@kindgi/api 0.0.0-bootstrap.0 → 0.1.1

package/dist/hitl-binding.d.ts

@@ -0,0 +1,115 @@
+import type { ReviewerRole } from '@kindgi/authz';
+import type { ApprovalId, Cursor, ProjectId, ProvenanceId, Result, ReviewerId, RunId, TenantId, Timestamp } from '@kindgi/types';
+export type ApprovalStatus = 'pending' | 'assigned' | 'in_review' | 'approved' | 'rejected' | 'escalated' | 'expired' | 'withdrawn';
+export type ReviewDecisionKind = 'approve' | 'reject' | 'escalate' | 'withdraw';
+export interface Approval {
+    readonly id: ApprovalId;
+    readonly tenantId: TenantId;
+    readonly projectId?: ProjectId;
+    readonly subjectKind: string;
+    readonly subjectRef: Readonly<Record<string, unknown>>;
+    readonly requiredRole: ReviewerRole;
+    readonly status: ApprovalStatus;
+    readonly assignedTo?: ReviewerId;
+    readonly batchKey?: string;
+    readonly title?: string;
+    readonly description?: string;
+    readonly context?: Readonly<Record<string, unknown>>;
+    readonly provenanceRef?: {
+        readonly runId: RunId;
+        readonly provenanceId?: ProvenanceId;
+    };
+    readonly waitTokenId?: string;
+    readonly createdAt: Timestamp;
+    readonly updatedAt: Timestamp;
+    readonly decidedAt?: Timestamp;
+    readonly expiresAt?: Timestamp;
+}
+export interface ReviewDecision {
+    readonly id: string;
+    readonly tenantId: TenantId;
+    readonly approvalId: ApprovalId;
+    readonly reviewerId: ReviewerId;
+    readonly decision: ReviewDecisionKind;
+    readonly rationale?: string;
+    readonly evidence?: Readonly<Record<string, unknown>>;
+    readonly reviewerRoleAtDecision: ReviewerRole;
+    readonly decidedAt: Timestamp;
+}
+export interface ListApprovalsBindingInput {
+    readonly tenantId: TenantId;
+    readonly limit: number;
+    readonly status?: ApprovalStatus;
+    readonly requiredRole?: ReviewerRole;
+    readonly since?: Timestamp;
+    readonly cursor?: Cursor;
+}
+export interface ListApprovalsBindingResult {
+    readonly approvals: readonly Approval[];
+    readonly nextCursor?: Cursor;
+}
+export interface SubmitReviewBindingInput {
+    readonly tenantId: TenantId;
+    readonly approvalId: ApprovalId;
+    readonly reviewerId: ReviewerId;
+    readonly decision: ReviewDecisionKind;
+    readonly rationale?: string;
+}
+/**
+ * Two shapes: `terminal` — reviewer's decision terminated the approval;
+ * `escalated` — a new higher-tier approval was opened. Consumers narrow
+ * `nextApproval` via the discriminant.
+ */
+export type SubmitReviewBindingResult = {
+    readonly kind: 'terminal';
+    readonly approval: Approval;
+    readonly decision: ReviewDecision;
+} | {
+    readonly kind: 'escalated';
+    readonly approval: Approval;
+    readonly decision: ReviewDecision;
+    readonly nextApproval: Approval;
+};
+/**
+ * A single review-decision row hydrated for the audit-bundle route.
+ * `null` = the approval terminated without a recorded decision (e.g.
+ * status `expired`).
+ */
+export interface ReviewDecisionRecord {
+    readonly decision: ReviewDecisionKind;
+    readonly reviewerId: ReviewerId;
+    readonly reviewerRoleAtDecision: ReviewerRole;
+    readonly decidedAt: Timestamp;
+    readonly rationale?: string;
+}
+/**
+ * Structural error surface returned by `HitlBinding` methods.
+ * Implementations emit these codes (`approval-not-found`,
+ * `reviewer-not-found`, `reviewer-deactivated`, `insufficient-role`,
+ * `approval-terminal`, `approval-already-decided`, `invalid-transition`,
+ * `persistence-error`) — the routes pass them through to `statusFor()` /
+ * `toWireError()`, which key off the string.
+ */
+export interface HitlBindingError {
+    readonly code: string;
+    readonly message: string;
+    readonly [key: string]: unknown;
+}
+/**
+ * Approvals data-access binding. Every method takes typed inputs and
+ * returns `Promise<Result<T, HitlBindingError>>`. The implementation
+ * owns its storage, so callers never touch it directly; the Kindgi
+ * runtime provides one.
+ */
+export interface HitlBinding {
+    getApproval(tenantId: TenantId, approvalId: ApprovalId): Promise<Result<Approval, HitlBindingError>>;
+    listApprovals(input: ListApprovalsBindingInput): Promise<Result<ListApprovalsBindingResult, HitlBindingError>>;
+    submitReview(input: SubmitReviewBindingInput): Promise<Result<SubmitReviewBindingResult, HitlBindingError>>;
+    /**
+     * Hydrate the recorded decision row for an approval — used by the
+     * audit-bundle route. Returns `null` when the approval terminated
+     * without a recorded decision (status `expired`).
+     */
+    loadReviewDecision(tenantId: TenantId, approvalId: ApprovalId): Promise<Result<ReviewDecisionRecord | null, HitlBindingError>>;
+}
+//# sourceMappingURL=hitl-binding.d.ts.map

