@dcsv-io/d2-auth-abstractions 0.1.1

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright (c) DCSV
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,104 @@
+<!--
+Copyright (c) DCSV. Licensed under the Apache License, Version 2.0.
+-->
+
+# @dcsv-io/d2-auth-abstractions
+
+> Parent: [`packages/typescript/`](../../README.md)
+
+Auth-related constants for TS consumers — `Scopes` tree, `AuthErrorCodes`,
+`AuthFailures` factories, `JwtClaimTypes`. Mirrors
+`DcsvIo.D2.Auth.Abstractions` + `DcsvIo.D2.Auth.Errors` consolidated
+(matches the .NET assembly placement).
+
+## Public API
+
+| Export                                                  | Source                            | Mirror                                      |
+| ------------------------------------------------------- | --------------------------------- | ------------------------------------------- |
+| `Scopes` (nested constants)                             | `scopes.g.ts` (codegen)           | `Scopes.*.*` (.NET)                         |
+| `ALL_SCOPES`                                            | `scopes.g.ts`                     | `Scopes.AllScopes`                          |
+| `AuthErrorCodes`                                        | `auth-error-codes.g.ts` (codegen) | `DcsvIo.D2.Auth.Errors.AuthErrorCodes`      |
+| `ALL_AUTH_ERROR_CODES` / `getAuthErrorHttpStatus(code)` | `auth-error-codes.g.ts`           | `AuthErrorCodes.AllCodes` / `GetHttpStatus` |
+| `AuthFailures.<factory>()`                              | `auth-failures.g.ts` (codegen)    | `DcsvIo.D2.Auth.Errors.AuthFailures.*`      |
+| `JwtClaimTypes`                                         | `jwt-claim-types.g.ts` (codegen)  | `DcsvIo.D2.Auth.Abstractions.JwtClaimTypes` |
+| `JwtPayload`                                            | `jwt-payload.g.ts` (codegen)      | TS-only typed view over the same spec       |
+
+## Codegen workflow
+
+`prebuild` chains 4 emitter scripts (auth-scopes / auth-error-codes /
+auth-failures / jwt-claims) before `tsc -b`, so `pnpm -r build` regenerates
+transparently. Generated files (`*.g.ts`) are committed to git.
+
+`JwtClaimTypes` AND `JwtPayload` both emit from
+`contracts/jwt-claims/jwt-claims.spec.json` (one generator, two outputs; sources committed):
+
+- `JwtClaimTypes` — string-constant catalog (every claim's wire name).
+- `JwtPayload` — TS interface typed on every `standard` + `d2-custom`
+  claim with stable per-field types; `inside-act` claims live nested
+  inside `act` and are not surfaced as top-level fields. A trailing
+  `raw: Readonly<Record<string, unknown>>` escape hatch carries the
+  raw decoded claims for downstream consumers needing access to
+  non-spec'd claims.
+
+The .NET side consumes the same spec for `JwtClaimTypes` constants;
+.NET reads claim values via `ClaimsPrincipal` so a typed payload is not
+needed there. Cross-language drift on the constant catalog is
+structurally impossible (single source).
+
+## Header constants
+
+> Wire-protocol header catalogs live in the per-transport packages — see [`../../README.md` § Packages](../../README.md#packages) for the full per-transport catalog enumeration.
+
+## Dependencies
+
+- `@dcsv-io/d2-result` — `D2Result` shape returned by `AuthFailures.*` factories.
+
+## Usage example
+
+```ts
+import {
+  Scopes,
+  AuthFailures,
+  AuthErrorCodes,
+  JwtClaimTypes,
+} from "@dcsv-io/d2-auth-abstractions";
+import { HttpHeaders } from "@dcsv-io/d2-headers-http";
+
+// Scope check.
+if (!ctx.scopes.has(Scopes.auth.user.impersonate.consent)) {
+  return AuthFailures.scopeInsufficient(ctx.traceId);
+}
+
+// Header read.
+const idempotency = req.headers[HttpHeaders.IDEMPOTENCY_KEY];
+
+// Claim read.
+const sub = jwtPayload[JwtClaimTypes.SUB];
+
+// Error-code discrimination.
+if (result.errorCode === AuthErrorCodes.AUTH_JWT_EXPIRED) {
+  // refresh the token and retry
+}
+```
+
+## Parity with .NET
+
+Mirrors `DcsvIo.D2.Auth.Abstractions` + `DcsvIo.D2.Auth.Errors`:
+
+- `Scopes` tree — same dot-segmented spec names emitted as nested
+  constants (e.g. `Scopes.auth.user.impersonate.consent`).
+- `AuthErrorCodes` — same string values (every constant is its own name).
+- `AuthFailures` — every factory returns `D2Result.fail(...)` with
+  matching `errorCode` + `statusCode` + default `messageKey`.
+- `JwtClaimTypes` — codegen-emitted from `contracts/jwt-claims/jwt-claims.spec.json`;
+  same constant names + values on both sides.
+- `JwtPayload` — TS-only typed view emitted from the same spec; .NET reads
+  claims via `ClaimsPrincipal` rather than a typed shape.
+
+## Edge cases
+
+- `getAuthErrorHttpStatus` returns 500 for unknown codes — defensive
+  default, every shipped `AUTH_*` code IS in the table.
+- `Scopes` may include `_self` keys at branch nodes when an entry is
+  both a leaf scope AND has children (rare; edge case for forward-compat).
+- Generated files (`*.g.ts`) are committed to git.

package/dist/auth-error-codes.g.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Machine-readable error codes for auth runtime failures. Mirrors .NET
+ * DcsvIo.D2.Auth.Errors.AuthErrorCodes (same string values).
+ */
+export declare const AuthErrorCodes: {
+    readonly AUTH_BEARER_MALFORMED: "AUTH_BEARER_MALFORMED";
+    readonly AUTH_BEARER_MISSING: "AUTH_BEARER_MISSING";
+    readonly AUTH_JWKS_UNAVAILABLE: "AUTH_JWKS_UNAVAILABLE";
+    readonly AUTH_JWT_ACT_CHAIN_MALFORMED: "AUTH_JWT_ACT_CHAIN_MALFORMED";
+    readonly AUTH_JWT_AUDIENCE_MISMATCH: "AUTH_JWT_AUDIENCE_MISMATCH";
+    readonly AUTH_JWT_CLAIM_MISSING: "AUTH_JWT_CLAIM_MISSING";
+    readonly AUTH_JWT_EXPIRED: "AUTH_JWT_EXPIRED";
+    readonly AUTH_JWT_ISSUER_MISMATCH: "AUTH_JWT_ISSUER_MISMATCH";
+    readonly AUTH_JWT_KID_NOT_FOUND: "AUTH_JWT_KID_NOT_FOUND";
+    readonly AUTH_JWT_NOT_YET_VALID: "AUTH_JWT_NOT_YET_VALID";
+    readonly AUTH_JWT_SIGNATURE_INVALID: "AUTH_JWT_SIGNATURE_INVALID";
+    readonly AUTH_REQUEST_ORIGIN_UNESTABLISHED: "AUTH_REQUEST_ORIGIN_UNESTABLISHED";
+    readonly AUTH_SCOPE_INSUFFICIENT: "AUTH_SCOPE_INSUFFICIENT";
+    readonly AUTH_SESSION_LIVENESS_UNAVAILABLE: "AUTH_SESSION_LIVENESS_UNAVAILABLE";
+    readonly AUTH_SESSION_REVOKED: "AUTH_SESSION_REVOKED";
+};
+export type AuthErrorCode = (typeof AuthErrorCodes)[keyof typeof AuthErrorCodes];
+export declare const ALL_AUTH_ERROR_CODES: readonly string[];
+/**
+ * HTTP status declared in the spec for an AUTH_* code.
+ * Returns 500 for unknown codes (defensive default).
+ */
+export declare function getAuthErrorHttpStatus(code: string): number;
+//# sourceMappingURL=auth-error-codes.g.d.ts.map

