assembly-kit 0.0.1

package/dist/schemas/index.mjs

@@ -0,0 +1,34 @@
+import { MembershipTypeSchema } from "./shared/membership-type.mjs";
+import { AppConnectionCreateRequestSchema, AppConnectionResponseSchema, AppConnectionSchema, AppConnectionTypeSchema, AppConnectionsResponseSchema } from "../lib/modules/app-connections/schema.mjs";
+import { AppInstallResponseSchema, AppInstallSchema, AppInstallTypeSchema, AppInstallsResponseSchema } from "../lib/modules/app-installs/schema.mjs";
+import { ClientCreateRequestSchema, ClientResponseSchema, ClientSchema, ClientUpdateRequestSchema, ClientsResponseSchema } from "../lib/modules/clients/schema.mjs";
+import { HexColorSchema } from "./shared/hex-color.mjs";
+import { CompaniesResponseSchema, CompanyCreateRequestSchema, CompanyResponseSchema, CompanySchema, CompanyUpdateRequestSchema } from "../lib/modules/companies/schema.mjs";
+import { ContractTemplateResponseSchema, ContractTemplateSchema, ContractTemplatesResponseSchema } from "../lib/modules/contract-templates/schema.mjs";
+import { ContractFieldInputTypeSchema, ContractFieldSchema, ContractResponseSchema, ContractSchema, ContractSendRequestSchema, ContractStatusSchema, ContractsResponseSchema } from "../lib/modules/contracts/schema.mjs";
+import { CustomFieldOptionSchema, ListCustomFieldOptionResponseSchema } from "../lib/modules/custom-field-options/schema.mjs";
+import { AddressValueSchema, CustomFieldEntityTypeSchema, CustomFieldSchema, CustomFieldTypeSchema, CustomFieldValueSchema, ListCustomFieldResponseSchema } from "../lib/modules/custom-fields/schema.mjs";
+import { AuditLogEventResponseSchema, AuditLogEventSchema, AuditLogEventsResponseSchema, EventActorTypeSchema, EventCreateRequestSchema, EventSourceSchema } from "../lib/modules/events/schema.mjs";
+import { FileChannelCreateRequestSchema, FileChannelResponseSchema, FileChannelSchema, FileChannelsResponseSchema } from "../lib/modules/file-channels/schema.mjs";
+import { AssemblyFileResponseSchema, AssemblyFileSchema, AssemblyFilesResponseSchema, FileTypeSchema } from "../lib/modules/files/schema.mjs";
+import { FormResponseCreateRequestSchema, FormResponseItemResponseSchema, FormResponseSchema, FormResponsesResponseSchema } from "../lib/modules/form-responses/schema.mjs";
+import { FormDataResponseSchema, FormSchema, FormsDataResponseSchema } from "../lib/modules/forms/schema.mjs";
+import { InternalUserResponseSchema, InternalUserSchema, InternalUsersResponseSchema } from "../lib/modules/internal-users/schema.mjs";
+import { InvoiceTemplateResponseSchema, InvoiceTemplateSchema, InvoiceTemplatesResponseSchema } from "../lib/modules/invoice-templates/schema.mjs";
+import { InvoiceCreateRequestSchema, InvoiceLineItemRequestSchema, InvoiceLineItemSchema, InvoicePaymentMethodPreferenceRequestSchema, InvoiceResponseSchema, InvoiceSchema, InvoiceStatusSchema, InvoicesResponseSchema, PaymentMethodPreferenceSchema, PaymentMethodTypeSchema } from "../lib/modules/invoices/schema.mjs";
+import { MessageChannelCreateRequestSchema, MessageChannelResponseSchema, MessageChannelSchema, MessageChannelsResponseSchema } from "../lib/modules/message-channels/schema.mjs";
+import { MessageResponseSchema, MessageSchema, MessagesResponseSchema, SendMessageRequestSchema } from "../lib/modules/messages/schema.mjs";
+import { NoteCreateRequestSchema, NoteResponseSchema, NoteSchema, NoteUpdateRequestSchema, NotesResponseSchema } from "../lib/modules/notes/schema.mjs";
+import { EmailDeliveryTargetSchema, InProductDeliveryTargetSchema, NotificationCreateRequestSchema, NotificationDeliveryTargetsSchema, NotificationResponseSchema, NotificationSchema, NotificationsResponseSchema } from "../lib/modules/notifications/schema.mjs";
+import { PaymentResponseSchema, PaymentSchema, PaymentsResponseSchema } from "../lib/modules/payments/schema.mjs";
+import { PriceResponseSchema, PriceSchema, PricesResponseSchema } from "../lib/modules/prices/schema.mjs";
+import { ProductResponseSchema, ProductSchema, ProductsResponseSchema } from "../lib/modules/products/schema.mjs";
+import { SubscriptionTemplateResponseSchema, SubscriptionTemplateSchema, SubscriptionTemplatesResponseSchema } from "../lib/modules/subscription-templates/schema.mjs";
+import { SubscriptionCreateRequestSchema, SubscriptionResponseSchema, SubscriptionSchema, SubscriptionsResponseSchema } from "../lib/modules/subscriptions/schema.mjs";
+import { TaskTemplateResponseSchema, TaskTemplateSchema, TaskTemplatesResponseSchema } from "../lib/modules/task-templates/schema.mjs";
+import { TaskCreateRequestSchema, TaskResponseSchema, TaskSchema, TaskStatusSchema, TaskUpdateRequestSchema, TasksResponseSchema } from "../lib/modules/tasks/schema.mjs";
+import { WorkspaceResponseSchema, WorkspaceSchema } from "../lib/modules/workspace/schema.mjs";
+import { TokenPayloadSchema } from "./shared/token.mjs";
+import "../lib/modules/index.mjs";
+import "./shared/index.mjs";
+export { AddressValueSchema, AppConnectionCreateRequestSchema, AppConnectionResponseSchema, AppConnectionSchema, AppConnectionTypeSchema, AppConnectionsResponseSchema, AppInstallResponseSchema, AppInstallSchema, AppInstallTypeSchema, AppInstallsResponseSchema, AssemblyFileResponseSchema, AssemblyFileSchema, AssemblyFilesResponseSchema, AuditLogEventResponseSchema, AuditLogEventSchema, AuditLogEventsResponseSchema, ClientCreateRequestSchema, ClientResponseSchema, ClientSchema, ClientUpdateRequestSchema, ClientsResponseSchema, CompaniesResponseSchema, CompanyCreateRequestSchema, CompanyResponseSchema, CompanySchema, CompanyUpdateRequestSchema, ContractFieldInputTypeSchema, ContractFieldSchema, ContractResponseSchema, ContractSchema, ContractSendRequestSchema, ContractStatusSchema, ContractTemplateResponseSchema, ContractTemplateSchema, ContractTemplatesResponseSchema, ContractsResponseSchema, CustomFieldEntityTypeSchema, CustomFieldOptionSchema, CustomFieldSchema, CustomFieldTypeSchema, CustomFieldValueSchema, EmailDeliveryTargetSchema, EventActorTypeSchema, EventCreateRequestSchema, EventSourceSchema, FileChannelCreateRequestSchema, FileChannelResponseSchema, FileChannelSchema, FileChannelsResponseSchema, FileTypeSchema, FormDataResponseSchema, FormResponseCreateRequestSchema, FormResponseItemResponseSchema, FormResponseSchema, FormResponsesResponseSchema, FormSchema, FormsDataResponseSchema, HexColorSchema, InProductDeliveryTargetSchema, InternalUserResponseSchema, InternalUserSchema, InternalUsersResponseSchema, InvoiceCreateRequestSchema, InvoiceLineItemRequestSchema, InvoiceLineItemSchema, InvoicePaymentMethodPreferenceRequestSchema, InvoiceResponseSchema, InvoiceSchema, InvoiceStatusSchema, InvoiceTemplateResponseSchema, InvoiceTemplateSchema, InvoiceTemplatesResponseSchema, InvoicesResponseSchema, ListCustomFieldOptionResponseSchema, ListCustomFieldResponseSchema, MembershipTypeSchema, MessageChannelCreateRequestSchema, MessageChannelResponseSchema, MessageChannelSchema, MessageChannelsResponseSchema, MessageResponseSchema, MessageSchema, MessagesResponseSchema, NoteCreateRequestSchema, NoteResponseSchema, NoteSchema, NoteUpdateRequestSchema, NotesResponseSchema, NotificationCreateRequestSchema, NotificationDeliveryTargetsSchema, NotificationResponseSchema, NotificationSchema, NotificationsResponseSchema, PaymentMethodPreferenceSchema, PaymentMethodTypeSchema, PaymentResponseSchema, PaymentSchema, PaymentsResponseSchema, PriceResponseSchema, PriceSchema, PricesResponseSchema, ProductResponseSchema, ProductSchema, ProductsResponseSchema, SendMessageRequestSchema, SubscriptionCreateRequestSchema, SubscriptionResponseSchema, SubscriptionSchema, SubscriptionTemplateResponseSchema, SubscriptionTemplateSchema, SubscriptionTemplatesResponseSchema, SubscriptionsResponseSchema, TaskCreateRequestSchema, TaskResponseSchema, TaskSchema, TaskStatusSchema, TaskTemplateResponseSchema, TaskTemplateSchema, TaskTemplatesResponseSchema, TaskUpdateRequestSchema, TasksResponseSchema, TokenPayloadSchema, WorkspaceResponseSchema, WorkspaceSchema };

