@mesadev/sdk 0.47.2 → 0.48.0

package/README.md

@@ -17,17 +17,11 @@ bun add @mesadev/sdk
 ```ts
 import { Mesa } from '@mesadev/sdk';
 
-const mesa = new Mesa({
-  privateKey: process.env.MESA_PRIVATE_KEY,
-});
+const mesa = new Mesa({ privateKey: process.env.MESA_PRIVATE_KEY });
 
 // The organization comes from the key, so there is nothing to pass.
 const repo = await mesa.repos.create({ name: 'my-repo' });
 
-// Somewhere you trust less, use a short-lived token instead of the key.
-const scoped = new Mesa({ auth: { accessToken } });
-await scoped.repos.list();
-
 console.log(repo.name);
 ```
 
@@ -35,33 +29,38 @@ This package exposes org-inferred REST resources under `mesa.*`.
 
 ## Configuration
 
-`Mesa` accepts:
+`Mesa` accepts one optional configuration object. When `privateKey` is omitted, the SDK reads `MESA_PRIVATE_KEY` in Node.
 
-- `privateKey?: string` (falls back to `MESA_PRIVATE_KEY` in Node)
-- `auth?: { privateKey } | { accessToken }`
+- `privateKey?: string`
 - `apiUrl?: string` (defaults to `https://api.mesa.dev/v1`)
 - `fetch?: typeof fetch`
 - `userAgent?: string`
 - `webhookSecret?: string` (used by `mesa.webhooks.receive(...)`)
 
-Pass exactly one of `privateKey` or `auth`. When neither is present, the SDK reads `MESA_PRIVATE_KEY` in Node. Private keys and access tokens already name the organization they belong to, so the client picks it up from the credential.
+The private key names its organization, so the client picks it up from the key.
 
-The TypeScript SDK does not accept API keys as client credentials and does not read `MESA_API_KEY`. API keys remain supported by the Mesa CLI and direct backend interfaces.
+### Layout-scoped access tokens
 
-### Scoped access tokens
-
-Mint a token in your trusted process and hand only that token to the sandbox or job that needs it:
+Build a filesystem layout in your trusted process, then hand the sandbox only its serialized layout and short-lived token:
 
 ```ts
-const { token } = await mesa.tokens.create({
+import { repo } from '@mesadev/sdk';
+
+const definition = mesa.fs({
+  layout: {
+    '/workspace': repo('agent-workspace', { mode: 'rw' }),
+  },
   authors: [{ name: 'Mesa Bot', email: 'mesa-bot@example.com' }],
-  scopes: ['read', 'write'],
-  repos: ['acme/agent-workspace'],
-  ttl_seconds: 60 * 60, // 1 hour
+  ttl: 60 * 60, // 1 hour
 });
+
+const { token } = await definition.token();
+const layoutJson = JSON.stringify(definition.layout(), null, 2);
 ```
 
-A token signed by a private key lasts 15 minutes by default and can be given up to 4 hours. A client built from an access token cannot mint another token.
+Write `layoutJson` to `layout.json` in the receiving environment, set `MESA_ACCESS_TOKEN` to `token`, and run `mesa mount --layout=layout.json`. A `ro` layout declaration grants `read-repo`; `rw` grants `write-repo`. Repositories outside the layout are not accessible.
+
+An access token lasts 15 minutes by default and can be given up to 4 hours. Pass scoped tokens to the Mesa CLI, MesaFS, or direct REST requests instead of constructing a TypeScript SDK client with them.
 
 ## Webhook Handlers
 
@@ -73,10 +72,7 @@ parses the payload, and dispatches any registered handlers.
 import { Hono } from 'hono';
 import { Mesa } from '@mesadev/sdk';
 
-const mesa = new Mesa({
-  privateKey: process.env.MESA_PRIVATE_KEY,
-  webhookSecret: process.env.MESA_WEBHOOK_SECRET,
-});
+const mesa = new Mesa({ privateKey: process.env.MESA_PRIVATE_KEY, webhookSecret: process.env.MESA_WEBHOOK_SECRET });
 
 mesa.webhooks.on('push', (event) => {
   console.log('push:', event.data.updates[0]?.ref);
@@ -104,5 +100,5 @@ Use `@mesadev/rest` directly, or call the API with your own HTTP client, when yo
 If you previously used the older generated `@mesadev/sdk` package:
 
 - use `apiUrl` instead of `serverURL`
-- use the organization encoded in the private key or access token
+- use the organization encoded in the private key
 - use resource namespaces (`mesa.repos`, `mesa.changes`, etc.); install `@mesadev/rest` directly when you need generated REST operations