package/dist/hitl-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-binding.d.ts","sourceRoot":"","sources":["../src/hitl-binding.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,UAAU,EACV,MAAM,EACN,SAAS,EACT,YAAY,EACZ,MAAM,EACN,UAAU,EACV,KAAK,EACL,QAAQ,EACR,SAAS,EACV,MAAM,eAAe,CAAC;AAIvB,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,UAAU,GACV,WAAW,GACX,UAAU,GACV,UAAU,GACV,WAAW,GACX,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,CAAC;AAEhF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,aAAa,CAAC,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,sBAAsB,EAAE,YAAY,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAID,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,GAC7F;IACE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;CACjC,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,YAAY,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAID;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,WAAW,CACT,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE/C,aAAa,CACX,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,MAAM,CAAC,0BAA0B,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEjE,YAAY,CACV,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEhE;;;;OAIG;IACH,kBAAkB,CAChB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,UAAU,GACrB,OAAO,CAAC,MAAM,CAAC,oBAAoB,GAAG,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;CACnE"}

package/dist/hitl-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=hitl-binding.js.map

package/dist/hitl-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-binding.js","sourceRoot":"","sources":["../src/hitl-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/identity-directory-binding.d.ts

@@ -0,0 +1,116 @@
+import type { Cursor, TenantId, Timestamp, UserId } from '@kindgi/types';
+/**
+ * Caller-plugged surface for the tenant-scoped identity directory —
+ * part of the admin control plane. Closes the "who is my
+ * user" gap the session-auth flow leaves open: the session store
+ * (`SessionStoreBinding`) knows about the sessions a user has, and the
+ * identity provider (`IdentityProviderBinding`) knows how to
+ * authenticate them, but neither answers the "list every user in this
+ * tenant" / "show me a user's profile" / "revoke all a user's active
+ * sessions" question this binding covers.
+ *
+ * Registry-only over HTTP — the framework does NOT own user
+ * persistence. Deployments plug in an LDAP / SCIM / IdP-mirror /
+ * bespoke store behind this binding.
+ *
+ * Same caller-plugged pattern as every other admin-plane binding
+ * (`PolicyRegistryBinding`, `ProviderRegistryBinding`, ...).
+ *
+ * The directory is flat. Groups / roles / RBAC / invitations /
+ * audit history / LDAP+SCIM sync / impersonation are not part of this
+ * binding.
+ */
+export interface IdentityDirectoryBinding {
+    /**
+     * Look up a specific user by id. Returns `null` when unknown —
+     * the route surfaces `null` as `404 identity-user-not-found`.
+     */
+    getUser(input: IdentityGetUserInput): Promise<UserRecord | null>;
+    /**
+     * Cursor-paginated list of users in the tenant. Optional `query`
+     * is a prefix match on `displayName` — the natural filter shape
+     * for a "search users" surface. Sort order is binding-defined (e.g.
+     * ascending by `userId`).
+     */
+    listUsers(input: IdentityListUsersInput): Promise<UserCollectionPage>;
+    /**
+     * List the active (non-revoked, non-expired) sessions for a user.
+     * Implementations may return the full list; `nextCursor` is optional