package/dist/auth-error-codes.g.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-error-codes.g.d.ts","sourceRoot":"","sources":["../src/auth-error-codes.g.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;CAgBjB,CAAC;AAEX,MAAM,MAAM,aAAa,GACvB,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAEvD,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAgBjD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAmB3D"}

package/dist/auth-error-codes.g.js

@@ -0,0 +1,71 @@
+// -----------------------------------------------------------------------
+// <auto-generated>
+//   Generated by the D2 TypeScript catalog codegen — see emitter tests for coverage.
+//   Source spec: contracts/auth-error-codes/auth-error-codes.spec.json
+//   Manual edits will be lost on rebuild.
+// </auto-generated>
+// -----------------------------------------------------------------------
+/* eslint-disable */
+/**
+ * Machine-readable error codes for auth runtime failures. Mirrors .NET
+ * DcsvIo.D2.Auth.Errors.AuthErrorCodes (same string values).
+ */
+export const AuthErrorCodes = {
+    AUTH_BEARER_MALFORMED: "AUTH_BEARER_MALFORMED",
+    AUTH_BEARER_MISSING: "AUTH_BEARER_MISSING",
+    AUTH_JWKS_UNAVAILABLE: "AUTH_JWKS_UNAVAILABLE",
+    AUTH_JWT_ACT_CHAIN_MALFORMED: "AUTH_JWT_ACT_CHAIN_MALFORMED",
+    AUTH_JWT_AUDIENCE_MISMATCH: "AUTH_JWT_AUDIENCE_MISMATCH",
+    AUTH_JWT_CLAIM_MISSING: "AUTH_JWT_CLAIM_MISSING",
+    AUTH_JWT_EXPIRED: "AUTH_JWT_EXPIRED",
+    AUTH_JWT_ISSUER_MISMATCH: "AUTH_JWT_ISSUER_MISMATCH",
+    AUTH_JWT_KID_NOT_FOUND: "AUTH_JWT_KID_NOT_FOUND",
+    AUTH_JWT_NOT_YET_VALID: "AUTH_JWT_NOT_YET_VALID",
+    AUTH_JWT_SIGNATURE_INVALID: "AUTH_JWT_SIGNATURE_INVALID",
+    AUTH_REQUEST_ORIGIN_UNESTABLISHED: "AUTH_REQUEST_ORIGIN_UNESTABLISHED",
+    AUTH_SCOPE_INSUFFICIENT: "AUTH_SCOPE_INSUFFICIENT",
+    AUTH_SESSION_LIVENESS_UNAVAILABLE: "AUTH_SESSION_LIVENESS_UNAVAILABLE",
+    AUTH_SESSION_REVOKED: "AUTH_SESSION_REVOKED",
+};
+export const ALL_AUTH_ERROR_CODES = [
+    "AUTH_BEARER_MALFORMED",
+    "AUTH_BEARER_MISSING",
+    "AUTH_JWKS_UNAVAILABLE",
+    "AUTH_JWT_ACT_CHAIN_MALFORMED",
+    "AUTH_JWT_AUDIENCE_MISMATCH",
+    "AUTH_JWT_CLAIM_MISSING",
+    "AUTH_JWT_EXPIRED",
+    "AUTH_JWT_ISSUER_MISMATCH",
+    "AUTH_JWT_KID_NOT_FOUND",
+    "AUTH_JWT_NOT_YET_VALID",
+    "AUTH_JWT_SIGNATURE_INVALID",
+    "AUTH_REQUEST_ORIGIN_UNESTABLISHED",
+    "AUTH_SCOPE_INSUFFICIENT",
+    "AUTH_SESSION_LIVENESS_UNAVAILABLE",
+    "AUTH_SESSION_REVOKED",
+];
+/**
+ * HTTP status declared in the spec for an AUTH_* code.
+ * Returns 500 for unknown codes (defensive default).
+ */
+export function getAuthErrorHttpStatus(code) {
+    switch (code) {
+        case "AUTH_BEARER_MALFORMED": return 401;
+        case "AUTH_BEARER_MISSING": return 401;
+        case "AUTH_JWKS_UNAVAILABLE": return 503;
+        case "AUTH_JWT_ACT_CHAIN_MALFORMED": return 401;
+        case "AUTH_JWT_AUDIENCE_MISMATCH": return 401;
+        case "AUTH_JWT_CLAIM_MISSING": return 401;
+        case "AUTH_JWT_EXPIRED": return 401;
+        case "AUTH_JWT_ISSUER_MISMATCH": return 401;
+        case "AUTH_JWT_KID_NOT_FOUND": return 401;
+        case "AUTH_JWT_NOT_YET_VALID": return 401;
+        case "AUTH_JWT_SIGNATURE_INVALID": return 401;
+        case "AUTH_REQUEST_ORIGIN_UNESTABLISHED": return 401;
+        case "AUTH_SCOPE_INSUFFICIENT": return 401;
+        case "AUTH_SESSION_LIVENESS_UNAVAILABLE": return 503;
+        case "AUTH_SESSION_REVOKED": return 401;
+        default: return 500;
+    }
+}
+//# sourceMappingURL=auth-error-codes.g.js.map

