@selvajs/server 2.0.0-beta.19 → 2.0.0-beta.20

package/dist/config/index.d.ts

@@ -0,0 +1,2 @@
+export { ENGINE_SETTINGS } from './settings.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/config/index.js

@@ -0,0 +1,2 @@
+export { ENGINE_SETTINGS } from './settings.js';
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC"}

package/dist/config/settings.d.ts

@@ -0,0 +1,2 @@
+export declare const ENGINE_SETTINGS: import("@selvajs/platform/config").Manifest;
+//# sourceMappingURL=settings.d.ts.map

package/dist/config/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/config/settings.ts"],"names":[],"mappings":"AAoCA,eAAO,MAAM,eAAe,6CAqS1B,CAAC"}

package/dist/config/settings.js

@@ -0,0 +1,261 @@
+import { composeManifest, defineSetting } from '@selvajs/platform/config';
+import { DEFAULT_API_RATE_LIMIT } from '../api/rate-limit.js';
+// Keys the engine reads, wherever the host app runs it. Providers declare their
+// own (`@selvajs/*-provider/config`); the host app declares what only it reads.
+const flag = (key, description, impact) => defineSetting({
+    key: `SELVA_FLAG_${key}`,
+    type: 'bool',
+    default: false,
+    onInvalid: 'fail',
+    class: 'setting',
+    description,
+    ...(impact ? { impact } : {})
+});
+const tunableInt = (key, fallback, description, extra = {}) => defineSetting({
+    key,
+    type: 'int',
+    min: 1,
+    default: fallback,
+    onInvalid: 'default',
+    class: 'tunable',
+    description,
+    ...extra
+});
+const MB = 1024 * 1024;
+export const ENGINE_SETTINGS = composeManifest([
+    // ── Wiring ───────────────────────────────────────────────────────────────
+    ...['AUTH', 'DATA', 'STORAGE'].map((slot) => defineSetting({
+        key: `SELVA_${slot}_PROVIDER`,
+        type: 'string',
+        default: 'local',
+        onInvalid: 'fail',
+        class: 'bootstrap',
+        summary: true,
+        description: `${slot.toLowerCase()} provider: local, supabase${slot === 'AUTH' ? ' or header' : ''}.`,
+        impact: 'Switching it does not move any data: the instance starts on what the new provider holds.'
+    })),
+    defineSetting({
+        key: 'SELVA_TENANCY',
+        type: 'enum',
+        values: ['single', 'multi'],
+        default: 'single',
+        onInvalid: 'fail',
+        class: 'bootstrap',
+        summary: true,
+        description: 'single: one org per deployment. multi: users create their own orgs.'
+    }),
+    defineSetting({
+        key: 'SELVA_CONFIG_PATH',
+        type: 'string',
+        onInvalid: 'fail',
+        class: 'bootstrap',
+        description: 'A selva.config.js that replaces env-driven provider wiring.'
+    }),
+    // ── Keys ─────────────────────────────────────────────────────────────────
+    defineSetting({
+        key: 'SELVA_HMAC_KEY',
+        type: 'string',
+        minLength: 32,
+        required: true,
+        onInvalid: 'fail',
+        class: 'secret',
+        sensitive: true,
+        generated: true,
+        summary: true,
+        description: 'Signs sessions (local auth), OAuth codes, MCP client ids and solve-event tokens.',
+        impact: 'Changing it without SELVA_HMAC_KEY_PREVIOUS breaks what it signed: run `selva keys rotate hmac`.'
+    }),
+    defineSetting({
+        key: 'SELVA_AT_REST_KEY',
+        type: 'key',
+        required: true,
+        onInvalid: 'fail',
+        class: 'secret',
+        sensitive: true,
+        generated: true,
+        summary: true,
+        description: 'Encrypts stored Rhino.Compute API keys.',
+        impact: 'Changing it without SELVA_AT_REST_KEY_PREVIOUS makes stored API keys unreadable: run `selva keys rotate at-rest`.'
+    }),
+    defineSetting({
+        key: 'SELVA_HMAC_KEY_PREVIOUS',
+        type: 'string',
+        minLength: 32,
+        onInvalid: 'fail',
+        class: 'secret',
+        sensitive: true,
+        generated: true,
+        summary: true,
+        description: 'The HMAC key before the last rotation. Still accepted for what it signed.',
+        impact: 'Removing it ends sessions, MCP clients and links signed before the rotation.'
+    }),
+    defineSetting({
+        key: 'SELVA_AT_REST_KEY_PREVIOUS',
+        type: 'key',
+        onInvalid: 'fail',
+        class: 'secret',
+        sensitive: true,
+        generated: true,
+        summary: true,
+        description: 'The encryption key before the last rotation. Stored API keys are re-sealed at boot.',
+        impact: 'Remove it only once /admin/system shows no API key on the previous key.'
+    }),
+    defineSetting({
+        key: 'SELVA_HMAC_KEY_PREVIOUS_EXPIRES',
+        type: 'string',
+        onInvalid: 'fail',
+        class: 'secret',
+        description: 'When SELVA_HMAC_KEY_PREVIOUS stops being accepted (ISO date). Set by `selva keys rotate`.',
+        impact: 'After it, anything only the previous key opens is refused. An unreadable date counts as passed.'
+    }),
+    defineSetting({
+        key: 'SELVA_AT_REST_KEY_PREVIOUS_EXPIRES',
+        type: 'string',
+        onInvalid: 'fail',
+        class: 'secret',
+        description: 'When SELVA_AT_REST_KEY_PREVIOUS stops being accepted (ISO date). Set by `selva keys rotate`.',
+        impact: 'After it, anything only the previous key opens is refused. An unreadable date counts as passed.'
+    }),
+    // ── Access ───────────────────────────────────────────────────────────────
+    defineSetting({
+        key: 'BOOTSTRAP_INSTANCE_ADMIN_EMAIL',
+        type: 'string',
+        onInvalid: 'fail',
+        class: 'bootstrap',
+        sensitive: true,
+        summary: true,
+        description: 'Only this address may claim instance admin while none exists. Break-glass recovery.'
+    }),
+    defineSetting({
+        key: 'SIGN_IN_MAX_AGE_DAYS',
+        type: 'int',
+        min: 0,
+        default: 0,
+        onInvalid: 'fail',
+        class: 'setting',
+        summary: true,
+        description: 'How long one sign-in at the identity provider lasts. 0 is off.',
+        impact: 'API tokens of anyone who has not signed in within this many days are revoked.'
+    }),
+    flag('ALLOW_ORG_CREATION', 'Self-service org creation (read by host apps).'),
+    flag('ALLOW_CROSS_ORG_PUBLIC', 'Public projects are visible to every signed-in user, not just the publishing org.', 'Turning it on widens who sees existing public projects.'),
+    flag('ALLOW_ORG_COMPUTE_OVERRIDE', 'Orgs may configure their own Rhino.Compute server.'),
+    flag('ENABLE_SHARING', 'Per-definition share links for anonymous access.', 'Turning it off stops every existing share link from resolving.'),
+    flag('ENABLE_PLATFORM_PROJECTS', 'Projects owned by instance admins and granted to orgs or users.'),
+    // ── Branding ─────────────────────────────────────────────────────────────
+    ...[
+        ['NAME', 'Product name in the header and titles.'],
+        ['COPYRIGHT_NAME', 'Footer copyright owner. Defaults to the brand name.'],
+        ['TAGLINE', 'Subtitle on the landing page.'],
+        ['DESCRIPTION', 'Meta description for search and link previews.']
+    ].map(([key, description]) => defineSetting({
+        key: `SELVA_BRAND_${key}`,
+        type: 'string',
+        onInvalid: 'fail',
+        class: 'setting',
+        description
+    })),
+    // ── Mail ─────────────────────────────────────────────────────────────────
+    defineSetting({
+        key: 'SMTP_HOST',
+        type: 'string',
+        onInvalid: 'fail',
+        class: 'setting',
+        description: 'SMTP server. Unset: invites return a link to send by hand.'
+    }),
+    defineSetting({
+        key: 'SMTP_PORT',
+        type: 'int',
+        min: 1,
+        max: 65535,
+        default: 587,
+        onInvalid: 'fail',
+        class: 'setting',
+        description: '587 for STARTTLS, 465 for implicit TLS.'
+    }),
+    defineSetting({
+        key: 'SMTP_USER',
+        type: 'string',
+        onInvalid: 'fail',
+        class: 'setting',
+        sensitive: true,
+        description: 'SMTP login.'
+    }),
+    defineSetting({
+        key: 'SMTP_PASS',
+        type: 'string',
+        onInvalid: 'fail',
+        class: 'secret',
+        sensitive: true,
+        description: 'SMTP password.'
+    }),
+    defineSetting({
+        key: 'SMTP_FROM',
+        type: 'string',
+        onInvalid: 'fail',
+        class: 'setting',
+        sensitive: true,
+        description: 'Sender address. Required once SMTP_HOST is set.'
+    }),
+    defineSetting({
+        key: 'SMTP_SECURE',
+        type: 'bool',
+        onInvalid: 'fail',
+        class: 'tunable',
+        description: 'Override the TLS mode inferred from the port.',
+        legacy: { bool: 'exact-true' }
+    }),
+    // ── Compute limits ───────────────────────────────────────────────────────
+    tunableInt('COMPUTE_SOLVE_DEADLINE_MS', 100_000, 'Longest one solve may run.', {
+        aliases: ['MAX_SOLVE_DURATION_MS'],
+        impact: 'Past the reverse proxy read timeout, solves fail there with a 502 instead.'
+    }),
+    tunableInt('COMPUTE_RATE_LIMIT_WINDOW_MS', 100_000, 'Compute rate-limit window.'),
+    tunableInt('COMPUTE_RATE_LIMIT_MAX', 120, 'Solves per user or share link per window.'),
+    tunableInt('MAX_DEFINITION_FILE_SIZE_BYTES', 50 * MB, 'Largest .gh upload.'),
+    tunableInt('MAX_IMAGE_FILE_SIZE_BYTES', 10 * MB, 'Largest cover image upload.'),
+    tunableInt('COMPUTE_REQUEST_MAX_BYTES', 256 * MB, 'Largest solve request body.', {
+        impact: 'Must stay at or below BODY_SIZE_LIMIT, or that limit rejects first.'
+    }),
+    tunableInt('COMPUTE_RESPONSE_MAX_BYTES', 300 * MB, 'Largest solve response body.'),
+    tunableInt('REMOTE_DEFINITION_FETCH_TIMEOUT_MS', 30_000, 'Deadline for fetching a remote .gh.'),
+    tunableInt('REMOTE_DEFINITION_CACHE_TTL_MS', 5 * 60 * 1000, 'How long remote .gh bytes stay cached.', {
+        aliases: ['DEFINITION_CACHE_TTL_MS']
+    }),
+    tunableInt('COMPUTE_MAX_QUEUE_DEPTH', 0, 'Solves allowed to wait per compute server. 0 is unbounded.', {
+        min: 0
+    }),
+    tunableInt('COMPUTE_QUEUE_WAIT_MS', 0, 'Longest a solve may wait queued. 0 is no deadline.', {
+        min: 0
+    }),
+    tunableInt('COMPUTE_DEFINITION_CACHE_MB', 256, 'Definition cache budget. 0 turns it off.', {
+        min: 0,
+        aliases: ['COMPUTE_DEFINITION_BYTE_CACHE_MB']
+    }),
+    tunableInt('COMPUTE_SOLVE_CACHE_MB', 256, 'Solve cache budget per warm compute server. 0 turns it off.', {
+        min: 0,
+        aliases: ['COMPUTE_RESPONSE_CACHE_MB']
+    }),
+    defineSetting({
+        key: 'COMPUTE_REUSE_DEFINITION_CACHE',
+        type: 'bool',
+        default: true,
+        onInvalid: 'default',
+        class: 'tunable',
+        description: 'Reuse the compute server’s cached definition instead of re-uploading it.',
+        impact: 'Leave on only with a compute server that reports a stale pointer (the VektorNode fork).'
+    }),
+    defineSetting({
+        key: 'COMPUTE_SERVER_CACHESOLVE',
+        type: 'bool',
+        default: true,
+        onInvalid: 'default',
+        class: 'tunable',
+        description: 'Ask Rhino.Compute to cache solve results server-side.'
+    }),
+    tunableInt('API_TOKEN_RATE_LIMIT_WINDOW_MS', DEFAULT_API_RATE_LIMIT.windowMs, 'API token rate-limit window.'),
+    tunableInt('API_TOKEN_RATE_LIMIT_MAX', DEFAULT_API_RATE_LIMIT.maxPerWindow, 'Requests per API token per window. 0 is off.', {
+        min: 0
+    })
+]);
+//# sourceMappingURL=settings.js.map