+     * on the response, so an implementation can paginate without a wire
+     * change.
+     *
+     * When the user id is unknown, an empty list is returned rather
+     * than a not-found. Callers who need the distinction should call
+     * `getUser` first.
+     */
+    listSessions(input: IdentityListSessionsInput): Promise<SessionSummaryPage>;
+    /**
+     * Admin op: revoke every active session for a user. Returns the
+     * count of sessions revoked (0 when the user was already fully
+     * signed out — idempotent). Under the hood, deployments typically
+     * delegate to `SessionStoreBinding.revokeAllForUser`.
+     */
+    revokeAllSessions(input: IdentityRevokeSessionsInput): Promise<RevokeSessionsResult>;
+}
+export interface IdentityGetUserInput {
+    readonly tenantId: TenantId;
+    readonly userId: UserId;
+}
+export interface IdentityListUsersInput {
+    readonly tenantId: TenantId;
+    readonly limit: number;
+    readonly cursor?: Cursor;
+    /** Prefix match on `UserRecord.displayName`. Undefined = no filter. */
+    readonly query?: string;
+}
+export interface IdentityListSessionsInput {
+    readonly tenantId: TenantId;
+    readonly userId: UserId;
+}
+export interface IdentityRevokeSessionsInput {
+    readonly tenantId: TenantId;
+    readonly userId: UserId;
+}
+/**
+ * The tenant-scoped user record on the wire. `primaryEmail` may be
+ * redacted by the binding based on tenant policy — the routes treat
+ * the field as opaque and return whatever the binding hands back.
+ * `metadata` is free-form JSON (e.g. IdP claims, provisioning source,
+ * roles).
+ */
+export interface UserRecord {
+    readonly userId: UserId;
+    readonly tenantId: TenantId;
+    readonly primaryEmail?: string;
+    readonly displayName?: string;
+    readonly createdAt: Timestamp;
+    readonly lastActiveAt?: Timestamp;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface UserCollectionPage {
+    readonly data: readonly UserRecord[];
+    readonly nextCursor?: Cursor;
+}
+/**
+ * Wire-safe subset of `Session` (from `session-store-binding.ts`).
+ * Excludes the opaque provider `accessToken` / `refreshToken` — those
+ * never cross the wire, even to admins.
+ */
+export interface SessionSummary {
+    readonly sessionId: string;
+    readonly userId: UserId;
+    readonly providerId: string;
+    readonly createdAt: Timestamp;
+    readonly expiresAt: Timestamp;
+    readonly scopes: readonly string[];
+    readonly revokedAt?: Timestamp;
+}
+export interface SessionSummaryPage {
+    readonly data: readonly SessionSummary[];
+    readonly nextCursor?: Cursor;
+}
+export interface RevokeSessionsResult {
+    readonly userId: UserId;
+    readonly revokedCount: number;
+}
+//# sourceMappingURL=identity-directory-binding.d.ts.map

package/dist/identity-directory-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-directory-binding.d.ts","sourceRoot":"","sources":["../src/identity-directory-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACjE;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtE;;;;;;;;;OASG;IACH,YAAY,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5E;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACtF;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}

package/dist/identity-directory-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=identity-directory-binding.js.map

package/dist/identity-directory-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-directory-binding.js","sourceRoot":"","sources":["../src/identity-directory-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/identity-provider-binding.d.ts

