@astrale-os/kernel-core 0.4.1

package/dist/auth/methods/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/methods/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,OAAO,CAAA"}

package/dist/auth/methods/index.js

@@ -0,0 +1,7 @@
+export * from './registry';
+export * from './errors';
+export * from './resolver';
+export * from './classifier';
+export * from './factory';
+export * from './jwt';
+//# sourceMappingURL=index.js.map

package/dist/auth/methods/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/methods/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,OAAO,CAAA"}

package/dist/auth/methods/jwt/index.d.ts

@@ -0,0 +1,2 @@
+export * from './jwt.method';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/methods/jwt/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../auth/methods/jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA"}

package/dist/auth/methods/jwt/index.js

@@ -0,0 +1,2 @@
+export * from './jwt.method';
+//# sourceMappingURL=index.js.map

package/dist/auth/methods/jwt/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../auth/methods/jwt/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA"}

package/dist/auth/methods/jwt/jwt.method.d.ts

@@ -0,0 +1,14 @@
+import { type JWK } from 'jose';
+import type { CredentialEnvelope } from '#auth/credentials/envelope';
+import type { DecodedCredentialClaims, VerifiedCredential } from '#auth/credentials/types';
+import type { PublicKey } from '#auth/jwks';
+import type { CredentialMethod, ResolveTrustedKeys } from '#auth/methods/registry';
+export declare function deriveAllowedAlgorithms(jwk: JWK): string[];
+export declare class JwtMethod implements CredentialMethod {
+    readonly kind = "jwt";
+    verify(envelope: CredentialEnvelope, resolveTrustedKeys: ResolveTrustedKeys): Promise<VerifiedCredential>;
+    verifyWithKey(envelope: CredentialEnvelope, publicKey: PublicKey): Promise<VerifiedCredential>;
+    decode(envelope: CredentialEnvelope): DecodedCredentialClaims;
+}
+export declare function looksLikeJwt(envelope: CredentialEnvelope): boolean;
+//# sourceMappingURL=jwt.method.d.ts.map

package/dist/auth/methods/jwt/jwt.method.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.method.d.ts","sourceRoot":"","sources":["../../../../auth/methods/jwt/jwt.method.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,GAAG,EAET,MAAM,MAAM,CAAA;AAEb,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE1F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AA6ClF,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,CAa1D;AAyHD,qBAAa,SAAU,YAAW,gBAAgB;IAChD,QAAQ,CAAC,IAAI,SAAQ;IAEf,MAAM,CACV,QAAQ,EAAE,kBAAkB,EAC5B,kBAAkB,EAAE,kBAAkB,GACrC,OAAO,CAAC,kBAAkB,CAAC,CA4B7B;IAEK,aAAa,CACjB,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAG7B;IAED,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,uBAAuB,CAO5D;CACF;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAWlE"}

