@salamandradevs/core 0.1.3 → 0.2.0

package/dist/keys/openbao/schema.js

@@ -0,0 +1,67 @@
+import { z } from 'zod';
+/**
+ * OpenBao key namespace, request policy, and connection schema.
+ *
+ * - TransitMount: Transit secrets-engine mount.
+ * - KvMount: KV v2 secrets-engine mount.
+ * - StatePath: KV path containing lifecycle state.
+ * - KeyNamePrefix: Prefix for provider-managed Transit keys.
+ * - RequestTimeoutMs: Deadline applied to every OpenBao HTTP request.
+ * - RefreshCooldownSecs: Minimum time between two re-reads of the lifecycle document
+ *   triggered by an unknown `kid`.
+ * - BaoAddr: OpenBao origin without embedded credentials; read from `BAO_ADDR`.
+ * - BaoToken: Runtime OpenBao token; a secret, read from `BAO_TOKEN`.
+ *
+ * @remarks
+ * `baoAddr` and `baoToken` are marked `.meta({ env })`, so `loadEnvVariables` resolves them
+ * from `BAO_ADDR` and `BAO_TOKEN` and hands the values to the provider; the configuration
+ * file holds only placeholders, so the token never appears in the config object.
+ */
+export const openBaoSigningKeysConfigSchema = z
+    .object({
+    transitMount: z.string().min(1),
+    kvMount: z.string().min(1),
+    statePath: z.string().min(1),
+    keyNamePrefix: z.string().min(1),
+    requestTimeoutMs: z.number().int().positive().default(10_000),
+    refreshCooldownSecs: z.number().int().positive(),
+    baoAddr: z.url({ error: 'is required and must be a URL' }).meta({ env: 'BAO_ADDR' }),
+    baoToken: z
+        .string({ error: 'is required' })
+        .min(1, 'must not be empty')
+        .meta({ env: 'BAO_TOKEN' })
+})
+    .strict();
+/**
+ * KV v2 lifecycle-state read response schema.
+ *
+ * - Data: KV envelope carrying the stored document and its version metadata.
+ *
+ * @remarks
+ * OpenBao wraps every logical response in an envelope carrying `request_id`, `lease_id`,
+ * `lease_duration`, `renewable`, `warnings`, `wrap_info`, `auth` and `mount_type`, and the
+ * version metadata adds `created_time`, `custom_metadata`, `deletion_time` and `destroyed`.
+ * None of these response schemas may be `strict`, because those unmodelled fields are
+ * always present. Verified against OpenBao 2.7.0.
+ */
+export const openBaoKvReadResponseSchema = z.object({
+    data: z.object({
+        data: z.record(z.string(), z.unknown()),
+        metadata: z.object({ version: z.number().int().positive() })
+    })
+});
+/**
+ * Transit signing response schema.
+ *
+ * - Data: JWS-formatted signature returned by Transit.
+ */
+export const openBaoTransitSignResponseSchema = z.object({
+    data: z.object({ signature: z.string().min(1) })
+});
+/**
+ * OpenBao error response schema.
+ *
+ * - Errors: Sanitized error messages returned by OpenBao.