package/dist/config/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/config/settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,aAAa,EAAmB,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,WAAmB,EAAE,MAAe,EAAE,EAAE,CAClE,aAAa,CAAC;IACb,GAAG,EAAE,cAAc,GAAG,EAAE;IACxB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,KAAK;IACd,SAAS,EAAE,MAAM;IACjB,KAAK,EAAE,SAAS;IAChB,WAAW;IACX,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEJ,MAAM,UAAU,GAAG,CAClB,GAAW,EACX,QAAgB,EAChB,WAAmB,EACnB,QAAiE,EAAE,EAClE,EAAE,CACH,aAAa,CAAC;IACb,GAAG;IACH,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,CAAC;IACN,OAAO,EAAE,QAAQ;IACjB,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,SAAS;IAChB,WAAW;IACX,GAAG,KAAK;CACR,CAAC,CAAC;AAEJ,MAAM,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvB,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;IAC9C,4EAA4E;IAC5E,GAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtD,aAAa,CAAC;QACb,GAAG,EAAE,SAAS,IAAI,WAAW;QAC7B,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,6BAA6B,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG;QACrG,MAAM,EACL,0FAA0F;KAC3F,CAAC,CACF;IACD,aAAa,CAAC;QACb,GAAG,EAAE,eAAe;QACpB,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,qEAAqE;KAClF,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,mBAAmB;QACxB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE,6DAA6D;KAC1E,CAAC;IAEF,4EAA4E;IAC5E,aAAa,CAAC;QACb,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,kFAAkF;QAC/F,MAAM,EACL,kGAAkG;KACnG,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,mBAAmB;QACxB,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,yCAAyC;QACtD,MAAM,EACL,mHAAmH;KACpH,CAAC;IAEF,aAAa,CAAC;QACb,GAAG,EAAE,yBAAyB;QAC9B,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,2EAA2E;QACxF,MAAM,EAAE,8EAA8E;KACtF,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,4BAA4B;QACjC,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,WAAW,EACV,qFAAqF;QACtF,MAAM,EAAE,yEAAyE;KACjF,CAAC;IAEF,aAAa,CAAC;QACb,GAAG,EAAE,iCAAiC;QACtC,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,QAAQ;QACf,WAAW,EACV,2FAA2F;QAC5F,MAAM,EACL,iGAAiG;KAClG,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,oCAAoC;QACzC,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,QAAQ;QACf,WAAW,EACV,8FAA8F;QAC/F,MAAM,EACL,iGAAiG;KAClG,CAAC;IAEF,4EAA4E;IAC5E,aAAa,CAAC;QACb,GAAG,EAAE,gCAAgC;QACrC,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,WAAW;QAClB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,WAAW,EACV,qFAAqF;KACtF,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,sBAAsB;QAC3B,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,CAAC;QACN,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,gEAAgE;QAC7E,MAAM,EAAE,+EAA+E;KACvF,CAAC;IACF,IAAI,CAAC,oBAAoB,EAAE,gDAAgD,CAAC;IAC5E,IAAI,CACH,wBAAwB,EACxB,mFAAmF,EACnF,yDAAyD,CACzD;IACD,IAAI,CAAC,4BAA4B,EAAE,oDAAoD,CAAC;IACxF,IAAI,CACH,gBAAgB,EAChB,kDAAkD,EAClD,gEAAgE,CAChE;IACD,IAAI,CACH,0BAA0B,EAC1B,iEAAiE,CACjE;IAED,4EAA4E;IAC5E,GACC;QACC,CAAC,MAAM,EAAE,wCAAwC,CAAC;QAClD,CAAC,gBAAgB,EAAE,qDAAqD,CAAC;QACzE,CAAC,SAAS,EAAE,+BAA+B,CAAC;QAC5C,CAAC,aAAa,EAAE,gDAAgD,CAAC;KAElE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,CAC5B,aAAa,CAAC;QACb,GAAG,EAAE,eAAe,GAAG,EAAE;QACzB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,SAAS;QAChB,WAAW;KACX,CAAC,CACF;IAED,4EAA4E;IAC5E,aAAa,CAAC;QACb,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,4DAA4D;KACzE,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,CAAC;QACN,GAAG,EAAE,KAAK;QACV,OAAO,EAAE,GAAG;QACZ,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,yCAAyC;KACtD,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,aAAa;KAC1B,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,gBAAgB;KAC7B,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,SAAS;QAChB,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,iDAAiD;KAC9D,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,+CAA+C;QAC5D,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE;KAC9B,CAAC;IAEF,4EAA4E;IAC5E,UAAU,CAAC,2BAA2B,EAAE,OAAO,EAAE,4BAA4B,EAAE;QAC9E,OAAO,EAAE,CAAC,uBAAuB,CAAC;QAClC,MAAM,EAAE,4EAA4E;KACpF,CAAC;IACF,UAAU,CAAC,8BAA8B,EAAE,OAAO,EAAE,4BAA4B,CAAC;IACjF,UAAU,CAAC,wBAAwB,EAAE,GAAG,EAAE,2CAA2C,CAAC;IACtF,UAAU,CAAC,gCAAgC,EAAE,EAAE,GAAG,EAAE,EAAE,qBAAqB,CAAC;IAC5E,UAAU,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,EAAE,6BAA6B,CAAC;IAC/E,UAAU,CAAC,2BAA2B,EAAE,GAAG,GAAG,EAAE,EAAE,6BAA6B,EAAE;QAChF,MAAM,EAAE,qEAAqE;KAC7E,CAAC;IACF,UAAU,CAAC,4BAA4B,EAAE,GAAG,GAAG,EAAE,EAAE,8BAA8B,CAAC;IAClF,UAAU,CAAC,oCAAoC,EAAE,MAAM,EAAE,qCAAqC,CAAC;IAC/F,UAAU,CACT,gCAAgC,EAChC,CAAC,GAAG,EAAE,GAAG,IAAI,EACb,wCAAwC,EACxC;QACC,OAAO,EAAE,CAAC,yBAAyB,CAAC;KACpC,CACD;IACD,UAAU,CACT,yBAAyB,EACzB,CAAC,EACD,4DAA4D,EAC5D;QACC,GAAG,EAAE,CAAC;KACN,CACD;IACD,UAAU,CAAC,uBAAuB,EAAE,CAAC,EAAE,oDAAoD,EAAE;QAC5F,GAAG,EAAE,CAAC;KACN,CAAC;IACF,UAAU,CAAC,6BAA6B,EAAE,GAAG,EAAE,0CAA0C,EAAE;QAC1F,GAAG,EAAE,CAAC;QACN,OAAO,EAAE,CAAC,kCAAkC,CAAC;KAC7C,CAAC;IACF,UAAU,CACT,wBAAwB,EACxB,GAAG,EACH,6DAA6D,EAC7D;QACC,GAAG,EAAE,CAAC;QACN,OAAO,EAAE,CAAC,2BAA2B,CAAC;KACtC,CACD;IACD,aAAa,CAAC;QACb,GAAG,EAAE,gCAAgC;QACrC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,0EAA0E;QACvF,MAAM,EACL,yFAAyF;KAC1F,CAAC;IACF,aAAa,CAAC;QACb,GAAG,EAAE,2BAA2B;QAChC,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,uDAAuD;KACpE,CAAC;IACF,UAAU,CACT,gCAAgC,EAChC,sBAAsB,CAAC,QAAQ,EAC/B,8BAA8B,CAC9B;IACD,UAAU,CACT,0BAA0B,EAC1B,sBAAsB,CAAC,YAAY,EACnC,8CAA8C,EAC9C;QACC,GAAG,EAAE,CAAC;KACN,CACD;CACD,CAAC,CAAC"}