package/dist/auth/methods/jwt/jwt.method.js

@@ -0,0 +1,195 @@
+import { createRemoteJWKSet, decodeJwt, decodeProtectedHeader, importJWK, jwtVerify, } from 'jose';
+import { toDecodedClaims } from '#auth/credentials/envelope';
+import { AlgNotAllowedError, CredentialNotYetValidError, CredentialVerificationError, ExpiredCredentialError, IssuerUnreachableError, MalformedCredentialError, SignatureVerificationError, SigningKeyNotFoundError, } from '#auth/methods/errors';
+const JWT_BASE64URL_SEGMENT = /^[A-Za-z0-9_-]+$/;
+const MAX_LIKELY_JWT_LENGTH = 16 * 1024;
+const EC_CURVE_ALGORITHMS = {
+    'P-256': ['ES256'],
+    'P-384': ['ES384'],
+    'P-521': ['ES512'],
+};
+const OKP_CURVE_ALGORITHMS = {
+    Ed25519: ['EdDSA'],
+    Ed448: ['EdDSA'],
+};
+const RSA_ALGORITHMS = ['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512'];
+/**
+ * Asymmetric-only algorithm allowlist for JWKS-resolved verification.
+ *
+ * Excludes `HS*` (symmetric, the canonical alg-confusion vector — an attacker
+ * signs a token with the issuer's public key as the HMAC secret) and `none`.
+ */
+const JWT_ASYMMETRIC_ALGORITHMS = [
+    ...RSA_ALGORITHMS,
+    'ES256',
+    'ES256K',
+    'ES384',
+    'ES512',
+    'EdDSA',
+];
+export function deriveAllowedAlgorithms(jwk) {
+    if (jwk.alg)
+        return [jwk.alg];
+    switch (jwk.kty) {
+        case 'EC':
+            return (jwk.crv ? EC_CURVE_ALGORITHMS[jwk.crv] : undefined) ?? [];
+        case 'RSA':
+            return RSA_ALGORITHMS;
+        case 'OKP':
+            return (jwk.crv ? OKP_CURVE_ALGORITHMS[jwk.crv] : undefined) ?? [];
+        default:
+            return [];
+    }
+}
+function toToken(envelope) {
+    const token = envelope.text.trim();
+    if (!token) {
+        throw new MalformedCredentialError('Empty credential', 'jwt');
+    }
+    return token;
+}
+function toVerifiedCredential(payload) {
+    if (typeof payload.iss !== 'string' || typeof payload.sub !== 'string') {
+        throw new MalformedCredentialError('JWT payload must include iss and sub', 'jwt');
+    }
+    return {
+        iss: payload.iss,
+        sub: payload.sub,
+        aud: payload.aud,
+        claims: payload,
+    };
+}
+function hasCompactJwtShape(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        return false;
+    }
+    return parts.every((part) => part.length > 0 && JWT_BASE64URL_SEGMENT.test(part));
+}
+function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+function classifyJoseError(error, ctx) {
+    // Our own pre-verify throws (shape / key-config) pass through unchanged.
+    if (error instanceof MalformedCredentialError || error instanceof SignatureVerificationError) {
+        throw error;
+    }
+    const code = error instanceof Error ? error.code : undefined;
+    const payload = error?.payload;
+    switch (code) {
+        case 'ERR_JWT_EXPIRED':
+            throw new ExpiredCredentialError(typeof payload?.exp === 'number' ? payload.exp : undefined, nowSeconds());
+        case 'ERR_JWT_CLAIM_VALIDATION_FAILED': {
+            // With our verify options jose only validates `exp` (→ JWTExpired) and
+            // `nbf` here; guard anyway so a surprise claim doesn't masquerade.
+            if (error.claim === 'nbf') {
+                throw new CredentialNotYetValidError(typeof payload?.nbf === 'number' ? payload.nbf : undefined, nowSeconds());
+            }
+            throw new CredentialVerificationError(typeof code === 'string' ? code : undefined);
+        }
+        case 'ERR_JWKS_NO_MATCHING_KEY':
+            throw new SigningKeyNotFoundError(ctx.iss, ctx.kid);
+        case 'ERR_JWKS_TIMEOUT':
+            throw new IssuerUnreachableError(ctx.iss);
+        case 'ERR_JOSE_ALG_NOT_ALLOWED':
+            throw new AlgNotAllowedError(ctx.alg);
+        case 'ERR_JWS_INVALID':
+        case 'ERR_JWT_INVALID':
+        case 'ERR_JOSE_NOT_SUPPORTED':
+            throw new MalformedCredentialError('Malformed credential.', 'jwt');
+        case 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED':
+            throw new SignatureVerificationError('Signature verification failed.', 'jwt');
+        default:
+            throw new CredentialVerificationError(typeof code === 'string' ? code : undefined);
+    }
+}
+async function verifyWithVerificationKey(token, key) {
+    const header = decodeProtectedHeader(token);
+    if (typeof header.alg !== 'string') {
+        throw new MalformedCredentialError('JWT header missing alg', 'jwt');
+    }
+    if (header.alg === 'none') {
+        throw new MalformedCredentialError('Unsecured JWTs (alg: none) are not accepted', 'jwt');
+    }
+    try {
+        if ('jwksUri' in key) {
+            if (!key.jwksUri) {
+                throw new MalformedCredentialError('Missing jwksUri', 'jwt');
+            }
+            const resolver = createRemoteJWKSet(key.jwksUri);
+            const result = await jwtVerify(token, resolver, {
+                algorithms: [...JWT_ASYMMETRIC_ALGORITHMS],
+            });
+            return toVerifiedCredential(result.payload);
+        }
+        if ('jwk' in key) {
+            const allowedAlgs = deriveAllowedAlgorithms(key.jwk);
+            if (allowedAlgs.length === 0) {
+                throw new SignatureVerificationError('Cannot determine allowed algorithms for key', 'jwt');
+            }
+            const importAlg = key.jwk.alg ?? (allowedAlgs.includes(header.alg) ? header.alg : allowedAlgs[0]);
+            const cryptoKey = await importJWK(key.jwk, importAlg);
+            const result = await jwtVerify(token, cryptoKey, { algorithms: allowedAlgs });
+            return toVerifiedCredential(result.payload);
+        }
+    }
+    catch (error) {
+        classifyJoseError(error, { alg: header.alg });
+    }
+    throw new SignatureVerificationError('Unsupported key format for JWT verification', 'jwt');
+}
+export class JwtMethod {
+    kind = 'jwt';
+    async verify(envelope, resolveTrustedKeys) {
+        const token = toToken(envelope);
+        let payload;
+        let kid;
+        let alg;
+        try {
+            payload = decodeJwt(token);
+            const header = decodeProtectedHeader(token);
+            kid = typeof header.kid === 'string' ? header.kid : undefined;
+            alg = typeof header.alg === 'string' ? header.alg : undefined;
+        }
+        catch {
+            throw new MalformedCredentialError('Malformed JWT credential', 'jwt');
+        }
+        if (typeof payload.iss !== 'string') {
+            throw new MalformedCredentialError('JWT payload missing iss', 'jwt');
+        }
+        const resolver = await resolveTrustedKeys(payload.iss, kid);
+        try {
+            const result = await jwtVerify(token, resolver, {
+                algorithms: [...JWT_ASYMMETRIC_ALGORITHMS],
+            });
+            return toVerifiedCredential(result.payload);
+        }
+        catch (error) {
+            classifyJoseError(error, { iss: payload.iss, kid, alg });
+        }
+    }
+    async verifyWithKey(envelope, publicKey) {
+        const token = toToken(envelope);
+        return verifyWithVerificationKey(token, publicKey);
+    }
+    decode(envelope) {
+        const token = toToken(envelope);
+        try {
+            return toDecodedClaims(decodeJwt(token));
+        }
+        catch {
+            throw new MalformedCredentialError('Malformed JWT credential', 'jwt');
+        }
+    }
+}
+export function looksLikeJwt(envelope) {
+    const token = envelope.text.trim();
+    if (!token || token.length > MAX_LIKELY_JWT_LENGTH) {
+        return false;
+    }
+    if (!hasCompactJwtShape(token)) {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=jwt.method.js.map