+ */
+export const openBaoErrorResponseSchema = z.object({ errors: z.array(z.string()) });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2tleXMvb3BlbmJhby9zY2hlbWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLENBQUMsRUFBRSxNQUFNLEtBQUssQ0FBQztBQUV4Qjs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FpQkc7QUFDSCxNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUFDO0tBQzVDLE1BQU0sQ0FBQztJQUNOLFlBQVksRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUMvQixPQUFPLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDMUIsU0FBUyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzVCLGFBQWEsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNoQyxnQkFBZ0IsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQztJQUM3RCxtQkFBbUIsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxFQUFFLENBQUMsUUFBUSxFQUFFO0lBQ2hELE9BQU8sRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLEVBQUUsS0FBSyxFQUFFLCtCQUErQixFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDcEYsUUFBUSxFQUFFLENBQUM7U0FDUixNQUFNLENBQUMsRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLENBQUM7U0FDaEMsR0FBRyxDQUFDLENBQUMsRUFBRSxtQkFBbUIsQ0FBQztTQUMzQixJQUFJLENBQUMsRUFBRSxHQUFHLEVBQUUsV0FBVyxFQUFFLENBQUM7Q0FDOUIsQ0FBQztLQUNELE1BQU0sRUFBRSxDQUFDO0FBRVo7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDO0lBQ2xELElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDO1FBQ2IsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUN2QyxRQUFRLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQztLQUM3RCxDQUFDO0NBQ0gsQ0FBQyxDQUFDO0FBRUg7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDdkQsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0NBQ2pELENBQUMsQ0FBQztBQUVIOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDIn0=

package/dist/keys/openbao/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMva2V5cy9vcGVuYmFvL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist/keys/schema.js

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+/**
+ * Public JSON Web Key material schema.
+ *
+ * - Kty: Key type.
+ * - Kid: Public key identifier.
+ * - Use: Optional intended key use.
+ * - Alg: Optional JOSE algorithm.
+ * - Crv: Optional elliptic curve name.
+ * - X: Optional elliptic-curve or RSA coordinate.
+ * - Y: Optional elliptic-curve coordinate.
+ * - N: Optional RSA modulus.
+ * - E: Optional RSA exponent.
+ *
+ * @remarks
+ * Provider-neutral: this is the public key as served to every key consumer, so it carries
+ * no provider-specific fields. Shared across every signing-key provider so each validates
+ * the lifecycle document against one definition.
+ * @group Keys
+ * @category Key Providers
+ */
+export const publicJwkSchema = z
+    .object({
+    kty: z.string(),
+    kid: z.string().min(1),
+    use: z.string().optional(),
+    alg: z.string().optional(),
+    crv: z.string().optional(),
+    x: z.string().optional(),
+    y: z.string().optional(),
+    n: z.string().optional(),
+    e: z.string().optional()
+})
+    .strict();
+/**
+ * Durable signing-key lifecycle document schema.
+ *
+ * - CurrentKid: Identifier of the sole active key.
+ * - Keys: Complete provider-managed key lifecycle.
+ *
+ * @remarks
+ * The neutral contract every provider's durable store must satisfy. Behavioural invariants
+ * beyond this shape (exactly one active key, status-consistent timestamps) live in
+ * {@link validateSigningKeyState}.
+ * @group Keys
+ * @category Key Providers
+ */
+export const signingKeyStateSchema = z
+    .object({
+    currentKid: z.string().min(1).nullable(),
+    keys: z.array(z
+        .object({
+        kid: z.string().min(1),
+        providerKeyId: z.string().min(1),
+        status: z.enum(['pending', 'active', 'retired']),
+        publicJwk: publicJwkSchema,
+        activateAfter: z.string().pipe(z.iso.datetime()),
+        activatedAt: z.string().pipe(z.iso.datetime()).nullable(),
+        retiredAt: z.string().pipe(z.iso.datetime()).nullable(),
+        verifyUntil: z.string().pipe(z.iso.datetime()).nullable()
+    })
+        .strict())
+})
+    .strict();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2tleXMvc2NoZW1hLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxDQUFDLEVBQUUsTUFBTSxLQUFLLENBQUM7QUFFeEI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FtQkc7QUFDSCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQztLQUM3QixNQUFNLENBQUM7SUFDTixHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRTtJQUNmLEdBQUcsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUN0QixHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUMxQixHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUMxQixHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUMxQixDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUN4QixDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUN4QixDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUN4QixDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtDQUN6QixDQUFDO0tBQ0QsTUFBTSxFQUFFLENBQUM7QUFFWjs7Ozs7Ozs7Ozs7O0dBWUc7QUFDSCxNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDO0tBQ25DLE1BQU0sQ0FBQztJQUNOLFVBQVUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUN4QyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FDWCxDQUFDO1NBQ0UsTUFBTSxDQUFDO1FBQ04sR0FBRyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ3RCLGFBQWEsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNoQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDaEQsU0FBUyxFQUFFLGVBQWU7UUFDMUIsYUFBYSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNoRCxXQUFXLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsUUFBUSxFQUFFO1FBQ3pELFNBQVMsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUU7UUFDdkQsV0FBVyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRTtLQUMxRCxDQUFDO1NBQ0QsTUFBTSxFQUFFLENBQ1o7Q0FDRixDQUFDO0tBQ0QsTUFBTSxFQUFFLENBQUMifQ==

package/dist/keys/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMva2V5cy90eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/dist/keys/validation.js

@@ -0,0 +1,100 @@
+import { CustomError } from '@salamandradevs/tools/shared';
+import { signingKeyStateSchema } from './schema.js';
+/**
+ * Parses the signing-key lifecycle document and enforces every invariant providers rely on.
