@astrale-os/kernel-core 0.4.1

package/dist/auth/grants/types.d.ts

@@ -0,0 +1,27 @@
+import type { IdentityExpr, UnresolvedIdentityExpr } from '#auth/expression/types';
+import type { IdentityId } from '#ids';
+/**
+ * Grant for access check.
+ *
+ * Single identity expression checked against the resource node with the
+ * requested permission. No two-phase type/resource split.
+ *
+ * Scopes are expressed via 'scope' expression nodes wrapping subtrees.
+ * Principal is passed separately to checkAccess/explainAccess.
+ */
+export type Grant = {
+    expr: IdentityExpr;
+};
+/**
+ * Unresolved grant for credential 'grant' claim.
+ *
+ * Wire format for the `.grant` claim on credentials. `expr` is required —
+ * a bare-self credential must explicitly carry `{ kind: 'identity', self: true }`
+ * rather than relying on an absent-expr default.
+ */
+export type UnresolvedGrant = {
+    v: 1;
+    expr: UnresolvedIdentityExpr;
+};
+export declare function selfGrant(principal: IdentityId): Grant;
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/grants/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../auth/grants/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAClF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAItC;;;;;;;;GAQG;AACH,MAAM,MAAM,KAAK,GAAG;IAClB,IAAI,EAAE,YAAY,CAAA;CACnB,CAAA;AAID;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,CAAC,EAAE,CAAC,CAAA;IACJ,IAAI,EAAE,sBAAsB,CAAA;CAC7B,CAAA;AAID,wBAAgB,SAAS,CAAC,SAAS,EAAE,UAAU,GAAG,KAAK,CAEtD"}

package/dist/auth/grants/types.js

@@ -0,0 +1,5 @@
+// ─── Factory ────────────────────────────────────────────────────────────────
+export function selfGrant(principal) {
+    return { expr: { kind: 'identity', id: principal } };
+}
+//# sourceMappingURL=types.js.map

package/dist/auth/grants/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../auth/grants/types.ts"],"names":[],"mappings":"AAgCA,+EAA+E;AAE/E,MAAM,UAAU,SAAS,CAAC,SAAqB;IAC7C,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAA;AACtD,CAAC"}

package/dist/auth/identity/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types';
+export * from './verify';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,UAAU,CAAA"}

package/dist/auth/identity/index.js

@@ -0,0 +1,3 @@
+export * from './types';
+export * from './verify';
+//# sourceMappingURL=index.js.map

package/dist/auth/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,UAAU,CAAA"}

package/dist/auth/identity/types.d.ts

@@ -0,0 +1,51 @@
+import z from 'zod';
+import type { IdentityId } from '#ids';
+/**
+ * Zod schema for the properties of an Identity node.
+ *
+ * Single source of truth for the prop shape — consumed by:
+ *   - the kernel `Identity` node interface (schema/interfaces/Identity.interface.ts)
+ *     to define its props (via `.shape`),
+ *   - the authentication layer (this package) to describe the `Identity`
+ *     value object returned by IdentityStore.
+ *
+ * Lives in auth/ rather than schema/ so the auth subdomain is the owner of
+ * its own types. Schema imports from auth, not the other way around.
+ */
+export declare const identityPropsSchema: z.ZodObject<{
+    iss: z.ZodString;
+    sub: z.ZodString;
+    frozen: z.ZodOptional<z.ZodBoolean>;
+    publicKey: z.ZodOptional<z.ZodObject<{
+        jwk: z.ZodOptional<z.ZodCustom<import("jose").JWK, import("jose").JWK>>;
+        jwksUri: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strip>>;
+    requiredClaims: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"eq">;
+        value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"contains">;
+        value: z.ZodType<import("#auth/claims/types").JsonValue, unknown, z.core.$ZodTypeInternals<import("#auth/claims/types").JsonValue, unknown>>;
+    }, z.core.$strip>, z.ZodObject<{
+        claim: z.ZodString;
+        op: z.ZodLiteral<"exists">;
+    }, z.core.$strip>], "op">>>;
+}, z.core.$strip>;
+export type IdentityProps = z.infer<typeof identityPropsSchema>;
+/**
+ * Identity value object used by the authentication layer.
+ *
+ * Not a full graph node — just an id plus the bag of identity-specific
+ * properties matching the kernel `Identity` interface's props schema
+ * (iss, sub, frozen?, publicKey?, requiredClaims?).
+ *
+ * Produced by IdentityStore.findIdentity / provisionIdentity and
+ * consumed by the Authenticator to verify claims / frozen state.
+ */
+export interface Identity {
+    readonly id: IdentityId;
+    readonly props: Readonly<IdentityProps>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/identity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../auth/identity/types.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAKtC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;iBAM9B,CAAA;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAA;CACxC"}

