@spinajs/rbac-http-token 2.0.507

package/lib/cjs/controllers/AccessTokenController.js

@@ -0,0 +1,264 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenController = void 0;
+const http_1 = require("@spinajs/http");
+const rbac_1 = require("@spinajs/rbac");
+const rbac_http_1 = require("@spinajs/rbac-http");
+const exceptions_1 = require("@spinajs/exceptions");
+const luxon_1 = require("luxon");
+const AccessToken_js_1 = require("../models/AccessToken.js");
+const actions_js_1 = require("../actions.js");
+const create_token_dto_js_1 = require("../dto/create-token-dto.js");
+const NoTokenAuthPolicy_js_1 = require("../policies/NoTokenAuthPolicy.js");
+const NoImpersonationPolicy_js_1 = require("../policies/NoImpersonationPolicy.js");
+/**
+ * Self-service management of own access tokens.
+ *
+ * SELF-service in the strict sense: the caller must be the account owner,
+ * present in person. Two ways of acting *as* somebody are refused outright -
+ * an access token ( which must never mint another token ) and an impersonated
+ * session ( which must never mint a credential that outlives it ). Every query
+ * is additionally constrained by the calling user's id, so a foreign uuid is
+ * simply not found.
+ *
+ * WIRING - the decorator layout below is load bearing. The two guards share ONE
+ * `@Policy([...])` group so they are ANDed; splitting them into two `@Policy()`
+ * calls would OR them and each would become optional. And do NOT add a class
+ * level `@Policy(RbacPolicy)` alongside:
+ *
+ * `@spinajs/http` combines policies at three levels ( see `createPolicyGate` in
+ * `http/src/route-builder.ts` ): AND inside one `@Policy()` group, OR between
+ * the groups declared at one scope, AND between the controller scope and the
+ * route scope. `@Permission()` already pushes `RbacPolicy` as a group on the
+ * ROUTE ( `rbac-http/src/decorators.ts` ), so:
+ *
+ *   - controller scope holds exactly ONE group,
+ *     `[NoTokenAuthPolicy, NoImpersonationPolicy]`. A lone group cannot be ORed
+ *     away, so both are a hard requirement of EVERY route on this controller,
+ *     including any route added later.
+ *   - route scope holds `[RbacPolicy]` from `@Permission`, which demands an
+ *     authorized session AND the declared grant.
+ *
+ * Adding `@Policy(RbacPolicy)` at class level would make the controller scope
+ * `[NoTokenAuthPolicy, NoImpersonationPolicy] OR [RbacPolicy]`, and satisfying
+ * `RbacPolicy` alone would then discharge the whole scope - both invariants
+ * would rest on nothing but RbacPolicy's own session check, which does not look
+ * at impersonation at all.
+ *
+ * @tags AccessTokens
+ */
+let AccessTokenController = class AccessTokenController extends http_1.BaseController {
+    /**
+     * List own access tokens
+     * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
+     * dehydrated rows carry the uuid, label, roles and timestamps only.
+     * @security cookieAuth
+     * @response 200 Own tokens
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    async list(user) {
+        const tokens = await AccessToken_js_1.AccessToken.where('user_id', user.Id);
+        return new http_1.Ok(tokens.map((t) => this.toWire(t)));
+    }
+    /**
+     * Create an access token
+     * The plaintext appears in this response only and cannot be retrieved again.
+     * Roles must be a subset of the caller's own roles.
+     * @security cookieAuth
+     * @response 200 Token created, `Plaintext` returned once
+     * @response 400 Requested roles are not held by the caller
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    async create(user, dto) {
+        const expiresAt = dto.ExpiresAt ? luxon_1.DateTime.fromISO(dto.ExpiresAt) : null;
+        try {
+            const { Token, Plaintext } = await (0, actions_js_1.createToken)(user, dto.Name, dto.Roles, expiresAt);
+            return new http_1.Ok({ Token: this.toWire(Token), Plaintext }, { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] });
+        }
+        catch (err) {
+            return this.roleError(err);
+        }
+    }
+    /**
+     * Delete ( revoke ) an own token
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @response 200 Token deleted
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    async delete(user, uuid) {
+        const token = await this.own(user, uuid);
+        if (!token) {
+            return new http_1.NotFound({ error: { code: 'E_TOKEN_NOT_FOUND', message: 'No such token' } });
+        }
+        await (0, actions_js_1.deleteToken)(token);
+        return new http_1.Ok();
+    }
+    /**
+     * Grant a role to an own token
+     * The role must be held by the caller - a token can never carry more than its
+     * owner does.
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @param role Role name to grant
+     * @response 200 Updated token
+     * @response 400 Role is not held by the caller
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    async grantRole(user, uuid, role) {
+        const token = await this.own(user, uuid);
+        if (!token) {
+            return new http_1.NotFound({ error: { code: 'E_TOKEN_NOT_FOUND', message: 'No such token' } });
+        }
+        try {
+            const updated = await (0, actions_js_1.grantTokenRole)(token, role);
