@spinajs/rbac-http-token 2.0.507

package/lib/mjs/config/rbac-http-token.js

@@ -0,0 +1,96 @@
+import { join, normalize, resolve } from 'path';
+function dir(path) {
+    const inCommonJs = typeof module !== 'undefined';
+    return [
+        resolve(normalize(join(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), 'node_modules', '@spinajs', 'rbac-http-token', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+        // one up if we run from app or build folder
+        resolve(normalize(join(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), '../', 'node_modules', '@spinajs', 'rbac-http-token', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+    ];
+}
+const rbacHttpToken = {
+    system: {
+        dirs: {
+            // CLI commands and controllers are found by a filesystem scan
+            // ( `@ListFromFiles` ), so without these entries the shipped commands and
+            // the AccessToken controller are unreachable in a consuming app.
+            cli: [...dir('cli')],
+            controllers: [...dir('controllers')],
+            // `migrations` is DELIBERATELY not shipped here, and neither is `models`.
+            //
+            // Package configs merge into an app's config by ARRAY CONCAT, and
+            // `FilesystemMigrationSource` treats a non-empty `system.dirs.migrations`
+            // as "the operator configured the scan set": it then REPLACES the build
+            // layout defaults instead of adding to them, and turns a failed `.js`
+            // import from a warning into a throw ( `orm/src/migration-sources.ts`,
+            // and the docblock on `orm/src/config/orm.ts` which ships the key empty
+            // for exactly this reason ). A single line here would therefore silently
+            // switch off migration discovery in every application that installs this
+            // package. `RbacHttpTokenInitial_...` needs no scan anyway - it carries
+            // `@Migration`, is exported from the package index, and is picked up from
+            // the DI registry by `DiRegistryMigrationSource`. `@spinajs/rbac` ships
+            // `cli` only for the same reason.
+            //
+            // Nothing in the framework reads `system.dirs.models` - models register
+            // themselves through the `@Model` decorator when their file is imported.
+        },
+    },
+    queue: {
+        // All events emitted by this package go to the black hole connection
+        // declared by @spinajs/rbac ( `rbac-user-empty-queue` ). Without the
+        // routing they would fall back to the application's DEFAULT connection -
+        // a real broker - and every token operation would publish to it.
+        routing: {
+            AccessTokenCreated: { connection: 'rbac-user-empty-queue' },
+            AccessTokenDeleted: { connection: 'rbac-user-empty-queue' },
+            AccessTokenRoleGranted: { connection: 'rbac-user-empty-queue' },
+            AccessTokenRoleRevoked: { connection: 'rbac-user-empty-queue' },
+        },
+    },
+    rbac: {
+        token: {
+            /**
+             * Token generation algorithm. Swap for your own implementation of
+             * AccessTokenGenerationProvider registered under this name.
+             */
+            generation: {
+                service: 'SecureRandomTokenProvider',
+            },
+            /**
+             * Stable plaintext prefix - lets secret scanners recognise leaked tokens.
+             */
+            prefix: 'spt_',
+            /**
+             * Random bytes per token ( 32 = 256 bit entropy ).
+             */
+            length: 32,
+            /**
+             * Fallback header checked when no `Authorization: Bearer` is present.
+             */
+            headerName: 'x-api-key',
+            /**
+             * Seconds between LastUsedAt writes for a busy token.
+             */
+            lastUsedUpdateInterval: 60,
+        },
+        grants: {
+            user: {
+                'user.tokens': { 'create:own': ['*'], 'read:own': ['*'], 'update:own': ['*'], 'delete:own': ['*'] },
+            },
+            // RESERVED - nothing shipped in this package enforces or consumes these.
+            //
+            // `AccessTokenController` is self-service by construction: every one of
+            // its routes declares an `*Own` permission and additionally constrains
+            // its query by the caller's id ( `own()` ), so an `*:any` grant changes
+            // nothing about what that controller lets through. The entry is here so
+            // the role's grant map is complete ahead of an admin-scope controller -
+            // "list / revoke the tokens of any user" is the obvious next addition -
+            // and so an application that writes such a controller itself finds the
+            // grants already declared under the resource name it must use.
+            'admin.users': {
+                'user.tokens': { 'create:any': ['*'], 'read:any': ['*'], 'update:any': ['*'], 'delete:any': ['*'] },
+            },
+        },
+    },
+};
+export default rbacHttpToken;
+//# sourceMappingURL=rbac-http-token.js.map

