@selvajs/server 1.4.0 → 1.5.0-beta.0

package/dist/api/bodies.d.ts

@@ -25,8 +25,8 @@ export declare const CreateProjectBodySchema: z.ZodObject<{
     name: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
     visibility: z.ZodDefault<z.ZodEnum<{
-        public: "public";
         org: "org";
+        public: "public";
         private: "private";
         platform: "platform";
     }>>;
@@ -36,8 +36,8 @@ export declare const UpdateProjectBodySchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
     visibility: z.ZodOptional<z.ZodEnum<{
-        public: "public";
         org: "org";
+        public: "public";
         private: "private";
         platform: "platform";
     }>>;
@@ -70,11 +70,13 @@ export declare const CreateInviteBodySchema: z.ZodObject<{
         manage_compute: "manage_compute";
         manage_instance_users: "manage_instance_users";
         manage_updates: "manage_updates";
+        manage_api_tokens: "manage_api_tokens";
     }>, z.ZodEnum<{
         manage_org_members: "manage_org_members";
         manage_org_compute: "manage_org_compute";
         manage_definitions: "manage_definitions";
         manage_projects: "manage_projects";
+        read_all_org_projects: "read_all_org_projects";
     }>]>>>;
 }, z.core.$strip>;
 export declare const OrgComputePatchBodySchema: z.ZodObject<{
@@ -99,6 +101,12 @@ export declare const UpdateOrgMemberBodySchema: z.ZodObject<{
         manage_org_compute: "manage_org_compute";
         manage_definitions: "manage_definitions";
         manage_projects: "manage_projects";
+        read_all_org_projects: "read_all_org_projects";
     }>>>;
 }, z.core.$strip>;
+export declare const CreateApiTokenBodySchema: z.ZodObject<{
+    name: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    expiresInDays: z.ZodUnion<z.ZodLiteral<30 | 90 | 180>[]>;
+}, z.core.$strip>;
 //# sourceMappingURL=bodies.d.ts.map

package/dist/api/bodies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bodies.d.ts","sourceRoot":"","sources":["../../src/api/bodies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAexB,eAAO,MAAM,eAAe;;;;;;;;;iBAO1B,CAAC;AAMH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAKlC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAOzB,CAAC;AAEZ,eAAO,MAAM,0BAA0B;;;;;;;iBAGrC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;iBAAwC,CAAC;AASnF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;iBAIjC,CAAC;AAiBH,eAAO,MAAM,yBAAyB;;;;;;;;;;iBAIpC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;iBASnC,CAAC"}
+{"version":3,"file":"bodies.d.ts","sourceRoot":"","sources":["../../src/api/bodies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAiBxB,eAAO,MAAM,eAAe;;;;;;;;;iBAO1B,CAAC;AAMH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAKlC,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAOzB,CAAC;AAEZ,eAAO,MAAM,0BAA0B;;;;;;;iBAGrC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;iBAAwC,CAAC;AASnF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;iBAIjC,CAAC;AAiBH,eAAO,MAAM,yBAAyB;;;;;;;;;;iBAIpC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;iBASnC,CAAC;AAMJ,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC"}

package/dist/api/bodies.js

@@ -11,7 +11,7 @@
  * from, so their fields are described in the spec directly.
  */
 import { z } from 'zod';
-import { ProjectVisibilitySchema, ProjectRoleSchema, OrgRoleSchema, OrgPermissionSchema, PlatformPermissionSchema, ALL_ORG_PERMISSIONS } from '@selvajs/platform';
+import { ProjectVisibilitySchema, ProjectRoleSchema, OrgRoleSchema, OrgPermissionSchema, PlatformPermissionSchema, ALL_ORG_PERMISSIONS, ApiScopeStringSchema, API_TOKEN_LIFETIME_DAYS } from '@selvajs/platform';
 // ============================================================================
 // Definitions
 // ============================================================================
@@ -84,4 +84,12 @@ export const UpdateOrgMemberBodySchema = z
     .refine((b) => b.role !== undefined || b.permissions !== undefined, {
     message: 'Provide at least one of role, permissions'
 });
+// ============================================================================
+// API tokens
+// ============================================================================
+export const CreateApiTokenBodySchema = z.object({
+    name: z.string().trim().min(1, 'Name is required').max(100),
+    scopes: z.array(ApiScopeStringSchema).min(1, 'Pick at least one scope').max(20),
+    expiresInDays: z.union(API_TOKEN_LIFETIME_DAYS.map((d) => z.literal(d)))
+});
 //# sourceMappingURL=bodies.js.map