+            return new http_1.Ok(this.toWire(updated));
+        }
+        catch (err) {
+            return this.roleError(err);
+        }
+    }
+    /**
+     * Revoke a role from an own token
+     * A token must keep at least one role; dropping the last one is refused with
+     * 400 - deleting the token is the way to revoke it entirely.
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @param role Role name to revoke
+     * @response 200 Updated token
+     * @response 400 Cannot revoke the token's last role
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    async revokeRole(user, uuid, role) {
+        const token = await this.own(user, uuid);
+        if (!token) {
+            return new http_1.NotFound({ error: { code: 'E_TOKEN_NOT_FOUND', message: 'No such token' } });
+        }
+        try {
+            const updated = await (0, actions_js_1.revokeTokenRole)(token, role);
+            return new http_1.Ok(this.toWire(updated));
+        }
+        catch (err) {
+            return this.roleError(err);
+        }
+    }
+    /**
+     * Resolves a token by uuid WITHIN the caller's own tokens - the ownership
+     * boundary of this whole controller.
+     */
+    own(user, uuid) {
+        return AccessToken_js_1.AccessToken.where({ Uuid: uuid, user_id: user.Id }).first();
+    }
+    /**
+     * Wire shape of one token: the dehydrated row, with timestamps as ISO
+     * instants and `Roles` put back as a real array.
+     *
+     * `dehydrate()` runs every column through its converter's `toDB` direction -
+     * the STORAGE encoding, which is not the API contract in two places:
+     *
+     *   - `dateTimeFormat: 'iso'` is what turns `CreatedAt` / `ExpiresAt` /
+     *     `LastUsedAt` into offset-carrying ISO strings. Without it the sql
+     *     converter emits its driver format ( `"2026-08-11 10:00:00"` ), which
+     *     names no offset at all, so a client has to guess the zone. Every other
+     *     user-bearing response in the repo dehydrates with this option - see
+     *     `rbac-http-user/src/controllers/UserController.ts` - and a plain
+     *     `toJSON()` is exactly `dehydrate()` with the option missing.
+     *   - `@Set()`'s converter joins the role list into `"user,admin"`. Left
+     *     alone, `Roles` reaches clients as a string that only looks like a list,
+     *     which no generated client parses back.
+     *
+     * `@Hidden()` columns ( `Token`, `Id` ) are dropped by `dehydrate` itself and
+     * `user_id` is skipped as the `User` relation's foreign key, so the hash still
+     * never leaves here.
+     */
+    toWire(token) {
+        return { ...token.dehydrate({ dateTimeFormat: 'iso' }), Roles: [...token.Roles] };
+    }
+    /**
+     * Turns the actions layer's role refusals into a 400.
+     *
+     * `ErrorCode` has no entry in the http error map, so an uncaught one leaves as
+     * a 500 - and "you asked for a role you do not have" / "a token must keep one
+     * role" are the caller's mistakes, not the server's. Anything else is rethrown
+     * untouched so a genuine failure still reaches the error handler.
+     */
+    roleError(err) {
+        if (err instanceof exceptions_1.ErrorCode && err.code === actions_js_1.E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED) {
+            return new http_1.BadRequestResponse({ error: { code: 'E_TOKEN_ROLE_NOT_ALLOWED', message: err.message } });
+        }
+        throw err;
+    }
+};
+exports.AccessTokenController = AccessTokenController;
+__decorate([
+    (0, http_1.Get)('tokens'),
+    (0, rbac_http_1.Permission)(['readOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "list", null);
+__decorate([
+    (0, http_1.Post)('tokens'),
+    (0, rbac_http_1.Permission)(['createOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User, create_token_dto_js_1.CreateTokenDto]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "create", null);
+__decorate([
+    (0, http_1.Del)('tokens/:uuid'),
+    (0, rbac_http_1.Permission)(['deleteOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User, String]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "delete", null);
+__decorate([
+    (0, http_1.Put)('tokens/:uuid/roles/:role'),
+    (0, rbac_http_1.Permission)(['updateOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Param)()),
+    __param(2, (0, http_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User, String, String]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "grantRole", null);
+__decorate([
+    (0, http_1.Del)('tokens/:uuid/roles/:role'),
+    (0, rbac_http_1.Permission)(['updateOwn']),
+    __param(0, (0, rbac_http_1.User)()),
+    __param(1, (0, http_1.Param)()),
+    __param(2, (0, http_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [rbac_1.User, String, String]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "revokeRole", null);
+exports.AccessTokenController = AccessTokenController = __decorate([
+    (0, http_1.BasePath)('user'),
+    (0, rbac_http_1.Resource)('user.tokens'),
+    (0, http_1.Policy)([NoTokenAuthPolicy_js_1.NoTokenAuthPolicy, NoImpersonationPolicy_js_1.NoImpersonationPolicy])
+], AccessTokenController);
+//# sourceMappingURL=AccessTokenController.js.map