package/dist/schemas/shared/hex-color.d.mts

@@ -0,0 +1,8 @@
+import { z } from "zod";
+
+//#region src/schemas/shared/hex-color.d.ts
+type HexColor = string;
+declare const HexColorSchema: z.ZodType<HexColor>;
+//#endregion
+export { HexColor, HexColorSchema };
+//# sourceMappingURL=hex-color.d.mts.map

package/dist/schemas/shared/hex-color.mjs

@@ -0,0 +1,7 @@
+import { z } from "zod";
+//#region src/schemas/shared/hex-color.ts
+const HexColorSchema = z.string().refine((val) => /^#([0-9A-Fa-f]{3}|[0-9A-Fa-f]{6})$/.test(val), { message: "Invalid hex color code" });
+//#endregion
+export { HexColorSchema };
+
+//# sourceMappingURL=hex-color.mjs.map

package/dist/schemas/shared/hex-color.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"hex-color.mjs","names":[],"sources":["../../../src/schemas/shared/hex-color.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport type HexColor = string;\n\nexport const HexColorSchema: z.ZodType<HexColor> = z\n  .string()\n  .refine((val) => /^#([0-9A-Fa-f]{3}|[0-9A-Fa-f]{6})$/.test(val), {\n    message: \"Invalid hex color code\",\n  });\n"],"mappings":";;AAIA,MAAa,iBAAsC,EAChD,QAAQ,CACR,QAAQ,QAAQ,qCAAqC,KAAK,IAAI,EAAE,EAC/D,SAAS,0BACV,CAAC"}

package/dist/schemas/shared/index.d.mts

@@ -0,0 +1,3 @@
+import { MembershipType, MembershipTypeSchema } from "./membership-type.mjs";
+import { HexColor, HexColorSchema } from "./hex-color.mjs";
+import { TokenPayload, TokenPayloadSchema } from "./token.mjs";

package/dist/schemas/shared/index.mjs

@@ -0,0 +1,4 @@
+import "./membership-type.mjs";
+import "./hex-color.mjs";
+import "./token.mjs";
+export {};

package/dist/schemas/shared/membership-type.d.mts

@@ -0,0 +1,9 @@
+import { z } from "zod";
+
+//#region src/schemas/shared/membership-type.d.ts
+/** Membership type shared across message channels, file channels, and app connections. */
+type MembershipType = "company" | "group" | "individual";
+declare const MembershipTypeSchema: z.ZodType<MembershipType>;
+//#endregion
+export { MembershipType, MembershipTypeSchema };
+//# sourceMappingURL=membership-type.d.mts.map

package/dist/schemas/shared/membership-type.mjs

@@ -0,0 +1,11 @@
+import { z } from "zod";
+//#region src/schemas/shared/membership-type.ts
+const MembershipTypeSchema = z.enum([
+	"individual",
+	"group",
+	"company"
+]);
+//#endregion
+export { MembershipTypeSchema };
+
+//# sourceMappingURL=membership-type.mjs.map

package/dist/schemas/shared/membership-type.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership-type.mjs","names":[],"sources":["../../../src/schemas/shared/membership-type.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/** Membership type shared across message channels, file channels, and app connections. */\nexport type MembershipType = \"company\" | \"group\" | \"individual\";\n\nexport const MembershipTypeSchema: z.ZodType<MembershipType> = z.enum([\n  \"individual\",\n  \"group\",\n  \"company\",\n]);\n"],"mappings":";;AAKA,MAAa,uBAAkD,EAAE,KAAK;CACpE;CACA;CACA;CACD,CAAC"}

package/dist/schemas/shared/token.d.mts

@@ -0,0 +1,22 @@
+import { z } from "zod";
+
+//#region src/schemas/shared/token.d.ts
+interface TokenPayload {
+  baseUrl?: string;
+  clientId?: string;
+  companyId?: string;
+  internalUserId?: string;
+  notificationId?: string;
+  tokenId?: string;
+  workspaceId: string;
+}
+/**
+ * Schema for a decrypted Assembly token payload.
+ * Unknown fields are silently stripped for forward compatibility.
+ * Requires either `internalUserId` (team member) or `clientId` (portal user).
+ * `companyId` is always optional.
+ */
+declare const TokenPayloadSchema: z.ZodType<TokenPayload>;
+//#endregion
+export { TokenPayload, TokenPayloadSchema };
+//# sourceMappingURL=token.d.mts.map

package/dist/schemas/shared/token.mjs

@@ -0,0 +1,21 @@
+import { z } from "zod";
+//#region src/schemas/shared/token.ts
+/**
+* Schema for a decrypted Assembly token payload.
+* Unknown fields are silently stripped for forward compatibility.
+* Requires either `internalUserId` (team member) or `clientId` (portal user).
+* `companyId` is always optional.
+*/
+const TokenPayloadSchema = z.object({
+	baseUrl: z.string().optional(),
+	clientId: z.string().optional(),
+	companyId: z.string().optional(),
+	internalUserId: z.string().optional(),
+	notificationId: z.string().optional(),
+	tokenId: z.string().optional(),
+	workspaceId: z.string().min(1)
+}).refine((val) => val.internalUserId !== void 0 || val.clientId !== void 0, { message: "Token must contain either internalUserId or clientId" });
+//#endregion
+export { TokenPayloadSchema };
+
+//# sourceMappingURL=token.mjs.map