package/dist/api/bodies.js.map

@@ -1 +1 @@
-{"version":3,"file":"bodies.js","sourceRoot":"","sources":["../../src/api/bodies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EAEnB,MAAM,mBAAmB,CAAC;AAE3B,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,4FAA4F;IAC5F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,WAAW;AACX,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;IACtD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACtC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,uBAAuB;IACnC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC7B,CAAC;KACD,OAAO,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC;IAC/C,IAAI,EAAE,iBAAiB;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAEnF,+EAA+E;AAC/E,OAAO;AACP,+EAA+E;AAE/E,wFAAwF;AACxF,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEtF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAClF,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACtD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;IAC7C,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACxC,MAAM,CAAC;IACP,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmE,CAAC,CAAC;SAClF,QAAQ,EAAE;CACZ,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE;IACnE,OAAO,EAAE,2CAA2C;CACpD,CAAC,CAAC"}
+{"version":3,"file":"bodies.js","sourceRoot":"","sources":["../../src/api/bodies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACN,uBAAuB,EACvB,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EAEvB,MAAM,mBAAmB,CAAC;AAE3B,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,4FAA4F;IAC5F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,WAAW;AACX,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;IACnE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC;IACtD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACtC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,uBAAuB;IACnC,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC7B,CAAC;KACD,OAAO,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC;IAC/C,IAAI,EAAE,iBAAiB;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAEnF,+EAA+E;AAC/E,OAAO;AACP,+EAA+E;AAE/E,wFAAwF;AACxF,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEtF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAClF,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACtD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;IAC7C,uGAAuG;IACvG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACxC,MAAM,CAAC;IACP,IAAI,EAAE,aAAa,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmE,CAAC,CAAC;SAClF,QAAQ,EAAE;CACZ,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE;IACnE,OAAO,EAAE,2CAA2C;CACpD,CAAC,CAAC;AAEJ,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3D,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;CACxE,CAAC,CAAC"}

package/dist/api/deps.d.ts

@@ -14,6 +14,7 @@
 import type { DefinitionService } from '../definitions/definition-service.js';
 import type { OrgAssetService } from '../organizations/org-asset-service.js';
 import type { TokenCodec } from '../tokens/token-codec.js';
+import type { ApiTokenCodec } from '../tokens/api-token-codec.js';
 import type { IAuthProvider, IDataProvider, IEventSink, INotificationProvider, IStorageProvider, SelvaConfig, SelvaFlags } from '@selvajs/platform';
 export interface SelvaDeps {
     auth: IAuthProvider;
@@ -63,6 +64,8 @@ export interface SelvaDeps {
     tokens: {
         shareLinks?: TokenCodec;
         invites?: TokenCodec;
+        /** Without it, minting answers 503 `API_TOKENS_UNAVAILABLE`. */
+        apiTokens?: ApiTokenCodec;
     };
     /**
      * Upload caps, in bytes.

package/dist/api/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../src/api/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EACX,aAAa,EACb,aAAa,EACb,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,aAAa,CAAC;IACpB,uEAAuE;IACvE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACpC,0DAA0D;IAC1D,cAAc,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC9C,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,qBAAqB,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IAC9D;;;;;;;OAOG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB;;;;OAIG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,UAAU,KAAK,OAAO,CAAC;IAC1C;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE;QACP,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,OAAO,CAAC,EAAE,UAAU,CAAC;KACrB,CAAC;IACF;;;;;;;;OAQG;IACH,YAAY,EAAE;QACb,qBAAqB,EAAE,MAAM,CAAC;QAC9B,gBAAgB,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,EAAE;QACT,WAAW,CAAC,EAAE,iBAAiB,CAAC;QAChC,SAAS,CAAC,EAAE,eAAe,CAAC;KAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,WAAW,EACnB,QAAQ,GAAE,SAAS,CAAC,UAAU,CAAM,EACpC,EACC,MAAW,EACX,YAAY,EACZ,kBAA6B,EAC7B,aAAa,EACb,YAAsB,EACtB,GAAE;IACF,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IAClD,kBAAkB,CAAC,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;CACjB,GACJ,SAAS,CA8BX"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../src/api/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EACX,aAAa,EACb,aAAa,EACb,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,aAAa,CAAC;IACpB,uEAAuE;IACvE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACpC,0DAA0D;IAC1D,cAAc,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC9C,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,qBAAqB,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IAC9D;;;;;;;OAOG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB;;;;OAIG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,UAAU,KAAK,OAAO,CAAC;IAC1C;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE;QACP,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,OAAO,CAAC,EAAE,UAAU,CAAC;QACrB,gEAAgE;QAChE,SAAS,CAAC,EAAE,aAAa,CAAC;KAC1B,CAAC;IACF;;;;;;;;OAQG;IACH,YAAY,EAAE;QACb,qBAAqB,EAAE,MAAM,CAAC;QAC9B,gBAAgB,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,EAAE;QACT,WAAW,CAAC,EAAE,iBAAiB,CAAC;QAChC,SAAS,CAAC,EAAE,eAAe,CAAC;KAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,WAAW,EACnB,QAAQ,GAAE,SAAS,CAAC,UAAU,CAAM,EACpC,EACC,MAAW,EACX,YAAY,EACZ,kBAA6B,EAC7B,aAAa,EACb,YAAsB,EACtB,GAAE;IACF,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IAClD,kBAAkB,CAAC,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;CACjB,GACJ,SAAS,CA8BX"}