@@ -0,0 +1,184 @@
+import type { TenantId } from '@kindgi/types';
+/**
+ * Caller-plugged catalog of OAuth 2.0 / OIDC identity providers the
+ * deployment offers to its tenants. Same pattern as
+ * `ProviderRegistryBinding` (model providers) — the API package does
+ * NOT own provider persistence, and secrets never cross the wire.
+ *
+ * A `ProviderConfig` carries ONLY a `clientSecretRef` — an opaque
+ * pointer that the deployment resolves server-side (env-var lookup,
+ * secrets-manager path, KMS handle, etc.). The plaintext client secret
+ * is exchanged with the identity provider inside the deployment's
+ * boundary during the code→token exchange in `/v1/auth/callback` and
+ * never surfaces on any HTTP response.
+ *
+ * PKCE is mandatory (S256). Providers that don't support PKCE are
+ * rejected at boot; the framework does NOT emit `code_challenge_method`
+ * negotiation.
+ */
+export interface IdentityProviderBinding {
+    list(input: IdentityProviderListInput): Promise<IdentityProviderPage>;
+    get(input: IdentityProviderGetInput): Promise<ProviderConfig | null>;
+    register(input: IdentityProviderRegisterInput): Promise<IdentityProviderRegisterOutcome>;
+    unregister(input: IdentityProviderUnregisterInput): Promise<IdentityProviderUnregisterOutcome>;
+}
+export type IdentityProviderKind = 'oauth2' | 'oidc';
+export interface ProviderConfig {
+    /** Stable string chosen by the deployment (e.g. `acme-sso`, `globex-oidc`). */
+    readonly providerId: string;
+    readonly kind: IdentityProviderKind;
+    readonly clientId: string;
+    /**
+     * Opaque pointer resolved server-side. Never a plaintext secret. The
+     * shape (env-var name / secrets-manager path / KMS handle) is a
+     * deployment convention, not a framework one.
+     */
+    readonly clientSecretRef: string;
+    readonly authorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly userinfoEndpoint?: string;
+    readonly scopes: readonly string[];
+    /**
+     * OAuth 2.1 BCP redirect-URI allowlist. When present and non-empty,
+     * `POST /v1/auth/login/:providerId` rejects any `redirectUri` (whether
+     * supplied in the body or resolved from `metadata.defaultRedirectUri`)
+     * that is not an exact match to a list entry — 400
+     * `redirect-uri-not-allowed`. `POST /v1/auth/callback/:providerId`
+     * cross-checks the state row's stored `redirect_uri` against the same
+     * list — 400 `redirect-uri-mismatch` if the allowlist was tightened
+     * between login and callback. Absent or empty → any redirect_uri is
+     * accepted (pass-through; deployments MUST populate
+     * this to reach OAuth 2.1 BCP compliance).
+     *
+     * Exact-string match, not prefix or regex — the OAuth 2.1 BCP
+     * mandates literal comparison to prevent redirect-URI injection.
+     */
+    readonly allowedRedirectUris?: readonly string[];
+    /**
+     * Optional per-provider claim mapping. When present, the `ExchangeCodeFn`
+     * / `RefreshTokenFn` implementations translate provider claims into the
+     * Kindgi `Session` shape according to this spec. Absent → pass-
+     * through (provider `sub` → `userId`, `email` → `email`, `name` →
+     * `displayName`, scopes come from the token response). A deployment's
+     * own `ExchangeCodeFn` MAY honor this field the same way.
+     */
+    readonly claimMapping?: ClaimMappingSpec;
+    readonly metadata?: Record<string, unknown>;
+}
+/**
+ * How provider claims map into Kindgi's session shape. All fields
+ * are optional — the closer a provider's claim naming is to the OIDC
+ * defaults (`sub` / `email` / `name`), the fewer overrides the
+ * deployment needs. Field values are dot-path claim references
+ * relative to the provider's userinfo / id_token payload:
+ *
+ * - `"sub"` reads top-level `sub`.
+ * - `"profile.email"` reads `payload.profile.email` (dot-navigated).
+ * - `"https://acme.com/roles"` reads the raw claim under that URI-
+ *   shaped key (namespaced custom claims — no dot navigation).
+ *
+ * The scopes case is a discriminated shape because scope claims in
