mindvest-atlas 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 FinManagerAI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,56 @@
+# Atlas CLI (Node.js)
+
+The Node.js implementation of the Atlas CLI. Zero runtime dependencies — just
+Node ≥ 18 (uses the built-in `fetch`, Web Streams, `crypto`, and `http`).
+
+## Install
+
+```sh
+npm install -g mindvest-atlas   # installs the `atlas` command
+atlas login
+```
+
+Or run from a clone without installing:
+
+```sh
+cd node
+node bin/atlas.js --help
+```
+
+## Usage
+
+See the [top-level README](../README.md) for the full command reference. Quick
+tour:
+
+```sh
+atlas login
+atlas tools
+atlas stock-quote --symbol SPY
+atlas options-chain --symbol SPY --expiration 2026-06-20
+atlas alerts --symbol SPY --name greek_exposure --save-charts ./charts
+atlas flow stream --symbol NVDA
+```
+
+## Layout
+
+```
+bin/atlas.js          # executable entry point
+src/
+  cli.js              # arg parsing + command dispatch
+  config.js           # constants, endpoints, paths
+  auth/               # pkce, oauth, loopback callback server, 0600 token store
+  api/                # authenticated client (+ auto-refresh), catalog, SSE parser
+  commands/           # login, logout, whoami, tools, call, alerts, flow
+  util/               # args, help, formatting, terminal UI, stream loop
+test/                 # node --test suites (offline)
+```
+
+## Test
+
+```sh
+npm test
+```
+
+Runs PKCE/arg/SSE/storage unit tests plus integration tests that drive the real
+OAuth client and loopback server against in-process mock servers — no network
+required.

package/bin/atlas.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// Atlas CLI entry point. Keeps the shebang file tiny: parse-and-dispatch lives
+// in src/cli.js so it can be unit-tested without spawning a process.
+import { main } from '../src/cli.js';
+
+main(process.argv.slice(2)).then(
+  (code) => process.exit(typeof code === 'number' ? code : 0),
+  (err) => {
+    // Last-resort handler. Commands are expected to handle their own errors and
+    // return an exit code; anything that bubbles to here is a bug or a hard stop.
+    const msg = err && err.message ? err.message : String(err);
+    process.stderr.write(`atlas: ${msg}\n`);
+    if (process.env.ATLAS_DEBUG && err && err.stack) process.stderr.write(err.stack + '\n');
+    process.exit(1);
+  },
+);

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "mindvest-atlas",
+  "version": "0.1.0",
+  "description": "Atlas CLI — OAuth login, tool calls, and live alert/flow streaming for the Atlas trading API",
+  "type": "module",
+  "bin": {
+    "atlas": "bin/atlas.js"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "test": "node --test",
+    "prepublishOnly": "node --test"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/finmanagerai/atlas-cli.git",
+    "directory": "node"
+  },
+  "homepage": "https://github.com/finmanagerai/atlas-cli#readme",
+  "bugs": {
+    "url": "https://github.com/finmanagerai/atlas-cli/issues"
+  },
+  "keywords": [
+    "atlas",
+    "mindvest",
+    "options",
+    "trading",
+    "oauth",
+    "cli",
+    "mcp"
+  ],
+  "author": "FinManagerAI",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/api/catalog.js

@@ -0,0 +1,62 @@
+// Tool catalog: fetch + cache GET /api/v1/tools and resolve CLI slugs to the
+// canonical tool name the server expects in the URL.
+import { API, FILES } from '../config.js';
+import { readJson, writeJson } from '../auth/store.js';
+import { requestJson } from './client.js';
+
+const MAX_AGE_MS = 24 * 60 * 60 * 1000; // refresh the cache daily
+
+export async function fetchCatalog({ force = false } = {}) {
+  const cached = readJson(FILES.catalog);
+  if (!force && cached && cached.fetched_at && Date.now() - cached.fetched_at < MAX_AGE_MS) {
+    return cached;
+  }
+  const data = await requestJson(API.tools);
+  const catalog = {
+    fetched_at: Date.now(),
+    count: data.count ?? Object.keys(data.tools || {}).length,
+    tools: data.tools || {},
+  };
+  writeJson(FILES.catalog, catalog, 0o600);
+  return catalog;
+}
+
+export function cachedCatalog() {
+  return readJson(FILES.catalog);
+}
+
+// PascalCase display names carry an uppercase letter or hyphen; snake_case
+// Python aliases do not. The display set is the clean, de-duplicated list.
+export function isDisplayName(name) {
+  return /[A-Z]/.test(name) || name.includes('-');
+}
+
+export function slugify(name) {
+  return name.toLowerCase();
+}
+
+// Resolve "stock-quote" / "get_stock_quote" / "Stock-Quote" to a real key.
+export function resolveToolName(catalog, input) {
+  const tools = catalog.tools || {};
+  if (tools[input]) return input;
+  const want = String(input).toLowerCase();
+  for (const key of Object.keys(tools)) {
+    if (key.toLowerCase() === want) return key;
+  }
+  return null;
+}
+
+export function listDisplayTools(catalog) {
+  const tools = catalog.tools || {};
+  const display = Object.keys(tools).filter(isDisplayName).sort((a, b) => a.localeCompare(b));
+  return display.length ? display : Object.keys(tools).sort();
+}
+
+// Up to `limit` slug suggestions for a typo, by simple substring distance.
+export function suggestTools(catalog, input, limit = 5) {
+  const want = String(input).toLowerCase();
+  return listDisplayTools(catalog)
+    .map((name) => slugify(name))
+    .filter((slug) => slug.includes(want) || want.includes(slug.split('-')[0]))
+    .slice(0, limit);
+}