package/dist/handlers/shareLinks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shareLinks.d.ts","sourceRoot":"","sources":["../../src/handlers/shareLinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AAsB9D,eAAO,MAAM,cAAc,EAAE,UAU5B,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UA8B7B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,UAc7B,CAAC"}
+{"version":3,"file":"shareLinks.d.ts","sourceRoot":"","sources":["../../src/handlers/shareLinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgBH,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,iBAAiB,CAAC;AA0B9D,eAAO,MAAM,cAAc,EAAE,UAU5B,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UAkC7B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,UAc7B,CAAC"}

package/dist/handlers/shareLinks.js

@@ -12,7 +12,7 @@
  */
 import { randomUUID } from 'node:crypto';
 import { apiError, ApiErrorCode, CreatedShareLinkResponseSchema, noContent, parseBody, parseListOptions, parseParam, requireCaller, shaped, shapedCollection, ShareLinkResponseSchema } from '../api/index.js';
-import { CreateShareLinkInputSchema, DEFAULT_SHARE_LINK_MAX_SOLVES } from '@selvajs/platform';
+import { CreateShareLinkInputSchema, DEFAULT_SHARE_LINK_MAX_SOLVES, DEFAULT_SHARE_LINK_TTL_DAYS } from '@selvajs/platform';
 import { GuidSchema } from '@selvajs/platform/definitions';
 import { requireEditableDefinition } from '../access/index.js';
 import { tokenCodec } from './services.js';
@@ -51,7 +51,10 @@ export const createShareLink = async (req) => {
         name: input.name,
         createdBy: user.id,
         createdAt: new Date().toISOString(),
-        expiresAt: input.expiresAt ?? null,
+        // Same rule as maxSolves: absent gets the default, an explicit null never expires.
+        expiresAt: input.expiresAt === undefined
+            ? new Date(Date.now() + DEFAULT_SHARE_LINK_TTL_DAYS * 86_400_000).toISOString()
+            : input.expiresAt,
         revokedAt: null,
         allowSolve: input.allowSolve,
         // The default applies only when the field is absent. An explicit `null`

package/dist/handlers/shareLinks.js.map

@@ -1 +1 @@
-{"version":3,"file":"shareLinks.js","sourceRoot":"","sources":["../../src/handlers/shareLinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,8BAA8B,EAC9B,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,MAAM,EACN,gBAAgB,EAChB,uBAAuB,EACvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAE9F,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,SAAS,oBAAoB,CAAC,GAAe;IAC5C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtC,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,6DAA6D,CAC7D,CAAC;IACH,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,IAAe;IACjC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,gBAAgB,CAAC,uBAAuB,EAAE;QAChD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAE1F,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,IAAI,GAAc;QACvB,EAAE,EAAE,UAAU,EAAE;QAChB,YAAY,EAAE,IAAI;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,wEAAwE;QACxE,mDAAmD;QACnD,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;QAC1F,UAAU,EAAE,CAAC;KACb,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,+EAA+E;IAC/E,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAC3F,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAEpE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACjD,4EAA4E;QAC5E,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}
+{"version":3,"file":"shareLinks.js","sourceRoot":"","sources":["../../src/handlers/shareLinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,QAAQ,EACR,YAAY,EACZ,8BAA8B,EAC9B,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,MAAM,EACN,gBAAgB,EAChB,uBAAuB,EACvB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,SAAS,oBAAoB,CAAC,GAAe;IAC5C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACtC,QAAQ,CACP,GAAG,EACH,YAAY,CAAC,SAAS,EACtB,6DAA6D,CAC7D,CAAC;IACH,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,IAAe;IACjC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACvD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9F,OAAO,gBAAgB,CAAC,uBAAuB,EAAE;QAChD,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QAChC,UAAU,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,0BAA0B,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAE1F,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC;IACjC,MAAM,IAAI,GAAc;QACvB,EAAE,EAAE,UAAU,EAAE;QAChB,YAAY,EAAE,IAAI;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,IAAI,CAAC,EAAE;QAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,mFAAmF;QACnF,SAAS,EACR,KAAK,CAAC,SAAS,KAAK,SAAS;YAC5B,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,2BAA2B,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;YAC/E,CAAC,CAAC,KAAK,CAAC,SAAS;QACnB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,wEAAwE;QACxE,mDAAmD;QACnD,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;QAC1F,UAAU,EAAE,CAAC;KACb,CAAC;IAEF,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,+EAA+E;IAC/E,OAAO,MAAM,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AAC3F,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAe,KAAK,EAAE,GAAG,EAAE,EAAE;IACxD,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAEpE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACjD,4EAA4E;QAC5E,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,SAAS,EAAE,CAAC;AACpB,CAAC,CAAC"}

package/dist/http/api-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.d.ts","sourceRoot":"","sources":["../../src/http/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,EACb,OAAO,EACP,cAAc,EACd,UAAU,EACV,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAGN,KAAK,aAAa,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAoB,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAI5F,MAAM,MAAM,kBAAkB;AAC7B,2EAA2E;AACzE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE;AACtE,0EAA0E;GACxE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,MAAM,WAAW,mBAAmB;IACnC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,kBAAkB,CAAC,CAAC;IAC1D,IAAI,EAAE,IAAI,CACT,aAAa,EACb,WAAW,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,uBAAuB,GAAG,aAAa,CAC3F,CAAC;IACF,qHAAqH;IACrH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;OAGG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,UAAU,KAAK,OAAO,CAAC;IAC3C;;;OAGG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AA0BD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,mBAAmB,EACzB,EAAE,UAAuB,EAAE,GAAE,sBAA2B,GACtD,OAAO,CAAC,kBAAkB,CAAC,CAqG7B;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,SAAS,EAAE,UAAU,SAAS,GAAG,kBAAkB,CAoBhG;AAED,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKxD"}
+{"version":3,"file":"api-token.d.ts","sourceRoot":"","sources":["../../src/http/api-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,aAAa,EACb,OAAO,EACP,cAAc,EACd,UAAU,EACV,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAGN,KAAK,aAAa,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAoB,KAAK,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAK5F,MAAM,MAAM,kBAAkB;AAC7B,2EAA2E;AACzE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE;AACtE,0EAA0E;GACxE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,MAAM,WAAW,mBAAmB;IACnC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,kBAAkB,CAAC,CAAC;IAC1D,IAAI,EAAE,IAAI,CACT,aAAa,EACb,WAAW,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,uBAAuB,GAAG,aAAa,CAC3F,CAAC;IACF,qHAAqH;IACrH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;OAGG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,UAAU,KAAK,OAAO,CAAC;IAC3C;;;OAGG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACtC,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AA0BD;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,mBAAmB,EACzB,EAAE,UAAuB,EAAE,GAAE,sBAA2B,GACtD,OAAO,CAAC,kBAAkB,CAAC,CAqG7B;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,SAAS,EAAE,UAAU,SAAS,GAAG,kBAAkB,CAoBhG;AAED,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKxD"}

package/dist/http/api-token.js

@@ -2,6 +2,7 @@ import { SYSTEM_CONTEXT, narrowApiTokenContext } from '@selvajs/platform';
 import { ApiErrorCode } from '../api/errors.js';
 import { API_TOKEN_PREFIX, looksLikeApiToken } from '../tokens/api-token-codec.js';
 import { canHoldApiTokens } from '../tokens/api-token-holder.js';
+import { findByToken } from '../tokens/token-codec.js';
 import { buildRequestContext } from './request-context.js';
 import { signInIsStale } from './sign-in-age.js';
 /** `lastUsedAt` is written at most this often per token, so a busy key isn't a write per request. */
@@ -68,7 +69,7 @@ export async function resolveApiToken(request, deps, { pathPrefix = '/api/v1/' }
         return UNAVAILABLE;
     if (!deps.codec.hasValidChecksum(raw))
         return UNAUTHORIZED;
-    const token = await store.getByTokenHash(SYSTEM_CONTEXT, deps.codec.hashToken(raw));
+    const token = await findByToken(deps.codec, raw, (h) => store.getByTokenHash(SYSTEM_CONTEXT, h));
     if (!token)
         return UNAUTHORIZED;
     const [user, member, platformPermissions] = await Promise.all([

