@selvajs/server 1.5.0-beta.1 → 1.5.0-beta.3

package/README.md

@@ -26,23 +26,23 @@ pnpm add @selvajs/server
 **There is no root export.** Import from a subpath — `import … from '@selvajs/server'` fails to
 resolve, on purpose, so it stays visible which slice a consumer depends on.
 
-| Export                          | Contents                                                                        |
-| ------------------------------- | ------------------------------------------------------------------------------- |
-| `@selvajs/server/compute`       | Compute limits, rate limiting, idempotency, SSRF guard, remote-definition fetch |
-| `@selvajs/server/definitions`   | Definition service, compute-schema extraction, render loader                    |
-| `@selvajs/server/providers`     | Env-driven provider selection over a caller-supplied registry                   |
-| `@selvajs/server/tokens`        | HMAC codec for capability-URL tokens (share links, invites)                     |
-| `@selvajs/server/errors`        | Sentry-backed `IErrorReporter`                                                  |
-| `@selvajs/server/logging`       | pino-backed `ILogger` + request-id correlation                                  |
-| `@selvajs/server/http`          | Security headers, body-size and redirect guards, route classification           |
-| `@selvajs/server/access`        | Builds the input platform's project access rules consume                        |
-| `@selvajs/server/ops`           | Channel-aware semver comparison                                                 |
-| `@selvajs/server/api`           | Transport-free API core: handler contract, injected deps, error envelope        |
-| `@selvajs/server/handlers`      | The API handlers: business logic behind each endpoint, bound via `runHandler`   |
-| `@selvajs/server/projects`      | Project writes whose rules two routes must agree on                             |
-| `@selvajs/server/organizations` | Org-level domain services spanning more than one provider                       |
-| `@selvajs/server/notifications` | `SmtpNotificationProvider`, SMTP config, invite delivery                        |
-| `@selvajs/server/testing`       | Test harness for the transport-free API handlers                                |
+| Export                          | Contents                                                                                                |
+| ------------------------------- | ------------------------------------------------------------------------------------------------------- |
+| `@selvajs/server/compute`       | Compute limits, rate limiting, idempotency, SSRF guard, remote-definition fetch                         |
+| `@selvajs/server/definitions`   | Definition service, compute-schema extraction, render loader                                            |
+| `@selvajs/server/providers`     | Env-driven provider selection over a caller-supplied registry                                           |
+| `@selvajs/server/tokens`        | HMAC codec for capability-URL tokens (share links, invites)                                             |
+| `@selvajs/server/errors`        | Sentry-backed `IErrorReporter`                                                                          |
+| `@selvajs/server/logging`       | pino-backed `ILogger` + request-id correlation                                                          |
+| `@selvajs/server/http`          | Security headers, body-size and redirect guards, route classification                                   |
+| `@selvajs/server/access`        | Builds the input platform's project access rules consume                                                |
+| `@selvajs/server/ops`           | Channel-aware semver comparison                                                                         |
+| `@selvajs/server/api`           | Transport-free API core: handler contract, deps, errors, token scope, per-token rate limit, idempotency |
+| `@selvajs/server/handlers`      | The API handlers: business logic behind each endpoint, bound via `runHandler`                           |
+| `@selvajs/server/projects`      | Project writes whose rules two routes must agree on                                                     |
+| `@selvajs/server/organizations` | Org-level domain services spanning more than one provider                                               |
+| `@selvajs/server/notifications` | `SmtpNotificationProvider`, SMTP config, invite delivery                                                |
+| `@selvajs/server/testing`       | Test harness for the transport-free API handlers                                                        |
 
 Requires a `@selvajs/platform` provider (e.g. `@selvajs/local-provider` or
 `@selvajs/supabase-provider`) for data/storage/auth.

package/dist/api/deps.d.ts

@@ -15,6 +15,9 @@ import type { DefinitionService } from '../definitions/definition-service.js';
 import type { OrgAssetService } from '../organizations/org-asset-service.js';
 import type { TokenCodec } from '../tokens/token-codec.js';
 import type { ApiTokenCodec } from '../tokens/api-token-codec.js';
+import type { ApiTokenHolderPolicy } from '../tokens/api-token-holder.js';
+import type { ApiRateLimiter } from './rate-limit.js';
+import type { ApiIdempotencyStore } from './idempotency.js';
 import type { IAuthProvider, IDataProvider, IEventSink, INotificationProvider, IStorageProvider, SelvaConfig, SelvaFlags } from '@selvajs/platform';
 export interface SelvaDeps {
     auth: IAuthProvider;
@@ -66,6 +69,8 @@ export interface SelvaDeps {
         invites?: TokenCodec;
         /** Without it, minting answers 503 `API_TOKENS_UNAVAILABLE`. */
         apiTokens?: ApiTokenCodec;
+        /** Who may mint and use API tokens. Absent: the platform permission `manage_api_tokens`. */
+        mayHoldApiTokens?: ApiTokenHolderPolicy;
     };
     /**
      * Upload caps, in bytes.
@@ -90,6 +95,14 @@ export interface SelvaDeps {
      * handlers report `not-configured` rather than failing the write.
      */
     notifications?: INotificationProvider;
+    /**
+     * Per-token request limit `runHandler` charges. Absent: the process-wide
+     * default (`DEFAULT_API_RATE_LIMIT`). `null`: no limit. A host's own limiter
+     * must outlive the request, since deps are rebuilt per request.
+     */
+    apiRateLimiter?: ApiRateLimiter | null;
+    /** Replay store for routes mounted with `idempotent: true`. Absent: the process-wide default. */
+    idempotency?: ApiIdempotencyStore;
     /** Instance display name, used where a record has none. */
     instanceName: string;
     /** Where a person manages their API tokens, linked from the new-key email. Host-relative. */
@@ -130,12 +143,14 @@ export interface SelvaDeps {
  * `tokens` arrives in an options object rather than as a third positional, so
  * the two composed bags cannot be swapped at a call site.
  */
-export declare function depsFromConfig(config: SelvaConfig, services?: SelvaDeps['services'], { tokens, uploadLimits, evictComputeClient, notifications, instanceName, apiTokenSettingsPath }?: {
+export declare function depsFromConfig(config: SelvaConfig, services?: SelvaDeps['services'], { tokens, uploadLimits, evictComputeClient, notifications, instanceName, apiTokenSettingsPath, apiRateLimiter, idempotency }?: {
     tokens?: SelvaDeps['tokens'];
     uploadLimits?: Partial<SelvaDeps['uploadLimits']>;
     evictComputeClient?: SelvaDeps['evictComputeClient'];
     notifications?: INotificationProvider;
     instanceName?: string;
     apiTokenSettingsPath?: string;
+    apiRateLimiter?: ApiRateLimiter | null;
+    idempotency?: ApiIdempotencyStore;
 }): SelvaDeps;
 //# sourceMappingURL=deps.d.ts.map

package/dist/api/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../src/api/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EACX,aAAa,EACb,aAAa,EACb,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,aAAa,CAAC;IACpB,uEAAuE;IACvE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACpC,0DAA0D;IAC1D,cAAc,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC9C,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,qBAAqB,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IAC9D;;;;;;;OAOG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB;;;;OAIG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,UAAU,KAAK,OAAO,CAAC;IAC1C;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE;QACP,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,OAAO,CAAC,EAAE,UAAU,CAAC;QACrB,gEAAgE;QAChE,SAAS,CAAC,EAAE,aAAa,CAAC;KAC1B,CAAC;IACF;;;;;;;;OAQG;IACH,YAAY,EAAE;QACb,qBAAqB,EAAE,MAAM,CAAC;QAC9B,gBAAgB,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,EAAE;QACT,WAAW,CAAC,EAAE,iBAAiB,CAAC;QAChC,SAAS,CAAC,EAAE,eAAe,CAAC;KAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,WAAW,EACnB,QAAQ,GAAE,SAAS,CAAC,UAAU,CAAM,EACpC,EACC,MAAW,EACX,YAAY,EACZ,kBAA6B,EAC7B,aAAa,EACb,YAAsB,EACtB,oBAAyC,EACzC,GAAE;IACF,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IAClD,kBAAkB,CAAC,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACzB,GACJ,SAAS,CA+BX"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../src/api/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EACX,aAAa,EACb,aAAa,EACb,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,aAAa,CAAC;IACpB,uEAAuE;IACvE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACpC,0DAA0D;IAC1D,cAAc,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,aAAa,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC9C,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1C,qBAAqB,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IAC9D;;;;;;;OAOG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB;;;;OAIG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,UAAU,KAAK,OAAO,CAAC;IAC1C;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE;QACP,UAAU,CAAC,EAAE,UAAU,CAAC;QACxB,OAAO,CAAC,EAAE,UAAU,CAAC;QACrB,gEAAgE;QAChE,SAAS,CAAC,EAAE,aAAa,CAAC;QAC1B,4FAA4F;QAC5F,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;KACxC,CAAC;IACF;;;;;;;;OAQG;IACH,YAAY,EAAE;QACb,qBAAqB,EAAE,MAAM,CAAC;QAC9B,gBAAgB,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,iGAAiG;IACjG,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,6FAA6F;IAC7F,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,EAAE;QACT,WAAW,CAAC,EAAE,iBAAiB,CAAC;QAChC,SAAS,CAAC,EAAE,eAAe,CAAC;KAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,WAAW,EACnB,QAAQ,GAAE,SAAS,CAAC,UAAU,CAAM,EACpC,EACC,MAAW,EACX,YAAY,EACZ,kBAA6B,EAC7B,aAAa,EACb,YAAsB,EACtB,oBAAyC,EACzC,cAAc,EACd,WAAW,EACX,GAAE;IACF,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7B,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IAClD,kBAAkB,CAAC,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACrD,aAAa,CAAC,EAAE,qBAAqB,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,WAAW,CAAC,EAAE,mBAAmB,CAAC;CAC7B,GACJ,SAAS,CAiCX"}