+ * the wild come as either space-separated strings, comma-separated,
+ * or a JSON array — the `delimiter` field lets deployments say how to
+ * split. When omitted (or the resolved claim is already an array),
+ * splitting is skipped.
+ */
+export interface ClaimMappingSpec {
+    /** Provider claim path for the Kindgi `userId`. Default: `sub`. */
+    readonly userId?: string;
+    /** Provider claim path for the caller's email. Default: `email`. */
+    readonly email?: string;
+    /** Provider claim path for the caller's display name. Default: `name`. */
+    readonly displayName?: string;
+    /**
+     * Provider claim path + optional delimiter for the Kindgi OAuth
+     * scopes list. When absent, scopes come from the OAuth token
+     * response `scope` field, not from claims.
+     */
+    readonly scopes?: ClaimMappingScopesSpec;
+    /**
+     * Extra claim paths to preserve verbatim on `Session.metadata`.
+     * Values are copied as-is. Absent → all claims flow through in
+     * `metadata`.
+     */
+    readonly metadata?: readonly string[];
+}
+export interface ClaimMappingScopesSpec {
+    /** Claim path for the raw scopes value. */
+    readonly claim: string;
+    /**
+     * When the resolved claim is a string, split on this delimiter to
+     * produce the scopes array. When absent, split on any whitespace.
+     * Ignored when the resolved claim is already an array.
+     */
+    readonly delimiter?: string;
+}
+export interface IdentityProviderListInput {
+    readonly tenantId: TenantId;
+}
+export interface IdentityProviderPage {
+    readonly data: readonly ProviderConfig[];
+}
+export interface IdentityProviderGetInput {
+    readonly tenantId: TenantId;
+    readonly providerId: string;
+}
+export interface IdentityProviderRegisterInput {
+    readonly tenantId: TenantId;
+    readonly config: ProviderConfig;
+}
+export type IdentityProviderRegisterOutcome = {
+    readonly kind: 'ok';
+    readonly providerId: string;
+};
+export interface IdentityProviderUnregisterInput {
+    readonly tenantId: TenantId;
+    readonly providerId: string;
+}
+export interface IdentityProviderUnregisterOutcome {
+    readonly unregistered: boolean;
+}
+/**
+ * Result of the OAuth code→session exchange the callback route delegates
+ * to the identity provider. Distinct from `SessionCreateInput` because
+ * the framework decides the `SessionId` (opaque), while the provider
+ * decides `userId` / `accessToken` / `scopes`.
+ */
+export interface ExchangeCodeInput {
+    readonly tenantId: TenantId;
+    readonly providerId: string;
+    readonly code: string;
+    readonly codeVerifier: string;
+    readonly redirectUri: string;
+}
+export interface ExchangeCodeOutcome {
+    readonly userId: string;
+    readonly accessToken: string;
+    readonly refreshToken?: string;
+    readonly expiresAt: Date;
+    readonly scopes: readonly string[];
+    readonly claims?: Record<string, unknown>;
+}
+/**
+ * Optional companion binding used by `POST /v1/auth/callback` and
+ * `POST /v1/auth/refresh`. Deployments that only implement provider
+ * registry CRUD (and want to run the exchange themselves) can inline
+ * this closure via `CreateAppInput.exchangeCode`. A typical
+ * implementation calls the provider `tokenEndpoint` with PKCE +
+ * client-secret client authentication.
+ */
+export type ExchangeCodeFn = (input: ExchangeCodeInput) => Promise<ExchangeCodeOutcome>;
+/**
+ * Optional refresh-token exchange. When present, `POST /v1/auth/refresh`
+ * rotates the underlying provider tokens before minting a new session
+ * token. When absent, the refresh route simply revokes the old session
+ * and re-issues a session token with the same expiry (still useful for
+ * key rotation on the framework side even when the provider stays put).
+ */
+export interface RefreshTokenInput {
+    readonly tenantId: TenantId;
+    readonly providerId: string;
+    readonly refreshToken: string;
+}
+export type RefreshTokenFn = (input: RefreshTokenInput) => Promise<ExchangeCodeOutcome>;
+//# sourceMappingURL=identity-provider-binding.d.ts.map

