@astrale-os/kernel-core 0.4.1

package/dist/auth/policy/identity.d.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+import { type ClaimConstraint } from '#auth/claims/types';
+export type ExtendComposition = {
+    extendWith: string;
+    when?: ClaimConstraint;
+};
+export type ConstrainComposition = {
+    constrainedBy: string;
+    when?: ClaimConstraint;
+};
+export type ExcludeComposition = {
+    excludedFrom: string;
+    when?: ClaimConstraint;
+};
+export type CompositionEntry = ExtendComposition | ConstrainComposition | ExcludeComposition;
+export declare const compositionEntrySchema: z.ZodUnion<readonly [z.ZodObject<{
+    extendWith: z.ZodString;
+    when: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"eq">;
+        value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"contains">;
+        value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"exists">;
+    }, z.core.$strip>], "op">>;
+}, z.core.$strip>, z.ZodObject<{
+    constrainedBy: z.ZodString;
+    when: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"eq">;
+        value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"contains">;
+        value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"exists">;
+    }, z.core.$strip>], "op">>;
+}, z.core.$strip>, z.ZodObject<{
+    excludedFrom: z.ZodString;
+    when: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"eq">;
+        value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"contains">;
+        value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"exists">;
+    }, z.core.$strip>], "op">>;
+}, z.core.$strip>]>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/auth/policy/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../auth/policy/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAIhF,MAAM,MAAM,iBAAiB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,eAAe,CAAA;CAAE,CAAA;AAC9E,MAAM,MAAM,oBAAoB,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,eAAe,CAAA;CAAE,CAAA;AACpF,MAAM,MAAM,kBAAkB,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,eAAe,CAAA;CAAE,CAAA;AACjF,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,kBAAkB,CAAA;AAI5F,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAIjC,CAAA"}

package/dist/auth/policy/identity.js

@@ -0,0 +1,9 @@
+import { z } from 'zod';
+import { claimConstraintSchema } from '#auth/claims/types';
+// ─── Schemas ────────────────────────────────────────────────
+export const compositionEntrySchema = z.union([
+    z.object({ extendWith: z.string(), when: claimConstraintSchema.optional() }),
+    z.object({ constrainedBy: z.string(), when: claimConstraintSchema.optional() }),
+    z.object({ excludedFrom: z.string(), when: claimConstraintSchema.optional() }),
+]);
+//# sourceMappingURL=identity.js.map

package/dist/auth/policy/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../auth/policy/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,qBAAqB,EAAwB,MAAM,oBAAoB,CAAA;AAShF,+DAA+D;AAE/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,qBAAqB,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,qBAAqB,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC/E,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,qBAAqB,CAAC,QAAQ,EAAE,EAAE,CAAC;CAC/E,CAAC,CAAA"}

package/dist/auth/policy/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types';
+export * from './trust.types';
+export * from './provision';
+export * from './identity';
+export * from './provisioning';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/policy/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/auth/policy/index.js

@@ -0,0 +1,6 @@
+export * from './types';
+export * from './trust.types';
+export * from './provision';
+export * from './identity';
+export * from './provisioning';
+//# sourceMappingURL=index.js.map

package/dist/auth/policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/policy/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/auth/policy/provision.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import { type JsonValue } from '#auth/claims/types';
+export type ClaimParamMapping = {
+    claim: string;
+};
+export type LiteralParamMapping = {
+    literal: JsonValue;
+};
+export type ParamMapping = ClaimParamMapping | LiteralParamMapping;
+export type ProvisionMethod = {
+    /** Absolute path to the domain method (e.g., '/acme.eu.astrale.ai/User.init'). */
+    method: string;
+    /** Maps method param names to JWT claims or literal values. */
+    params: Record<string, ParamMapping>;
+};
+export declare const paramMappingSchema: z.ZodUnion<readonly [z.ZodObject<{
+    claim: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    literal: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+}, z.core.$strip>]>;
+export declare const provisionMethodSchema: z.ZodObject<{
+    method: z.ZodString;
+    params: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        claim: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        literal: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    }, z.core.$strip>]>>;
+}, z.core.$strip>;
+//# sourceMappingURL=provision.d.ts.map