package/dist/api/access-token.d.ts

@@ -1,61 +1,44 @@
 /**
- * Local access-token signing for Ed25519 signing private keys. Tokens are
+ * Local access-token signing for Ed25519 private keys. Tokens are
  * produced entirely offline with no network round trip.
  *
- * This is the SDK-side counterpart to the server implementations in
- * `packages/core/src/auth/signing-key-access-token.ts`. The wire contract lives
- * in `context/auth/signing-key-access-token-protocol.md`. JSON key order does
- * not affect verification.
+ * This is the SDK-side counterpart to the server implementation in
+ * `packages/core/src/auth/access-token.ts`. JSON key order does not
+ * affect verification.
  *
  * Implemented with `node:crypto` only so the published SDK retains Node 18
  * support without adding a JWT dependency.
  */
 import { z } from 'zod';
-import type { PrivateKeyCredential } from './signing-key.js';
-declare const signingKeyAuthorSchema: z.ZodObject<{
+import type { PrivateKeyCredential } from './private-key.js';
+declare const accessTokenAuthorSchema: z.ZodObject<{
     name: z.ZodString;
     email: z.ZodPipe<z.ZodDefault<z.ZodNullable<z.ZodString>>, z.ZodTransform<string | null, string | null>>;
 }, z.core.$strip>;
-export type SigningKeyAuthorInput = z.input<typeof signingKeyAuthorSchema>;
-export declare function normalizeSigningKeyAuthors(authors: readonly SigningKeyAuthorInput[]): readonly [z.output<typeof signingKeyAuthorSchema>, ...z.output<typeof signingKeyAuthorSchema>[]];
-export type RepositoryNameRestriction<NameField extends string = 'repos', IdField extends string = 'repoIds'> = {
-    [Key in NameField]: string[] | null;
-} & {
-    [Key in IdField]?: never;
-};
-export type RepositoryIdRestriction<NameField extends string = 'repos', IdField extends string = 'repoIds'> = {
-    [Key in NameField]?: never;
-} & {
-    [Key in IdField]: string[] | null;
-};
-export type RepositoryRestriction<NameField extends string = 'repos', IdField extends string = 'repoIds'> = RepositoryNameRestriction<NameField, IdField> | RepositoryIdRestriction<NameField, IdField>;
-export type OptionalRepositoryRestriction<NameField extends string, IdField extends string> = Partial<RepositoryNameRestriction<NameField, IdField>> | RepositoryIdRestriction<NameField, IdField>;
-export type ApiRepositoryRestriction = OptionalRepositoryRestriction<'repos', 'repo_ids'>;
-type SignedAccessToken = {
+declare const accessTokenAccessLevelSchema: z.ZodEnum<{
+    "read-repo": "read-repo";
+    "write-repo": "write-repo";
+}>;
+export type Author = z.input<typeof accessTokenAuthorSchema>;
+type AccessTokenAccessInput = Readonly<Record<string, z.input<typeof accessTokenAccessLevelSchema>>>;
+export declare function normalizeAccessTokenAuthors(authors: readonly Author[]): readonly [z.output<typeof accessTokenAuthorSchema>, ...z.output<typeof accessTokenAuthorSchema>[]];
+type SignedPrivateKeyAccessToken = {
     token: string;
     /** Exact expiry as an ISO 8601 string. */
     expiresAt: string;
-    /** Effective scopes encoded into the token. */
-    scopes: string[];
-    /** Backward-compatible name restriction, when used. */
-    repos?: string[] | null;
-    /** Canonical repository-ID restriction, when used. */
-    repoIds?: string[] | null;
     /** The token's unique id (`jti`), for auditing without re-decoding the JWT. */
     jti: string;
 };
-type SignPrivateKeyAccessTokenInput = OptionalRepositoryRestriction<'repos', 'repoIds'> & {
-    credential: PrivateKeyCredential;
-    authors?: readonly [SigningKeyAuthorInput, ...SigningKeyAuthorInput[]];
-    /** Defaults to organization-root admin authority. */
-    scopes?: string[];
+type SignAutomaticPrivateKeyAccessTokenInput = {
+    privateKey: PrivateKeyCredential;
+    authors?: readonly [Author, ...Author[]];
     ttlSeconds?: number;
-};
-/** Convert the public snake-case token fields to the signer restriction. */
-export declare function toSignerRepositoryRestriction(input: ApiRepositoryRestriction): RepositoryRestriction;
-/** Convert signer metadata back to the public snake-case token fields. */
-export declare function toApiRepositoryRestriction(input: Pick<SignedAccessToken, 'repos' | 'repoIds'>): RepositoryRestriction<'repos', 'repo_ids'>;
-/** Sign the minimal Ed25519 access-token contract accepted by the server. */
-export declare function signPrivateKeyAccessToken(input: SignPrivateKeyAccessTokenInput): SignedAccessToken;
+} & ({
+    admin: true;
+} | {
+    access: AccessTokenAccessInput;
+});
+/** Sign an automatic request or MesaFS access token. */
+export declare function signAutomaticPrivateKeyAccessToken(input: SignAutomaticPrivateKeyAccessTokenInput): SignedPrivateKeyAccessToken;
 export {};
 //# sourceMappingURL=access-token.d.ts.map

