@astrale-os/kernel-core 0.4.1

package/dist/auth/access.d.ts

@@ -0,0 +1,48 @@
+import type { Path } from '#graph/nav/path';
+import type { NodeId, IdentityId } from '#ids';
+import type { IdentityExpr } from './expression/types';
+import type { Permission } from './permissions';
+export type AccessDecision = {
+    granted: boolean;
+};
+export type AccessExplanation = {
+    node: Path;
+    perm: Permission;
+    principal: IdentityId;
+    granted: boolean;
+    expression: IdentityExpr;
+    leaves: LeafEvaluation[];
+    query: string | null;
+};
+/**
+ * Evaluation of a single leaf identity in the expression tree.
+ *
+ * Path encoding: position in tree using operand indices.
+ * - [] = root (single identity)
+ * - [0] = first operand (or base for exclude)
+ * - [1] = second operand (or first excluded for exclude)
+ * - [0, 2] = first operand's third operand
+ *
+ * For scope nodes, the path passes through transparently (scope
+ * wraps a single expression, so no index is added).
+ */
+export type LeafEvaluation = {
+    path: number[];
+    identityId: IdentityId;
+    status: 'granted' | 'filtered' | 'missing';
+    grantedAt?: NodeId;
+    inheritancePath?: NodeId[];
+    filterDetail?: FilterDetail[];
+    searchedPath?: NodeId[];
+    nodeRestriction?: NodeId[];
+};
+/**
+ * Detail about why a scope filtered an identity.
+ * Note: 'principal' and 'perm' are checked during pruning.
+ * Node scope restrictions are enforced in Cypher, not in filter.
+ */
+export type FilterDetail = {
+    scopeIndex: number;
+    failedCheck: 'principal' | 'perm';
+};
+//# sourceMappingURL=access.d.ts.map

package/dist/auth/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../auth/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAE9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAE/C,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,IAAI,CAAA;IACV,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,UAAU,CAAA;IACrB,OAAO,EAAE,OAAO,CAAA;IAChB,UAAU,EAAE,YAAY,CAAA;IACxB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,UAAU,EAAE,UAAU,CAAA;IACtB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAA;IAG1C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAG1B,YAAY,CAAC,EAAE,YAAY,EAAE,CAAA;IAG7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IAKvB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,WAAW,GAAG,MAAM,CAAA;CAClC,CAAA"}

package/dist/auth/access.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=access.js.map

package/dist/auth/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../auth/access.ts"],"names":[],"mappings":""}

package/dist/auth/attestation/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/attestation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/attestation/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA"}

package/dist/auth/attestation/index.js

@@ -0,0 +1,2 @@
+export * from './types';
+//# sourceMappingURL=index.js.map

package/dist/auth/attestation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/attestation/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA"}

package/dist/auth/attestation/types.d.ts

@@ -0,0 +1,5 @@
+import type { SelfIdentityExpr } from '#auth/expression';
+export type Attestation = {
+    expr: SelfIdentityExpr;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/attestation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../auth/attestation/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,gBAAgB,CAAA;CACvB,CAAA"}

package/dist/auth/attestation/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/attestation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../auth/attestation/types.ts"],"names":[],"mappings":""}

package/dist/auth/audience/errors.d.ts

@@ -0,0 +1,8 @@
+import type { IssuerId } from '#auth/issuers';
+import { AuthenticationError } from '#auth/credentials/errors';
+export declare class InvalidAudienceError extends AuthenticationError {
+    readonly expectedAudience: IssuerId;
+    readonly actualAudience?: (string | string[]) | undefined;
+    constructor(expectedAudience: IssuerId, actualAudience?: (string | string[]) | undefined);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/audience/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../auth/audience/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,qBAAa,oBAAqB,SAAQ,mBAAmB;IAEzD,QAAQ,CAAC,gBAAgB,EAAE,QAAQ;IACnC,QAAQ,CAAC,cAAc,CAAC,GAAE,MAAM,GAAG,MAAM,EAAE;IAF7C,YACW,gBAAgB,EAAE,QAAQ,EAC1B,cAAc,CAAC,GAAE,MAAM,GAAG,MAAM,EAAE,aAAA,EAU5C;CACF"}