package/lib/cjs/controllers/AccessTokenController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,wCAAqI;AACrI,wCAAkD;AAClD,kDAAgE;AAChE,oDAAgD;AAChD,iCAAiC;AAEjC,6DAAuD;AACvD,8CAAyG;AACzG,oEAA4D;AAC5D,2EAAqE;AACrE,mFAA6E;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,qBAAc;IACvD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,4BAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,SAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,wBAAW,EAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrF,OAAO,IAAI,SAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,IAAA,wBAAW,EAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,SAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAc,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,eAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,4BAAe,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,SAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,4BAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,sBAAS,IAAI,GAAG,CAAC,IAAI,KAAK,0BAAa,CAAC,wBAAwB,EAAE,CAAC;YACpF,OAAO,IAAI,yBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;;AA5Jc;IAFZ,IAAA,UAAG,EAAC,QAAQ,CAAC;IACb,IAAA,sBAAU,EAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;;qCAAO,WAAS;;iDAGxC;AAcY;IAFZ,IAAA,WAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,WAAI,GAAE,CAAA;;qCAAlB,WAAS,EAAe,oCAAc;;mDASvE;AAaY;IAFZ,IAAA,UAAG,EAAC,cAAc,CAAC;IACnB,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAAnB,WAAS;;mDAQ1C;AAiBY;IAFZ,IAAA,UAAG,EAAC,0BAA0B,CAAC;IAC/B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAA1C,WAAS;;sDAY7C;AAiBY;IAFZ,IAAA,UAAG,EAAC,0BAA0B,CAAC;IAC/B,IAAA,sBAAU,EAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAA,gBAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAK,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAK,GAAE,CAAA;;qCAA1C,WAAS;;uDAY9C;gCArHU,qBAAqB;IAHjC,IAAA,eAAQ,EAAC,MAAM,CAAC;IAChB,IAAA,oBAAQ,EAAC,aAAa,CAAC;IACvB,IAAA,aAAM,EAAC,CAAC,wCAAiB,EAAE,gDAAqB,CAAC,CAAC;GACtC,qBAAqB,CAwKjC"}