package/src/api/client.js

@@ -0,0 +1,100 @@
+// Authenticated HTTP client for the Atlas REST + streaming API. Handles token
+// resolution (env > stored creds), proactive refresh near expiry, and a single
+// refresh-and-retry on a 401.
+import { baseUrl } from '../config.js';
+import { loadCredentials, saveCredentials } from '../auth/store.js';
+import { getEndpoints, refreshAccessToken } from '../auth/oauth.js';
+
+export class AuthError extends Error {}
+export class ApiError extends Error {
+  constructor(message, { status, data } = {}) {
+    super(message);
+    this.status = status;
+    this.data = data;
+  }
+}
+
+function envToken() {
+  const t = process.env.ATLAS_TOKEN;
+  return t && t.trim() ? t.trim() : null;
+}
+
+export function isLoggedIn() {
+  return !!(envToken() || (loadCredentials() || {}).access_token);
+}
+
+async function refreshAndStore(creds) {
+  const endpoints = await getEndpoints();
+  const tok = await refreshAccessToken(endpoints, {
+    refreshToken: creds.refresh_token,
+    clientId: creds.client_id,
+  });
+  const updated = {
+    ...creds,
+    access_token: tok.access_token,
+    token_type: tok.token_type || creds.token_type,
+    scope: tok.scope || creds.scope,
+    expires_at: tok.expires_in ? Date.now() + tok.expires_in * 1000 : creds.expires_at,
+    obtained_at: Date.now(),
+  };
+  saveCredentials(updated);
+  return updated;
+}
+
+async function currentAccessToken() {
+  const env = envToken();
+  if (env) return env;
+  let creds = loadCredentials();
+  if (!creds || !creds.access_token) {
+    throw new AuthError('Not authenticated. Run `atlas login` (or set ATLAS_TOKEN).');
+  }
+  const canRefresh = creds.refresh_token && creds.client_id;
+  if (canRefresh && creds.expires_at && Date.now() > creds.expires_at - 60_000) {
+    try { creds = await refreshAndStore(creds); } catch { /* fall through; 401 path retries */ }
+  }
+  return creds.access_token;
+}
+
+// Low-level request returning the raw Response (also used for SSE streams).
+export async function request(pathname, { method = 'GET', body, headers = {}, accept = 'application/json', signal } = {}) {
+  const url = baseUrl() + pathname;
+  const token = await currentAccessToken();
+  const build = (tok) => fetch(url, {
+    method,
+    signal,
+    headers: {
+      Authorization: `Bearer ${tok}`,
+      Accept: accept,
+      ...(body !== undefined ? { 'Content-Type': 'application/json' } : {}),
+      ...headers,
+    },
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  });
+
+  let res = await build(token);
+  if (res.status === 401 && !envToken()) {
+    // The 8h token may have died early (e.g. an OAuth-server restart). Try one
+    // refresh-and-retry before surfacing the 401.
+    const creds = loadCredentials();
+    if (creds && creds.refresh_token && creds.client_id) {
+      try {
+        const updated = await refreshAndStore(creds);
+        res = await build(updated.access_token);
+      } catch { /* return the original 401 */ }
+    }
+  }
+  return res;
+}
+
+// JSON request that surfaces transport errors (4xx/5xx). Note: the tools API
+// often returns 200 with an { error } body for bad inputs — callers should
+// inspect the returned object's `error` field too.
+export async function requestJson(pathname, opts = {}) {
+  const res = await request(pathname, opts);
+  const text = await res.text();
+  let data;
+  try { data = text ? JSON.parse(text) : {}; } catch { data = { result: text }; }
+  if (res.status === 401) throw new AuthError(data.error || 'Unauthorized — run `atlas login` again.');
+  if (!res.ok) throw new ApiError(data.error || data.message || `HTTP ${res.status}`, { status: res.status, data });
+  return data;
+}

