@selvajs/platform 0.20.1 → 0.21.0-beta.0

package/dist/apiTokens/index.d.ts

@@ -0,0 +1,6 @@
+export type { ApiScope, ApiScopeAction, ApiScopeResource, ApiToken, ApiTokenSummary, ApiTokenRevokeReason, ApiTokenLifetimeDays } from './types.js';
+export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
+export type { IApiTokenStore } from './interface.js';
+export type { ScopeTarget } from './scope.js';
+export { scopeAllows, narrowApiTokenContext } from './scope.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/apiTokens/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/apiTokens/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACX,QAAQ,EACR,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}

package/dist/apiTokens/index.js

@@ -0,0 +1,3 @@
+export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope } from './types.js';
+export { scopeAllows, narrowApiTokenContext } from './scope.js';
+//# sourceMappingURL=index.js.map

package/dist/apiTokens/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/apiTokens/index.ts"],"names":[],"mappings":"AASA,OAAO,EACN,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC"}

package/dist/apiTokens/interface.d.ts

@@ -0,0 +1,37 @@
+import type { RequestContext } from '../context.js';
+import type { ListOptions, Page } from '../pagination.js';
+import type { ApiToken, ApiTokenRevokeReason, ApiTokenSummary } from './types.js';
+/**
+ * Mutations are gated by the route layer. `getByTokenHash` and `touchLastUsed`
+ * run as `SYSTEM_CONTEXT`: the key is the credential, and there is no session
+ * yet when it is resolved.
+ */
+export interface IApiTokenStore {
+    create(ctx: RequestContext, token: ApiToken): Promise<void>;
+    /** Live tokens only: unknown, revoked and expired hashes all return null. */
+    getByTokenHash(ctx: RequestContext, tokenHash: string): Promise<ApiToken | null>;
+    /** Any state, including revoked and expired. */
+    get(ctx: RequestContext, id: string): Promise<ApiTokenSummary | null>;
+    /** Newest first by default. `userId` narrows to one owner's tokens. */
+    listByOrg(ctx: RequestContext, orgId: string, opts?: ListOptions & {
+        userId?: string;
+    }): Promise<Page<ApiTokenSummary>>;
+    /** No-op if already revoked or missing. */
+    revoke(ctx: RequestContext, id: string, reason: ApiTokenRevokeReason): Promise<void>;
+    /**
+     * Revoke every live token `userId` owns, in one org or (no `orgId`) all of
+     * them, returning the ids revoked. One call so a token minted between a
+     * list and a per-id revoke can't survive.
+     */
+    revokeAllForUser(ctx: RequestContext, userId: string, opts: {
+        orgId?: string;
+        reason: ApiTokenRevokeReason;
+    }): Promise<string[]>;
+    /** Best effort; callers throttle and never await it on the request path. */
+    touchLastUsed(ctx: RequestContext, id: string, at: string): Promise<void>;
+    /** Erasure: deletes the user's tokens and clears `createdBy` on tokens they minted for others. */
+    eraseUser(ctx: RequestContext, userId: string): Promise<void>;
+    /** Called from the `deleteOrg` cascade. */
+    deleteByOrg(ctx: RequestContext, orgId: string): Promise<void>;
+}
+//# sourceMappingURL=interface.d.ts.map

package/dist/apiTokens/interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/apiTokens/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC9B,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5D,6EAA6E;IAC7E,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEjF,gDAAgD;IAChD,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEtE,uEAAuE;IACvE,SAAS,CACR,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,WAAW,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IAElC,2CAA2C;IAC3C,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErF;;;;OAIG;IACH,gBAAgB,CACf,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,GACpD,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErB,4EAA4E;IAC5E,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1E,kGAAkG;IAClG,SAAS,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D,2CAA2C;IAC3C,WAAW,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D"}

package/dist/apiTokens/interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=interface.js.map

package/dist/apiTokens/interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/apiTokens/interface.ts"],"names":[],"mappings":""}

