@selvajs/server 1.5.0-beta.5 → 1.5.0-beta.7

package/dist/oauth/index.js

@@ -0,0 +1,415 @@
+/**
+ * OAuth 2.1 for MCP clients, with this instance as its own authorization server.
+ *
+ * The access token is an ordinary API token. The host mints it while the user is
+ * signed in, at consent, through the same path as Settings → API tokens; this
+ * module seals the raw key into the authorization code and hands it over at the
+ * token endpoint. So `/mcp` and `/api/v1` keep one credential type.
+ *
+ * Nothing here is stored. A registered client's id is its own signed metadata,
+ * and a code is its own encrypted grant, bound to the issuing origin. The only
+ * state is the set of redeemed codes, in the host's memory, so on several
+ * replicas a code could be redeemed once per replica within its minute, and only
+ * by whoever holds the PKCE verifier.
+ */
+import { createCipheriv, createDecipheriv, createHash, createHmac, hkdfSync, randomBytes, timingSafeEqual } from 'node:crypto';
+/** The scopes a grant can carry. Each maps to one org-wide API scope. */
+export const OAUTH_SCOPES = ['read', 'solve'];
+export const MCP_PATH = '/mcp';
+const CODE_TTL_MS = 60_000;
+const CLIENT_NAME_MAX = 100;
+const REDIRECT_URIS_MAX = 10;
+const CIMD_TTL_MS = 60 * 60_000;
+// A failing metadata URL is not refetched for this long: each fetch is outbound
+// work an anonymous caller could otherwise trigger at will.
+const CIMD_FAILURE_TTL_MS = 60_000;
+const CIMD_CACHE_MAX = 500;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+export class OAuthError extends Error {
+    error;
+    status;
+    constructor(
+    /** RFC 6749 / 7591 error code. */
+    error, description, status = 400) {
+        super(description);
+        this.error = error;
+        this.status = status;
+        this.name = 'OAuthError';
+    }
+    toBody() {
+        return { error: this.error, error_description: this.message };
+    }
+}
+// ============================================================================
+// Discovery documents
+// ============================================================================
+export function mcpResourceUrl(origin) {
+    return origin + MCP_PATH;
+}
+export function resourceMetadataUrl(origin) {
+    return `${origin}/.well-known/oauth-protected-resource${MCP_PATH}`;
+}
+/** RFC 9728. Claude uses only the first authorization server. */
+export function protectedResourceMetadata(origin) {
+    return {
+        resource: mcpResourceUrl(origin),
+        authorization_servers: [origin],
+        scopes_supported: [...OAUTH_SCOPES],
+        bearer_methods_supported: ['header']
+    };
+}
+/**
+ * RFC 8414. Claude picks Client ID Metadata Documents only when both
+ * `client_id_metadata_document_supported` and the `none` auth method appear.
+ */
+export function authorizationServerMetadata(origin) {
+    return {
+        issuer: origin,
+        authorization_endpoint: `${origin}/oauth/authorize`,
+        token_endpoint: `${origin}/oauth/token`,
+        registration_endpoint: `${origin}/oauth/register`,
+        response_types_supported: ['code'],
+        grant_types_supported: ['authorization_code'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint_auth_methods_supported: ['none'],
+        scopes_supported: [...OAUTH_SCOPES],
+        client_id_metadata_document_supported: true,
+        authorization_response_iss_parameter_supported: true
+    };
+}
+// ============================================================================
+// Server
+// ============================================================================
+export function createOAuthServer(options) {
+    const { origin } = options;
+    const now = options.now ?? Date.now;
+    const signKey = derive(options.secret, 'selva-oauth-client');
+    const codeKey = derive(options.secret, `selva-oauth-code:${origin}`);
+    const redeemed = options.redeemedCodes ?? new Map();
+    const metadataCache = new Map();
+    // ==========================================================================
+    // Clients
+    // ==========================================================================