package/dist/auth-error-codes.g.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-error-codes.g.js","sourceRoot":"","sources":["../src/auth-error-codes.g.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mBAAmB;AACnB,qFAAqF;AACrF,uEAAuE;AACvE,0CAA0C;AAC1C,oBAAoB;AACpB,0EAA0E;AAE1E,oBAAoB;AAEpB;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C,mBAAmB,EAAE,qBAAqB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,4BAA4B,EAAE,8BAA8B;IAC5D,0BAA0B,EAAE,4BAA4B;IACxD,sBAAsB,EAAE,wBAAwB;IAChD,gBAAgB,EAAE,kBAAkB;IACpC,wBAAwB,EAAE,0BAA0B;IACpD,sBAAsB,EAAE,wBAAwB;IAChD,sBAAsB,EAAE,wBAAwB;IAChD,0BAA0B,EAAE,4BAA4B;IACxD,iCAAiC,EAAE,mCAAmC;IACtE,uBAAuB,EAAE,yBAAyB;IAClD,iCAAiC,EAAE,mCAAmC;IACtE,oBAAoB,EAAE,sBAAsB;CACpC,CAAC;AAKX,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,uBAAuB;IACvB,qBAAqB;IACrB,uBAAuB;IACvB,8BAA8B;IAC9B,4BAA4B;IAC5B,wBAAwB;IACxB,kBAAkB;IAClB,0BAA0B;IAC1B,wBAAwB;IACxB,wBAAwB;IACxB,4BAA4B;IAC5B,mCAAmC;IACnC,yBAAyB;IACzB,mCAAmC;IACnC,sBAAsB;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,uBAAuB,CAAC,CAAC,OAAO,GAAG,CAAC;QACzC,KAAK,qBAAqB,CAAC,CAAC,OAAO,GAAG,CAAC;QACvC,KAAK,uBAAuB,CAAC,CAAC,OAAO,GAAG,CAAC;QACzC,KAAK,8BAA8B,CAAC,CAAC,OAAO,GAAG,CAAC;QAChD,KAAK,4BAA4B,CAAC,CAAC,OAAO,GAAG,CAAC;QAC9C,KAAK,wBAAwB,CAAC,CAAC,OAAO,GAAG,CAAC;QAC1C,KAAK,kBAAkB,CAAC,CAAC,OAAO,GAAG,CAAC;QACpC,KAAK,0BAA0B,CAAC,CAAC,OAAO,GAAG,CAAC;QAC5C,KAAK,wBAAwB,CAAC,CAAC,OAAO,GAAG,CAAC;QAC1C,KAAK,wBAAwB,CAAC,CAAC,OAAO,GAAG,CAAC;QAC1C,KAAK,4BAA4B,CAAC,CAAC,OAAO,GAAG,CAAC;QAC9C,KAAK,mCAAmC,CAAC,CAAC,OAAO,GAAG,CAAC;QACrD,KAAK,yBAAyB,CAAC,CAAC,OAAO,GAAG,CAAC;QAC3C,KAAK,mCAAmC,CAAC,CAAC,OAAO,GAAG,CAAC;QACrD,KAAK,sBAAsB,CAAC,CAAC,OAAO,GAAG,CAAC;QACxC,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/auth-failures.g.d.ts

@@ -0,0 +1,85 @@
+import { D2Result } from "@dcsv-io/d2-result";
+import { type TKMessage } from "@dcsv-io/d2-i18n-abstractions";
+/**
+ * Pre-built D2Result failures for inbound auth runtime — JWT validation
+ * rejections, session liveness outages, JWKS upstream failures.
+ * Mirrors .NET DcsvIo.D2.Auth.Errors.AuthFailures factory shape.
+ */
+export declare const AuthFailures: {
+    /** The Authorization header was present but not a parseable Bearer JWT. */
+    readonly bearerMalformed: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** The Authorization header was missing on a protected endpoint. */
+    readonly bearerMissing: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** JWKS upstream is unavailable; no cached snapshot to fall back on. */
+    readonly jwksUnavailable: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** JWT act chain is malformed (RFC 8693 section 2.1 violation). */
+    readonly jwtActChainMalformed: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** JWT aud claim does not match this service's configured audience. */
+    readonly jwtAudienceMismatch: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** JWT is missing a required claim that this service depends on. */
+    readonly jwtClaimMissing: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** JWT is expired (exp in the past, beyond clock skew). */
+    readonly jwtExpired: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** JWT iss claim does not match the configured issuer. */
+    readonly jwtIssuerMismatch: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** JWT signed by an unknown kid; reactive JWKS refresh did not surface it. */
+    readonly jwtKidNotFound: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** JWT not yet valid (nbf in the future, beyond clock skew). */
+    readonly jwtNotYetValid: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** JWT signature verification failed against the JWKS. */
+    readonly jwtSignatureInvalid: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** gRPC product call reached a host with RequestOrigin still Unestablished after the cross-process establishment interceptor (no validated mTLS peer identity). Platform fail-closed deny — not a per-handler check. Surfaces as 401 (not 403) so the auth boundary keeps a uniform shape with other policy-denied auth failures. */
+    readonly requestOriginUnestablished: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** Caller is authenticated but the per-endpoint scope requirement is not satisfied. Surfaces as 401 (not 403) - the auth boundary keeps a uniform shape regardless of whether the JWT was bad or scopes were insufficient, so attackers cannot deduce which check failed. */
+    readonly scopeInsufficient: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** Session liveness store unreachable. Caller fails closed: receives a 503-equivalent and may retry; the attempt is NOT treated as authenticated. Treating an unknown liveness state as alive would let revoked sessions ride through outages. */
+    readonly sessionLivenessUnavailable: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+    /** The bearer's d2_session_id is no longer alive (revoked). */
+    readonly sessionRevoked: <T = void>(opts?: {
+        messages?: readonly TKMessage[];
+        traceId?: string;
+    }) => D2Result<T>;
+};
+//# sourceMappingURL=auth-failures.g.d.ts.map

package/dist/auth-failures.g.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-failures.g.d.ts","sourceRoot":"","sources":["../src/auth-failures.g.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,QAAQ,EAAoC,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAI/D;;;;GAIG;AACH,eAAO,MAAM,YAAY;IACvB,2EAA2E;+BAC3D,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQxG,oEAAoE;6BACtD,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQtG,wEAAwE;+BACxD,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQxG,mEAAmE;oCAC9C,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQ7G,uEAAuE;mCACnD,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQ5G,oEAAoE;+BACpD,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQxG,2DAA2D;0BAChD,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQnG,0DAA0D;iCACxC,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQ1G,8EAA8E;8BAC/D,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQvG,gEAAgE;8BACjD,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQvG,0DAA0D;mCACtC,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQ5G,qUAAqU;0CAC1S,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQnH,6QAA6Q;iCAC3P,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQ1G,kPAAkP;0CACvN,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;IAQnH,+DAA+D;8BAChD,CAAC,gBAAe;QAAE,QAAQ,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,QAAQ,CAAC,CAAC,CAAC;CAQ/F,CAAC"}