package/dist/apiTokens/scope.d.ts

@@ -0,0 +1,28 @@
+import type { RequestContext } from '../context.js';
+import { type ApiScopeAction, type ApiToken } from './types.js';
+/** The rows a request touches, when the route knows them. */
+export interface ScopeTarget {
+    projectId?: string;
+    definitionId?: string;
+}
+/**
+ * May this request perform `action` on `target`?
+ *
+ * Without a target this is an org-level check, which only `all` and org scopes
+ * pass: a project key must never reach a route that can't say which project it
+ * touches. Requests without an API token always pass; their permissions are
+ * checked elsewhere.
+ */
+export declare function scopeAllows(ctx: RequestContext, action: ApiScopeAction, target?: ScopeTarget): boolean;
+/**
+ * Narrow the owner's live context to what the token grants. Only removes
+ * rights:
+ *
+ * - Platform permissions are dropped. Instance authority never rides on a
+ *   bearer key, so an operator's leaked key can't reach other tenants.
+ * - `apiScope` is attached, which `scopeAllows` reads.
+ *
+ * Scopes this version can't parse are dropped, so they grant nothing.
+ */
+export declare function narrowApiTokenContext(ctx: RequestContext, token: Pick<ApiToken, 'id' | 'orgId' | 'scopes'>): RequestContext;
+//# sourceMappingURL=scope.d.ts.map

package/dist/apiTokens/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/apiTokens/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,OAAO,EAAgC,KAAK,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE9F,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAC1B,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,cAAc,EACtB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAIT;AAoBD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACpC,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAC,GAC9C,cAAc,CAMhB"}

package/dist/apiTokens/scope.js

@@ -0,0 +1,50 @@
+import { ProviderError } from '../errors.js';
+import { parseApiScope } from './types.js';
+/**
+ * May this request perform `action` on `target`?
+ *
+ * Without a target this is an org-level check, which only `all` and org scopes
+ * pass: a project key must never reach a route that can't say which project it
+ * touches. Requests without an API token always pass; their permissions are
+ * checked elsewhere.
+ */
+export function scopeAllows(ctx, action, target) {
+    const api = ctx.apiScope;
+    if (!api)
+        return true;
+    return api.scopes.some((s) => actionCovers(s.action, action) && resourceCovers(s, ctx, target));
+}
+function actionCovers(granted, wanted) {
+    return granted === wanted || wanted === 'read';
+}
+function resourceCovers(scope, ctx, target) {
+    const { resource } = scope;
+    switch (resource.kind) {
+        case 'all':
+            return true;
+        case 'org':
+            return resource.id === ctx.actingOrgId;
+        case 'project':
+            return target?.projectId === resource.id;
+        case 'definition':
+            return target?.definitionId === resource.id;
+    }
+}
+/**
+ * Narrow the owner's live context to what the token grants. Only removes
+ * rights:
+ *
+ * - Platform permissions are dropped. Instance authority never rides on a
+ *   bearer key, so an operator's leaked key can't reach other tenants.
+ * - `apiScope` is attached, which `scopeAllows` reads.
+ *
+ * Scopes this version can't parse are dropped, so they grant nothing.
+ */
+export function narrowApiTokenContext(ctx, token) {
+    if (ctx.actingOrgId !== token.orgId) {
+        throw new ProviderError('API token context must act in the token’s org', 500);
+    }
+    const scopes = token.scopes.map(parseApiScope).filter((s) => s !== null);
+    return { ...ctx, platformPermissions: [], apiScope: { tokenId: token.id, scopes } };
+}
+//# sourceMappingURL=scope.js.map

package/dist/apiTokens/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/apiTokens/scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAqD,MAAM,YAAY,CAAC;AAQ9F;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAC1B,GAAmB,EACnB,MAAsB,EACtB,MAAoB;IAEpB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,YAAY,CAAC,OAAuB,EAAE,MAAsB;IACpE,OAAO,OAAO,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CAAC,KAAe,EAAE,GAAmB,EAAE,MAAoB;IACjF,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,KAAK;YACT,OAAO,IAAI,CAAC;QACb,KAAK,KAAK;YACT,OAAO,QAAQ,CAAC,EAAE,KAAK,GAAG,CAAC,WAAW,CAAC;QACxC,KAAK,SAAS;YACb,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC1C,KAAK,YAAY;YAChB,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,CAAC,EAAE,CAAC;IAC9C,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACpC,GAAmB,EACnB,KAAgD;IAEhD,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CAAC,+CAA+C,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACxF,OAAO,EAAE,GAAG,GAAG,EAAE,mBAAmB,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;AACrF,CAAC"}