package/dist/api/access-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/api/access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAgB7D,QAAA,MAAM,sBAAsB;;;iBAiB1B,CAAC;AASH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GACxC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,sBAAsB,CAAC,EAAE,CAAC,CASlG;AAiCD,MAAM,MAAM,yBAAyB,CAAC,SAAS,SAAS,MAAM,GAAG,OAAO,EAAE,OAAO,SAAS,MAAM,GAAG,SAAS,IAAI;KAC7G,GAAG,IAAI,SAAS,GAAG,MAAM,EAAE,GAAG,IAAI;CACpC,GAAG;KACD,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK;CACzB,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,SAAS,SAAS,MAAM,GAAG,OAAO,EAAE,OAAO,SAAS,MAAM,GAAG,SAAS,IAAI;KAC3G,GAAG,IAAI,SAAS,CAAC,CAAC,EAAE,KAAK;CAC3B,GAAG;KACD,GAAG,IAAI,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI;CAClC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,SAAS,SAAS,MAAM,GAAG,OAAO,EAAE,OAAO,SAAS,MAAM,GAAG,SAAS,IACpG,yBAAyB,CAAC,SAAS,EAAE,OAAO,CAAC,GAC7C,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,MAAM,6BAA6B,CAAC,SAAS,SAAS,MAAM,EAAE,OAAO,SAAS,MAAM,IACtF,OAAO,CAAC,yBAAyB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,GACtD,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAEhD,MAAM,MAAM,wBAAwB,GAAG,6BAA6B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAE1F,KAAK,iBAAiB,GAAG;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,KAAK,8BAA8B,GAAG,6BAA6B,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG;IACxF,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,CAAC,EAAE,SAAS,CAAC,qBAAqB,EAAE,GAAG,qBAAqB,EAAE,CAAC,CAAC;IACvE,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,wBAAwB,GAAG,qBAAqB,CAMpG;AAED,0EAA0E;AAC1E,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,SAAS,CAAC,GAClD,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,CAE5C;AAOD,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,8BAA8B,GAAG,iBAAiB,CAoClG"}
+{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../src/api/access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAuB7D,QAAA,MAAM,uBAAuB;;;iBAuB3B,CAAC;AAUH,QAAA,MAAM,4BAA4B;;;EAAsC,CAAC;AAgDzE,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC7D,KAAK,sBAAsB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC;AAErG,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,uBAAuB,CAAC,EAAE,CAAC,CASpG;AA6BD,KAAK,2BAA2B,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,KAAK,uCAAuC,GAAG;IAC7C,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,CAAC;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC,CAAC;AAgD3D,wDAAwD;AACxD,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,uCAAuC,GAC7C,2BAA2B,CAO7B"}