package/lib/mjs/config/rbac-http-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-http-token.js","sourceRoot":"","sources":["../../../src/config/rbac-http-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAElK,4CAA4C;QAC5C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KAC1K,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,8DAA8D;YAC9D,0EAA0E;YAC1E,iEAAiE;YACjE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;YAEpC,0EAA0E;YAC1E,EAAE;YACF,kEAAkE;YAClE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,wEAAwE;YACxE,kCAAkC;YAClC,EAAE;YACF,wEAAwE;YACxE,yEAAyE;SAC1E;KACF;IACD,KAAK,EAAE;QACL,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,iEAAiE;QACjE,OAAO,EAAE;YACP,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,kBAAkB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC3D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;YAC/D,sBAAsB,EAAE,EAAE,UAAU,EAAE,uBAAuB,EAAE;SAChE;KACF;IACD,IAAI,EAAE;QACJ,KAAK,EAAE;YACL;;;eAGG;YACH,UAAU,EAAE;gBACV,OAAO,EAAE,2BAA2B;aACrC;YAED;;eAEG;YACH,MAAM,EAAE,MAAM;YAEd;;eAEG;YACH,MAAM,EAAE,EAAE;YAEV;;eAEG;YACH,UAAU,EAAE,WAAW;YAEvB;;eAEG;YACH,sBAAsB,EAAE,EAAE;SAC3B;QACD,MAAM,EAAE;YACN,IAAI,EAAE;gBACJ,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;YAED,yEAAyE;YACzE,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,+DAA+D;YAC/D,aAAa,EAAE;gBACb,aAAa,EAAE,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE;aACpG;SACF;KACF;CACF,CAAC;AAEF,eAAe,aAAa,CAAC"}