package/dist/schemas/shared/token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.mjs","names":[],"sources":["../../../src/schemas/shared/token.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport interface TokenPayload {\n  baseUrl?: string;\n  clientId?: string;\n  companyId?: string;\n  internalUserId?: string;\n  notificationId?: string;\n  tokenId?: string;\n  workspaceId: string;\n}\n\n/**\n * Schema for a decrypted Assembly token payload.\n * Unknown fields are silently stripped for forward compatibility.\n * Requires either `internalUserId` (team member) or `clientId` (portal user).\n * `companyId` is always optional.\n */\nexport const TokenPayloadSchema: z.ZodType<TokenPayload> = z\n  .object({\n    baseUrl: z.string().optional(),\n    clientId: z.string().optional(),\n    companyId: z.string().optional(),\n    internalUserId: z.string().optional(),\n    notificationId: z.string().optional(),\n    tokenId: z.string().optional(),\n    workspaceId: z.string().min(1),\n  })\n  .refine((val) => val.internalUserId !== undefined || val.clientId !== undefined, {\n    message: \"Token must contain either internalUserId or clientId\",\n  });\n"],"mappings":";;;;;;;;AAkBA,MAAa,qBAA8C,EACxD,OAAO;CACN,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC9B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,WAAW,EAAE,QAAQ,CAAC,UAAU;CAChC,gBAAgB,EAAE,QAAQ,CAAC,UAAU;CACrC,gBAAgB,EAAE,QAAQ,CAAC,UAAU;CACrC,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC9B,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC/B,CAAC,CACD,QAAQ,QAAQ,IAAI,mBAAmB,KAAA,KAAa,IAAI,aAAa,KAAA,GAAW,EAC/E,SAAS,wDACV,CAAC"}

package/dist/token/assembly-token.d.mts

@@ -0,0 +1,96 @@
+import { TokenPayload } from "../schemas/shared/token.mjs";
+
+//#region src/token/assembly-token.d.ts
+/** A token payload that identifies a client (portal) user. */
+interface ClientTokenPayload extends TokenPayload {
+  clientId: string;
+  companyId?: string;
+}
+/** A token payload that identifies an internal (team member) user. */
+interface InternalUserTokenPayload extends TokenPayload {
+  internalUserId: string;
+}
+/**
+ * Decrypts and validates an Assembly token, exposing the payload with
+ * convenience getters for identity checks and compound key building.
+ *
+ * Use `AssemblyToken.run()` to store a request-scoped instance via
+ * `AsyncLocalStorage`, then retrieve it anywhere with `AssemblyToken.current()`.
+ * This is safe for Vercel fluid compute — no shared state across requests.
+ *
+ * @example
+ * ```ts
+ * // Request-scoped (recommended for serverless)
+ * const t = AssemblyToken.new({ token: encryptedHex, apiKey });
+ * const same = AssemblyToken.new({ token: encryptedHex, apiKey }); // returns the same instance
+ *
+ * // Direct instantiation (always creates a new instance)
+ * const token = new AssemblyToken({ token: encryptedHex, apiKey });
+ * ```
+ *
+ * @throws {AssemblyNoTokenError} If `token` is nullish or empty.
+ * @throws {AssemblyInvalidTokenError} If decryption, JSON parsing, or schema validation fails.
+ */
+declare class AssemblyToken {
+  #private;
+  readonly currentToken: string;
+  readonly payload: TokenPayload;
+  constructor({
+    token,
+    apiKey
+  }: {
+    token: unknown;
+    apiKey: string;
+  });
+  /**
+   * Get or create a request-scoped `AssemblyToken` instance via `AsyncLocalStorage`.
+   * Returns the existing instance if one exists with the same token. If the token
+   * differs, a new instance is created and replaces the previous one.
+   *
+   * @returns The `AssemblyToken` instance for the current async context.
+   */
+  static new(options: {
+    token: unknown;
+    apiKey: string;
+  }): AssemblyToken;
+  /** The workspace ID embedded in the token. Always present. */
+  get workspaceId(): string;
+  /** The token ID, if present (used in marketplace compound keys). */
+  get tokenId(): string | undefined;
+  /** The API base URL override, if present. */
+  get baseUrl(): string | undefined;
+  /** The client (portal user) ID, if present. */
+  get clientId(): string | undefined;
+  /** The company ID associated with the client, if present. */
+  get companyId(): string | undefined;
+  /** The internal (team member) user ID, if present. */
+  get internalUserId(): string | undefined;
+  /** `true` when the token belongs to a client (portal) user. */
+  get isClientUser(): boolean;
+  /** `true` when the token belongs to an internal (team member) user. */
+  get isInternalUser(): boolean;
+  /**
+   * Assert that the token belongs to a client user and return the narrowed payload.
+   * @throws {AssemblyUnauthorizedError} If the token does not represent a client user.
+   */
+  ensureIsClient(): ClientTokenPayload;
+  /**
+   * Assert that the token belongs to an internal (team member) user and return the narrowed payload.
+   * @throws {AssemblyUnauthorizedError} If the token does not represent an internal user.
+   */
+  ensureIsInternalUser(): InternalUserTokenPayload;
+  /**
+   * Build the compound API key sent in the `X-API-Key` header.
+   *
+   * - With `tokenId`: `{workspaceId}/{apiKey}/{tokenId}`
+   * - Without `tokenId`: `{workspaceId}/{apiKey}`
+   */
+  buildCompoundKey({
+    apiKey
+  }: {
+    apiKey: string;
+  }): string;
+}
+//#endregion
+export { AssemblyToken, ClientTokenPayload, InternalUserTokenPayload };
+//# sourceMappingURL=assembly-token.d.mts.map