package/lib/cjs/dto/create-token-dto.d.ts

@@ -0,0 +1,34 @@
+export declare const CreateTokenDtoSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        Name: {
+            type: string;
+            minLength: number;
+            maxLength: number;
+            description: string;
+        };
+        Roles: {
+            type: string;
+            items: {
+                type: string;
+            };
+            minItems: number;
+            description: string;
+        };
+        ExpiresAt: {
+            type: string[];
+            format: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+export declare class CreateTokenDto {
+    Name: string;
+    Roles: string[];
+    ExpiresAt?: string | null;
+    constructor(data: any);
+}
+//# sourceMappingURL=create-token-dto.d.ts.map

package/lib/cjs/dto/create-token-dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-token-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB;IAC/B,OAAO;IACP,KAAK;IACL,IAAI;IACJ,UAAU;QACR,IAAI;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACjE,KAAK;YAAI,IAAI;YAAW,KAAK;gBAAI,IAAI;;YAAc,QAAQ;YAAK,WAAW;;QAC3E,SAAS;YAAI,IAAI;YAAsB,MAAM;YAAe,WAAW;;;IAEzE,QAAQ;CACT,CAAC;AAEF,qBACa,cAAc;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,YAAY,IAAI,EAAE,GAAG,EAEpB;CACF"}

package/lib/cjs/dto/create-token-dto.js

@@ -0,0 +1,35 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateTokenDto = exports.CreateTokenDtoSchema = void 0;
+const validation_1 = require("@spinajs/validation");
+exports.CreateTokenDtoSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Create access token DTO',
+    type: 'object',
+    properties: {
+        Name: { type: 'string', minLength: 1, maxLength: 128, description: 'Human readable token label' },
+        Roles: { type: 'array', items: { type: 'string' }, minItems: 1, description: 'Roles allowed on the token, must be subset of own roles' },
+        ExpiresAt: { type: ['string', 'null'], format: 'date-time', description: 'ISO expiration instant; null or omitted = never expires' },
+    },
+    required: ['Name', 'Roles'],
+};
+let CreateTokenDto = class CreateTokenDto {
+    constructor(data) {
+        Object.assign(this, data);
+    }
+};
+exports.CreateTokenDto = CreateTokenDto;
+exports.CreateTokenDto = CreateTokenDto = __decorate([
+    (0, validation_1.Schema)(exports.CreateTokenDtoSchema),
+    __metadata("design:paramtypes", [Object])
+], CreateTokenDto);
+//# sourceMappingURL=create-token-dto.js.map

package/lib/cjs/dto/create-token-dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-token-dto.js","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAA6C;AAEhC,QAAA,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE;QACxI,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,yDAAyD,EAAE;KACrI;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;CAC5B,CAAC;AAGK,IAAM,cAAc,GAApB,MAAM,cAAc;IAKzB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;;yBARY,cAAc;IAD1B,IAAA,mBAAM,EAAC,QAAA,oBAAoB,CAAC;;GAChB,cAAc,CAQ1B"}

package/lib/cjs/events/AccessTokenCreated.d.ts

@@ -0,0 +1,4 @@
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+export declare class AccessTokenCreated extends AccessTokenEvent {
+}
+//# sourceMappingURL=AccessTokenCreated.d.ts.map

package/lib/cjs/events/AccessTokenCreated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenCreated.d.ts","sourceRoot":"","sources":["../../../src/events/AccessTokenCreated.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,qBACa,kBAAmB,SAAQ,gBAAgB;CAAG"}