package/dist/api/deps.js.map

@@ -1 +1 @@
-{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../src/api/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAoHjE;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC7B,MAAmB,EACnB,WAAkC,EAAE,EACpC,EACC,MAAM,GAAG,EAAE,EACX,YAAY,EACZ,kBAAkB,GAAG,GAAG,EAAE,GAAE,CAAC,EAC7B,aAAa,EACb,YAAY,GAAG,OAAO,KAOnB,EAAE;IAEN,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,WAAW;QAChC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,aAAa,EAAE;QAC5C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QAC3C,MAAM;QACN,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,YAAY,EAAE;YACb,qBAAqB,EAAE,YAAY,EAAE,qBAAqB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;YAC9E,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;SACpE;QACD,kBAAkB;QAClB,aAAa;QACb,YAAY;QACZ,QAAQ;KACR,CAAC;AACH,CAAC"}
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../src/api/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAuHjE;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC7B,MAAmB,EACnB,WAAkC,EAAE,EACpC,EACC,MAAM,GAAG,EAAE,EACX,YAAY,EACZ,kBAAkB,GAAG,GAAG,EAAE,GAAE,CAAC,EAC7B,aAAa,EACb,YAAY,GAAG,OAAO,KAOnB,EAAE;IAEN,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,WAAW;QAChC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,aAAa,EAAE;QAC5C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QAC3C,MAAM;QACN,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,YAAY,EAAE;YACb,qBAAqB,EAAE,YAAY,EAAE,qBAAqB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;YAC9E,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;SACpE;QACD,kBAAkB;QAClB,aAAa;QACb,YAAY;QACZ,QAAQ;KACR,CAAC;AACH,CAAC"}

package/dist/api/errors.d.ts

@@ -18,6 +18,8 @@ export declare const ApiErrorCode: {
     readonly COMPUTE_UNAVAILABLE: "COMPUTE_UNAVAILABLE";
     readonly SETUP_REQUIRED: "SETUP_REQUIRED";
     readonly INTERNAL: "INTERNAL";
+    /** API tokens are switched off or misconfigured here; browser sessions still work. */
+    readonly API_TOKENS_UNAVAILABLE: "API_TOKENS_UNAVAILABLE";
 };
 export type ApiErrorCode = (typeof ApiErrorCode)[keyof typeof ApiErrorCode];
 export declare class ApiError extends Error {
@@ -25,11 +27,13 @@ export declare class ApiError extends Error {
     readonly code: ApiErrorCode;
     /** Per-field validation messages, keyed by dotted path. Only on VALIDATION_FAILED. */
     readonly fields?: Record<string, string>;
-    constructor(status: number, code: ApiErrorCode, message: string, fields?: Record<string, string>);
+    /** Machine-readable context, e.g. `requiredScope` on a scope refusal. */
+    readonly details?: Record<string, string>;
+    constructor(status: number, code: ApiErrorCode, message: string, fields?: Record<string, string>, details?: Record<string, string>);
 }
 export declare function isApiError(err: unknown): err is ApiError;
 /** Raise a structured API error. The only way handlers should fail. */
-export declare function apiError(status: number, code: ApiErrorCode, message: string, fields?: Record<string, string>): never;
+export declare function apiError(status: number, code: ApiErrorCode, message: string, fields?: Record<string, string>, details?: Record<string, string>): never;
 /** Default code for a status, for mapping errors that carry no code of their own. */
 export declare function codeForStatus(status: number): ApiErrorCode;
 //# sourceMappingURL=errors.d.ts.map

package/dist/api/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,eAAO,MAAM,YAAY;;;;;;;;;;CAUf,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE5E,qBAAa,QAAS,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAGxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAQhC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,QAAQ,CAExD;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,KAAK,CAEP;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAmB1D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,eAAO,MAAM,YAAY;;;;;;;;;;IAUxB,sFAAsF;;CAE7E,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE5E,qBAAa,QAAS,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAGzC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CASjC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,QAAQ,CAExD;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,KAAK,CAEP;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAmB1D"}

package/dist/api/errors.js

@@ -17,27 +17,32 @@ export const ApiErrorCode = {
     UNPROCESSABLE: 'UNPROCESSABLE',
     COMPUTE_UNAVAILABLE: 'COMPUTE_UNAVAILABLE',
     SETUP_REQUIRED: 'SETUP_REQUIRED',
-    INTERNAL: 'INTERNAL'
+    INTERNAL: 'INTERNAL',
+    /** API tokens are switched off or misconfigured here; browser sessions still work. */
+    API_TOKENS_UNAVAILABLE: 'API_TOKENS_UNAVAILABLE'
 };
 export class ApiError extends Error {
     status;
     code;
     /** Per-field validation messages, keyed by dotted path. Only on VALIDATION_FAILED. */
     fields;
-    constructor(status, code, message, fields) {
+    /** Machine-readable context, e.g. `requiredScope` on a scope refusal. */
+    details;
+    constructor(status, code, message, fields, details) {
         super(message);
         this.name = 'ApiError';
         this.status = status;
         this.code = code;
         this.fields = fields;
+        this.details = details;
     }
 }
 export function isApiError(err) {
     return err instanceof ApiError;
 }
 /** Raise a structured API error. The only way handlers should fail. */
-export function apiError(status, code, message, fields) {
-    throw new ApiError(status, code, message, fields);
+export function apiError(status, code, message, fields, details) {
+    throw new ApiError(status, code, message, fields, details);
 }
 /** Default code for a status, for mapping errors that carry no code of their own. */
 export function codeForStatus(status) {