package/dist/apiTokens/types.d.ts

@@ -0,0 +1,79 @@
+import { z } from 'zod';
+/** `write` and `solve` each include `read`; neither includes the other. */
+export declare const ApiScopeActionSchema: z.ZodEnum<{
+    read: "read";
+    write: "write";
+    solve: "solve";
+}>;
+export type ApiScopeAction = z.infer<typeof ApiScopeActionSchema>;
+/**
+ * What one scope covers. A token is bound to one org, so `all` and that org's
+ * `org` resource reach the same rows; both exist so a host app can store
+ * either without translating.
+ */
+export type ApiScopeResource = {
+    kind: 'all';
+} | {
+    kind: 'org';
+    id: string;
+} | {
+    kind: 'project';
+    id: string;
+} | {
+    kind: 'definition';
+    id: string;
+};
+export interface ApiScope {
+    action: ApiScopeAction;
+    resource: ApiScopeResource;
+}
+/** `read:all`, `write:org:<id>`, `solve:project:<id>`, `read:definition:<guid>`. */
+export declare function parseApiScope(value: string): ApiScope | null;
+export declare function formatApiScope(scope: ApiScope): string;
+/**
+ * Scopes are stored as strings so a new action or resource kind needs no
+ * migration. Parsing rejects anything this version doesn't understand, so an
+ * unknown scope grants nothing rather than being guessed at.
+ */
+export declare const ApiScopeStringSchema: z.ZodString;
+/**
+ * A long-lived bearer credential acting as `userId` inside `orgId`, narrowed by
+ * `scopes`. The raw key is shown once at mint; the store holds only its HMAC.
+ */
+export interface ApiToken {
+    id: string;
+    /** The user the token acts as. Erasing them deletes the token. */
+    userId: string;
+    /**
+     * Who minted it. Equal to `userId` until service accounts exist; null once
+     * the minting user is erased.
+     */
+    createdBy: string | null;
+    orgId: string;
+    /** Free text the owner chose. Personal data in practice ("Felix laptop"), so never logged or audited. */
+    name: string;
+    /** `HMAC-SHA256(SELVA_HMAC_KEY, rawToken)`, base64url. */
+    tokenHash: string;
+    /** String form, see {@link parseApiScope}. At least one. */
+    scopes: string[];
+    createdAt: string;
+    expiresAt: string;
+    lastUsedAt: string | null;
+    /** Revoked rows stay so a `tokenId` in the audit log still resolves to a name. */
+    revokedAt: string | null;
+}
+/** What listing returns: the hash never leaves the store on a read path. */
+export type ApiTokenSummary = Omit<ApiToken, 'tokenHash'>;
+export declare const ApiTokenRevokeReasonSchema: z.ZodEnum<{
+    admin: "admin";
+    owner: "owner";
+    member_removed: "member_removed";
+    user_disabled: "user_disabled";
+}>;
+export type ApiTokenRevokeReason = z.infer<typeof ApiTokenRevokeReasonSchema>;
+/** The only lifetimes offered. Expiry is never optional. */
+export declare const API_TOKEN_LIFETIME_DAYS: readonly [30, 90, 180];
+export type ApiTokenLifetimeDays = (typeof API_TOKEN_LIFETIME_DAYS)[number];
+/** "Read and change everything in the org". Names no ids, so it suits an email. */
+export declare function describeApiScope(value: string): string;
+//# sourceMappingURL=types.d.ts.map

package/dist/apiTokens/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/apiTokens/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB;;;;EAAqC,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACzB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,WAAW,QAAQ;IACxB,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,gBAAgB,CAAC;CAC3B;AAMD,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAM5D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAGtD;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,aAEuC,CAAC;AAEzE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,4EAA4E;AAC5E,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAE1D,eAAO,MAAM,0BAA0B;;;;;EAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,wBAAyB,CAAC;AAC9D,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQ5E,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD"}