package/dist/auth/identity/types.js

@@ -0,0 +1,23 @@
+import z from 'zod';
+import { requiredClaimsSchema } from '#auth/claims/types';
+import { publicKeySchema } from '#auth/jwks/types';
+/**
+ * Zod schema for the properties of an Identity node.
+ *
+ * Single source of truth for the prop shape — consumed by:
+ *   - the kernel `Identity` node interface (schema/interfaces/Identity.interface.ts)
+ *     to define its props (via `.shape`),
+ *   - the authentication layer (this package) to describe the `Identity`
+ *     value object returned by IdentityStore.
+ *
+ * Lives in auth/ rather than schema/ so the auth subdomain is the owner of
+ * its own types. Schema imports from auth, not the other way around.
+ */
+export const identityPropsSchema = z.object({
+    iss: z.string(),
+    sub: z.string(),
+    frozen: z.boolean().optional(),
+    publicKey: publicKeySchema.optional(),
+    requiredClaims: requiredClaimsSchema.optional(),
+});
+//# sourceMappingURL=types.js.map

package/dist/auth/identity/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../auth/identity/types.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAInB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAElD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,eAAe,CAAC,QAAQ,EAAE;IACrC,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAA"}

package/dist/auth/identity/verify.d.ts

@@ -0,0 +1,3 @@
+import type { Identity } from './types';
+export declare function verifyIdentity(identity: Identity, claims: Record<string, unknown>): void;
+//# sourceMappingURL=verify.d.ts.map

package/dist/auth/identity/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../auth/identity/verify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAEvC,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMxF"}

package/dist/auth/identity/verify.js

@@ -0,0 +1,10 @@
+import { verifyRequiredClaims } from '#auth/claims';
+import { verifyFrozen } from '#auth/frozen';
+export function verifyIdentity(identity, claims) {
+    const requiredClaims = identity.props.requiredClaims;
+    if (requiredClaims?.length) {
+        verifyRequiredClaims(requiredClaims, claims);
+    }
+    verifyFrozen(identity);
+}
+//# sourceMappingURL=verify.js.map

package/dist/auth/identity/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../auth/identity/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAI3C,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,MAA+B;IAChF,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAA;IACpD,IAAI,cAAc,EAAE,MAAM,EAAE,CAAC;QAC3B,oBAAoB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAC9C,CAAC;IACD,YAAY,CAAC,QAAQ,CAAC,CAAA;AACxB,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,15 @@
+export * from './expression/types';
+export * from './grants';
+export * from './claims';
+export * from './identity';
+export * from './context';
+export * from './issuers';
+export * from './credentials';
+export * from './methods';
+export * from './audience';
+export * from './frozen';
+export * from './jwks';
+export * from './delegation';
+export * from './attestation';
+export * from './policy';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,QAAQ,CAAA;AACtB,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,15 @@
+export * from './expression/types';
+export * from './grants';
+export * from './claims';
+export * from './identity';
+export * from './context';
+export * from './issuers';
+export * from './credentials';
+export * from './methods';
+export * from './audience';
+export * from './frozen';
+export * from './jwks';
+export * from './delegation';
+export * from './attestation';
+export * from './policy';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,cAAc,UAAU,CAAA;AACxB,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,WAAW,CAAA;AACzB,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,QAAQ,CAAA;AACtB,cAAc,cAAc,CAAA;AAC5B,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA"}

package/dist/auth/issuers/ids.d.ts

@@ -0,0 +1,15 @@
+type AuthDomainBrand = {
+    readonly __authDomain: true;
+};
+type IssuerIdBrand = {
+    readonly __issuerId: true;
+};
+export type AuthDomain = string & AuthDomainBrand;
+export type IssuerId = string & IssuerIdBrand;
+export declare function isAuthDomain(value: string): value is AuthDomain;
+export declare function toAuthDomain(value: string): AuthDomain;
+export declare function normalizeIssuerId(value: string): string;
+export declare function isIssuerId(value: string): value is IssuerId;
+export declare function toIssuerId(value: string): IssuerId;
+export {};
+//# sourceMappingURL=ids.d.ts.map