package/dist/auth/audience/errors.js

@@ -0,0 +1,15 @@
+import { AuthenticationError } from '#auth/credentials/errors';
+export class InvalidAudienceError extends AuthenticationError {
+    expectedAudience;
+    actualAudience;
+    constructor(expectedAudience, actualAudience) {
+        const actual = Array.isArray(actualAudience)
+            ? actualAudience.join(', ')
+            : (actualAudience ?? 'undefined');
+        super(`Credential audience mismatch. Expected: ${expectedAudience}. Actual: ${actual}`, 'INVALID_AUDIENCE');
+        this.expectedAudience = expectedAudience;
+        this.actualAudience = actualAudience;
+        this.name = 'InvalidAudienceError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/audience/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../auth/audience/errors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IAEhD,gBAAgB;IAChB,cAAc;IAFzB,YACW,gBAA0B,EAC1B,cAAkC;QAE3C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YAC1C,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,CAAC,CAAC,CAAC,cAAc,IAAI,WAAW,CAAC,CAAA;QACnC,KAAK,CACH,2CAA2C,gBAAgB,aAAa,MAAM,EAAE,EAChF,kBAAkB,CACnB,CAAA;gCATQ,gBAAgB;8BAChB,cAAc;QASvB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF"}

package/dist/auth/audience/index.d.ts

@@ -0,0 +1,3 @@
+export * from './verify-audience';
+export * from './errors';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/audience/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/audience/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,UAAU,CAAA"}

package/dist/auth/audience/index.js

@@ -0,0 +1,3 @@
+export * from './verify-audience';
+export * from './errors';
+//# sourceMappingURL=index.js.map

package/dist/auth/audience/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/audience/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,UAAU,CAAA"}

package/dist/auth/audience/verify-audience.d.ts

@@ -0,0 +1,4 @@
+import type { VerifiedCredential } from '#auth/credentials/types';
+import type { IssuerId } from '#auth/issuers';
+export declare function verifyAudience(verified: VerifiedCredential, expectedAudience: IssuerId): void;
+//# sourceMappingURL=verify-audience.d.ts.map

package/dist/auth/audience/verify-audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-audience.d.ts","sourceRoot":"","sources":["../../../auth/audience/verify-audience.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAI7C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,QAAQ,GAAG,IAAI,CAkB7F"}

package/dist/auth/audience/verify-audience.js

@@ -0,0 +1,18 @@
+import { InvalidAudienceError } from './errors';
+export function verifyAudience(verified, expectedAudience) {
+    const { aud } = verified;
+    if (typeof aud === 'string') {
+        if (aud !== expectedAudience) {
+            throw new InvalidAudienceError(expectedAudience, aud);
+        }
+        return;
+    }
+    if (Array.isArray(aud)) {
+        if (!aud.includes(expectedAudience)) {
+            throw new InvalidAudienceError(expectedAudience, aud);
+        }
+        return;
+    }
+    throw new InvalidAudienceError(expectedAudience, aud);
+}
+//# sourceMappingURL=verify-audience.js.map

package/dist/auth/audience/verify-audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-audience.js","sourceRoot":"","sources":["../../../auth/audience/verify-audience.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAE/C,MAAM,UAAU,cAAc,CAAC,QAA4B,EAAE,gBAA0B;IACrF,MAAM,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAA;IAExB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YAC7B,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;QACD,OAAM;IACR,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;QACvD,CAAC;QACD,OAAM;IACR,CAAC;IAED,MAAM,IAAI,oBAAoB,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;AACvD,CAAC"}

package/dist/auth/claims/errors.d.ts

@@ -0,0 +1,22 @@
+import { AuthenticationError } from '#auth/credentials/errors';
+export declare class IdpError extends AuthenticationError {
+    details?: Record<string, unknown> | undefined;
+    constructor(message: string, code: string, details?: Record<string, unknown> | undefined);
+}
+export type ClaimMismatchDetails = {
+    claim: string;
+    constraint: {
+        op: 'eq' | 'contains' | 'exists';
+        value?: unknown;
+    };
+    actual: unknown;
+};
+export declare class ClaimMismatchError extends AuthenticationError {
+    details: ClaimMismatchDetails;
+    constructor(details: ClaimMismatchDetails);
+}
+export declare class UnsupportedClaimConstraintOperatorError extends AuthenticationError {
+    readonly operator: unknown;
+    constructor(operator: unknown);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/claims/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../auth/claims/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAI9D,qBAAa,QAAS,SAAQ,mBAAmB;IAItC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAH1C,YACE,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACL,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA,EAIzC;CACF;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE;QAAE,EAAE,EAAE,IAAI,GAAG,UAAU,GAAG,QAAQ,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACjE,MAAM,EAAE,OAAO,CAAA;CAChB,CAAA;AAED,qBAAa,kBAAmB,SAAQ,mBAAmB;IACtC,OAAO,EAAE,oBAAoB;IAAhD,YAAmB,OAAO,EAAE,oBAAoB,EAW/C;CACF;AAED,qBAAa,uCAAwC,SAAQ,mBAAmB;IAClE,QAAQ,CAAC,QAAQ,EAAE,OAAO;IAAtC,YAAqB,QAAQ,EAAE,OAAO,EAGrC;CACF"}