package/dist/api/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,eAAe;IAC9B,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,gBAAgB;IAChC,QAAQ,EAAE,UAAU;CACX,CAAC;AAIX,MAAM,OAAO,QAAS,SAAQ,KAAK;IACzB,MAAM,CAAS;IACf,IAAI,CAAe;IAC5B,sFAAsF;IAC7E,MAAM,CAA0B;IAEzC,YACC,MAAc,EACd,IAAkB,EAClB,OAAe,EACf,MAA+B;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;CACD;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACtC,OAAO,GAAG,YAAY,QAAQ,CAAC;AAChC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CACvB,MAAc,EACd,IAAkB,EAClB,OAAe,EACf,MAA+B;IAE/B,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,iBAAiB,CAAC;QACvC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,YAAY,CAAC;QAClC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,SAAS,CAAC;QAC/B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,SAAS,CAAC;QAC/B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,QAAQ,CAAC;QAC9B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,aAAa,CAAC;QACnC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,mBAAmB,CAAC;QACzC;YACC,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;AACF,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,eAAe;IAC9B,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,gBAAgB;IAChC,QAAQ,EAAE,UAAU;IACpB,sFAAsF;IACtF,sBAAsB,EAAE,wBAAwB;CACvC,CAAC;AAIX,MAAM,OAAO,QAAS,SAAQ,KAAK;IACzB,MAAM,CAAS;IACf,IAAI,CAAe;IAC5B,sFAAsF;IAC7E,MAAM,CAA0B;IACzC,yEAAyE;IAChE,OAAO,CAA0B;IAE1C,YACC,MAAc,EACd,IAAkB,EAClB,OAAe,EACf,MAA+B,EAC/B,OAAgC;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACtC,OAAO,GAAG,YAAY,QAAQ,CAAC;AAChC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CACvB,MAAc,EACd,IAAkB,EAClB,OAAe,EACf,MAA+B,EAC/B,OAAgC;IAEhC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,iBAAiB,CAAC;QACvC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,YAAY,CAAC;QAClC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,SAAS,CAAC;QAC/B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,SAAS,CAAC;QAC/B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,QAAQ,CAAC;QAC9B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,aAAa,CAAC;QACnC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,mBAAmB,CAAC;QACzC;YACC,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;AACF,CAAC"}

package/dist/api/index.d.ts

@@ -4,9 +4,10 @@ export { depsFromConfig, type SelvaDeps } from './deps.js';
 export { collection, created, noContent } from './responses.js';
 export { shaped, shapedCollection } from './shaped.js';
 export { formText, parseBody, parseParam, requireCaller, requireParams, requireUpload, throwZodError } from './request.js';
-export { runHandler, toErrorBody, type ApiErrorBody } from './respond.js';
+export { runHandler, toErrorBody, type ApiErrorBody, type RunHandlerOptions } from './respond.js';
+export { assertScope, actionForMethod, scopeRefusalsToday, projectScopeTarget, definitionScopeTarget } from './scope.js';
 export { mapCoreError } from './map-core-error.js';
 export { parseListOptions, parseDefinitionListOptions } from './pagination.js';
-export { SolveBodySchema, CreateProjectBodySchema, UpdateProjectBodySchema, AddProjectMemberBodySchema, UpdateProjectMemberBodySchema, CreateInviteBodySchema, OrgComputePatchBodySchema, UpdateOrgMemberBodySchema } from './bodies.js';
-export { ShareLinkResponseSchema, CreatedShareLinkResponseSchema, InviteResponseSchema, CreatedInviteResponseSchema, OrgComputeServerResponseSchema, ComputeCatalogEntrySchema, OrgComputeResponseSchema, type ShareLinkResponse } from './responses-schema.js';
+export { SolveBodySchema, CreateProjectBodySchema, UpdateProjectBodySchema, AddProjectMemberBodySchema, UpdateProjectMemberBodySchema, CreateInviteBodySchema, OrgComputePatchBodySchema, UpdateOrgMemberBodySchema, CreateApiTokenBodySchema } from './bodies.js';
+export { ShareLinkResponseSchema, CreatedShareLinkResponseSchema, InviteResponseSchema, CreatedInviteResponseSchema, OrgComputeServerResponseSchema, ComputeCatalogEntrySchema, OrgComputeResponseSchema, ApiTokenResponseSchema, CreatedApiTokenResponseSchema, type ShareLinkResponse } from './responses-schema.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1F,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACN,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1F,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACN,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EACN,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,MAAM,uBAAuB,CAAC"}

