/src/auth/access-token-legacy.ts` and
+ * `packages/core/src/auth/signing-key-access-token.ts`. Their wire contracts
+ * live in `context/auth/legacy-access-token-protocol.md` and
+ * `context/auth/signing-key-access-token-protocol.md`. JSON key order does not
+ * affect verification; each implementation may emit claims in any order.
  *
  * Secret derivation:
  *   secret = base64url_nopad(SHA-256(utf8(raw_api_key)))
  * This is byte-identical to the value stored in the server's `apikey.key`
  * column. The HMAC key is the UTF-8 bytes of this base64url string.
  *
- * The token carries NO org and NO user info: the server derives both from the
- * API key row at verification time, and clamps the requested scopes/repos to
- * the key's current permissions. The `repos` claim carries full `org/repo`
- * names (not ids) so the client signs entirely offline.
+ * Legacy HS256 tokens carry no org or user info. The server derives both from
+ * the API key row at verification time and clamps the requested scopes/repos
+ * to the key's current permissions. New callers should use canonical
+ * `repo_ids`; the backward-compatible `repos` claim carries full `org/repo`
+ * names.
  *
- * Implemented with `node:crypto` only — the published SDK takes no JWT
- * dependency.
+ * Implemented with `node:crypto` only so the published SDK retains Node 18
+ * support without adding a JWT dependency.
  */
+import { z } from 'zod';
+import type { PrivateKeyCredential } from './signing-key.js';
 /** Default token lifetime when the caller does not request one. */
 export declare const ACCESS_TOKEN_DEFAULT_TTL_SECONDS: number;
 /** Hard cap on token lifetime; the server rejects anything longer at verify time. */
 export declare const ACCESS_TOKEN_MAX_TTL_SECONDS: number;
-export type SignAccessTokenInput = {
+declare const signingKeyAuthorSchema: z.ZodObject<{
+    name: z.ZodString;
+    email: z.ZodPipe<z.ZodDefault<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | null, string | null>>;
+}, z.core.$strip>;
+export type SigningKeyAuthorInput = z.input<typeof signingKeyAuthorSchema>;
+export declare function normalizeSigningKeyAuthors(authors: readonly SigningKeyAuthorInput[]): readonly [z.output<typeof signingKeyAuthorSchema>, ...z.output<typeof signingKeyAuthorSchema>[]];
+export type RepositoryNameRestriction<NameField extends string = 'repos', IdField extends string = 'repoIds'> = {
+    [Key in NameField]: string[] | null;
+} & {
+    [Key in IdField]?: never;
+};
+export type RepositoryIdRestriction<NameField extends string = 'repos', IdField extends string = 'repoIds'> = {
+    [Key in NameField]?: never;
+} & {
+    [Key in IdField]: string[] | null;
+};
+export type RepositoryRestriction<NameField extends string = 'repos', IdField extends string = 'repoIds'> = RepositoryNameRestriction<NameField, IdField> | RepositoryIdRestriction<NameField, IdField>;
+export type OptionalRepositoryRestriction<NameField extends string, IdField extends string> = Partial<RepositoryNameRestriction<NameField, IdField>> | RepositoryIdRestriction<NameField, IdField>;
+export type ApiRepositoryRestriction = OptionalRepositoryRestriction<'repos', 'repo_ids'>;
+export type SignAccessTokenInput = RepositoryRestriction & {
     /** The API key ID that signs this token; encoded into the `kid` header. */
     apiKeyId: string;
     /** The raw API key (`mesa_...`) the client holds; the signing secret is derived from it. */
     rawApiKey: string;
     /** Requested scopes; clamped to the key's current scopes at verify time. */
     scopes: string[];
-    /**
-     * Requested repo restriction as full `org/repo` names; resolved to ids and
-     * clamped to the key's at verify time. null = no restriction.
-     */
-    repos: string[] | null;
+    /** Repository restrictions are supplied by the mutually exclusive `repos` or `repoIds` fields. */
     /** Token lifetime in seconds. Defaults to {@link ACCESS_TOKEN_DEFAULT_TTL_SECONDS}. */
     ttlSeconds?: number;
 };
@@ -48,11 +65,24 @@ export type SignedAccessToken = {
     expiresAt: string;
     /** Effective scopes encoded into the token. */
     scopes: string[];
-    /** Effective repo restriction (full `org/repo` names) encoded into the token. */
-    repos: string[] | null;
+    /** Backward-compatible name restriction, when used. */
+    repos?: string[] | null;
+    /** Canonical repository-ID restriction, when used. */
+    repoIds?: string[] | null;
     /** The token's unique id (`jti`), for auditing without re-decoding the JWT. */
     jti: string;
 };
+type SignPrivateKeyAccessTokenInput = OptionalRepositoryRestriction<'repos', 'repoIds'> & {
+    credential: PrivateKeyCredential;
+    authors?: readonly [SigningKeyAuthorInput, ...SigningKeyAuthorInput[]];
+    /** Defaults to organization-root admin authority. */
+    scopes?: string[];
+    ttlSeconds?: number;
+};
+/** Convert the public snake-case token fields to the signer restriction. */
+export declare function toSignerRepositoryRestriction(input: ApiRepositoryRestriction): RepositoryRestriction;
+/** Convert signer metadata back to the public snake-case token fields. */
+export declare function toApiRepositoryRestriction(input: Pick<SignedAccessToken, 'repos' | 'repoIds'>): RepositoryRestriction<'repos', 'repo_ids'>;
 /**
  * Derive the HMAC signing secret from a raw API key. Byte-identical to the
  * value stored in the server's `apikey.key` column. The HMAC key is the UTF-8
@@ -62,8 +92,11 @@ export declare function deriveAccessTokenSigningSecret(rawApiKey: string): strin
 /**
  * Sign an access token with HS256 entirely client-side. The `iss` claim is the
  * minting API key id (mirrors the `kid` header). JSON key order is not
- * semantically meaningful — the server verifies the signature, not a byte-exact
+ * semantically meaningful because the server verifies the signature, not a byte-exact
  * string.
  */
 export declare function signAccessToken(input: SignAccessTokenInput): SignedAccessToken;
+/** Sign the minimal Ed25519 access-token contract accepted by the server. */
+export declare function signPrivateKeyAccessToken(input: SignPrivateKeyAccessTokenInput): SignedAccessToken;
+export {};
 //# sourceMappingURL=access-token.d.ts.map