package/dist/auth-failures.g.js

@@ -0,0 +1,156 @@
+// -----------------------------------------------------------------------
+// <auto-generated>
+//   Generated by the D2 TypeScript catalog codegen — see emitter tests for coverage.
+//   Source spec: contracts/auth-error-codes/auth-error-codes.spec.json
+//   Manual edits will be lost on rebuild.
+// </auto-generated>
+// -----------------------------------------------------------------------
+/* eslint-disable */
+import { D2Result, serviceUnavailable, unauthorized } from "@dcsv-io/d2-result";
+import { ErrorCategoryWire } from "@dcsv-io/d2-error-category";
+import {} from "@dcsv-io/d2-i18n-abstractions";
+import { TK } from "@dcsv-io/d2-i18n-keys";
+import { AuthErrorCodes } from "./auth-error-codes.g.js";
+/**
+ * Pre-built D2Result failures for inbound auth runtime — JWT validation
+ * rejections, session liveness outages, JWKS upstream failures.
+ * Mirrors .NET DcsvIo.D2.Auth.Errors.AuthFailures factory shape.
+ */
+export const AuthFailures = {
+    /** The Authorization header was present but not a parseable Bearer JWT. */
+    bearerMalformed(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_BEARER_MALFORMED,
+            category: ErrorCategoryWire.ValidationFailure,
+            traceId: opts.traceId,
+        });
+    },
+    /** The Authorization header was missing on a protected endpoint. */
+    bearerMissing(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_BEARER_MISSING,
+            category: ErrorCategoryWire.ValidationFailure,
+            traceId: opts.traceId,
+        });
+    },
+    /** JWKS upstream is unavailable; no cached snapshot to fall back on. */
+    jwksUnavailable(opts = {}) {
+        return serviceUnavailable({
+            messages: opts.messages ?? [TK.auth.errors.TEMPORARILY_UNAVAILABLE],
+            errorCode: AuthErrorCodes.AUTH_JWKS_UNAVAILABLE,
+            category: ErrorCategoryWire.InfrastructureUnavailable,
+            traceId: opts.traceId,
+        });
+    },
+    /** JWT act chain is malformed (RFC 8693 section 2.1 violation). */
+    jwtActChainMalformed(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_JWT_ACT_CHAIN_MALFORMED,
+            category: ErrorCategoryWire.ValidationFailure,
+            traceId: opts.traceId,
+        });
+    },
+    /** JWT aud claim does not match this service's configured audience. */
+    jwtAudienceMismatch(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_JWT_AUDIENCE_MISMATCH,
+            category: ErrorCategoryWire.ValidationFailure,
+            traceId: opts.traceId,
+        });
+    },
+    /** JWT is missing a required claim that this service depends on. */
+    jwtClaimMissing(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_JWT_CLAIM_MISSING,
+            category: ErrorCategoryWire.ValidationFailure,
+            traceId: opts.traceId,
+        });
+    },
+    /** JWT is expired (exp in the past, beyond clock skew). */
+    jwtExpired(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_JWT_EXPIRED,
+            category: ErrorCategoryWire.ValidationFailure,
+            traceId: opts.traceId,
+        });
+    },
+    /** JWT iss claim does not match the configured issuer. */
+    jwtIssuerMismatch(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_JWT_ISSUER_MISMATCH,
+            category: ErrorCategoryWire.ValidationFailure,
+            traceId: opts.traceId,
+        });
+    },
+    /** JWT signed by an unknown kid; reactive JWKS refresh did not surface it. */
+    jwtKidNotFound(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_JWT_KID_NOT_FOUND,
+            category: ErrorCategoryWire.ValidationFailure,
+            traceId: opts.traceId,
+        });
+    },
+    /** JWT not yet valid (nbf in the future, beyond clock skew). */
+    jwtNotYetValid(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_JWT_NOT_YET_VALID,
+            category: ErrorCategoryWire.ValidationFailure,
+            traceId: opts.traceId,
+        });
+    },
+    /** JWT signature verification failed against the JWKS. */
+    jwtSignatureInvalid(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_JWT_SIGNATURE_INVALID,
+            category: ErrorCategoryWire.ValidationFailure,
+            traceId: opts.traceId,
+        });
+    },
+    /** gRPC product call reached a host with RequestOrigin still Unestablished after the cross-process establishment interceptor (no validated mTLS peer identity). Platform fail-closed deny — not a per-handler check. Surfaces as 401 (not 403) so the auth boundary keeps a uniform shape with other policy-denied auth failures. */
+    requestOriginUnestablished(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_REQUEST_ORIGIN_UNESTABLISHED,
+            category: ErrorCategoryWire.PolicyDenied,
+            traceId: opts.traceId,
+        });
+    },
+    /** Caller is authenticated but the per-endpoint scope requirement is not satisfied. Surfaces as 401 (not 403) - the auth boundary keeps a uniform shape regardless of whether the JWT was bad or scopes were insufficient, so attackers cannot deduce which check failed. */
+    scopeInsufficient(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_SCOPE_INSUFFICIENT,
+            category: ErrorCategoryWire.PolicyDenied,
+            traceId: opts.traceId,
+        });
+    },
+    /** Session liveness store unreachable. Caller fails closed: receives a 503-equivalent and may retry; the attempt is NOT treated as authenticated. Treating an unknown liveness state as alive would let revoked sessions ride through outages. */
+    sessionLivenessUnavailable(opts = {}) {
+        return serviceUnavailable({
+            messages: opts.messages ?? [TK.auth.errors.TEMPORARILY_UNAVAILABLE],
+            errorCode: AuthErrorCodes.AUTH_SESSION_LIVENESS_UNAVAILABLE,
+            category: ErrorCategoryWire.InfrastructureUnavailable,
+            traceId: opts.traceId,
+        });
+    },
+    /** The bearer's d2_session_id is no longer alive (revoked). */
+    sessionRevoked(opts = {}) {
+        return unauthorized({
+            messages: opts.messages ?? [TK.auth.errors.UNAUTHORIZED],
+            errorCode: AuthErrorCodes.AUTH_SESSION_REVOKED,
+            category: ErrorCategoryWire.PolicyDenied,
+            traceId: opts.traceId,
+        });
+    },
+};
+//# sourceMappingURL=auth-failures.g.js.map