+    /** RFC 7591. The client id carries the metadata, signed, so nothing is stored. */
+    function register(input) {
+        try {
+            const meta = (input ?? {});
+            const redirectUris = checkRedirectUris(meta.redirect_uris);
+            const name = typeof meta.client_name === 'string' ? meta.client_name.trim() : '';
+            const payload = b64(JSON.stringify({ n: name.slice(0, CLIENT_NAME_MAX), r: redirectUris, t: now() }));
+            const clientId = `dcr_${payload}.${sign(signKey, payload)}`;
+            return {
+                status: 201,
+                body: {
+                    client_id: clientId,
+                    client_id_issued_at: Math.floor(now() / 1000),
+                    client_name: name || undefined,
+                    redirect_uris: redirectUris,
+                    grant_types: ['authorization_code'],
+                    response_types: ['code'],
+                    token_endpoint_auth_method: 'none'
+                }
+            };
+        }
+        catch (err) {
+            if (err instanceof OAuthError)
+                return { status: err.status, body: err.toBody() };
+            throw err;
+        }
+    }
+    async function resolveClient(clientId) {
+        if (clientId.startsWith('dcr_'))
+            return registeredClient(clientId);
+        if (clientId.startsWith('https://'))
+            return metadataClient(clientId);
+        throw new OAuthError('invalid_client', 'Unknown client.');
+    }
+    function registeredClient(clientId) {
+        const [payload, signature] = clientId.slice('dcr_'.length).split('.');
+        if (!payload || !signature || !safeEqual(signature, sign(signKey, payload))) {
+            throw new OAuthError('invalid_client', 'Unknown client.');
+        }
+        const meta = JSON.parse(unb64(payload));
+        return { clientId, name: meta.n || 'An MCP client', redirectUris: meta.r };
+    }
+    async function metadataClient(url) {
+        const cached = metadataCache.get(url);
+        if (cached) {
+            if ('client' in cached && now() - cached.at < CIMD_TTL_MS)
+                return cached.client;
+            if ('failure' in cached && now() - cached.at < CIMD_FAILURE_TTL_MS)
+                throw cached.failure;
+        }
+        if (!options.fetchClientMetadata) {
+            throw new OAuthError('invalid_client', 'This server does not accept URL client ids.');
+        }
+        try {
+            const client = await readMetadata(url, options.fetchClientMetadata);
+            remember(url, { at: now(), client });
+            return client;
+        }
+        catch (err) {
+            if (!(err instanceof OAuthError))
+                throw err;
+            remember(url, { at: now(), failure: err });
+            throw err;
+        }
+    }
+    function remember(url, entry) {
+        if (metadataCache.size >= CIMD_CACHE_MAX) {
+            metadataCache.delete(metadataCache.keys().next().value);
+        }
+        metadataCache.set(url, entry);
+    }
+    // ==========================================================================
+    // Authorization
+    // ==========================================================================
+    /**
+     * Validates the query `/oauth/authorize` arrives with. An `OAuthError` from a
+     * bad client or redirect URI must be shown, not redirected: the redirect target
+     * is exactly what can't be trusted.
+     */
+    async function parseAuthorizeRequest(query) {
+        const client = await resolveClient(query.get('client_id') ?? '');
+        const redirectUri = query.get('redirect_uri') ?? '';
+        if (!client.redirectUris.some((r) => redirectMatches(r, redirectUri))) {
+            throw new OAuthError('invalid_request', 'The redirect URI is not registered for this client.');
+        }
+        if (query.get('response_type') !== 'code') {
+            throw new OAuthError('unsupported_response_type', 'Only response_type=code is supported.');
+        }
+        const codeChallenge = query.get('code_challenge') ?? '';
+        if (!codeChallenge || query.get('code_challenge_method') !== 'S256') {