package/dist/auth/methods/jwt/jwt.method.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.method.js","sourceRoot":"","sources":["../../../../auth/methods/jwt/jwt.method.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,SAAS,GAGV,MAAM,MAAM,CAAA;AAQb,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,qBAAqB,GAAG,kBAAkB,CAAA;AAChD,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvC,MAAM,mBAAmB,GAA6B;IACpD,OAAO,EAAE,CAAC,OAAO,CAAC;IAClB,OAAO,EAAE,CAAC,OAAO,CAAC;IAClB,OAAO,EAAE,CAAC,OAAO,CAAC;CACnB,CAAA;AAED,MAAM,oBAAoB,GAA6B;IACrD,OAAO,EAAE,CAAC,OAAO,CAAC;IAClB,KAAK,EAAE,CAAC,OAAO,CAAC;CACjB,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AAE7E;;;;;GAKG;AACH,MAAM,yBAAyB,GAAsB;IACnD,GAAG,cAAc;IACjB,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAA;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAQ;IAC9C,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAE7B,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QACnE,KAAK,KAAK;YACR,OAAO,cAAc,CAAA;QACvB,KAAK,KAAK;YACR,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;QACpE;YACE,OAAO,EAAE,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,wBAAwB,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAmB;IAC/C,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,wBAAwB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAA;IACnF,CAAC;IAED,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAe;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAA6C;KACtD,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACnF,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;AACtC,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,GAAiD;IAEjD,yEAAyE;IACzE,IAAI,KAAK,YAAY,wBAAwB,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;QAC7F,MAAM,KAAK,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACpF,MAAM,OAAO,GAAI,KAA8C,EAAE,OAAO,CAAA;IACxE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB;YACpB,MAAM,IAAI,sBAAsB,CAC9B,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAC1D,UAAU,EAAE,CACb,CAAA;QACH,KAAK,iCAAiC,EAAE,CAAC;YACvC,uEAAuE;YACvE,mEAAmE;YACnE,IAAK,KAA6B,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACnD,MAAM,IAAI,0BAA0B,CAClC,OAAO,OAAO,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAC1D,UAAU,EAAE,CACb,CAAA;YACH,CAAC;YACD,MAAM,IAAI,2BAA2B,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;QACpF,CAAC;QACD,KAAK,0BAA0B;YAC7B,MAAM,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;QACrD,KAAK,kBAAkB;YACrB,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3C,KAAK,0BAA0B;YAC7B,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACvC,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB,CAAC;QACvB,KAAK,wBAAwB;YAC3B,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAA;QACpE,KAAK,uCAAuC;YAC1C,MAAM,IAAI,0BAA0B,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAA;QAC/E;YACE,MAAM,IAAI,2BAA2B,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACtF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,KAAa,EACb,GAAc;IAEd,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC3C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,wBAAwB,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,wBAAwB,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;IAC1F,CAAC;IAED,IAAI,CAAC;QACH,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,IAAI,wBAAwB,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAChD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;gBAC9C,UAAU,EAAE,CAAC,GAAG,yBAAyB,CAAC;aAC3C,CAAC,CAAA;YACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC7C,CAAC;QAED,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjB,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACpD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,0BAA0B,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;YAC5F,CAAC;YACD,MAAM,SAAS,GACb,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;YACjF,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YACrD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;YAC7E,OAAO,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iBAAiB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,MAAM,IAAI,0BAA0B,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;AAC5F,CAAC;AAED,MAAM,OAAO,SAAS;IACX,IAAI,GAAG,KAAK,CAAA;IAErB,KAAK,CAAC,MAAM,CACV,QAA4B,EAC5B,kBAAsC;QAEtC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/B,IAAI,OAAmB,CAAA;QACvB,IAAI,GAAuB,CAAA;QAC3B,IAAI,GAAuB,CAAA;QAE3B,IAAI,CAAC;YACH,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;YAC1B,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAC3C,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;YAC7D,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,wBAAwB,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;QACvE,CAAC;QAED,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,wBAAwB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAe,EAAE,GAAG,CAAC,CAAA;QACvE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;gBAC9C,UAAU,EAAE,CAAC,GAAG,yBAAyB,CAAC;aAC3C,CAAC,CAAA;YACF,OAAO,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,iBAAiB,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,QAA4B,EAC5B,SAAoB;QAEpB,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/B,OAAO,yBAAyB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IACpD,CAAC;IAED,MAAM,CAAC,QAA4B;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC/B,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,SAAS,CAAC,KAAK,CAAuC,CAAC,CAAA;QAChF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,wBAAwB,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,QAA4B;IACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QACnD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/auth/methods/registry.d.ts

