@taico/taico 0.0.2

package/dist/authorization-server/dto/consent-metadata-response.dto.js

@@ -0,0 +1,130 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetConsentMetadataResponseDto = exports.FlowClientDto = exports.FlowServerDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const mcp_authorization_flow_status_enum_1 = require("../../auth-journeys/enums/mcp-authorization-flow-status.enum");
+class FlowServerDto {
+    providedId;
+    name;
+    description;
+}
+exports.FlowServerDto = FlowServerDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Server identifier used in API paths',
+        example: 'tasks',
+    }),
+    __metadata("design:type", String)
+], FlowServerDto.prototype, "providedId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Human-readable name of the MCP server',
+        example: 'Tasks',
+    }),
+    __metadata("design:type", String)
+], FlowServerDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Description of what the MCP server does',
+        example: 'Task management and productivity tool',
+    }),
+    __metadata("design:type", String)
+], FlowServerDto.prototype, "description", void 0);
+class FlowClientDto {
+    clientId;
+    clientName;
+}
+exports.FlowClientDto = FlowClientDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'OAuth client identifier',
+        example: '0bab273987a2e163c3abb40c631ec0a4',
+    }),
+    __metadata("design:type", String)
+], FlowClientDto.prototype, "clientId", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Human-readable name of the client application',
+        example: 'Claude Desktop',
+    }),
+    __metadata("design:type", String)
+], FlowClientDto.prototype, "clientName", void 0);
+class GetConsentMetadataResponseDto {
+    id;
+    status;
+    scopes;
+    resource;
+    server;
+    client;
+    redirectUri;
+    createdAt;
+}
+exports.GetConsentMetadataResponseDto = GetConsentMetadataResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Unique identifier of the authorization flow',
+        example: 'b15e8a76-5b6d-4bde-9a3b-26fdbaab5b4c',
+    }),
+    __metadata("design:type", String)
+], GetConsentMetadataResponseDto.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Current status of the authorization flow',
+        enum: mcp_authorization_flow_status_enum_1.McpAuthorizationFlowStatus,
+        example: mcp_authorization_flow_status_enum_1.McpAuthorizationFlowStatus.AUTHORIZATION_REQUEST_STARTED,
+    }),
+    __metadata("design:type", String)
+], GetConsentMetadataResponseDto.prototype, "status", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'List of scopes being requested',
+        example: ['tasks:read', 'tasks:write'],
+        type: [String],
+    }),
+    __metadata("design:type", Array)
+], GetConsentMetadataResponseDto.prototype, "scopes", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Resource URL the client wants to access',
+        example: 'http://localhost:4001/',
+    }),
+    __metadata("design:type", String)
+], GetConsentMetadataResponseDto.prototype, "resource", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'MCP server the client is requesting access to',
+        type: FlowServerDto,
+    }),
+    __metadata("design:type", FlowServerDto)
+], GetConsentMetadataResponseDto.prototype, "server", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Client application requesting authorization',
+        type: FlowClientDto,
+    }),
+    __metadata("design:type", FlowClientDto)
+], GetConsentMetadataResponseDto.prototype, "client", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Redirect URI provided in the authorization request',
+        example: 'http://localhost:4001/callback',
+    }),
+    __metadata("design:type", String)
+], GetConsentMetadataResponseDto.prototype, "redirectUri", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Timestamp when the flow was created',
+        example: '2024-01-15T10:30:00.000Z',
+    }),
+    __metadata("design:type", Date)
+], GetConsentMetadataResponseDto.prototype, "createdAt", void 0);
+//# sourceMappingURL=consent-metadata-response.dto.js.map