package/dist/auth/issuers/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../../auth/issuers/ids.ts"],"names":[],"mappings":"AAEA,KAAK,eAAe,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAA;CAAE,CAAA;AACtD,KAAK,aAAa,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAA;AAClD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,eAAe,CAAA;AACjD,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAA;AA8E7C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAE/D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAMtD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASvD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,QAAQ,CAO3D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAElD"}

package/dist/auth/issuers/ids.js

@@ -0,0 +1,98 @@
+// ─── Branded types ──────────────────────────────────────────────────────────
+// ─── Validation ─────────────────────────────────────────────────────────────
+const AUTH_DOMAIN_RE = /^(?=.{1,253}$)(?:(?!-)[a-z0-9-]{1,63}(?<!-)\.)+(?:(?!-)[a-z0-9-]{2,63}(?<!-))$/i;
+const ABSOLUTE_URI_RE = /^([a-z][a-z0-9+.-]*):(.*)$/i;
+// Default ports per RFC 3986 §3.2.3 — http=80, https=443. When the URI uses
+// the scheme's default port, strip it so equivalent forms canonicalize equal.
+const DEFAULT_PORTS = { http: '80', https: '443' };
+function normalizeAuthorityHost(authority, scheme) {
+    const at = authority.lastIndexOf('@');
+    const userInfo = at >= 0 ? authority.slice(0, at + 1) : '';
+    const hostPort = at >= 0 ? authority.slice(at + 1) : authority;
+    let host;
+    let port;
+    if (hostPort.startsWith('[')) {
+        const end = hostPort.indexOf(']');
+        if (end < 0)
+            throw new Error(`Invalid issuer URL authority: "${authority}"`);
+        host = hostPort.slice(0, end + 1).toLowerCase();
+        port = hostPort.slice(end + 1);
+    }
+    else {
+        const lastColon = hostPort.lastIndexOf(':');
+        const firstColon = hostPort.indexOf(':');
+        if (lastColon !== firstColon) {
+            // Multi-colon outside brackets violates RFC 3986 §3.2.2 — IPv6 literals
+            // must be bracketed. Reject rather than collapse the whole string into
+            // the host slot, which would let two malformed variants normalize to the
+            // same trust-store key and silently overwrite each other.
+            throw new Error(`Invalid issuer URL authority: "${authority}" (bracket IPv6 hosts as [::1]:port)`);
+        }
+        const hasPortColon = lastColon >= 0;
+        host = (hasPortColon ? hostPort.slice(0, lastColon) : hostPort).toLowerCase();
+        port = hasPortColon ? hostPort.slice(lastColon) : '';
+    }
+    if (!host)
+        throw new Error(`Invalid issuer URL authority: "${authority}"`);
+    if (port.startsWith(':') && DEFAULT_PORTS[scheme] === port.slice(1)) {
+        port = '';
+    }
+    return `${userInfo}${host}${port}`;
+}
+function normalizeAbsoluteIssuerUri(value) {
+    const match = ABSOLUTE_URI_RE.exec(value);
+    if (!match)
+        throw new Error(`Invalid issuer URI: "${value}"`);
+    const [, rawScheme, tail] = match;
+    const scheme = rawScheme.toLowerCase();
+    if (!tail) {
+        throw new Error(`Invalid issuer URI: "${value}"`);
+    }
+    if (!tail.startsWith('//')) {
+        return `${scheme}:${tail}`;
+    }
+    const withoutPrefix = tail.slice(2);
+    const separator = withoutPrefix.search(/[/?#]/);
+    const authority = separator >= 0 ? withoutPrefix.slice(0, separator) : withoutPrefix;
+    let rest = separator >= 0 ? withoutPrefix.slice(separator) : '';
+    if (!authority) {
+        throw new Error(`Issuer URI must include authority: "${value}"`);
+    }
+    // Strip a lone trailing slash (empty path canonicalizes to no path).
+    if (rest === '/')
+        rest = '';
+    return `${scheme}://${normalizeAuthorityHost(authority, scheme)}${rest}`;
+}
+export function isAuthDomain(value) {
+    return AUTH_DOMAIN_RE.test(value);
+}
+export function toAuthDomain(value) {
+    const normalized = value.trim().toLowerCase();
+    if (!isAuthDomain(normalized)) {
+        throw new Error(`Invalid auth domain: "${value}"`);
+    }
+    return normalized;
+}
+export function normalizeIssuerId(value) {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new Error('Issuer cannot be empty');
+    }
+    if (isAuthDomain(normalized)) {
+        return normalized.toLowerCase();
+    }
+    return normalizeAbsoluteIssuerUri(normalized);
+}
+export function isIssuerId(value) {
+    try {
+        normalizeIssuerId(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function toIssuerId(value) {
+    return normalizeIssuerId(value);
+}
+//# sourceMappingURL=ids.js.map