package/dist/token/assembly-token.mjs

@@ -0,0 +1,117 @@
+import { AssemblyNoTokenError } from "../errors/no-token.mjs";
+import { AssemblyInvalidTokenError } from "../errors/invalid-token.mjs";
+import { AssemblyUnauthorizedError } from "../errors/unauthorized.mjs";
+import { decrypt, validatePayload } from "./parse.mjs";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/token/assembly-token.ts
+/**
+* Decrypts and validates an Assembly token, exposing the payload with
+* convenience getters for identity checks and compound key building.
+*
+* Use `AssemblyToken.run()` to store a request-scoped instance via
+* `AsyncLocalStorage`, then retrieve it anywhere with `AssemblyToken.current()`.
+* This is safe for Vercel fluid compute — no shared state across requests.
+*
+* @example
+* ```ts
+* // Request-scoped (recommended for serverless)
+* const t = AssemblyToken.new({ token: encryptedHex, apiKey });
+* const same = AssemblyToken.new({ token: encryptedHex, apiKey }); // returns the same instance
+*
+* // Direct instantiation (always creates a new instance)
+* const token = new AssemblyToken({ token: encryptedHex, apiKey });
+* ```
+*
+* @throws {AssemblyNoTokenError} If `token` is nullish or empty.
+* @throws {AssemblyInvalidTokenError} If decryption, JSON parsing, or schema validation fails.
+*/
+var AssemblyToken = class AssemblyToken {
+	static #store = new AsyncLocalStorage();
+	currentToken;
+	payload;
+	constructor({ token, apiKey }) {
+		if (token === void 0 || token === null || token === "") throw new AssemblyNoTokenError();
+		if (typeof token !== "string") throw new AssemblyInvalidTokenError({ message: `Expected token to be a string, got ${typeof token}` });
+		this.currentToken = token;
+		this.payload = validatePayload(decrypt({
+			apiKey,
+			token
+		}));
+	}
+	/**
+	* Get or create a request-scoped `AssemblyToken` instance via `AsyncLocalStorage`.
+	* Returns the existing instance if one exists with the same token. If the token
+	* differs, a new instance is created and replaces the previous one.
+	*
+	* @returns The `AssemblyToken` instance for the current async context.
+	*/
+	static new(options) {
+		const existing = AssemblyToken.#store.getStore();
+		if (existing && existing.currentToken === options.token) return existing;
+		const instance = new AssemblyToken(options);
+		AssemblyToken.#store.enterWith(instance);
+		return instance;
+	}
+	/** The workspace ID embedded in the token. Always present. */
+	get workspaceId() {
+		return this.payload.workspaceId;
+	}
+	/** The token ID, if present (used in marketplace compound keys). */
+	get tokenId() {
+		return this.payload.tokenId;
+	}
+	/** The API base URL override, if present. */
+	get baseUrl() {
+		return this.payload.baseUrl;
+	}
+	/** The client (portal user) ID, if present. */
+	get clientId() {
+		return this.payload.clientId;
+	}
+	/** The company ID associated with the client, if present. */
+	get companyId() {
+		return this.payload.companyId;
+	}
+	/** The internal (team member) user ID, if present. */
+	get internalUserId() {
+		return this.payload.internalUserId;
+	}
+	/** `true` when the token belongs to a client (portal) user. */
+	get isClientUser() {
+		return this.payload.clientId !== void 0;
+	}
+	/** `true` when the token belongs to an internal (team member) user. */
+	get isInternalUser() {
+		return this.payload.internalUserId !== void 0;
+	}
+	/**
+	* Assert that the token belongs to a client user and return the narrowed payload.
+	* @throws {AssemblyUnauthorizedError} If the token does not represent a client user.
+	*/
+	ensureIsClient() {
+		if (!this.isClientUser) throw new AssemblyUnauthorizedError({ message: "This operation requires a client token (clientId), but the token does not contain a clientId" });
+		return this.payload;
+	}
+	/**
+	* Assert that the token belongs to an internal (team member) user and return the narrowed payload.
+	* @throws {AssemblyUnauthorizedError} If the token does not represent an internal user.
+	*/
+	ensureIsInternalUser() {
+		if (!this.isInternalUser) throw new AssemblyUnauthorizedError({ message: "This operation requires an internal user token (internalUserId), but the token does not contain an internalUserId" });
+		return this.payload;
+	}
+	/**
+	* Build the compound API key sent in the `X-API-Key` header.
+	*
+	* - With `tokenId`: `{workspaceId}/{apiKey}/{tokenId}`
+	* - Without `tokenId`: `{workspaceId}/{apiKey}`
+	*/
+	buildCompoundKey({ apiKey }) {
+		if (this.payload.tokenId) return `${this.payload.workspaceId}/${apiKey}/${this.payload.tokenId}`;
+		return `${this.payload.workspaceId}/${apiKey}`;
+	}
+};
+//#endregion
+export { AssemblyToken };
+
+//# sourceMappingURL=assembly-token.mjs.map