package/dist/auth/claims/errors.js

@@ -0,0 +1,33 @@
+import { AuthenticationError } from '#auth/credentials/errors';
+export class IdpError extends AuthenticationError {
+    details;
+    constructor(message, code, details) {
+        super(message, code);
+        this.details = details;
+        this.name = 'IdpError';
+    }
+}
+export class ClaimMismatchError extends AuthenticationError {
+    details;
+    constructor(details) {
+        const { claim, constraint, actual } = details;
+        const actualStr = actual === undefined ? 'undefined' : JSON.stringify(actual);
+        const message = constraint.op === 'exists'
+            ? `Claim "${claim}" must exist, got ${actualStr}`
+            : constraint.op === 'contains'
+                ? `Claim "${claim}" must contain ${JSON.stringify(constraint.value)}, got ${actualStr}`
+                : `Claim "${claim}" must equal ${JSON.stringify(constraint.value)}, got ${actualStr}`;
+        super(message, 'CLAIM_MISMATCH');
+        this.details = details;
+        this.name = 'ClaimMismatchError';
+    }
+}
+export class UnsupportedClaimConstraintOperatorError extends AuthenticationError {
+    operator;
+    constructor(operator) {
+        super(`Unknown claim constraint operator: ${String(operator)}`, 'INVALID_CLAIM_CONSTRAINT');
+        this.operator = operator;
+        this.name = 'UnsupportedClaimConstraintOperatorError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/claims/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../auth/claims/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAI9D,MAAM,OAAO,QAAS,SAAQ,mBAAmB;IAItC,OAAO;IAHhB,YACE,OAAe,EACf,IAAY,EACL,OAAiC;QAExC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;uBAFb,OAAO;QAGd,IAAI,CAAC,IAAI,GAAG,UAAU,CAAA;IACxB,CAAC;CACF;AAQD,MAAM,OAAO,kBAAmB,SAAQ,mBAAmB;IACtC,OAAO;IAA1B,YAAmB,OAA6B;QAC9C,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC7C,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAC7E,MAAM,OAAO,GACX,UAAU,CAAC,EAAE,KAAK,QAAQ;YACxB,CAAC,CAAC,UAAU,KAAK,qBAAqB,SAAS,EAAE;YACjD,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,UAAU;gBAC5B,CAAC,CAAC,UAAU,KAAK,kBAAkB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAkB,CAAC,SAAS,SAAS,EAAE;gBACpG,CAAC,CAAC,UAAU,KAAK,gBAAgB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAkB,CAAC,SAAS,SAAS,EAAE,CAAA;QACxG,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;uBATf,OAAO;QAUxB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED,MAAM,OAAO,uCAAwC,SAAQ,mBAAmB;IACzD,QAAQ;IAA7B,YAAqB,QAAiB;QACpC,KAAK,CAAC,sCAAsC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,0BAA0B,CAAC,CAAA;wBADxE,QAAQ;QAE3B,IAAI,CAAC,IAAI,GAAG,yCAAyC,CAAA;IACvD,CAAC;CACF"}

package/dist/auth/claims/index.d.ts

@@ -0,0 +1,4 @@
+export * from './required-claims';
+export * from './errors';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/claims/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/claims/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,UAAU,CAAA;AACxB,cAAc,SAAS,CAAA"}

package/dist/auth/claims/index.js

@@ -0,0 +1,4 @@
+export * from './required-claims';
+export * from './errors';
+export * from './types';
+//# sourceMappingURL=index.js.map

package/dist/auth/claims/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/claims/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,UAAU,CAAA;AACxB,cAAc,SAAS,CAAA"}