+            throw new OAuthError('invalid_request', 'PKCE with code_challenge_method=S256 is required.');
+        }
+        const resource = query.get('resource') ?? mcpResourceUrl(origin);
+        if (!isThisResource(resource)) {
+            throw new OAuthError('invalid_target', 'The resource is not this server.');
+        }
+        return {
+            client,
+            redirectUri,
+            state: query.get('state') ?? undefined,
+            codeChallenge,
+            scopes: parseScopes(query.get('scope')),
+            resource
+        };
+    }
+    /** Where to send the browser after consent: the client's redirect URI with a code. */
+    function approve(request, grant) {
+        const code = seal(codeKey, {
+            c: request.client.clientId,
+            r: request.redirectUri,
+            p: request.codeChallenge,
+            x: now() + CODE_TTL_MS,
+            g: grant
+        });
+        return withParams(request.redirectUri, { code, state: request.state, iss: origin });
+    }
+    function deny(request) {
+        return withParams(request.redirectUri, {
+            error: 'access_denied',
+            state: request.state,
+            iss: origin
+        });
+    }
+    // ==========================================================================
+    // Token endpoint
+    // ==========================================================================
+    function exchange(form) {
+        try {
+            if (form.get('grant_type') !== 'authorization_code') {
+                throw new OAuthError('unsupported_grant_type', 'Only authorization_code is supported.');
+            }
+            const code = form.get('code') ?? '';
+            const sealed = open(codeKey, code);
+            if (!sealed || sealed.x < now()) {
+                throw new OAuthError('invalid_grant', 'The code is invalid or expired.');
+            }
+            if (sealed.c !== form.get('client_id') || sealed.r !== form.get('redirect_uri')) {
+                throw new OAuthError('invalid_grant', 'The code was issued to another client.');
+            }
+            const verifier = form.get('code_verifier') ?? '';
+            if (!safeEqual(createHash('sha256').update(verifier).digest('base64url'), sealed.p)) {
+                throw new OAuthError('invalid_grant', 'The code_verifier does not match.');
+            }
+            const resource = form.get('resource');
+            if (resource !== null && !isThisResource(resource)) {
+                throw new OAuthError('invalid_target', 'The resource is not this server.');
+            }
+            if (!markRedeemed(code, sealed.x)) {
+                throw new OAuthError('invalid_grant', 'The code was already used.');
+            }
+            const { g } = sealed;
+            return {
+                status: 200,
+                body: {
+                    access_token: g.secret,
+                    token_type: 'Bearer',
+                    expires_in: Math.max(0, Math.floor((Date.parse(g.expiresAt) - now()) / 1000)),
+                    scope: g.scopes.join(' ')
+                }
+            };
+        }
+        catch (err) {
+            if (err instanceof OAuthError)
+                return { status: err.status, body: err.toBody() };
+            throw err;
+        }
+    }
+    function markRedeemed(code, expiresAt) {
+        const t = now();
+        for (const [k, x] of redeemed)
+            if (x < t)
+                redeemed.delete(k);
+        const id = createHash('sha256').update(code).digest('base64url');
+        if (redeemed.has(id))
+            return false;
+        redeemed.set(id, expiresAt);
+        return true;
+    }
+    function isThisResource(resource) {
+        const r = resource.replace(/\/$/, '');
+        return r === origin || r === mcpResourceUrl(origin);
+    }
+    return {
+        register,
+        resolveClient,
+        parseAuthorizeRequest,
+        approve,
+        deny,
+        exchange,
+        protectedResourceMetadata: () => protectedResourceMetadata(origin),
+        authorizationServerMetadata: () => authorizationServerMetadata(origin)
+    };
+}
+/** OAuth scopes to the API scopes a minted token gets. */