package/dist/api/access-token.js

@@ -1,11 +1,10 @@
 /**
- * Local access-token signing for Ed25519 signing private keys. Tokens are
+ * Local access-token signing for Ed25519 private keys. Tokens are
  * produced entirely offline with no network round trip.
  *
- * This is the SDK-side counterpart to the server implementations in
- * `packages/core/src/auth/signing-key-access-token.ts`. The wire contract lives
- * in `context/auth/signing-key-access-token-protocol.md`. JSON key order does
- * not affect verification.
+ * This is the SDK-side counterpart to the server implementation in
+ * `packages/core/src/auth/access-token.ts`. JSON key order does not
+ * affect verification.
  *
  * Implemented with `node:crypto` only so the published SDK retains Node 18
  * support without adding a JWT dependency.
@@ -20,37 +19,92 @@ import { looksLikePrivateKey } from './credentials.js';
 const ACCESS_TOKEN_AUD = 'mesa-api';
 /** JOSE `typ` header (RFC 9068 style) distinguishing access tokens. */
 const ACCESS_TOKEN_TYP = 'mesa-at+jwt';
-/** Default and maximum lifetimes accepted by the signing-key verifier. */
-const SIGNING_KEY_ACCESS_TOKEN_DEFAULT_TTL_SECONDS = 15 * 60; // 15 minutes
-const SIGNING_KEY_ACCESS_TOKEN_MAX_TTL_SECONDS = 4 * 60 * 60; // 4 hours
-const MAX_SIGNING_KEY_AUTHORS = 100;
-const SIGNING_KEY_TOKEN_SCOPES = ['read', 'write', 'admin'];
-const signingKeyAuthorSchema = z.object({
+/** Default and maximum lifetimes accepted by the access-token verifier. */
+const ACCESS_TOKEN_DEFAULT_TTL_SECONDS = 15 * 60; // 15 minutes
+const ACCESS_TOKEN_MAX_TTL_SECONDS = 4 * 60 * 60; // 4 hours
+const MAX_ACCESS_TOKEN_AUTHORS = 100;
+const MAX_ACCESS_TOKEN_ACCESS_ENTRIES = 250;
+const REPOSITORY_NAME_PATTERN = /^[A-Za-z0-9._-]{1,100}$/;
+const RESERVED_REPOSITORY_NAMES = new Set(['repo', 'repos', 'api-key', 'api-keys']);
+function isValidRepositoryName(name) {
+    if (!REPOSITORY_NAME_PATTERN.test(name) || name === '.' || name === '..')
+        return false;
+    const lowerName = name.toLowerCase();
+    return !lowerName.endsWith('.git') && !RESERVED_REPOSITORY_NAMES.has(lowerName);
+}
+const accessTokenAuthorSchema = z.object({
     name: z
         .string()
         .trim()
         .min(1, { error: 'Author names must not be blank.' })
         .refine((name) => !/[<>\r\n]/.test(name), {
         error: 'Author names must not contain angle brackets or newlines.',
+    })
+        .refine((name) => !looksLikePrivateKey(name), {
+        error: 'Author names must not contain Mesa private keys.',
     }),
     email: z
         .string()
         .trim()
         .refine((email) => !/[<>\r\n]/.test(email), {
         error: 'Author emails must not contain angle brackets or newlines.',
+    })
+        .refine((email) => !looksLikePrivateKey(email), {
+        error: 'Author emails must not contain Mesa private keys.',
     })
         .nullable()
         .default(null)
         .transform((email) => email || null),
 });
-const signingKeyAuthorsSchema = z
-    .array(signingKeyAuthorSchema)
-    .min(1, {
-    error: 'At least one author is required.',
+const accessTokenAccessRepositorySchema = z
+    .string()
+    .refine((repo) => !looksLikePrivateKey(repo), {
+    error: 'Token access repos must not contain Mesa private keys.',
 })
-    .max(MAX_SIGNING_KEY_AUTHORS, { error: `At most ${MAX_SIGNING_KEY_AUTHORS} authors are allowed.` });
-export function normalizeSigningKeyAuthors(authors) {
-    const parsed = signingKeyAuthorsSchema.safeParse(authors);
+    .refine((repo) => isValidRepositoryName(repo), {
+    error: 'Token access repos must be valid bare repository names.',
+});
+const accessTokenAccessLevelSchema = z.enum(['read-repo', 'write-repo']);
+const accessTokenAccessSchema = z.unknown().transform((access, context) => {
+    if (access === null || typeof access !== 'object' || Array.isArray(access)) {
+        context.addIssue({ code: 'custom', message: 'Token access must be a repository permission map.' });
+        return z.NEVER;
+    }
+    const entries = Object.entries(access);
+    if (entries.length === 0) {
+        context.addIssue({ code: 'custom', message: 'Token access must include at least one repository.' });
+        return z.NEVER;
+    }
+    if (entries.length > MAX_ACCESS_TOKEN_ACCESS_ENTRIES) {
+        context.addIssue({
+            code: 'custom',
+            message: `Token access must include at most ${MAX_ACCESS_TOKEN_ACCESS_ENTRIES} repositories.`,
+        });
+        return z.NEVER;
+    }
+    const parsedEntries = [];
+    for (const [repo, level] of entries) {
+        const parsedRepo = accessTokenAccessRepositorySchema.safeParse(repo);
+        if (!parsedRepo.success) {
+            context.addIssue({ code: 'custom', path: [repo], message: parsedRepo.error.issues[0].message });
+            continue;
+        }
+        const parsedLevel = accessTokenAccessLevelSchema.safeParse(level);
+        if (!parsedLevel.success) {
+            context.addIssue({ code: 'custom', path: [repo], message: parsedLevel.error.issues[0].message });
+            continue;
+        }
+        parsedEntries.push([parsedRepo.data, parsedLevel.data]);
+    }
+    return Object.fromEntries(parsedEntries);
+});
+const accessTokenAuthorsSchema = z
+    .array(accessTokenAuthorSchema)
+    .min(1, { error: 'At least one author is required.' })
+    .max(MAX_ACCESS_TOKEN_AUTHORS, { error: `At most ${MAX_ACCESS_TOKEN_AUTHORS} authors are allowed.` });
+const accessTokenTtlSchema = z.int().min(1).max(ACCESS_TOKEN_MAX_TTL_SECONDS).default(ACCESS_TOKEN_DEFAULT_TTL_SECONDS);
+export function normalizeAccessTokenAuthors(authors) {
+    const parsed = accessTokenAuthorsSchema.safeParse(authors);
     if (!parsed.success) {
         const issue = parsed.error.issues[0];
         const path = issue?.path.length ? `.${issue.path.join('.')}` : '';
@@ -58,80 +112,74 @@ export function normalizeSigningKeyAuthors(authors) {