package/src/api/stream.js

@@ -0,0 +1,47 @@
+// Minimal Server-Sent Events parser over a WHATWG ReadableStream (the body of a
+// fetch() Response). Yields { event, data } per dispatched SSE message and
+// silently drops `:` keepalive comments.
+export async function* parseSSE(webStream) {
+  const reader = webStream.getReader();
+  const decoder = new TextDecoder();
+  let buffer = '';
+  let eventName = 'message';
+  let dataLines = [];
+
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+
+      let nl;
+      while ((nl = buffer.indexOf('\n')) >= 0) {
+        let line = buffer.slice(0, nl);
+        buffer = buffer.slice(nl + 1);
+        if (line.endsWith('\r')) line = line.slice(0, -1);
+
+        if (line === '') {
+          // Blank line dispatches the buffered event.
+          if (dataLines.length > 0) {
+            yield { event: eventName, data: dataLines.join('\n') };
+          }
+          eventName = 'message';
+          dataLines = [];
+          continue;
+        }
+        if (line.startsWith(':')) continue; // comment / keepalive
+
+        const colon = line.indexOf(':');
+        const field = colon === -1 ? line : line.slice(0, colon);
+        let val = colon === -1 ? '' : line.slice(colon + 1);
+        if (val.startsWith(' ')) val = val.slice(1);
+
+        if (field === 'event') eventName = val;
+        else if (field === 'data') dataLines.push(val);
+        // `id` / `retry` are ignored.
+      }
+    }
+  } finally {
+    try { reader.releaseLock(); } catch { /* ignore */ }
+  }
+}