package/dist/authorization-server/dto/consent-metadata-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-metadata-response.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/consent-metadata-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,qHAA0G;AAK1G,MAAa,aAAa;IAKxB,UAAU,CAAU;IAMpB,IAAI,CAAU;IAMd,WAAW,CAAU;CACtB;AAlBD,sCAkBC;AAbC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,OAAO;KACjB,CAAC;;iDACkB;AAMpB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,OAAO;KACjB,CAAC;;2CACY;AAMd;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,uCAAuC;KACjD,CAAC;;kDACmB;AAMvB,MAAa,aAAa;IAKxB,QAAQ,CAAU;IAMlB,UAAU,CAAU;CACrB;AAZD,sCAYC;AAPC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,kCAAkC;KAC5C,CAAC;;+CACgB;AAMlB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,gBAAgB;KAC1B,CAAC;;iDACkB;AAStB,MAAa,6BAA6B;IAKxC,EAAE,CAAU;IAOZ,MAAM,CAA8B;IAOpC,MAAM,CAAY;IAMlB,QAAQ,CAAU;IAMlB,MAAM,CAAiB;IAMvB,MAAM,CAAiB;IAMvB,WAAW,CAAU;IAMrB,SAAS,CAAQ;CAClB;AAlDD,sEAkDC;AA7CC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,sCAAsC;KAChD,CAAC;;yDACU;AAOZ;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,0CAA0C;QACvD,IAAI,EAAE,+DAA0B;QAChC,OAAO,EAAE,+DAA0B,CAAC,6BAA6B;KAClE,CAAC;;6DACkC;AAOpC;IALC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,gCAAgC;QAC7C,OAAO,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACtC,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC;;6DACgB;AAMlB;IAJC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,wBAAwB;KAClC,CAAC;;+DACgB;AAMlB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,aAAa;KACpB,CAAC;8BACO,aAAa;6DAAC;AAMvB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,aAAa;KACpB,CAAC;8BACO,aAAa;6DAAC;AAMvB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,gCAAgC;KAC1C,CAAC;;kEACmB;AAMrB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,0BAA0B;KACpC,CAAC;8BACU,IAAI;gEAAC"}

package/dist/authorization-server/dto/introspect-token-request.dto.d.ts

@@ -0,0 +1,7 @@
+import { TokenTypeHint } from '../enums';
+export declare class IntrospectTokenRequestDto {
+    token: string;
+    token_type_hint?: TokenTypeHint;
+    client_id?: string;
+    client_secret?: string;
+}

package/dist/authorization-server/dto/introspect-token-request.dto.js

@@ -0,0 +1,63 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IntrospectTokenRequestDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+const enums_1 = require("../enums");
+class IntrospectTokenRequestDto {
+    token;
+    token_type_hint;
+    client_id;
+    client_secret;
+}
+exports.IntrospectTokenRequestDto = IntrospectTokenRequestDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Access or refresh token that should be validated',
+        example: 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...',
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], IntrospectTokenRequestDto.prototype, "token", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Hint to help the server determine the token lookup strategy',
+        enum: enums_1.TokenTypeHint,
+        example: enums_1.TokenTypeHint.ACCESS_TOKEN,
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(enums_1.TokenTypeHint),
+    __metadata("design:type", String)
+], IntrospectTokenRequestDto.prototype, "token_type_hint", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Client identifier for optional validation against the token claims. Per RFC 7662, this is not required - the client_id is extracted from the token itself.',
+        example: '0bab273987a2e163c3abb40c631ec0a4',
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], IntrospectTokenRequestDto.prototype, "client_id", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Client secret for confidential clients (MCP clients typically omit this)',
+        example: 's3cr3t',
+        nullable: true,
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], IntrospectTokenRequestDto.prototype, "client_secret", void 0);
+//# sourceMappingURL=introspect-token-request.dto.js.map

package/dist/authorization-server/dto/introspect-token-request.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect-token-request.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/introspect-token-request.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA2E;AAC3E,6CAAmE;AACnE,oCAAyC;AAKzC,MAAa,yBAAyB;IAOpC,KAAK,CAAU;IASf,eAAe,CAAiB;IAUhC,SAAS,CAAU;IAWnB,aAAa,CAAU;CACxB;AAtCD,8DAsCC;AA/BC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,yCAAyC;KACnD,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;wDACE;AASf;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,6DAA6D;QAC1E,IAAI,EAAE,qBAAa;QACnB,OAAO,EAAE,qBAAa,CAAC,YAAY;KACpC,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,qBAAa,CAAC;;kEACU;AAUhC;IARC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,4JAA4J;QAC9J,OAAO,EAAE,kCAAkC;KAC5C,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;4DACM;AAWnB;IATC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EACT,0EAA0E;QAC5E,OAAO,EAAE,QAAQ;QACjB,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;gEACU"}