package/dist/api/deps.js

@@ -21,7 +21,7 @@ import { isFlagEnabled, NoopEventSink } from '@selvajs/platform';
  * `tokens` arrives in an options object rather than as a third positional, so
  * the two composed bags cannot be swapped at a call site.
  */
-export function depsFromConfig(config, services = {}, { tokens = {}, uploadLimits, evictComputeClient = () => { }, notifications, instanceName = 'Selva', apiTokenSettingsPath = '/settings/tokens' } = {}) {
+export function depsFromConfig(config, services = {}, { tokens = {}, uploadLimits, evictComputeClient = () => { }, notifications, instanceName = 'Selva', apiTokenSettingsPath = '/settings/tokens', apiRateLimiter, idempotency } = {}) {
     const { data } = config;
     return {
         auth: config.auth,
@@ -50,6 +50,8 @@ export function depsFromConfig(config, services = {}, { tokens = {}, uploadLimit
         notifications,
         instanceName,
         apiTokenSettingsPath,
+        apiRateLimiter,
+        idempotency,
         services
     };
 }

package/dist/api/deps.js.map

@@ -1 +1 @@
-{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../src/api/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAyHjE;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC7B,MAAmB,EACnB,WAAkC,EAAE,EACpC,EACC,MAAM,GAAG,EAAE,EACX,YAAY,EACZ,kBAAkB,GAAG,GAAG,EAAE,GAAE,CAAC,EAC7B,aAAa,EACb,YAAY,GAAG,OAAO,EACtB,oBAAoB,GAAG,kBAAkB,KAQtC,EAAE;IAEN,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,WAAW;QAChC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,aAAa,EAAE;QAC5C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QAC3C,MAAM;QACN,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,YAAY,EAAE;YACb,qBAAqB,EAAE,YAAY,EAAE,qBAAqB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;YAC9E,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;SACpE;QACD,kBAAkB;QAClB,aAAa;QACb,YAAY;QACZ,oBAAoB;QACpB,QAAQ;KACR,CAAC;AACH,CAAC"}
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../src/api/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAsIjE;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC7B,MAAmB,EACnB,WAAkC,EAAE,EACpC,EACC,MAAM,GAAG,EAAE,EACX,YAAY,EACZ,kBAAkB,GAAG,GAAG,EAAE,GAAE,CAAC,EAC7B,aAAa,EACb,YAAY,GAAG,OAAO,EACtB,oBAAoB,GAAG,kBAAkB,EACzC,cAAc,EACd,WAAW,KAUR,EAAE;IAEN,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI;QACJ,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,WAAW;QAChC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,aAAa,EAAE;QAC5C,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QAC3C,MAAM;QACN,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,YAAY,EAAE;YACb,qBAAqB,EAAE,YAAY,EAAE,qBAAqB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;YAC9E,gBAAgB,EAAE,YAAY,EAAE,gBAAgB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI;SACpE;QACD,kBAAkB;QAClB,aAAa;QACb,YAAY;QACZ,oBAAoB;QACpB,cAAc;QACd,WAAW;QACX,QAAQ;KACR,CAAC;AACH,CAAC"}

package/dist/api/errors.d.ts

@@ -20,6 +20,10 @@ export declare const ApiErrorCode: {
     readonly INTERNAL: "INTERNAL";
     /** API tokens are switched off or misconfigured here; browser sessions still work. */
     readonly API_TOKENS_UNAVAILABLE: "API_TOKENS_UNAVAILABLE";
+    /** Too many requests, or a share link's solve cap is spent. `Retry-After`, when sent, says when to retry. */
+    readonly RATE_LIMITED: "RATE_LIMITED";
+    /** The key is valid, but the host's holder policy no longer lets its owner hold API tokens. */
+    readonly API_TOKEN_HOLDER_REFUSED: "API_TOKEN_HOLDER_REFUSED";
 };
 export type ApiErrorCode = (typeof ApiErrorCode)[keyof typeof ApiErrorCode];
 export declare class ApiError extends Error {
@@ -31,6 +35,13 @@ export declare class ApiError extends Error {
     readonly details?: Record<string, string>;
     constructor(status: number, code: ApiErrorCode, message: string, fields?: Record<string, string>, details?: Record<string, string>);
 }
+export interface ApiErrorBody {
+    message: string;
+    code: ApiErrorCode;
+    fields?: Record<string, string>;
+    details?: Record<string, string>;
+}
+export declare function toErrorBody(err: ApiError): ApiErrorBody;
 export declare function isApiError(err: unknown): err is ApiError;
 /** Raise a structured API error. The only way handlers should fail. */
 export declare function apiError(status: number, code: ApiErrorCode, message: string, fields?: Record<string, string>, details?: Record<string, string>): never;

package/dist/api/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,eAAO,MAAM,YAAY;;;;;;;;;;IAUxB,sFAAsF;;CAE7E,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE5E,qBAAa,QAAS,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAGzC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CASjC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,QAAQ,CAExD;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,KAAK,CAEP;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAmB1D"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,eAAO,MAAM,YAAY;;;;;;;;;;IAUxB,sFAAsF;;IAEtF,6GAA6G;;IAE7G,+FAA+F;;CAEtF,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE5E,qBAAa,QAAS,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAGzC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CASjC;AAED,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,YAAY,CAKvD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,QAAQ,CAExD;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CACvB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,KAAK,CAEP;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAqB1D"}

package/dist/api/errors.js

@@ -19,7 +19,11 @@ export const ApiErrorCode = {
     SETUP_REQUIRED: 'SETUP_REQUIRED',
     INTERNAL: 'INTERNAL',
     /** API tokens are switched off or misconfigured here; browser sessions still work. */
-    API_TOKENS_UNAVAILABLE: 'API_TOKENS_UNAVAILABLE'
+    API_TOKENS_UNAVAILABLE: 'API_TOKENS_UNAVAILABLE',
+    /** Too many requests, or a share link's solve cap is spent. `Retry-After`, when sent, says when to retry. */
+    RATE_LIMITED: 'RATE_LIMITED',
+    /** The key is valid, but the host's holder policy no longer lets its owner hold API tokens. */
+    API_TOKEN_HOLDER_REFUSED: 'API_TOKEN_HOLDER_REFUSED'
 };
 export class ApiError extends Error {
     status;
@@ -37,6 +41,14 @@ export class ApiError extends Error {
         this.details = details;
     }
 }
+export function toErrorBody(err) {
+    const body = { message: err.message, code: err.code };
+    if (err.fields)
+        body.fields = err.fields;
+    if (err.details)
+        body.details = err.details;
+    return body;
+}
 export function isApiError(err) {
     return err instanceof ApiError;
 }
@@ -59,6 +71,8 @@ export function codeForStatus(status) {
             return ApiErrorCode.CONFLICT;
         case 422:
             return ApiErrorCode.UNPROCESSABLE;
+        case 429:
+            return ApiErrorCode.RATE_LIMITED;
         case 503:
             return ApiErrorCode.COMPUTE_UNAVAILABLE;
         default:

package/dist/api/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,eAAe;IAC9B,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,gBAAgB;IAChC,QAAQ,EAAE,UAAU;IACpB,sFAAsF;IACtF,sBAAsB,EAAE,wBAAwB;CACvC,CAAC;AAIX,MAAM,OAAO,QAAS,SAAQ,KAAK;IACzB,MAAM,CAAS;IACf,IAAI,CAAe;IAC5B,sFAAsF;IAC7E,MAAM,CAA0B;IACzC,yEAAyE;IAChE,OAAO,CAA0B;IAE1C,YACC,MAAc,EACd,IAAkB,EAClB,OAAe,EACf,MAA+B,EAC/B,OAAgC;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACtC,OAAO,GAAG,YAAY,QAAQ,CAAC;AAChC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CACvB,MAAc,EACd,IAAkB,EAClB,OAAe,EACf,MAA+B,EAC/B,OAAgC;IAEhC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,iBAAiB,CAAC;QACvC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,YAAY,CAAC;QAClC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,SAAS,CAAC;QAC/B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,SAAS,CAAC;QAC/B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,QAAQ,CAAC;QAC9B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,aAAa,CAAC;QACnC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,mBAAmB,CAAC;QACzC;YACC,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;AACF,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC3B,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,eAAe;IAC9B,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,gBAAgB;IAChC,QAAQ,EAAE,UAAU;IACpB,sFAAsF;IACtF,sBAAsB,EAAE,wBAAwB;IAChD,6GAA6G;IAC7G,YAAY,EAAE,cAAc;IAC5B,+FAA+F;IAC/F,wBAAwB,EAAE,0BAA0B;CAC3C,CAAC;AAIX,MAAM,OAAO,QAAS,SAAQ,KAAK;IACzB,MAAM,CAAS;IACf,IAAI,CAAe;IAC5B,sFAAsF;IAC7E,MAAM,CAA0B;IACzC,yEAAyE;IAChE,OAAO,CAA0B;IAE1C,YACC,MAAc,EACd,IAAkB,EAClB,OAAe,EACf,MAA+B,EAC/B,OAAgC;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AASD,MAAM,UAAU,WAAW,CAAC,GAAa;IACxC,MAAM,IAAI,GAAiB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,GAAG,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAY;IACtC,OAAO,GAAG,YAAY,QAAQ,CAAC;AAChC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CACvB,MAAc,EACd,IAAkB,EAClB,OAAe,EACf,MAA+B,EAC/B,OAAgC;IAEhC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,iBAAiB,CAAC;QACvC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,YAAY,CAAC;QAClC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,SAAS,CAAC;QAC/B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,SAAS,CAAC;QAC/B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,QAAQ,CAAC;QAC9B,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,aAAa,CAAC;QACnC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,YAAY,CAAC;QAClC,KAAK,GAAG;YACP,OAAO,YAAY,CAAC,mBAAmB,CAAC;QACzC;YACC,OAAO,YAAY,CAAC,QAAQ,CAAC;IAC/B,CAAC;AACF,CAAC"}

package/dist/api/idempotency.d.ts

@@ -0,0 +1,58 @@
+/**
+ * `Idempotency-Key` for mounted routes that opt in with `idempotent: true`.
+ *
+ * Built on the solve route's store and wire contract (`../compute/idempotency*`):
+ * the store absorbs in-flight and near-term retries in this process; it is not
+ * a durable record. A create that must never duplicate also needs the key on
+ * the created row under a unique constraint, written in the same transaction.
+ *
+ * Each entry carries a fingerprint of method, path and body, so a client that
+ * reuses a key for a different request gets 422 instead of someone else's
+ * replay. Only responses below 400 are kept: a failed attempt frees the key so
+ * a corrected retry can run.
+ */
+import type { RequestContext } from '@selvajs/platform';
+import { type IdempotencyStore } from '../compute/idempotency.js';
+import { type StoredResponse } from '../compute/idempotency-http.js';
+export declare const IDEMPOTENCY_KEY_HEADER = "Idempotency-Key";
+export declare const MAX_IDEMPOTENCY_KEY_LENGTH = 255;
+/** Covers a client's retry-on-timeout window without turning into a result cache. */
+export declare const DEFAULT_API_IDEMPOTENCY_TTL_MS: number;
+export interface IdempotentEntry {
+    fingerprint: string;
+    response: StoredResponse;
+}
+export type ApiIdempotencyStore = IdempotencyStore<IdempotentEntry>;
+export declare function createApiIdempotencyStore(ttlMs?: number): ApiIdempotencyStore;
+/** The store `depsFromConfig` wires when the host passes none. One per process. */
+export declare function defaultApiIdempotencyStore(): ApiIdempotencyStore;
+/**
+ * The narrowest identity a key is namespaced by: the token for a token
+ * request, so two keys of one user never share replays, else the user.
+ */
+export declare function idempotencyCallerId(ctx: RequestContext): string;
+/** Read and validate the client's key. `null` when the header is absent. */
+export declare function readIdempotencyKey(request: Request): string | null;
+/** SHA-256 over method, path and body, hex. */
+export declare function requestFingerprint(method: string, path: string, body: ArrayBuffer | string): Promise<string>;
+/**
+ * The body `requestFingerprint` should hash, read from a clone so the handler
+ * can still consume the original.
+ *
+ * Multipart is canonicalized to its fields and file contents: clients pick a
+ * fresh random boundary per request, so the raw bytes of an identical retry
+ * never match.
+ */
+export declare function fingerprintBody(request: Request): Promise<ArrayBuffer | string>;
+/**
+ * Run `fn` once per `(callerId, clientKey)`, replaying its response to repeats
+ * with `Idempotency-Replayed: true`. Throws 422 when the key was used for a
+ * different request. Errors `fn` throws propagate and free the key.
+ */
+export declare function runIdempotent({ store, callerId, clientKey, fingerprint }: {
+    store: ApiIdempotencyStore;
+    callerId: string;
+    clientKey: string;
+    fingerprint: string;
+}, fn: () => Promise<Response>): Promise<Response>;
+//# sourceMappingURL=idempotency.d.ts.map

package/dist/api/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../../src/api/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,gCAAgC,CAAC;AAGxC,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AACxD,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,qFAAqF;AACrF,eAAO,MAAM,8BAA8B,QAAa,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;AAEpE,wBAAgB,yBAAyB,CACxC,KAAK,SAAiC,GACpC,mBAAmB,CAErB;AAID,mFAAmF;AACnF,wBAAgB,0BAA0B,IAAI,mBAAmB,CAEhE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAE/D;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAWlE;AAOD,+CAA+C;AAC/C,wBAAsB,kBAAkB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,WAAW,GAAG,MAAM,GACxB,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,CAsBrF;AAmBD;;;;GAIG;AACH,wBAAsB,aAAa,CAClC,EACC,KAAK,EACL,QAAQ,EACR,SAAS,EACT,WAAW,EACX,EAAE;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAC3F,EAAE,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GACzB,OAAO,CAAC,QAAQ,CAAC,CAiBnB"}