package/dist/api/index.js

@@ -8,8 +8,9 @@ export { collection, created, noContent } from './responses.js';
 export { shaped, shapedCollection } from './shaped.js';
 export { formText, parseBody, parseParam, requireCaller, requireParams, requireUpload, throwZodError } from './request.js';
 export { runHandler, toErrorBody } from './respond.js';
+export { assertScope, actionForMethod, scopeRefusalsToday, projectScopeTarget, definitionScopeTarget } from './scope.js';
 export { mapCoreError } from './map-core-error.js';
 export { parseListOptions, parseDefinitionListOptions } from './pagination.js';
-export { SolveBodySchema, CreateProjectBodySchema, UpdateProjectBodySchema, AddProjectMemberBodySchema, UpdateProjectMemberBodySchema, CreateInviteBodySchema, OrgComputePatchBodySchema, UpdateOrgMemberBodySchema } from './bodies.js';
-export { ShareLinkResponseSchema, CreatedShareLinkResponseSchema, InviteResponseSchema, CreatedInviteResponseSchema, OrgComputeServerResponseSchema, ComputeCatalogEntrySchema, OrgComputeResponseSchema } from './responses-schema.js';
+export { SolveBodySchema, CreateProjectBodySchema, UpdateProjectBodySchema, AddProjectMemberBodySchema, UpdateProjectMemberBodySchema, CreateInviteBodySchema, OrgComputePatchBodySchema, UpdateOrgMemberBodySchema, CreateApiTokenBodySchema } from './bodies.js';
+export { ShareLinkResponseSchema, CreatedShareLinkResponseSchema, InviteResponseSchema, CreatedInviteResponseSchema, OrgComputeServerResponseSchema, ComputeCatalogEntrySchema, OrgComputeResponseSchema, ApiTokenResponseSchema, CreatedApiTokenResponseSchema } from './responses-schema.js';
 //# sourceMappingURL=index.js.map

package/dist/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,kEAAkE;AAElE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1F,OAAO,EAAE,cAAc,EAAkB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACN,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,EAExB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,kEAAkE;AAElE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1F,OAAO,EAAE,cAAc,EAAkB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACN,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAA6C,MAAM,cAAc,CAAC;AAClG,OAAO,EACN,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,6BAA6B,EAE7B,MAAM,uBAAuB,CAAC"}

package/dist/api/respond.d.ts

@@ -8,22 +8,35 @@
  * `toErrorBody` and serialize itself.
  */
 import { ApiError, ApiErrorCode } from './errors.js';
+import type { ApiScopeAction, ScopeTarget } from '@selvajs/platform';
 import type { ApiHandler, ApiRequest } from './types.js';
 export interface ApiErrorBody {
     message: string;
     code: ApiErrorCode;
     fields?: Record<string, string>;
+    details?: Record<string, string>;
 }
 export declare function toErrorBody(err: ApiError): ApiErrorBody;
-/**
- * Run a handler and serialize whatever comes out, including failures.
- *
- * `mapError` lets a host fold its own domain errors into the envelope before
- * the 500 fallback — the Selva app maps `ProviderError`, `SchemaExtractionError`
- * and `ComputeServerUnconfiguredError` this way, none of which belong here.
- */
-export declare function runHandler(handler: ApiHandler, req: ApiRequest, { fallback, mapError }: {
+export interface RunHandlerOptions {
+    /** The 500 message when the handler throws something unmapped. */
     fallback: string;
+    /**
+     * Folds a host's own domain errors into the envelope before the 500 fallback.
+     * The Selva app maps `ProviderError`, `SchemaExtractionError` and
+     * `ComputeServerUnconfiguredError` this way, none of which belong here.
+     */
     mapError?: (err: unknown) => ApiError | undefined;
-}): Promise<Response>;
+    /**
+     * What the route does, for API-token scope checks. Defaults from the method:
+     * `GET`/`HEAD` are `read`, everything else `write`. Solve routes say `solve`.
+     */
+    action?: ApiScopeAction;
+    /**
+     * The project or definition the route touches. Without it the scope check is
+     * org-level, which project- and definition-scoped keys never pass.
+     */
+    scopeTarget?: (req: ApiRequest) => ScopeTarget | Promise<ScopeTarget>;
+}
+/** Run a handler and serialize whatever comes out, including failures. */
+export declare function runHandler(handler: ApiHandler, req: ApiRequest, { fallback, mapError, action, scopeTarget }: RunHandlerOptions): Promise<Response>;
 //# sourceMappingURL=respond.d.ts.map

package/dist/api/respond.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../src/api/respond.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAEtE,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,YAAY,CAIvD;AAcD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC/B,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,UAAU,EACf,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC7F,OAAO,CAAC,QAAQ,CAAC,CA0BnB"}
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../src/api/respond.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAGtE,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,YAAY,CAKvD;AAcD,MAAM,WAAW,iBAAiB;IACjC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACtE;AAED,0EAA0E;AAC1E,wBAAsB,UAAU,CAC/B,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,UAAU,EACf,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,iBAAiB,GAC5D,OAAO,CAAC,QAAQ,CAAC,CAiCnB"}