package/dist/token/assembly-token.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"assembly-token.mjs","names":["#store"],"sources":["../../src/token/assembly-token.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\n\nimport { AssemblyInvalidTokenError } from \"src/errors/invalid-token\";\nimport { AssemblyNoTokenError } from \"src/errors/no-token\";\nimport { AssemblyUnauthorizedError } from \"src/errors/unauthorized\";\nimport type { TokenPayload } from \"src/schemas/shared/token\";\n\nimport { decrypt, validatePayload } from \"./parse\";\n\n/** A token payload that identifies a client (portal) user. */\nexport interface ClientTokenPayload extends TokenPayload {\n  clientId: string;\n  companyId?: string;\n}\n\n/** A token payload that identifies an internal (team member) user. */\nexport interface InternalUserTokenPayload extends TokenPayload {\n  internalUserId: string;\n}\n\n/**\n * Decrypts and validates an Assembly token, exposing the payload with\n * convenience getters for identity checks and compound key building.\n *\n * Use `AssemblyToken.run()` to store a request-scoped instance via\n * `AsyncLocalStorage`, then retrieve it anywhere with `AssemblyToken.current()`.\n * This is safe for Vercel fluid compute — no shared state across requests.\n *\n * @example\n * ```ts\n * // Request-scoped (recommended for serverless)\n * const t = AssemblyToken.new({ token: encryptedHex, apiKey });\n * const same = AssemblyToken.new({ token: encryptedHex, apiKey }); // returns the same instance\n *\n * // Direct instantiation (always creates a new instance)\n * const token = new AssemblyToken({ token: encryptedHex, apiKey });\n * ```\n *\n * @throws {AssemblyNoTokenError} If `token` is nullish or empty.\n * @throws {AssemblyInvalidTokenError} If decryption, JSON parsing, or schema validation fails.\n */\nexport class AssemblyToken {\n  static readonly #store: AsyncLocalStorage<AssemblyToken> = new AsyncLocalStorage<AssemblyToken>();\n\n  readonly currentToken: string;\n  readonly payload: TokenPayload;\n\n  constructor({ token, apiKey }: { token: unknown; apiKey: string }) {\n    if (token === undefined || token === null || token === \"\") {\n      throw new AssemblyNoTokenError();\n    }\n\n    if (typeof token !== \"string\") {\n      throw new AssemblyInvalidTokenError({\n        message: `Expected token to be a string, got ${typeof token}`,\n      });\n    }\n\n    this.currentToken = token;\n    this.payload = validatePayload(decrypt({ apiKey, token }));\n  }\n\n  /**\n   * Get or create a request-scoped `AssemblyToken` instance via `AsyncLocalStorage`.\n   * Returns the existing instance if one exists with the same token. If the token\n   * differs, a new instance is created and replaces the previous one.\n   *\n   * @returns The `AssemblyToken` instance for the current async context.\n   */\n  static new(options: { token: unknown; apiKey: string }): AssemblyToken {\n    const existing = AssemblyToken.#store.getStore();\n    if (existing && existing.currentToken === options.token) {\n      return existing;\n    }\n    const instance = new AssemblyToken(options);\n    AssemblyToken.#store.enterWith(instance);\n    return instance;\n  }\n\n  /** The workspace ID embedded in the token. Always present. */\n  get workspaceId(): string {\n    return this.payload.workspaceId;\n  }\n\n  /** The token ID, if present (used in marketplace compound keys). */\n  get tokenId(): string | undefined {\n    return this.payload.tokenId;\n  }\n\n  /** The API base URL override, if present. */\n  get baseUrl(): string | undefined {\n    return this.payload.baseUrl;\n  }\n\n  /** The client (portal user) ID, if present. */\n  get clientId(): string | undefined {\n    return this.payload.clientId;\n  }\n\n  /** The company ID associated with the client, if present. */\n  get companyId(): string | undefined {\n    return this.payload.companyId;\n  }\n\n  /** The internal (team member) user ID, if present. */\n  get internalUserId(): string | undefined {\n    return this.payload.internalUserId;\n  }\n\n  /** `true` when the token belongs to a client (portal) user. */\n  get isClientUser(): boolean {\n    return this.payload.clientId !== undefined;\n  }\n\n  /** `true` when the token belongs to an internal (team member) user. */\n  get isInternalUser(): boolean {\n    return this.payload.internalUserId !== undefined;\n  }\n\n  /**\n   * Assert that the token belongs to a client user and return the narrowed payload.\n   * @throws {AssemblyUnauthorizedError} If the token does not represent a client user.\n   */\n  ensureIsClient(): ClientTokenPayload {\n    if (!this.isClientUser) {\n      throw new AssemblyUnauthorizedError({\n        message:\n          \"This operation requires a client token (clientId), but the token does not contain a clientId\",\n      });\n    }\n    return this.payload as ClientTokenPayload;\n  }\n\n  /**\n   * Assert that the token belongs to an internal (team member) user and return the narrowed payload.\n   * @throws {AssemblyUnauthorizedError} If the token does not represent an internal user.\n   */\n  ensureIsInternalUser(): InternalUserTokenPayload {\n    if (!this.isInternalUser) {\n      throw new AssemblyUnauthorizedError({\n        message:\n          \"This operation requires an internal user token (internalUserId), but the token does not contain an internalUserId\",\n      });\n    }\n    return this.payload as InternalUserTokenPayload;\n  }\n\n  /**\n   * Build the compound API key sent in the `X-API-Key` header.\n   *\n   * - With `tokenId`: `{workspaceId}/{apiKey}/{tokenId}`\n   * - Without `tokenId`: `{workspaceId}/{apiKey}`\n   */\n  buildCompoundKey({ apiKey }: { apiKey: string }): string {\n    if (this.payload.tokenId) {\n      return `${this.payload.workspaceId}/${apiKey}/${this.payload.tokenId}`;\n    }\n    return `${this.payload.workspaceId}/${apiKey}`;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAa,gBAAb,MAAa,cAAc;CACzB,QAAA,QAA2D,IAAI,mBAAkC;CAEjG;CACA;CAEA,YAAY,EAAE,OAAO,UAA8C;AACjE,MAAI,UAAU,KAAA,KAAa,UAAU,QAAQ,UAAU,GACrD,OAAM,IAAI,sBAAsB;AAGlC,MAAI,OAAO,UAAU,SACnB,OAAM,IAAI,0BAA0B,EAClC,SAAS,sCAAsC,OAAO,SACvD,CAAC;AAGJ,OAAK,eAAe;AACpB,OAAK,UAAU,gBAAgB,QAAQ;GAAE;GAAQ;GAAO,CAAC,CAAC;;;;;;;;;CAU5D,OAAO,IAAI,SAA4D;EACrE,MAAM,WAAW,eAAA,MAAqB,UAAU;AAChD,MAAI,YAAY,SAAS,iBAAiB,QAAQ,MAChD,QAAO;EAET,MAAM,WAAW,IAAI,cAAc,QAAQ;AAC3C,iBAAA,MAAqB,UAAU,SAAS;AACxC,SAAO;;;CAIT,IAAI,cAAsB;AACxB,SAAO,KAAK,QAAQ;;;CAItB,IAAI,UAA8B;AAChC,SAAO,KAAK,QAAQ;;;CAItB,IAAI,UAA8B;AAChC,SAAO,KAAK,QAAQ;;;CAItB,IAAI,WAA+B;AACjC,SAAO,KAAK,QAAQ;;;CAItB,IAAI,YAAgC;AAClC,SAAO,KAAK,QAAQ;;;CAItB,IAAI,iBAAqC;AACvC,SAAO,KAAK,QAAQ;;;CAItB,IAAI,eAAwB;AAC1B,SAAO,KAAK,QAAQ,aAAa,KAAA;;;CAInC,IAAI,iBAA0B;AAC5B,SAAO,KAAK,QAAQ,mBAAmB,KAAA;;;;;;CAOzC,iBAAqC;AACnC,MAAI,CAAC,KAAK,aACR,OAAM,IAAI,0BAA0B,EAClC,SACE,gGACH,CAAC;AAEJ,SAAO,KAAK;;;;;;CAOd,uBAAiD;AAC/C,MAAI,CAAC,KAAK,eACR,OAAM,IAAI,0BAA0B,EAClC,SACE,qHACH,CAAC;AAEJ,SAAO,KAAK;;;;;;;;CASd,iBAAiB,EAAE,UAAsC;AACvD,MAAI,KAAK,QAAQ,QACf,QAAO,GAAG,KAAK,QAAQ,YAAY,GAAG,OAAO,GAAG,KAAK,QAAQ;AAE/D,SAAO,GAAG,KAAK,QAAQ,YAAY,GAAG"}