package/dist/api/idempotency.js

@@ -0,0 +1,130 @@
+/**
+ * `Idempotency-Key` for mounted routes that opt in with `idempotent: true`.
+ *
+ * Built on the solve route's store and wire contract (`../compute/idempotency*`):
+ * the store absorbs in-flight and near-term retries in this process; it is not
+ * a durable record. A create that must never duplicate also needs the key on
+ * the created row under a unique constraint, written in the same transaction.
+ *
+ * Each entry carries a fingerprint of method, path and body, so a client that
+ * reuses a key for a different request gets 422 instead of someone else's
+ * replay. Only responses below 400 are kept: a failed attempt frees the key so
+ * a corrected retry can run.
+ */
+import { createIdempotencyStore } from '../compute/idempotency.js';
+import { fromStoredResponse, idempotencyKey, toStoredResponse } from '../compute/idempotency-http.js';
+import { apiError, ApiErrorCode } from './errors.js';
+export const IDEMPOTENCY_KEY_HEADER = 'Idempotency-Key';
+export const MAX_IDEMPOTENCY_KEY_LENGTH = 255;
+/** Covers a client's retry-on-timeout window without turning into a result cache. */
+export const DEFAULT_API_IDEMPOTENCY_TTL_MS = 5 * 60_000;
+export function createApiIdempotencyStore(ttlMs = DEFAULT_API_IDEMPOTENCY_TTL_MS) {
+    return createIdempotencyStore({ ttlMs });
+}
+let sharedDefault;
+/** The store `depsFromConfig` wires when the host passes none. One per process. */
+export function defaultApiIdempotencyStore() {
+    return (sharedDefault ??= createApiIdempotencyStore());
+}
+/**
+ * The narrowest identity a key is namespaced by: the token for a token
+ * request, so two keys of one user never share replays, else the user.
+ */
+export function idempotencyCallerId(ctx) {
+    return ctx.apiScope ? `token:${ctx.apiScope.tokenId}` : `user:${ctx.userId}`;
+}
+/** Read and validate the client's key. `null` when the header is absent. */
+export function readIdempotencyKey(request) {
+    const key = request.headers.get(IDEMPOTENCY_KEY_HEADER);
+    if (key === null)
+        return null;
+    if (key.length === 0 || key.length > MAX_IDEMPOTENCY_KEY_LENGTH) {
+        apiError(400, ApiErrorCode.VALIDATION_FAILED, `${IDEMPOTENCY_KEY_HEADER} must be 1 to ${MAX_IDEMPOTENCY_KEY_LENGTH} characters.`);
+    }
+    return key;
+}
+async function sha256Hex(bytes) {
+    const digest = await crypto.subtle.digest('SHA-256', bytes);
+    return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, '0')).join('');
+}
+/** SHA-256 over method, path and body, hex. */
+export async function requestFingerprint(method, path, body) {
+    const head = new TextEncoder().encode(`${method.toUpperCase()} ${path}\n`);
+    const tail = typeof body === 'string' ? new TextEncoder().encode(body) : new Uint8Array(body);
+    const bytes = new Uint8Array(head.length + tail.length);
+    bytes.set(head);
+    bytes.set(tail, head.length);
+    return sha256Hex(bytes);
+}
+/**
+ * The body `requestFingerprint` should hash, read from a clone so the handler
+ * can still consume the original.
+ *
+ * Multipart is canonicalized to its fields and file contents: clients pick a
+ * fresh random boundary per request, so the raw bytes of an identical retry
+ * never match.
+ */
+export async function fingerprintBody(request) {
+    const type = request.headers.get('content-type') ?? '';
+    if (!type.toLowerCase().startsWith('multipart/form-data')) {
+        return request.clone().arrayBuffer();
+    }
+    let form;
+    try {
+        form = await request.clone().formData();
+    }
+    catch {
+        // Malformed: hash the raw bytes and let the handler refuse it.
+        return request.clone().arrayBuffer();
+    }
+    const parts = [];
+    for (const [name, value] of form) {
+        parts.push([
+            name,
+            typeof value === 'string'
+                ? value
+                : { file: value.name, type: value.type, sha256: await sha256Hex(await value.arrayBuffer()) }
+        ]);
+    }
+    return JSON.stringify(parts);
+}
+class NotReplayable {
+    fingerprint;
+    response;
+    constructor(fingerprint, response) {
+        this.fingerprint = fingerprint;
+        this.response = response;
+    }
+}
+function assertSameRequest(stored, fingerprint) {
+    if (stored !== fingerprint) {
+        apiError(422, ApiErrorCode.UNPROCESSABLE, `This ${IDEMPOTENCY_KEY_HEADER} was already used for a different request.`);
+    }
+}
+/**
+ * Run `fn` once per `(callerId, clientKey)`, replaying its response to repeats
+ * with `Idempotency-Replayed: true`. Throws 422 when the key was used for a
+ * different request. Errors `fn` throws propagate and free the key.
+ */
+export async function runIdempotent({ store, callerId, clientKey, fingerprint }, fn) {
+    let outcome;
+    try {
+        outcome = await store.run(idempotencyKey(callerId, clientKey), async () => {
+            const res = await fn();
+            const response = await toStoredResponse(res);
+            if (res.status >= 400)
+                throw new NotReplayable(fingerprint, response);
+            return { fingerprint, response };
+        });
+    }
+    catch (err) {
+        if (!(err instanceof NotReplayable))
+            throw err;
+        // A concurrent retry joining the failed attempt receives the same failure.
+        assertSameRequest(err.fingerprint, fingerprint);
+        return fromStoredResponse(err.response, false);
+    }
+    assertSameRequest(outcome.value.fingerprint, fingerprint);
+    return fromStoredResponse(outcome.value.response, outcome.replayed);
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/api/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/api/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,sBAAsB,EAAyB,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EACN,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAEhB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,qFAAqF;AACrF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,GAAG,MAAM,CAAC;AASzD,MAAM,UAAU,yBAAyB,CACxC,KAAK,GAAG,8BAA8B;IAEtC,OAAO,sBAAsB,CAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,IAAI,aAA8C,CAAC;AAEnD,mFAAmF;AACnF,MAAM,UAAU,0BAA0B;IACzC,OAAO,CAAC,aAAa,KAAK,yBAAyB,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IACtD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACxD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QACjE,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,iBAAiB,EAC9B,GAAG,sBAAsB,iBAAiB,0BAA0B,cAAc,CAClF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAmB;IAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,MAAc,EACd,IAAY,EACZ,IAA0B;IAE1B,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC3D,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;QAC/D,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,KAAK,GAAwE,EAAE,CAAC;IACtF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACV,IAAI;YACJ,OAAO,KAAK,KAAK,QAAQ;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE;SAC7F,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,aAAa;IAER;IACA;IAFV,YACU,WAAmB,EACnB,QAAwB;QADxB,gBAAW,GAAX,WAAW,CAAQ;QACnB,aAAQ,GAAR,QAAQ,CAAgB;IAC/B,CAAC;CACJ;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,WAAmB;IAC7D,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC5B,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,aAAa,EAC1B,QAAQ,sBAAsB,4CAA4C,CAC1E,CAAC;IACH,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,EACC,KAAK,EACL,QAAQ,EACR,SAAS,EACT,WAAW,EAC+E,EAC3F,EAA2B;IAE3B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACtE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC;YAAE,MAAM,GAAG,CAAC;QAC/C,2EAA2E;QAC3E,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAChD,OAAO,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC1D,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;AACrE,CAAC"}

package/dist/api/index.d.ts

@@ -5,6 +5,8 @@ export { collection, created, noContent } from './responses.js';
 export { shaped, shapedCollection } from './shaped.js';
 export { formText, parseBody, parseParam, requireCaller, requireParams, requireUpload, throwZodError } from './request.js';
 export { runHandler, toErrorBody, type ApiErrorBody, type RunHandlerOptions } from './respond.js';
+export { createApiRateLimiter, defaultApiRateLimiter, resolveApiRateLimitConfig, chargeApiRateLimit, rateLimitHeaders, rateLimitedResponse, withRateLimitHeaders, DEFAULT_API_RATE_LIMIT, type ApiRateLimiter, type ApiRateLimitConfig, type ApiRateLimitVerdict } from './rate-limit.js';
+export { createApiIdempotencyStore, defaultApiIdempotencyStore, idempotencyCallerId, readIdempotencyKey, requestFingerprint, runIdempotent, IDEMPOTENCY_KEY_HEADER, MAX_IDEMPOTENCY_KEY_LENGTH, DEFAULT_API_IDEMPOTENCY_TTL_MS, type ApiIdempotencyStore, type IdempotentEntry } from './idempotency.js';
 export { assertScope, actionForMethod, scopeRefusalsToday, projectScopeTarget, definitionScopeTarget } from './scope.js';
 export { mapCoreError } from './map-core-error.js';
 export { parseListOptions, parseDefinitionListOptions } from './pagination.js';

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1F,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACN,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EACN,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1F,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACN,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,MAAM,uBAAuB,CAAC"}

package/dist/api/index.js

@@ -8,6 +8,8 @@ export { collection, created, noContent } from './responses.js';
 export { shaped, shapedCollection } from './shaped.js';
 export { formText, parseBody, parseParam, requireCaller, requireParams, requireUpload, throwZodError } from './request.js';
 export { runHandler, toErrorBody } from './respond.js';
+export { createApiRateLimiter, defaultApiRateLimiter, resolveApiRateLimitConfig, chargeApiRateLimit, rateLimitHeaders, rateLimitedResponse, withRateLimitHeaders, DEFAULT_API_RATE_LIMIT } from './rate-limit.js';
+export { createApiIdempotencyStore, defaultApiIdempotencyStore, idempotencyCallerId, readIdempotencyKey, requestFingerprint, runIdempotent, IDEMPOTENCY_KEY_HEADER, MAX_IDEMPOTENCY_KEY_LENGTH, DEFAULT_API_IDEMPOTENCY_TTL_MS } from './idempotency.js';
 export { assertScope, actionForMethod, scopeRefusalsToday, projectScopeTarget, definitionScopeTarget } from './scope.js';
 export { mapCoreError } from './map-core-error.js';
 export { parseListOptions, parseDefinitionListOptions } from './pagination.js';

package/dist/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,kEAAkE;AAElE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1F,OAAO,EAAE,cAAc,EAAkB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACN,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAA6C,MAAM,cAAc,CAAC;AAClG,OAAO,EACN,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,6BAA6B,EAE7B,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,kEAAkE;AAElE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1F,OAAO,EAAE,cAAc,EAAkB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EACN,QAAQ,EACR,SAAS,EACT,UAAU,EACV,aAAa,EACb,aAAa,EACb,aAAa,EACb,aAAa,EACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,WAAW,EAA6C,MAAM,cAAc,CAAC;AAClG,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EAItB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAG9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB,EACpB,2BAA2B,EAC3B,8BAA8B,EAC9B,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,6BAA6B,EAE7B,MAAM,uBAAuB,CAAC"}