package/dist/apiTokens/types.js

@@ -0,0 +1,54 @@
+import { z } from 'zod';
+/** `write` and `solve` each include `read`; neither includes the other. */
+export const ApiScopeActionSchema = z.enum(['read', 'write', 'solve']);
+// Ids are uuids or guids in practice; the charset only has to keep `:` out so
+// the string form stays unambiguous.
+const SCOPE_PATTERN = /^(read|write|solve):(all|(org|project|definition):([A-Za-z0-9_-]{1,128}))$/;
+/** `read:all`, `write:org:<id>`, `solve:project:<id>`, `read:definition:<guid>`. */
+export function parseApiScope(value) {
+    const m = SCOPE_PATTERN.exec(value);
+    if (!m)
+        return null;
+    const action = m[1];
+    if (m[2] === 'all')
+        return { action, resource: { kind: 'all' } };
+    return { action, resource: { kind: m[3], id: m[4] } };
+}
+export function formatApiScope(scope) {
+    const { action, resource } = scope;
+    return resource.kind === 'all' ? `${action}:all` : `${action}:${resource.kind}:${resource.id}`;
+}
+/**
+ * Scopes are stored as strings so a new action or resource kind needs no
+ * migration. Parsing rejects anything this version doesn't understand, so an
+ * unknown scope grants nothing rather than being guessed at.
+ */
+export const ApiScopeStringSchema = z
+    .string()
+    .refine((s) => parseApiScope(s) !== null, { message: 'Unknown scope' });
+export const ApiTokenRevokeReasonSchema = z.enum([
+    'owner',
+    'admin',
+    'member_removed',
+    'user_disabled'
+]);
+/** The only lifetimes offered. Expiry is never optional. */
+export const API_TOKEN_LIFETIME_DAYS = [30, 90, 180];
+const ACTION_WORDS = {
+    read: 'Read',
+    write: 'Read and change',
+    solve: 'Read and run solves on'
+};
+/** "Read and change everything in the org". Names no ids, so it suits an email. */
+export function describeApiScope(value) {
+    const scope = parseApiScope(value);
+    if (!scope)
+        return `Unknown scope (${value})`;
+    const what = scope.resource.kind === 'project'
+        ? 'one project'
+        : scope.resource.kind === 'definition'
+            ? 'one definition'
+            : 'everything in the org';
+    return `${ACTION_WORDS[scope.action]} ${what}`;
+}
+//# sourceMappingURL=types.js.map

package/dist/apiTokens/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/apiTokens/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAmBvE,8EAA8E;AAC9E,qCAAqC;AACrC,MAAM,aAAa,GAAG,4EAA4E,CAAC;AAEnG,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAmB,CAAC;IACtC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;IACjE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAqC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAe;IAC7C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACnC,OAAO,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;AAgCzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,eAAe;CACf,CAAC,CAAC;AAGH,4DAA4D;AAC5D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAU,CAAC;AAG9D,MAAM,YAAY,GAAmC;IACpD,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,iBAAiB;IACxB,KAAK,EAAE,wBAAwB;CAC/B,CAAC;AAEF,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO,kBAAkB,KAAK,GAAG,CAAC;IAC9C,MAAM,IAAI,GACT,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;QAChC,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;YACrC,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,uBAAuB,CAAC;IAC7B,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;AAChD,CAAC"}

package/dist/auth/index.d.ts

@@ -1,3 +1,3 @@
 export type { AuthUser, UserManagementResult, LoginResult } from './types.js';
-export type { IAuthProvider, IOAuthAuth, ISessionRefresh, IPasswordAuth, IEmailLinkAuth, IProxyAuth } from './interface.js';
+export type { IAuthProvider, IOAuthAuth, ISessionRefresh, IPasswordAuth, IEmailLinkAuth, IProxyAuth, IDelegatedSession, DelegatedSessionStatus } from './interface.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9E,YAAY,EACX,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,QAAQ,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9E,YAAY,EACX,aAAa,EACb,UAAU,EACV,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,sBAAsB,EACtB,MAAM,gBAAgB,CAAC"}

package/dist/auth/interface.d.ts

@@ -223,6 +223,30 @@ export interface IProxyAuth {
     /** Identity-header names this provider reads. Log output only, never surfaced to end users. */
     readonly configuredHeaderNames: readonly string[];
 }
+export type DelegatedSessionStatus = {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+/**
+ * Signs a short-lived session for a user without their credentials, so an API
+ * token request runs under the same row security as that user's browser
+ * session. Only providers whose stores scope queries by a user session need
+ * it; without it their stores see an anonymous caller.
+ *
+ * Nothing can revoke a minted session before it expires, so callers must
+ * re-check the user (disabled, still a member) before every `mint`.
+ */
+export interface IDelegatedSession {
+    /**
+     * Whether minting works with the configured key. A failure switches API
+     * tokens off; browser sign-in is unaffected.
+     */
+    status(): Promise<DelegatedSessionStatus>;
+    /** A session token acting as `userId`, valid for about a minute. Throws if `status` isn't ok. */
+    mint(userId: string): Promise<string>;
+}
 /**
  * Authentication provider — identity verification only. Profile state lives
  * in `IUserProfileStore`, platform permissions in `IPlatformPermissionStore`,
@@ -258,6 +282,11 @@ export interface IAuthProvider {
      * the logout button — Selva has no session to destroy.
      */
     readonly proxyAuth?: IProxyAuth;
+    /**
+     * Present for providers whose data stores scope by a user session (row
+     * security). API token requests use it to act as the token's owner.
+     */
+    readonly delegatedSession?: IDelegatedSession;
     /** Verify a token (session cookie, JWT, ID token, etc.); null if invalid or expired. */
     verifyToken(token: string): Promise<AuthUser | null>;
     getUser(id: string): Promise<AuthUser | null>;