package/dist/auth-failures.g.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-failures.g.js","sourceRoot":"","sources":["../src/auth-failures.g.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mBAAmB;AACnB,qFAAqF;AACrF,uEAAuE;AACvE,0CAA0C;AAC1C,oBAAoB;AACpB,0EAA0E;AAE1E,oBAAoB;AAEpB,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,2EAA2E;IAC3E,eAAe,CAAW,OAA8D,EAAE;QACxF,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,qBAAqB;YAC/C,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,oEAAoE;IACpE,aAAa,CAAW,OAA8D,EAAE;QACtF,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,mBAAmB;YAC7C,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,wEAAwE;IACxE,eAAe,CAAW,OAA8D,EAAE;QACxF,OAAO,kBAAkB,CAAI;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;YACnE,SAAS,EAAE,cAAc,CAAC,qBAAqB;YAC/C,QAAQ,EAAE,iBAAiB,CAAC,yBAAyB;YACrD,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,mEAAmE;IACnE,oBAAoB,CAAW,OAA8D,EAAE;QAC7F,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,4BAA4B;YACtD,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,uEAAuE;IACvE,mBAAmB,CAAW,OAA8D,EAAE;QAC5F,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,0BAA0B;YACpD,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,oEAAoE;IACpE,eAAe,CAAW,OAA8D,EAAE;QACxF,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,sBAAsB;YAChD,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,2DAA2D;IAC3D,UAAU,CAAW,OAA8D,EAAE;QACnF,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,gBAAgB;YAC1C,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,0DAA0D;IAC1D,iBAAiB,CAAW,OAA8D,EAAE;QAC1F,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,wBAAwB;YAClD,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,8EAA8E;IAC9E,cAAc,CAAW,OAA8D,EAAE;QACvF,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,sBAAsB;YAChD,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,gEAAgE;IAChE,cAAc,CAAW,OAA8D,EAAE;QACvF,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,sBAAsB;YAChD,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,0DAA0D;IAC1D,mBAAmB,CAAW,OAA8D,EAAE;QAC5F,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,0BAA0B;YACpD,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB;YAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,qUAAqU;IACrU,0BAA0B,CAAW,OAA8D,EAAE;QACnG,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,iCAAiC;YAC3D,QAAQ,EAAE,iBAAiB,CAAC,YAAY;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,6QAA6Q;IAC7Q,iBAAiB,CAAW,OAA8D,EAAE;QAC1F,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,uBAAuB;YACjD,QAAQ,EAAE,iBAAiB,CAAC,YAAY;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,kPAAkP;IAClP,0BAA0B,CAAW,OAA8D,EAAE;QACnG,OAAO,kBAAkB,CAAI;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;YACnE,SAAS,EAAE,cAAc,CAAC,iCAAiC;YAC3D,QAAQ,EAAE,iBAAiB,CAAC,yBAAyB;YACrD,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IACD,+DAA+D;IAC/D,cAAc,CAAW,OAA8D,EAAE;QACvF,OAAO,YAAY,CAAI;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YACxD,SAAS,EAAE,cAAc,CAAC,oBAAoB;YAC9C,QAAQ,EAAE,iBAAiB,CAAC,YAAY;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;CACO,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { AuthErrorCodes, type AuthErrorCode, ALL_AUTH_ERROR_CODES, getAuthErrorHttpStatus, } from "./auth-error-codes.g.js";
+export { AuthFailures } from "./auth-failures.g.js";
+export { Scopes, ALL_SCOPES } from "./scopes.g.js";
+export { ProtocolAudiences, type ProtocolAudience, ALL_PROTOCOL_AUDIENCES, } from "./protocol-audiences.g.js";
+export { JwtClaimTypes, type JwtClaimType } from "./jwt-claim-types.g.js";
+export type { JwtPayload } from "./jwt-payload.g.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,cAAc,EACd,KAAK,aAAa,EAClB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+// -----------------------------------------------------------------------
+// Copyright (c) DCSV. Licensed under the Apache License, Version 2.0.
+// -----------------------------------------------------------------------
+export { AuthErrorCodes, ALL_AUTH_ERROR_CODES, getAuthErrorHttpStatus, } from "./auth-error-codes.g.js";
+export { AuthFailures } from "./auth-failures.g.js";
+export { Scopes, ALL_SCOPES } from "./scopes.g.js";
+export { ProtocolAudiences, ALL_PROTOCOL_AUDIENCES, } from "./protocol-audiences.g.js";
+export { JwtClaimTypes } from "./jwt-claim-types.g.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,sEAAsE;AACtE,0EAA0E;AAE1E,OAAO,EACL,cAAc,EAEd,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EACL,iBAAiB,EAEjB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAqB,MAAM,wBAAwB,CAAC"}

package/dist/jwt-claim-types.g.d.ts

@@ -0,0 +1,108 @@
+/**
+ * JWT claim name string constants used across the platform. Mirrors
+ * .NET DcsvIo.D2.Auth.Abstractions.JwtClaimTypes (same string values).
+ *
+ * Standard OAuth/OIDC claims keep their canonical names (sub, aud,
+ * scope, ...); D2-specific claims use the d2_ prefix; inside-act claims
+ * are nested under the act object per RFC 8693 §2.1 (lookup path
+ * act[ACT_KIND]).
+ */
+export declare const JwtClaimTypes: {
+    /**
+     * Subject — the user's identifier (Guid string for user tokens) or service client_id for pure service-identity tokens (RFC 6749 §4.4).
+     * Kind: standard.
+     */
+    readonly SUB: "sub";
+    /**
+     * Audience — the intended recipient service identifier(s). Per RFC 7519 §4.1.3 may be a single string OR a JSON array; both wire shapes accepted.
+     * Kind: standard.
+     */
+    readonly AUD: "aud";
+    /**
+     * Issued-at — Unix timestamp seconds when the token was minted.
+     * Kind: standard.
+     */
+    readonly IAT: "iat";
+    /**
+     * Expiry — Unix timestamp seconds after which the token is invalid.
+     * Kind: standard.
+     */
+    readonly EXP: "exp";
+    /**
+     * Authorized party (RFC 7519 §4.1.7) — the OAuth client the token was issued for.
+     * Kind: standard.
+     */
+    readonly AZP: "azp";
+    /**
+     * Space-separated string of granted permissions per RFC 6749 §3.3. Some authorization servers send this as a JSON array; the runtime parser accepts both shapes.
+     * Kind: standard.
+     */
+    readonly SCOPE: "scope";
+    /**
+     * Actor chain — RFC 8693 §2.1 nested-object structure identifying the chain of services / impersonators that minted the token. Empty / absent when the token is an end-user-direct token.
+     * Kind: standard.
+     */
+    readonly ACT: "act";
+    /**
+     * OAuth client identifier of the client that requested THIS specific token from the authorization server (RFC 8693 §4.3 / RFC 9068 §2.2). Updates on every token exchange — for a multi-hop chain, this is the immediate requesting client, not the originating one.
+     * Kind: standard.
+     */
+    readonly CLIENT_ID: "client_id";
+    /**
+     * User session identifier — links the token to a session record in d2-auth.
+     * Kind: d2-custom.
+     */
+    readonly SESSION_ID: "d2_session_id";
+    /**
+     * Login handle — unique, lowercase username.
+     * Kind: d2-custom.
+     */
+    readonly USERNAME: "d2_username";
+    /**
+     * JWT fingerprint — SHA-256 of canonical request signal (User-Agent + Accept). Used for token-binding adversarial checks.
+     * Kind: d2-custom.
+     */
+    readonly FINGERPRINT: "d2_fp";
+    /**
+     * Operating organization identifier. During impersonation: the impersonated user's org.
+     * Kind: d2-custom.
+     */
+    readonly ORG_ID: "d2_org_id";
+    /**
+     * Operating organization display name.
+     * Kind: d2-custom.
+     */
+    readonly ORG_NAME: "d2_org_name";
+    /**
+     * Operating organization type — string form of the OrgType enum.
+     * Kind: d2-custom.
+     */
+    readonly ORG_TYPE: "d2_org_type";
+    /**
+     * User's role in the operating organization — string form of the Role enum.
+     * Kind: d2-custom.
+     */
+    readonly ORG_ROLE: "d2_org_role";
+    /**
+     * Inside-act claim — flavor of impersonation when the actor's kind is impersonation. Values are lowercase strings matching ImpersonationKind (consent or force). Lookup path: act.d2_kind. There is NO top-level d2_kind claim; token kind is derived from the act chain's shape.
+     * Kind: inside-act.
+     */
+    readonly ACT_KIND: "d2_kind";
+    /**
+     * Inside-act claim — impersonation session identifier when the actor's kind is impersonation. Lookup path: act.d2_session_id. Wire value collides with top-level d2_session_id but the lookup path is distinct (nested under act).
+     * Kind: inside-act.
+     */
+    readonly ACT_SESSION_ID: "d2_session_id";
+    /**
+     * Authentication Methods Reference (RFC 8176). Array of strings identifying the authentication methods used. Input to risk-scoring and audit — 'password-only vs MFA vs OAuth2-with-WebAuthn' matters for sensitive-action gating.
+     * Kind: standard.
+     */
+    readonly AMR: "amr";
+    /**
+     * Unix-seconds timestamp of last step-up authentication completion. Handlers gating sensitive actions enforce 'step-up within last N minutes'. Edge auth populates from session record at JWT mint.
+     * Kind: d2-custom.
+     */
+    readonly STEP_UP_AT: "d2_step_up_at";
+};
+export type JwtClaimType = (typeof JwtClaimTypes)[keyof typeof JwtClaimTypes];
+//# sourceMappingURL=jwt-claim-types.g.d.ts.map