package/dist/auth/issuers/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../../auth/issuers/ids.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAO/E,+EAA+E;AAE/E,MAAM,cAAc,GAClB,iFAAiF,CAAA;AACnF,MAAM,eAAe,GAAG,6BAA6B,CAAA;AAErD,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,aAAa,GAA2B,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AAE1E,SAAS,sBAAsB,CAAC,SAAiB,EAAE,MAAc;IAC/D,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,MAAM,QAAQ,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAE9D,IAAI,IAAY,CAAA;IAChB,IAAI,IAAY,CAAA;IAChB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,GAAG,CAAC,CAAA;QAC5E,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC/C,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACxC,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,wEAAwE;YACxE,uEAAuE;YACvE,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,IAAI,KAAK,CACb,kCAAkC,SAAS,sCAAsC,CAClF,CAAA;QACH,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,IAAI,CAAC,CAAA;QACnC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAA;QAC7E,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACtD,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,SAAS,GAAG,CAAC,CAAA;IAE1E,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,GAAG,EAAE,CAAA;IACX,CAAC;IACD,OAAO,GAAG,QAAQ,GAAG,IAAI,GAAG,IAAI,EAAE,CAAA;AACpC,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,GAAG,CAAC,CAAA;IAE7D,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,KAAK,CAAA;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAA;IACtC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,GAAG,MAAM,IAAI,IAAI,EAAE,CAAA;IAC5B,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAA;IACpF,IAAI,IAAI,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAE/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,GAAG,CAAC,CAAA;IAClE,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,KAAK,GAAG;QAAE,IAAI,GAAG,EAAE,CAAA;IAE3B,OAAO,GAAG,MAAM,MAAM,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC7C,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,GAAG,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,UAAwB,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC/B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,WAAW,EAAE,CAAA;IACjC,CAAC;IACD,OAAO,0BAA0B,CAAC,UAAU,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACxB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,iBAAiB,CAAC,KAAK,CAAa,CAAA;AAC7C,CAAC"}

package/dist/auth/issuers/index.d.ts

@@ -0,0 +1,2 @@
+export * from './ids';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/issuers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/issuers/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAA"}

package/dist/auth/issuers/index.js

@@ -0,0 +1,2 @@
+export * from './ids';
+//# sourceMappingURL=index.js.map

package/dist/auth/issuers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/issuers/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAA"}

package/dist/auth/jwks/index.d.ts

@@ -0,0 +1,3 @@
+export * from './thumbprint';
+export * from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/jwks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/jwks/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,SAAS,CAAA"}

package/dist/auth/jwks/index.js

@@ -0,0 +1,3 @@
+export * from './thumbprint';
+export * from './types';
+//# sourceMappingURL=index.js.map

package/dist/auth/jwks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/jwks/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,SAAS,CAAA"}

package/dist/auth/jwks/thumbprint.d.ts

@@ -0,0 +1,13 @@
+import { type JWK } from 'jose';
+/**
+ * Compute the RFC 7638 JWK Thumbprint of a public JWK.
+ *
+ * Returns the base64url-encoded SHA-256 digest over the canonical JSON
+ * representation of the key's required members. Two JWKs with identical
+ * key material produce identical thumbprints regardless of ordering or
+ * optional metadata (kid, alg, use, …).
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc7638
+ */
+export declare function computeJwkThumbprint(jwk: JWK): Promise<string>;
+//# sourceMappingURL=thumbprint.d.ts.map