package/dist/auth/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/auth/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEnE;;;OAGG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3E,iFAAiF;IACjF,YAAY,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACzE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,UAAU;IAC1B;;;;;;OAMG;IACH,aAAa,IAAI,SAAS,MAAM,EAAE,CAAC;IAEnC;;;;;OAKG;IACH,wBAAwB,CACvB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,EAClD,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACxC,IAAI,EAAE,QAAQ,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;IAEV;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;CACV;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;IAEV;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC9B;;;;;;;;;OASG;IACH,aAAa,CACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GACjB,OAAO,CACT;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAC1F,CAAC;IAEF;;;;;;;;;OASG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QAChD,IAAI,EAAE,QAAQ,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,IAAI,CAAC,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,UAAU;IAC1B;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAEhD,+FAA+F;IAC/F,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEtC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;IAE1C;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IAEpC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAEhC,wFAAwF;IACxF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAErD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE9C,qEAAqE;IACrE,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEtD;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEvD;;;OAGG;IACH,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/auth/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC7B;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEnE;;;OAGG;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE3E,iFAAiF;IACjF,YAAY,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CACzE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,UAAU;IAC1B;;;;;;OAMG;IACH,aAAa,IAAI,SAAS,MAAM,EAAE,CAAC;IAEnC;;;;;OAKG;IACH,wBAAwB,CACvB,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,EAClD,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnB;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QACxC,IAAI,EAAE,QAAQ,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;IAEV;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;CACV;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI,CAAC,CAAC;IAEV;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC/C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC9B;;;;;;;;;OASG;IACH,aAAa,CACZ,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GACjB,OAAO,CACT;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,GAAG,eAAe,CAAA;KAAE,CAC1F,CAAC;IAEF;;;;;;;;;OASG;IACH,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC;QAChD,IAAI,EAAE,QAAQ,CAAC;QACf,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;KACtB,GAAG,IAAI,CAAC,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,UAAU;IAC1B;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAEhD,+FAA+F;IAC/F,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED,MAAM,MAAM,sBAAsB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;OAGG;IACH,MAAM,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE1C,iGAAiG;IACjG,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;IAEtC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAC;IAE1C;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC;IAEpC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;IAEhC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IAE9C,wFAAwF;IACxF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAErD,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE9C,qEAAqE;IACrE,SAAS,CAAC,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEtD;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEvD;;;OAGG;IACH,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C"}

package/dist/context.d.ts

@@ -1,5 +1,6 @@
 import type { PlatformPermission } from './permissions/types.js';
 import type { OrgPermission } from './organizations/schemas.js';
+import type { ApiScope } from './apiTokens/types.js';
 /**
  * Per-request identity + scope passed to every data provider call, built once
  * per HTTP request from the authenticated session.
@@ -29,6 +30,14 @@ export interface RequestContext {
      * guard refuses.
      */
     shareLinkId?: string;
+    /**
+     * Set when the request authenticated with an API token. `scopeAllows` reads
+     * it; a request without it is a browser or proxy session.
+     */
+    apiScope?: {
+        tokenId: string;
+        scopes: readonly ApiScope[];
+    };
     /** Opaque adapter payload — the Supabase adapter passes the user JWT through for RLS; local ignores it. */
     adapterContext?: unknown;
 }

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAIhE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC9B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,wCAAwC;IACxC,MAAM,CAAC,EAAE,IAAI,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,iGAAiG;AACjG,eAAO,MAAM,cAAc,EAAE,cAK5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAC5B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,kBAAkB,GAAG,aAAa,GAC5C,OAAO,CAOT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI7E;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAK5D"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC9B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,6CAA6C;IAC7C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,wCAAwC;IACxC,MAAM,CAAC,EAAE,IAAI,CAAC;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAA;KAAE,CAAC;IAC5D,2GAA2G;IAC3G,cAAc,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,iGAAiG;AACjG,eAAO,MAAM,cAAc,EAAE,cAK5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,CAC5B,GAAG,EAAE,cAAc,EACnB,UAAU,EAAE,kBAAkB,GAAG,aAAa,GAC5C,OAAO,CAOT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI7E;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAK5D"}