package/dist/auth/claims/required-claims.d.ts

@@ -0,0 +1,16 @@
+import type { ClaimConstraint, Claims, RequiredClaims } from './types';
+/**
+ * Verify all required claims against token claims.
+ * Throws ClaimMismatchError on first failing constraint.
+ *
+ * @param requiredClaims - Constraints from identity metadata
+ * @param tokenClaims - Claims from verified JWT
+ * @throws ClaimMismatchError if any constraint fails
+ */
+export declare function verifyRequiredClaims(requiredClaims: RequiredClaims, tokenClaims: Claims): void;
+/**
+ * Evaluate a single claim constraint against token claims.
+ * Returns true if constraint is satisfied.
+ */
+export declare function evaluateConstraint(constraint: ClaimConstraint, claims: Claims): boolean;
+//# sourceMappingURL=required-claims.d.ts.map

package/dist/auth/claims/required-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"required-claims.d.ts","sourceRoot":"","sources":["../../../auth/claims/required-claims.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAa,cAAc,EAAE,MAAM,SAAS,CAAA;AAIjF;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAa9F;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAgBvF"}

package/dist/auth/claims/required-claims.js

@@ -0,0 +1,41 @@
+import { dequal } from 'dequal';
+import { ClaimMismatchError, UnsupportedClaimConstraintOperatorError } from './errors';
+/**
+ * Verify all required claims against token claims.
+ * Throws ClaimMismatchError on first failing constraint.
+ *
+ * @param requiredClaims - Constraints from identity metadata
+ * @param tokenClaims - Claims from verified JWT
+ * @throws ClaimMismatchError if any constraint fails
+ */
+export function verifyRequiredClaims(requiredClaims, tokenClaims) {
+    for (const constraint of requiredClaims) {
+        if (!evaluateConstraint(constraint, tokenClaims)) {
+            throw new ClaimMismatchError({
+                claim: constraint.claim,
+                constraint: constraint.op === 'exists'
+                    ? { op: 'exists' }
+                    : { op: constraint.op, value: constraint.value },
+                actual: tokenClaims[constraint.claim],
+            });
+        }
+    }
+}
+/**
+ * Evaluate a single claim constraint against token claims.
+ * Returns true if constraint is satisfied.
+ */
+export function evaluateConstraint(constraint, claims) {
+    const actual = claims[constraint.claim];
+    switch (constraint.op) {
+        case 'exists':
+            return actual !== undefined;
+        case 'eq':
+            return dequal(actual, constraint.value);
+        case 'contains':
+            return Array.isArray(actual) && actual.some((item) => dequal(item, constraint.value));
+        default:
+            throw new UnsupportedClaimConstraintOperatorError(constraint.op);
+    }
+}
+//# sourceMappingURL=required-claims.js.map

package/dist/auth/claims/required-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"required-claims.js","sourceRoot":"","sources":["../../../auth/claims/required-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAI/B,OAAO,EAAE,kBAAkB,EAAE,uCAAuC,EAAE,MAAM,UAAU,CAAA;AAEtF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,cAA8B,EAAE,WAAmB;IACtF,KAAK,MAAM,UAAU,IAAI,cAAc,EAAE,CAAC;QACxC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,UAAU,EACR,UAAU,CAAC,EAAE,KAAK,QAAQ;oBACxB,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE;oBAClB,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAkB,EAAE;gBACjE,MAAM,EAAE,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC;aACtC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA2B,EAAE,MAAc;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAEvC,QAAQ,UAAU,CAAC,EAAE,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,MAAM,KAAK,SAAS,CAAA;QAE7B,KAAK,IAAI;YACP,OAAO,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAA;QAEzC,KAAK,UAAU;YACb,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;QAEvF;YACE,MAAM,IAAI,uCAAuC,CAAE,UAA+B,CAAC,EAAE,CAAC,CAAA;IAC1F,CAAC;AACH,CAAC"}