+export function apiScopesFor(scopes) {
+    return scopes.map((s) => `${s}:all`);
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+async function readMetadata(url, fetchClientMetadata) {
+    let doc;
+    try {
+        doc = (await fetchClientMetadata(url));
+    }
+    catch {
+        throw new OAuthError('invalid_client', 'The client metadata document could not be read.');
+    }
+    if (doc?.client_id !== url) {
+        throw new OAuthError('invalid_client', 'The metadata document names a different client_id.');
+    }
+    return {
+        clientId: url,
+        name: typeof doc.client_name === 'string' && doc.client_name.trim()
+            ? doc.client_name.trim().slice(0, CLIENT_NAME_MAX)
+            : new URL(url).host,
+        redirectUris: checkRedirectUris(doc.redirect_uris)
+    };
+}
+/**
+ * Every scope when the client asks for none; unknown scopes are dropped. `read`
+ * is always in: `solve` includes it at /api/v1, and a grant without it is empty.
+ */
+function parseScopes(raw) {
+    const asked = (raw ?? '').split(' ').filter(Boolean);
+    if (!OAUTH_SCOPES.some((s) => asked.includes(s)))
+        return [...OAUTH_SCOPES];
+    return OAUTH_SCOPES.filter((s) => s === 'read' || asked.includes(s));
+}
+function checkRedirectUris(value) {
+    if (!Array.isArray(value) || !value.length || value.length > REDIRECT_URIS_MAX) {
+        throw new OAuthError('invalid_redirect_uri', 'Give between 1 and 10 redirect_uris.');
+    }
+    for (const uri of value) {
+        if (typeof uri !== 'string' || !isAllowedRedirect(uri)) {
+            throw new OAuthError('invalid_redirect_uri', 'Redirect URIs must be https, or http on a loopback address.');
+        }
+    }
+    return value;
+}
+function isAllowedRedirect(uri) {
+    let url;
+    try {
+        url = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (url.hash)
+        return false;
+    return (url.protocol === 'https:' || (url.protocol === 'http:' && LOOPBACK_HOSTS.has(url.hostname)));
+}
+/** A redirect to a program on the user's own machine, which any local process can claim. */
+export function isLoopbackRedirect(uri) {
+    try {
+        return LOOPBACK_HOSTS.has(new URL(uri).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/** Exact, except a loopback redirect matches on any port (RFC 8252 §7.3). */
+export function redirectMatches(registered, requested) {
+    if (registered === requested)
+        return true;
+    let a, b;
+    try {
+        a = new URL(registered);
+        b = new URL(requested);
+    }
+    catch {
+        return false;
+    }
+    return (a.protocol === 'http:' &&
+        b.protocol === 'http:' &&
+        LOOPBACK_HOSTS.has(a.hostname) &&
+        a.hostname === b.hostname &&
+        a.pathname === b.pathname &&
+        a.search === b.search);
+}
+function withParams(uri, params) {
+    const url = new URL(uri);
+    for (const [k, v] of Object.entries(params))
+        if (v !== undefined)
+            url.searchParams.set(k, v);
+    return url.toString();
+}
+function derive(secret, info) {
+    return Buffer.from(hkdfSync('sha256', secret, '', info, 32));
+}
+function sign(key, data) {
+    return createHmac('sha256', key).update(data).digest('base64url');
+}
+function seal(key, value) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const body = Buffer.concat([cipher.update(JSON.stringify(value)), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), body]).toString('base64url');
+}
+function open(key, sealed) {
+    try {
+        const raw = Buffer.from(sealed, 'base64url');
+        const decipher = createDecipheriv('aes-256-gcm', key, raw.subarray(0, 12));
+        decipher.setAuthTag(raw.subarray(12, 28));
+        const body = Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()]);
+        return JSON.parse(body.toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function b64(text) {
+    return Buffer.from(text).toString('base64url');
+}
+function unb64(text) {
+    return Buffer.from(text, 'base64url').toString('utf8');
+}
+function safeEqual(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+//# sourceMappingURL=index.js.map