package/dist/http/api-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../../src/http/api-token.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACN,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAA6B,MAAM,+BAA+B,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA6CjD,qGAAqG;AACrG,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,YAAY,GAAuB;IACxC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,YAAY;IAC/B,OAAO,EAAE,gDAAgD;CACzD,CAAC;AAEF,MAAM,WAAW,GAAuB;IACvC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,sBAAsB;IACzC,OAAO,EAAE,8CAA8C;CACvD,CAAC;AAEF,MAAM,cAAc,GAAuB;IAC1C,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,wBAAwB;IAC3C,OAAO,EAAE,kEAAkE;CAC3E,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,OAAgB,EAChB,IAAyB,EACzB,EAAE,UAAU,GAAG,UAAU,KAA6B,EAAE;IAExD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,YAAY,CAAC,iBAAiB;gBACpC,OAAO,EACN,qHAAqH;aACtH,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEhE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,OAAO;YACN,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,YAAY,CAAC,SAAS;YAC5B,OAAO,EAAE,8BAA8B,UAAU,GAAG;SACpD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,WAAW,CAAC;IAE9C,yDAAyD;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC7C,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IAEpE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,CAAC;IAEhC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;QACtE,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC;KAC1D,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5E,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,qCAAqC,EAAE;gBACrD,SAAS,EAAE,UAAU;gBACrB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACrD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,mBAAmB,CACrC,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAC/D,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CACxB,CAAC;IACF,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,cAAc,GACnB,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC;IAC7F,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;YACxD,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,IAAI,EAAE;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACpB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB;gBACtD,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;gBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;aAChC;SACD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,cAAc,CAAC;QAClC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE7C,oEAAoE;IACpE,kDAAkD;IAClD,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3E,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,2BAA2B,EAAE,CAAC;QAC5F,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACxF,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,gCAAgC,EAAE;gBAChD,SAAS,EAAE,UAAU;gBACrB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACrD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAK,GAAG,MAAM,EAAE,UAAU,GAAG,MAAM;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,OAAO;QACN,MAAM,CAAC,OAAO,EAAE,GAAG;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,IAAI,MAAM,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,OAAO,EAAE,GAAG;YACpB,IAAI,KAAK,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,KAAK;oBAAE,IAAI,MAAM,IAAI,GAAG;wBAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACtE,sDAAsD;gBACtD,IAAI,KAAK,CAAC,IAAI,IAAI,UAAU;oBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;YACxE,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;QACjC,CAAC;KACD,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,QAAQ,CAAC,OAAgB;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}
+{"version":3,"file":"api-token.js","sourceRoot":"","sources":["../../src/http/api-token.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACN,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAA6B,MAAM,+BAA+B,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA6CjD,qGAAqG;AACrG,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,MAAM,YAAY,GAAuB;IACxC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,YAAY;IAC/B,OAAO,EAAE,gDAAgD;CACzD,CAAC;AAEF,MAAM,WAAW,GAAuB;IACvC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,sBAAsB;IACzC,OAAO,EAAE,8CAA8C;CACvD,CAAC;AAEF,MAAM,cAAc,GAAuB;IAC1C,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,YAAY,CAAC,wBAAwB;IAC3C,OAAO,EAAE,kEAAkE;CAC3E,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,OAAgB,EAChB,IAAyB,EACzB,EAAE,UAAU,GAAG,UAAU,KAA6B,EAAE;IAExD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/C,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,YAAY,CAAC,iBAAiB;gBACpC,OAAO,EACN,qHAAqH;aACtH,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEhE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,OAAO;YACN,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,YAAY,CAAC,SAAS;YAC5B,OAAO,EAAE,8BAA8B,UAAU,GAAG;SACpD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,WAAW,CAAC;IAE9C,yDAAyD;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC7C,IAAI,SAAS,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC;IAEpE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,CAAC;IAEhC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;QACtE,+EAA+E;QAC/E,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC;KAC1D,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;QAC/D,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5E,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,qCAAqC,EAAE;gBACrD,SAAS,EAAE,UAAU;gBACrB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACrD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,mBAAmB,CACrC,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAC/D,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CACxB,CAAC;IACF,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,cAAc,GACnB,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC;IAC7F,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;YACxD,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,IAAI,EAAE;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACpB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB;gBACtD,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;gBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;aAChC;SACD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,cAAc,CAAC;QAClC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE7C,oEAAoE;IACpE,kDAAkD;IAClD,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3E,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,2BAA2B,EAAE,CAAC;QAC5F,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACxF,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,gCAAgC,EAAE;gBAChD,SAAS,EAAE,UAAU;gBACrB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACrD,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAK,GAAG,MAAM,EAAE,UAAU,GAAG,MAAM;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,OAAO;QACN,MAAM,CAAC,OAAO,EAAE,GAAG;YAClB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,IAAI,MAAM,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,OAAO,EAAE,GAAG;YACpB,IAAI,KAAK,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,KAAK;oBAAE,IAAI,MAAM,IAAI,GAAG;wBAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACtE,sDAAsD;gBACtD,IAAI,KAAK,CAAC,IAAI,IAAI,UAAU;oBAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;YACxE,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;QACjC,CAAC;KACD,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,QAAQ,CAAC,OAAgB;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/notifications/smtp-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"smtp-config.d.ts","sourceRoot":"","sources":["../../src/notifications/smtp-config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;CACb;AAED,kGAAkG;AAClG,MAAM,WAAW,OAAO;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAOD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAsB9D"}
+{"version":3,"file":"smtp-config.d.ts","sourceRoot":"","sources":["../../src/notifications/smtp-config.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,IAAI,EAAE,MAAM,CAAC;CACb;AAED,kGAAkG;AAClG,MAAM,WAAW,OAAO;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IAKrB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAOD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAuB9D"}

package/dist/notifications/smtp-config.js

@@ -1,3 +1,4 @@
+import { readBool } from '../compute/limits.js';
 function parsePort(raw) {
     const n = Number(raw ?? 587);
     return Number.isInteger(n) && n > 0 && n < 65536 ? n : 587;
@@ -32,8 +33,9 @@ export function readSmtpConfig(env) {
         host,
         port,
         // Port 465 is implicit TLS; 587 and 25 start plaintext and upgrade via
-        // STARTTLS, which nodemailer does on its own when `secure` is false.
-        secure: env.SMTP_SECURE ? env.SMTP_SECURE === 'true' : port === 465,
+        // STARTTLS, which nodemailer does on its own when `secure` is false. Parsed
+        // with the manifest's boolean words, so what `selva config show` reports runs.
+        secure: readBool({ SMTP_SECURE: env.SMTP_SECURE }, 'SMTP_SECURE', port === 465),
         auth: user && pass ? { user, pass } : undefined,
         from
     };

package/dist/notifications/smtp-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"smtp-config.js","sourceRoot":"","sources":["../../src/notifications/smtp-config.ts"],"names":[],"mappings":"AAuBA,SAAS,SAAS,CAAC,GAAuB;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC;IAE3B,OAAO;QACN,IAAI;QACJ,IAAI;QACJ,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG;QACnE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/C,IAAI;KACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"smtp-config.js","sourceRoot":"","sources":["../../src/notifications/smtp-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAyBhD,SAAS,SAAS,CAAC,GAAuB;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC;IAE3B,OAAO;QACN,IAAI;QACJ,IAAI;QACJ,uEAAuE;QACvE,4EAA4E;QAC5E,+EAA+E;QAC/E,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,KAAK,GAAG,CAAC;QAC/E,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC/C,IAAI;KACJ,CAAC;AACH,CAAC"}

package/dist/oauth/index.d.ts

@@ -68,8 +68,10 @@ export interface Grant {
 export interface OAuthServerOptions {
     /** This instance's origin, e.g. `https://selva.example.com`. */
     origin: string;
-    /** `SELVA_HMAC_KEY`. Rotating it invalidates registered clients and live codes. */
+    /** `SELVA_HMAC_KEY`. Signs client ids and seals codes. */
     secret: string;
+    /** The key before the last rotation: client ids and codes it made still verify. */
+    previousSecret?: string;
     /**
      * Fetches a Client ID Metadata Document. The URL comes from an unknown client,
      * so the host must guard it against SSRF. Without it, URL client ids are refused.

package/dist/oauth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,yEAAyE;AACzE,eAAO,MAAM,YAAY,yDAA0D,CAAC;AACpF,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,4BAA6D,CAAC;AAEnG,sGAAsG;AACtG,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAYzD,eAAO,MAAM,QAAQ,SAAS,CAAC;AAE/B,eAAO,MAAM,WAAW,QAAS,CAAC;AAUlC,qBAAa,UAAW,SAAQ,KAAK;IAEnC,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAEtB,QAAQ,CAAC,MAAM;;IAHf,kCAAkC;IACzB,KAAK,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACV,MAAM,SAAM;IAMtB,MAAM,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;CAGtD;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;CAC9B;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,oEAAoE;AACpE,MAAM,WAAW,KAAK;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD;;;OAGG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,UAAU,UAAU;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAMD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,iEAAiE;AACjE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM;;;;;EAOvD;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;EAczD;AAMD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB;sBAgBnC,OAAO,KAAG,UAAU;8BA2BN,MAAM,KAAG,OAAO,CAAC,WAAW,CAAC;mCA0DxB,eAAe,KAAG,OAAO,CAAC,gBAAgB,CAAC;uBA+B7D,gBAAgB,SAAS,KAAK,KAAG,MAAM;oBAW1C,gBAAgB,KAAG,MAAM;qBAYxB,eAAe,KAAG,UAAU;;;;;;;;;;;;;;;;;;;;EAuEpD;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE/D,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,EAAE,CAEpE;AAiDD,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpC,MAAM,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,aAAa,EAAE,CAK7E;AA8BD,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAoB9E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,yEAAyE;AACzE,eAAO,MAAM,YAAY,yDAA0D,CAAC;AACpF,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,4BAA6D,CAAC;AAEnG,sGAAsG;AACtG,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAYzD,eAAO,MAAM,QAAQ,SAAS,CAAC;AAE/B,eAAO,MAAM,WAAW,QAAS,CAAC;AAUlC,qBAAa,UAAW,SAAQ,KAAK;IAEnC,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAEtB,QAAQ,CAAC,MAAM;;IAHf,kCAAkC;IACzB,KAAK,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACV,MAAM,SAAM;IAMtB,MAAM,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE;CAGtD;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,4DAA4D;IAC5D,OAAO,EAAE,OAAO,CAAC;IACjB,4DAA4D;IAC5D,MAAM,EAAE,SAAS,UAAU,EAAE,CAAC;CAC9B;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,oEAAoE;AACpE,MAAM,WAAW,KAAK;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD;;;OAGG;IACH,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,UAAU,UAAU;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAMD,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,iEAAiE;AACjE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM;;;;;EAOvD;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;;EAczD;AAMD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB;sBAmBnC,OAAO,KAAG,UAAU;8BA2BN,MAAM,KAAG,OAAO,CAAC,WAAW,CAAC;mCA4DxB,eAAe,KAAG,OAAO,CAAC,gBAAgB,CAAC;uBA+B7D,gBAAgB,SAAS,KAAK,KAAG,MAAM;oBAW1C,gBAAgB,KAAG,MAAM;qBAYxB,eAAe,KAAG,UAAU;;;;;;;;;;;;;;;;;;;;EAwEpD;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE/D,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,EAAE,CAEpE;AAiDD,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpC,MAAM,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,GAAG,aAAa,EAAE,CAK7E;AA8BD,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAoB9E"}