package/dist/auth/claims/types.d.ts

@@ -0,0 +1,33 @@
+import z from 'zod';
+export type Claims = Record<string, unknown>;
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export declare const jsonValueSchema: z.ZodType<JsonValue>;
+export declare const claimConstraintSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    claim: z.ZodString;
+    op: z.ZodLiteral<"eq">;
+    value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+}, z.core.$strip>, z.ZodObject<{
+    claim: z.ZodString;
+    op: z.ZodLiteral<"contains">;
+    value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+}, z.core.$strip>, z.ZodObject<{
+    claim: z.ZodString;
+    op: z.ZodLiteral<"exists">;
+}, z.core.$strip>], "op">;
+export type ClaimConstraint = z.infer<typeof claimConstraintSchema>;
+export declare const requiredClaimsSchema: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    claim: z.ZodString;
+    op: z.ZodLiteral<"eq">;
+    value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+}, z.core.$strip>, z.ZodObject<{
+    claim: z.ZodString;
+    op: z.ZodLiteral<"contains">;
+    value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+}, z.core.$strip>, z.ZodObject<{
+    claim: z.ZodString;
+    op: z.ZodLiteral<"exists">;
+}, z.core.$strip>], "op">>;
+export type RequiredClaims = z.infer<typeof requiredClaimsSchema>;
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/claims/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../auth/claims/types.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,MAAM,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAI5C,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,EAAE,GACX;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAA;AAEhC,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAShD,CAAA;AAID,eAAO,MAAM,qBAAqB;;;;;;;;;;;yBAIhC,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,eAAO,MAAM,oBAAoB;;;;;;;;;;;0BAAiC,CAAA;AAClE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA"}

package/dist/auth/claims/types.js

@@ -0,0 +1,17 @@
+import z from 'zod';
+export const jsonValueSchema = z.lazy(() => z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+    z.array(jsonValueSchema),
+    z.record(z.string(), jsonValueSchema),
+]));
+// ─── Claim Constraints ──────────────────────────────────────────
+export const claimConstraintSchema = z.discriminatedUnion('op', [
+    z.object({ claim: z.string(), op: z.literal('eq'), value: jsonValueSchema }),
+    z.object({ claim: z.string(), op: z.literal('contains'), value: jsonValueSchema }),
+    z.object({ claim: z.string(), op: z.literal('exists') }),
+]);
+export const requiredClaimsSchema = z.array(claimConstraintSchema);
+//# sourceMappingURL=types.js.map

package/dist/auth/claims/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../auth/claims/types.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAcnB,MAAM,CAAC,MAAM,eAAe,GAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAC/D,CAAC,CAAC,KAAK,CAAC;IACN,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,IAAI,EAAE;IACR,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;CACtC,CAAC,CACH,CAAA;AAED,mEAAmE;AAEnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE;IAC9D,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAClF,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;CACzD,CAAC,CAAA;AAIF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAA"}

package/dist/auth/context.d.ts

@@ -0,0 +1,23 @@
+import type { IdentityId } from '#ids';
+import type { Attestation } from './attestation';
+import type { CredentialInput, VerifiedCredential } from './credentials';
+import type { Delegation } from './delegation';
+import type { Grant } from './grants';
+export type CredentialContext = {
+    raw: CredentialInput;
+    verified: VerifiedCredential;
+};
+export type Authenticated = {
+    credential: CredentialContext;
+    grant?: Grant;
+    attestation?: Attestation;
+    delegation?: Delegation;
+};
+export type AuthContext = {
+    credential: CredentialContext;
+    principal: IdentityId;
+    grant: Grant;
+    attestation?: Attestation;
+    delegation?: Delegation;
+};
+//# sourceMappingURL=context.d.ts.map

package/dist/auth/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../auth/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAEtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAErC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,eAAe,CAAA;IACpB,QAAQ,EAAE,kBAAkB,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,iBAAiB,CAAA;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,iBAAiB,CAAA;IAC7B,SAAS,EAAE,UAAU,CAAA;IACrB,KAAK,EAAE,KAAK,CAAA;IACZ,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,UAAU,CAAC,EAAE,UAAU,CAAA;CACxB,CAAA"}

package/dist/auth/context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=context.js.map

package/dist/auth/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../auth/context.ts"],"names":[],"mappings":""}

package/dist/auth/credentials/decode.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialMethodResolver } from '#auth/methods/resolver';
+import type { CredentialInput, DecodedCredentialClaims } from './types';
+export declare function decodeCredential(methodResolver: CredentialMethodResolver, credential: CredentialInput): DecodedCredentialClaims;
+//# sourceMappingURL=decode.d.ts.map

package/dist/auth/credentials/decode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.d.ts","sourceRoot":"","sources":["../../../auth/credentials/decode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAEtE,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA;AAIvE,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,wBAAwB,EACxC,UAAU,EAAE,eAAe,GAC1B,uBAAuB,CAIzB"}