package/lib/cjs/events/AccessTokenCreated.js

@@ -0,0 +1,18 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenCreated = void 0;
+const queue_1 = require("@spinajs/queue");
+const AccessTokenEvent_js_1 = require("./AccessTokenEvent.js");
+let AccessTokenCreated = class AccessTokenCreated extends AccessTokenEvent_js_1.AccessTokenEvent {
+};
+exports.AccessTokenCreated = AccessTokenCreated;
+exports.AccessTokenCreated = AccessTokenCreated = __decorate([
+    (0, queue_1.Event)()
+], AccessTokenCreated);
+//# sourceMappingURL=AccessTokenCreated.js.map

package/lib/cjs/events/AccessTokenCreated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenCreated.js","sourceRoot":"","sources":["../../../src/events/AccessTokenCreated.ts"],"names":[],"mappings":";;;;;;;;;AAAA,0CAAuC;AACvC,+DAAyD;AAGlD,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,sCAAgB;CAAG,CAAA;;6BAA9C,kBAAkB;IAD9B,IAAA,aAAK,GAAE;GACK,kBAAkB,CAA4B"}

package/lib/cjs/events/AccessTokenDeleted.d.ts

@@ -0,0 +1,4 @@
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+export declare class AccessTokenDeleted extends AccessTokenEvent {
+}
+//# sourceMappingURL=AccessTokenDeleted.d.ts.map

package/lib/cjs/events/AccessTokenDeleted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenDeleted.d.ts","sourceRoot":"","sources":["../../../src/events/AccessTokenDeleted.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,qBACa,kBAAmB,SAAQ,gBAAgB;CAAG"}

package/lib/cjs/events/AccessTokenDeleted.js

@@ -0,0 +1,18 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenDeleted = void 0;
+const queue_1 = require("@spinajs/queue");
+const AccessTokenEvent_js_1 = require("./AccessTokenEvent.js");
+let AccessTokenDeleted = class AccessTokenDeleted extends AccessTokenEvent_js_1.AccessTokenEvent {
+};
+exports.AccessTokenDeleted = AccessTokenDeleted;
+exports.AccessTokenDeleted = AccessTokenDeleted = __decorate([
+    (0, queue_1.Event)()
+], AccessTokenDeleted);
+//# sourceMappingURL=AccessTokenDeleted.js.map

package/lib/cjs/events/AccessTokenDeleted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenDeleted.js","sourceRoot":"","sources":["../../../src/events/AccessTokenDeleted.ts"],"names":[],"mappings":";;;;;;;;;AAAA,0CAAuC;AACvC,+DAAyD;AAGlD,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,sCAAgB;CAAG,CAAA;;6BAA9C,kBAAkB;IAD9B,IAAA,aAAK,GAAE;GACK,kBAAkB,CAA4B"}

package/lib/cjs/events/AccessTokenEvent.d.ts

@@ -0,0 +1,10 @@
+import { QueueEvent } from '@spinajs/queue';
+import { AccessToken } from '../models/AccessToken.js';
+export declare class AccessTokenEvent extends QueueEvent {
+    /**
+     * Public token identifier. Never the token material.
+     */
+    TokenUuid: string;
+    constructor(token: AccessToken);
+}
+//# sourceMappingURL=AccessTokenEvent.d.ts.map

package/lib/cjs/events/AccessTokenEvent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenEvent.d.ts","sourceRoot":"","sources":["../../../src/events/AccessTokenEvent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAS,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,qBACa,gBAAiB,SAAQ,UAAU;IAC9C;;OAEG;IACI,SAAS,EAAE,MAAM,CAAC;IAEzB,YAAY,KAAK,EAAE,WAAW,EAG7B;CACF"}