package/dist/oauth/index.js

@@ -104,6 +104,9 @@ export function createOAuthServer(options) {
     const now = options.now ?? Date.now;
     const signKey = derive(options.secret, 'selva-oauth-client');
     const codeKey = derive(options.secret, `selva-oauth-code:${origin}`);
+    const previous = options.previousSecret;
+    const previousSignKey = previous ? derive(previous, 'selva-oauth-client') : undefined;
+    const previousCodeKey = previous ? derive(previous, `selva-oauth-code:${origin}`) : undefined;
     const redeemed = options.redeemedCodes ?? new Map();
     const metadataCache = new Map();
     // ==========================================================================
@@ -147,7 +150,8 @@ export function createOAuthServer(options) {
     }
     function registeredClient(clientId) {
         const [payload, signature] = clientId.slice('dcr_'.length).split('.');
-        if (!payload || !signature || !safeEqual(signature, sign(signKey, payload))) {
+        const signedBy = (key) => key !== undefined && safeEqual(signature, sign(key, payload));
+        if (!payload || !signature || !(signedBy(signKey) || signedBy(previousSignKey))) {
             throw new OAuthError('invalid_client', 'Unknown client.');
         }
         const meta = JSON.parse(unb64(payload));
@@ -249,7 +253,8 @@ export function createOAuthServer(options) {
                 throw new OAuthError('unsupported_grant_type', 'Only authorization_code is supported.');
             }
             const code = form.get('code') ?? '';
-            const sealed = open(codeKey, code);
+            const sealed = (open(codeKey, code) ??
+                (previousCodeKey ? open(previousCodeKey, code) : null));
             if (!sealed || sealed.x < now()) {
                 throw new OAuthError('invalid_grant', 'The code is invalid or expired.');
             }

package/dist/oauth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,EACR,WAAW,EACX,eAAe,EACf,MAAM,aAAa,CAAC;AAErB,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAU,CAAC;AAGpF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,CAA0C,CAAC;AAEnG,sGAAsG;AACtG,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,kBAAkB,GAAgB;IACvC,QAAQ,EAAE,qBAAqB;IAC/B,IAAI,EAAE,uBAAuB;IAC7B,YAAY,EAAE,CAAC,2BAA2B,CAAC;IAC3C,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC;CAC7C,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE/B,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,gFAAgF;AAChF,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,MAAM,OAAO,UAAW,SAAQ,KAAK;IAG1B;IAEA;IAJV;IACC,kCAAkC;IACzB,KAAa,EACtB,WAAmB,EACV,SAAS,GAAG;QAErB,KAAK,CAAC,WAAW,CAAC,CAAC;QAJV,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAM;QAGrB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC1B,CAAC;IAED,MAAM;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;CACD;AAwDD,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,MAAM,UAAU,cAAc,CAAC,MAAc;IAC5C,OAAO,MAAM,GAAG,QAAQ,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IACjD,OAAO,GAAG,MAAM,wCAAwC,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACvD,OAAO;QACN,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC;QAChC,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,wBAAwB,CAAC;QAC/C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACpC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACzD,OAAO;QACN,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;QAC7C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,qCAAqC,EAAE,IAAI;QAC3C,8CAA8C,EAAE,IAAI;KACpD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,MAAM,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,GAAG,EAAkB,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IAEJ,6EAA6E;IAC7E,UAAU;IACV,6EAA6E;IAE7E,kFAAkF;IAClF,SAAS,QAAQ,CAAC,KAAc;QAC/B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAuD,CAAC;YACjF,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,OAAO,GAAG,GAAG,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAChF,CAAC;YACF,MAAM,QAAQ,GAAG,OAAO,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACL,SAAS,EAAE,QAAQ;oBACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBAC7C,WAAW,EAAE,IAAI,IAAI,SAAS;oBAC9B,aAAa,EAAE,YAAY;oBAC3B,WAAW,EAAE,CAAC,oBAAoB,CAAC;oBACnC,cAAc,EAAE,CAAC,MAAM,CAAC;oBACxB,0BAA0B,EAAE,MAAM;iBAClC;aACD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,QAAgB;QAC5C,IAAI,QAAQ,KAAK,qBAAqB;YAAE,OAAO,kBAAkB,CAAC;QAClE,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,SAAS,gBAAgB,CAAC,QAAgB;QACzC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAA+B,CAAC;QACtE,OAAO;YACN,QAAQ;YACR,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,eAAe;YAC/B,YAAY,EAAE,IAAI,CAAC,CAAC;YACpB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,wBAAwB;SAChC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,GAAW;QACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,WAAW;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC;YAChF,IAAI,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,mBAAmB;gBAAE,MAAM,MAAM,CAAC,OAAO,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACpE,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC5C,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,QAAQ,CAAC,GAAW,EAAE,KAA8C;QAC5E,IAAI,aAAa,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YAC1C,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QAC1D,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,gBAAgB;IAChB,6EAA6E;IAE7E;;;;OAIG;IACH,KAAK,UAAU,qBAAqB,CAAC,KAAsB;QAC1D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,qDAAqD,CACrD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,IAAI,UAAU,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;YACrE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;YACN,MAAM;YACN,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YACtC,aAAa;YACb,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;YACtD,QAAQ;SACR,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,SAAS,OAAO,CAAC,OAAyB,EAAE,KAAY;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE;YAC1B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YAC1B,CAAC,EAAE,OAAO,CAAC,WAAW;YACtB,CAAC,EAAE,OAAO,CAAC,aAAa;YACxB,CAAC,EAAE,GAAG,EAAE,GAAG,WAAW;YACtB,CAAC,EAAE,KAAK;SACR,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,SAAS,IAAI,CAAC,OAAyB;QACtC,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;YACtC,KAAK,EAAE,eAAe;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,MAAM;SACX,CAAC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAE7E,SAAS,QAAQ,CAAC,IAAqB;QACtC,IAAI,CAAC;YACJ,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,EAAE,CAAC;gBACrD,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAMzB,CAAC;YACT,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC;YACrB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACL,YAAY,EAAE,CAAC,CAAC,MAAM;oBACtB,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;iBACzB;aACD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;QACpD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,SAAS,cAAc,CAAC,QAAgB;QACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACN,QAAQ;QACR,aAAa;QACb,qBAAqB;QACrB,OAAO;QACP,IAAI;QACJ,QAAQ;QACR,yBAAyB,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAClE,2BAA2B,EAAE,GAAG,EAAE,CAAC,2BAA2B,CAAC,MAAM,CAAC;KACtE,CAAC;AACH,CAAC;AAID,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,MAA6B;IACzD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,KAAK,UAAU,YAAY,CAC1B,GAAW,EACX,mBAAsD;IAEtD,IAAI,GAA4E,CAAC;IACjF,IAAI,CAAC;QACJ,GAAG,GAAG,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAe,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,EAAE,SAAS,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,GAAG;QACb,IAAI,EACH,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YAC5D,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;YAClD,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI;QACrB,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;QAClD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,wBAAwB;KAChC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,GAAkB,EAAE,OAA8B;IACtE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CACpD,OAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC1C,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAA6B;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACrF,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAChF,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,6DAA6D,CAC7D,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,KAAiB,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACrC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CACN,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAC3F,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,IAAI,CAAC;QACJ,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAAiB;IACpE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAM,EAAE,CAAM,CAAC;IACnB,IAAI,CAAC;QACJ,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CACN,CAAC,CAAC,QAAQ,KAAK,OAAO;QACtB,CAAC,CAAC,QAAQ,KAAK,OAAO;QACtB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9B,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,CAAC,IAAI;QACP,CAAC,CAAC,CAAC,QAAQ;QACX,CAAC,CAAC,CAAC,QAAQ,CACX,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,MAA0C;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY;IACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,KAAc;IACxC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,MAAc;IACxC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7C,qFAAqF;QACrF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YAC1E,aAAa,EAAE,EAAE;SACjB,CAAC,CAAC;QACH,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACN,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,EACR,WAAW,EACX,eAAe,EACf,MAAM,aAAa,CAAC;AAErB,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAU,CAAC;AAGpF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,MAAM,EAAE,OAAO,CAA0C,CAAC;AAEnG,sGAAsG;AACtG,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,kBAAkB,GAAgB;IACvC,QAAQ,EAAE,qBAAqB;IAC/B,IAAI,EAAE,uBAAuB;IAC7B,YAAY,EAAE,CAAC,2BAA2B,CAAC;IAC3C,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,iBAAiB,CAAC;CAC7C,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE/B,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC;AAChC,gFAAgF;AAChF,4DAA4D;AAC5D,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,MAAM,OAAO,UAAW,SAAQ,KAAK;IAG1B;IAEA;IAJV;IACC,kCAAkC;IACzB,KAAa,EACtB,WAAmB,EACV,SAAS,GAAG;QAErB,KAAK,CAAC,WAAW,CAAC,CAAC;QAJV,UAAK,GAAL,KAAK,CAAQ;QAEb,WAAM,GAAN,MAAM,CAAM;QAGrB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC1B,CAAC;IAED,MAAM;QACL,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC;CACD;AA0DD,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,MAAM,UAAU,cAAc,CAAC,MAAc;IAC5C,OAAO,MAAM,GAAG,QAAQ,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IACjD,OAAO,GAAG,MAAM,wCAAwC,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACvD,OAAO;QACN,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC;QAChC,qBAAqB,EAAE,CAAC,MAAM,CAAC;QAC/B,gBAAgB,EAAE,CAAC,GAAG,wBAAwB,CAAC;QAC/C,wBAAwB,EAAE,CAAC,QAAQ,CAAC;KACpC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACzD,OAAO;QACN,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,kBAAkB;QACnD,cAAc,EAAE,GAAG,MAAM,cAAc;QACvC,qBAAqB,EAAE,GAAG,MAAM,iBAAiB;QACjD,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,qBAAqB,EAAE,CAAC,oBAAoB,CAAC;QAC7C,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAC1C,qCAAqC,EAAE,CAAC,MAAM,CAAC;QAC/C,gBAAgB,EAAE,CAAC,GAAG,YAAY,CAAC;QACnC,qCAAqC,EAAE,IAAI;QAC3C,8CAA8C,EAAE,IAAI;KACpD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,oBAAoB,MAAM,EAAE,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;IACxC,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,IAAI,GAAG,EAAkB,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,GAAG,EAG1B,CAAC;IAEJ,6EAA6E;IAC7E,UAAU;IACV,6EAA6E;IAE7E,kFAAkF;IAClF,SAAS,QAAQ,CAAC,KAAc;QAC/B,IAAI,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAuD,CAAC;YACjF,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC3D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,OAAO,GAAG,GAAG,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAChF,CAAC;YACF,MAAM,QAAQ,GAAG,OAAO,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACL,SAAS,EAAE,QAAQ;oBACnB,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;oBAC7C,WAAW,EAAE,IAAI,IAAI,SAAS;oBAC9B,aAAa,EAAE,YAAY;oBAC3B,WAAW,EAAE,CAAC,oBAAoB,CAAC;oBACnC,cAAc,EAAE,CAAC,MAAM,CAAC;oBACxB,0BAA0B,EAAE,MAAM;iBAClC;aACD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,QAAgB;QAC5C,IAAI,QAAQ,KAAK,qBAAqB;YAAE,OAAO,kBAAkB,CAAC;QAClE,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACnE,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,SAAS,gBAAgB,CAAC,QAAgB;QACzC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,CAAC,GAAuB,EAAE,EAAE,CAC5C,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAA+B,CAAC;QACtE,OAAO;YACN,QAAQ;YACR,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,eAAe;YAC/B,YAAY,EAAE,IAAI,CAAC,CAAC;YACpB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,wBAAwB;SAChC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,GAAW;QACxC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,WAAW;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC;YAChF,IAAI,SAAS,IAAI,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,mBAAmB;gBAAE,MAAM,MAAM,CAAC,OAAO,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,6CAA6C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;YACpE,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACrC,OAAO,MAAM,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,GAAG,YAAY,UAAU,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC5C,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,QAAQ,CAAC,GAAW,EAAE,KAA8C;QAC5E,IAAI,aAAa,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YAC1C,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QAC1D,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,6EAA6E;IAC7E,gBAAgB;IAChB,6EAA6E;IAE7E;;;;OAIG;IACH,KAAK,UAAU,qBAAqB,CAAC,KAAsB;QAC1D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,UAAU,CACnB,iBAAiB,EACjB,qDAAqD,CACrD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,IAAI,UAAU,CAAC,2BAA2B,EAAE,uCAAuC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;YACrE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO;YACN,MAAM;YACN,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS;YACtC,aAAa;YACb,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC;YACtD,QAAQ;SACR,CAAC;IACH,CAAC;IAED,sFAAsF;IACtF,SAAS,OAAO,CAAC,OAAyB,EAAE,KAAY;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE;YAC1B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YAC1B,CAAC,EAAE,OAAO,CAAC,WAAW;YACtB,CAAC,EAAE,OAAO,CAAC,aAAa;YACxB,CAAC,EAAE,GAAG,EAAE,GAAG,WAAW;YACtB,CAAC,EAAE,KAAK;SACR,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,SAAS,IAAI,CAAC,OAAyB;QACtC,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;YACtC,KAAK,EAAE,eAAe;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,MAAM;SACX,CAAC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAE7E,SAAS,QAAQ,CAAC,IAAqB;QACtC,IAAI,CAAC;YACJ,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,oBAAoB,EAAE,CAAC;gBACrD,MAAM,IAAI,UAAU,CAAC,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;gBAClC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAM/C,CAAC;YACT,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC;YACrB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACL,YAAY,EAAE,CAAC,CAAC,MAAM;oBACtB,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC7E,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;iBACzB;aACD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;QACpD,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,SAAS,cAAc,CAAC,QAAgB;QACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,cAAc,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACN,QAAQ;QACR,aAAa;QACb,qBAAqB;QACrB,OAAO;QACP,IAAI;QACJ,QAAQ;QACR,yBAAyB,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAClE,2BAA2B,EAAE,GAAG,EAAE,CAAC,2BAA2B,CAAC,MAAM,CAAC;KACtE,CAAC;AACH,CAAC;AAID,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,MAA6B;IACzD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,KAAK,UAAU,YAAY,CAC1B,GAAW,EACX,mBAAsD;IAEtD,IAAI,GAA4E,CAAC;IACjF,IAAI,CAAC;QACJ,GAAG,GAAG,CAAC,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAe,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,iDAAiD,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,EAAE,SAAS,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACN,QAAQ,EAAE,GAAG;QACb,IAAI,EACH,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;YAC5D,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;YAClD,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI;QACrB,YAAY,EAAE,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC;QAClD,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,wBAAwB;KAChC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,GAAkB,EAAE,OAA8B;IACtE,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CACpD,OAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC1C,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAA6B;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACrF,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAChF,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,sCAAsC,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,UAAU,CACnB,sBAAsB,EACtB,6DAA6D,CAC7D,CAAC;QACH,CAAC;IACF,CAAC;IACD,OAAO,KAAiB,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACrC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CACN,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAC3F,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,IAAI,CAAC;QACJ,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,UAAkB,EAAE,SAAiB;IACpE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAM,EAAE,CAAM,CAAC;IACnB,IAAI,CAAC;QACJ,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CACN,CAAC,CAAC,QAAQ,KAAK,OAAO;QACtB,CAAC,CAAC,QAAQ,KAAK,OAAO;QACtB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9B,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;QACzB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,CAAC,IAAI;QACP,CAAC,CAAC,CAAC,QAAQ;QACX,CAAC,CAAC,CAAC,QAAQ,CACX,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,MAA0C;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY;IACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,KAAc;IACxC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,MAAc;IACxC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7C,qFAAqF;QACrF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;YAC1E,aAAa,EAAE,EAAE;SACjB,CAAC,CAAC;QACH,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACxB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/ops/deploymentConfig.d.ts