package/dist/auth/credentials/decode.js

@@ -0,0 +1,7 @@
+import { CredentialEnvelope } from './envelope';
+export function decodeCredential(methodResolver, credential) {
+    const envelope = new CredentialEnvelope(credential);
+    const method = methodResolver.resolve(envelope);
+    return method.decode(envelope);
+}
+//# sourceMappingURL=decode.js.map

package/dist/auth/credentials/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../../../auth/credentials/decode.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,UAAU,gBAAgB,CAC9B,cAAwC,EACxC,UAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC"}

package/dist/auth/credentials/envelope.d.ts

@@ -0,0 +1,15 @@
+import type { CredentialInput, DecodedCredentialClaims } from './types';
+export declare class CredentialEnvelope {
+    private readonly raw;
+    private _bytes?;
+    private _text?;
+    constructor(raw: CredentialInput);
+    get bytes(): Uint8Array;
+    get text(): string;
+}
+export declare function normalizeCredentialInput(input: CredentialInput): {
+    bytes: Uint8Array;
+    text: string;
+};
+export declare function toDecodedClaims(payload: Record<string, unknown>): DecodedCredentialClaims;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/auth/credentials/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../../auth/credentials/envelope.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA;AAKvE,qBAAa,kBAAkB;IAIjB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,MAAM,CAAC,CAAY;IAC3B,OAAO,CAAC,KAAK,CAAC,CAAQ;IAEtB,YAA6B,GAAG,EAAE,eAAe,EAAI;IAErD,IAAI,KAAK,IAAI,UAAU,CAMtB;IAED,IAAI,IAAI,IAAI,MAAM,CAMjB;CACF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG;IAChE,KAAK,EAAE,UAAU,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;CACb,CAKA;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,uBAAuB,CAsBzF"}

package/dist/auth/credentials/envelope.js

@@ -0,0 +1,52 @@
+import { toIssuerId } from '#auth/issuers';
+const textDecoder = new TextDecoder();
+const textEncoder = new TextEncoder();
+export class CredentialEnvelope {
+    raw;
+    _bytes;
+    _text;
+    constructor(raw) {
+        this.raw = raw;
+    }
+    get bytes() {
+        if (this._bytes) {
+            return this._bytes;
+        }
+        this._bytes = typeof this.raw === 'string' ? textEncoder.encode(this.raw) : this.raw;
+        return this._bytes;
+    }
+    get text() {
+        if (this._text !== undefined) {
+            return this._text;
+        }
+        this._text = typeof this.raw === 'string' ? this.raw : textDecoder.decode(this.raw);
+        return this._text;
+    }
+}
+export function normalizeCredentialInput(input) {
+    if (typeof input === 'string') {
+        return { bytes: textEncoder.encode(input), text: input };
+    }
+    return { bytes: input, text: textDecoder.decode(input) };
+}
+export function toDecodedClaims(payload) {
+    const issStr = typeof payload.issuer === 'string'
+        ? payload.issuer
+        : typeof payload.iss === 'string'
+            ? payload.iss
+            : undefined;
+    const iss = issStr !== undefined ? toIssuerId(issStr) : undefined;
+    const sub = typeof payload.subject === 'string'
+        ? payload.subject
+        : typeof payload.sub === 'string'
+            ? payload.sub
+            : undefined;
+    const aud = payload.aud ?? payload.audience;
+    return {
+        iss,
+        sub,
+        aud: Array.isArray(aud) || typeof aud === 'string' ? aud : undefined,
+        claims: payload,
+    };
+}
+//# sourceMappingURL=envelope.js.map

package/dist/auth/credentials/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../auth/credentials/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAI1C,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;AACrC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;AAErC,MAAM,OAAO,kBAAkB;IAIA,GAAG;IAHxB,MAAM,CAAa;IACnB,KAAK,CAAS;IAEtB,YAA6B,GAAoB;mBAApB,GAAG;IAAoB,CAAC;IAErD,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,MAAM,CAAA;QACpB,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;QACpF,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,IAAI,IAAI;QACN,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAA;QACnB,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnF,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;CACF;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAsB;IAI7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC1D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAgC;IAC9D,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,CAAC,OAAO,CAAC,GAAG;YACb,CAAC,CAAC,SAAS,CAAA;IACjB,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,MAAM,GAAG,GACP,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACjC,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,CAAC,OAAO,CAAC,GAAG;YACb,CAAC,CAAC,SAAS,CAAA;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAA;IAE3C,OAAO;QACL,GAAG;QACH,GAAG;QACH,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QACpE,MAAM,EAAE,OAAO;KAChB,CAAA;AACH,CAAC"}