package/dist/api/respond.js

@@ -8,10 +8,14 @@
  * `toErrorBody` and serialize itself.
  */
 import { ApiErrorCode, isApiError } from './errors.js';
+import { actionForMethod, assertScope } from './scope.js';
 export function toErrorBody(err) {
-    return err.fields
-        ? { message: err.message, code: err.code, fields: err.fields }
-        : { message: err.message, code: err.code };
+    const body = { message: err.message, code: err.code };
+    if (err.fields)
+        body.fields = err.fields;
+    if (err.details)
+        body.details = err.details;
+    return body;
 }
 function toResponse(result) {
     if (result instanceof Response)
@@ -24,15 +28,12 @@ function toResponse(result) {
         headers: { 'content-type': 'application/json', ...headers }
     });
 }
-/**
- * Run a handler and serialize whatever comes out, including failures.
- *
- * `mapError` lets a host fold its own domain errors into the envelope before
- * the 500 fallback — the Selva app maps `ProviderError`, `SchemaExtractionError`
- * and `ComputeServerUnconfiguredError` this way, none of which belong here.
- */
-export async function runHandler(handler, req, { fallback, mapError }) {
+/** Run a handler and serialize whatever comes out, including failures. */
+export async function runHandler(handler, req, { fallback, mapError, action, scopeTarget }) {
     try {
+        if (req.ctx?.apiScope) {
+            assertScope(req.ctx, action ?? actionForMethod(req.request.method), scopeTarget ? await scopeTarget(req) : undefined);
+        }
         return toResponse(await handler(req));
     }
     catch (err) {

package/dist/api/respond.js.map

@@ -1 +1 @@
-{"version":3,"file":"respond.js","sourceRoot":"","sources":["../../src/api/respond.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAY,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASjE,MAAM,UAAU,WAAW,CAAC,GAAa;IACxC,OAAO,GAAG,CAAC,MAAM;QAChB,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;QAC9D,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,MAA8B;IACjD,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,EAAE,MAAM,IAAI,GAAG;QACrB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;KAC3D,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,OAAmB,EACnB,GAAe,EACf,EAAE,QAAQ,EAAE,QAAQ,EAA2E;IAE/F,IAAI,CAAC;QACJ,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,oEAAoE;QACpE,uEAAuE;QACvE,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,QAAQ,EAAE,EAAE;YAClC,SAAS,EAAE,KAAK;YAChB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACpE,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;YACjB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE;SACxD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}
+{"version":3,"file":"respond.js","sourceRoot":"","sources":["../../src/api/respond.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAY,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAS1D,MAAM,UAAU,WAAW,CAAC,GAAa;IACxC,MAAM,IAAI,GAAiB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,GAAG,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,MAA8B;IACjD,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,EAAE,MAAM,IAAI,GAAG;QACrB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;KAC3D,CAAC,CAAC;AACJ,CAAC;AAuBD,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,OAAmB,EACnB,GAAe,EACf,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAqB;IAE9D,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YACvB,WAAW,CACV,GAAG,CAAC,GAAG,EACP,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAC7C,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,oEAAoE;QACpE,uEAAuE;QACvE,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,QAAQ,EAAE,EAAE;YAClC,SAAS,EAAE,KAAK;YAChB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACpE,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;YACjB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE;SACxD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}

package/dist/api/responses-schema.d.ts

@@ -1,8 +1,8 @@
 /**
  * Response schemas for the v1 payloads that must not carry a stored secret.
  *
- * Three store types hold a credential next to fields a client legitimately
- * reads: `ShareLink.tokenHash` and `Invite.tokenHash` are HMACs of a token,
+ * Four store types hold a credential next to fields a client legitimately
+ * reads: `ShareLink.tokenHash`, `Invite.tokenHash` and `ApiToken.tokenHash` are HMACs of a token,
  * `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to
  * strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`
  * — which works until someone adds a field to the stored type or edits the line
@@ -155,4 +155,34 @@ export declare const OrgComputeResponseSchema: z.ZodObject<{
         retryCount: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+export declare const ApiTokenResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodString;
+    createdBy: z.ZodNullable<z.ZodString>;
+    orgId: z.ZodString;
+    name: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    createdAt: z.ZodString;
+    expiresAt: z.ZodString;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    refusedToday: z.ZodNumber;
+}, z.core.$strip>;
+/** The mint response. `secret` is the raw key, returned exactly once. */
+export declare const CreatedApiTokenResponseSchema: z.ZodObject<{
+    token: z.ZodObject<{
+        id: z.ZodString;
+        userId: z.ZodString;
+        createdBy: z.ZodNullable<z.ZodString>;
+        orgId: z.ZodString;
+        name: z.ZodString;
+        scopes: z.ZodArray<z.ZodString>;
+        createdAt: z.ZodString;
+        expiresAt: z.ZodString;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodString>;
+        refusedToday: z.ZodNumber;
+    }, z.core.$strip>;
+    secret: z.ZodString;
+}, z.core.$strip>;
 //# sourceMappingURL=responses-schema.d.ts.map

package/dist/api/responses-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"responses-schema.d.ts","sourceRoot":"","sources":["../../src/api/responses-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;iBAclC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0EAA0E;AAC1E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;iBAGzC,CAAC;AAMH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;iBAY/B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;iBAGtC,CAAC;AAMH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;iBASzC,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;iBAQpC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKnC,CAAC"}
+{"version":3,"file":"responses-schema.d.ts","sourceRoot":"","sources":["../../src/api/responses-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;iBAclC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0EAA0E;AAC1E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;iBAGzC,CAAC;AAMH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;iBAY/B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;iBAGtC,CAAC;AAMH;;;GAGG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;iBASzC,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;iBAQpC,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKnC,CAAC;AAMH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAajC,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;iBAGxC,CAAC"}