package/dist/authorization-server/dto/introspect-token-response.dto.d.ts

@@ -0,0 +1,17 @@
+import { TokenType } from '../enums';
+import { AccessTokenClaims } from '../../auth/core/types/access-token-claims.type';
+export declare class IntrospectTokenResponseDto {
+    active: boolean;
+    token_type: TokenType;
+    client_id: string;
+    sub: AccessTokenClaims['sub'];
+    aud: AccessTokenClaims['aud'];
+    iss: AccessTokenClaims['iss'];
+    jti: AccessTokenClaims['jti'];
+    exp: AccessTokenClaims['exp'];
+    iat: AccessTokenClaims['iat'];
+    scope?: string;
+    mcp_server_identifier?: AccessTokenClaims['mcp_server_identifier'];
+    resource: AccessTokenClaims['resource'];
+    version: AccessTokenClaims['version'];
+}

package/dist/authorization-server/dto/introspect-token-response.dto.js

@@ -0,0 +1,126 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IntrospectTokenResponseDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const enums_1 = require("../enums");
+class IntrospectTokenResponseDto {
+    active;
+    token_type;
+    client_id;
+    sub;
+    aud;
+    iss;
+    jti;
+    exp;
+    iat;
+    scope;
+    mcp_server_identifier;
+    resource;
+    version;
+}
+exports.IntrospectTokenResponseDto = IntrospectTokenResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Indicates whether the token is currently valid',
+        example: true,
+    }),
+    __metadata("design:type", Boolean)
+], IntrospectTokenResponseDto.prototype, "active", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Token type, always Bearer for MCP clients',
+        enum: enums_1.TokenType,
+        example: enums_1.TokenType.BEARER,
+    }),
+    __metadata("design:type", String)
+], IntrospectTokenResponseDto.prototype, "token_type", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Client identifier associated with the token',
+        example: '0bab273987a2e163c3abb40c631ec0a4',
+    }),
+    __metadata("design:type", String)
+], IntrospectTokenResponseDto.prototype, "client_id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Subject of the token (resource owner or actor)',
+        example: 'journey:1234',
+    }),
+    __metadata("design:type", Object)
+], IntrospectTokenResponseDto.prototype, "sub", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Audience that should accept this token',
+        oneOf: [
+            { type: 'string', example: 'tasks-api' },
+            { type: 'array', items: { type: 'string' }, example: ['tasks-api'] },
+        ],
+    }),
+    __metadata("design:type", Object)
+], IntrospectTokenResponseDto.prototype, "aud", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Issuer that minted the token',
+        example: 'https://auth.tasks.local/auth',
+    }),
+    __metadata("design:type", Object)
+], IntrospectTokenResponseDto.prototype, "iss", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Unique token identifier for replay detection',
+        example: 'b15e8a76-5b6d-4bde-9a3b-26fdbaab5b4c',
+    }),
+    __metadata("design:type", Object)
+], IntrospectTokenResponseDto.prototype, "jti", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Expiration timestamp (seconds since Unix epoch)',
+        example: 1731145219,
+    }),
+    __metadata("design:type", Object)
+], IntrospectTokenResponseDto.prototype, "exp", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Issued-at timestamp (seconds since Unix epoch)',
+        example: 1731141619,
+    }),
+    __metadata("design:type", Object)
+], IntrospectTokenResponseDto.prototype, "iat", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Granted scopes (space-delimited) for display purposes',
+        example: 'tasks:read tasks:write',
+    }),
+    __metadata("design:type", String)
+], IntrospectTokenResponseDto.prototype, "scope", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'MCP server identifier the token is scoped to',
+        example: 'tasks',
+    }),
+    __metadata("design:type", Object)
+], IntrospectTokenResponseDto.prototype, "mcp_server_identifier", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Resource URL that was used during authorization',
+        example: 'http://localhost:4001/',
+    }),
+    __metadata("design:type", Object)
+], IntrospectTokenResponseDto.prototype, "resource", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Version of the MCP server contract',
+        example: '1.0.0',
+    }),
+    __metadata("design:type", Object)
+], IntrospectTokenResponseDto.prototype, "version", void 0);
+//# sourceMappingURL=introspect-token-response.dto.js.map