package/dist/api/access-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/api/access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAkBH,mEAAmE;AACnE,eAAO,MAAM,gCAAgC,QAAU,CAAC;AACxD,qFAAqF;AACrF,eAAO,MAAM,4BAA4B,QAAe,CAAC;AAEzD,MAAM,MAAM,oBAAoB,GAAG;IACjC,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iFAAiF;IACjF,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAYD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,iBAAiB,CAiC9E"}
+{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/api/access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAiB7D,mEAAmE;AACnE,eAAO,MAAM,gCAAgC,QAAU,CAAC;AACxD,qFAAqF;AACrF,eAAO,MAAM,4BAA4B,QAAe,CAAC;AASzD,QAAA,MAAM,sBAAsB;;;iBAiB1B,CAAC;AASH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GACxC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,EAAE,CAAC,CASlG;AAiCD,MAAM,MAAM,yBAAyB,CAAC,SAAS,SAAS,MAAM,GAAG,OAAO,EAAE,OAAO,SAAS,MAAM,GAAG,SAAS,IAAI;KAC7G,GAAG,IAAI,SAAS,GAAG,MAAM,EAAE,GAAG,IAAI;CACpC,GAAG;KACD,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK;CACzB,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,SAAS,SAAS,MAAM,GAAG,OAAO,EAAE,OAAO,SAAS,MAAM,GAAG,SAAS,IAAI;KAC3G,GAAG,IAAI,SAAS,CAAC,CAAC,EAAE,KAAK;CAC3B,GAAG;KACD,GAAG,IAAI,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI;CAClC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,SAAS,SAAS,MAAM,GAAG,OAAO,EAAE,OAAO,SAAS,MAAM,GAAG,SAAS,IACpG,yBAAyB,CAAC,SAAS,EAAE,OAAO,CAAC,GAC7C,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,MAAM,6BAA6B,CAAC,SAAS,SAAS,MAAM,EAAE,OAAO,SAAS,MAAM,IACtF,OAAO,CAAC,yBAAyB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,GACtD,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,MAAM,wBAAwB,GAAG,6BAA6B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAE1F,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,GAAG;IACzD,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kGAAkG;IAClG,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,KAAK,8BAA8B,GAAG,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG;IACxF,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,CAAC,EAAE,SAAS,CAAC,qBAAqB,EAAE,GAAG,qBAAqB,EAAE,CAAC,CAAC;IACvE,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAMpG;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,SAAS,CAAC,GAClD,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAYD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,iBAAiB,CAsC9E;AAED,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,8BAA8B,GAAG,iBAAiB,CAoClG"}