@@ -29,6 +29,7 @@ export interface DeploymentEnv {
     ORIGIN?: string;
     ADDRESS_HEADER?: string;
     XFF_DEPTH?: string;
+    HOST?: string;
     BODY_SIZE_LIMIT?: string;
     COMPUTE_REQUEST_MAX_BYTES?: string;
     [key: string]: string | undefined;

package/dist/ops/deploymentConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploymentConfig.d.ts","sourceRoot":"","sources":["../../src/ops/deploymentConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAKnC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAUhF;AAOD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CA0CpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CAwDpE;AAED,qDAAqD;AACrD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,EAAE,CAEzE"}
+{"version":3,"file":"deploymentConfig.d.ts","sourceRoot":"","sources":["../../src/ops/deploymentConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,oEAAoE;AACpE,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAa;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAKnC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAUhF;AAOD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CA0CpE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,CA0EpE;AAED,qDAAqD;AACrD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,aAAa,EAAE,CAEzE"}

package/dist/ops/deploymentConfig.js

@@ -141,6 +141,21 @@ export function checkClientAddress(env) {
             remediation: 'It counts proxies from the outside in — use 1 for a single reverse proxy.'
         };
     }
+    // A trusted address header is only safe if every request passes through the
+    // proxy: on a public bind a direct caller sets the header itself and picks
+    // its own rate-limit bucket.
+    const host = env.HOST ?? '0.0.0.0';
+    if (!['127.0.0.1', 'localhost', '::1'].includes(host)) {
+        return {
+            ...base,
+            verdict: 'warn',
+            summary: `ADDRESS_HEADER=${header} is trusted but HOST=${host} leaves the app reachable ` +
+                'without the proxy, so a direct caller can set the header and pick its own ' +
+                'rate-limit bucket.',
+            remediation: 'Set HOST=127.0.0.1 and keep port 3000 closed in the firewall. Ignore this only ' +
+                'if the proxy runs on another host and network isolation keeps everything else out.'
+        };
+    }
     return {
         ...base,
         verdict: 'ok',

package/dist/ops/deploymentConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploymentConfig.js","sourceRoot":"","sources":["../../src/ops/deploymentConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA4BH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA8B;IAChE,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IACzF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,6BAA6B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAExD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACpD,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,6BAA6B,CAAC;IAE1F,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/B,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,gFAAgF;gBAChF,kDAAkD;YACnD,WAAW,EAAE,mCAAmC,IAAI,CAAC,UAAU,CAAC,yCAAyC;SACzG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,oBAAoB,GAAG,wDAAwD;YACxF,WAAW,EAAE,yDAAyD;SACtE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;QACxB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,mBAAmB,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,uCAAuC;gBAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,uEAAuE;YAC5F,WAAW,EAAE,qCAAqC,IAAI,CAAC,UAAU,CAAC,eAAe;SACjF,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,mBAAmB,GAAG,kCAAkC;KACjE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACpD,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;IAE5B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,iFAAiF;SAC1F,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,sFAAsF;gBACtF,qFAAqF;gBACrF,qDAAqD;YACtD,WAAW,EACV,sFAAsF;gBACtF,2EAA2E;SAC5E,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,kBAAkB,MAAM,gDAAgD;gBACxE,oFAAoF;gBACpF,8CAA8C;YAC/C,WAAW,EACV,kFAAkF;gBAClF,kFAAkF;gBAClF,4CAA4C;SAC7C,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,cAAc,KAAK,8BAA8B;YAC1D,WAAW,EAAE,2EAA2E;SACxF,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,kBAAkB,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,eAAe,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;KAC3E,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,qBAAqB,CAAC,GAAkB;IACvD,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"deploymentConfig.js","sourceRoot":"","sources":["../../src/ops/deploymentConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA6BH;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA8B;IAChE,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,KAAK,GAA2B,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IACzF,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,6BAA6B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAExD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACpD,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,6BAA6B,CAAC;IAE1F,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC/B,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,gFAAgF;gBAChF,kDAAkD;YACnD,WAAW,EAAE,mCAAmC,IAAI,CAAC,UAAU,CAAC,yCAAyC;SACzG,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,oBAAoB,GAAG,wDAAwD;YACxF,WAAW,EAAE,yDAAyD;SACtE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;QACxB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,mBAAmB,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,uCAAuC;gBAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,uEAAuE;YAC5F,WAAW,EAAE,qCAAqC,IAAI,CAAC,UAAU,CAAC,eAAe;SACjF,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,mBAAmB,GAAG,kCAAkC;KACjE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB;IACpD,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;IAE5B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,iFAAiF;SAC1F,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,sFAAsF;gBACtF,qFAAqF;gBACrF,qDAAqD;YACtD,WAAW,EACV,sFAAsF;gBACtF,2EAA2E;SAC5E,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,kBAAkB,MAAM,gDAAgD;gBACxE,oFAAoF;gBACpF,8CAA8C;YAC/C,WAAW,EACV,kFAAkF;gBAClF,kFAAkF;gBAClF,4CAA4C;SAC7C,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,cAAc,KAAK,8BAA8B;YAC1D,WAAW,EAAE,2EAA2E;SACxF,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,6BAA6B;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC;IACnC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,OAAO;YACN,GAAG,IAAI;YACP,OAAO,EAAE,MAAM;YACf,OAAO,EACN,kBAAkB,MAAM,wBAAwB,IAAI,4BAA4B;gBAChF,4EAA4E;gBAC5E,oBAAoB;YACrB,WAAW,EACV,iFAAiF;gBACjF,oFAAoF;SACrF,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG,IAAI;QACP,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,kBAAkB,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,eAAe,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;KAC3E,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,qBAAqB,CAAC,GAAkB;IACvD,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/tokens/api-token-codec.d.ts