package/dist/jwt-claim-types.g.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-claim-types.g.d.ts","sourceRoot":"","sources":["../src/jwt-claim-types.g.ts"],"names":[],"mappings":"AAUA;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;IACxB;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;IAEH;;;OAGG;;CAEK,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC"}

package/dist/jwt-claim-types.g.js

@@ -0,0 +1,115 @@
+// -----------------------------------------------------------------------
+// <auto-generated>
+//   Generated by the D2 TypeScript catalog codegen — see emitter tests for coverage.
+//   Source spec: contracts/jwt-claims/jwt-claims.spec.json
+//   Manual edits will be lost on rebuild.
+// </auto-generated>
+// -----------------------------------------------------------------------
+/* eslint-disable */
+/**
+ * JWT claim name string constants used across the platform. Mirrors
+ * .NET DcsvIo.D2.Auth.Abstractions.JwtClaimTypes (same string values).
+ *
+ * Standard OAuth/OIDC claims keep their canonical names (sub, aud,
+ * scope, ...); D2-specific claims use the d2_ prefix; inside-act claims
+ * are nested under the act object per RFC 8693 §2.1 (lookup path
+ * act[ACT_KIND]).
+ */
+export const JwtClaimTypes = {
+    /**
+     * Subject — the user's identifier (Guid string for user tokens) or service client_id for pure service-identity tokens (RFC 6749 §4.4).
+     * Kind: standard.
+     */
+    SUB: "sub",
+    /**
+     * Audience — the intended recipient service identifier(s). Per RFC 7519 §4.1.3 may be a single string OR a JSON array; both wire shapes accepted.
+     * Kind: standard.
+     */
+    AUD: "aud",
+    /**
+     * Issued-at — Unix timestamp seconds when the token was minted.
+     * Kind: standard.
+     */
+    IAT: "iat",
+    /**
+     * Expiry — Unix timestamp seconds after which the token is invalid.
+     * Kind: standard.
+     */
+    EXP: "exp",
+    /**
+     * Authorized party (RFC 7519 §4.1.7) — the OAuth client the token was issued for.
+     * Kind: standard.
+     */
+    AZP: "azp",
+    /**
+     * Space-separated string of granted permissions per RFC 6749 §3.3. Some authorization servers send this as a JSON array; the runtime parser accepts both shapes.
+     * Kind: standard.
+     */
+    SCOPE: "scope",
+    /**
+     * Actor chain — RFC 8693 §2.1 nested-object structure identifying the chain of services / impersonators that minted the token. Empty / absent when the token is an end-user-direct token.
+     * Kind: standard.
+     */
+    ACT: "act",
+    /**
+     * OAuth client identifier of the client that requested THIS specific token from the authorization server (RFC 8693 §4.3 / RFC 9068 §2.2). Updates on every token exchange — for a multi-hop chain, this is the immediate requesting client, not the originating one.
+     * Kind: standard.
+     */
+    CLIENT_ID: "client_id",
+    /**
+     * User session identifier — links the token to a session record in d2-auth.
+     * Kind: d2-custom.
+     */
+    SESSION_ID: "d2_session_id",
+    /**
+     * Login handle — unique, lowercase username.
+     * Kind: d2-custom.
+     */
+    USERNAME: "d2_username",
+    /**
+     * JWT fingerprint — SHA-256 of canonical request signal (User-Agent + Accept). Used for token-binding adversarial checks.
+     * Kind: d2-custom.
+     */
+    FINGERPRINT: "d2_fp",
+    /**
+     * Operating organization identifier. During impersonation: the impersonated user's org.
+     * Kind: d2-custom.
+     */
+    ORG_ID: "d2_org_id",
+    /**
+     * Operating organization display name.
+     * Kind: d2-custom.
+     */
+    ORG_NAME: "d2_org_name",
+    /**
+     * Operating organization type — string form of the OrgType enum.
+     * Kind: d2-custom.
+     */
+    ORG_TYPE: "d2_org_type",
+    /**
+     * User's role in the operating organization — string form of the Role enum.
+     * Kind: d2-custom.
+     */
+    ORG_ROLE: "d2_org_role",
+    /**
+     * Inside-act claim — flavor of impersonation when the actor's kind is impersonation. Values are lowercase strings matching ImpersonationKind (consent or force). Lookup path: act.d2_kind. There is NO top-level d2_kind claim; token kind is derived from the act chain's shape.
+     * Kind: inside-act.
+     */
+    ACT_KIND: "d2_kind",
+    /**
+     * Inside-act claim — impersonation session identifier when the actor's kind is impersonation. Lookup path: act.d2_session_id. Wire value collides with top-level d2_session_id but the lookup path is distinct (nested under act).
+     * Kind: inside-act.
+     */
+    ACT_SESSION_ID: "d2_session_id",
+    /**
+     * Authentication Methods Reference (RFC 8176). Array of strings identifying the authentication methods used. Input to risk-scoring and audit — 'password-only vs MFA vs OAuth2-with-WebAuthn' matters for sensitive-action gating.
+     * Kind: standard.
+     */
+    AMR: "amr",
+    /**
+     * Unix-seconds timestamp of last step-up authentication completion. Handlers gating sensitive actions enforce 'step-up within last N minutes'. Edge auth populates from session record at JWT mint.
+     * Kind: d2-custom.
+     */
+    STEP_UP_AT: "d2_step_up_at",
+};
+//# sourceMappingURL=jwt-claim-types.g.js.map

package/dist/jwt-claim-types.g.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-claim-types.g.js","sourceRoot":"","sources":["../src/jwt-claim-types.g.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mBAAmB;AACnB,qFAAqF;AACrF,2DAA2D;AAC3D,0CAA0C;AAC1C,oBAAoB;AACpB,0EAA0E;AAE1E,oBAAoB;AAEpB;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B;;;OAGG;IACH,GAAG,EAAE,KAAK;IACV;;;OAGG;IACH,GAAG,EAAE,KAAK;IACV;;;OAGG;IACH,GAAG,EAAE,KAAK;IACV;;;OAGG;IACH,GAAG,EAAE,KAAK;IACV;;;OAGG;IACH,GAAG,EAAE,KAAK;IACV;;;OAGG;IACH,KAAK,EAAE,OAAO;IACd;;;OAGG;IACH,GAAG,EAAE,KAAK;IACV;;;OAGG;IACH,SAAS,EAAE,WAAW;IACtB;;;OAGG;IACH,UAAU,EAAE,eAAe;IAC3B;;;OAGG;IACH,QAAQ,EAAE,aAAa;IACvB;;;OAGG;IACH,WAAW,EAAE,OAAO;IACpB;;;OAGG;IACH,MAAM,EAAE,WAAW;IACnB;;;OAGG;IACH,QAAQ,EAAE,aAAa;IACvB;;;OAGG;IACH,QAAQ,EAAE,aAAa;IACvB;;;OAGG;IACH,QAAQ,EAAE,aAAa;IACvB;;;OAGG;IACH,QAAQ,EAAE,SAAS;IACnB;;;OAGG;IACH,cAAc,EAAE,eAAe;IAC/B;;;OAGG;IACH,GAAG,EAAE,KAAK;IACV;;;OAGG;IACH,UAAU,EAAE,eAAe;CACnB,CAAC"}