package/dist/api/access-token.js

@@ -1,31 +1,35 @@
 /**
- * Local access-token signing. Access tokens are short-lived HS256 JWTs whose
- * signing secret is derived from the raw API key the client holds, so a client
- * that holds an API key can sign them entirely offline — no network round-trip
- * to the server.
+ * Local access-token signing for API keys and Ed25519 signing private keys.
+ * Both formats are produced entirely offline with no network round trip.
  *
- * This is the SDK-side counterpart to the server's reference implementation in
- * `packages/core/src/auth/access-token-legacy.ts`. The cross-language contract
- * lives in `context/auth/legacy-access-token-protocol.md`. JSON key order
- * does not affect verification; each implementation may emit claims in any
- * order.
+ * This is the SDK-side counterpart to the server implementations in
+ * `packages/core/src/auth/access-token-legacy.ts` and
+ * `packages/core/src/auth/signing-key-access-token.ts`. Their wire contracts
+ * live in `context/auth/legacy-access-token-protocol.md` and
+ * `context/auth/signing-key-access-token-protocol.md`. JSON key order does not
+ * affect verification; each implementation may emit claims in any order.
  *
  * Secret derivation:
  *   secret = base64url_nopad(SHA-256(utf8(raw_api_key)))
  * This is byte-identical to the value stored in the server's `apikey.key`
  * column. The HMAC key is the UTF-8 bytes of this base64url string.
  *
- * The token carries NO org and NO user info: the server derives both from the
- * API key row at verification time, and clamps the requested scopes/repos to
- * the key's current permissions. The `repos` claim carries full `org/repo`
- * names (not ids) so the client signs entirely offline.
+ * Legacy HS256 tokens carry no org or user info. The server derives both from
+ * the API key row at verification time and clamps the requested scopes/repos
+ * to the key's current permissions. New callers should use canonical
+ * `repo_ids`; the backward-compatible `repos` claim carries full `org/repo`
+ * names.
  *
- * Implemented with `node:crypto` only — the published SDK takes no JWT
- * dependency.
+ * Implemented with `node:crypto` only so the published SDK retains Node 18
+ * support without adding a JWT dependency.
  */
-import { createHash, createHmac, randomUUID } from 'node:crypto';
+import { createHash, createHmac, randomUUID, sign as signEd25519 } from 'node:crypto';
+import { z } from 'zod';
 import { InvalidOptionsError } from '../lib/errors.js';
+import { looksLikePrivateKey } from './credentials.js';
 /** Audience claim: access tokens are only valid when presented to the Mesa API. */
+// Protocol values mirror packages/core/src/auth/constants.ts. The published SDK
+// cannot import the private server package at runtime.
 const ACCESS_TOKEN_AUD = 'mesa-api';
 /** JOSE `typ` header (RFC 9068 style) distinguishing access tokens. */
 const ACCESS_TOKEN_TYP = 'mesa-at+jwt';
@@ -41,6 +45,83 @@ const ACCESS_TOKEN_DERIVATION_VERSION = 'v1';
 export const ACCESS_TOKEN_DEFAULT_TTL_SECONDS = 60 * 60; // 1 hour
 /** Hard cap on token lifetime; the server rejects anything longer at verify time. */
 export const ACCESS_TOKEN_MAX_TTL_SECONDS = 24 * 60 * 60; // 24 hours
+/** Default and maximum lifetimes accepted by the signing-key verifier. */
+const SIGNING_KEY_ACCESS_TOKEN_DEFAULT_TTL_SECONDS = 15 * 60; // 15 minutes
+const SIGNING_KEY_ACCESS_TOKEN_MAX_TTL_SECONDS = 4 * 60 * 60; // 4 hours
+const MAX_SIGNING_KEY_AUTHORS = 100;
+const SIGNING_KEY_TOKEN_SCOPES = ['read', 'write', 'admin'];
+const signingKeyAuthorSchema = z.object({
+    name: z
+        .string()
+        .trim()
+        .min(1, { error: 'Author names must not be blank.' })
+        .refine((name) => !/[<>\r\n]/.test(name), {
+        error: 'Author names must not contain angle brackets or newlines.',
+    }),
+    email: z
+        .string()
+        .trim()
+        .refine((email) => !/[<>\r\n]/.test(email), {
+        error: 'Author emails must not contain angle brackets or newlines.',
+    })
+        .nullable()
+        .default(null)
+        .transform((email) => email || null),
+});
+const signingKeyAuthorsSchema = z
+    .array(signingKeyAuthorSchema)
+    .min(1, {
+    error: 'At least one author is required.',
+})
+    .max(MAX_SIGNING_KEY_AUTHORS, { error: `At most ${MAX_SIGNING_KEY_AUTHORS} authors are allowed.` });
+export function normalizeSigningKeyAuthors(authors) {
+    const parsed = signingKeyAuthorsSchema.safeParse(authors);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        const path = issue?.path.length ? `.${issue.path.join('.')}` : '';
+        throw new InvalidOptionsError(`Invalid authors${path}: ${issue?.message ?? 'invalid value'}`);
+    }
+    return parsed.data;
+}
+const signingKeyTokenInputSchema = z