package/dist/authorization-server/dto/introspect-token-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"introspect-token-response.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/introspect-token-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,oCAAqC;AAOrC,MAAa,0BAA0B;IAKrC,MAAM,CAAW;IAOjB,UAAU,CAAa;IAMvB,SAAS,CAAU;IAMnB,GAAG,CAA4B;IAS/B,GAAG,CAA4B;IAM/B,GAAG,CAA4B;IAM/B,GAAG,CAA4B;IAM/B,GAAG,CAA4B;IAM/B,GAAG,CAA4B;IAM/B,KAAK,CAAU;IAMf,qBAAqB,CAA8C;IAMnE,QAAQ,CAAiC;IAMzC,OAAO,CAAgC;CACxC;AAlFD,gEAkFC;AA7EC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,gDAAgD;QAC7D,OAAO,EAAE,IAAI;KACd,CAAC;;0DACe;AAOjB;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,iBAAS;QACf,OAAO,EAAE,iBAAS,CAAC,MAAM;KAC1B,CAAC;;8DACqB;AAMvB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,kCAAkC;KAC5C,CAAC;;6DACiB;AAMnB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,gDAAgD;QAC7D,OAAO,EAAE,cAAc;KACxB,CAAC;;uDAC6B;AAS/B;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,wCAAwC;QACrD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE;YACxC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;SACrE;KACF,CAAC;;uDAC6B;AAM/B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,+BAA+B;KACzC,CAAC;;uDAC6B;AAM/B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,sCAAsC;KAChD,CAAC;;uDAC6B;AAM/B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,iDAAiD;QAC9D,OAAO,EAAE,UAAU;KACpB,CAAC;;uDAC6B;AAM/B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,gDAAgD;QAC7D,OAAO,EAAE,UAAU;KACpB,CAAC;;uDAC6B;AAM/B;IAJC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,wBAAwB;KAClC,CAAC;;yDACa;AAMf;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,OAAO;KACjB,CAAC;;yEACiE;AAMnE;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,iDAAiD;QAC9D,OAAO,EAAE,wBAAwB;KAClC,CAAC;;4DACuC;AAMzC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,OAAO;KACjB,CAAC;;2DACqC"}

package/dist/authorization-server/dto/issue-access-token-request.dto.d.ts

@@ -0,0 +1,5 @@
+export declare class IssueAccessTokenRequestDto {
+    name: string;
+    scopes: string[];
+    expirationDays?: number;
+}

package/dist/authorization-server/dto/issue-access-token-request.dto.js

@@ -0,0 +1,57 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IssueAccessTokenRequestDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class IssueAccessTokenRequestDto {
+    name;
+    scopes;
+    expirationDays;
+}
+exports.IssueAccessTokenRequestDto = IssueAccessTokenRequestDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Human-readable name for this token (e.g., "CI/CD Pipeline Token")',
+        example: 'Production API Token',
+        minLength: 1,
+        maxLength: 100,
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MinLength)(1),
+    (0, class_validator_1.MaxLength)(100),
+    __metadata("design:type", String)
+], IssueAccessTokenRequestDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Scopes to grant to this token',
+        example: ['tasks:read', 'tasks:write'],
+        type: [String],
+    }),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], IssueAccessTokenRequestDto.prototype, "scopes", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'Number of days until token expires (default: 30, max: 365)',
+        example: 30,
+        default: 30,
+        minimum: 1,
+        maximum: 365,
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsNumber)(),
+    (0, class_validator_1.Min)(1),
+    (0, class_validator_1.Max)(365),
+    __metadata("design:type", Number)
+], IssueAccessTokenRequestDto.prototype, "expirationDays", void 0);
+//# sourceMappingURL=issue-access-token-request.dto.js.map

package/dist/authorization-server/dto/issue-access-token-request.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-access-token-request.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/issue-access-token-request.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,qDASyB;AAMzB,MAAa,0BAA0B;IAWrC,IAAI,CAAU;IASd,MAAM,CAAY;IAalB,cAAc,CAAU;CACzB;AAlCD,gEAkCC;AAvBC;IAVC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,mEAAmE;QACrE,OAAO,EAAE,sBAAsB;QAC/B,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;KACf,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,CAAC,CAAC;IACZ,IAAA,2BAAS,EAAC,GAAG,CAAC;;wDACD;AASd;IAPC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,+BAA+B;QAC5C,OAAO,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACtC,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,0BAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;0DACP;AAalB;IAXC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,qBAAG,EAAC,CAAC,CAAC;IACN,IAAA,qBAAG,EAAC,GAAG,CAAC;;kEACe"}

package/dist/authorization-server/dto/issue-access-token-response.dto.d.ts

@@ -0,0 +1,8 @@
+export declare class IssueAccessTokenResponseDto {
+    id: string;
+    name: string;
+    token: string;
+    scopes: string[];
+    expiresAt: string;
+    createdAt: string;
+}