package/lib/mjs/controllers/AccessTokenController.d.ts

@@ -0,0 +1,139 @@
+import { BadRequestResponse, BaseController, NotFound, Ok } from '@spinajs/http';
+import { User as UserModel } from '@spinajs/rbac';
+import { AccessToken } from '../models/AccessToken.js';
+import { CreateTokenDto } from '../dto/create-token-dto.js';
+/**
+ * Self-service management of own access tokens.
+ *
+ * SELF-service in the strict sense: the caller must be the account owner,
+ * present in person. Two ways of acting *as* somebody are refused outright -
+ * an access token ( which must never mint another token ) and an impersonated
+ * session ( which must never mint a credential that outlives it ). Every query
+ * is additionally constrained by the calling user's id, so a foreign uuid is
+ * simply not found.
+ *
+ * WIRING - the decorator layout below is load bearing. The two guards share ONE
+ * `@Policy([...])` group so they are ANDed; splitting them into two `@Policy()`
+ * calls would OR them and each would become optional. And do NOT add a class
+ * level `@Policy(RbacPolicy)` alongside:
+ *
+ * `@spinajs/http` combines policies at three levels ( see `createPolicyGate` in
+ * `http/src/route-builder.ts` ): AND inside one `@Policy()` group, OR between
+ * the groups declared at one scope, AND between the controller scope and the
+ * route scope. `@Permission()` already pushes `RbacPolicy` as a group on the
+ * ROUTE ( `rbac-http/src/decorators.ts` ), so:
+ *
+ *   - controller scope holds exactly ONE group,
+ *     `[NoTokenAuthPolicy, NoImpersonationPolicy]`. A lone group cannot be ORed
+ *     away, so both are a hard requirement of EVERY route on this controller,
+ *     including any route added later.
+ *   - route scope holds `[RbacPolicy]` from `@Permission`, which demands an
+ *     authorized session AND the declared grant.
+ *
+ * Adding `@Policy(RbacPolicy)` at class level would make the controller scope
+ * `[NoTokenAuthPolicy, NoImpersonationPolicy] OR [RbacPolicy]`, and satisfying
+ * `RbacPolicy` alone would then discharge the whole scope - both invariants
+ * would rest on nothing but RbacPolicy's own session check, which does not look
+ * at impersonation at all.
+ *
+ * @tags AccessTokens
+ */
+export declare class AccessTokenController extends BaseController {
+    /**
+     * List own access tokens
+     * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
+     * dehydrated rows carry the uuid, label, roles and timestamps only.
+     * @security cookieAuth
+     * @response 200 Own tokens
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    list(user: UserModel): Promise<Ok<unknown>>;
+    /**
+     * Create an access token
+     * The plaintext appears in this response only and cannot be retrieved again.
+     * Roles must be a subset of the caller's own roles.
+     * @security cookieAuth
+     * @response 200 Token created, `Plaintext` returned once
+     * @response 400 Requested roles are not held by the caller
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    create(user: UserModel, dto: CreateTokenDto): Promise<Ok<unknown> | BadRequestResponse>;
+    /**
+     * Delete ( revoke ) an own token
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @response 200 Token deleted
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    delete(user: UserModel, uuid: string): Promise<Ok | NotFound>;
+    /**
+     * Grant a role to an own token
+     * The role must be held by the caller - a token can never carry more than its
+     * owner does.
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @param role Role name to grant
+     * @response 200 Updated token
+     * @response 400 Role is not held by the caller
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    grantRole(user: UserModel, uuid: string, role: string): Promise<Ok<unknown> | NotFound | BadRequestResponse>;
+    /**
+     * Revoke a role from an own token
+     * A token must keep at least one role; dropping the last one is refused with
+     * 400 - deleting the token is the way to revoke it entirely.
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @param role Role name to revoke
+     * @response 200 Updated token
+     * @response 400 Cannot revoke the token's last role
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    revokeRole(user: UserModel, uuid: string, role: string): Promise<Ok<unknown> | NotFound | BadRequestResponse>;
+    /**
+     * Resolves a token by uuid WITHIN the caller's own tokens - the ownership
+     * boundary of this whole controller.
+     */
+    protected own(user: UserModel, uuid: string): Promise<AccessToken | undefined>;
+    /**
+     * Wire shape of one token: the dehydrated row, with timestamps as ISO
+     * instants and `Roles` put back as a real array.
+     *
+     * `dehydrate()` runs every column through its converter's `toDB` direction -
+     * the STORAGE encoding, which is not the API contract in two places:
+     *
+     *   - `dateTimeFormat: 'iso'` is what turns `CreatedAt` / `ExpiresAt` /
+     *     `LastUsedAt` into offset-carrying ISO strings. Without it the sql
+     *     converter emits its driver format ( `"2026-08-11 10:00:00"` ), which
+     *     names no offset at all, so a client has to guess the zone. Every other
+     *     user-bearing response in the repo dehydrates with this option - see
+     *     `rbac-http-user/src/controllers/UserController.ts` - and a plain
+     *     `toJSON()` is exactly `dehydrate()` with the option missing.
+     *   - `@Set()`'s converter joins the role list into `"user,admin"`. Left
+     *     alone, `Roles` reaches clients as a string that only looks like a list,
+     *     which no generated client parses back.
+     *
+     * `@Hidden()` columns ( `Token`, `Id` ) are dropped by `dehydrate` itself and
+     * `user_id` is skipped as the `User` relation's foreign key, so the hash still
+     * never leaves here.
+     */
+    protected toWire(token: AccessToken): Record<string, unknown>;
+    /**
+     * Turns the actions layer's role refusals into a 400.
+     *
+     * `ErrorCode` has no entry in the http error map, so an uncaught one leaves as
+     * a 500 - and "you asked for a role you do not have" / "a token must keep one
+     * role" are the caller's mistakes, not the server's. Anything else is rethrown
+     * untouched so a genuine failure still reaches the error handler.
+     */
+    protected roleError(err: unknown): BadRequestResponse;
+}
+//# sourceMappingURL=AccessTokenController.d.ts.map

package/lib/mjs/controllers/AccessTokenController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenController.d.ts","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAA4B,QAAQ,EAAE,EAAE,EAA4B,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAKlD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,qBAGa,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;OAQG;IAGU,IAAI,CAAS,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAG/D;IAED;;;;;;;;;OASG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAU,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,kBAAkB,CAAC,CASnH;IAED;;;;;;;;OAQG;IAGU,MAAM,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAC,CAQ1F;IAED;;;;;;;;;;;;OAYG;IAGU,SAAS,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYlJ;IAED;;;;;;;;;;;;OAYG;IAGU,UAAU,CAAS,IAAI,EAAE,SAAS,EAAW,IAAI,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,QAAQ,GAAG,kBAAkB,CAAC,CAYnJ;IAED;;;OAGG;IACH,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAE7E;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE5D;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,CAMpD;CACF"}