@@ -0,0 +1,21 @@
+import type { CredentialEnvelope } from '#auth/credentials/envelope';
+import type { DecodedCredentialClaims, VerifiedCredential } from '#auth/credentials/types';
+import type { JWKSResolver } from '#auth/credentials/verify';
+import type { IssuerId } from '#auth/issuers';
+import type { PublicKey } from '#auth/jwks';
+export type ResolveTrustedKeys = (issuer: IssuerId, kid?: string) => Promise<JWKSResolver>;
+export declare const AUTH_METHODS: readonly ['jwt'];
+export type AuthenticationMethod = (typeof AUTH_METHODS)[number];
+export interface CredentialMethod {
+    readonly kind: AuthenticationMethod;
+    verify(envelope: CredentialEnvelope, resolveTrustedKeys: ResolveTrustedKeys): Promise<VerifiedCredential>;
+    verifyWithKey(envelope: CredentialEnvelope, publicKey: PublicKey): Promise<VerifiedCredential>;
+    decode(envelope: CredentialEnvelope): DecodedCredentialClaims;
+}
+export type MethodRegistryInput = CredentialMethod | AuthenticationMethod;
+export declare class MethodRegistry {
+    private readonly methodsByKind;
+    constructor(methods?: readonly MethodRegistryInput[]);
+    get(kind: AuthenticationMethod): CredentialMethod | undefined;
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/auth/methods/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../auth/methods/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AACpE,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC1F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAI3C,MAAM,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;AAE1F,eAAO,MAAM,YAAY,YAAI,KAAK,CAAU,CAAA;AAE5C,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,MAAM,CACJ,QAAQ,EAAE,kBAAkB,EAC5B,kBAAkB,EAAE,kBAAkB,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC9B,aAAa,CAAC,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC9F,MAAM,CAAC,QAAQ,EAAE,kBAAkB,GAAG,uBAAuB,CAAA;CAC9D;AAED,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,oBAAoB,CAAA;AAEzE,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoD;IAElF,YAAY,OAAO,GAAE,SAAS,mBAAmB,EAAiB,EAQjE;IAED,GAAG,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,GAAG,SAAS,CAE5D;CACF"}