package/src/auth/loopback.js

@@ -0,0 +1,129 @@
+// Loopback redirect catcher for the OAuth flow (RFC 8252 §7.3). Binds an
+// ephemeral port on 127.0.0.1, advertises it as the redirect_uri, and resolves
+// once the browser is redirected to /callback?code=...
+import http from 'node:http';
+import { REDIRECT_PATH } from '../config.js';
+
+const PAGE = (title, heading, body, accent) => `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { margin:0; min-height:100vh; display:flex; align-items:center; justify-content:center;
+         font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
+         background:#0b0d12; color:#e6e8ee; }
+  .card { max-width:420px; padding:40px 36px; border-radius:16px; background:#151923;
+          box-shadow:0 10px 40px rgba(0,0,0,.45); text-align:center; }
+  .badge { width:56px; height:56px; border-radius:50%; margin:0 auto 20px; display:flex;
+           align-items:center; justify-content:center; font-size:28px; background:${accent}22; color:${accent}; }
+  h1 { font-size:20px; margin:0 0 8px; }
+  p { font-size:14px; line-height:1.5; color:#9aa3b2; margin:0; }
+  .brand { margin-top:24px; font-size:12px; letter-spacing:.08em; text-transform:uppercase; color:#5b6472; }
+  code { background:#0b0d12; padding:1px 6px; border-radius:6px; color:#cbd2e0; }
+</style></head>
+<body><div class="card">
+  <div class="badge">${heading}</div>
+  ${body}
+  <div class="brand" style="color:#5b6472">Atlas CLI</div>
+</div>
+<script>setTimeout(function(){ try { window.close(); } catch (e) {} }, 1200);</script>
+</body></html>`;
+
+const SUCCESS_HTML = PAGE(
+  'Atlas — signed in', '✓',
+  '<h1>You are signed in</h1><p>Authentication complete. You can close this window and return to your terminal.</p>',
+  '#4ade80',
+);
+
+const ERROR_HTML = (msg) => PAGE(
+  'Atlas — sign-in failed', '✕',
+  `<h1>Sign-in failed</h1><p>${escapeHtml(msg)}</p><p style="margin-top:10px">Return to your terminal and try <code>atlas login</code> again.</p>`,
+  '#f87171',
+);
+
+function escapeHtml(s) {
+  return String(s).replace(/[&<>"']/g, (c) => (
+    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
+  ));
+}
+
+export class LoopbackServer {
+  constructor() {
+    this.server = null;
+    this.port = 0;
+  }
+
+  // Bind 127.0.0.1 on an OS-assigned port; returns { port, redirectUri }.
+  start() {
+    return new Promise((resolve, reject) => {
+      this.server = http.createServer();
+      this.server.on('error', reject);
+      this.server.listen(0, '127.0.0.1', () => {
+        this.port = this.server.address().port;
+        resolve({ port: this.port, redirectUri: `http://127.0.0.1:${this.port}${REDIRECT_PATH}` });
+      });
+    });
+  }
+
+  // Resolve with { code, state } on the first valid /callback hit; reject on
+  // an OAuth error, a state mismatch, or timeout.
+  waitForCallback({ expectedState, timeoutMs = 300000 } = {}) {
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        cleanup();
+        reject(new Error('Timed out waiting for the browser callback (5 min).'));
+      }, timeoutMs);
+
+      const onRequest = (req, res) => {
+        const url = new URL(req.url, `http://127.0.0.1:${this.port}`);
+        if (url.pathname !== REDIRECT_PATH) {
+          res.writeHead(404, { 'Content-Type': 'text/plain' });
+          res.end('Not found');
+          return;
+        }
+        const p = url.searchParams;
+        const respond = (html, status = 200) => {
+          res.writeHead(status, { 'Content-Type': 'text/html; charset=utf-8' });
+          res.end(html);
+        };
+        const error = p.get('error');
+        const code = p.get('code');
+        const state = p.get('state');
+
+        if (error) {
+          const desc = p.get('error_description');
+          respond(ERROR_HTML(desc ? `${error}: ${desc}` : error), 400);
+          cleanup();
+          reject(new Error(`Authorization denied: ${error}`));
+          return;
+        }
+        if (!code) {
+          respond(ERROR_HTML('No authorization code was returned.'), 400);
+          cleanup();
+          reject(new Error('Callback did not include an authorization code.'));
+          return;
+        }
+        if (expectedState && state !== expectedState) {
+          respond(ERROR_HTML('State mismatch — request aborted.'), 400);
+          cleanup();
+          reject(new Error('State mismatch in OAuth callback (possible CSRF).'));
+          return;
+        }
+        respond(SUCCESS_HTML);
+        cleanup();
+        resolve({ code, state });
+      };
+
+      const cleanup = () => {
+        clearTimeout(timer);
+        if (this.server) this.server.removeListener('request', onRequest);
+      };
+      this.server.on('request', onRequest);
+    });
+  }
+
+  close() {
+    try { if (this.server) this.server.close(); } catch { /* ignore */ }
+  }
+}