+    .object({
+    authors: signingKeyAuthorsSchema.optional(),
+    scopes: z
+        .array(z.enum(SIGNING_KEY_TOKEN_SCOPES))
+        .min(1)
+        .transform((scopes) => [...new Set(scopes)])
+        .default(['admin']),
+    repos: z
+        .array(z
+        .string()
+        .min(1)
+        .refine((repo) => !looksLikePrivateKey(repo), {
+        error: 'Token repos must not contain Mesa private keys.',
+    }))
+        .nullable()
+        .optional(),
+    repoIds: z.array(z.string().min(1)).max(250).nullable().optional(),
+    ttlSeconds: z
+        .number()
+        .int()
+        .min(1)
+        .max(SIGNING_KEY_ACCESS_TOKEN_MAX_TTL_SECONDS)
+        .default(SIGNING_KEY_ACCESS_TOKEN_DEFAULT_TTL_SECONDS),
+})
+    .refine((input) => input.repos === undefined || input.repoIds === undefined, {
+    error: 'Token repos and repoIds restrictions are mutually exclusive.',
+});
+/** Convert the public snake-case token fields to the signer restriction. */
+export function toSignerRepositoryRestriction(input) {
+    if (input.repos !== undefined && input.repo_ids !== undefined) {
+        throw new InvalidOptionsError('Token repos and repo_ids restrictions are mutually exclusive');
+    }
+    return input.repo_ids !== undefined ? { repoIds: input.repo_ids } : { repos: input.repos ?? null };
+}
+/** Convert signer metadata back to the public snake-case token fields. */
+export function toApiRepositoryRestriction(input) {
+    return input.repoIds !== undefined ? { repo_ids: input.repoIds } : { repos: input.repos ?? null };
+}
 /**
  * Derive the HMAC signing secret from a raw API key. Byte-identical to the
  * value stored in the server's `apikey.key` column. The HMAC key is the UTF-8
@@ -60,7 +141,7 @@ function base64UrlJson(value) {
 /**
  * Sign an access token with HS256 entirely client-side. The `iss` claim is the
  * minting API key id (mirrors the `kid` header). JSON key order is not
- * semantically meaningful — the server verifies the signature, not a byte-exact
+ * semantically meaningful because the server verifies the signature, not a byte-exact
  * string.
  */
 export function signAccessToken(input) {
@@ -71,12 +152,16 @@ export function signAccessToken(input) {
     const iat = Math.floor(Date.now() / 1000);
     const exp = iat + ttlSeconds;
     const jti = randomUUID();
+    if (input.repos !== undefined && input.repoIds !== undefined) {
+        throw new InvalidOptionsError('Token repos and repoIds restrictions are mutually exclusive');
+    }
+    const repoRestriction = input.repoIds !== undefined ? { repo_ids: input.repoIds } : { repos: input.repos ?? null };
     const header = { alg: ACCESS_TOKEN_ALG, typ: ACCESS_TOKEN_TYP, kid: buildKid(input.apiKeyId) };
     const payload = {
         iss: input.apiKeyId,
         aud: ACCESS_TOKEN_AUD,
         scopes: input.scopes,
-        repos: input.repos,
+        ...repoRestriction,
         iat,
         exp,
         jti,
@@ -89,7 +174,40 @@ export function signAccessToken(input) {
         token,
         expiresAt: new Date(exp * 1000).toISOString(),
         scopes: input.scopes,
-        repos: input.repos,
+        ...(input.repoIds !== undefined ? { repoIds: input.repoIds } : { repos: input.repos ?? null }),
+        jti,
+    };
+}
+/** Sign the minimal Ed25519 access-token contract accepted by the server. */
+export function signPrivateKeyAccessToken(input) {
+    const parsed = signingKeyTokenInputSchema.safeParse(input);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        throw new InvalidOptionsError(`Invalid ${issue?.path.join('.') || 'token options'}: ${issue?.message ?? 'invalid value'}`);
+    }
+    const { authors, scopes, repos, repoIds, ttlSeconds } = parsed.data;
+    const iat = Math.floor(Date.now() / 1000);
+    const exp = iat + ttlSeconds;
+    const jti = randomUUID();
+    const repoRestriction = repoIds !== undefined ? { repo_ids: repoIds } : { repos: repos ?? null };
+    const header = { alg: 'EdDSA', typ: ACCESS_TOKEN_TYP, jwk: input.credential.publicJwk };
+    const payload = {
+        iss: input.credential.org,
+        aud: ACCESS_TOKEN_AUD,
+        ...(authors === undefined ? {} : { author: authors.map(({ name, email }) => [name, email]) }),
+        scopes,
+        ...repoRestriction,
+        iat,
+        exp,
+        jti,
+    };
+    const signingInput = `${base64UrlJson(header)}.${base64UrlJson(payload)}`;
+    const signature = signEd25519(null, Buffer.from(signingInput, 'utf8'), input.credential.privateKey).toString('base64url');
+    return {
+        token: `${signingInput}.${signature}`,
+        expiresAt: new Date(exp * 1000).toISOString(),
+        scopes,
+        ...(repoIds !== undefined ? { repoIds } : { repos: repos ?? null }),
         jti,
     };
 }