package/dist/auth/methods/registry.js

@@ -0,0 +1,18 @@
+import { createCredentialMethod } from './factory';
+export const AUTH_METHODS = ['jwt'];
+export class MethodRegistry {
+    methodsByKind = new Map();
+    constructor(methods = AUTH_METHODS) {
+        for (const input of methods) {
+            const method = typeof input === 'string' ? createCredentialMethod(input) : input;
+            if (this.methodsByKind.has(method.kind)) {
+                throw new Error(`Duplicate authentication method kind: ${method.kind}`);
+            }
+            this.methodsByKind.set(method.kind, method);
+        }
+    }
+    get(kind) {
+        return this.methodsByKind.get(kind);
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/auth/methods/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../auth/methods/registry.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAIlD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAK,CAAU,CAAA;AAgB5C,MAAM,OAAO,cAAc;IACR,aAAa,GAAG,IAAI,GAAG,EAA0C,CAAA;IAElF,YAAY,OAAO,GAAmC,YAAY;QAChE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YAChF,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;YACzE,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAA0B;QAC5B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;CACF"}

package/dist/auth/methods/resolver.d.ts

@@ -0,0 +1,9 @@
+import type { CredentialEnvelope } from '#auth/credentials/envelope';
+import type { CredentialMethod, MethodRegistry } from './registry';
+export declare class CredentialMethodResolver {
+    private readonly registry;
+    private readonly classifier;
+    constructor(registry: MethodRegistry);
+    resolve(envelope: CredentialEnvelope): CredentialMethod;
+}
+//# sourceMappingURL=resolver.d.ts.map

package/dist/auth/methods/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../auth/methods/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAEpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAKlE,qBAAa,wBAAwB;IAGvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAFrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD,YAA6B,QAAQ,EAAE,cAAc,EAAI;IAEzD,OAAO,CAAC,QAAQ,EAAE,kBAAkB,GAAG,gBAAgB,CAYtD;CACF"}

package/dist/auth/methods/resolver.js

@@ -0,0 +1,21 @@
+import { CredentialClassifier } from './classifier';
+import { UnrecognizedCredentialError, UnsupportedMethodError } from './errors';
+export class CredentialMethodResolver {
+    registry;
+    classifier = new CredentialClassifier();
+    constructor(registry) {
+        this.registry = registry;
+    }
+    resolve(envelope) {
+        const classification = this.classifier.classify(envelope);
+        if (!classification) {
+            throw new UnrecognizedCredentialError();
+        }
+        const method = this.registry.get(classification.method);
+        if (!method) {
+            throw new UnsupportedMethodError(classification.method);
+        }
+        return method;
+    }
+}
+//# sourceMappingURL=resolver.js.map

package/dist/auth/methods/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../auth/methods/resolver.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAE9E,MAAM,OAAO,wBAAwB;IAGN,QAAQ;IAFpB,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAExD,YAA6B,QAAwB;wBAAxB,QAAQ;IAAmB,CAAC;IAEzD,OAAO,CAAC,QAA4B;QAClC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACzD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,2BAA2B,EAAE,CAAA;QACzC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,sBAAsB,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACzD,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;CACF"}

package/dist/auth/permissions/describe.d.ts

@@ -0,0 +1,9 @@
+import type { PermissionMask } from './permission';
+/**
+ * Describe a permission mask for debugging/error messages.
+ *
+ * Returns the semantic names by default ("USE", "READ | USE"). Pass an
+ * explicit `names[]` to override for non-canonical bit assignments.
+ */
+export declare function describePerms(mask: PermissionMask, names?: string[]): string;
+//# sourceMappingURL=describe.d.ts.map

package/dist/auth/permissions/describe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.d.ts","sourceRoot":"","sources":["../../../auth/permissions/describe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAalD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,GAAE,MAAM,EAAkB,GAAG,MAAM,CAS3F"}