package/dist/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,EACR,WAAW,EACX,eAAe,EACf,MAAM,aAAa,CAAC;AAErB,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,CAAU,CAAC;AAGvD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE/B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,gFAAgF;AAChF,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,MAAM,OAAO,UAAW,SAAQ,KAAK;IAG1B;IAEA;IAJV;IACC,kCAAkC;IACzB,KAAa,EACtB,WAAmB,EACV,SAAS,GAAG;QAErB,KAAK,CAAC,WAAW,CAAC,CAAC;QAJV,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAM;QAGrB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC1B,CAAC;IAED,MAAM;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;CACD;AAkDD,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,MAAM,UAAU,cAAc,CAAC,MAAc;IAC5C,OAAO,MAAM,GAAG,QAAQ,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IACjD,OAAO,GAAG,MAAM,wCAAwC,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACvD,OAAO;QACN,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC;QAChC,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACpC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACzD,OAAO;QACN,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;QAC7C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,qCAAqC,EAAE,IAAI;QAC3C,8CAA8C,EAAE,IAAI;KACpD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,MAAM,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,GAAG,EAAkB,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IAEJ,6EAA6E;IAC7E,UAAU;IACV,6EAA6E;IAE7E,kFAAkF;IAClF,SAAS,QAAQ,CAAC,KAAc;QAC/B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAuD,CAAC;YACjF,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,OAAO,GAAG,GAAG,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAChF,CAAC;YACF,MAAM,QAAQ,GAAG,OAAO,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACL,SAAS,EAAE,QAAQ;oBACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBAC7C,WAAW,EAAE,IAAI,IAAI,SAAS;oBAC9B,aAAa,EAAE,YAAY;oBAC3B,WAAW,EAAE,CAAC,oBAAoB,CAAC;oBACnC,cAAc,EAAE,CAAC,MAAM,CAAC;oBACxB,0BAA0B,EAAE,MAAM;iBAClC;aACD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,QAAgB;QAC5C,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,SAAS,gBAAgB,CAAC,QAAgB;QACzC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAA+B,CAAC;QACtE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,eAAe,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;IAC5E,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,GAAW;QACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,WAAW;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC;YAChF,IAAI,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,mBAAmB;gBAAE,MAAM,MAAM,CAAC,OAAO,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACpE,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC5C,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,QAAQ,CAAC,GAAW,EAAE,KAA8C;QAC5E,IAAI,aAAa,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YAC1C,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QAC1D,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,gBAAgB;IAChB,6EAA6E;IAE7E;;;;OAIG;IACH,KAAK,UAAU,qBAAqB,CAAC,KAAsB;QAC1D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,qDAAqD,CACrD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,IAAI,UAAU,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;YACrE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;YACN,MAAM;YACN,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YACtC,aAAa;YACb,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvC,QAAQ;SACR,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,SAAS,OAAO,CAAC,OAAyB,EAAE,KAAY;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE;YAC1B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YAC1B,CAAC,EAAE,OAAO,CAAC,WAAW;YACtB,CAAC,EAAE,OAAO,CAAC,aAAa;YACxB,CAAC,EAAE,GAAG,EAAE,GAAG,WAAW;YACtB,CAAC,EAAE,KAAK;SACR,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,SAAS,IAAI,CAAC,OAAyB;QACtC,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;YACtC,KAAK,EAAE,eAAe;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,MAAM;SACX,CAAC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAE7E,SAAS,QAAQ,CAAC,IAAqB;QACtC,IAAI,CAAC;YACJ,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,EAAE,CAAC;gBACrD,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAMzB,CAAC;YACT,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC;YACrB,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACL,YAAY,EAAE,CAAC,CAAC,MAAM;oBACtB,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;iBACzB;aACD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;QACpD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,SAAS,cAAc,CAAC,QAAgB;QACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACN,QAAQ;QACR,aAAa;QACb,qBAAqB;QACrB,OAAO;QACP,IAAI;QACJ,QAAQ;QACR,yBAAyB,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAClE,2BAA2B,EAAE,GAAG,EAAE,CAAC,2BAA2B,CAAC,MAAM,CAAC;KACtE,CAAC;AACH,CAAC;AAID,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,MAA6B;IACzD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,KAAK,UAAU,YAAY,CAC1B,GAAW,EACX,mBAAsD;IAEtD,IAAI,GAA4E,CAAC;IACjF,IAAI,CAAC;QACJ,GAAG,GAAG,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAe,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,EAAE,SAAS,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,GAAG;QACb,IAAI,EACH,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YAC5D,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;YAClD,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI;QACrB,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;KAClD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAkB;IACtC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC;IAC3E,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAChF,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,6DAA6D,CAC7D,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,KAAiB,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACrC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CACN,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAC3F,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,IAAI,CAAC;QACJ,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAAiB;IACpE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAM,EAAE,CAAM,CAAC;IACnB,IAAI,CAAC;QACJ,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CACN,CAAC,CAAC,QAAQ,KAAK,OAAO;QACtB,CAAC,CAAC,QAAQ,KAAK,OAAO;QACtB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9B,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CACrB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,MAA0C;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY;IACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,KAAc;IACxC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,MAAc;IACxC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/tokens/api-token-codec.d.ts