package/dist/auth/policy/provision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../../../auth/policy/provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAIpE,MAAM,MAAM,iBAAiB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AACjD,MAAM,MAAM,mBAAmB,GAAG;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,CAAA;AACxD,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG,mBAAmB,CAAA;AAElE,MAAM,MAAM,eAAe,GAAG;IAC5B,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAA;IACd,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACrC,CAAA;AAID,eAAO,MAAM,kBAAkB;;;;mBAG7B,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;;;iBAGhC,CAAA"}

package/dist/auth/policy/provision.js

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+import { jsonValueSchema } from '#auth/claims/types';
+// ─── Schemas ────────────────────────────────────────────────
+export const paramMappingSchema = z.union([
+    z.object({ claim: z.string() }),
+    z.object({ literal: jsonValueSchema }),
+]);
+export const provisionMethodSchema = z.object({
+    method: z.string(),
+    params: z.record(z.string(), paramMappingSchema),
+});
+//# sourceMappingURL=provision.js.map

package/dist/auth/policy/provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../../auth/policy/provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,eAAe,EAAkB,MAAM,oBAAoB,CAAA;AAepE,+DAA+D;AAE/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;CACvC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC;CACjD,CAAC,CAAA"}

package/dist/auth/policy/provisioning.d.ts

@@ -0,0 +1,210 @@
+import { z } from 'zod';
+import type { IssuerId } from '#auth/issuers/ids';
+import { type RequiredClaims } from '#auth/claims/types';
+import type { CompositionEntry } from './identity';
+import type { ProvisionMethod } from './provision';
+import type { PolicyDecision, PolicyRuleBase, StringPatternSet } from './types';
+export type ProvisioningRule = PolicyRuleBase & {
+    issuer?: StringPatternSet;
+    subject?: StringPatternSet;
+    /**
+     * Claim constraints checked at provisioning time AND stamped on the identity.
+     * Gates provisioning (deny if any constraint fails) and ensures every future
+     * auth re-checks these constraints.
+     */
+    requiredClaims?: RequiredClaims;
+    provision?: ProvisionMethod;
+    identity?: CompositionEntry[];
+};
+export type ProvisioningPolicy = {
+    defaultDecision?: PolicyDecision;
+    rules?: ProvisioningRule[];
+};
+export type ProvisioningInput = {
+    issuer: IssuerId;
+    subject: string;
+    claims: Record<string, unknown>;
+};
+export type ProvisioningDecision = {
+    allow: boolean;
+    requiredClaims?: RequiredClaims;
+    provision?: ProvisionMethod;
+    identity?: CompositionEntry[];
+    reason?: string;
+    matchedRuleId?: string;
+};
+export declare const provisioningRuleSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    effect: z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>;
+    issuer: z.ZodOptional<z.ZodObject<{
+        equals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        prefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        suffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        contains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        globs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    subject: z.ZodOptional<z.ZodObject<{
+        equals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        prefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        suffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        contains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        globs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    requiredClaims: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"eq">;
+        value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"contains">;
+        value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"exists">;
+    }, z.core.$strip>], "op">>>;
+    provision: z.ZodOptional<z.ZodObject<{
+        method: z.ZodString;
+        params: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+            claim: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            literal: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+        }, z.core.$strip>]>>;
+    }, z.core.$strip>>;
+    identity: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        extendWith: z.ZodString;
+        when: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"eq">;
+            value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+        }, z.core.$strip>, z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"contains">;
+            value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+        }, z.core.$strip>, z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"exists">;
+        }, z.core.$strip>], "op">>;
+    }, z.core.$strip>, z.ZodObject<{
+        constrainedBy: z.ZodString;
+        when: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"eq">;
+            value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+        }, z.core.$strip>, z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"contains">;
+            value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+        }, z.core.$strip>, z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"exists">;
+        }, z.core.$strip>], "op">>;
+    }, z.core.$strip>, z.ZodObject<{
+        excludedFrom: z.ZodString;
+        when: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"eq">;
+            value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+        }, z.core.$strip>, z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"contains">;
+            value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+        }, z.core.$strip>, z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"exists">;
+        }, z.core.$strip>], "op">>;
+    }, z.core.$strip>]>>>;
+}, z.core.$strip>;
+export declare const provisioningPolicySchema: z.ZodObject<{
+    defaultDecision: z.ZodOptional<z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>>;
+    rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        effect: z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>;
+        issuer: z.ZodOptional<z.ZodObject<{
+            equals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            prefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            suffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            contains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            globs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        subject: z.ZodOptional<z.ZodObject<{
+            equals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            prefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            suffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            contains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            globs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        requiredClaims: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"eq">;
+            value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+        }, z.core.$strip>, z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"contains">;
+            value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+        }, z.core.$strip>, z.ZodObject<{
+            claim: z.ZodString;
+            op: z.ZodLiteral<"exists">;
+        }, z.core.$strip>], "op">>>;
+        provision: z.ZodOptional<z.ZodObject<{
+            method: z.ZodString;
+            params: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+                claim: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                literal: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+            }, z.core.$strip>]>>;
+        }, z.core.$strip>>;
+        identity: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            extendWith: z.ZodString;
+            when: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                claim: z.ZodString;
+                op: z.ZodLiteral<"eq">;
+                value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+            }, z.core.$strip>, z.ZodObject<{
+                claim: z.ZodString;
+                op: z.ZodLiteral<"contains">;
+                value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+            }, z.core.$strip>, z.ZodObject<{
+                claim: z.ZodString;
+                op: z.ZodLiteral<"exists">;
+            }, z.core.$strip>], "op">>;
+        }, z.core.$strip>, z.ZodObject<{
+            constrainedBy: z.ZodString;
+            when: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                claim: z.ZodString;
+                op: z.ZodLiteral<"eq">;
+                value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+            }, z.core.$strip>, z.ZodObject<{
+                claim: z.ZodString;
+                op: z.ZodLiteral<"contains">;
+                value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+            }, z.core.$strip>, z.ZodObject<{
+                claim: z.ZodString;
+                op: z.ZodLiteral<"exists">;
+            }, z.core.$strip>], "op">>;
+        }, z.core.$strip>, z.ZodObject<{
+            excludedFrom: z.ZodString;
+            when: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                claim: z.ZodString;
+                op: z.ZodLiteral<"eq">;
+                value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+            }, z.core.$strip>, z.ZodObject<{
+                claim: z.ZodString;
+                op: z.ZodLiteral<"contains">;
+                value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+            }, z.core.$strip>, z.ZodObject<{
+                claim: z.ZodString;
+                op: z.ZodLiteral<"exists">;
+            }, z.core.$strip>], "op">>;
+        }, z.core.$strip>]>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+//# sourceMappingURL=provisioning.d.ts.map