@@ -7,7 +7,7 @@ import { type TokenCodec } from './token-codec.js';
  *   keys use it.
  * - 30 base62 chars carry ~178 bits of entropy.
  * - The checksum lets the resolver reject a typo or a truncated paste without
- *   a store lookup. It is not a MAC: the HMAC at rest is what authenticates.
+ *   a store lookup. It is not a MAC: the hash at rest is what authenticates.
  * - CRC32 tops out below 62^6, so 6 chars always fit; shorter values are
  *   left-padded with `0`.
  */
@@ -21,5 +21,5 @@ export interface ApiTokenCodec extends TokenCodec {
     /** Shape and checksum only. A true result says nothing about whether the key exists. */
     hasValidChecksum(raw: string): boolean;
 }
-export declare function createApiTokenCodec(secret: string): ApiTokenCodec;
+export declare function createApiTokenCodec(secret: string, previousSecret?: string): ApiTokenCodec;
 //# sourceMappingURL=api-token-codec.d.ts.map

package/dist/tokens/api-token-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-codec.d.ts","sourceRoot":"","sources":["../../src/tokens/api-token-codec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,WAAW,CAAC;AA+BzC;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,wFAAwF;IACxF,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAcjE"}
+{"version":3,"file":"api-token-codec.d.ts","sourceRoot":"","sources":["../../src/tokens/api-token-codec.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,WAAW,CAAC;AA+BzC;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMxD;AAED,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,wFAAwF;IACxF,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvC;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,aAAa,CAkB1F"}

package/dist/tokens/api-token-codec.js

@@ -9,7 +9,7 @@ import { createTokenCodec } from './token-codec.js';
  *   keys use it.
  * - 30 base62 chars carry ~178 bits of entropy.
  * - The checksum lets the resolver reject a typo or a truncated paste without
- *   a store lookup. It is not a MAC: the HMAC at rest is what authenticates.
+ *   a store lookup. It is not a MAC: the hash at rest is what authenticates.
  * - CRC32 tops out below 62^6, so 6 chars always fit; shorter values are
  *   left-padded with `0`.
  */
@@ -51,8 +51,12 @@ export function looksLikeApiToken(value) {
         value.startsWith(API_TOKEN_PREFIX) &&
         BODY_PATTERN.test(value.slice(API_TOKEN_PREFIX.length)));
 }
-export function createApiTokenCodec(secret) {
-    const base = createTokenCodec({ prefix: API_TOKEN_PREFIX, secret });
+export function createApiTokenCodec(secret, previousSecret) {
+    const base = createTokenCodec({
+        prefix: API_TOKEN_PREFIX,
+        secret,
+        ...(previousSecret ? { previousSecret } : {})
+    });
     return {
         ...base,
         mintRawToken() {

package/dist/tokens/api-token-codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-token-codec.js","sourceRoot":"","sources":["../../src/tokens/api-token-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,kBAAkB,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AACzC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,GAAG,aAAa,GAAG,eAAe,CAAC;AAE/E,MAAM,MAAM,GAAG,gEAAgE,CAAC;AAChF,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,2EAA2E;AAC3E,+BAA+B;AAC/B,SAAS,YAAY,CAAC,MAAc;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,IAAI,IAAI,GAAG,GAAG;gBAAE,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM;QAClC,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC/B,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC9C,OAAO,CACN,KAAK,CAAC,MAAM,KAAK,YAAY;QAC7B,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAClC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CACvD,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,MAAc;IACjD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,OAAO;QACN,GAAG,IAAI;QACP,YAAY;YACX,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,gBAAgB,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,gBAAgB,CAAC,GAAW;YAC3B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7E,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"api-token-codec.js","sourceRoot":"","sources":["../../src/tokens/api-token-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAmB,MAAM,kBAAkB,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AACzC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,GAAG,aAAa,GAAG,eAAe,CAAC;AAE/E,MAAM,MAAM,GAAG,gEAAgE,CAAC;AAChF,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAEtC,2EAA2E;AAC3E,+BAA+B;AAC/B,SAAS,YAAY,CAAC,MAAc;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,IAAI,IAAI,GAAG,GAAG;gBAAE,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM;QAClC,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC/B,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC;QAC3B,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC9C,OAAO,CACN,KAAK,CAAC,MAAM,KAAK,YAAY;QAC7B,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAClC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CACvD,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,cAAuB;IAC1E,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC7B,MAAM,EAAE,gBAAgB;QACxB,MAAM;QACN,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,OAAO;QACN,GAAG,IAAI;QACP,YAAY;YACX,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;YAC3C,OAAO,gBAAgB,GAAG,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,gBAAgB,CAAC,GAAW;YAC3B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7E,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/tokens/index.d.ts

@@ -1,4 +1,4 @@
-export { createTokenCodec, MIN_TOKEN_SECRET_LENGTH, type TokenCodec, type TokenCodecConfig } from './token-codec.js';
+export { createTokenCodec, findByToken, MIN_TOKEN_SECRET_LENGTH, type TokenCodec, type TokenCodecConfig } from './token-codec.js';
 export { createApiTokenCodec, API_TOKEN_PREFIX, looksLikeApiToken, type ApiTokenCodec } from './api-token-codec.js';
 export { canHoldApiTokens, type ApiTokenHolderOptions, type ApiTokenHolderPolicy } from './api-token-holder.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tokens/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,EAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,MAAM,uBAAuB,CAAC"}

package/dist/tokens/index.js

@@ -1,6 +1,6 @@
-// HMAC token codec for capability-URL tokens (share links, invites, …).
-export { createTokenCodec, MIN_TOKEN_SECRET_LENGTH } from './token-codec.js';
-// API tokens (`selva_`): the same HMAC-at-rest scheme, plus a checksum.
+// Token codec for capability-URL tokens (share links, invites, …).
+export { createTokenCodec, findByToken, MIN_TOKEN_SECRET_LENGTH } from './token-codec.js';
+// API tokens (`selva_`): the same hash-at-rest scheme, plus a checksum.
 export { createApiTokenCodec, API_TOKEN_PREFIX, looksLikeApiToken } from './api-token-codec.js';
 export { canHoldApiTokens } from './api-token-holder.js';
 //# sourceMappingURL=index.js.map

package/dist/tokens/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,OAAO,EACN,gBAAgB,EAChB,uBAAuB,EAGvB,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,gBAAgB,EAGhB,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,OAAO,EACN,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EAGvB,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EAEjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,gBAAgB,EAGhB,MAAM,uBAAuB,CAAC"}

package/dist/tokens/token-codec.d.ts

@@ -1,27 +1,22 @@
 /**
- * HMAC token codec — the primitive behind capability-URL tokens (share links,
- * invites, and anything shaped like them).
+ * Token codec — the primitive behind capability-URL tokens (share links,
+ * invites, API tokens, and anything shaped like them).
  *
  * ## Format
  *   raw  = `<prefix><base64url(32 random bytes)>`
- *   hash = base64url( HMAC-SHA256(secret, raw) )
+ *   hash = `sha256:` + base64url( SHA-256(raw) )
  *
- * ## Two secrets per token
+ * The raw token is handed back once at mint time and never stored; the store
+ * holds only the hash. With 256 bits of entropy in the raw token, an unkeyed
+ * hash is as unreplayable from a database leak as a keyed one, and rotating
+ * the instance secret no longer invalidates stored tokens.
  *
- *   1. **Per-token entropy** — the 32 random bytes in `mintRawToken()`, handed
- *      back exactly once at mint time and never stored. This is what end-users
- *      carry in `?token=…`.
+ * ## Legacy hashes
  *
- *   2. **Instance-wide HMAC secret** (`config.secret`) — hashes tokens for
- *      storage, so the store holds only `HMAC-SHA256(secret, raw)`. A DB-only
- *      leak can't be replayed: the attacker also needs the secret, and it lives
- *      in env, not the database.
- *
- * Resolution hashes the supplied token with the same secret and looks up an
- * exact match against the stored hash.
- *
- * Rotating the secret invalidates every token minted under it — give each token
- * family (each prefix) its own secret so they rotate independently.
+ * Tokens minted before this format were stored as
+ * `base64url(HMAC-SHA256(secret, raw))`. `lookupHashes` returns those forms
+ * too, under the current and the previous secret, so they keep resolving
+ * through a rotation until they expire.
  */
 /**
  * Minimum accepted secret length, matching the "random ≥32-byte string"
@@ -32,14 +27,18 @@ export declare const MIN_TOKEN_SECRET_LENGTH = 32;
 export interface TokenCodecConfig {
     /** Token-family marker prepended to every raw token, e.g. `share_`. */
     prefix: string;
-    /** Instance-wide HMAC secret; one per token family so they rotate apart. */
+    /** Instance secret. Only legacy hashes use it. */
     secret: string;
+    /** The secret before the last rotation; legacy hashes made under it still resolve. */
+    previousSecret?: string;
 }
 export interface TokenCodec {
     /** Fresh raw token. Never persisted — show it to the user exactly once. */
     mintRawToken(): string;
     /** Raw token to the hash stored in its place. */
     hashToken(raw: string): string;
+    /** Every hash a stored record of `raw` may carry, current form first. Try each in turn. */
+    lookupHashes(raw: string): string[];
     /** Constant-time compare, so a mismatch leaks no position information. */
     hashesEqual(a: string, b: string): boolean;
     /** Prefix check — recognizes this family's tokens on inbound requests. */
@@ -48,4 +47,10 @@ export interface TokenCodec {
     readonly prefix: string;
 }
 export declare function createTokenCodec(config: TokenCodecConfig): TokenCodec;
+/**
+ * Look a raw token up by each hash its record may carry. Sequential rather than
+ * one `IN` query so stores keep their single-hash interface; records are never
+ * rewritten here, so there is no rewrite for a lookup to race.
+ */
+export declare function findByToken<T>(codec: Pick<TokenCodec, 'lookupHashes'>, raw: string, lookup: (hash: string) => Promise<T | null>): Promise<T | null>;
 //# sourceMappingURL=token-codec.d.ts.map