package/dist/auth/permissions/describe.js

@@ -0,0 +1,26 @@
+import { MAX_PERM_BITS } from './permission';
+/**
+ * Default semantic names for the canonical Astrale OS permission bits
+ * (READ/EDIT/USE/SHARE — see semantic.ts). The kernel is otherwise
+ * agnostic about what bits mean, but `bits[N]` is unreadable in error
+ * messages and reads as "byte N" (META_TRACE #51/#83). Domains that
+ * extend the bit model can pass their own `names[]`.
+ */
+const DEFAULT_NAMES = ['READ', 'EDIT', 'USE', 'SHARE'];
+/**
+ * Describe a permission mask for debugging/error messages.
+ *
+ * Returns the semantic names by default ("USE", "READ | USE"). Pass an
+ * explicit `names[]` to override for non-canonical bit assignments.
+ */
+export function describePerms(mask, names = DEFAULT_NAMES) {
+    if (mask === 0)
+        return 'none';
+    const bits = [];
+    for (let i = 0; i < MAX_PERM_BITS; i++) {
+        if ((mask & (1 << i)) !== 0)
+            bits.push(i);
+    }
+    return bits.map((b) => names[b] ?? `bit${b}`).join(' | ');
+}
+//# sourceMappingURL=describe.js.map

package/dist/auth/permissions/describe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe.js","sourceRoot":"","sources":["../../../auth/permissions/describe.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;AAEtD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoB,EAAE,KAAK,GAAa,aAAa;IACjF,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAE7B,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC3D,CAAC"}

package/dist/auth/permissions/index.d.ts

@@ -0,0 +1,6 @@
+export * from './permission';
+export * from './semantic';
+export * from './operations';
+export * from './validation';
+export * from './describe';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/permissions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../auth/permissions/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA"}

package/dist/auth/permissions/index.js

@@ -0,0 +1,6 @@
+export * from './permission';
+export * from './semantic';
+export * from './operations';
+export * from './validation';
+export * from './describe';
+//# sourceMappingURL=index.js.map

package/dist/auth/permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../auth/permissions/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA"}

package/dist/auth/permissions/operations.d.ts

@@ -0,0 +1,19 @@
+import type { Permission, PermissionMask } from './permission';
+/**
+ * Create a Permission from a bit position (0-indexed).
+ * Validates the position is within the safe range (0..30).
+ */
+export declare function permBit(pos: number): Permission;
+/** Check if a mask contains a specific permission. */
+export declare function hasPerm(mask: PermissionMask, perm: Permission): boolean;
+/** Check if a mask contains ALL of the required permissions. */
+export declare function hasAllPerms(mask: PermissionMask, required: PermissionMask): boolean;
+/** Combine permissions into a mask. */
+export declare function toMask(...perms: Permission[]): PermissionMask;
+/** Remove permissions from a mask. */
+export declare function removePerms(mask: PermissionMask, ...perms: Permission[]): PermissionMask;
+/** Intersect two masks (only bits present in both). */
+export declare function intersectPerms(a: PermissionMask, b: PermissionMask): PermissionMask;
+/** Decompose a mask into individual Permission flags. */
+export declare function toPerms(mask: PermissionMask): Permission[];
+//# sourceMappingURL=operations.d.ts.map

package/dist/auth/permissions/operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../../auth/permissions/operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAI9D;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAK/C;AAED,sDAAsD;AACtD,wBAAgB,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAEvE;AAED,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAEnF;AAED,uCAAuC;AACvC,wBAAgB,MAAM,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,cAAc,CAI7D;AAED,sCAAsC;AACtC,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,cAAc,CAIxF;AAED,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,GAAG,cAAc,CAEnF;AAED,yDAAyD;AACzD,wBAAgB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,EAAE,CAO1D"}