package/dist/authorization-server/dto/issue-access-token-response.dto.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IssueAccessTokenResponseDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+class IssueAccessTokenResponseDto {
+    id;
+    name;
+    token;
+    scopes;
+    expiresAt;
+    createdAt;
+}
+exports.IssueAccessTokenResponseDto = IssueAccessTokenResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Unique identifier for this token (can be used for revocation)',
+        example: '123e4567-e89b-12d3-a456-426614174000',
+    }),
+    __metadata("design:type", String)
+], IssueAccessTokenResponseDto.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Human-readable name for this token',
+        example: 'Production API Token',
+    }),
+    __metadata("design:type", String)
+], IssueAccessTokenResponseDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'The raw JWT token - only shown once, store securely!',
+        example: 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...',
+    }),
+    __metadata("design:type", String)
+], IssueAccessTokenResponseDto.prototype, "token", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Scopes granted to this token',
+        example: ['tasks:read', 'tasks:write'],
+        type: [String],
+    }),
+    __metadata("design:type", Array)
+], IssueAccessTokenResponseDto.prototype, "scopes", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'When this token expires (ISO 8601)',
+        example: '2025-02-20T12:00:00.000Z',
+    }),
+    __metadata("design:type", String)
+], IssueAccessTokenResponseDto.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'When this token was created (ISO 8601)',
+        example: '2025-01-20T12:00:00.000Z',
+    }),
+    __metadata("design:type", String)
+], IssueAccessTokenResponseDto.prototype, "createdAt", void 0);
+//# sourceMappingURL=issue-access-token-response.dto.js.map

package/dist/authorization-server/dto/issue-access-token-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-access-token-response.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/issue-access-token-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAM9C,MAAa,2BAA2B;IAMtC,EAAE,CAAU;IAMZ,IAAI,CAAU;IAMd,KAAK,CAAU;IAOf,MAAM,CAAY;IAMlB,SAAS,CAAU;IAMnB,SAAS,CAAU;CACpB;AAtCD,kEAsCC;AAhCC;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,+DAA+D;QACjE,OAAO,EAAE,sCAAsC;KAChD,CAAC;;uDACU;AAMZ;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,sBAAsB;KAChC,CAAC;;yDACY;AAMd;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,yCAAyC;KACnD,CAAC;;0DACa;AAOf;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACtC,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC;;2DACgB;AAMlB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,0BAA0B;KACpC,CAAC;;8DACiB;AAMnB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,0BAA0B;KACpC,CAAC;;8DACiB"}

package/dist/authorization-server/dto/issued-access-token-response.dto.d.ts

@@ -0,0 +1,15 @@
+export declare class IssuedAccessTokenResponseDto {
+    id: string;
+    name: string;
+    scopes: string[];
+    sub: string;
+    subjectSlug: string;
+    subjectDisplayName: string;
+    issuedBy: string;
+    issuedByDisplayName: string;
+    expiresAt: string;
+    createdAt: string;
+    revokedAt: string | null;
+    lastUsedAt: string | null;
+    isValid: boolean;
+}