     }
     return parsed.data;
 }
-const signingKeyTokenInputSchema = z
-    .object({
-    authors: signingKeyAuthorsSchema.optional(),
-    scopes: z
-        .array(z.enum(SIGNING_KEY_TOKEN_SCOPES))
-        .min(1)
-        .transform((scopes) => [...new Set(scopes)])
-        .default(['admin']),
-    repos: z
-        .array(z
-        .string()
-        .min(1)
-        .refine((repo) => !looksLikePrivateKey(repo), {
-        error: 'Token repos must not contain Mesa private keys.',
-    }))
-        .nullable()
-        .optional(),
-    repoIds: z.array(z.string().min(1)).max(250).nullable().optional(),
-    ttlSeconds: z
-        .number()
-        .int()
-        .min(1)
-        .max(SIGNING_KEY_ACCESS_TOKEN_MAX_TTL_SECONDS)
-        .default(SIGNING_KEY_ACCESS_TOKEN_DEFAULT_TTL_SECONDS),
-})
-    .refine((input) => input.repos === undefined || input.repoIds === undefined, {
-    error: 'Token repos and repoIds restrictions are mutually exclusive.',
-});
-/** Convert the public snake-case token fields to the signer restriction. */
-export function toSignerRepositoryRestriction(input) {
-    if (input.repos !== undefined && input.repo_ids !== undefined) {
-        throw new InvalidOptionsError('Token repos and repo_ids restrictions are mutually exclusive');
+function normalizeAccessTokenAccess(access) {
+    const repos = new Map();
+    for (const [repo, level] of Object.entries(access)) {
+        const key = repo.toLowerCase();
+        const existing = repos.get(key);
+        if (!existing || level === 'write-repo') {
+            repos.set(key, { name: existing?.name ?? repo, level });
+        }
     }
-    return input.repo_ids !== undefined ? { repoIds: input.repo_ids } : { repos: input.repos ?? null };
+    return Object.fromEntries([...repos.values()].map(({ name, level }) => [name, level]));
 }
-/** Convert signer metadata back to the public snake-case token fields. */
-export function toApiRepositoryRestriction(input) {
-    return input.repoIds !== undefined ? { repo_ids: input.repoIds } : { repos: input.repos ?? null };
+const automaticAccessTokenInputSchema = z.union([
+    z.strictObject({
+        authors: accessTokenAuthorsSchema.optional(),
+        admin: z.literal(true),
+        ttlSeconds: accessTokenTtlSchema,
+    }),
+    z.strictObject({
+        authors: accessTokenAuthorsSchema.optional(),
+        access: accessTokenAccessSchema,
+        ttlSeconds: accessTokenTtlSchema,
+    }),
+]);
+function invalidTokenOptions(error) {
+    const outerIssue = error.issues[0];
+    const unionIssues = outerIssue?.code === 'invalid_union' ? outerIssue.errors.flat() : [];
+    const issue = unionIssues.find((candidate) => candidate.code === 'custom') ?? unionIssues[0] ?? outerIssue;
+    const message = issue?.code === 'invalid_key' ? issue.issues[0]?.message : issue?.message;
+    // Repository selectors are user-controlled and may contain private material.
+    // Report the field without echoing the invalid map key.
+    const path = issue?.path[0] === 'access' ? 'access' : issue?.path.join('.') || 'token options';
+    return new InvalidOptionsError(`Invalid ${path}: ${message ?? 'invalid value'}`);
 }
 /** base64url-nopad encode a UTF-8 string. Node's `base64url` is already unpadded. */
 function base64UrlJson(value) {
     return Buffer.from(JSON.stringify(value), 'utf8').toString('base64url');
 }
-/** Sign the minimal Ed25519 access-token contract accepted by the server. */
-export function signPrivateKeyAccessToken(input) {
-    const parsed = signingKeyTokenInputSchema.safeParse(input);
-    if (!parsed.success) {
-        const issue = parsed.error.issues[0];
-        throw new InvalidOptionsError(`Invalid ${issue?.path.join('.') || 'token options'}: ${issue?.message ?? 'invalid value'}`);
-    }
-    const { authors, scopes, repos, repoIds, ttlSeconds } = parsed.data;
+function signPrivateKeyToken(privateKey, tokenInput) {
+    const { authors, ttlSeconds } = tokenInput;
+    const authority = 'admin' in tokenInput ? { admin: true } : { access: normalizeAccessTokenAccess(tokenInput.access) };
     const iat = Math.floor(Date.now() / 1000);
     const exp = iat + ttlSeconds;
     const jti = randomUUID();
-    const repoRestriction = repoIds !== undefined ? { repo_ids: repoIds } : { repos: repos ?? null };
-    const header = { alg: 'EdDSA', typ: ACCESS_TOKEN_TYP, jwk: input.credential.publicJwk };
+    const header = { alg: 'EdDSA', typ: ACCESS_TOKEN_TYP, jwk: privateKey.publicJwk };
     const payload = {
-        iss: input.credential.org,
+        iss: privateKey.org,
         aud: ACCESS_TOKEN_AUD,
-        ...(authors === undefined ? {} : { author: authors.map(({ name, email }) => [name, email]) }),
-        scopes,
-        ...repoRestriction,
+        ...(authors ? { authors } : {}),
+        ...authority,
         iat,
         exp,
         jti,
     };
     const signingInput = `${base64UrlJson(header)}.${base64UrlJson(payload)}`;
-    const signature = signEd25519(null, Buffer.from(signingInput, 'utf8'), input.credential.privateKey).toString('base64url');
+    const signature = signEd25519(null, Buffer.from(signingInput, 'utf8'), privateKey.privateKey).toString('base64url');
     return {
         token: `${signingInput}.${signature}`,
         expiresAt: new Date(exp * 1000).toISOString(),
-        scopes,
-        ...(repoIds !== undefined ? { repoIds } : { repos: repos ?? null }),
         jti,
     };
 }
+/** Sign an automatic request or MesaFS access token. */
+export function signAutomaticPrivateKeyAccessToken(input) {
+    const { privateKey, ...tokenInput } = input;
+    const parsed = automaticAccessTokenInputSchema.safeParse(tokenInput);
+    if (!parsed.success) {
+        throw invalidTokenOptions(parsed.error);
+    }
+    return signPrivateKeyToken(privateKey, parsed.data);
+}
 //# sourceMappingURL=access-token.js.map

