@selvajs/server 1.0.0-beta.9 → 1.0.1

package/dist/tokens/token-codec.js

@@ -3,34 +3,31 @@ import { randomBytes, createHmac, timingSafeEqual } from 'node:crypto';
  * HMAC token codec — the primitive behind capability-URL tokens (share links,
  * invites, and anything shaped like them).
  *
- * ## Two-part design
- *
- * Each minted token involves TWO secrets:
+ * ## Format
+ *   raw  = `<prefix><base64url(32 random bytes)>`
+ *   hash = base64url( HMAC-SHA256(secret, raw) )
  *
- *   1. **Per-token secret** — generated in `mintRawToken()` from 32 random
- *      bytes, returned to the caller exactly once at mint time. Different
- *      every token. This is what end-users carry in `?token=…`.
+ * ## Two secrets per token
  *
- *   2. **Instance-wide HMAC secret** (`config.secret`) — used to hash tokens
- *      for storage. The store sees only `HMAC-SHA256(secret, token)`. A
- *      DB-only leak therefore can't be replayed: the attacker would need the
- *      secret too, and it lives in env, not the database.
+ *   1. **Per-token entropy** — the 32 random bytes in `mintRawToken()`, handed
+ *      back exactly once at mint time and never stored. This is what end-users
+ *      carry in `?token=…`.
  *
- * ## Format
- *   raw    = `<prefix><base64url(32 random bytes)>`
- *   hash   = base64url( HMAC-SHA256(secret, raw) )
+ *   2. **Instance-wide HMAC secret** (`config.secret`) — hashes tokens for
+ *      storage, so the store holds only `HMAC-SHA256(secret, raw)`. A DB-only
+ *      leak can't be replayed: the attacker also needs the secret, and it lives
+ *      in env, not the database.
  *
- * The resolution path hashes the supplied token with the same secret and looks
- * up by exact match against the stored hash.
+ * Resolution hashes the supplied token with the same secret and looks up an
+ * exact match against the stored hash.
  *
- * Rotating the secret invalidates every token minted under it — give each
- * token family (each prefix) its own secret so they rotate independently.
+ * Rotating the secret invalidates every token minted under it — give each token
+ * family (each prefix) its own secret so they rotate independently.
  */
 /**
- * Minimum accepted secret length. Matches the "random ≥32-byte string"
- * guidance everywhere these secrets are documented; enforced here so a
- * short dev secret can't reach production silently (presence-only checks
- * let a 4-char secret through).
+ * Minimum accepted secret length, matching the "random ≥32-byte string"
+ * guidance these secrets are documented under. Enforced here because a
+ * presence-only check lets a 4-char dev secret reach production silently.
  */
 export const MIN_TOKEN_SECRET_LENGTH = 32;
 export function createTokenCodec(config) {

package/dist/tokens/token-codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-codec.js","sourceRoot":"","sources":["../../src/tokens/token-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAsB1C,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACd,eAAe,MAAM,6BAA6B,uBAAuB,cAAc;YACtF,QAAQ,MAAM,CAAC,MAAM,+CAA+C,CACrE,CAAC;IACH,CAAC;IAED,OAAO;QACN,MAAM;QACN,YAAY;YACX,OAAO,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC;QACD,SAAS,CAAC,GAAW;YACpB,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,CAAC;QACD,WAAW,CAAC,CAAS,EAAE,CAAS;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,cAAc,CAAC,KAAa;YAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"token-codec.js","sourceRoot":"","sources":["../../src/tokens/token-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAsB1C,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACd,eAAe,MAAM,6BAA6B,uBAAuB,cAAc;YACtF,QAAQ,MAAM,CAAC,MAAM,+CAA+C,CACrE,CAAC;IACH,CAAC;IAED,OAAO;QACN,MAAM;QACN,YAAY;YACX,OAAO,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC;QACD,SAAS,CAAC,GAAW;YACpB,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,CAAC;QACD,WAAW,CAAC,CAAS,EAAE,CAAS;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,cAAc,CAAC,KAAa;YAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;KACD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/server",
-  "version": "1.0.0-beta.9",
+  "version": "1.0.1",
   "description": "Transport-agnostic server building blocks for apps built on the Selva engine (limits, rate limiting, SSRF guard, remote-definition fetch, definition service + render loader); the solve core lives in @selvajs/solve/server",
   "license": "MIT",
   "author": "VektorNode",
@@ -79,9 +79,9 @@
     "!**/*.spec.*"
   ],
   "dependencies": {
-    "@selvajs/compute": "^4.0.0-beta.6",
-    "@selvajs/platform": "^0.17.0-beta.3",
-    "@selvajs/schemas": "^5.0.0-beta.3"
+    "@selvajs/compute": "^4.0.1",
+    "@selvajs/platform": "^0.17.0",
+    "@selvajs/schemas": "^5.0.0"
   },
   "peerDependencies": {
     "@sentry/node": ">=8",
@@ -99,7 +99,7 @@
     "@types/node": "^26.1.2",
     "typescript": "~6.0.3",
     "vitest": "^4.1.10",
-    "@selvajs/config": "0.0.3"
+    "@selvajs/config": "0.0.4"
   },
   "scripts": {
     "build": "tsc",