package/dist/auth/credentials/errors.d.ts

@@ -0,0 +1,26 @@
+import type { IssuerId } from '#auth/issuers';
+export declare class AuthenticationError extends Error {
+    readonly code: string;
+    readonly method?: string | undefined;
+    constructor(message: string, code: string, method?: string | undefined);
+    /**
+     * Self-classify as a KernelErrorPayload (structural match — core cannot
+     * depend on kernel-api). Codes match KERNEL_ERROR_CODES.AUTH_MISSING /
+     * AUTH_INVALID / AUTH_EXPIRED. The fine-grained cause stays in `data.type`;
+     * the numeric code remains a coarse bucket.
+     */
+    toKernelErrorPayload(): {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+export declare class UntrustedIssuerError extends AuthenticationError {
+    readonly issuer: IssuerId;
+    constructor(issuer: IssuerId);
+}
+export declare class TrustPolicyDeniedError extends AuthenticationError {
+    readonly issuer: IssuerId;
+    constructor(issuer: IssuerId);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/credentials/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../auth/credentials/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7C,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;IAH1B,YACE,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,YAAA,EAIzB;IAED;;;;;OAKG;IACH,oBAAoB,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAGxE;CACF;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;IAC/C,QAAQ,CAAC,MAAM,EAAE,QAAQ;IAArC,YAAqB,MAAM,EAAE,QAAQ,EAGpC;CACF;AAED,qBAAa,sBAAuB,SAAQ,mBAAmB;IACjD,QAAQ,CAAC,MAAM,EAAE,QAAQ;IAArC,YAAqB,MAAM,EAAE,QAAQ,EAGpC;CACF"}

package/dist/auth/credentials/errors.js

@@ -0,0 +1,37 @@
+export class AuthenticationError extends Error {
+    code;
+    method;
+    constructor(message, code, method) {
+        super(message);
+        this.code = code;
+        this.method = method;
+        this.name = 'AuthenticationError';
+    }
+    /**
+     * Self-classify as a KernelErrorPayload (structural match — core cannot
+     * depend on kernel-api). Codes match KERNEL_ERROR_CODES.AUTH_MISSING /
+     * AUTH_INVALID / AUTH_EXPIRED. The fine-grained cause stays in `data.type`;
+     * the numeric code remains a coarse bucket.
+     */
+    toKernelErrorPayload() {
+        const code = this.code === 'NO_AUTH' ? 2001 : this.code === 'EXPIRED_CREDENTIAL' ? 2003 : 2002;
+        return { code, message: this.message, data: { type: this.code } };
+    }
+}
+export class UntrustedIssuerError extends AuthenticationError {
+    issuer;
+    constructor(issuer) {
+        super(`Issuer is not trusted: ${issuer}`, 'UNTRUSTED_ISSUER');
+        this.issuer = issuer;
+        this.name = 'UntrustedIssuerError';
+    }
+}
+export class TrustPolicyDeniedError extends AuthenticationError {
+    issuer;
+    constructor(issuer) {
+        super(`Trust policy denied issuer: ${issuer}`, 'TRUST_POLICY_DENIED');
+        this.issuer = issuer;
+        this.name = 'TrustPolicyDeniedError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/credentials/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../auth/credentials/errors.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAGjC,IAAI;IACJ,MAAM;IAHjB,YACE,OAAe,EACN,IAAY,EACZ,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAA;oBAHL,IAAI;sBACJ,MAAM;QAGf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;IAED;;;;;OAKG;IACH,oBAAoB;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;IACnE,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IACtC,MAAM;IAA3B,YAAqB,MAAgB;QACnC,KAAK,CAAC,0BAA0B,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAA;sBAD1C,MAAM;QAEzB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,mBAAmB;IACxC,MAAM;IAA3B,YAAqB,MAAgB;QACnC,KAAK,CAAC,+BAA+B,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;sBADlD,MAAM;QAEzB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF"}

package/dist/auth/credentials/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types';
+export * from './envelope';
+export * from './errors';
+export * from './decode';
+export * from './verify';
+//# sourceMappingURL=index.d.ts.map