package/dist/api/rate-limit.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The general per-token request limit `runHandler` applies to every API-token
+ * request. Browser sessions are not charged: their abuse surface is the
+ * per-user compute bucket and the login limiter, not request volume.
+ *
+ * Solves charge this bucket and the owner's `user:{id}` compute bucket, so ten
+ * keys of one user never buy ten times the compute.
+ *
+ * The default limiter is process-local (fixed window over
+ * `createComputeRateLimiter`), so N instances admit N times the rate. A host
+ * that needs one shared budget implements `ApiRateLimiter` over its own store.
+ */
+import type { ILogger, RequestContext } from '@selvajs/platform';
+import { type EnvRecord } from '../compute/limits.js';
+export interface ApiRateLimitVerdict {
+    allowed: boolean;
+    /** Requests admitted per window. */
+    limit: number;
+    /** Requests left in the current window after this one. */
+    remaining: number;
+    /** Seconds until the window resets, when refused. */
+    retryAfter?: number;
+}
+/** Records one request against `key`. Async so a shared-store implementation fits. */
+export interface ApiRateLimiter {
+    hit(key: string): ApiRateLimitVerdict | Promise<ApiRateLimitVerdict>;
+}
+export interface ApiRateLimitConfig {
+    windowMs: number;
+    /** `0` disables the limit. */
+    maxPerWindow: number;
+}
+export declare const DEFAULT_API_RATE_LIMIT: Readonly<ApiRateLimitConfig>;
+/**
+ * Read `API_TOKEN_RATE_LIMIT_MAX` (requests per window, `0` = off) and
+ * `API_TOKEN_RATE_LIMIT_WINDOW_MS` from an injected env map.
+ */
+export declare function resolveApiRateLimitConfig(env: EnvRecord, logger?: ILogger): ApiRateLimitConfig;
+/** Process-local fixed-window limiter. Returns `null` when `maxPerWindow` is 0. */
+export declare function createApiRateLimiter(config?: ApiRateLimitConfig): ApiRateLimiter | null;
+/**
+ * The limiter `depsFromConfig` wires when the host passes none. One per
+ * process: deps are rebuilt per request, and a limiter per request counts
+ * nothing.
+ */
+export declare function defaultApiRateLimiter(): ApiRateLimiter | null;
+/**
+ * Charge one request to the caller's token. `undefined` for a session caller
+ * or when no limiter is wired.
+ */
+export declare function chargeApiRateLimit(ctx: RequestContext | undefined, limiter: ApiRateLimiter | null | undefined): Promise<ApiRateLimitVerdict | undefined>;
+export declare function rateLimitHeaders(verdict: ApiRateLimitVerdict): Record<string, string>;
+/** The 429 envelope, with `Retry-After` and the `RateLimit-*` headers. */
+export declare function rateLimitedResponse(verdict: ApiRateLimitVerdict, message?: string): Response;
+/** Stamp the `RateLimit-*` headers onto a response. No-op without a verdict. */
+export declare function withRateLimitHeaders(res: Response, verdict: ApiRateLimitVerdict | undefined): Response;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/api/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/api/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEjE,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAG3F,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,kBAAkB,CAG9D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,kBAAkB,CAe9F;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CACnC,MAAM,GAAE,kBAA2C,GACjD,cAAc,GAAG,IAAI,CAevB;AAID;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,GAAG,IAAI,CAG7D;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACvC,GAAG,EAAE,cAAc,GAAG,SAAS,EAC/B,OAAO,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,GACxC,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAG1C;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOrF;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,SAAgF,GACrF,QAAQ,CAOV;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CACnC,GAAG,EAAE,QAAQ,EACb,OAAO,EAAE,mBAAmB,GAAG,SAAS,GACtC,QAAQ,CAgBV"}

package/dist/api/rate-limit.js

@@ -0,0 +1,108 @@
+/**
+ * The general per-token request limit `runHandler` applies to every API-token
+ * request. Browser sessions are not charged: their abuse surface is the
+ * per-user compute bucket and the login limiter, not request volume.
+ *
+ * Solves charge this bucket and the owner's `user:{id}` compute bucket, so ten
+ * keys of one user never buy ten times the compute.
+ *
+ * The default limiter is process-local (fixed window over
+ * `createComputeRateLimiter`), so N instances admit N times the rate. A host
+ * that needs one shared budget implements `ApiRateLimiter` over its own store.
+ */
+import { createComputeRateLimiter } from '../compute/rate-limit.js';
+import { readNonNegativeInt, readPositiveInt } from '../compute/limits.js';
+import { ApiError, ApiErrorCode, toErrorBody } from './errors.js';
+export const DEFAULT_API_RATE_LIMIT = Object.freeze({
+    windowMs: 60_000,
+    maxPerWindow: 600
+});
+/**
+ * Read `API_TOKEN_RATE_LIMIT_MAX` (requests per window, `0` = off) and
+ * `API_TOKEN_RATE_LIMIT_WINDOW_MS` from an injected env map.
+ */
+export function resolveApiRateLimitConfig(env, logger) {
+    return {
+        windowMs: readPositiveInt(env, 'API_TOKEN_RATE_LIMIT_WINDOW_MS', DEFAULT_API_RATE_LIMIT.windowMs, logger),
+        maxPerWindow: readNonNegativeInt(env, 'API_TOKEN_RATE_LIMIT_MAX', DEFAULT_API_RATE_LIMIT.maxPerWindow, logger)
+    };
+}
+/** Process-local fixed-window limiter. Returns `null` when `maxPerWindow` is 0. */
+export function createApiRateLimiter(config = DEFAULT_API_RATE_LIMIT) {
+    if (config.maxPerWindow <= 0)
+        return null;
+    const inner = createComputeRateLimiter(config);
+    const limit = config.maxPerWindow;
+    return {
+        hit(key) {
+            const result = inner.check(key);
+            return {
+                allowed: result.allowed,
+                limit,
+                remaining: Math.max(0, limit - inner.count(key)),
+                retryAfter: result.retryAfter
+            };
+        }
+    };
+}
+let sharedDefault;
+/**
+ * The limiter `depsFromConfig` wires when the host passes none. One per
+ * process: deps are rebuilt per request, and a limiter per request counts
+ * nothing.
+ */
+export function defaultApiRateLimiter() {
+    if (sharedDefault === undefined)
+        sharedDefault = createApiRateLimiter();
+    return sharedDefault;
+}
+/**
+ * Charge one request to the caller's token. `undefined` for a session caller
+ * or when no limiter is wired.
+ */
+export async function chargeApiRateLimit(ctx, limiter) {
+    if (!ctx?.apiScope || !limiter)
+        return undefined;
+    return limiter.hit(`token:${ctx.apiScope.tokenId}`);
+}
+export function rateLimitHeaders(verdict) {
+    const headers = {
+        'RateLimit-Limit': String(verdict.limit),
+        'RateLimit-Remaining': String(verdict.remaining)
+    };
+    if (!verdict.allowed)
+        headers['Retry-After'] = String(verdict.retryAfter ?? 1);
+    return headers;
+}
+/** The 429 envelope, with `Retry-After` and the `RateLimit-*` headers. */
+export function rateLimitedResponse(verdict, message = `Too many requests for this API token. Retry in ${verdict.retryAfter ?? 1}s.`) {
+    const retryAfter = String(verdict.retryAfter ?? 1);
+    const err = new ApiError(429, ApiErrorCode.RATE_LIMITED, message, undefined, { retryAfter });
+    return new Response(JSON.stringify(toErrorBody(err)), {
+        status: 429,
+        headers: { 'content-type': 'application/json', ...rateLimitHeaders(verdict) }
+    });
+}
+/** Stamp the `RateLimit-*` headers onto a response. No-op without a verdict. */
+export function withRateLimitHeaders(res, verdict) {
+    if (!verdict)
+        return res;
+    const headers = rateLimitHeaders(verdict);
+    try {
+        for (const [k, v] of Object.entries(headers))
+            res.headers.set(k, v);
+        return res;
+    }
+    catch {
+        // A fetched or otherwise immutable response: rewrap rather than drop the headers.
+        const copy = new Headers(res.headers);
+        for (const [k, v] of Object.entries(headers))
+            copy.set(k, v);
+        return new Response(res.body, {
+            status: res.status,
+            statusText: res.statusText,
+            headers: copy
+        });
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/api/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/api/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAkB,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuBlE,MAAM,CAAC,MAAM,sBAAsB,GAAiC,MAAM,CAAC,MAAM,CAAC;IACjF,QAAQ,EAAE,MAAM;IAChB,YAAY,EAAE,GAAG;CACjB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAc,EAAE,MAAgB;IACzE,OAAO;QACN,QAAQ,EAAE,eAAe,CACxB,GAAG,EACH,gCAAgC,EAChC,sBAAsB,CAAC,QAAQ,EAC/B,MAAM,CACN;QACD,YAAY,EAAE,kBAAkB,CAC/B,GAAG,EACH,0BAA0B,EAC1B,sBAAsB,CAAC,YAAY,EACnC,MAAM,CACN;KACD,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CACnC,SAA6B,sBAAsB;IAEnD,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;IAClC,OAAO;QACN,GAAG,CAAC,GAAG;YACN,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO;gBACN,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK;gBACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAChD,UAAU,EAAE,MAAM,CAAC,UAAU;aAC7B,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC;AAED,IAAI,aAAgD,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACpC,IAAI,aAAa,KAAK,SAAS;QAAE,aAAa,GAAG,oBAAoB,EAAE,CAAC;IACxE,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,GAA+B,EAC/B,OAA0C;IAE1C,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA4B;IAC5D,MAAM,OAAO,GAA2B;QACvC,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;KAChD,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAClC,OAA4B,EAC5B,OAAO,GAAG,kDAAkD,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI;IAEvF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7F,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE;QACrD,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE;KAC7E,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CACnC,GAAa,EACb,OAAwC;IAExC,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC;IACzB,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC;QACJ,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpE,OAAO,GAAG,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACR,kFAAkF;QAClF,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE;YAC7B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,IAAI;SACb,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}