package/dist/tokens/token-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-codec.d.ts","sourceRoot":"","sources":["../../src/tokens/token-codec.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,MAAM,WAAW,gBAAgB;IAChC,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IAC1B,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC;IACvB,iDAAiD;IACjD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3C,0EAA0E;IAC1E,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CA2BrE"}
+{"version":3,"file":"token-codec.d.ts","sourceRoot":"","sources":["../../src/tokens/token-codec.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,MAAM,WAAW,gBAAgB;IAChC,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IAC1B,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC;IACvB,iDAAiD;IACjD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACpC,0EAA0E;IAC1E,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3C,0EAA0E;IAC1E,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,UAAU,CAoCrE;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,CAAC,EAClC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EACvC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,GACzC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAMnB"}

package/dist/tokens/token-codec.js

@@ -1,28 +1,23 @@
-import { randomBytes, createHmac, timingSafeEqual } from 'node:crypto';
+import { randomBytes, createHash, createHmac, timingSafeEqual } from 'node:crypto';
 /**
- * HMAC token codec — the primitive behind capability-URL tokens (share links,
- * invites, and anything shaped like them).
+ * Token codec — the primitive behind capability-URL tokens (share links,
+ * invites, API tokens, and anything shaped like them).
  *
  * ## Format
  *   raw  = `<prefix><base64url(32 random bytes)>`
- *   hash = base64url( HMAC-SHA256(secret, raw) )
+ *   hash = `sha256:` + base64url( SHA-256(raw) )
  *
- * ## Two secrets per token
+ * The raw token is handed back once at mint time and never stored; the store
+ * holds only the hash. With 256 bits of entropy in the raw token, an unkeyed
+ * hash is as unreplayable from a database leak as a keyed one, and rotating
+ * the instance secret no longer invalidates stored tokens.
  *
- *   1. **Per-token entropy** — the 32 random bytes in `mintRawToken()`, handed
- *      back exactly once at mint time and never stored. This is what end-users
- *      carry in `?token=…`.
+ * ## Legacy hashes
  *
- *   2. **Instance-wide HMAC secret** (`config.secret`) — hashes tokens for
- *      storage, so the store holds only `HMAC-SHA256(secret, raw)`. A DB-only
- *      leak can't be replayed: the attacker also needs the secret, and it lives
- *      in env, not the database.
- *
- * Resolution hashes the supplied token with the same secret and looks up an
- * exact match against the stored hash.
- *
- * Rotating the secret invalidates every token minted under it — give each token
- * family (each prefix) its own secret so they rotate independently.
+ * Tokens minted before this format were stored as
+ * `base64url(HMAC-SHA256(secret, raw))`. `lookupHashes` returns those forms
+ * too, under the current and the previous secret, so they keep resolving
+ * through a rotation until they expire.
  */
 /**
  * Minimum accepted secret length, matching the "random ≥32-byte string"
@@ -31,18 +26,23 @@ import { randomBytes, createHmac, timingSafeEqual } from 'node:crypto';
  */
 export const MIN_TOKEN_SECRET_LENGTH = 32;
 export function createTokenCodec(config) {
-    const { prefix, secret } = config;
-    if (secret.length < MIN_TOKEN_SECRET_LENGTH) {
-        throw new Error(`Secret for "${prefix}" tokens must be at least ${MIN_TOKEN_SECRET_LENGTH} characters ` +
-            `(got ${secret.length}). Generate one with: openssl rand -base64 32`);
+    const { prefix, secret, previousSecret } = config;
+    for (const s of [secret, ...(previousSecret ? [previousSecret] : [])]) {
+        if (s.length < MIN_TOKEN_SECRET_LENGTH) {
+            throw new Error(`Secret for "${prefix}" tokens must be at least ${MIN_TOKEN_SECRET_LENGTH} characters ` +
+                `(got ${s.length}). Generate one with: openssl rand -base64 32`);
+        }
     }
+    const hashToken = (raw) => 'sha256:' + createHash('sha256').update(raw).digest('base64url');
     return {
         prefix,
         mintRawToken() {
             return prefix + randomBytes(32).toString('base64url');
         },
-        hashToken(raw) {
-            return createHmac('sha256', secret).update(raw).digest('base64url');
+        hashToken,
+        lookupHashes(raw) {
+            const legacy = [secret, ...(previousSecret ? [previousSecret] : [])].map((key) => createHmac('sha256', key).update(raw).digest('base64url'));
+            return [hashToken(raw), ...legacy];
         },
         hashesEqual(a, b) {
             const ab = Buffer.from(a);
@@ -56,4 +56,17 @@ export function createTokenCodec(config) {
         }
     };
 }
+/**
+ * Look a raw token up by each hash its record may carry. Sequential rather than
+ * one `IN` query so stores keep their single-hash interface; records are never
+ * rewritten here, so there is no rewrite for a lookup to race.
+ */
+export async function findByToken(codec, raw, lookup) {
+    for (const hash of codec.lookupHashes(raw)) {
+        const found = await lookup(hash);
+        if (found)
+            return found;
+    }
+    return null;
+}
 //# sourceMappingURL=token-codec.js.map

package/dist/tokens/token-codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-codec.js","sourceRoot":"","sources":["../../src/tokens/token-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAsB1C,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACd,eAAe,MAAM,6BAA6B,uBAAuB,cAAc;YACtF,QAAQ,MAAM,CAAC,MAAM,+CAA+C,CACrE,CAAC;IACH,CAAC;IAED,OAAO;QACN,MAAM;QACN,YAAY;YACX,OAAO,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC;QACD,SAAS,CAAC,GAAW;YACpB,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,CAAC;QACD,WAAW,CAAC,CAAS,EAAE,CAAS;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,cAAc,CAAC,KAAa;YAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;KACD,CAAC;AACH,CAAC"}
+{"version":3,"file":"token-codec.js","sourceRoot":"","sources":["../../src/tokens/token-codec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnF;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AA0B1C,MAAM,UAAU,gBAAgB,CAAC,MAAwB;IACxD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,CAAC,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACd,eAAe,MAAM,6BAA6B,uBAAuB,cAAc;gBACtF,QAAQ,CAAC,CAAC,MAAM,+CAA+C,CAChE,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE,CACzC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAElE,OAAO;QACN,MAAM;QACN,YAAY;YACX,OAAO,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACvD,CAAC;QACD,SAAS;QACT,YAAY,CAAC,GAAW;YACvB,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAChF,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CACzD,CAAC;YACF,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,WAAW,CAAC,CAAS,EAAE,CAAS;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC;QACD,cAAc,CAAC,KAAa;YAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,KAAuC,EACvC,GAAW,EACX,MAA2C;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/server",
-  "version": "2.0.0-beta.19",
+  "version": "2.0.0-beta.20",
   "description": "Transport-agnostic server building blocks for apps built on the Selva engine (limits, rate limiting, SSRF guard, remote-definition fetch, definition service + render loader); the solve core lives in @selvajs/solve/server",
   "license": "MIT",
   "author": "VektorNode",
@@ -31,6 +31,11 @@
       "types": "./dist/compute/index.d.ts",
       "import": "./dist/compute/index.js"
     },
+    "./config": {
+      "selva-source": "./src/config/index.ts",
+      "types": "./dist/config/index.d.ts",
+      "import": "./dist/config/index.js"
+    },
     "./definitions": {
       "selva-source": "./src/definitions/index.ts",
       "types": "./dist/definitions/index.d.ts",
@@ -116,9 +121,9 @@
   "dependencies": {
     "zod": "^4.6.7",
     "@selvajs/compute": "^5.0.0-beta.9",
-    "@selvajs/platform": "^1.0.0-beta.7",
+    "@selvajs/notifications": "^0.3.0-beta.9",
     "@selvajs/schemas": "^5.3.0-beta.3",
-    "@selvajs/notifications": "^0.3.0-beta.7"
+    "@selvajs/platform": "^1.0.0-beta.9"
   },
   "peerDependencies": {
     "@sentry/node": ">=8",
@@ -144,7 +149,7 @@
     "typescript": "~6.0.3",
     "vitest": "^5.0.5",
     "@selvajs/config": "0.0.4",
-    "@selvajs/local-provider": "0.16.0-beta.3"
+    "@selvajs/local-provider": "0.16.0-beta.5"
   },
   "scripts": {
     "build": "tsc",