package/lib/mjs/controllers/AccessTokenController.js

@@ -0,0 +1,261 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { BadRequestResponse, BaseController, BasePath, Body, Del, Get, NotFound, Ok, Param, Policy, Post, Put } from '@spinajs/http';
+import { User as UserModel } from '@spinajs/rbac';
+import { Permission, Resource, User } from '@spinajs/rbac-http';
+import { ErrorCode } from '@spinajs/exceptions';
+import { DateTime } from 'luxon';
+import { AccessToken } from '../models/AccessToken.js';
+import { E_TOKEN_CODES, createToken, deleteToken, grantTokenRole, revokeTokenRole } from '../actions.js';
+import { CreateTokenDto } from '../dto/create-token-dto.js';
+import { NoTokenAuthPolicy } from '../policies/NoTokenAuthPolicy.js';
+import { NoImpersonationPolicy } from '../policies/NoImpersonationPolicy.js';
+/**
+ * Self-service management of own access tokens.
+ *
+ * SELF-service in the strict sense: the caller must be the account owner,
+ * present in person. Two ways of acting *as* somebody are refused outright -
+ * an access token ( which must never mint another token ) and an impersonated
+ * session ( which must never mint a credential that outlives it ). Every query
+ * is additionally constrained by the calling user's id, so a foreign uuid is
+ * simply not found.
+ *
+ * WIRING - the decorator layout below is load bearing. The two guards share ONE
+ * `@Policy([...])` group so they are ANDed; splitting them into two `@Policy()`
+ * calls would OR them and each would become optional. And do NOT add a class
+ * level `@Policy(RbacPolicy)` alongside:
+ *
+ * `@spinajs/http` combines policies at three levels ( see `createPolicyGate` in
+ * `http/src/route-builder.ts` ): AND inside one `@Policy()` group, OR between
+ * the groups declared at one scope, AND between the controller scope and the
+ * route scope. `@Permission()` already pushes `RbacPolicy` as a group on the
+ * ROUTE ( `rbac-http/src/decorators.ts` ), so:
+ *
+ *   - controller scope holds exactly ONE group,
+ *     `[NoTokenAuthPolicy, NoImpersonationPolicy]`. A lone group cannot be ORed
+ *     away, so both are a hard requirement of EVERY route on this controller,
+ *     including any route added later.
+ *   - route scope holds `[RbacPolicy]` from `@Permission`, which demands an
+ *     authorized session AND the declared grant.
+ *
+ * Adding `@Policy(RbacPolicy)` at class level would make the controller scope
+ * `[NoTokenAuthPolicy, NoImpersonationPolicy] OR [RbacPolicy]`, and satisfying
+ * `RbacPolicy` alone would then discharge the whole scope - both invariants
+ * would rest on nothing but RbacPolicy's own session check, which does not look
+ * at impersonation at all.
+ *
+ * @tags AccessTokens
+ */
+let AccessTokenController = class AccessTokenController extends BaseController {
+    /**
+     * List own access tokens
+     * Hashes are never returned - `Token` is `@Hidden()` on the model, so the
+     * dehydrated rows carry the uuid, label, roles and timestamps only.
+     * @security cookieAuth
+     * @response 200 Own tokens
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    async list(user) {
+        const tokens = await AccessToken.where('user_id', user.Id);
+        return new Ok(tokens.map((t) => this.toWire(t)));
+    }
+    /**
+     * Create an access token
+     * The plaintext appears in this response only and cannot be retrieved again.
+     * Roles must be a subset of the caller's own roles.
+     * @security cookieAuth
+     * @response 200 Token created, `Plaintext` returned once
+     * @response 400 Requested roles are not held by the caller
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     */
+    async create(user, dto) {
+        const expiresAt = dto.ExpiresAt ? DateTime.fromISO(dto.ExpiresAt) : null;
+        try {
+            const { Token, Plaintext } = await createToken(user, dto.Name, dto.Roles, expiresAt);
+            return new Ok({ Token: this.toWire(Token), Plaintext }, { Headers: [{ Name: 'Cache-Control', Value: 'no-store' }] });
+        }
+        catch (err) {
+            return this.roleError(err);
+        }
+    }
+    /**
+     * Delete ( revoke ) an own token
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @response 200 Token deleted
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    async delete(user, uuid) {
+        const token = await this.own(user, uuid);
+        if (!token) {
+            return new NotFound({ error: { code: 'E_TOKEN_NOT_FOUND', message: 'No such token' } });
+        }
+        await deleteToken(token);
+        return new Ok();
+    }
+    /**
+     * Grant a role to an own token
+     * The role must be held by the caller - a token can never carry more than its
+     * owner does.
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @param role Role name to grant
+     * @response 200 Updated token
+     * @response 400 Role is not held by the caller
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    async grantRole(user, uuid, role) {
+        const token = await this.own(user, uuid);
+        if (!token) {
+            return new NotFound({ error: { code: 'E_TOKEN_NOT_FOUND', message: 'No such token' } });