package/dist/auth/policy/provisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.d.ts","sourceRoot":"","sources":["../../../auth/policy/provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAE/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAQ/E,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG;IAC9C,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC9B,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,eAAe,CAAC,EAAE,cAAc,CAAA;IAChC,KAAK,CAAC,EAAE,gBAAgB,EAAE,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,QAAQ,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,OAAO,CAAA;IACd,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB,CAAA;AAID,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQjC,CAAA;AAEF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGnC,CAAA"}

package/dist/auth/policy/provisioning.js

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+import { claimConstraintSchema } from '#auth/claims/types';
+import { compositionEntrySchema } from './identity';
+import { provisionMethodSchema } from './provision';
+import { policyDecisionSchema, stringPatternSetSchema } from './types';
+// ─── Schemas ────────────────────────────────────────────────
+export const provisioningRuleSchema = z.object({
+    id: z.string().optional(),
+    effect: policyDecisionSchema,
+    issuer: stringPatternSetSchema.optional(),
+    subject: stringPatternSetSchema.optional(),
+    requiredClaims: z.array(claimConstraintSchema).optional(),
+    provision: provisionMethodSchema.optional(),
+    identity: z.array(compositionEntrySchema).optional(),
+});
+export const provisioningPolicySchema = z.object({
+    defaultDecision: policyDecisionSchema.optional(),
+    rules: z.array(provisioningRuleSchema).optional(),
+});
+//# sourceMappingURL=provisioning.js.map

package/dist/auth/policy/provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning.js","sourceRoot":"","sources":["../../../auth/policy/provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,qBAAqB,EAAuB,MAAM,oBAAoB,CAAA;AAM/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA;AAqCtE,+DAA+D;AAE/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACzC,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC1C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC3C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAA"}