package/lib/cjs/events/AccessTokenEvent.js

@@ -0,0 +1,26 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenEvent = void 0;
+const queue_1 = require("@spinajs/queue");
+const AccessToken_js_1 = require("../models/AccessToken.js");
+let AccessTokenEvent = class AccessTokenEvent extends queue_1.QueueEvent {
+    constructor(token) {
+        super();
+        this.TokenUuid = token.Uuid;
+    }
+};
+exports.AccessTokenEvent = AccessTokenEvent;
+exports.AccessTokenEvent = AccessTokenEvent = __decorate([
+    (0, queue_1.Event)(),
+    __metadata("design:paramtypes", [AccessToken_js_1.AccessToken])
+], AccessTokenEvent);
+//# sourceMappingURL=AccessTokenEvent.js.map

package/lib/cjs/events/AccessTokenEvent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenEvent.js","sourceRoot":"","sources":["../../../src/events/AccessTokenEvent.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAmD;AACnD,6DAAuD;AAGhD,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,kBAAU;IAM9C,YAAY,KAAkB;QAC5B,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF,CAAA;;2BAVY,gBAAgB;IAD5B,IAAA,aAAK,GAAE;qCAOa,4BAAW;GANnB,gBAAgB,CAU5B"}

package/lib/cjs/events/AccessTokenRoleGranted.d.ts

@@ -0,0 +1,7 @@
+import { AccessToken } from '../models/AccessToken.js';
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+export declare class AccessTokenRoleGranted extends AccessTokenEvent {
+    Role: string;
+    constructor(token: AccessToken, Role: string);
+}
+//# sourceMappingURL=AccessTokenRoleGranted.d.ts.map

package/lib/cjs/events/AccessTokenRoleGranted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenRoleGranted.d.ts","sourceRoot":"","sources":["../../../src/events/AccessTokenRoleGranted.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,qBACa,sBAAuB,SAAQ,gBAAgB;IACnB,IAAI,EAAE,MAAM;IAAnD,YAAY,KAAK,EAAE,WAAW,EAAS,IAAI,EAAE,MAAM,EAElD;CACF"}

package/lib/cjs/events/AccessTokenRoleGranted.js

@@ -0,0 +1,27 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenRoleGranted = void 0;
+const queue_1 = require("@spinajs/queue");
+const AccessToken_js_1 = require("../models/AccessToken.js");
+const AccessTokenEvent_js_1 = require("./AccessTokenEvent.js");
+let AccessTokenRoleGranted = class AccessTokenRoleGranted extends AccessTokenEvent_js_1.AccessTokenEvent {
+    constructor(token, Role) {
+        super(token);
+        this.Role = Role;
+    }
+};
+exports.AccessTokenRoleGranted = AccessTokenRoleGranted;
+exports.AccessTokenRoleGranted = AccessTokenRoleGranted = __decorate([
+    (0, queue_1.Event)(),
+    __metadata("design:paramtypes", [AccessToken_js_1.AccessToken, String])
+], AccessTokenRoleGranted);
+//# sourceMappingURL=AccessTokenRoleGranted.js.map

package/lib/cjs/events/AccessTokenRoleGranted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenRoleGranted.js","sourceRoot":"","sources":["../../../src/events/AccessTokenRoleGranted.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAuC;AACvC,6DAAuD;AACvD,+DAAyD;AAGlD,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,sCAAgB;IAC1D,YAAY,KAAkB,EAAS,IAAY;QACjD,KAAK,CAAC,KAAK,CAAC,CAAC;oBADwB,IAAI;IAE3C,CAAC;CACF,CAAA;;iCAJY,sBAAsB;IADlC,IAAA,aAAK,GAAE;qCAEa,4BAAW;GADnB,sBAAsB,CAIlC"}

package/lib/cjs/events/AccessTokenRoleRevoked.d.ts

@@ -0,0 +1,7 @@
+import { AccessToken } from '../models/AccessToken.js';
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+export declare class AccessTokenRoleRevoked extends AccessTokenEvent {
+    Role: string;
+    constructor(token: AccessToken, Role: string);
+}
+//# sourceMappingURL=AccessTokenRoleRevoked.d.ts.map