package/dist/auth/jwks/thumbprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thumbprint.d.ts","sourceRoot":"","sources":["../../../auth/jwks/thumbprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAA;AAEvD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE"}

package/dist/auth/jwks/thumbprint.js

@@ -0,0 +1,15 @@
+import { calculateJwkThumbprint } from 'jose';
+/**
+ * Compute the RFC 7638 JWK Thumbprint of a public JWK.
+ *
+ * Returns the base64url-encoded SHA-256 digest over the canonical JSON
+ * representation of the key's required members. Two JWKs with identical
+ * key material produce identical thumbprints regardless of ordering or
+ * optional metadata (kid, alg, use, …).
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc7638
+ */
+export async function computeJwkThumbprint(jwk) {
+    return calculateJwkThumbprint(jwk, 'sha256');
+}
+//# sourceMappingURL=thumbprint.js.map

package/dist/auth/jwks/thumbprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thumbprint.js","sourceRoot":"","sources":["../../../auth/jwks/thumbprint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAY,MAAM,MAAM,CAAA;AAEvD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAQ;IACjD,OAAO,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;AAC9C,CAAC"}

package/dist/auth/jwks/types.d.ts

@@ -0,0 +1,15 @@
+import type { JWK } from 'jose';
+import { z } from 'zod';
+export declare const jwkSchema: z.ZodCustom<JWK, JWK>;
+export declare const publicKeySchema: z.ZodObject<{
+    jwk: z.ZodOptional<z.ZodCustom<JWK, JWK>>;
+    jwksUri: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip>;
+export type PublicKey = {
+    jwk: JWK;
+    jwksUri?: undefined;
+} | {
+    jwksUri: URL;
+    jwk?: undefined;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/jwks/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../auth/jwks/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAE/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,SAAS,uBAErB,CAAA;AAED,eAAO,MAAM,eAAe;;;iBAG1B,CAAA;AAEF,MAAM,MAAM,SAAS,GAAG;IAAE,GAAG,EAAE,GAAG,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,GAAG,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,CAAA"}

package/dist/auth/jwks/types.js

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+// ─── Public Key ─────────────────────────────────────────────────
+export const jwkSchema = z.custom((val) => typeof val === 'object' && val !== null && 'kty' in val && typeof val.kty === 'string');
+export const publicKeySchema = z.object({
+    jwk: jwkSchema.optional(),
+    jwksUri: z.url().optional(),
+});
+//# sourceMappingURL=types.js.map

package/dist/auth/jwks/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../auth/jwks/types.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,mEAAmE;AAEnE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAC/B,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAChG,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA"}

package/dist/auth/methods/classifier.d.ts

@@ -0,0 +1,9 @@
+import type { CredentialEnvelope } from '#auth/credentials/envelope';
+import type { AuthenticationMethod } from './registry';
+export type CredentialClassification = {
+    method: AuthenticationMethod;
+};
+export declare class CredentialClassifier {
+    classify(envelope: CredentialEnvelope): CredentialClassification | null;
+}
+//# sourceMappingURL=classifier.d.ts.map

package/dist/auth/methods/classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifier.d.ts","sourceRoot":"","sources":["../../../auth/methods/classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAEpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAItD,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,oBAAoB,CAAA;CAC7B,CAAA;AAED,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,wBAAwB,GAAG,IAAI,CAKtE;CACF"}

package/dist/auth/methods/classifier.js

@@ -0,0 +1,10 @@
+import { looksLikeJwt } from './jwt';
+export class CredentialClassifier {
+    classify(envelope) {
+        if (looksLikeJwt(envelope)) {
+            return { method: 'jwt' };
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=classifier.js.map

package/dist/auth/methods/classifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classifier.js","sourceRoot":"","sources":["../../../auth/methods/classifier.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAA;AAMpC,MAAM,OAAO,oBAAoB;IAC/B,QAAQ,CAAC,QAA4B;QACnC,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;QAC1B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}