package/dist/auth/policy/trust.types.d.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod';
+import type { AuthenticationMethod } from '#auth/methods/registry';
+import type { PolicyDecision, PolicyRuleBase, StringPatternSet } from './types';
+export type TrustDecision = PolicyDecision;
+export type TrustRuleBase = PolicyRuleBase;
+export type TrustRule = TrustRuleBase & {
+    issuer?: StringPatternSet;
+    method?: AuthenticationMethod[];
+    kid?: StringPatternSet;
+    jwksUri?: string;
+};
+export type TrustPolicy = {
+    default?: TrustDecision;
+    rules?: TrustRule[];
+};
+export type TrustInput = {
+    issuer: string;
+    method: AuthenticationMethod;
+    kid?: string;
+};
+export declare const trustRuleSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    effect: z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>;
+    issuer: z.ZodOptional<z.ZodObject<{
+        equals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        prefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        suffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        contains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        globs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    method: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        jwt: "jwt";
+    }>>>;
+    kid: z.ZodOptional<z.ZodObject<{
+        equals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        prefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        suffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        contains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        globs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    jwksUri: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const trustPolicySchema: z.ZodObject<{
+    default: z.ZodOptional<z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>>;
+    rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        effect: z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>;
+        issuer: z.ZodOptional<z.ZodObject<{
+            equals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            prefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            suffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            contains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            globs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        method: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            jwt: "jwt";
+        }>>>;
+        kid: z.ZodOptional<z.ZodObject<{
+            equals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            prefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            suffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            contains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            globs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        jwksUri: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+//# sourceMappingURL=trust.types.d.ts.map

package/dist/auth/policy/trust.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.types.d.ts","sourceRoot":"","sources":["../../../auth/policy/trust.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAElE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAM/E,MAAM,MAAM,aAAa,GAAG,cAAc,CAAA;AAC1C,MAAM,MAAM,aAAa,GAAG,cAAc,CAAA;AAE1C,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG;IACtC,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAC/B,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,oBAAoB,CAAA;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAID,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;iBAO1B,CAAA;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG5B,CAAA"}

package/dist/auth/policy/trust.types.js

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+import { policyDecisionSchema, stringPatternSetSchema } from './types';
+// ─── Schemas ────────────────────────────────────────────────
+export const trustRuleSchema = z.object({
+    id: z.string().optional(),
+    effect: policyDecisionSchema,
+    issuer: stringPatternSetSchema.optional(),
+    method: z.array(z.enum(['jwt'])).optional(),
+    kid: stringPatternSetSchema.optional(),
+    jwksUri: z.string().url().optional(),
+});
+export const trustPolicySchema = z.object({
+    default: policyDecisionSchema.optional(),
+    rules: z.array(trustRuleSchema).optional(),
+});
+//# sourceMappingURL=trust.types.js.map

package/dist/auth/policy/trust.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.types.js","sourceRoot":"","sources":["../../../auth/policy/trust.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAA;AAyBtE,+DAA+D;AAE/D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAA"}

package/dist/auth/policy/types.d.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+export type PolicyDecision = 'allow' | 'deny';
+export type StringPatternSet = {
+    equals?: string[];
+    prefixes?: string[];
+    suffixes?: string[];
+    contains?: string[];
+    globs?: string[];
+};
+export type PolicyRuleBase = {
+    id?: string;
+    effect: PolicyDecision;
+};
+export declare const policyDecisionSchema: z.ZodEnum<{
+    allow: "allow";
+    deny: "deny";
+}>;
+export declare const stringPatternSetSchema: z.ZodObject<{
+    equals: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    prefixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    suffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    contains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    globs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const policyRuleBaseSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    effect: z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+    }>;
+}, z.core.$strip>;
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/policy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../auth/policy/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,CAAA;AAE7C,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,cAAc,CAAA;CACvB,CAAA;AAID,eAAO,MAAM,oBAAoB;;;EAA4B,CAAA;AAE7D,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAA;AAEF,eAAO,MAAM,oBAAoB;;;;;;iBAG/B,CAAA"}