@@ -3,8 +3,8 @@ import { type TokenCodec } from './token-codec.js';
  * API token format: `selva_` + 30 base62 random chars + 6 base62 chars of
  * CRC32 over the random part. 42 chars total.
  *
- * - The prefix is what secret scanners match on; `sk_` was dropped because
- *   Stripe and OpenAI keys share it.
+ * - The prefix is what secret scanners match on. Not `sk_`: Stripe and OpenAI
+ *   keys use it.
  * - 30 base62 chars carry ~178 bits of entropy.
  * - The checksum lets the resolver reject a typo or a truncated paste without
  *   a store lookup. It is not a MAC: the HMAC at rest is what authenticates.

package/dist/tokens/api-token-codec.js

@@ -5,8 +5,8 @@ import { createTokenCodec } from './token-codec.js';
  * API token format: `selva_` + 30 base62 random chars + 6 base62 chars of
  * CRC32 over the random part. 42 chars total.
  *
- * - The prefix is what secret scanners match on; `sk_` was dropped because
- *   Stripe and OpenAI keys share it.
+ * - The prefix is what secret scanners match on. Not `sk_`: Stripe and OpenAI
+ *   keys use it.
  * - 30 base62 chars carry ~178 bits of entropy.
  * - The checksum lets the resolver reject a typo or a truncated paste without
  *   a store lookup. It is not a MAC: the HMAC at rest is what authenticates.

package/dist/tokens/api-token-holder.d.ts

@@ -1,12 +1,14 @@
-import type { RequestContext } from '@selvajs/platform';
+import { type RequestContext } from '@selvajs/platform';
 /**
  * Who may hold API tokens in the context's acting org, decided by the host.
+ * Without one, holding a key needs the platform permission `manage_api_tokens`.
  *
- * Without one, minting needs the platform permission `manage_api_tokens`. With
- * one, it replaces that check at mint, and the resolver re-asks it on every
- * request against the owner's live context in the token's org, so a key stops
- * working (403 `API_TOKEN_HOLDER_REFUSED`) the moment its owner no longer
- * qualifies, without being revoked.
+ * Asked at mint, and again by the resolver on every request against the
+ * owner's live context in the token's org, so a key stops working (403
+ * `API_TOKEN_HOLDER_REFUSED`) the moment its owner no longer qualifies,
+ * without being revoked.
  */
 export type ApiTokenHolderPolicy = (ctx: RequestContext) => boolean;
+/** The one place the "no policy means `manage_api_tokens`" default lives. */
+export declare function canHoldApiTokens(ctx: RequestContext, policy?: ApiTokenHolderPolicy): boolean;
 //# sourceMappingURL=api-token-holder.d.ts.map

package/dist/tokens/api-token-holder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-holder.d.ts","sourceRoot":"","sources":["../../src/tokens/api-token-holder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC"}
+{"version":3,"file":"api-token-holder.d.ts","sourceRoot":"","sources":["../../src/tokens/api-token-holder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC;AAEpE,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAE5F"}

package/dist/tokens/api-token-holder.js

@@ -1,2 +1,6 @@
-export {};
+import { hasPermission } from '@selvajs/platform';
+/** The one place the "no policy means `manage_api_tokens`" default lives. */
+export function canHoldApiTokens(ctx, policy) {
+    return policy ? policy(ctx) : hasPermission(ctx, 'manage_api_tokens');
+}
 //# sourceMappingURL=api-token-holder.js.map