package/dist/jwt-payload.g.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Decoded JWT payload — typed on every spec-driven claim with a stable
+ * top-level wire name. Mirrors the spec's `kind in {standard, d2-custom}`
+ * subset; `inside-act` claims live nested inside `act` and are not
+ * surfaced as top-level fields. The trailing `raw` field carries the
+ * untyped claim object for downstream consumers that need access to
+ * non-spec'd claims.
+ */
+export interface JwtPayload {
+    /**
+     * Subject — the user's identifier (Guid string for user tokens) or service client_id for pure service-identity tokens (RFC 6749 §4.4).
+     * Claim wire name: sub (kind: standard).
+     */
+    readonly sub?: string;
+    /**
+     * Audience — the intended recipient service identifier(s). Per RFC 7519 §4.1.3 may be a single string OR a JSON array; both wire shapes accepted.
+     * Claim wire name: aud (kind: standard).
+     */
+    readonly aud: readonly string[];
+    /**
+     * Issued-at — Unix timestamp seconds when the token was minted.
+     * Claim wire name: iat (kind: standard).
+     */
+    readonly iat?: number;
+    /**
+     * Expiry — Unix timestamp seconds after which the token is invalid.
+     * Claim wire name: exp (kind: standard).
+     */
+    readonly exp?: number;
+    /**
+     * Authorized party (RFC 7519 §4.1.7) — the OAuth client the token was issued for.
+     * Claim wire name: azp (kind: standard).
+     */
+    readonly azp?: string;
+    /**
+     * Space-separated string of granted permissions per RFC 6749 §3.3. Some authorization servers send this as a JSON array; the runtime parser accepts both shapes.
+     * Claim wire name: scope (kind: standard).
+     */
+    readonly scope?: string;
+    /**
+     * Actor chain — RFC 8693 §2.1 nested-object structure identifying the chain of services / impersonators that minted the token. Empty / absent when the token is an end-user-direct token.
+     * Claim wire name: act (kind: standard).
+     */
+    readonly act?: Readonly<Record<string, unknown>>;
+    /**
+     * OAuth client identifier of the client that requested THIS specific token from the authorization server (RFC 8693 §4.3 / RFC 9068 §2.2). Updates on every token exchange — for a multi-hop chain, this is the immediate requesting client, not the originating one.
+     * Claim wire name: client_id (kind: standard).
+     */
+    readonly client_id?: string;
+    /**
+     * User session identifier — links the token to a session record in d2-auth.
+     * Claim wire name: d2_session_id (kind: d2-custom).
+     */
+    readonly d2_session_id?: string;
+    /**
+     * Login handle — unique, lowercase username.
+     * Claim wire name: d2_username (kind: d2-custom).
+     */
+    readonly d2_username?: string;
+    /**
+     * JWT fingerprint — SHA-256 of canonical request signal (User-Agent + Accept). Used for token-binding adversarial checks.
+     * Claim wire name: d2_fp (kind: d2-custom).
+     */
+    readonly d2_fp?: string;
+    /**
+     * Operating organization identifier. During impersonation: the impersonated user's org.
+     * Claim wire name: d2_org_id (kind: d2-custom).
+     */
+    readonly d2_org_id?: string;
+    /**
+     * Operating organization display name.
+     * Claim wire name: d2_org_name (kind: d2-custom).
+     */
+    readonly d2_org_name?: string;
+    /**
+     * Operating organization type — string form of the OrgType enum.
+     * Claim wire name: d2_org_type (kind: d2-custom).
+     */
+    readonly d2_org_type?: string;
+    /**
+     * User's role in the operating organization — string form of the Role enum.
+     * Claim wire name: d2_org_role (kind: d2-custom).
+     */
+    readonly d2_org_role?: string;
+    /**
+     * Authentication Methods Reference (RFC 8176). Array of strings identifying the authentication methods used. Input to risk-scoring and audit — 'password-only vs MFA vs OAuth2-with-WebAuthn' matters for sensitive-action gating.
+     * Claim wire name: amr (kind: standard).
+     */
+    readonly amr?: string;
+    /**
+     * Unix-seconds timestamp of last step-up authentication completion. Handlers gating sensitive actions enforce 'step-up within last N minutes'. Edge auth populates from session record at JWT mint.
+     * Claim wire name: d2_step_up_at (kind: d2-custom).
+     */
+    readonly d2_step_up_at?: string;
+    /**
+     * Raw decoded claims object — escape hatch for downstream consumers
+     * that need access to non-spec'd claims.
+     */
+    readonly raw: Readonly<Record<string, unknown>>;
+}
+//# sourceMappingURL=jwt-payload.g.d.ts.map

package/dist/jwt-payload.g.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-payload.g.d.ts","sourceRoot":"","sources":["../src/jwt-payload.g.ts"],"names":[],"mappings":"AAUA;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACjD"}

package/dist/jwt-payload.g.js

@@ -0,0 +1,9 @@
+// -----------------------------------------------------------------------
+// <auto-generated>
+//   Generated by the D2 TypeScript catalog codegen — see emitter tests for coverage.
+//   Source spec: contracts/jwt-claims/jwt-claims.spec.json
+//   Manual edits will be lost on rebuild.
+// </auto-generated>
+// -----------------------------------------------------------------------
+export {};
+//# sourceMappingURL=jwt-payload.g.js.map

package/dist/jwt-payload.g.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-payload.g.js","sourceRoot":"","sources":["../src/jwt-payload.g.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mBAAmB;AACnB,qFAAqF;AACrF,2DAA2D;AAC3D,0CAA0C;AAC1C,oBAAoB;AACpB,0EAA0E"}