package/dist/api/access-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/api/access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,mFAAmF;AACnF,gFAAgF;AAChF,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,UAAU,CAAC;AACpC,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,0EAA0E;AAC1E,MAAM,4CAA4C,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa;AAC3E,MAAM,wCAAwC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AACxE,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAGpC,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAA0C,CAAC;AAErG,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;SACpD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxC,KAAK,EAAE,2DAA2D;KACnE,CAAC;IACJ,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC1C,KAAK,EAAE,4DAA4D;KACpE,CAAC;SACD,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC;KAC9B,KAAK,CAAC,sBAAsB,CAAC;KAC7B,GAAG,CAAC,CAAC,EAAE;IACN,KAAK,EAAE,kCAAkC;CAC1C,CAAC;KACD,GAAG,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,WAAW,uBAAuB,uBAAuB,EAAE,CAAC,CAAC;AAItG,MAAM,UAAU,0BAA0B,CACxC,OAAyC;IAEzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,IAAI,KAAK,KAAK,EAAE,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,MAAM,CAAC,IAA+F,CAAC;AAChH,CAAC;AAED,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC;SACN,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;SAC3C,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE;QAC5C,KAAK,EAAE,iDAAiD;KACzD,CAAC,CACL;SACA,QAAQ,EAAE;SACV,QAAQ,EAAE;IACb,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClE,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,wCAAwC,CAAC;SAC7C,OAAO,CAAC,4CAA4C,CAAC;CACzD,CAAC;KACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE;IAC3E,KAAK,EAAE,8DAA8D;CACtE,CAAC,CAAC;AA8CL,4EAA4E;AAC5E,MAAM,UAAU,6BAA6B,CAAC,KAA+B;IAC3E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,mBAAmB,CAAC,8DAA8D,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;AACrG,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,0BAA0B,CACxC,KAAmD;IAEnD,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;AACpG,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CAAC,KAAqC;IAC7E,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAC3B,WAAW,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,eAAe,KAAK,KAAK,EAAE,OAAO,IAAI,eAAe,EAAE,CAC5F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,eAAe,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;IACjG,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;IACxF,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG;QACzB,GAAG,EAAE,gBAAgB;QACrB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAU,CAAC,EAAE,CAAC;QACtG,MAAM;QACN,GAAG,eAAe;QAClB,GAAG;QACH,GAAG;QACH,GAAG;KACJ,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC1G,WAAW,CACZ,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,GAAG,YAAY,IAAI,SAAS,EAAE;QACrC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7C,MAAM;QACN,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;QACnE,GAAG;KACJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../src/api/access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,mFAAmF;AACnF,gFAAgF;AAChF,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,UAAU,CAAC;AACpC,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,2EAA2E;AAC3E,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,aAAa;AAC/D,MAAM,4BAA4B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAC5D,MAAM,wBAAwB,GAAG,GAAG,CAAC;AACrC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAC5C,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAC1D,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpF,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAEvF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;SACpD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACxC,KAAK,EAAE,2DAA2D;KACnE,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE;QAC5C,KAAK,EAAE,kDAAkD;KAC1D,CAAC;IACJ,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAC1C,KAAK,EAAE,4DAA4D;KACpE,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE;QAC9C,KAAK,EAAE,mDAAmD;KAC3D,CAAC;SACD,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC;CACvC,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,CAAC;KACxC,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE;IAC5C,KAAK,EAAE,wDAAwD;CAChE,CAAC;KACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;IAC7C,KAAK,EAAE,yDAAyD;CACjE,CAAC,CAAC;AACL,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzE,MAAM,uBAAuB,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACxE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,+BAA+B,EAAE,CAAC;QACrD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,qCAAqC,+BAA+B,gBAAgB;SAC9F,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,aAAa,GAA4C,EAAE,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,iCAAiC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACjG,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QAED,aAAa,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAGH,MAAM,wBAAwB,GAAG,CAAC;KAC/B,KAAK,CAAC,uBAAuB,CAAC;KAC9B,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;KACrD,GAAG,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,WAAW,wBAAwB,uBAAuB,EAAE,CAAC,CAAC;AACxG,MAAM,oBAAoB,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;AAKxH,MAAM,UAAU,2BAA2B,CACzC,OAA0B;IAE1B,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,mBAAmB,CAAC,kBAAkB,IAAI,KAAK,KAAK,EAAE,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,MAAM,CAAC,IAAiG,CAAC;AAClH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAmC;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2D,CAAC;IAEjF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YACxC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,YAAY,CAAC;QACb,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;QAC5C,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACtB,UAAU,EAAE,oBAAoB;KACjC,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;QAC5C,MAAM,EAAE,uBAAuB;QAC/B,UAAU,EAAE,oBAAoB;KACjC,CAAC;CACH,CAAC,CAAC;AAgBH,SAAS,mBAAmB,CAAC,KAAiB;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,UAAU,EAAE,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;IAC3G,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC;IAC1F,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC;IAC/F,OAAO,IAAI,mBAAmB,CAAC,WAAW,IAAI,KAAK,OAAO,IAAI,eAAe,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,qFAAqF;AACrF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAgC,EAChC,UAA4D;IAE5D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;IAC3C,MAAM,SAAS,GACb,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,0BAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,GAAG,GAAG,UAAU,CAAC;IAC7B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;IAClF,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,GAAG,EAAE,gBAAgB;QACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,SAAS;QACZ,GAAG;QACH,GAAG;QACH,GAAG;KACJ,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEpH,OAAO;QACL,KAAK,EAAE,GAAG,YAAY,IAAI,SAAS,EAAE;QACrC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC7C,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,kCAAkC,CAChD,KAA8C;IAE9C,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC"}