package/dist/tokens/api-token-holder.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-holder.js","sourceRoot":"","sources":["../../src/tokens/api-token-holder.ts"],"names":[],"mappings":""}
+{"version":3,"file":"api-token-holder.js","sourceRoot":"","sources":["../../src/tokens/api-token-holder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAuB,MAAM,mBAAmB,CAAC;AAavE,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,MAA6B;IAClF,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AACvE,CAAC"}

package/dist/tokens/index.d.ts

@@ -1,4 +1,4 @@
 export { createTokenCodec, MIN_TOKEN_SECRET_LENGTH, type TokenCodec, type TokenCodecConfig } from './token-codec.js';
 export { createApiTokenCodec, API_TOKEN_PREFIX, looksLikeApiToken, type ApiTokenCodec } from './api-token-codec.js';
-export type { ApiTokenHolderPolicy } from './api-token-holder.js';
+export { canHoldApiTokens, type ApiTokenHolderPolicy } from './api-token-holder.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tokens/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/tokens/index.js

@@ -2,4 +2,5 @@
 export { createTokenCodec, MIN_TOKEN_SECRET_LENGTH } from './token-codec.js';
 // API tokens (`selva_`): the same HMAC-at-rest scheme, plus a checksum.
 export { createApiTokenCodec, API_TOKEN_PREFIX, looksLikeApiToken } from './api-token-codec.js';
+export { canHoldApiTokens } from './api-token-holder.js';
 //# sourceMappingURL=index.js.map

package/dist/tokens/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EAGvB,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EAGvB,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAA6B,MAAM,uBAAuB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/server",
-  "version": "1.5.0-beta.5",
+  "version": "1.5.0-beta.7",
   "description": "Transport-agnostic server building blocks for apps built on the Selva engine (limits, rate limiting, SSRF guard, remote-definition fetch, definition service + render loader); the solve core lives in @selvajs/solve/server",
   "license": "MIT",
   "author": "VektorNode",
@@ -41,6 +41,11 @@
       "types": "./dist/providers/index.d.ts",
       "import": "./dist/providers/index.js"
     },
+    "./oauth": {
+      "selva-source": "./src/oauth/index.ts",
+      "types": "./dist/oauth/index.d.ts",
+      "import": "./dist/oauth/index.js"
+    },
     "./tokens": {
       "selva-source": "./src/tokens/index.ts",
       "types": "./dist/tokens/index.d.ts",
@@ -111,8 +116,8 @@
   "dependencies": {
     "zod": "^4.6.5",
     "@selvajs/compute": "^4.2.2-beta.0",
-    "@selvajs/platform": "^0.21.0-beta.1",
-    "@selvajs/notifications": "^0.3.0-beta.1",
+    "@selvajs/notifications": "^0.3.0-beta.2",
+    "@selvajs/platform": "^0.21.0-beta.2",
     "@selvajs/schemas": "^5.2.0"
   },
   "peerDependencies": {
@@ -138,7 +143,7 @@
     "typescript": "~6.0.3",
     "vitest": "^5.0.2",
     "@selvajs/config": "0.0.4",
-    "@selvajs/local-provider": "0.16.0-beta.0"
+    "@selvajs/local-provider": "0.16.0-beta.1"
   },
   "scripts": {
     "build": "tsc",

package/dist/compute/idempotency-http.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"idempotency-http.d.ts","sourceRoot":"","sources":["../../src/compute/idempotency-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAElE;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,mEAAmE;AACnE,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAM7E;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAItF"}

package/dist/compute/idempotency-http.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"idempotency-http.js","sourceRoot":"","sources":["../../src/compute/idempotency-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAYlE;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,SAAiB;IACjE,OAAO,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAa;IACnD,OAAO;QACN,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,EAAE,MAAM,GAAG,CAAC,WAAW,EAAE;KAC7B,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,MAAsB,EAAE,QAAiB;IAC3E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC"}