package/dist/auth/methods/errors.d.ts

@@ -0,0 +1,34 @@
+import { AuthenticationError } from '#auth/credentials/errors';
+import type { AuthenticationMethod } from './registry';
+export declare class UnrecognizedCredentialError extends AuthenticationError {
+    constructor();
+}
+export declare class UnsupportedMethodError extends AuthenticationError {
+    constructor(method: AuthenticationMethod);
+}
+export declare class MalformedCredentialError extends AuthenticationError {
+    constructor(message: string, method?: string);
+}
+export declare class SignatureVerificationError extends AuthenticationError {
+    constructor(message: string, method?: string);
+}
+export declare class ExpiredCredentialError extends AuthenticationError {
+    constructor(expiredAt?: number, now?: number);
+}
+export declare class CredentialNotYetValidError extends AuthenticationError {
+    constructor(nbf?: number, now?: number);
+}
+export declare class AlgNotAllowedError extends AuthenticationError {
+    constructor(alg?: string);
+}
+export declare class SigningKeyNotFoundError extends AuthenticationError {
+    constructor(issuer?: string, kid?: string);
+}
+export declare class IssuerUnreachableError extends AuthenticationError {
+    constructor(issuer?: string);
+}
+export declare class CredentialVerificationError extends AuthenticationError {
+    readonly joseCode?: string;
+    constructor(joseCode?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/methods/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../auth/methods/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEtD,qBAAa,2BAA4B,SAAQ,mBAAmB;IAClE,cAGC;CACF;AAED,qBAAa,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,MAAM,EAAE,oBAAoB,EAGvC;CACF;AAED,qBAAa,wBAAyB,SAAQ,mBAAmB;IAC/D,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,0BAA2B,SAAQ,mBAAmB;IACjE,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAG3C;CACF;AAED,qBAAa,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAK3C;CACF;AAED,qBAAa,0BAA2B,SAAQ,mBAAmB;IACjE,YAAY,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAIrC;CACF;AAED,qBAAa,kBAAmB,SAAQ,mBAAmB;IACzD,YAAY,GAAG,CAAC,EAAE,MAAM,EAGvB;CACF;AAED,qBAAa,uBAAwB,SAAQ,mBAAmB;IAC9D,YAAY,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAQxC;CACF;AAED,qBAAa,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,MAAM,CAAC,EAAE,MAAM,EAO1B;CACF;AAED,qBAAa,2BAA4B,SAAQ,mBAAmB;IAClE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,YAAY,QAAQ,CAAC,EAAE,MAAM,EAI5B;CACF"}