package/dist/auth/permissions/operations.js

@@ -0,0 +1,48 @@
+import { MAX_PERM_BITS } from './permission';
+/**
+ * Create a Permission from a bit position (0-indexed).
+ * Validates the position is within the safe range (0..30).
+ */
+export function permBit(pos) {
+    if (!Number.isInteger(pos) || pos < 0 || pos >= MAX_PERM_BITS) {
+        throw new Error(`Invalid permission bit position: ${pos} (must be 0..${MAX_PERM_BITS - 1})`);
+    }
+    return (1 << pos);
+}
+/** Check if a mask contains a specific permission. */
+export function hasPerm(mask, perm) {
+    return (mask & perm) !== 0;
+}
+/** Check if a mask contains ALL of the required permissions. */
+export function hasAllPerms(mask, required) {
+    return (mask & required) === required;
+}
+/** Combine permissions into a mask. */
+export function toMask(...perms) {
+    let mask = 0;
+    for (const p of perms)
+        mask = mask | p;
+    return mask;
+}
+/** Remove permissions from a mask. */
+export function removePerms(mask, ...perms) {
+    let result = mask;
+    for (const p of perms)
+        result = result & ~p;
+    return result;
+}
+/** Intersect two masks (only bits present in both). */
+export function intersectPerms(a, b) {
+    return a & b;
+}
+/** Decompose a mask into individual Permission flags. */
+export function toPerms(mask) {
+    const perms = [];
+    for (let i = 0; i < MAX_PERM_BITS; i++) {
+        const bit = (1 << i);
+        if ((mask & bit) !== 0)
+            perms.push(bit);
+    }
+    return perms;
+}
+//# sourceMappingURL=operations.js.map

package/dist/auth/permissions/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../../auth/permissions/operations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAE5C;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,aAAa,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,gBAAgB,aAAa,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,GAAG,CAAe,CAAA;AACjC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,OAAO,CAAC,IAAoB,EAAE,IAAgB;IAC5D,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;AAC5B,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,IAAoB,EAAE,QAAwB;IACxE,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,QAAQ,CAAA;AACvC,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,MAAM,CAAC,GAAG,KAAmB;IAC3C,IAAI,IAAI,GAAmB,CAAC,CAAA;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,GAAG,IAAI,GAAG,CAAC,CAAA;IACtC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,WAAW,CAAC,IAAoB,EAAE,GAAG,KAAmB;IACtE,IAAI,MAAM,GAAG,IAAI,CAAA;IACjB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3C,OAAO,MAAM,CAAA;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,CAAiB,EAAE,CAAiB;IACjE,OAAO,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,OAAO,CAAC,IAAoB;IAC1C,MAAM,KAAK,GAAiB,EAAE,CAAA;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAe,CAAA;QAClC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/auth/permissions/permission.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Permissions — Bitmask Model
+ *
+ * The kernel is agnostic about what permissions mean.
+ * It provides 31 bit positions (0..30) on 32-bit signed integers.
+ * The application layer assigns semantic names to bit positions.
+ *
+ * Permission = a single bit flag (power of 2), branded for type safety.
+ * PermissionMask = combined bits (bitwise OR of Permission values).
+ */
+/**
+ * A single permission flag — always a power of 2.
+ * Branded so that a combined mask cannot be passed where a single permission is expected.
+ */
+export type Permission = number & {
+    readonly __brand: 'Permission';
+};
+/**
+ * Combined permission flags (bitwise OR of Permission values).
+ * A single Permission IS assignable to PermissionMask (branded number satisfies plain number).
+ * A PermissionMask is NOT assignable to Permission (plain number lacks the brand).
+ */
+export type PermissionMask = number;
+/** Maximum number of usable permission bits (bit 31 is the sign bit). */
+export declare const MAX_PERM_BITS = 31;
+/** No permissions. */
+export declare const NO_PERMS: PermissionMask;
+/** All 31 permission bits set. */
+export declare const ALL_PERMS: PermissionMask;
+//# sourceMappingURL=permission.d.ts.map

package/dist/auth/permissions/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../../auth/permissions/permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAA;AAEpE;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAA;AAEnC,yEAAyE;AACzE,eAAO,MAAM,aAAa,KAAK,CAAA;AAE/B,sBAAsB;AACtB,eAAO,MAAM,QAAQ,EAAE,cAAkB,CAAA;AAEzC,kCAAkC;AAClC,eAAO,MAAM,SAAS,EAAE,cAA2B,CAAA"}

package/dist/auth/permissions/permission.js

@@ -0,0 +1,17 @@
+/**
+ * Permissions — Bitmask Model
+ *
+ * The kernel is agnostic about what permissions mean.
+ * It provides 31 bit positions (0..30) on 32-bit signed integers.
+ * The application layer assigns semantic names to bit positions.
+ *
+ * Permission = a single bit flag (power of 2), branded for type safety.
+ * PermissionMask = combined bits (bitwise OR of Permission values).
+ */
+/** Maximum number of usable permission bits (bit 31 is the sign bit). */
+export const MAX_PERM_BITS = 31;
+/** No permissions. */
+export const NO_PERMS = 0;
+/** All 31 permission bits set. */
+export const ALL_PERMS = 0x7fffffff;
+//# sourceMappingURL=permission.js.map