package/dist/auth/policy/types.js

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+// ─── Schemas ────────────────────────────────────────────────
+export const policyDecisionSchema = z.enum(['allow', 'deny']);
+export const stringPatternSetSchema = z.object({
+    equals: z.array(z.string()).optional(),
+    prefixes: z.array(z.string()).optional(),
+    suffixes: z.array(z.string()).optional(),
+    contains: z.array(z.string()).optional(),
+    globs: z.array(z.string()).optional(),
+});
+export const policyRuleBaseSchema = z.object({
+    id: z.string().optional(),
+    effect: policyDecisionSchema,
+});
+//# sourceMappingURL=types.js.map

package/dist/auth/policy/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../auth/policy/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAmBvB,+DAA+D;AAE/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,oBAAoB;CAC7B,CAAC,CAAA"}

package/dist/dns-label.d.ts

@@ -0,0 +1,26 @@
+import { z } from 'zod';
+/**
+ * Canonical RFC 1035 §2.3.4 DNS label: lowercase alphanumeric + hyphen, no
+ * leading/trailing hyphen, 1–63 characters.
+ *
+ * This is the single source of truth for any identifier that becomes a hostname
+ * label — instance slugs (`{slug}.{region}.astrale.ai`), service slugs, and
+ * regions. The router lowercases the host and looks instances up by this label
+ * verbatim, so an id that is not a valid DNS label is unreachable.
+ *
+ * Distinct from the permissive EDGE slug (`graph/nav/ast/slug.ts`), which allows
+ * uppercase and `._` for internal path slugs that never reach DNS — do not
+ * confuse the two.
+ */
+export declare const DNS_LABEL_RE: RegExp;
+/** Non-throwing predicate: is `value` a valid DNS label? */
+export declare function isDnsLabel(value: string): boolean;
+/** Throw a clear error if `value` is not a valid DNS label. */
+export declare function assertDnsLabel(value: string, name: string): void;
+/**
+ * Zod field validator for a DNS label — use it as the contract type for an
+ * instance id / public slug so non-DNS-safe values are rejected at parse time
+ * (the `.max(63)`/`.min(1)` give clear length errors before the regex check).
+ */
+export declare const dnsLabelSchema: z.ZodString;
+//# sourceMappingURL=dns-label.d.ts.map

package/dist/dns-label.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-label.d.ts","sourceRoot":"","sources":["../dns-label.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,QAA2C,CAAA;AAEpE,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAKhE;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,aAOxB,CAAA"}

package/dist/dns-label.js

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+/**
+ * Canonical RFC 1035 §2.3.4 DNS label: lowercase alphanumeric + hyphen, no
+ * leading/trailing hyphen, 1–63 characters.
+ *
+ * This is the single source of truth for any identifier that becomes a hostname
+ * label — instance slugs (`{slug}.{region}.astrale.ai`), service slugs, and
+ * regions. The router lowercases the host and looks instances up by this label
+ * verbatim, so an id that is not a valid DNS label is unreachable.
+ *
+ * Distinct from the permissive EDGE slug (`graph/nav/ast/slug.ts`), which allows
+ * uppercase and `._` for internal path slugs that never reach DNS — do not
+ * confuse the two.
+ */
+export const DNS_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/** Non-throwing predicate: is `value` a valid DNS label? */
+export function isDnsLabel(value) {
+    return DNS_LABEL_RE.test(value);
+}
+/** Throw a clear error if `value` is not a valid DNS label. */
+export function assertDnsLabel(value, name) {
+    if (isDnsLabel(value))
+        return;
+    throw new Error(`${name} must be a lowercase DNS label [a-z0-9-], 1–63 chars, no leading/trailing hyphen — got: ${value}`);
+}
+/**
+ * Zod field validator for a DNS label — use it as the contract type for an
+ * instance id / public slug so non-DNS-safe values are rejected at parse time
+ * (the `.max(63)`/`.min(1)` give clear length errors before the regex check).
+ */
+export const dnsLabelSchema = z
+    .string()
+    .min(1)
+    .max(63)
+    .regex(DNS_LABEL_RE, 'must be a lowercase DNS label [a-z0-9-], ≤63 chars, no leading/trailing hyphen');
+//# sourceMappingURL=dns-label.js.map

package/dist/dns-label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-label.js","sourceRoot":"","sources":["../dns-label.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,wCAAwC,CAAA;AAEpE,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;IACxD,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,OAAM;IAC7B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,2FAA2F,KAAK,EAAE,CAC1G,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CACJ,YAAY,EACZ,gFAAgF,CACjF,CAAA"}