package/dist/api/respond.d.ts

@@ -7,16 +7,10 @@
  * to build an `ApiRequest` and call `runHandler`; one that does not can reuse
  * `toErrorBody` and serialize itself.
  */
-import { ApiError, ApiErrorCode } from './errors.js';
+import { ApiError } from './errors.js';
 import type { ApiScopeAction, ScopeTarget } from '@selvajs/platform';
 import type { ApiHandler, ApiRequest } from './types.js';
-export interface ApiErrorBody {
-    message: string;
-    code: ApiErrorCode;
-    fields?: Record<string, string>;
-    details?: Record<string, string>;
-}
-export declare function toErrorBody(err: ApiError): ApiErrorBody;
+export { toErrorBody, type ApiErrorBody } from './errors.js';
 export interface RunHandlerOptions {
     /** The 500 message when the handler throws something unmapped. */
     fallback: string;
@@ -36,7 +30,13 @@ export interface RunHandlerOptions {
      * org-level, which project- and definition-scoped keys never pass.
      */
     scopeTarget?: (req: ApiRequest) => ScopeTarget | Promise<ScopeTarget>;
+    /**
+     * Honour `Idempotency-Key`: a repeat from the same caller replays the first
+     * response, and a key reused with a different body gets 422. Opt in per
+     * route; what is safe to replay differs.
+     */
+    idempotent?: boolean;
 }
 /** Run a handler and serialize whatever comes out, including failures. */
-export declare function runHandler(handler: ApiHandler, req: ApiRequest, { fallback, mapError, action, scopeTarget }: RunHandlerOptions): Promise<Response>;
+export declare function runHandler(handler: ApiHandler, req: ApiRequest, { fallback, mapError, action, scopeTarget, idempotent }: RunHandlerOptions): Promise<Response>;
 //# sourceMappingURL=respond.d.ts.map

package/dist/api/respond.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../src/api/respond.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAGtE,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,YAAY,CAKvD;AAcD,MAAM,WAAW,iBAAiB;IACjC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACtE;AAED,0EAA0E;AAC1E,wBAAsB,UAAU,CAC/B,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,UAAU,EACf,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,iBAAiB,GAC5D,OAAO,CAAC,QAAQ,CAAC,CAiCnB"}
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../src/api/respond.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAyC,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAiBtE,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAc7D,MAAM,WAAW,iBAAiB;IACjC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;IAClD;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;OAGG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,0EAA0E;AAC1E,wBAAsB,UAAU,CAC/B,OAAO,EAAE,UAAU,EACnB,GAAG,EAAE,UAAU,EACf,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,iBAAiB,GACxE,OAAO,CAAC,QAAQ,CAAC,CA4EnB"}

package/dist/api/respond.js

@@ -7,16 +7,11 @@
  * to build an `ApiRequest` and call `runHandler`; one that does not can reuse
  * `toErrorBody` and serialize itself.
  */
-import { ApiErrorCode, isApiError } from './errors.js';
+import { ApiErrorCode, isApiError, toErrorBody } from './errors.js';
 import { actionForMethod, assertScope } from './scope.js';
-export function toErrorBody(err) {
-    const body = { message: err.message, code: err.code };
-    if (err.fields)
-        body.fields = err.fields;
-    if (err.details)
-        body.details = err.details;
-    return body;
-}
+import { chargeApiRateLimit, defaultApiRateLimiter, rateLimitedResponse, withRateLimitHeaders } from './rate-limit.js';
+import { defaultApiIdempotencyStore, fingerprintBody, idempotencyCallerId, readIdempotencyKey, requestFingerprint, runIdempotent } from './idempotency.js';
+export { toErrorBody } from './errors.js';
 function toResponse(result) {
     if (result instanceof Response)
         return result;
@@ -29,14 +24,8 @@ function toResponse(result) {
     });
 }
 /** Run a handler and serialize whatever comes out, including failures. */
-export async function runHandler(handler, req, { fallback, mapError, action, scopeTarget }) {
-    try {
-        if (req.ctx?.apiScope) {
-            assertScope(req.ctx, action ?? actionForMethod(req.request.method), scopeTarget ? await scopeTarget(req) : undefined);
-        }
-        return toResponse(await handler(req));
-    }
-    catch (err) {
+export async function runHandler(handler, req, { fallback, mapError, action, scopeTarget, idempotent }) {
+    const fail = (err) => {
         if (isApiError(err)) {
             return toResponse({ status: err.status, body: toErrorBody(err) });
         }
@@ -55,6 +44,49 @@ export async function runHandler(handler, req, { fallback, mapError, action, sco
             status: 500,
             body: { message: fallback, code: ApiErrorCode.INTERNAL }
         });
+    };
+    let verdict;
+    try {
+        // Charged before the scope check: `scopeTarget` may read the database,
+        // and a throttled key must not reach it.
+        const limiter = req.deps.apiRateLimiter === undefined ? defaultApiRateLimiter() : req.deps.apiRateLimiter;
+        verdict = await chargeApiRateLimit(req.ctx, limiter);
+        if (verdict && !verdict.allowed)
+            return rateLimitedResponse(verdict);
+    }
+    catch (err) {
+        return fail(err);
+    }
+    let res;
+    try {
+        if (req.ctx?.apiScope) {
+            assertScope(req.ctx, action ?? actionForMethod(req.request.method), scopeTarget ? await scopeTarget(req) : undefined);
+        }
+        const run = async () => {
+            try {
+                return toResponse(await handler(req));
+            }
+            catch (err) {
+                return fail(err);
+            }
+        };
+        const clientKey = idempotent && req.ctx ? readIdempotencyKey(req.request) : null;
+        if (clientKey && req.ctx) {
+            const fingerprint = await requestFingerprint(req.request.method, req.url.pathname + req.url.search, await fingerprintBody(req.request));
+            res = await runIdempotent({
+                store: req.deps.idempotency ?? defaultApiIdempotencyStore(),
+                callerId: idempotencyCallerId(req.ctx),
+                clientKey,
+                fingerprint
+            }, run);
+        }
+        else {
+            res = await run();
+        }
+    }
+    catch (err) {
+        res = fail(err);
     }
+    return withRateLimitHeaders(res, verdict);
 }
 //# sourceMappingURL=respond.js.map

package/dist/api/respond.js.map

@@ -1 +1 @@
-{"version":3,"file":"respond.js","sourceRoot":"","sources":["../../src/api/respond.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAY,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAS1D,MAAM,UAAU,WAAW,CAAC,GAAa;IACxC,MAAM,IAAI,GAAiB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,GAAG,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO;QAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5C,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,MAA8B;IACjD,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,EAAE,MAAM,IAAI,GAAG;QACrB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;KAC3D,CAAC,CAAC;AACJ,CAAC;AAuBD,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,OAAmB,EACnB,GAAe,EACf,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAqB;IAE9D,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YACvB,WAAW,CACV,GAAG,CAAC,GAAG,EACP,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAC7C,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;QACH,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,oEAAoE;QACpE,uEAAuE;QACvE,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,QAAQ,EAAE,EAAE;YAClC,SAAS,EAAE,KAAK;YAChB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACpE,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;YACjB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE;SACxD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}
+{"version":3,"file":"respond.js","sourceRoot":"","sources":["../../src/api/respond.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAY,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG9E,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACN,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,0BAA0B,EAC1B,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAqB,MAAM,aAAa,CAAC;AAE7D,SAAS,UAAU,CAAC,MAA8B;IACjD,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAEtF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,EAAE,MAAM,IAAI,GAAG;QACrB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;KAC3D,CAAC,CAAC;AACJ,CAAC;AA6BD,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,OAAmB,EACnB,GAAe,EACf,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAqB;IAE1E,MAAM,IAAI,GAAG,CAAC,GAAY,EAAY,EAAE;QACvC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,EAAE,CAAC;YACZ,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,oEAAoE;QACpE,uEAAuE;QACvE,qCAAqC;QACrC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,QAAQ,EAAE,EAAE;YAClC,SAAS,EAAE,KAAK;YAChB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACpE,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;YACjB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE;SACxD,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACJ,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,OAAO,GACZ,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;QAC3F,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACJ,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YACvB,WAAW,CACV,GAAG,CAAC,GAAG,EACP,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAC7C,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAChD,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE;YACtB,IAAI,CAAC;gBACJ,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;QACF,CAAC,CAAC;QACF,MAAM,SAAS,GAAG,UAAU,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjF,IAAI,SAAS,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAC3C,GAAG,CAAC,OAAO,CAAC,MAAM,EAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,EACjC,MAAM,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAClC,CAAC;YACF,GAAG,GAAG,MAAM,aAAa,CACxB;gBACC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,0BAA0B,EAAE;gBAC3D,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;gBACtC,SAAS;gBACT,WAAW;aACX,EACD,GAAG,CACH,CAAC;QACH,CAAC;aAAM,CAAC;YACP,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC3C,CAAC"}

package/dist/handlers/apiTokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiTokens.d.ts","sourceRoot":"","sources":["../../src/handlers/apiTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAKN,KAAK,oBAAoB,EAEzB,KAAK,cAAc,EACnB,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAiH9D;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,UAU3B,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,cAAc,EAAE,UAqC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,UAY5B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACxC,KAAK,EAAE,cAAc,GAAG,SAAS,EACjC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,EACtD,GAAG,EAAE,OAAO,GACV,OAAO,CAAC,IAAI,CAAC,CAaf"}
+{"version":3,"file":"apiTokens.d.ts","sourceRoot":"","sources":["../../src/handlers/apiTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAKN,KAAK,oBAAoB,EAEzB,KAAK,cAAc,EACnB,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AA4H9D;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,UAU3B,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,cAAc,EAAE,UAqC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,UAY5B,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACxC,KAAK,EAAE,cAAc,GAAG,SAAS,EACjC,GAAG,EAAE,cAAc,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,EACtD,GAAG,EAAE,OAAO,GACV,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/handlers/apiTokens.js