package/dist/auth/permissions/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../../../auth/permissions/permission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAeH,yEAAyE;AACzE,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAA;AAE/B,sBAAsB;AACtB,MAAM,CAAC,MAAM,QAAQ,GAAmB,CAAC,CAAA;AAEzC,kCAAkC;AAClC,MAAM,CAAC,MAAM,SAAS,GAAmB,UAAU,CAAA"}

package/dist/auth/permissions/semantic.d.ts

@@ -0,0 +1,7 @@
+import type { Permission, PermissionMask } from './permission';
+export declare const READ: Permission;
+export declare const EDIT: Permission;
+export declare const USE: Permission;
+export declare const SHARE: Permission;
+export declare const ALL: PermissionMask;
+//# sourceMappingURL=semantic.d.ts.map

package/dist/auth/permissions/semantic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic.d.ts","sourceRoot":"","sources":["../../../auth/permissions/semantic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE9D,eAAO,MAAM,IAAI,EAAQ,UAAU,CAAA;AACnC,eAAO,MAAM,IAAI,EAAQ,UAAU,CAAA;AACnC,eAAO,MAAM,GAAG,EAAQ,UAAU,CAAA;AAClC,eAAO,MAAM,KAAK,EAAQ,UAAU,CAAA;AACpC,eAAO,MAAM,GAAG,EAAkC,cAAc,CAAA"}

package/dist/auth/permissions/semantic.js

@@ -0,0 +1,6 @@
+export const READ = 1; // bit 0
+export const EDIT = 2; // bit 1
+export const USE = 4; // bit 2
+export const SHARE = 8; // bit 3
+export const ALL = (READ | EDIT | USE | SHARE); // bits 0-3
+//# sourceMappingURL=semantic.js.map

package/dist/auth/permissions/semantic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic.js","sourceRoot":"","sources":["../../../auth/permissions/semantic.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,IAAI,GAAG,CAAe,CAAA,CAAC,QAAQ;AAC5C,MAAM,CAAC,MAAM,IAAI,GAAG,CAAe,CAAA,CAAC,QAAQ;AAC5C,MAAM,CAAC,MAAM,GAAG,GAAG,CAAe,CAAA,CAAC,QAAQ;AAC3C,MAAM,CAAC,MAAM,KAAK,GAAG,CAAe,CAAA,CAAC,QAAQ;AAC7C,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK,CAAmB,CAAA,CAAC,WAAW"}

package/dist/auth/permissions/validation.d.ts

@@ -0,0 +1,6 @@
+import type { Permission, PermissionMask } from './permission';
+/** Validate a value is a valid single Permission (power of 2, within range). */
+export declare function validatePermission(perm: unknown): asserts perm is Permission;
+/** Validate a value is a valid PermissionMask (non-negative integer within range). */
+export declare function validatePermissionMask(mask: unknown): asserts mask is PermissionMask;
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/permissions/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../auth/permissions/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAI9D,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAQ5E;AAED,sFAAsF;AACtF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,cAAc,CAMpF"}

package/dist/auth/permissions/validation.js

@@ -0,0 +1,18 @@
+import { ALL_PERMS } from './permission';
+/** Validate a value is a valid single Permission (power of 2, within range). */
+export function validatePermission(perm) {
+    if (typeof perm !== 'number' || !Number.isInteger(perm) || perm <= 0 || perm > ALL_PERMS) {
+        throw new Error(`Invalid permission: must be a positive integer within range (got ${perm})`);
+    }
+    // Check it's a power of 2
+    if ((perm & (perm - 1)) !== 0) {
+        throw new Error(`Invalid permission: must be a power of 2 (got ${perm})`);
+    }
+}
+/** Validate a value is a valid PermissionMask (non-negative integer within range). */
+export function validatePermissionMask(mask) {
+    if (typeof mask !== 'number' || !Number.isInteger(mask) || mask < 0 || mask > ALL_PERMS) {
+        throw new Error(`Invalid permission mask: must be a non-negative integer within range (got ${mask})`);
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/auth/permissions/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../auth/permissions/validation.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAExC,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,oEAAoE,IAAI,GAAG,CAAC,CAAA;IAC9F,CAAC;IACD,0BAA0B;IAC1B,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,GAAG,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,GAAG,CACrF,CAAA;IACH,CAAC;AACH,CAAC"}