@selvajs/server 1.4.1 → 1.5.0-beta.1

package/dist/tokens/api-token-codec.js

@@ -0,0 +1,70 @@
+import { randomBytes } from 'node:crypto';
+import { crc32 } from 'node:zlib';
+import { createTokenCodec } from './token-codec.js';
+/**
+ * API token format: `selva_` + 30 base62 random chars + 6 base62 chars of
+ * CRC32 over the random part. 42 chars total.
+ *
+ * - The prefix is what secret scanners match on; `sk_` was dropped because
+ *   Stripe and OpenAI keys share it.
+ * - 30 base62 chars carry ~178 bits of entropy.
+ * - The checksum lets the resolver reject a typo or a truncated paste without
+ *   a store lookup. It is not a MAC: the HMAC at rest is what authenticates.
+ * - CRC32 tops out below 62^6, so 6 chars always fit; shorter values are
+ *   left-padded with `0`.
+ */
+export const API_TOKEN_PREFIX = 'selva_';
+const RANDOM_LENGTH = 30;
+const CHECKSUM_LENGTH = 6;
+const TOKEN_LENGTH = API_TOKEN_PREFIX.length + RANDOM_LENGTH + CHECKSUM_LENGTH;
+const BASE62 = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+const BODY_PATTERN = /^[0-9A-Za-z]+$/;
+// Bytes at or above 248 (62 * 4) are dropped rather than reduced, so every
+// character is equally likely.
+function randomBase62(length) {
+    let out = '';
+    while (out.length < length) {
+        for (const byte of randomBytes(length * 2)) {
+            if (byte < 248)
+                out += BASE62[byte % 62];
+            if (out.length === length)
+                break;
+        }
+    }
+    return out;
+}
+function checksum(random) {
+    let n = crc32(random);
+    let out = '';
+    for (let i = 0; i < CHECKSUM_LENGTH; i++) {
+        out = BASE62[n % 62] + out;
+        n = Math.floor(n / 62);
+    }
+    return out;
+}
+/**
+ * Shape only, no secret needed. For spotting a key where it must not be, such
+ * as a query string, without flagging text that merely starts with `selva_`.
+ */
+export function looksLikeApiToken(value) {
+    return (value.length === TOKEN_LENGTH &&
+        value.startsWith(API_TOKEN_PREFIX) &&
+        BODY_PATTERN.test(value.slice(API_TOKEN_PREFIX.length)));
+}
+export function createApiTokenCodec(secret) {
+    const base = createTokenCodec({ prefix: API_TOKEN_PREFIX, secret });
+    return {
+        ...base,
+        mintRawToken() {
+            const random = randomBase62(RANDOM_LENGTH);
+            return API_TOKEN_PREFIX + random + checksum(random);
+        },
+        hasValidChecksum(raw) {
+            if (!looksLikeApiToken(raw))
+                return false;
+            const body = raw.slice(API_TOKEN_PREFIX.length);
+            return checksum(body.slice(0, RANDOM_LENGTH)) === body.slice(RANDOM_LENGTH);
+        }
+    };
+}
+//# sourceMappingURL=api-token-codec.js.map

package/dist/tokens/api-token-codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-codec.js","sourceRoot":"","sources":["../../src/tokens/api-token-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,kBAAkB,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AACzC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,GAAG,aAAa,GAAG,eAAe,CAAC;AAE/E,MAAM,MAAM,GAAG,gEAAgE,CAAC;AAChF,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,2EAA2E;AAC3E,+BAA+B;AAC/B,SAAS,YAAY,CAAC,MAAc;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,IAAI,IAAI,GAAG,GAAG;gBAAE,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM;QAClC,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC/B,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC9C,OAAO,CACN,KAAK,CAAC,MAAM,KAAK,YAAY;QAC7B,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAClC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CACvD,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,MAAc;IACjD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,OAAO;QACN,GAAG,IAAI;QACP,YAAY;YACX,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,gBAAgB,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,gBAAgB,CAAC,GAAW;YAC3B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7E,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/tokens/index.d.ts

@@ -1,2 +1,3 @@
 export { createTokenCodec, MIN_TOKEN_SECRET_LENGTH, type TokenCodec, type TokenCodecConfig } from './token-codec.js';
+export { createApiTokenCodec, API_TOKEN_PREFIX, looksLikeApiToken, type ApiTokenCodec } from './api-token-codec.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tokens/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC"}

package/dist/tokens/index.js

@@ -1,3 +1,5 @@
 // HMAC token codec for capability-URL tokens (share links, invites, …).
 export { createTokenCodec, MIN_TOKEN_SECRET_LENGTH } from './token-codec.js';
+// API tokens (`selva_`): the same HMAC-at-rest scheme, plus a checksum.
+export { createApiTokenCodec, API_TOKEN_PREFIX, looksLikeApiToken } from './api-token-codec.js';
 //# sourceMappingURL=index.js.map

package/dist/tokens/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EAGvB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EAGvB,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/server",
-  "version": "1.4.1",
+  "version": "1.5.0-beta.1",
   "description": "Transport-agnostic server building blocks for apps built on the Selva engine (limits, rate limiting, SSRF guard, remote-definition fetch, definition service + render loader); the solve core lives in @selvajs/solve/server",
   "license": "MIT",
   "author": "VektorNode",
@@ -111,9 +111,9 @@
   "dependencies": {
     "zod": "^4.6.5",
     "@selvajs/compute": "^4.2.1",
-    "@selvajs/notifications": "^0.2.1",
-    "@selvajs/platform": "^0.20.1",
-    "@selvajs/schemas": "^5.1.1"
+    "@selvajs/notifications": "^0.3.0-beta.1",
+    "@selvajs/schemas": "^5.2.0",
+    "@selvajs/platform": "^0.21.0-beta.1"
   },
   "peerDependencies": {
     "@sentry/node": ">=8",
@@ -138,7 +138,7 @@
     "typescript": "~6.0.3",
     "vitest": "^5.0.2",
     "@selvajs/config": "0.0.4",
-    "@selvajs/local-provider": "0.15.3"
+    "@selvajs/local-provider": "0.16.0-beta.0"
   },
   "scripts": {
     "build": "tsc",