package/dist/auth/methods/errors.js

@@ -0,0 +1,67 @@
+import { AuthenticationError } from '#auth/credentials/errors';
+export class UnrecognizedCredentialError extends AuthenticationError {
+    constructor() {
+        super('Unrecognized credential format', 'UNRECOGNIZED_CREDENTIAL');
+        this.name = 'UnrecognizedCredentialError';
+    }
+}
+export class UnsupportedMethodError extends AuthenticationError {
+    constructor(method) {
+        super(`Unsupported credential method: ${method}`, 'UNSUPPORTED_METHOD');
+        this.name = 'UnsupportedMethodError';
+    }
+}
+export class MalformedCredentialError extends AuthenticationError {
+    constructor(message, method) {
+        super(message, 'MALFORMED_CREDENTIAL', method);
+        this.name = 'MalformedCredentialError';
+    }
+}
+export class SignatureVerificationError extends AuthenticationError {
+    constructor(message, method) {
+        super(message, 'SIGNATURE_VERIFICATION_FAILED', method);
+        this.name = 'SignatureVerificationError';
+    }
+}
+export class ExpiredCredentialError extends AuthenticationError {
+    constructor(expiredAt, now) {
+        const detail = expiredAt !== undefined && now !== undefined ? ` at ${expiredAt} (now ${now})` : '';
+        super(`Credential expired${detail}.`, 'EXPIRED_CREDENTIAL', 'jwt');
+        this.name = 'ExpiredCredentialError';
+    }
+}
+export class CredentialNotYetValidError extends AuthenticationError {
+    constructor(nbf, now) {
+        const detail = nbf !== undefined && now !== undefined ? ` (nbf ${nbf} > now ${now})` : '';
+        super(`Credential not yet valid${detail}; check clock skew.`, 'CREDENTIAL_NOT_YET_VALID', 'jwt');
+        this.name = 'CredentialNotYetValidError';
+    }
+}
+export class AlgNotAllowedError extends AuthenticationError {
+    constructor(alg) {
+        super(`JWT algorithm '${alg ?? 'unknown'}' is not allowed.`, 'ALG_NOT_ALLOWED', 'jwt');
+        this.name = 'AlgNotAllowedError';
+    }
+}
+export class SigningKeyNotFoundError extends AuthenticationError {
+    constructor(issuer, kid) {
+        const kidPart = kid ? ` (kid '${kid}')` : '';
+        super(`No signing key found for issuer '${issuer ?? 'unknown'}'${kidPart}; the key may have rotated or was never published to this kernel.`, 'SIGNING_KEY_NOT_FOUND', 'jwt');
+        this.name = 'SigningKeyNotFoundError';
+    }
+}
+export class IssuerUnreachableError extends AuthenticationError {
+    constructor(issuer) {
+        super(`Could not fetch signing keys for issuer '${issuer ?? 'unknown'}'.`, 'ISSUER_UNREACHABLE', 'jwt');
+        this.name = 'IssuerUnreachableError';
+    }
+}
+export class CredentialVerificationError extends AuthenticationError {
+    joseCode;
+    constructor(joseCode) {
+        super('Credential verification failed.', 'CREDENTIAL_VERIFICATION_FAILED', 'jwt');
+        this.name = 'CredentialVerificationError';
+        this.joseCode = joseCode;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/auth/methods/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../auth/methods/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAI9D,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IAClE;QACE,KAAK,CAAC,gCAAgC,EAAE,yBAAyB,CAAC,CAAA;QAClE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,MAA4B;QACtC,KAAK,CAAC,kCAAkC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAA;QACvE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,mBAAmB;IAC/D,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,mBAAmB;IACjE,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,OAAO,EAAE,+BAA+B,EAAE,MAAM,CAAC,CAAA;QACvD,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,SAAkB,EAAE,GAAY;QAC1C,MAAM,MAAM,GACV,SAAS,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,SAAS,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACrF,KAAK,CAAC,qBAAqB,MAAM,GAAG,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAA;QAClE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,mBAAmB;IACjE,YAAY,GAAY,EAAE,GAAY;QACpC,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACzF,KAAK,CAAC,2BAA2B,MAAM,qBAAqB,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAA;QAChG,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAA;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,mBAAmB;IACzD,YAAY,GAAY;QACtB,KAAK,CAAC,kBAAkB,GAAG,IAAI,SAAS,mBAAmB,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAA;QACtF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAC9D,YAAY,MAAe,EAAE,GAAY;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5C,KAAK,CACH,oCAAoC,MAAM,IAAI,SAAS,IAAI,OAAO,mEAAmE,EACrI,uBAAuB,EACvB,KAAK,CACN,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,mBAAmB;IAC7D,YAAY,MAAe;QACzB,KAAK,CACH,4CAA4C,MAAM,IAAI,SAAS,IAAI,EACnE,oBAAoB,EACpB,KAAK,CACN,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,mBAAmB;IACzD,QAAQ,CAAS;IAC1B,YAAY,QAAiB;QAC3B,KAAK,CAAC,iCAAiC,EAAE,gCAAgC,EAAE,KAAK,CAAC,CAAA;QACjF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF"}

package/dist/auth/methods/factory.d.ts

@@ -0,0 +1,3 @@
+import type { AuthenticationMethod, CredentialMethod } from './registry';
+export declare function createCredentialMethod(kind: AuthenticationMethod): CredentialMethod;
+//# sourceMappingURL=factory.d.ts.map

package/dist/auth/methods/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../auth/methods/factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAKxE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CAOnF"}

package/dist/auth/methods/factory.js

@@ -0,0 +1,11 @@
+import { UnsupportedMethodError } from './errors';
+import { JwtMethod } from './jwt';
+export function createCredentialMethod(kind) {
+    switch (kind) {
+        case 'jwt':
+            return new JwtMethod();
+        default:
+            throw new UnsupportedMethodError(kind);
+    }
+}
+//# sourceMappingURL=factory.js.map

package/dist/auth/methods/factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../../../auth/methods/factory.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AAEjC,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK;YACR,OAAO,IAAI,SAAS,EAAE,CAAA;QACxB;YACE,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAA;IAC1C,CAAC;AACH,CAAC"}

package/dist/auth/methods/index.d.ts

@@ -0,0 +1,7 @@
+export * from './registry';
+export * from './errors';
+export * from './resolver';
+export * from './classifier';
+export * from './factory';
+export * from './jwt';
+//# sourceMappingURL=index.d.ts.map