package/dist/api/access-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/api/access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,UAAU,CAAC;AACpC,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAE7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAClE,qFAAqF;AACrF,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW;AA8BrE;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED,6DAA6D;AAC7D,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,GAAG,QAAQ,IAAI,+BAA+B,EAAE,CAAC;AAC1D,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,gCAAgC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,4BAA4B,EAAE,CAAC;QAClG,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,4BAA4B,UAAU,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IAEzB,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/F,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,EAAE,gBAAgB;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG;QACH,GAAG;QACH,GAAG;KACJ,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;IAE7C,OAAO;QACL,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG;KACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/api/access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,mFAAmF;AACnF,gFAAgF;AAChF,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,UAAU,CAAC;AACpC,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAE7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAClE,qFAAqF;AACrF,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW;AACrE,0EAA0E;AAC1E,MAAM,4CAA4C,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa;AAC3E,MAAM,wCAAwC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AACxE,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAGpC,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAA0C,CAAC;AAErG,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;SACpD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxC,KAAK,EAAE,2DAA2D;KACnE,CAAC;IACJ,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC1C,KAAK,EAAE,4DAA4D;KACpE,CAAC;SACD,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC;KAC9B,KAAK,CAAC,sBAAsB,CAAC;KAC7B,GAAG,CAAC,CAAC,EAAE;IACN,KAAK,EAAE,kCAAkC;CAC1C,CAAC;KACD,GAAG,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,WAAW,uBAAuB,uBAAuB,EAAE,CAAC,CAAC;AAItG,MAAM,UAAU,0BAA0B,CACxC,OAAyC;IAEzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,IAAI,KAAK,KAAK,EAAE,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,MAAM,CAAC,IAA+F,CAAC;AAChH,CAAC;AAED,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC;SACN,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;SAC3C,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE;QAC5C,KAAK,EAAE,iDAAiD;KACzD,CAAC,CACL;SACA,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClE,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,wCAAwC,CAAC;SAC7C,OAAO,CAAC,4CAA4C,CAAC;CACzD,CAAC;KACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE;IAC3E,KAAK,EAAE,8DAA8D;CACtE,CAAC,CAAC;AA0DL,4EAA4E;AAC5E,MAAM,UAAU,6BAA6B,CAAC,KAA+B;IAC3E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,mBAAmB,CAAC,8DAA8D,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B,CACxC,KAAmD;IAEnD,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AAED,6DAA6D;AAC7D,SAAS,QAAQ,CAAC,QAAgB;IAChC,OAAO,GAAG,QAAQ,IAAI,+BAA+B,EAAE,CAAC;AAC1D,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAA2B;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,gCAAgC,CAAC;IACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,4BAA4B,EAAE,CAAC;QAClG,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,4BAA4B,UAAU,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IAEzB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC7D,MAAM,IAAI,mBAAmB,CAAC,6DAA6D,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;IACnH,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/F,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,EAAE,gBAAgB;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,eAAe;QAClB,GAAG;QACH,GAAG;QACH,GAAG;KACJ,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,8BAA8B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;IAE7C,OAAO;QACL,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QAC9F,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CAAC,KAAqC;IAC7E,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,WAAW,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,eAAe,KAAK,KAAK,EAAE,OAAO,IAAI,eAAe,EAAE,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,eAAe,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;IACjG,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;IACxF,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG;QACzB,GAAG,EAAE,gBAAgB;QACrB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC,EAAE,CAAC;QACtG,MAAM;QACN,GAAG,eAAe;QAClB,GAAG;QACH,GAAG;QACH,GAAG;KACJ,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC1G,WAAW,CACZ,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,GAAG,YAAY,IAAI,SAAS,EAAE;QACrC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7C,MAAM;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;QACnE,GAAG;KACJ,CAAC;AACJ,CAAC"}