+        }
+        try {
+            const updated = await grantTokenRole(token, role);
+            return new Ok(this.toWire(updated));
+        }
+        catch (err) {
+            return this.roleError(err);
+        }
+    }
+    /**
+     * Revoke a role from an own token
+     * A token must keep at least one role; dropping the last one is refused with
+     * 400 - deleting the token is the way to revoke it entirely.
+     * @security cookieAuth
+     * @param uuid Public identifier of the token
+     * @param role Role name to revoke
+     * @response 200 Updated token
+     * @response 400 Cannot revoke the token's last role
+     * @response 401 Unauthorized - valid session required
+     * @response 403 Forbidden - access tokens cannot be used on this route
+     * @response 404 No such token for this user
+     */
+    async revokeRole(user, uuid, role) {
+        const token = await this.own(user, uuid);
+        if (!token) {
+            return new NotFound({ error: { code: 'E_TOKEN_NOT_FOUND', message: 'No such token' } });
+        }
+        try {
+            const updated = await revokeTokenRole(token, role);
+            return new Ok(this.toWire(updated));
+        }
+        catch (err) {
+            return this.roleError(err);
+        }
+    }
+    /**
+     * Resolves a token by uuid WITHIN the caller's own tokens - the ownership
+     * boundary of this whole controller.
+     */
+    own(user, uuid) {
+        return AccessToken.where({ Uuid: uuid, user_id: user.Id }).first();
+    }
+    /**
+     * Wire shape of one token: the dehydrated row, with timestamps as ISO
+     * instants and `Roles` put back as a real array.
+     *
+     * `dehydrate()` runs every column through its converter's `toDB` direction -
+     * the STORAGE encoding, which is not the API contract in two places:
+     *
+     *   - `dateTimeFormat: 'iso'` is what turns `CreatedAt` / `ExpiresAt` /
+     *     `LastUsedAt` into offset-carrying ISO strings. Without it the sql
+     *     converter emits its driver format ( `"2026-08-11 10:00:00"` ), which
+     *     names no offset at all, so a client has to guess the zone. Every other
+     *     user-bearing response in the repo dehydrates with this option - see
+     *     `rbac-http-user/src/controllers/UserController.ts` - and a plain
+     *     `toJSON()` is exactly `dehydrate()` with the option missing.
+     *   - `@Set()`'s converter joins the role list into `"user,admin"`. Left
+     *     alone, `Roles` reaches clients as a string that only looks like a list,
+     *     which no generated client parses back.
+     *
+     * `@Hidden()` columns ( `Token`, `Id` ) are dropped by `dehydrate` itself and
+     * `user_id` is skipped as the `User` relation's foreign key, so the hash still
+     * never leaves here.
+     */
+    toWire(token) {
+        return { ...token.dehydrate({ dateTimeFormat: 'iso' }), Roles: [...token.Roles] };
+    }
+    /**
+     * Turns the actions layer's role refusals into a 400.
+     *
+     * `ErrorCode` has no entry in the http error map, so an uncaught one leaves as
+     * a 500 - and "you asked for a role you do not have" / "a token must keep one
+     * role" are the caller's mistakes, not the server's. Anything else is rethrown
+     * untouched so a genuine failure still reaches the error handler.
+     */
+    roleError(err) {
+        if (err instanceof ErrorCode && err.code === E_TOKEN_CODES.E_TOKEN_ROLE_NOT_ALLOWED) {
+            return new BadRequestResponse({ error: { code: 'E_TOKEN_ROLE_NOT_ALLOWED', message: err.message } });
+        }
+        throw err;
+    }
+};
+__decorate([
+    Get('tokens'),
+    Permission(['readOwn']),
+    __param(0, User()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "list", null);
+__decorate([
+    Post('tokens'),
+    Permission(['createOwn']),
+    __param(0, User()),
+    __param(1, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, CreateTokenDto]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "create", null);
+__decorate([
+    Del('tokens/:uuid'),
+    Permission(['deleteOwn']),
+    __param(0, User()),
+    __param(1, Param()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, String]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "delete", null);
+__decorate([
+    Put('tokens/:uuid/roles/:role'),
+    Permission(['updateOwn']),
+    __param(0, User()),
+    __param(1, Param()),
+    __param(2, Param()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, String, String]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "grantRole", null);
+__decorate([
+    Del('tokens/:uuid/roles/:role'),
+    Permission(['updateOwn']),
+    __param(0, User()),
+    __param(1, Param()),
+    __param(2, Param()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [UserModel, String, String]),
+    __metadata("design:returntype", Promise)
+], AccessTokenController.prototype, "revokeRole", null);
+AccessTokenController = __decorate([
+    BasePath('user'),
+    Resource('user.tokens'),
+    Policy([NoTokenAuthPolicy, NoImpersonationPolicy])
+], AccessTokenController);
+export { AccessTokenController };
+//# sourceMappingURL=AccessTokenController.js.map