package/dist/protocol-audiences.g.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Protocol-audience constants emitted from
+ * contracts/auth-protocol-audiences/protocol-audiences.spec.json. These are the
+ * bare-token aud values (d2.internal, d2-edge) — NOT the URL-shaped
+ * token-exchange targets in @dcsv-io/d2-auth-abstractions' Audiences catalog. Mirrors
+ * the .NET DcsvIo.D2.Auth.Abstractions.WellKnownAudiences constants.
+ */
+export declare const ProtocolAudiences: {
+    /** The Edge self-audience for the Edge's own operations — the aud the Edge accepts on tokens minted for itself. */
+    readonly D2_EDGE_SELF_AUDIENCE: "d2-edge";
+    /** The single universal internal receive audience. The Edge mints exactly one internal transaction-token with aud=this value, and every hop validates aud == this value. It is NOT a token-exchange target (those live in auth-audiences/audiences.spec.json) — it is the universal receive audience that makes forward-unchanged possible. */
+    readonly D2_INTERNAL_AUDIENCE: "d2.internal";
+};
+export type ProtocolAudience = (typeof ProtocolAudiences)[keyof typeof ProtocolAudiences];
+/**
+ * All declared protocol-audience VALUES in spec-name-sorted order.
+ */
+export declare const ALL_PROTOCOL_AUDIENCES: readonly string[];
+//# sourceMappingURL=protocol-audiences.g.d.ts.map

package/dist/protocol-audiences.g.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-audiences.g.d.ts","sourceRoot":"","sources":["../src/protocol-audiences.g.ts"],"names":[],"mappings":"AAUA;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;IAC5B,mHAAmH;;IAEnH,+UAA+U;;CAEvU,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAE1F;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAGnD,CAAC"}

package/dist/protocol-audiences.g.js

@@ -0,0 +1,29 @@
+// -----------------------------------------------------------------------
+// <auto-generated>
+//   Generated by the D2 TypeScript catalog codegen — see emitter tests for coverage.
+//   Source spec: contracts/auth-protocol-audiences/protocol-audiences.spec.json
+//   Manual edits will be lost on rebuild.
+// </auto-generated>
+// -----------------------------------------------------------------------
+/* eslint-disable */
+/**
+ * Protocol-audience constants emitted from
+ * contracts/auth-protocol-audiences/protocol-audiences.spec.json. These are the
+ * bare-token aud values (d2.internal, d2-edge) — NOT the URL-shaped
+ * token-exchange targets in @dcsv-io/d2-auth-abstractions' Audiences catalog. Mirrors
+ * the .NET DcsvIo.D2.Auth.Abstractions.WellKnownAudiences constants.
+ */
+export const ProtocolAudiences = {
+    /** The Edge self-audience for the Edge's own operations — the aud the Edge accepts on tokens minted for itself. */
+    D2_EDGE_SELF_AUDIENCE: "d2-edge",
+    /** The single universal internal receive audience. The Edge mints exactly one internal transaction-token with aud=this value, and every hop validates aud == this value. It is NOT a token-exchange target (those live in auth-audiences/audiences.spec.json) — it is the universal receive audience that makes forward-unchanged possible. */
+    D2_INTERNAL_AUDIENCE: "d2.internal",
+};
+/**
+ * All declared protocol-audience VALUES in spec-name-sorted order.
+ */
+export const ALL_PROTOCOL_AUDIENCES = [
+    "d2-edge",
+    "d2.internal",
+];
+//# sourceMappingURL=protocol-audiences.g.js.map

package/dist/protocol-audiences.g.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-audiences.g.js","sourceRoot":"","sources":["../src/protocol-audiences.g.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mBAAmB;AACnB,qFAAqF;AACrF,gFAAgF;AAChF,0CAA0C;AAC1C,oBAAoB;AACpB,0EAA0E;AAE1E,oBAAoB;AAEpB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,mHAAmH;IACnH,qBAAqB,EAAE,SAAS;IAChC,+UAA+U;IAC/U,oBAAoB,EAAE,aAAa;CAC3B,CAAC;AAIX;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,SAAS;IACT,aAAa;CACd,CAAC"}

package/dist/scopes.g.d.ts

@@ -0,0 +1,21 @@
+/**
+ * OAuth scope catalog emitted from contracts/auth-scopes/scopes.spec.json.
+ * Tree-emitted nested constants — `Scopes.auth.user.impersonate.consent` resolves
+ * to the dot-segmented spec name.
+ */
+export declare const Scopes: {
+    readonly anon: {
+        readonly public: {
+            readonly health: "anon.public.health";
+        };
+    };
+    readonly self: {
+        readonly read: "self.read";
+        readonly write: "self.write";
+    };
+};
+/**
+ * All declared scopes in spec-sorted order.
+ */
+export declare const ALL_SCOPES: readonly string[];
+//# sourceMappingURL=scopes.g.d.ts.map

package/dist/scopes.g.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.g.d.ts","sourceRoot":"","sources":["../src/scopes.g.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;CAUT,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAIvC,CAAC"}

package/dist/scopes.g.js

@@ -0,0 +1,33 @@
+// -----------------------------------------------------------------------
+// <auto-generated>
+//   Generated by the D2 TypeScript catalog codegen — see emitter tests for coverage.
+//   Source spec: contracts/auth-scopes/scopes.spec.json
+//   Manual edits will be lost on rebuild.
+// </auto-generated>
+// -----------------------------------------------------------------------
+/* eslint-disable */
+/**
+ * OAuth scope catalog emitted from contracts/auth-scopes/scopes.spec.json.
+ * Tree-emitted nested constants — `Scopes.auth.user.impersonate.consent` resolves
+ * to the dot-segmented spec name.
+ */
+export const Scopes = {
+    anon: {
+        public: {
+            health: "anon.public.health",
+        },
+    },
+    self: {
+        read: "self.read",
+        write: "self.write",
+    },
+};
+/**
+ * All declared scopes in spec-sorted order.
+ */
+export const ALL_SCOPES = [
+    "anon.public.health",
+    "self.read",
+    "self.write",
+];
+//# sourceMappingURL=scopes.g.js.map

package/dist/scopes.g.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.g.js","sourceRoot":"","sources":["../src/scopes.g.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,mBAAmB;AACnB,qFAAqF;AACrF,wDAAwD;AACxD,0CAA0C;AAC1C,oBAAoB;AACpB,0EAA0E;AAE1E,oBAAoB;AAEpB;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,IAAI,EAAE;QACJ,MAAM,EAAE;YACN,MAAM,EAAE,oBAAoB;SAC7B;KACF;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,YAAY;KACpB;CACO,CAAC;AAEX;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAsB;IAC3C,oBAAoB;IACpB,WAAW;IACX,YAAY;CACb,CAAC"}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@dcsv-io/d2-auth-abstractions",
+  "version": "0.1.1",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@dcsv-io/d2-i18n-abstractions": "0.1.1",
+    "@dcsv-io/d2-i18n-keys": "0.1.1",
+    "@dcsv-io/d2-error-category": "0.1.1",
+    "@dcsv-io/d2-result": "0.1.1"
+  },
+  "devDependencies": {
+    "@vitest/coverage-v8": "4.0.18",
+    "typescript": "5.9.3",
+    "vitest": "4.0.18"
+  },
+  "scripts": {
+    "prebuild": "node ../../scripts/run-ts-codegen.mjs src/auth-scopes-emit.ts && node ../../scripts/run-ts-codegen.mjs src/error-codes-emit.ts && node ../../scripts/run-ts-codegen.mjs src/jwt-claims-emit.ts",
+    "build": "tsc -b",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "type-check:test": "tsc -p tsconfig.test.json"
+  }
+}