package/dist/authorization-server/dto/issued-access-token-response.dto.js

@@ -0,0 +1,126 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IssuedAccessTokenResponseDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+class IssuedAccessTokenResponseDto {
+    id;
+    name;
+    scopes;
+    sub;
+    subjectSlug;
+    subjectDisplayName;
+    issuedBy;
+    issuedByDisplayName;
+    expiresAt;
+    createdAt;
+    revokedAt;
+    lastUsedAt;
+    isValid;
+}
+exports.IssuedAccessTokenResponseDto = IssuedAccessTokenResponseDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Unique identifier for this token',
+        example: '123e4567-e89b-12d3-a456-426614174000',
+    }),
+    __metadata("design:type", String)
+], IssuedAccessTokenResponseDto.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Human-readable name for this token',
+        example: 'Production API Token',
+    }),
+    __metadata("design:type", String)
+], IssuedAccessTokenResponseDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Scopes granted to this token',
+        example: ['tasks:read', 'tasks:write'],
+        type: [String],
+    }),
+    __metadata("design:type", Array)
+], IssuedAccessTokenResponseDto.prototype, "scopes", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Subject actor ID this token is issued for (JWT sub claim)',
+        example: '123e4567-e89b-12d3-a456-426614174000',
+    }),
+    __metadata("design:type", String)
+], IssuedAccessTokenResponseDto.prototype, "sub", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Subject actor slug',
+        example: 'my-agent',
+    }),
+    __metadata("design:type", String)
+], IssuedAccessTokenResponseDto.prototype, "subjectSlug", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Subject actor display name',
+        example: 'My Agent',
+    }),
+    __metadata("design:type", String)
+], IssuedAccessTokenResponseDto.prototype, "subjectDisplayName", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Actor ID of the issuer (human who created this token)',
+        example: '123e4567-e89b-12d3-a456-426614174000',
+    }),
+    __metadata("design:type", String)
+], IssuedAccessTokenResponseDto.prototype, "issuedBy", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Display name of the issuer',
+        example: 'John Doe',
+    }),
+    __metadata("design:type", String)
+], IssuedAccessTokenResponseDto.prototype, "issuedByDisplayName", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'When this token expires (ISO 8601)',
+        example: '2025-02-20T12:00:00.000Z',
+    }),
+    __metadata("design:type", String)
+], IssuedAccessTokenResponseDto.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'When this token was created (ISO 8601)',
+        example: '2025-01-20T12:00:00.000Z',
+    }),
+    __metadata("design:type", String)
+], IssuedAccessTokenResponseDto.prototype, "createdAt", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'When this token was revoked (ISO 8601), null if active',
+        example: null,
+        type: String,
+        nullable: true,
+    }),
+    __metadata("design:type", Object)
+], IssuedAccessTokenResponseDto.prototype, "revokedAt", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        description: 'When this token was last used (ISO 8601), null if never used',
+        example: '2025-01-21T08:30:00.000Z',
+        type: String,
+        nullable: true,
+    }),
+    __metadata("design:type", Object)
+], IssuedAccessTokenResponseDto.prototype, "lastUsedAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Whether the token is still valid (not expired and not revoked)',
+        example: true,
+    }),
+    __metadata("design:type", Boolean)
+], IssuedAccessTokenResponseDto.prototype, "isValid", void 0);
+//# sourceMappingURL=issued-access-token-response.dto.js.map

package/dist/authorization-server/dto/issued-access-token-response.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issued-access-token-response.dto.js","sourceRoot":"","sources":["../../../src/authorization-server/dto/issued-access-token-response.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AAMnE,MAAa,4BAA4B;IAKvC,EAAE,CAAU;IAMZ,IAAI,CAAU;IAOd,MAAM,CAAY;IAMlB,GAAG,CAAU;IAMb,WAAW,CAAU;IAMrB,kBAAkB,CAAU;IAM5B,QAAQ,CAAU;IAMlB,mBAAmB,CAAU;IAM7B,SAAS,CAAU;IAMnB,SAAS,CAAU;IAQnB,SAAS,CAAiB;IAQ1B,UAAU,CAAiB;IAO3B,OAAO,CAAW;CACnB;AApFD,oEAoFC;AA/EC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,sCAAsC;KAChD,CAAC;;wDACU;AAMZ;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,sBAAsB;KAChC,CAAC;;0DACY;AAOd;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACtC,IAAI,EAAE,CAAC,MAAM,CAAC;KACf,CAAC;;4DACgB;AAMlB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,sCAAsC;KAChD,CAAC;;yDACW;AAMb;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,UAAU;KACpB,CAAC;;iEACmB;AAMrB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,UAAU;KACpB,CAAC;;wEAC0B;AAM5B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,sCAAsC;KAChD,CAAC;;8DACgB;AAMlB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,4BAA4B;QACzC,OAAO,EAAE,UAAU;KACpB,CAAC;;yEAC2B;AAM7B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,0BAA0B;KACpC,CAAC;;+DACiB;AAMnB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,0BAA0B;KACpC,CAAC;;+DACiB;AAQnB;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,wDAAwD;QACrE,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,IAAI;KACf,CAAC;;+DACwB;AAQ1B;IANC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,8DAA8D;QAC3E,OAAO,EAAE,0BAA0B;QACnC,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,IAAI;KACf,CAAC;;gEACyB;AAO3B;IALC,IAAA,qBAAW,EAAC;QACX,WAAW,EACT,gEAAgE;QAClE,OAAO,EAAE,IAAI;KACd,CAAC;;6DACgB"}