package/dist/api/responses-schema.js

@@ -1,8 +1,8 @@
 /**
  * Response schemas for the v1 payloads that must not carry a stored secret.
  *
- * Three store types hold a credential next to fields a client legitimately
- * reads: `ShareLink.tokenHash` and `Invite.tokenHash` are HMACs of a token,
+ * Four store types hold a credential next to fields a client legitimately
+ * reads: `ShareLink.tokenHash`, `Invite.tokenHash` and `ApiToken.tokenHash` are HMACs of a token,
  * `ComputeServerCommon.apiKey` is a live Rhino.Compute key. Handlers used to
  * strip them by destructuring — `const { tokenHash: _omit, ...rest } = invite`
  * — which works until someone adds a field to the stored type or edits the line
@@ -101,4 +101,26 @@ export const OrgComputeResponseSchema = z.object({
     globalDefaultServerId: z.string().nullish(),
     catalog: z.array(ComputeCatalogEntrySchema)
 });
+// ============================================================================
+// API tokens
+// ============================================================================
+export const ApiTokenResponseSchema = z.object({
+    id: z.string(),
+    userId: z.string(),
+    createdBy: z.string().nullable(),
+    orgId: z.string(),
+    name: z.string(),
+    scopes: z.array(z.string()),
+    createdAt: z.string(),
+    expiresAt: z.string(),
+    lastUsedAt: z.string().nullable(),
+    revokedAt: z.string().nullable(),
+    /** Scope refusals since midnight UTC, counted in this process only. */
+    refusedToday: z.number()
+});
+/** The mint response. `secret` is the raw key, returned exactly once. */
+export const CreatedApiTokenResponseSchema = z.object({
+    token: ApiTokenResponseSchema,
+    secret: z.string()
+});
 //# sourceMappingURL=responses-schema.js.map

package/dist/api/responses-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"responses-schema.js","sourceRoot":"","sources":["../../src/api/responses-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CACzB,CAAC,CAAC;AAIH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;CACtD,CAAC,CAAC;AAEH,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;IAChD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACrC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC3C,CAAC,CAAC"}
+{"version":3,"file":"responses-schema.js","sourceRoot":"","sources":["../../src/api/responses-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,6EAA6E;IAC7E,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CACzB,CAAC,CAAC;AAIH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC,MAAM,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;CACtD,CAAC,CAAC;AAEH,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC;IAChD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACrC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CAC3C,CAAC,CAAC;AAEH,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,uEAAuE;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,sBAAsB;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC"}

package/dist/api/scope.d.ts

@@ -0,0 +1,22 @@
+import type { ApiScopeAction, RequestContext, ScopeTarget } from '@selvajs/platform';
+import type { ApiRequest } from './types.js';
+/** The default action for a method: reads are `read`, everything else `write`. */
+export declare function actionForMethod(method: string): ApiScopeAction;
+/**
+ * Refuse an API-token request its scopes don't cover, with 403 naming the
+ * scope that would have passed. Browser sessions always pass.
+ *
+ * `runHandler` calls this for every mounted route. A route that builds its own
+ * `Response` must call it itself.
+ */
+export declare function assertScope(ctx: RequestContext | undefined, action: ApiScopeAction, target?: ScopeTarget): void;
+/** Scope refusals for `tokenId` since midnight UTC, in this process. */
+export declare function scopeRefusalsToday(tokenId: string): number;
+/** Scope target for routes addressed by a project id param. */
+export declare function projectScopeTarget(param?: string): (req: ApiRequest) => ScopeTarget;
+/**
+ * Scope target for routes addressed by a definition guid param. Loads the
+ * record so a project-scoped key reaches the definitions inside its project.
+ */
+export declare function definitionScopeTarget(param?: string): (req: ApiRequest) => Promise<ScopeTarget>;
+//# sourceMappingURL=scope.d.ts.map

package/dist/api/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/api/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAE9D;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAC1B,GAAG,EAAE,cAAc,GAAG,SAAS,EAC/B,MAAM,EAAE,cAAc,EACtB,MAAM,CAAC,EAAE,WAAW,GAClB,IAAI,CAMN;AAeD,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAQD,+DAA+D;AAC/D,wBAAgB,kBAAkB,CAAC,KAAK,SAAO,IACtC,KAAK,UAAU,KAAG,WAAW,CACrC;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,SAAS,IACrC,KAAK,UAAU,KAAG,OAAO,CAAC,WAAW,CAAC,CAMpD"}