package/dist/token/crypto.mjs

@@ -0,0 +1,98 @@
+import { createCipheriv, createDecipheriv, createHmac, randomBytes } from "node:crypto";
+//#region src/token/crypto.ts
+/**
+* Derive a 128-bit AES key from the API key using HMAC-SHA256.
+* Takes the first 32 hex characters (16 bytes) of the HMAC digest.
+*/
+const deriveKey = (apiKey) => createHmac("sha256", apiKey).digest("hex").slice(0, 32);
+/**
+* Strip PKCS7 padding from raw decrypted bytes.
+* Uses constant-time comparison to prevent timing side-channel attacks.
+*/
+const stripPkcs7 = (raw) => {
+	const padLen = raw.at(-1);
+	if (padLen === void 0 || padLen < 1 || padLen > 16) throw new Error(`Invalid PKCS7 padding byte: ${padLen}`);
+	let mismatches = 0;
+	for (let i = raw.length - padLen; i < raw.length; i += 1) if (raw[i] !== padLen) mismatches += 1;
+	if (mismatches > 0) throw new Error("Invalid PKCS7 padding");
+	return raw.subarray(0, raw.length - padLen);
+};
+/** Parse the hex-encoded token into key buffer, IV, and ciphertext. */
+const parseEncryptedToken = ({ apiKey, encryptedToken }) => {
+	const keyBuffer = Buffer.from(deriveKey(apiKey), "hex");
+	const blob = Buffer.from(encryptedToken, "hex");
+	return {
+		ciphertext: blob.subarray(16),
+		iv: blob.subarray(0, 16),
+		keyBuffer
+	};
+};
+/** Decrypt with native autoPadding (works on Node 18/22 and most Bun versions). */
+const decryptNative = ({ ciphertext, iv, keyBuffer }) => {
+	const decipher = createDecipheriv("aes-128-cbc", keyBuffer, iv);
+	return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+};
+/**
+* Decrypt with manual PKCS7 strip (handles Node 24 OpenSSL 3.4/3.5 edge case).
+* If the runtime ignores setAutoPadding(false) and strips padding anyway
+* (some Bun versions), the result won't be block-aligned — return it as-is.
+*/
+const decryptManual = ({ ciphertext, iv, keyBuffer }) => {
+	const decipher = createDecipheriv("aes-128-cbc", keyBuffer, iv);
+	decipher.setAutoPadding(false);
+	const raw = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+	if (raw.length % 16 !== 0) return raw.toString("utf8");
+	return stripPkcs7(raw).toString("utf8");
+};
+/**
+* Decrypt an AES-128-CBC encrypted token string using the API key.
+*
+* The encrypted token is a hex-encoded binary blob where:
+* - First 16 bytes = IV (initialization vector)
+* - Remaining bytes = ciphertext
+*
+* Strategy: try native autoPadding first (works on most runtimes), then
+* fall back to manual PKCS7 strip with autoPadding disabled. This handles:
+* - Node 24 (OpenSSL 3.4/3.5) where autoPadding fails on block-aligned payloads
+* - Bun versions where setAutoPadding(false) may be silently ignored
+*
+* @throws {Error} If decryption fails on both paths
+*/
+const decryptTokenString = ({ apiKey, encryptedToken }) => {
+	const parts = parseEncryptedToken({
+		apiKey,
+		encryptedToken
+	});
+	try {
+		return decryptNative(parts);
+	} catch (nativeError) {
+		try {
+			return decryptManual(parts);
+		} catch {
+			throw nativeError;
+		}
+	}
+};
+/**
+* Encrypt a plaintext string into a hex-encoded AES-128-CBC token.
+*
+* Produces a hex blob where the first 16 bytes are a random IV followed
+* by the PKCS7-padded ciphertext — the exact format that `decryptTokenString`
+* expects.
+*
+* @param {object} options - Encryption options.
+* @param {string} options.apiKey - The workspace/app API key used to derive the encryption key.
+* @param {string} options.plaintext - The plaintext string to encrypt (typically JSON).
+* @returns {string} The hex-encoded encrypted token.
+*/
+const encryptTokenString = ({ apiKey, plaintext }) => {
+	const keyBuffer = Buffer.from(deriveKey(apiKey), "hex");
+	const iv = randomBytes(16);
+	const cipher = createCipheriv("aes-128-cbc", keyBuffer, iv);
+	const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+	return Buffer.concat([iv, encrypted]).toString("hex");
+};
+//#endregion
+export { decryptTokenString, encryptTokenString };
+
+//# sourceMappingURL=crypto.mjs.map