package/lib/cjs/events/AccessTokenRoleRevoked.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenRoleRevoked.d.ts","sourceRoot":"","sources":["../../../src/events/AccessTokenRoleRevoked.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,qBACa,sBAAuB,SAAQ,gBAAgB;IACnB,IAAI,EAAE,MAAM;IAAnD,YAAY,KAAK,EAAE,WAAW,EAAS,IAAI,EAAE,MAAM,EAElD;CACF"}

package/lib/cjs/events/AccessTokenRoleRevoked.js

@@ -0,0 +1,27 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessTokenRoleRevoked = void 0;
+const queue_1 = require("@spinajs/queue");
+const AccessToken_js_1 = require("../models/AccessToken.js");
+const AccessTokenEvent_js_1 = require("./AccessTokenEvent.js");
+let AccessTokenRoleRevoked = class AccessTokenRoleRevoked extends AccessTokenEvent_js_1.AccessTokenEvent {
+    constructor(token, Role) {
+        super(token);
+        this.Role = Role;
+    }
+};
+exports.AccessTokenRoleRevoked = AccessTokenRoleRevoked;
+exports.AccessTokenRoleRevoked = AccessTokenRoleRevoked = __decorate([
+    (0, queue_1.Event)(),
+    __metadata("design:paramtypes", [AccessToken_js_1.AccessToken, String])
+], AccessTokenRoleRevoked);
+//# sourceMappingURL=AccessTokenRoleRevoked.js.map

package/lib/cjs/events/AccessTokenRoleRevoked.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenRoleRevoked.js","sourceRoot":"","sources":["../../../src/events/AccessTokenRoleRevoked.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAuC;AACvC,6DAAuD;AACvD,+DAAyD;AAGlD,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,sCAAgB;IAC1D,YAAY,KAAkB,EAAS,IAAY;QACjD,KAAK,CAAC,KAAK,CAAC,CAAC;oBADwB,IAAI;IAE3C,CAAC;CACF,CAAA;;iCAJY,sBAAsB;IADlC,IAAA,aAAK,GAAE;qCAEa,4BAAW;GADnB,sBAAsB,CAIlC"}

package/lib/cjs/events/index.d.ts

@@ -0,0 +1,6 @@
+export * from './AccessTokenEvent.js';
+export * from './AccessTokenCreated.js';
+export * from './AccessTokenDeleted.js';
+export * from './AccessTokenRoleGranted.js';
+export * from './AccessTokenRoleRevoked.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/events/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/events/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC"}

package/lib/cjs/events/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./AccessTokenEvent.js"), exports);
+__exportStar(require("./AccessTokenCreated.js"), exports);
+__exportStar(require("./AccessTokenDeleted.js"), exports);
+__exportStar(require("./AccessTokenRoleGranted.js"), exports);
+__exportStar(require("./AccessTokenRoleRevoked.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/events/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/events/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAAsC;AACtC,0DAAwC;AACxC,0DAAwC;AACxC,8DAA4C;AAC5C,8DAA4C"}

package/lib/cjs/generator.d.ts

@@ -0,0 +1,12 @@
+import { AccessTokenGenerationProvider, IGeneratedToken } from './interfaces.js';
+/**
+ * Default token algorithm: `<prefix>` + N crypto-random bytes base64url encoded.
+ * The stable prefix makes leaked tokens findable by secret scanners.
+ */
+export declare class SecureRandomTokenProvider extends AccessTokenGenerationProvider {
+    protected Prefix: string;
+    protected Length: number;
+    generate(): Promise<IGeneratedToken>;
+    hash(plaintext: string): string;
+}
+//# sourceMappingURL=generator.d.ts.map

package/lib/cjs/generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/generator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEjF;;;GAGG;AACH,qBACa,yBAA0B,SAAQ,6BAA6B;IAE1E,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IAGzB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IAEZ,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAGhD;IAEM,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErC;CACF"}