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAmC5C,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC7C,MAAM,EAAE,EAAE;IACV,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;IAClD,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;IACxC,MAAM,EAAE,IAAI;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC5B,GAAmB,EACnB,UAA8C;IAE9C,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAmB;IACjD,OAAO,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAmB,EAAE,IAAY;IACtE,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,kCAAkC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;AACF,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;AAE7E,SAAS,oBAAoB,CAAC,CAAS;IACtC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IACnD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACxB,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAyC5C,iGAAiG;AACjG,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC7C,MAAM,EAAE,EAAE;IACV,mBAAmB,EAAE,CAAC,GAAG,wBAAwB,CAAC;IAClD,cAAc,EAAE,CAAC,GAAG,mBAAmB,CAAC;IACxC,MAAM,EAAE,IAAI;CACZ,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC5B,GAAmB,EACnB,UAA8C;IAE9C,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAmB;IACjD,OAAO,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAmB,EAAE,IAAY;IACtE,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CAAC,kCAAkC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;AACF,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS,wBAAwB,CAAC,CAAC;AAE7E,SAAS,oBAAoB,CAAC,CAAS;IACtC,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IACnD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC,WAAW,CAAC;AACxB,CAAC"}

package/dist/data/interface.d.ts

@@ -16,6 +16,7 @@ import type { IComputeServerStore } from '../computeServer/interface.js';
 import type { IShareLinkStore } from '../shareLinks/interface.js';
 import type { IPlatformProjectGrantStore } from '../platformProjects/interface.js';
 import type { IInviteStore } from '../invites/interface.js';
+import type { IApiTokenStore } from '../apiTokens/interface.js';
 import type { IUserProfileStore } from '../userProfile/interface.js';
 import type { IPlatformPermissionStore } from '../permissions/interface.js';
 import type { IAuditQuery } from '../events/audit.js';
@@ -55,6 +56,12 @@ export interface IDataProvider {
     userProfile: IUserProfileStore;
     permissions: IPlatformPermissionStore;
     platformProjectGrants: IPlatformProjectGrantStore;
+    /**
+     * Optional: a provider without it has API tokens switched off, and token
+     * requests get 503 `API_TOKENS_UNAVAILABLE`. A provider whose stores scope
+     * by a user JWT must also implement `IAuthProvider.delegatedSession`.
+     */
+    apiTokens?: IApiTokenStore;
     /**
      * Read-side for the persisted event log. Optional — providers whose event
      * sink is a noop (local-provider) leave this undefined and the

package/dist/data/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/data/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IAClC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,YAAY,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,aAAa,EAAE,mBAAmB,CAAC;IACnC,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,eAAe,CAAC;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,WAAW,EAAE,wBAAwB,CAAC;IACtC,qBAAqB,EAAE,0BAA0B,CAAC;IAClD;;;;OAIG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IAEpB;;;;;;;OAOG;IACH,mBAAmB,CAAC,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAErD;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7F"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/data/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IAClC,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,YAAY,CAAC;AAEzC,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,aAAa,EAAE,mBAAmB,CAAC;IACnC,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,eAAe,CAAC;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,WAAW,EAAE,wBAAwB,CAAC;IACtC,qBAAqB,EAAE,0BAA0B,CAAC;IAClD;;;;OAIG;IACH,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC;IACzB;;;;OAIG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IAEpB;;;;;;;OAOG;IACH,mBAAmB,CAAC,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAErD;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7F"}

package/dist/data/interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/data/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAmCH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC"}
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/data/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoCH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC"}

package/dist/events/index.d.ts

@@ -1,4 +1,4 @@
 export type { DomainEvent, DomainEventType, IEventSink } from './interface.js';
-export { actorFrom, NoopEventSink, AUDIT_EVENT_VERSION } from './interface.js';
+export { actorFrom, actorOf, NoopEventSink, AUDIT_EVENT_VERSION } from './interface.js';
 export type { AuditEventRow, AuditCursor, AuditQueryFilters, AuditQueryResult, IAuditQuery } from './audit.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/events/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/events/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,YAAY,EACX,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/events/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EACX,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,MAAM,YAAY,CAAC"}

package/dist/events/index.js

@@ -1,2 +1,2 @@
-export { actorFrom, NoopEventSink, AUDIT_EVENT_VERSION } from './interface.js';
+export { actorFrom, actorOf, NoopEventSink, AUDIT_EVENT_VERSION } from './interface.js';
 //# sourceMappingURL=index.js.map

package/dist/events/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/events/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/events/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/events/interface.d.ts