package/dist/token/crypto.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.mjs","names":[],"sources":["../../src/token/crypto.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, createHmac, randomBytes } from \"node:crypto\";\n\n/**\n * Derive a 128-bit AES key from the API key using HMAC-SHA256.\n * Takes the first 32 hex characters (16 bytes) of the HMAC digest.\n */\nexport const deriveKey = (apiKey: string): string =>\n  createHmac(\"sha256\", apiKey).digest(\"hex\").slice(0, 32);\n\n/**\n * Strip PKCS7 padding from raw decrypted bytes.\n * Uses constant-time comparison to prevent timing side-channel attacks.\n */\nconst stripPkcs7 = (raw: Buffer): Buffer => {\n  const padLen = raw.at(-1);\n  if (padLen === undefined || padLen < 1 || padLen > 16) {\n    throw new Error(`Invalid PKCS7 padding byte: ${padLen}`);\n  }\n\n  // Always check every padding byte (no early exit) to avoid timing side-channels\n  let mismatches = 0;\n  for (let i = raw.length - padLen; i < raw.length; i += 1) {\n    if (raw[i] !== padLen) {\n      mismatches += 1;\n    }\n  }\n\n  if (mismatches > 0) {\n    throw new Error(\"Invalid PKCS7 padding\");\n  }\n\n  return raw.subarray(0, raw.length - padLen);\n};\n\ninterface CipherParts {\n  keyBuffer: Buffer;\n  iv: Buffer;\n  ciphertext: Buffer;\n}\n\n/** Parse the hex-encoded token into key buffer, IV, and ciphertext. */\nconst parseEncryptedToken = ({\n  apiKey,\n  encryptedToken,\n}: {\n  apiKey: string;\n  encryptedToken: string;\n}): CipherParts => {\n  const keyBuffer = Buffer.from(deriveKey(apiKey), \"hex\");\n  const blob = Buffer.from(encryptedToken, \"hex\");\n  return { ciphertext: blob.subarray(16), iv: blob.subarray(0, 16), keyBuffer };\n};\n\n/** Decrypt with native autoPadding (works on Node 18/22 and most Bun versions). */\nconst decryptNative = ({ ciphertext, iv, keyBuffer }: CipherParts): string => {\n  const decipher = createDecipheriv(\"aes-128-cbc\", keyBuffer, iv);\n  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString(\"utf8\");\n};\n\n/**\n * Decrypt with manual PKCS7 strip (handles Node 24 OpenSSL 3.4/3.5 edge case).\n * If the runtime ignores setAutoPadding(false) and strips padding anyway\n * (some Bun versions), the result won't be block-aligned — return it as-is.\n */\nconst decryptManual = ({ ciphertext, iv, keyBuffer }: CipherParts): string => {\n  const decipher = createDecipheriv(\"aes-128-cbc\", keyBuffer, iv);\n  decipher.setAutoPadding(false);\n  const raw = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n\n  // If length isn't a multiple of 16, the runtime already stripped padding\n  if (raw.length % 16 !== 0) {\n    return raw.toString(\"utf8\");\n  }\n\n  return stripPkcs7(raw).toString(\"utf8\");\n};\n\n/**\n * Decrypt an AES-128-CBC encrypted token string using the API key.\n *\n * The encrypted token is a hex-encoded binary blob where:\n * - First 16 bytes = IV (initialization vector)\n * - Remaining bytes = ciphertext\n *\n * Strategy: try native autoPadding first (works on most runtimes), then\n * fall back to manual PKCS7 strip with autoPadding disabled. This handles:\n * - Node 24 (OpenSSL 3.4/3.5) where autoPadding fails on block-aligned payloads\n * - Bun versions where setAutoPadding(false) may be silently ignored\n *\n * @throws {Error} If decryption fails on both paths\n */\nexport const decryptTokenString = ({\n  apiKey,\n  encryptedToken,\n}: {\n  apiKey: string;\n  encryptedToken: string;\n}): string => {\n  const parts = parseEncryptedToken({ apiKey, encryptedToken });\n\n  try {\n    return decryptNative(parts);\n  } catch (nativeError: unknown) {\n    try {\n      return decryptManual(parts);\n    } catch {\n      // Both paths failed — throw the native error as it's more informative\n      throw nativeError;\n    }\n  }\n};\n\n/**\n * Encrypt a plaintext string into a hex-encoded AES-128-CBC token.\n *\n * Produces a hex blob where the first 16 bytes are a random IV followed\n * by the PKCS7-padded ciphertext — the exact format that `decryptTokenString`\n * expects.\n *\n * @param {object} options - Encryption options.\n * @param {string} options.apiKey - The workspace/app API key used to derive the encryption key.\n * @param {string} options.plaintext - The plaintext string to encrypt (typically JSON).\n * @returns {string} The hex-encoded encrypted token.\n */\nexport const encryptTokenString = ({\n  apiKey,\n  plaintext,\n}: {\n  apiKey: string;\n  plaintext: string;\n}): string => {\n  const keyBuffer = Buffer.from(deriveKey(apiKey), \"hex\");\n  const iv = randomBytes(16);\n  const cipher = createCipheriv(\"aes-128-cbc\", keyBuffer, iv);\n  const encrypted = Buffer.concat([cipher.update(plaintext, \"utf8\"), cipher.final()]);\n  return Buffer.concat([iv, encrypted]).toString(\"hex\");\n};\n"],"mappings":";;;;;;AAMA,MAAa,aAAa,WACxB,WAAW,UAAU,OAAO,CAAC,OAAO,MAAM,CAAC,MAAM,GAAG,GAAG;;;;;AAMzD,MAAM,cAAc,QAAwB;CAC1C,MAAM,SAAS,IAAI,GAAG,GAAG;AACzB,KAAI,WAAW,KAAA,KAAa,SAAS,KAAK,SAAS,GACjD,OAAM,IAAI,MAAM,+BAA+B,SAAS;CAI1D,IAAI,aAAa;AACjB,MAAK,IAAI,IAAI,IAAI,SAAS,QAAQ,IAAI,IAAI,QAAQ,KAAK,EACrD,KAAI,IAAI,OAAO,OACb,eAAc;AAIlB,KAAI,aAAa,EACf,OAAM,IAAI,MAAM,wBAAwB;AAG1C,QAAO,IAAI,SAAS,GAAG,IAAI,SAAS,OAAO;;;AAU7C,MAAM,uBAAuB,EAC3B,QACA,qBAIiB;CACjB,MAAM,YAAY,OAAO,KAAK,UAAU,OAAO,EAAE,MAAM;CACvD,MAAM,OAAO,OAAO,KAAK,gBAAgB,MAAM;AAC/C,QAAO;EAAE,YAAY,KAAK,SAAS,GAAG;EAAE,IAAI,KAAK,SAAS,GAAG,GAAG;EAAE;EAAW;;;AAI/E,MAAM,iBAAiB,EAAE,YAAY,IAAI,gBAAqC;CAC5E,MAAM,WAAW,iBAAiB,eAAe,WAAW,GAAG;AAC/D,QAAO,OAAO,OAAO,CAAC,SAAS,OAAO,WAAW,EAAE,SAAS,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO;;;;;;;AAQxF,MAAM,iBAAiB,EAAE,YAAY,IAAI,gBAAqC;CAC5E,MAAM,WAAW,iBAAiB,eAAe,WAAW,GAAG;AAC/D,UAAS,eAAe,MAAM;CAC9B,MAAM,MAAM,OAAO,OAAO,CAAC,SAAS,OAAO,WAAW,EAAE,SAAS,OAAO,CAAC,CAAC;AAG1E,KAAI,IAAI,SAAS,OAAO,EACtB,QAAO,IAAI,SAAS,OAAO;AAG7B,QAAO,WAAW,IAAI,CAAC,SAAS,OAAO;;;;;;;;;;;;;;;;AAiBzC,MAAa,sBAAsB,EACjC,QACA,qBAIY;CACZ,MAAM,QAAQ,oBAAoB;EAAE;EAAQ;EAAgB,CAAC;AAE7D,KAAI;AACF,SAAO,cAAc,MAAM;UACpB,aAAsB;AAC7B,MAAI;AACF,UAAO,cAAc,MAAM;UACrB;AAEN,SAAM;;;;;;;;;;;;;;;;AAiBZ,MAAa,sBAAsB,EACjC,QACA,gBAIY;CACZ,MAAM,YAAY,OAAO,KAAK,UAAU,OAAO,EAAE,MAAM;CACvD,MAAM,KAAK,YAAY,GAAG;CAC1B,MAAM,SAAS,eAAe,eAAe,WAAW,GAAG;CAC3D,MAAM,YAAY,OAAO,OAAO,CAAC,OAAO,OAAO,WAAW,OAAO,EAAE,OAAO,OAAO,CAAC,CAAC;AACnF,QAAO,OAAO,OAAO,CAAC,IAAI,UAAU,CAAC,CAAC,SAAS,MAAM"}

package/dist/token/index.d.mts

@@ -0,0 +1,3 @@
+import { AssemblyToken, ClientTokenPayload, InternalUserTokenPayload } from "./assembly-token.mjs";
+import { createToken } from "./parse.mjs";
+export { AssemblyToken, type ClientTokenPayload, type InternalUserTokenPayload, createToken };

package/dist/token/index.mjs

@@ -0,0 +1,3 @@
+import { createToken } from "./parse.mjs";
+import { AssemblyToken } from "./assembly-token.mjs";
+export { AssemblyToken, createToken };

package/dist/token/parse.d.mts

@@ -0,0 +1,24 @@
+import { TokenPayload } from "../schemas/shared/token.mjs";
+
+//#region src/token/parse.d.ts
+/**
+ * Encrypt a token payload into a hex-encoded AES-128-CBC token string.
+ *
+ * The payload is validated against `TokenPayloadSchema`, serialized to JSON,
+ * and encrypted using the API key with HMAC-SHA256 key derivation and AES-128-CBC.
+ *
+ * @param options.payload - The token payload to encrypt.
+ * @param options.apiKey - The workspace/app API key used to derive the encryption key.
+ * @returns The hex-encoded encrypted token string.
+ * @throws {AssemblyInvalidTokenError} If the payload fails schema validation.
+ */
+declare const createToken: ({
+  payload,
+  apiKey
+}: {
+  payload: TokenPayload;
+  apiKey: string;
+}) => string;
+//#endregion
+export { createToken };
+//# sourceMappingURL=parse.d.mts.map