package/lib/mjs/controllers/AccessTokenController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenController.js","sourceRoot":"","sources":["../../../src/controllers/AccessTokenController.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,cAAc;IACvD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAS,IAAe;QACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAU,GAAmB;QACtE,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACrF,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAS,IAAe,EAAW,IAAY;QAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,IAAI,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,SAAS,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,UAAU,CAAS,IAAe,EAAW,IAAY,EAAW,IAAY;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,OAAO,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;;OAGG;IACO,GAAG,CAAC,IAAe,EAAE,IAAY;QACzC,OAAO,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,MAAM,CAAC,KAAkB;QACjC,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACO,SAAS,CAAC,GAAY;QAC9B,IAAI,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,wBAAwB,EAAE,CAAC;YACpF,OAAO,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;CACF,CAAA;AA5Jc;IAFZ,GAAG,CAAC,QAAQ,CAAC;IACb,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;;qCAAO,SAAS;;iDAGxC;AAcY;IAFZ,IAAI,CAAC,QAAQ,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;;qCAAlB,SAAS,EAAe,cAAc;;mDASvE;AAaY;IAFZ,GAAG,CAAC,cAAc,CAAC;IACnB,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;;qCAAnB,SAAS;;mDAQ1C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACF,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;sDAY7C;AAiBY;IAFZ,GAAG,CAAC,0BAA0B,CAAC;IAC/B,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACD,WAAA,IAAI,EAAE,CAAA;IAAmB,WAAA,KAAK,EAAE,CAAA;IAAgB,WAAA,KAAK,EAAE,CAAA;;qCAA1C,SAAS;;uDAY9C;AArHU,qBAAqB;IAHjC,QAAQ,CAAC,MAAM,CAAC;IAChB,QAAQ,CAAC,aAAa,CAAC;IACvB,MAAM,CAAC,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;GACtC,qBAAqB,CAwKjC"}

package/lib/mjs/dto/create-token-dto.d.ts

@@ -0,0 +1,34 @@
+export declare const CreateTokenDtoSchema: {
+    $schema: string;
+    title: string;
+    type: string;
+    properties: {
+        Name: {
+            type: string;
+            minLength: number;
+            maxLength: number;
+            description: string;
+        };
+        Roles: {
+            type: string;
+            items: {
+                type: string;
+            };
+            minItems: number;
+            description: string;
+        };
+        ExpiresAt: {
+            type: string[];
+            format: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+export declare class CreateTokenDto {
+    Name: string;
+    Roles: string[];
+    ExpiresAt?: string | null;
+    constructor(data: any);
+}
+//# sourceMappingURL=create-token-dto.d.ts.map