@@ -1,4 +1,5 @@
-export type DomainEvent = {
+import type { ApiTokenRevokeReason } from '../apiTokens/types.js';
+type DomainEventBody = {
     type: 'org.created';
     orgId: string;
     actorId: string;
@@ -115,6 +116,18 @@ export type DomainEvent = {
     inviteId: string;
     orgId: string;
     actorId: string;
+} | {
+    type: 'api_token.created';
+    apiTokenId: string;
+    orgId: string;
+    userId: string;
+    actorId: string;
+} | {
+    type: 'api_token.revoked';
+    apiTokenId: string;
+    orgId: string;
+    reason: ApiTokenRevokeReason;
+    actorId: string;
 } | {
     type: 'user.created';
     userId: string;
@@ -157,6 +170,14 @@ export type DomainEvent = {
     detail?: string;
     actorId: string;
 };
+/**
+ * `tokenId` is set on any event written during an API-token request, so a
+ * key's actions can be told apart from the same person's browser actions.
+ * Spread {@link actorOf} rather than setting it by hand.
+ */
+export type DomainEvent = DomainEventBody & {
+    tokenId?: string;
+};
 export type DomainEventType = DomainEvent['type'];
 /**
  * A durable sink (e.g. Supabase `audit_events.event_version`) stamps every row
@@ -190,8 +211,20 @@ export declare function actorFrom(ctx: {
     userId: string;
     system?: boolean;
 }): string;
+/** `actorId` plus, for an API-token request, `tokenId`. Spread into an event. */
+export declare function actorOf(ctx: {
+    userId: string;
+    system?: boolean;
+    apiScope?: {
+        tokenId: string;
+    };
+}): {
+    actorId: string;
+    tokenId?: string;
+};
 /** Discards every event. Used when `SelvaConfig.events` is omitted. */
 export declare class NoopEventSink implements IEventSink {
     emit(_event: DomainEvent): Promise<void>;
 }
+export {};
 //# sourceMappingURL=interface.d.ts.map

package/dist/events/interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/events/interface.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GACpB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAI9E;IACA,IAAI,EAAE,uCAAuC,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,yBAAyB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,gCAAgC,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAKpF;IACA,IAAI,EAAE,mBAAmB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACvB,GACD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtF;IACA,IAAI,EAAE,6BAA6B,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxF;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1F;IACA,IAAI,EAAE,4BAA4B,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,4BAA4B,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IACA,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2GAA2G;IAC3G,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC7F;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAI5E;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1D;IACA,IAAI,EAAE,8BAA8B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACf,GAID;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzF;IACA,IAAI,EAAE,wBAAwB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,2BAA2B,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,sBAAsB,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,CAAC;AAEL,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,UAAU;IAC1B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAE3E;AAED,uEAAuE;AACvE,qBAAa,aAAc,YAAW,UAAU;IACzC,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAC9C"}
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/events/interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAElE,KAAK,eAAe,GACjB;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAI9E;IACA,IAAI,EAAE,uCAAuC,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,yBAAyB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,gCAAgC,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAKpF;IACA,IAAI,EAAE,mBAAmB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;CACvB,GACD;IAAE,IAAI,EAAE,wBAAwB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtF;IACA,IAAI,EAAE,6BAA6B,CAAC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACxF;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1F;IACA,IAAI,EAAE,4BAA4B,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,4BAA4B,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/D;IACA,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,2GAA2G;IAC3G,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC7F;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAE5E;IACA,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,oBAAoB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;CACf,GAID;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1D;IACA,IAAI,EAAE,8BAA8B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;CACf,GAID;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzF;IACA,IAAI,EAAE,wBAAwB,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,2BAA2B,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,GACD;IACA,IAAI,EAAE,sBAAsB,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACf,CAAC;AAEL;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,UAAU;IAC1B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAE3E;AAED,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/B,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAGxC;AAED,uEAAuE;AACvE,qBAAa,aAAc,YAAW,UAAU;IACzC,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAC9C"}

package/dist/events/interface.js

@@ -12,6 +12,11 @@ export const AUDIT_EVENT_VERSION = 1;
 export function actorFrom(ctx) {
     return ctx.userId || 'system';
 }
+/** `actorId` plus, for an API-token request, `tokenId`. Spread into an event. */
+export function actorOf(ctx) {
+    const actorId = actorFrom(ctx);
+    return ctx.apiScope ? { actorId, tokenId: ctx.apiScope.tokenId } : { actorId };
+}
 /** Discards every event. Used when `SelvaConfig.events` is omitted. */
 export class NoopEventSink {
     async emit(_event) { }