package/dist/identity-provider-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider-binding.d.ts","sourceRoot":"","sources":["../src/identity-provider-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACtE,GAAG,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACzF,UAAU,CAAC,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;CAChG;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,cAAc,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC"}

package/dist/identity-provider-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=identity-provider-binding.js.map

package/dist/identity-provider-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-provider-binding.js","sourceRoot":"","sources":["../src/identity-provider-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/image-registry-binding.d.ts

@@ -0,0 +1,165 @@
+import type { Result, TenantId } from '@kindgi/types';
+/**
+ * Caller-plugged surface for the OCI image registry — the "Docker
+ * Registry HTTP API v2 client" seam used by the deploy route's
+ * image-verifiability step. Mirrors the caller-plugged pattern of
+ * `BlobStorageBinding`: the API package does NOT own registry auth or
+ * connectivity. Deployments plug in an adapter that talks to whichever
+ * OCI registry they run — hosted or self-hosted — using the credentials
+ * they operate.
+ *
+ * Three ops per the OCI Distribution Spec:
+ *   - `head`         — read manifest metadata (digest, config, layer
+ *                      digests, size) without pulling bytes. Used at
+ *                      `POST /v1/deployments` to verify the pinned
+ *                      digest exists + matches what the deployer signed.
+ *   - `extractFile`  — pull the bytes of a single file inside the image
+ *                      (typically `/app/index.json`) without downloading
+ *                      every layer. Used by the deploy route to verify
+ *                      `indexHash` matches `sha256(image's index.json)`.
+ *   - `push`         — upload a locally-built image + tag. Used by an
+ *                      image build step; the API only reads.
+ *
+ * Each method is tenant-scoped so multi-tenant deployments can route
+ * different tenants at different registries (or the same registry with
+ * per-tenant credentials).
+ *
+ * ## Seam only
+ *
+ * No concrete implementation is bundled; the `POST /v1/deployments`
+ * route calls `head` + `extractFile` through this interface.
+ */
+export interface ImageRegistryBinding {
+    /**
+     * Read the OCI image manifest for a digest-pinned reference. Returns
+     * `image-not-found` when the registry has no manifest at the given
+     * digest; `image-registry-unreachable` on transport / auth failure.
+     *
+     * The route MUST verify that `descriptor.digest` matches the digest
+     * inside `input.imageRef` — the binding is not responsible for that
+     * cross-check (defense-in-depth against a compromised registry).
+     */
+    head(input: ImageHeadInput): Promise<Result<ImageDescriptor, ImageRegistryError>>;
+    /**
+     * Fetch the bytes of a single file inside the image's layered
+     * filesystem. Implementations stream from the highest layer that
+     * contains the path — e.g. traverse layers top-down and return the
+     * first hit. `bytes` is streamed as a
+     * `Uint8Array` (small files only — `/app/index.json` is expected to
+     * be a few kilobytes to low megabytes).
+     *
+     * Returns `image-file-not-found` when no layer contains the path,
+     * `image-not-found` when the ref itself is unresolvable.
+     */
+    extractFile(input: ImageExtractFileInput): Promise<Result<ImageFile, ImageRegistryError>>;
+    /**
+     * Push a locally-built image + tag. Used by the build service, not by
+     * the API — but the interface exposes it so the same binding
+     * satisfies both consumers (a single deployment operator can wire one
+     * adapter across the whole framework).
+     *
+     * `bytes` is an OCI image archive (`docker save`-compatible tarball
+     * or a streaming OCI layout). The binding walks it, uploads each
+     * blob + manifest, and tags the final digest. Returns the resolved
+     * digest-pinned reference for the caller to sign over.
+     */
+    push(input: ImagePushInput): Promise<Result<ImagePushOutcome, ImageRegistryError>>;
+}
+/**
+ * Slice of the OCI manifest the API layer + build service need. Keeps
+ * the interface stable against future spec revisions — bindings extract