package/dist/api/client.d.ts

@@ -12,16 +12,14 @@ export type RestDataShape = {
 export type RestOperation = (options: never) => Promise<unknown>;
 export type RestRequestOptions<TData extends RestDataShape> = Simplify<Omit<RestOptions<TData, boolean>, 'baseUrl' | 'fetch' | 'headers' | 'responseStyle' | 'throwOnError'>>;
 export type RestClientConfig = {
-    /** Bearer credential: either an API key (`mesa_...`) or an access token (JWT). */
-    credential: string;
+    /** Bearer credential, or a local signer that returns one for each request. */
+    credential: string | (() => string);
     apiUrl: string;
     fetch?: typeof globalThis.fetch;
     userAgent?: string;
-    vcsUrl?: string;
 };
-export declare function isVcsRsUrl(value: string | undefined): boolean;
 export type RestClient = {
-    request<TData extends RestDataShape, TResult>(operation: RestOperation, options?: RestRequestOptions<TData>): Promise<TResult>;
+    request<TData extends RestDataShape, TResult>(operation: RestOperation, options?: RestRequestOptions<TData>, credentialOverride?: string): Promise<TResult>;
     whoami(): Promise<WhoamiResponse>;
 };
 export declare function createRestClient(config: RestClientConfig): RestClient;