@@ -19,6 +19,16 @@ function requireSessionInOrg(req) {
     }
     return requireActingOrg(req, req.params.orgId);
 }
+function requireMayHoldApiTokens(req, ctx) {
+    const policy = req.deps.tokens.mayHoldApiTokens;
+    if (!policy) {
+        requirePermission(req, 'manage_api_tokens');
+        return;
+    }
+    if (!policy(ctx)) {
+        apiError(403, ApiErrorCode.FORBIDDEN, 'You can’t create API tokens in this org.');
+    }
+}
 function unavailable() {
     apiError(503, ApiErrorCode.API_TOKENS_UNAVAILABLE, 'API tokens are not available on this server.');
 }
@@ -113,7 +123,7 @@ export const listApiTokens = async (req) => {
 /** Mint a token acting as the caller. The raw key is in this response and nowhere else. */
 export const createApiToken = async (req) => {
     const { ctx, orgId } = requireSessionInOrg(req);
-    requirePermission(req, 'manage_api_tokens');
+    requireMayHoldApiTokens(req, ctx);
     const { user } = requireCaller(req);
     const store = storeOf(req);
     const codec = codecOf(req);

package/dist/handlers/apiTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiTokens.js","sourceRoot":"","sources":["../../src/handlers/apiTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,gBAAgB,EAChB,aAAa,EACb,aAAa,EAOb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,UAAU,EACV,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,SAAS,mBAAmB,CAAC,GAAe;IAC3C,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QACvB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,wEAAwE,CACxE,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,WAAW;IACnB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,sBAAsB,EACnC,8CAA8C,CAC9C,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAe;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,OAAO,CAAC,GAAe;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB;IACzC,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CACnC,GAAe,EACf,KAAa,EACb,MAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAS,EAAE,CACzC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAC3B,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK;gBAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACtE,SAAS;QACV,CAAC;QAED,IAAI,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,MAAM,GACX,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1D,MAAM,CAAC,iBAAiB,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YACtC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,CAAC;YACJ,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,oBAAoB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAe,EAAE,KAAe;IAC/D,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;IAC3B,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE;QAAE,OAAO;IAClC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,aAAa,CAAC,IAAI,CACvB,0BAA0B,CAAC;YAC1B,EAAE;YACF,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE;SAC9D,CAAC,EACF,GAAG,CAAC,GAAG,CACP,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAChD,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;IACvD,IAAI,GAAG;QAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE;QACrD,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;KACpC,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,sBAAsB,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,4CAA4C;IAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjD,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,CAAC;IAE/D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACrE,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtD,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAa;QACvB,EAAE,EAAE,UAAU,EAAE;QAChB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,KAAK;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QAC/B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,aAAa,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;QAC/E,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;KACf,CAAC;IACF,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEnC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,OAAO;QACN,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;QACxC,IAAI,EAAE,6BAA6B,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;KACtF,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QAC5F,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,KAAiC,EACjC,GAAmB,EACnB,MAAc,EACd,IAAsD,EACtD,GAAY;IAEZ,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE;YACxC,SAAS,EAAE,WAAW;YACtB,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}
+{"version":3,"file":"apiTokens.js","sourceRoot":"","sources":["../../src/handlers/apiTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,gBAAgB,EAChB,aAAa,EACb,aAAa,EAOb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,UAAU,EACV,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,SAAS,mBAAmB,CAAC,GAAe;IAC3C,IAAI,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;QACvB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,wEAAwE,CACxE,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAe,EAAE,GAAmB;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAC5C,OAAO;IACR,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,0CAA0C,CAAC,CAAC;IACnF,CAAC;AACF,CAAC;AAED,SAAS,WAAW;IACnB,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,sBAAsB,EACnC,8CAA8C,CAC9C,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAe;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,OAAO,CAAC,GAAe;IAC/B,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB;IACzC,OAAO,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CACnC,GAAe,EACf,KAAa,EACb,MAAyB;IAEzB,MAAM,MAAM,GAAG,CAAC,OAAe,EAAS,EAAE,CACzC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAC3B,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK;gBAAE,MAAM,CAAC,kCAAkC,CAAC,CAAC;YACtE,SAAS;QACV,CAAC;QAED,IAAI,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACpC,MAAM,MAAM,GACX,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1D,MAAM,CAAC,iBAAiB,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC9B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAI,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK;YACtC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,CAAC;YACJ,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,oBAAoB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAe,EAAE,KAAe;IAC/D,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;IAC3B,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE;QAAE,OAAO;IAClC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,aAAa,CAAC,IAAI,CACvB,0BAA0B,CAAC;YAC1B,EAAE;YACF,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY;YAC3C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE;SAC9D,CAAC,EACF,GAAG,CAAC,GAAG,CACP,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAChD,SAAS,EAAE,WAAW;YACtB,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACtD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC;IACvD,IAAI,GAAG;QAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE;QACrD,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAC5B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;KACpC,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC,sBAAsB,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,4CAA4C;IAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjD,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,WAAW,EAAE,CAAC;IAE/D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACrE,MAAM,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtD,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAa;QACvB,EAAE,EAAE,UAAU,EAAE;QAChB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,KAAK;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QAC/B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,aAAa,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE;QAC/E,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;KACf,CAAC;IACF,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEnC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,OAAO;QACN,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;QACxC,IAAI,EAAE,6BAA6B,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;KACtF,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QAC5F,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,KAAiC,EACjC,GAAmB,EACnB,MAAc,EACd,IAAsD,EACtD,GAAY;IAEZ,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC;QACJ,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE;YACxC,SAAS,EAAE,WAAW;YACtB,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}

package/dist/handlers/services.d.ts

@@ -18,5 +18,5 @@ export declare function orgAssetService(deps: SelvaDeps): OrgAssetService;
  * about: a handler that quietly skipped hashing would persist a row whose token
  * can never be verified, and nothing downstream would report it.
  */
-export declare function tokenCodec(deps: SelvaDeps, family: keyof SelvaDeps['tokens']): TokenCodec;
+export declare function tokenCodec(deps: SelvaDeps, family: Exclude<keyof SelvaDeps['tokens'], 'mayHoldApiTokens'>): TokenCodec;
 //# sourceMappingURL=services.d.ts.map

package/dist/handlers/services.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../src/handlers/services.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,oEAMhD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,eAAe,CAMhE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,GAAG,UAAU,CAMzF"}
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../src/handlers/services.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,oEAMhD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,eAAe,CAMhE;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACzB,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,OAAO,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,GAC5D,UAAU,CAMZ"}

package/dist/handlers/services.js.map

@@ -1 +1 @@
-{"version":3,"file":"services.js","sourceRoot":"","sources":["../../src/handlers/services.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,UAAU,iBAAiB,CAAC,IAAe;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAe;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAAe,EAAE,MAAiC;IAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,oCAAoC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../../src/handlers/services.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,UAAU,iBAAiB,CAAC,IAAe;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAe;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACzB,IAAe,EACf,MAA8D;IAE9D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,oCAAoC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/http/api-token.d.ts

@@ -1,6 +1,7 @@
 import type { ApiToken, AuthUser, IAuthProvider, IDataProvider, ILogger, RequestContext } from '@selvajs/platform';
 import { ApiErrorCode } from '../api/errors.js';
 import { type ApiTokenCodec } from '../tokens/api-token-codec.js';
+import type { ApiTokenHolderPolicy } from '../tokens/api-token-holder.js';
 export type ApiTokenResolution = 
 /** No API token on the request. Carry on with the cookie or proxy path. */
 {
@@ -22,7 +23,10 @@ export interface ResolveApiTokenDeps {
     /** Absent when the host hasn't configured API tokens: a sent key gets 503. */
     codec?: ApiTokenCodec;
     auth: Pick<IAuthProvider, 'getUser' | 'delegatedSession'>;
-    data: Pick<IDataProvider, 'apiTokens' | 'orgs'>;
+    /** `permissions` is read only for `mayHoldApiTokens`; without it the policy sees no platform permissions. */
+    data: Pick<IDataProvider, 'apiTokens' | 'orgs'> & Partial<Pick<IDataProvider, 'permissions'>>;
+    /** The same policy passed as `SelvaDeps.tokens.mayHoldApiTokens`. Absent: keys aren't re-checked against one. */
+    mayHoldApiTokens?: ApiTokenHolderPolicy;
     /** Receives background failures (the `lastUsedAt` write). Logs the token id only. */
     log?: ILogger;
     now?: () => number;
@@ -40,7 +44,8 @@ export interface ResolveApiTokenOptions {
  * broken key and act as someone else.
  *
  * The owner is re-checked on every request (disabled, still a member of the
- * token's org), then their live context is narrowed to the token's scopes.
+ * token's org, and the host's holder policy if any), then their live context
+ * is narrowed to the token's scopes.
  */
 export declare function resolveApiToken(request: Request, deps: ResolveApiTokenDeps, { pathPrefix }?: ResolveApiTokenOptions): Promise<ApiTokenResolution>;
 //# sourceMappingURL=api-token.d.ts.map