package/dist/api/client.d.ts

@@ -13,13 +13,13 @@ export type RestOperation = (options: never) => Promise<unknown>;
 export type RestRequestOptions<TData extends RestDataShape> = Simplify<Omit<RestOptions<TData, boolean>, 'baseUrl' | 'fetch' | 'headers' | 'responseStyle' | 'throwOnError'>>;
 type RestClientConfig = {
     /** Bearer credential, or a local signer that returns one for each request. */
-    credential: string | (() => string);
+    accessToken: string | (() => string);
     apiUrl: string;
     fetch?: typeof globalThis.fetch;
     userAgent?: string;
 };
 export type RestClient = {
-    request<TData extends RestDataShape, TResult>(operation: RestOperation, options?: RestRequestOptions<TData>, credentialOverride?: string): Promise<TResult>;
+    request<TData extends RestDataShape, TResult>(operation: RestOperation, options?: RestRequestOptions<TData>, accessTokenOverride?: string): Promise<TResult>;
     whoami(): Promise<WhoamiResponse>;
 };
 export declare function createRestClient(config: RestClientConfig): RestClient;

package/dist/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,IAAI,WAAW,EAAmB,KAAK,cAAc,EAAU,MAAM,eAAe,CAAC;AAM1G,KAAK,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,EAAE,CAAC;AAEjD,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjE,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,aAAa,IAAI,QAAQ,CACpE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,cAAc,CAAC,CACtG,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAOF,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,OAAO,EAC1C,SAAS,EAAE,aAAa,EACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,EACnC,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA+CrE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,OAAO,IAAI,WAAW,EAAmB,KAAK,cAAc,EAAU,MAAM,eAAe,CAAC;AAM1G,KAAK,QAAQ,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAE,GAAG,EAAE,CAAC;AAEjD,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjE,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,aAAa,IAAI,QAAQ,CACpE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,cAAc,CAAC,CACtG,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAOF,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,CAAC,KAAK,SAAS,aAAa,EAAE,OAAO,EAC1C,SAAS,EAAE,aAAa,EACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,EACnC,mBAAmB,CAAC,EAAE,MAAM,GAC3B,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;CACnC,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA+CrE"}

package/dist/api/client.js

@@ -11,13 +11,13 @@ export function createRestClient(config) {
     else {
         defaultHeaders['User-Agent'] = userAgent ? `${SDK_USER_AGENT} ${userAgent}` : SDK_USER_AGENT;
     }
-    const request = async (operation, options = {}, credentialOverride) => {
-        const credential = credentialOverride ?? (typeof config.credential === 'function' ? config.credential() : config.credential);
+    const request = async (operation, options = {}, accessTokenOverride) => {
+        const accessToken = accessTokenOverride ?? (typeof config.accessToken === 'function' ? config.accessToken() : config.accessToken);
         const requestOptions = {
             ...options,
             baseUrl: config.apiUrl,
             fetch: config.fetch,
-            headers: { ...defaultHeaders, Authorization: `Bearer ${credential}` },
+            headers: { ...defaultHeaders, Authorization: `Bearer ${accessToken}` },
             responseStyle: 'fields',
             throwOnError: false,
         };

package/dist/api/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,cAAc,GAAG,eAAe,WAAW,EAAE,CAAC;AAwCpD,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,cAAc,GAA2B,EAAE,CAAC;IAElD,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,cAAc,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAC/F,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EACnB,SAAwB,EACxB,UAAqC,EAA+B,EACpE,kBAA2B,EACT,EAAE;QACpB,MAAM,UAAU,GACd,kBAAkB,IAAI,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5G,MAAM,cAAc,GAAG;YACrB,GAAG,OAAO;YACV,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,EAAE,GAAG,cAAc,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;YACrE,aAAa,EAAE,QAAQ;YACvB,YAAY,EAAE,KAAK;SACW,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAO,SAAwE,CAAC,cAAc,CAAC,CAAC;QAEjH,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,QAAkD,CAAC;YAEzE,IAAI,aAAa,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,iBAAiB,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,MAAM,IAAI,aAAa,EAAE,CAAC;gBAC5B,OAAO,aAAa,CAAC,IAAe,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,QAAmB,CAAC;IAC7B,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAA6B,MAAM,CAAC;KAC1D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC1G,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,cAAc,GAAG,eAAe,WAAW,EAAE,CAAC;AAwCpD,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,cAAc,GAA2B,EAAE,CAAC;IAElD,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,cAAc,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IACtG,CAAC;SAAM,CAAC;QACN,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC;IAC/F,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EACnB,SAAwB,EACxB,UAAqC,EAA+B,EACpE,mBAA4B,EACV,EAAE;QACpB,MAAM,WAAW,GACf,mBAAmB,IAAI,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChH,MAAM,cAAc,GAAG;YACrB,GAAG,OAAO;YACV,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,EAAE,GAAG,cAAc,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACtE,aAAa,EAAE,QAAQ;YACvB,YAAY,EAAE,KAAK;SACW,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAO,SAAwE,CAAC,cAAc,CAAC,CAAC;QAEjH,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,QAAkD,CAAC;YAEzE,IAAI,aAAa,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,iBAAiB,CAAC,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;YACvE,CAAC;YAED,IAAI,MAAM,IAAI,aAAa,EAAE,CAAC;gBAC5B,OAAO,aAAa,CAAC,IAAe,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,QAAmB,CAAC;IAC7B,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAA6B,MAAM,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/api/index.d.ts

@@ -1,3 +1,2 @@
-export { type TokensCreateAuthor, type TokensCreateInput, type TokensCreatePrivateKeyInput, type TokensCreateResponse, } from './resources.js';
 export { type RepoTagFilter, type RepoTagValueFilter } from './repo-tag-filter.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/api/index.js