+ * the parts every consumer cares about and hide the rest.
+ */
+export interface ImageDescriptor {
+    /** `sha256:<hex>` — canonical image digest, matches `imageRef`. */
+    readonly digest: string;
+    /** OCI media type of the manifest (`application/vnd.oci.image.manifest.v1+json` etc.). */
+    readonly mediaType: string;
+    /** Total on-wire size in bytes across all layers + config. */
+    readonly size: number;
+    /** Layer descriptors, top-to-bottom (the order used at pull time). */
+    readonly layers: readonly ImageLayerDescriptor[];
+    /** Image config descriptor (histories, env, entrypoint, etc.). */
+    readonly config: ImageBlobDescriptor;
+    /** `platform` from the manifest (e.g. `linux/amd64`). */
+    readonly platform?: ImagePlatform;
+}
+export interface ImageLayerDescriptor {
+    readonly digest: string;
+    readonly mediaType: string;
+    readonly size: number;
+}
+export type ImageBlobDescriptor = ImageLayerDescriptor;
+export interface ImagePlatform {
+    readonly os: string;
+    readonly architecture: string;
+    readonly variant?: string;
+}
+export interface ImageHeadInput {
+    readonly tenantId: TenantId;
+    /** Full digest-pinned reference: `<host>/<repo>@sha256:<hex>`. */
+    readonly imageRef: string;
+}
+export interface ImageExtractFileInput {
+    readonly tenantId: TenantId;
+    readonly imageRef: string;
+    /**
+     * Absolute path inside the image's layered filesystem. Convention:
+     * leading slash + POSIX separators (`/app/index.json`).
+     */
+    readonly path: string;
+}
+export interface ImageFile {
+    readonly path: string;
+    readonly bytes: Uint8Array;
+    /** `sha256` hex, lowercase — computed over `bytes` by the binding. */
+    readonly sha256: string;
+    /** Layer digest the file was found in — useful for audit logs. */
+    readonly layerDigest: string;
+}
+export interface ImagePushInput {
+    readonly tenantId: TenantId;
+    /**
+     * Unresolved reference the pusher requests — usually
+     * `<host>/<repo>:<tag>`. The binding uploads the archive and returns
+     * the digest-pinned form on success.
+     */
+    readonly imageRef: string;
+    /** OCI image archive bytes. */
+    readonly bytes: ReadableStream<Uint8Array> | Uint8Array;
+    /** Optional annotations the binding forwards to the registry. */
+    readonly annotations?: Readonly<Record<string, string>>;
+}
+export interface ImagePushOutcome {
+    /** Digest-pinned reference the caller signs against. */
+    readonly imageRef: string;
+    readonly digest: string;
+    readonly size: number;
+}
+/**
+ * Discriminated error union. The deploy route reports any of these as
+ * `400 image-unverifiable` ("we could not verify this image"), carrying
+ * the binding's `code` as `cause`.
+ */
+export type ImageRegistryError = {
+    readonly code: 'image-not-found';
+    readonly message: string;
+    readonly imageRef: string;
+} | {
+    readonly code: 'image-file-not-found';
+    readonly message: string;
+    readonly imageRef: string;
+    readonly path: string;
+} | {
+    readonly code: 'image-registry-unreachable';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'image-registry-unauthorized';
+    readonly message: string;
+} | {
+    readonly code: 'image-push-failed';
+    readonly message: string;
+    readonly cause?: unknown;
+};
+//# sourceMappingURL=image-registry-binding.d.ts.map

package/dist/image-registry-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-registry-binding.d.ts","sourceRoot":"","sources":["../src/image-registry-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAClF;;;;;;;;;;OAUG;IACH,WAAW,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC1F;;;;;;;;;;OAUG;IACH,IAAI,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC,CAAC;CACpF;AAID;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACjD,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAID,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+BAA+B;IAC/B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;IACxD,iEAAiE;IACjE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAID;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC"}

package/dist/image-registry-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=image-registry-binding.js.map

package/dist/image-registry-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-registry-binding.js","sourceRoot":"","sources":["../src/image-registry-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}