+ *
+ * @remarks
+ * Shared by every signing-key provider so the lifecycle invariants have one definition:
+ * unique identifiers, an ES256 P-256 public JWK per entry whose `kid` matches its entry,
+ * status-consistent timestamps, exactly one active key, at most one pending key, and a
+ * `currentKid` that names the active key. Nothing downstream re-checks any of this, so a
+ * failure here is fatal on purpose.
+ * @group Keys
+ * @category Key Providers
+ * @param value - Raw lifecycle document read from a provider's durable store.
+ * @param algorithm - JOSE algorithm every published key must declare.
+ * @returns Validated signing-key state.
+ * @throws {CustomError} KEYS_PROVIDER_ERROR when any signing-key invariant fails.
+ */
+export function validateSigningKeyState(value, algorithm) {
+    const candidate = signingKeyStateSchema.parse(value);
+    const keys = candidate.keys;
+    const kids = new Set();
+    const providerKeyIds = new Set();
+    for (const entry of keys) {
+        // Duplicates would make `kid` lookup ambiguous and could point two entries at one signing
+        // key, so retiring one would destroy the other's material.
+        if (kids.has(entry.kid) || providerKeyIds.has(entry.providerKeyId)) {
+            throw new CustomError({
+                name: 'KEYS_PROVIDER_ERROR',
+                message: 'Signing-key lifecycle state contains duplicate key identifiers'
+            });
+        }
+        kids.add(entry.kid);
+        providerKeyIds.add(entry.providerKeyId);
+        // The JWK is served verbatim to every token consumer, so it must be exactly an ES256
+        // P-256 verification key whose `kid` matches the entry that carries it.
+        if (entry.publicJwk.kty !== 'EC' ||
+            entry.publicJwk.crv !== 'P-256' ||
+            entry.publicJwk.alg !== algorithm ||
+            entry.publicJwk.use !== 'sig' ||
+            entry.publicJwk.kid !== entry.kid ||
+            !entry.publicJwk.x ||
+            !entry.publicJwk.y) {
+            throw new CustomError({
+                name: 'KEYS_PROVIDER_ERROR',
+                message: 'Signing-key lifecycle state contains an invalid public JWK'
+            });
+        }
+        validateEntryTimestamps(entry);
+    }
+    const active = keys.filter((entry) => entry.status === 'active');
+    const pending = keys.filter((entry) => entry.status === 'pending');
+    // Exactly one active key, because issuance picks it by status alone; at most one pending,
+    // because a second would be promoted into a key the first already replaced.
+    if (active.length !== 1 || pending.length > 1) {
+        throw new CustomError({
+            name: 'KEYS_PROVIDER_ERROR',
+            message: 'Signing-key lifecycle state must contain one active and at most one pending key'
+        });
+    }
+    // `currentKid` is redundant with the active entry, which makes it a useful cross-check that
+    // a hand-written or externally provisioned document did not leave the two disagreeing.