package/dist/token/parse.mjs

@@ -0,0 +1,62 @@
+import { AssemblyInvalidTokenError } from "../errors/invalid-token.mjs";
+import { TokenPayloadSchema } from "../schemas/shared/token.mjs";
+import { decryptTokenString, encryptTokenString } from "./crypto.mjs";
+//#region src/token/parse.ts
+/** Decrypt the token string, wrapping errors as AssemblyInvalidTokenError. */
+const decrypt = ({ apiKey, token }) => {
+	try {
+		return decryptTokenString({
+			apiKey,
+			encryptedToken: token
+		});
+	} catch (error) {
+		throw new AssemblyInvalidTokenError({
+			cause: error,
+			message: "Failed to decrypt token — verify the API key and token are correct"
+		});
+	}
+};
+/** Parse + validate decrypted JSON against TokenPayloadSchema. */
+const validatePayload = (decrypted) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(decrypted);
+	} catch (error) {
+		throw new AssemblyInvalidTokenError({
+			cause: error,
+			message: "Decrypted token is not valid JSON"
+		});
+	}
+	const result = TokenPayloadSchema.safeParse(parsed);
+	if (!result.success) throw new AssemblyInvalidTokenError({
+		cause: result.error,
+		message: "Token payload failed schema validation"
+	});
+	return result.data;
+};
+/**
+* Encrypt a token payload into a hex-encoded AES-128-CBC token string.
+*
+* The payload is validated against `TokenPayloadSchema`, serialized to JSON,
+* and encrypted using the API key with HMAC-SHA256 key derivation and AES-128-CBC.
+*
+* @param options.payload - The token payload to encrypt.
+* @param options.apiKey - The workspace/app API key used to derive the encryption key.
+* @returns The hex-encoded encrypted token string.
+* @throws {AssemblyInvalidTokenError} If the payload fails schema validation.
+*/
+const createToken = ({ payload, apiKey }) => {
+	const result = TokenPayloadSchema.safeParse(payload);
+	if (!result.success) throw new AssemblyInvalidTokenError({
+		cause: result.error,
+		message: "Token payload failed schema validation"
+	});
+	return encryptTokenString({
+		apiKey,
+		plaintext: JSON.stringify(result.data)
+	});
+};
+//#endregion
+export { createToken, decrypt, validatePayload };
+
+//# sourceMappingURL=parse.mjs.map

package/dist/token/parse.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.mjs","names":[],"sources":["../../src/token/parse.ts"],"sourcesContent":["import { AssemblyInvalidTokenError } from \"src/errors/invalid-token\";\nimport type { TokenPayload } from \"src/schemas/shared/token\";\nimport { TokenPayloadSchema } from \"src/schemas/shared/token\";\n\nimport { decryptTokenString, encryptTokenString } from \"./crypto\";\n\n/** Decrypt the token string, wrapping errors as AssemblyInvalidTokenError. */\nexport const decrypt = ({ apiKey, token }: { apiKey: string; token: string }): string => {\n  try {\n    return decryptTokenString({ apiKey, encryptedToken: token });\n  } catch (error) {\n    throw new AssemblyInvalidTokenError({\n      cause: error,\n      message: \"Failed to decrypt token — verify the API key and token are correct\",\n    });\n  }\n};\n\n/** Parse + validate decrypted JSON against TokenPayloadSchema. */\nexport const validatePayload = (decrypted: string): TokenPayload => {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(decrypted);\n  } catch (error) {\n    throw new AssemblyInvalidTokenError({\n      cause: error,\n      message: \"Decrypted token is not valid JSON\",\n    });\n  }\n\n  const result = TokenPayloadSchema.safeParse(parsed);\n  if (!result.success) {\n    throw new AssemblyInvalidTokenError({\n      cause: result.error,\n      message: \"Token payload failed schema validation\",\n    });\n  }\n\n  return result.data;\n};\n\n/**\n * Encrypt a token payload into a hex-encoded AES-128-CBC token string.\n *\n * The payload is validated against `TokenPayloadSchema`, serialized to JSON,\n * and encrypted using the API key with HMAC-SHA256 key derivation and AES-128-CBC.\n *\n * @param options.payload - The token payload to encrypt.\n * @param options.apiKey - The workspace/app API key used to derive the encryption key.\n * @returns The hex-encoded encrypted token string.\n * @throws {AssemblyInvalidTokenError} If the payload fails schema validation.\n */\nexport const createToken = ({\n  payload,\n  apiKey,\n}: {\n  payload: TokenPayload;\n  apiKey: string;\n}): string => {\n  const result = TokenPayloadSchema.safeParse(payload);\n  if (!result.success) {\n    throw new AssemblyInvalidTokenError({\n      cause: result.error,\n      message: \"Token payload failed schema validation\",\n    });\n  }\n\n  return encryptTokenString({\n    apiKey,\n    plaintext: JSON.stringify(result.data),\n  });\n};\n"],"mappings":";;;;;AAOA,MAAa,WAAW,EAAE,QAAQ,YAAuD;AACvF,KAAI;AACF,SAAO,mBAAmB;GAAE;GAAQ,gBAAgB;GAAO,CAAC;UACrD,OAAO;AACd,QAAM,IAAI,0BAA0B;GAClC,OAAO;GACP,SAAS;GACV,CAAC;;;;AAKN,MAAa,mBAAmB,cAAoC;CAClE,IAAI;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,UAAU;UACvB,OAAO;AACd,QAAM,IAAI,0BAA0B;GAClC,OAAO;GACP,SAAS;GACV,CAAC;;CAGJ,MAAM,SAAS,mBAAmB,UAAU,OAAO;AACnD,KAAI,CAAC,OAAO,QACV,OAAM,IAAI,0BAA0B;EAClC,OAAO,OAAO;EACd,SAAS;EACV,CAAC;AAGJ,QAAO,OAAO;;;;;;;;;;;;;AAchB,MAAa,eAAe,EAC1B,SACA,aAIY;CACZ,MAAM,SAAS,mBAAmB,UAAU,QAAQ;AACpD,KAAI,CAAC,OAAO,QACV,OAAM,IAAI,0BAA0B;EAClC,OAAO,OAAO;EACd,SAAS;EACV,CAAC;AAGJ,QAAO,mBAAmB;EACxB;EACA,WAAW,KAAK,UAAU,OAAO,KAAK;EACvC,CAAC"}

package/dist/transport/build-search-params.mjs

@@ -0,0 +1,16 @@
+//#region src/transport/build-search-params.ts
+/**
+* Builds a search params record from an optional args object,
+* filtering out `undefined` and `null` values and keeping only
+* string, number, and boolean values.
+*/
+const buildSearchParams = (args) => {
+	if (!args) return {};
+	const params = {};
+	for (const [key, value] of Object.entries(args)) if (value !== void 0 && value !== null && (typeof value === "string" || typeof value === "number" || typeof value === "boolean")) params[key] = value;
+	return params;
+};
+//#endregion
+export { buildSearchParams };
+
+//# sourceMappingURL=build-search-params.mjs.map

package/dist/transport/build-search-params.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-search-params.mjs","names":[],"sources":["../../src/transport/build-search-params.ts"],"sourcesContent":["/**\n * Builds a search params record from an optional args object,\n * filtering out `undefined` and `null` values and keeping only\n * string, number, and boolean values.\n */\n// eslint-disable-next-line typescript/no-explicit-any -- accepts any args object\nexport const buildSearchParams = (args?: any): Record<string, string | number | boolean> => {\n  if (!args) return {};\n\n  const params: Record<string, string | number | boolean> = {};\n  for (const [key, value] of Object.entries(args)) {\n    if (\n      value !== undefined &&\n      value !== null &&\n      (typeof value === \"string\" || typeof value === \"number\" || typeof value === \"boolean\")\n    ) {\n      params[key] = value;\n    }\n  }\n  return params;\n};\n"],"mappings":";;;;;;AAMA,MAAa,qBAAqB,SAA0D;AAC1F,KAAI,CAAC,KAAM,QAAO,EAAE;CAEpB,MAAM,SAAoD,EAAE;AAC5D,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,CAC7C,KACE,UAAU,KAAA,KACV,UAAU,SACT,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,WAE5E,QAAO,OAAO;AAGlB,QAAO"}