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,IAAI,WAAW,EAAmB,KAAK,cAAc,EAAU,MAAM,eAAe,CAAC;AAM1G,KAAK,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,EAAE,CAAC;AAEjD,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjE,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,aAAa,IAAI,QAAQ,CACpE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,cAAc,CAAC,CACtG,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAS7D;AAOD,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,OAAO,EAC1C,SAAS,EAAE,aAAa,EACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAClC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAkDrE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,IAAI,WAAW,EAAmB,KAAK,cAAc,EAAU,MAAM,eAAe,CAAC;AAM1G,KAAK,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,EAAE,CAAC;AAEjD,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjE,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,aAAa,IAAI,QAAQ,CACpE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,cAAc,CAAC,CACtG,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,8EAA8E;IAC9E,UAAU,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAOF,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,OAAO,EAC1C,SAAS,EAAE,aAAa,EACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,EACnC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA+CrE"}

package/dist/api/client.js

@@ -2,37 +2,22 @@ import { whoami } from '@mesadev/rest';
 import { SDK_VERSION } from '../version.js';
 import { normalizeApiError } from './errors.js';
 const SDK_USER_AGENT = `mesa-sdk-ts/${SDK_VERSION}`;
-export function isVcsRsUrl(value) {
-    if (!value)
-        return false;
-    try {
-        const url = new URL(value);
-        return url.hostname === '127.0.0.1';
-    }
-    catch {
-        return false;
-    }
-}
 export function createRestClient(config) {
     const userAgent = config.userAgent?.trim();
-    const defaultHeaders = {
-        Authorization: `Bearer ${config.credential}`,
-    };
+    const defaultHeaders = {};
     if (typeof process === 'undefined') {
         defaultHeaders['X-Mesa-User-Agent'] = userAgent ? `${SDK_USER_AGENT} ${userAgent}` : SDK_USER_AGENT;
     }
     else {
         defaultHeaders['User-Agent'] = userAgent ? `${SDK_USER_AGENT} ${userAgent}` : SDK_USER_AGENT;
     }
-    if (isVcsRsUrl(config.vcsUrl)) {
-        defaultHeaders['X-Mesa-VCS-Backend'] = 'rust';
-    }
-    const request = async (operation, options = {}) => {
+    const request = async (operation, options = {}, credentialOverride) => {
+        const credential = credentialOverride ?? (typeof config.credential === 'function' ? config.credential() : config.credential);
         const requestOptions = {
             ...options,
             baseUrl: config.apiUrl,
             fetch: config.fetch,
-            headers: defaultHeaders,
+            headers: { ...defaultHeaders, Authorization: `Bearer ${credential}` },
             responseStyle: 'fields',
             throwOnError: false,
         };

package/dist/api/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,cAAc,GAAG,eAAe,WAAW,EAAE,CAAC;AA2BpD,MAAM,UAAU,UAAU,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAeD,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,cAAc,GAA2B;QAC7C,aAAa,EAAE,UAAU,MAAM,CAAC,UAAU,EAAE;KAC7C,CAAC;IAEF,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,cAAc,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAC/F,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,cAAc,CAAC,oBAAoB,CAAC,GAAG,MAAM,CAAC;IAChD,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EACnB,SAAwB,EACxB,UAAqC,EAA+B,EAClD,EAAE;QACpB,MAAM,cAAc,GAAG;YACrB,GAAG,OAAO;YACV,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,cAAc;YACvB,aAAa,EAAE,QAAQ;YACvB,YAAY,EAAE,KAAK;SACW,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAO,SAAwE,CAAC,cAAc,CAAC,CAAC;QAEjH,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,QAAkD,CAAC;YAEzE,IAAI,aAAa,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,iBAAiB,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,MAAM,IAAI,aAAa,EAAE,CAAC;gBAC5B,OAAO,aAAa,CAAC,IAAe,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,QAAmB,CAAC;IAC7B,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAA6B,MAAM,CAAC;KAC1D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,cAAc,GAAG,eAAe,WAAW,EAAE,CAAC;AAwCpD,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,cAAc,GAA2B,EAAE,CAAC;IAElD,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,cAAc,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAC/F,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EACnB,SAAwB,EACxB,UAAqC,EAA+B,EACpE,kBAA2B,EACT,EAAE;QACpB,MAAM,UAAU,GACd,kBAAkB,IAAI,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5G,MAAM,cAAc,GAAG;YACrB,GAAG,OAAO;YACV,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,EAAE,GAAG,cAAc,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;YACrE,aAAa,EAAE,QAAQ;YACvB,YAAY,EAAE,KAAK;SACW,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAO,SAAwE,CAAC,cAAc,CAAC,CAAC;QAEjH,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,QAAkD,CAAC;YAEzE,IAAI,aAAa,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,iBAAiB,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,MAAM,IAAI,aAAa,EAAE,CAAC;gBAC5B,OAAO,aAAa,CAAC,IAAe,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,QAAmB,CAAC;IAC7B,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAA6B,MAAM,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/api/credentials.d.ts