package/lib/mjs/dto/create-token-dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-token-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,oBAAoB;IAC/B,OAAO;IACP,KAAK;IACL,IAAI;IACJ,UAAU;QACR,IAAI;YAAI,IAAI;YAAY,SAAS;YAAK,SAAS;YAAO,WAAW;;QACjE,KAAK;YAAI,IAAI;YAAW,KAAK;gBAAI,IAAI;;YAAc,QAAQ;YAAK,WAAW;;QAC3E,SAAS;YAAI,IAAI;YAAsB,MAAM;YAAe,WAAW;;;IAEzE,QAAQ;CACT,CAAC;AAEF,qBACa,cAAc;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,YAAY,IAAI,EAAE,GAAG,EAEpB;CACF"}

package/lib/mjs/dto/create-token-dto.js

@@ -0,0 +1,32 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Schema } from '@spinajs/validation';
+export const CreateTokenDtoSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Create access token DTO',
+    type: 'object',
+    properties: {
+        Name: { type: 'string', minLength: 1, maxLength: 128, description: 'Human readable token label' },
+        Roles: { type: 'array', items: { type: 'string' }, minItems: 1, description: 'Roles allowed on the token, must be subset of own roles' },
+        ExpiresAt: { type: ['string', 'null'], format: 'date-time', description: 'ISO expiration instant; null or omitted = never expires' },
+    },
+    required: ['Name', 'Roles'],
+};
+let CreateTokenDto = class CreateTokenDto {
+    constructor(data) {
+        Object.assign(this, data);
+    }
+};
+CreateTokenDto = __decorate([
+    Schema(CreateTokenDtoSchema),
+    __metadata("design:paramtypes", [Object])
+], CreateTokenDto);
+export { CreateTokenDto };
+//# sourceMappingURL=create-token-dto.js.map

package/lib/mjs/dto/create-token-dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-token-dto.js","sourceRoot":"","sources":["../../../src/dto/create-token-dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,yCAAyC;IAClD,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE;QACjG,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE;QACxI,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,yDAAyD,EAAE;KACrI;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;CAC5B,CAAC;AAGK,IAAM,cAAc,GAApB,MAAM,cAAc;IAKzB,YAAY,IAAS;QACnB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AARY,cAAc;IAD1B,MAAM,CAAC,oBAAoB,CAAC;;GAChB,cAAc,CAQ1B"}

package/lib/mjs/events/AccessTokenCreated.d.ts

@@ -0,0 +1,4 @@
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+export declare class AccessTokenCreated extends AccessTokenEvent {
+}
+//# sourceMappingURL=AccessTokenCreated.d.ts.map

package/lib/mjs/events/AccessTokenCreated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenCreated.d.ts","sourceRoot":"","sources":["../../../src/events/AccessTokenCreated.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,qBACa,kBAAmB,SAAQ,gBAAgB;CAAG"}

package/lib/mjs/events/AccessTokenCreated.js

@@ -0,0 +1,15 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Event } from '@spinajs/queue';
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+let AccessTokenCreated = class AccessTokenCreated extends AccessTokenEvent {
+};
+AccessTokenCreated = __decorate([
+    Event()
+], AccessTokenCreated);
+export { AccessTokenCreated };
+//# sourceMappingURL=AccessTokenCreated.js.map

package/lib/mjs/events/AccessTokenCreated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenCreated.js","sourceRoot":"","sources":["../../../src/events/AccessTokenCreated.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGlD,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,gBAAgB;CAAG,CAAA;AAA9C,kBAAkB;IAD9B,KAAK,EAAE;GACK,kBAAkB,CAA4B"}

package/lib/mjs/events/AccessTokenDeleted.d.ts

@@ -0,0 +1,4 @@
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+export declare class AccessTokenDeleted extends AccessTokenEvent {
+}
+//# sourceMappingURL=AccessTokenDeleted.d.ts.map

package/lib/mjs/events/AccessTokenDeleted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenDeleted.d.ts","sourceRoot":"","sources":["../../../src/events/AccessTokenDeleted.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,qBACa,kBAAmB,SAAQ,gBAAgB;CAAG"}

package/lib/mjs/events/AccessTokenDeleted.js

@@ -0,0 +1,15 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Event } from '@spinajs/queue';
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+let AccessTokenDeleted = class AccessTokenDeleted extends AccessTokenEvent {
+};
+AccessTokenDeleted = __decorate([
+    Event()
+], AccessTokenDeleted);
+export { AccessTokenDeleted };
+//# sourceMappingURL=AccessTokenDeleted.js.map