package/dist/events/interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/events/interface.ts"],"names":[],"mappings":"AAkHA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAoBrC;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAyC;IAClE,OAAO,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED,uEAAuE;AACvE,MAAM,OAAO,aAAa;IACzB,KAAK,CAAC,IAAI,CAAC,MAAmB,IAAkB,CAAC;CACjD"}
+{"version":3,"file":"interface.js","sourceRoot":"","sources":["../../src/events/interface.ts"],"names":[],"mappings":"AA0IA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAoBrC;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAyC;IAClE,OAAO,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,OAAO,CAAC,GAIvB;IACA,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AAChF,CAAC;AAED,uEAAuE;AACvE,MAAM,OAAO,aAAa;IACzB,KAAK,CAAC,IAAI,CAAC,MAAmB,IAAkB,CAAC;CACjD"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export type { AuthUser, UserManagementResult, LoginResult } from './auth/types.js';
-export type { IAuthProvider, IOAuthAuth, ISessionRefresh, IPasswordAuth, IEmailLinkAuth, IProxyAuth } from './auth/interface.js';
+export type { IAuthProvider, IOAuthAuth, ISessionRefresh, IPasswordAuth, IEmailLinkAuth, IProxyAuth, IDelegatedSession, DelegatedSessionStatus } from './auth/interface.js';
 export type { PlatformPermission } from './permissions/types.js';
-export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS } from './permissions/types.js';
+export { PlatformPermissionSchema, ALL_PLATFORM_PERMISSIONS, OPERATOR_PLATFORM_PERMISSIONS } from './permissions/types.js';
 export type { IPlatformPermissionStore } from './permissions/interface.js';
 export type { IUserProfileStore } from './userProfile/interface.js';
 export type { UserProfile, RecentRun } from './userProfile/types.js';
@@ -10,9 +10,11 @@ export type { Organization, OrgMember, OrgAssets } from './organizations/types.j
 export type { IOrgStore } from './organizations/interface.js';
 export { orgPaths } from './organizations/paths.js';
 export type { OrgRole, OrgPermission, OrgAssetKind, CreateOrgInput, UpdateOrgInput } from './organizations/schemas.js';
-export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, slugify, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './organizations/schemas.js';
+export { OrgRoleSchema, OrgPermissionSchema, OrgAssetKindSchema, ALL_ORG_ASSET_KINDS, SlugSchema, slugify, RESERVED_SLUGS, CreateOrgSchema, UpdateOrgSchema, ALL_ORG_PERMISSIONS, ORG_MANAGEMENT_PERMISSIONS, DEFAULT_ORG_PERMISSIONS, OWNER_ADMIN_ONLY_PERMISSIONS, MEMBER_ASSIGNABLE_PERMISSIONS } from './organizations/schemas.js';
 export type { Invite } from './invites/types.js';
 export type { IInviteStore } from './invites/interface.js';
+export type { ApiScope, ApiScopeAction, ApiScopeResource, ApiToken, ApiTokenSummary, ApiTokenRevokeReason, ApiTokenLifetimeDays, IApiTokenStore, ScopeTarget } from './apiTokens/index.js';
+export { ApiScopeActionSchema, ApiScopeStringSchema, ApiTokenRevokeReasonSchema, API_TOKEN_LIFETIME_DAYS, parseApiScope, formatApiScope, describeApiScope, scopeAllows, narrowApiTokenContext } from './apiTokens/index.js';
 export type { Project, ProjectMember } from './projects/types.js';
 export type { IProjectStore } from './projects/interface.js';
 export type { ProjectVisibility, ProjectRole } from './projects/schemas.js';
@@ -49,7 +51,7 @@ export { serversVisibleTo, defaultServerIdFor, resolveServerForOrg, findServerBy
 export type { ProjectAccessInput, DefinitionAccessInput, VisibilityChangeInput, ReclaimAccessInput, CreateProjectAccessInput, OrgOwnerAuthorityInput, OwnerRemovalInput, OwnerRemovalCheck } from './access/rules.js';
 export { canView, canSolve, canEdit, canManage, canEditProjectSettings, canChangeVisibilityToPublic, canEditDefinition, canReclaim, canCreateProject, canChangeOrgRole, checkOwnerRemoval, withAdminBypass } from './access/rules.js';
 export type { DomainEvent, DomainEventType, IEventSink } from './events/interface.js';
-export { actorFrom, NoopEventSink, AUDIT_EVENT_VERSION } from './events/interface.js';
+export { actorFrom, actorOf, NoopEventSink, AUDIT_EVENT_VERSION } from './events/interface.js';
 export type { AuditEventRow, AuditCursor, AuditQueryFilters, AuditQueryResult, IAuditQuery } from './events/audit.js';
 export type { ISolveMetricSink, SolveMetric, SolveFailureKind } from './metrics/interface.js';
 export { NoopSolveMetricSink } from './metrics/interface.js';