@@ -0,0 +1,4 @@
+export declare const MESA_PRIVATE_KEY_PREFIX = "mesa_private_key_";
+/** Recognize private-key formats before a value reaches an outbound request. */
+export declare function looksLikePrivateKey(input: string): boolean;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/api/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/api/credentials.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAE3D,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM1D"}

package/dist/api/credentials.js

@@ -0,0 +1,8 @@
+export const MESA_PRIVATE_KEY_PREFIX = 'mesa_private_key_';
+/** Recognize private-key formats before a value reaches an outbound request. */
+export function looksLikePrivateKey(input) {
+    const value = input.trim();
+    return (value.toLowerCase().includes(MESA_PRIVATE_KEY_PREFIX) ||
+        /^-----(?:BEGIN|END) (?:[A-Z0-9]+ )*PRIVATE KEY-----$/im.test(value));
+}
+//# sourceMappingURL=credentials.js.map

package/dist/api/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/api/credentials.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,OAAO,CACL,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACrD,wDAAwD,CAAC,IAAI,CAAC,KAAK,CAAC,CACrE,CAAC;AACJ,CAAC"}

package/dist/api/index.d.ts

@@ -1,3 +1,3 @@
-export { type ApiKeysCreateInput, type ApiKeysListInput, type ApiKeysRevokeInput, type ApiResources, type BookmarksCreateInput, type BookmarksDeleteInput, type BookmarksListInput, type ChangesCreateInput, type ChangesGetInput, type ChangesListInput, type ContentGetInput, createApiResources, type DiffsGetInput, type OrgGetInput, type ReposCreateInput, type ReposDeleteInput, type ReposGetInput, type ReposListInput, type ReposUpdateInput, type WebhookTargetsCreateInput, type WebhookTargetsDeleteInput, type WebhookTargetsListInput, type WebhookTargetsUpdateInput, } from './resources.js';
+export { type ApiKeysCreateInput, type ApiKeysListInput, type ApiKeysRevokeInput, type ApiResources, type BookmarksCreateInput, type BookmarksDeleteInput, type BookmarksListInput, type ChangesCreateInput, type ChangesGetInput, type ChangesListInput, type ContentGetInput, createApiResources, type DiffsGetInput, type OrgGetInput, type ReposCreateInput, type ReposDeleteInput, type ReposGetInput, type ReposListInput, type ReposUpdateInput, type TokensCreateAuthor, type TokensCreateInput, type TokensCreateLegacyInput, type TokensCreatePrivateKeyInput, type TokensCreateResponse, type WebhookTargetsCreateInput, type WebhookTargetsDeleteInput, type WebhookTargetsListInput, type WebhookTargetsUpdateInput, } from './resources.js';
 export { type RepoTagFilter, type RepoTagValueFilter } from './repo-tag-filter.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,GAC/B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAYL,kBAAkB,GAYnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA+C,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAYL,kBAAkB,GAiBnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA+C,MAAM,sBAAsB,CAAC"}