package/src/auth/oauth.js

@@ -0,0 +1,145 @@
+// OAuth 2.0 client: discovery, dynamic registration, authorize-URL building,
+// code exchange, refresh, revoke, and userinfo. Plain fetch + form/JSON bodies.
+import { defaultEndpoints, baseUrl, DEFAULT_SCOPE, CLIENT_NAME } from '../config.js';
+import { loadConfig, saveConfig } from './store.js';
+
+// Small JSON/form HTTP helper that turns non-2xx into a useful Error.
+async function httpJson(url, { method = 'GET', headers = {}, body, form } = {}) {
+  const opts = { method, headers: { Accept: 'application/json', ...headers } };
+  if (form) {
+    opts.headers['Content-Type'] = 'application/x-www-form-urlencoded';
+    opts.body = new URLSearchParams(form).toString();
+  } else if (body !== undefined) {
+    opts.headers['Content-Type'] = 'application/json';
+    opts.body = JSON.stringify(body);
+  }
+  const res = await fetch(url, opts);
+  const text = await res.text();
+  let data;
+  try { data = text ? JSON.parse(text) : {}; } catch { data = { raw: text }; }
+  if (!res.ok) {
+    const msg = data.error_description || data.error || data.message || `HTTP ${res.status}`;
+    const err = new Error(msg);
+    err.status = res.status;
+    err.data = data;
+    throw err;
+  }
+  return data;
+}
+
+// Resolve OAuth endpoints, fetching /.well-known and caching it. Falls back to
+// the derived defaults if discovery is unreachable.
+export async function getEndpoints({ refresh = false } = {}) {
+  const base = baseUrl();
+  const cfg = loadConfig();
+  if (!refresh && cfg.endpoints && cfg.endpoints.issuer === base) return cfg.endpoints;
+
+  let endpoints = defaultEndpoints(base);
+  try {
+    const disc = await httpJson(endpoints.discovery);
+    endpoints = {
+      issuer: disc.issuer || base,
+      discovery: endpoints.discovery,
+      authorization_endpoint: disc.authorization_endpoint || endpoints.authorization_endpoint,
+      token_endpoint: disc.token_endpoint || endpoints.token_endpoint,
+      registration_endpoint: disc.registration_endpoint || endpoints.registration_endpoint,
+      revocation_endpoint: disc.revocation_endpoint || endpoints.revocation_endpoint,
+      userinfo_endpoint: disc.userinfo_endpoint || endpoints.userinfo_endpoint,
+      scopes_supported: disc.scopes_supported || ['atlas', 'broker'],
+    };
+  } catch {
+    // Discovery is optional — defaults already match production.
+  }
+  saveConfig({ ...loadConfig(), endpoints });
+  return endpoints;
+}
+
+// Register a public client once (RFC 7591) and cache its id. Honours
+// ATLAS_CLIENT_ID and a previously cached id so we don't trip the server's
+// 5-registrations/min/IP limit.
+export async function ensureClientId(endpoints, redirectUri) {
+  if (process.env.ATLAS_CLIENT_ID) return process.env.ATLAS_CLIENT_ID;
+  const cfg = loadConfig();
+  if (cfg.client_id) return cfg.client_id;
+
+  const reg = await httpJson(endpoints.registration_endpoint, {
+    method: 'POST',
+    body: {
+      client_name: CLIENT_NAME,
+      redirect_uris: [redirectUri],
+      grant_types: ['authorization_code', 'refresh_token'],
+      response_types: ['code'],
+      token_endpoint_auth_method: 'none',
+      scope: DEFAULT_SCOPE,
+    },
+  });
+  if (!reg.client_id) throw new Error('Registration did not return a client_id.');
+  saveConfig({ ...loadConfig(), client_id: reg.client_id });
+  return reg.client_id;
+}
+
+export function buildAuthorizeUrl(endpoints, { clientId, redirectUri, scope, state, challenge, method }) {
+  const u = new URL(endpoints.authorization_endpoint);
+  u.search = new URLSearchParams({
+    response_type: 'code',
+    client_id: clientId,
+    redirect_uri: redirectUri,
+    scope,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: method,
+  }).toString();
+  return u.toString();
+}
+
+export function exchangeCode(endpoints, { code, redirectUri, clientId, verifier }) {
+  return httpJson(endpoints.token_endpoint, {
+    method: 'POST',
+    form: {
+      grant_type: 'authorization_code',
+      code,
+      redirect_uri: redirectUri,
+      client_id: clientId,
+      code_verifier: verifier,
+    },
+  });
+}
+
+export function refreshAccessToken(endpoints, { refreshToken, clientId }) {
+  return httpJson(endpoints.token_endpoint, {
+    method: 'POST',
+    form: {
+      grant_type: 'refresh_token',
+      refresh_token: refreshToken,
+      client_id: clientId,
+    },
+  });
+}
+
+export async function revokeToken(endpoints, { token }) {
+  if (!endpoints.revocation_endpoint || !token) return false;
+  try { await httpJson(endpoints.revocation_endpoint, { method: 'POST', body: { token } }); return true; }
+  catch { return false; }
+}
+
+export function fetchUserinfo(endpoints, accessToken) {
+  return httpJson(endpoints.userinfo_endpoint, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+  });
+}
+
+// Normalise a token-endpoint response into the persisted credential blob.
+export function credentialsFromTokenResponse(tok, { clientId, base = baseUrl() }) {
+  const now = Date.now();
+  return {
+    base_url: base,
+    access_token: tok.access_token,
+    refresh_token: tok.refresh_token || null,
+    token_type: tok.token_type || 'Bearer',
+    scope: tok.scope || null,
+    expires_at: tok.expires_in ? now + tok.expires_in * 1000 : null,
+    obtained_at: now,
+    client_id: clientId,
+    source: 'oauth',
+  };
+}

package/src/auth/pkce.js

@@ -0,0 +1,22 @@
+// PKCE (RFC 7636) and random state generation.
+import crypto from 'node:crypto';
+
+export function base64url(buf) {
+  return Buffer.from(buf).toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+// The server verifies S256 as base64url(sha256(verifier)) === challenge
+// (oauth-server.js `verifyPkce`), so this produces a matching pair.
+export function createPkce() {
+  const verifier = base64url(crypto.randomBytes(32));
+  const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
+  return { verifier, challenge, method: 'S256' };
+}
+
+// Opaque, URL-safe random value for the `state` parameter (CSRF defence).
+export function randomState(bytes = 16) {
+  return base64url(crypto.randomBytes(bytes));
+}