package/dist/http/api-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.d.ts","sourceRoot":"","sources":["../../src/http/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,EACb,OAAO,EACP,cAAc,EACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAGN,KAAK,aAAa,EAClB,MAAM,8BAA8B,CAAC;AAGtC,MAAM,MAAM,kBAAkB;AAC7B,2EAA2E;AACzE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE;AACtE,0EAA0E;GACxE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,MAAM,WAAW,mBAAmB;IACnC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,kBAAkB,CAAC,CAAC;IAC1D,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,MAAM,CAAC,CAAC;IAChD,qFAAqF;IACrF,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAmBD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,mBAAmB,EACzB,EAAE,UAAuB,EAAE,GAAE,sBAA2B,GACtD,OAAO,CAAC,kBAAkB,CAAC,CAuE7B"}
+{"version":3,"file":"api-token.d.ts","sourceRoot":"","sources":["../../src/http/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,EACb,OAAO,EACP,cAAc,EACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAGN,KAAK,aAAa,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAG1E,MAAM,MAAM,kBAAkB;AAC7B,2EAA2E;AACzE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE;AACtE,0EAA0E;GACxE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,MAAM,WAAW,mBAAmB;IACnC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,kBAAkB,CAAC,CAAC;IAC1D,6GAA6G;IAC7G,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9F,iHAAiH;IACjH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,qFAAqF;IACrF,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AA0BD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,mBAAmB,EACzB,EAAE,UAAuB,EAAE,GAAE,sBAA2B,GACtD,OAAO,CAAC,kBAAkB,CAAC,CA0E7B"}

package/dist/http/api-token.js

@@ -16,6 +16,12 @@ const UNAVAILABLE = {
     code: ApiErrorCode.API_TOKENS_UNAVAILABLE,
     message: 'API tokens are not available on this server.'
 };
+const HOLDER_REFUSED = {
+    kind: 'rejected',
+    status: 403,
+    code: ApiErrorCode.API_TOKEN_HOLDER_REFUSED,
+    message: 'This API token’s owner may no longer use API tokens in this org.'
+};
 /**
  * Authenticate a request by its `Authorization: Bearer selva_…` header.
  *
@@ -25,7 +31,8 @@ const UNAVAILABLE = {
  * broken key and act as someone else.
  *
  * The owner is re-checked on every request (disabled, still a member of the
- * token's org), then their live context is narrowed to the token's scopes.
+ * token's org, and the host's holder policy if any), then their live context
+ * is narrowed to the token's scopes.
  */
 export async function resolveApiToken(request, deps, { pathPrefix = '/api/v1/' } = {}) {
     const url = new URL(request.url);
@@ -62,14 +69,21 @@ export async function resolveApiToken(request, deps, { pathPrefix = '/api/v1/' }
     const token = await store.getByTokenHash(SYSTEM_CONTEXT, deps.codec.hashToken(raw));
     if (!token)
         return UNAUTHORIZED;
-    const [user, member] = await Promise.all([
+    const policy = deps.mayHoldApiTokens;
+    const [user, member, platformPermissions] = await Promise.all([
         deps.auth.getUser(token.userId),
-        deps.data.orgs.getOrgMember(SYSTEM_CONTEXT, token.orgId, token.userId)
+        deps.data.orgs.getOrgMember(SYSTEM_CONTEXT, token.orgId, token.userId),
+        // Read only for the policy: narrowing drops platform permissions anyway.
+        policy && deps.data.permissions
+            ? deps.data.permissions.getFor(SYSTEM_CONTEXT, token.userId)
+            : []
     ]);
     if (!user || user.disabled || !member)
         return UNAUTHORIZED;
-    // Platform permissions aren't read: narrowing drops them anyway.
-    let ctx = narrowApiTokenContext(await buildRequestContext({ user, platformPermissions: [], membership: member, pinOrg: true }, { orgs: deps.data.orgs }), token);
+    const live = await buildRequestContext({ user, platformPermissions, membership: member, pinOrg: true }, { orgs: deps.data.orgs });
+    if (policy && !policy(live))
+        return HOLDER_REFUSED;
+    let ctx = narrowApiTokenContext(live, token);
     // Signed only after the user check above: a minted session can't be
     // revoked, and row security doesn't look at bans.
     if (delegated) {

package/dist/http/api-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../../src/http/api-token.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACN,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAwB3D,qGAAqG;AACrG,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,YAAY,GAAuB;IACxC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,YAAY;IAC/B,OAAO,EAAE,gDAAgD;CACzD,CAAC;AAEF,MAAM,WAAW,GAAuB;IACvC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,sBAAsB;IACzC,OAAO,EAAE,8CAA8C;CACvD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,OAAgB,EAChB,IAAyB,EACzB,EAAE,UAAU,GAAG,UAAU,KAA6B,EAAE;IAExD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,YAAY,CAAC,iBAAiB;gBACpC,OAAO,EACN,qHAAqH;aACtH,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEhE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,OAAO;YACN,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,YAAY,CAAC,SAAS;YAC5B,OAAO,EAAE,8BAA8B,UAAU,GAAG;SACpD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,WAAW,CAAC;IAE9C,yDAAyD;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC7C,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IAEpE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,CAAC;IAEhC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;KACtE,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC;IAE3D,iEAAiE;IACjE,IAAI,GAAG,GAAG,qBAAqB,CAC9B,MAAM,mBAAmB,CACxB,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EACnE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CACxB,EACD,KAAK,CACL,CAAC;IAEF,oEAAoE;IACpE,kDAAkD;IAClD,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3E,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,2BAA2B,EAAE,CAAC;QAC5F,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACxF,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,gCAAgC,EAAE;gBAChD,SAAS,EAAE,UAAU;gBACrB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACrD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}
+{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../../src/http/api-token.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACN,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AA2B3D,qGAAqG;AACrG,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,YAAY,GAAuB;IACxC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,YAAY;IAC/B,OAAO,EAAE,gDAAgD;CACzD,CAAC;AAEF,MAAM,WAAW,GAAuB;IACvC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,sBAAsB;IACzC,OAAO,EAAE,8CAA8C;CACvD,CAAC;AAEF,MAAM,cAAc,GAAuB;IAC1C,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,wBAAwB;IAC3C,OAAO,EAAE,kEAAkE;CAC3E,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,OAAgB,EAChB,IAAyB,EACzB,EAAE,UAAU,GAAG,UAAU,KAA6B,EAAE;IAExD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,YAAY,CAAC,iBAAiB;gBACpC,OAAO,EACN,qHAAqH;aACtH,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEhE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,OAAO;YACN,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,YAAY,CAAC,SAAS;YAC5B,OAAO,EAAE,8BAA8B,UAAU,GAAG;SACpD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,WAAW,CAAC;IAE9C,yDAAyD;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC7C,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IAEpE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,CAAC;IAEhC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;QACtE,yEAAyE;QACzE,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW;YAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC;YAC5D,CAAC,CAAC,EAAE;KACL,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,mBAAmB,CACrC,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAC/D,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CACxB,CAAC;IACF,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,cAAc,CAAC;IACnD,IAAI,GAAG,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE7C,oEAAoE;IACpE,kDAAkD;IAClD,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3E,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,2BAA2B,EAAE,CAAC;QAC5F,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACxF,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,gCAAgC,EAAE;gBAChD,SAAS,EAAE,UAAU;gBACrB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACrD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/tokens/api-token-holder.d.ts

@@ -0,0 +1,12 @@
+import type { RequestContext } from '@selvajs/platform';
+/**
+ * Who may hold API tokens in the context's acting org, decided by the host.
+ *
+ * Without one, minting needs the platform permission `manage_api_tokens`. With
+ * one, it replaces that check at mint, and the resolver re-asks it on every
+ * request against the owner's live context in the token's org, so a key stops
+ * working (403 `API_TOKEN_HOLDER_REFUSED`) the moment its owner no longer
+ * qualifies, without being revoked.
+ */
+export type ApiTokenHolderPolicy = (ctx: RequestContext) => boolean;
+//# sourceMappingURL=api-token-holder.d.ts.map

package/dist/tokens/api-token-holder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-holder.d.ts","sourceRoot":"","sources":["../../src/tokens/api-token-holder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC"}

package/dist/tokens/api-token-holder.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=api-token-holder.js.map

package/dist/tokens/api-token-holder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-holder.js","sourceRoot":"","sources":["../../src/tokens/api-token-holder.ts"],"names":[],"mappings":""}

package/dist/tokens/index.d.ts

@@ -1,3 +1,4 @@
 export { createTokenCodec, MIN_TOKEN_SECRET_LENGTH, type TokenCodec, type TokenCodecConfig } from './token-codec.js';
 export { createApiTokenCodec, API_TOKEN_PREFIX, looksLikeApiToken, type ApiTokenCodec } from './api-token-codec.js';
+export type { ApiTokenHolderPolicy } from './api-token-holder.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tokens/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/server",
-  "version": "1.5.0-beta.1",
+  "version": "1.5.0-beta.3",
   "description": "Transport-agnostic server building blocks for apps built on the Selva engine (limits, rate limiting, SSRF guard, remote-definition fetch, definition service + render loader); the solve core lives in @selvajs/solve/server",
   "license": "MIT",
   "author": "VektorNode",