@@ -1,3 +1,2 @@
-export {} from './resources.js';
 export {} from './repo-tag-filter.js';
 //# sourceMappingURL=index.js.map

package/dist/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAKN,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA+C,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,MAAM,sBAAsB,CAAC"}

package/dist/api/{signing-key.d.ts → private-key.d.ts}

@@ -12,4 +12,4 @@ export type PrivateKeyCredential = {
 /** Parse and validate a Mesa Ed25519 private key once for repeated local signing. */
 export declare function parsePrivateKey(privateKey: string): PrivateKeyCredential;
 export {};
-//# sourceMappingURL=signing-key.d.ts.map
+//# sourceMappingURL=private-key.d.ts.map

package/dist/api/{signing-key.d.ts.map → private-key.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"signing-key.d.ts","sourceRoot":"","sources":["../../src/api/signing-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAMhF,KAAK,aAAa,GAAG;IACnB,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,CAiCxE"}
+{"version":3,"file":"private-key.d.ts","sourceRoot":"","sources":["../../src/api/private-key.ts"],"names":[],"mappings":"AACA,OAAO,EAAqC,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAMhF,KAAK,aAAa,GAAG;IACnB,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,SAAS,CAAC;IACf,CAAC,EAAE,MAAM,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,CAiCxE"}

package/dist/api/{signing-key.js → private-key.js}

@@ -35,4 +35,4 @@ export function parsePrivateKey(privateKey) {
         publicJwk: { kty: 'OKP', crv: 'Ed25519', x: x },
     };
 }
-//# sourceMappingURL=signing-key.js.map
+//# sourceMappingURL=private-key.js.map

package/dist/api/{signing-key.js.map → private-key.js.map}

@@ -1 +1 @@
-{"version":3,"file":"signing-key.js","sourceRoot":"","sources":["../../src/api/signing-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,6BAA6B,GAAG,sDAAsD,CAAC;AAc7F,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,mBAAmB,CAAC,4DAA4D,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mDAAmD,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEtD,IAAI,gBAA2B,CAAC;IAChC,IAAI,CAAC;QACH,gBAAgB,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,gBAAgB,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,mBAAmB,CAAC,iEAAiE,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,EAAE,CAAC,EAAE,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE1E,OAAO;QACL,GAAG;QACH,UAAU,EAAE,gBAAgB;QAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAE,EAAE;KACjD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"private-key.js","sourceRoot":"","sources":["../../src/api/private-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,6BAA6B,GAAG,sDAAsD,CAAC;AAc7F,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,mBAAmB,CAAC,4DAA4D,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAAC,mDAAmD,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IAEtD,IAAI,gBAA2B,CAAC;IAChC,IAAI,CAAC;QACH,gBAAgB,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAmB,CAAC,6CAA6C,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,gBAAgB,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,mBAAmB,CAAC,iEAAiE,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,EAAE,CAAC,EAAE,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE1E,OAAO;QACL,GAAG;QACH,UAAU,EAAE,gBAAgB;QAC5B,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAE,EAAE;KACjD,CAAC;AACJ,CAAC"}

package/dist/api/repo-tag-filter.d.ts

@@ -53,6 +53,6 @@ export type RepoTagFilter = {
     $not?: RepoTagFilter;
     [tagKey: string]: RepoTagValueFilter | RepoTagFilter | RepoTagFilter[] | undefined;
 };
-export declare function serializeRepoTagsFilter(tags: RepoTagFilter | string | undefined): string | undefined;
+export declare function serializeRepoTagsFilter(tags: RepoTagFilter | undefined): string | undefined;
 export {};
 //# sourceMappingURL=repo-tag-filter.d.ts.map

package/dist/api/repo-tag-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-tag-filter.d.ts","sourceRoot":"","sources":["../../src/api/repo-tag-filter.ts"],"names":[],"mappings":"AAAA,KAAK,eAAe,GAAG;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,MAAM,EAAE,GACR,eAAe,GACf,eAAe,GACf,qBAAqB,GACrB,uBAAuB,GACvB,qBAAqB,GACrB,mBAAmB,CAAC;AAQxB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;IACvB,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,aAAa,GAAG,aAAa,EAAE,GAAG,SAAS,CAAC;CACpF,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAGpG"}
+{"version":3,"file":"repo-tag-filter.d.ts","sourceRoot":"","sources":["../../src/api/repo-tag-filter.ts"],"names":[],"mappings":"AAAA,KAAK,eAAe,GAAG;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,KAAK,uBAAuB,GAAG;IAC7B,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,KAAK,CAAC;CACjB,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACzB,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,GAAG,CAAC,EAAE,KAAK,CAAC;IACZ,SAAS,CAAC,EAAE,KAAK,CAAC;IAClB,YAAY,CAAC,EAAE,KAAK,CAAC;IACrB,UAAU,CAAC,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B,MAAM,GACN,MAAM,EAAE,GACR,eAAe,GACf,eAAe,GACf,qBAAqB,GACrB,uBAAuB,GACvB,qBAAqB,GACrB,mBAAmB,CAAC;AAQxB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;IACvB,GAAG,CAAC,EAAE,aAAa,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,aAAa,GAAG,aAAa,EAAE,GAAG,SAAS,CAAC;CACpF,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI3F"}