package/dist/api/scope.js

@@ -0,0 +1,63 @@
+import { scopeAllows } from '@selvajs/platform';
+import { apiError, ApiErrorCode } from './errors.js';
+/** The default action for a method: reads are `read`, everything else `write`. */
+export function actionForMethod(method) {
+    return method === 'GET' || method === 'HEAD' ? 'read' : 'write';
+}
+/**
+ * Refuse an API-token request its scopes don't cover, with 403 naming the
+ * scope that would have passed. Browser sessions always pass.
+ *
+ * `runHandler` calls this for every mounted route. A route that builds its own
+ * `Response` must call it itself.
+ */
+export function assertScope(ctx, action, target) {
+    if (!ctx?.apiScope || scopeAllows(ctx, action, target))
+        return;
+    recordRefusal(ctx.apiScope.tokenId);
+    apiError(403, ApiErrorCode.FORBIDDEN, `This API token doesn't allow ${action} here.`, undefined, {
+        requiredScope: requiredScope(ctx, action, target)
+    });
+}
+// Per process and per UTC day, so the token page can flag a misconfigured
+// integration. Kept in memory on purpose: refusals are not audited.
+const refusals = new Map();
+const utcDay = () => new Date().toISOString().slice(0, 10);
+function recordRefusal(tokenId) {
+    const day = utcDay();
+    const entry = refusals.get(tokenId);
+    if (entry?.day === day)
+        entry.count++;
+    else
+        refusals.set(tokenId, { day, count: 1 });
+}
+/** Scope refusals for `tokenId` since midnight UTC, in this process. */
+export function scopeRefusalsToday(tokenId) {
+    const entry = refusals.get(tokenId);
+    return entry?.day === utcDay() ? entry.count : 0;
+}
+function requiredScope(ctx, action, target) {
+    if (target?.projectId)
+        return `${action}:project:${target.projectId}`;
+    if (target?.definitionId)
+        return `${action}:definition:${target.definitionId}`;
+    return `${action}:org:${ctx.actingOrgId}`;
+}
+/** Scope target for routes addressed by a project id param. */
+export function projectScopeTarget(param = 'id') {
+    return (req) => ({ projectId: req.params[param] });
+}
+/**
+ * Scope target for routes addressed by a definition guid param. Loads the
+ * record so a project-scoped key reaches the definitions inside its project.
+ */
+export function definitionScopeTarget(param = 'guid') {
+    return async (req) => {
+        const definitionId = req.params[param];
+        if (!definitionId || !req.ctx)
+            return { definitionId };
+        const record = await req.deps.definitionMeta.get(req.ctx, definitionId);
+        return { definitionId, projectId: record?.projectId };
+    };
+}
+//# sourceMappingURL=scope.js.map

package/dist/api/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/api/scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGrD,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,MAAc;IAC7C,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAC1B,GAA+B,EAC/B,MAAsB,EACtB,MAAoB;IAEpB,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;QAAE,OAAO;IAC/D,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gCAAgC,MAAM,QAAQ,EAAE,SAAS,EAAE;QAChG,aAAa,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;KACjD,CAAC,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,oEAAoE;AACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0C,CAAC;AAEnE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE3D,SAAS,aAAa,CAAC,OAAe;IACrC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,EAAE,GAAG,KAAK,GAAG;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC;;QACjC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,KAAK,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,GAAmB,EAAE,MAAsB,EAAE,MAAoB;IACvF,IAAI,MAAM,EAAE,SAAS;QAAE,OAAO,GAAG,MAAM,YAAY,MAAM,CAAC,SAAS,EAAE,CAAC;IACtE,IAAI,MAAM,EAAE,YAAY;QAAE,OAAO,GAAG,MAAM,eAAe,MAAM,CAAC,YAAY,EAAE,CAAC;IAC/E,OAAO,GAAG,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,KAAK,GAAG,IAAI;IAC9C,OAAO,CAAC,GAAe,EAAe,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAK,GAAG,MAAM;IACnD,OAAO,KAAK,EAAE,GAAe,EAAwB,EAAE;QACtD,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,GAAG;YAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACxE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC,CAAC;AACH,CAAC"}

package/dist/handlers/apiTokens.d.ts

@@ -0,0 +1,23 @@
+/**
+ * API tokens: mint, list, revoke.
+ *
+ * **Session-only.** A key can't manage keys, so a leaked one can't mint more or
+ * revoke the owner's others to cover its tracks.
+ *
+ * **The raw key exists only in the mint response.** The store holds its HMAC,
+ * and every response goes through a schema that has no `tokenHash`.
+ */
+import type { ApiHandler } from '../api/index.js';
+/**
+ * The caller's own tokens in this org, newest first, including revoked and
+ * expired ones. `?all=true` returns everyone's and needs `manage_org_members`.
+ */
+export declare const listApiTokens: ApiHandler;
+/** Mint a token acting as the caller. The raw key is in this response and nowhere else. */
+export declare const createApiToken: ApiHandler;
+/**
+ * Revoke a token: the owner's own, or anyone's in the org for
+ * `manage_org_members`. Someone else's token reads as missing, not forbidden.
+ */
+export declare const revokeApiToken: ApiHandler;
+//# sourceMappingURL=apiTokens.d.ts.map

package/dist/handlers/apiTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiTokens.d.ts","sourceRoot":"","sources":["../../src/handlers/apiTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4BH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAiH9D;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,UAU3B,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,cAAc,EAAE,UAqC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,UAY5B,CAAC"}