+    if (candidate.currentKid !== active[0].kid) {
+        throw new CustomError({
+            name: 'KEYS_PROVIDER_ERROR',
+            message: 'Signing-key lifecycle state has an invalid current key'
+        });
+    }
+    return { currentKid: candidate.currentKid, keys };
+}
+/**
+ * Enforces the timestamps each signing-key status permits, and their chronological order.
+ *
+ * @param entry - Signing-key entry to check.
+ * @throws {CustomError} KEYS_PROVIDER_ERROR when the entry carries timestamps its status
+ *   forbids.
+ */
+function validateEntryTimestamps(entry) {
+    // Each status implies exactly which timestamps may be set. Checking this here is what lets
+    // the rest of the system treat a present `verifyUntil` as proof the entry is retired.
+    const pendingIsClean = entry.activatedAt === null && entry.retiredAt === null && entry.verifyUntil === null;
+    const activeIsClean = entry.activatedAt !== null && entry.retiredAt === null && entry.verifyUntil === null;
+    const retiredIsOrdered = entry.activatedAt !== null &&
+        entry.retiredAt !== null &&
+        entry.verifyUntil !== null &&
+        Date.parse(entry.activatedAt) <= Date.parse(entry.retiredAt) &&
+        Date.parse(entry.retiredAt) <= Date.parse(entry.verifyUntil);
+    const valid = entry.status === 'pending'
+        ? pendingIsClean
+        : entry.status === 'active'
+            ? activeIsClean
+            : retiredIsOrdered;
+    if (!valid) {
+        throw new CustomError({
+            name: 'KEYS_PROVIDER_ERROR',
+            message: `Signing-key lifecycle entry '${entry.kid}' has timestamps its status forbids`
+        });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9rZXlzL3ZhbGlkYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRTNELE9BQU8sRUFBRSxxQkFBcUIsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUdwRDs7Ozs7Ozs7Ozs7Ozs7O0dBZUc7QUFDSCxNQUFNLFVBQVUsdUJBQXVCLENBQ3JDLEtBQWMsRUFDZCxTQUFrQjtJQUVsQixNQUFNLFNBQVMsR0FBb0IscUJBQXFCLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3RFLE1BQU0sSUFBSSxHQUErQixTQUFTLENBQUMsSUFBSSxDQUFDO0lBQ3hELE1BQU0sSUFBSSxHQUFnQixJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQzVDLE1BQU0sY0FBYyxHQUFnQixJQUFJLEdBQUcsRUFBVSxDQUFDO0lBRXRELEtBQUssTUFBTSxLQUFLLElBQUksSUFBSSxFQUFFLENBQUM7UUFDekIsMEZBQTBGO1FBQzFGLDJEQUEyRDtRQUMzRCxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLGNBQWMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7WUFDbkUsTUFBTSxJQUFJLFdBQVcsQ0FBQztnQkFDcEIsSUFBSSxFQUFFLHFCQUFxQjtnQkFDM0IsT0FBTyxFQUFFLGdFQUFnRTthQUMxRSxDQUFDLENBQUM7UUFDTCxDQUFDO1FBRUQsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDcEIsY0FBYyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUM7UUFFeEMscUZBQXFGO1FBQ3JGLHdFQUF3RTtRQUN4RSxJQUNFLEtBQUssQ0FBQyxTQUFTLENBQUMsR0FBRyxLQUFLLElBQUk7WUFDNUIsS0FBSyxDQUFDLFNBQVMsQ0FBQyxHQUFHLEtBQUssT0FBTztZQUMvQixLQUFLLENBQUMsU0FBUyxDQUFDLEdBQUcsS0FBSyxTQUFTO1lBQ2pDLEtBQUssQ0FBQyxTQUFTLENBQUMsR0FBRyxLQUFLLEtBQUs7WUFDN0IsS0FBSyxDQUFDLFNBQVMsQ0FBQyxHQUFHLEtBQUssS0FBSyxDQUFDLEdBQUc7WUFDakMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDbEIsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsRUFDbEIsQ0FBQztZQUNELE1BQU0sSUFBSSxXQUFXLENBQUM7Z0JBQ3BCLElBQUksRUFBRSxxQkFBcUI7Z0JBQzNCLE9BQU8sRUFBRSw0REFBNEQ7YUFDdEUsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELHVCQUF1QixDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2pDLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBc0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQztJQUNwRixNQUFNLE9BQU8sR0FBc0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQztJQUV0RiwwRkFBMEY7SUFDMUYsNEVBQTRFO0lBQzVFLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM5QyxNQUFNLElBQUksV0FBVyxDQUFDO1lBQ3BCLElBQUksRUFBRSxxQkFBcUI7WUFDM0IsT0FBTyxFQUNMLGlGQUFpRjtTQUNwRixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsNEZBQTRGO0lBQzVGLHVGQUF1RjtJQUN2RixJQUFJLFNBQVMsQ0FBQyxVQUFVLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQzNDLE1BQU0sSUFBSSxXQUFXLENBQUM7WUFDcEIsSUFBSSxFQUFFLHFCQUFxQjtZQUMzQixPQUFPLEVBQUUsd0RBQXdEO1NBQ2xFLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxPQUFPLEVBQUUsVUFBVSxFQUFFLFNBQVMsQ0FBQyxVQUFVLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFDcEQsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILFNBQVMsdUJBQXVCLENBQUMsS0FBc0I7SUFDckQsMkZBQTJGO0lBQzNGLHNGQUFzRjtJQUN0RixNQUFNLGNBQWMsR0FDbEIsS0FBSyxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksS0FBSyxDQUFDLFNBQVMsS0FBSyxJQUFJLElBQUksS0FBSyxDQUFDLFdBQVcsS0FBSyxJQUFJLENBQUM7SUFDdkYsTUFBTSxhQUFhLEdBQ2pCLEtBQUssQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssSUFBSSxJQUFJLEtBQUssQ0FBQyxXQUFXLEtBQUssSUFBSSxDQUFDO0lBQ3ZGLE1BQU0sZ0JBQWdCLEdBQ3BCLEtBQUssQ0FBQyxXQUFXLEtBQUssSUFBSTtRQUMxQixLQUFLLENBQUMsU0FBUyxLQUFLLElBQUk7UUFDeEIsS0FBSyxDQUFDLFdBQVcsS0FBSyxJQUFJO1FBQzFCLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUM1RCxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUUvRCxNQUFNLEtBQUssR0FDVCxLQUFLLENBQUMsTUFBTSxLQUFLLFNBQVM7UUFDeEIsQ0FBQyxDQUFDLGNBQWM7UUFDaEIsQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUTtZQUN6QixDQUFDLENBQUMsYUFBYTtZQUNmLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQztJQUV6QixJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDWCxNQUFNLElBQUksV0FBVyxDQUFDO1lBQ3BCLElBQUksRUFBRSxxQkFBcUI7WUFDM0IsT0FBTyxFQUFFLGdDQUFnQyxLQUFLLENBQUMsR0FBRyxxQ0FBcUM7U0FDeEYsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztBQUNILENBQUMifQ==

package/dist/runtime/context.js

@@ -0,0 +1,42 @@
+import { CustomError } from '@salamandradevs/tools/shared';
+import { AsyncLocalStorage } from 'node:async_hooks';
+// Async local storage backing the ambient execution context for the current async scope.
+const executionContextStorage = new AsyncLocalStorage();
+/**
+ * Runs one callback with the supplied execution context bound to the current async scope.
+ *
+ * @remarks
+ * The context is visible to every asynchronous operation started within `callback` and is
+ * torn down when it returns, so nested calls to {@link getExecutionCtx} resolve the same
+ * identity without explicit propagation. Transport middleware wraps request handling in
+ * this call.
+ * @group Utils
+ * @category Execution Context
+ * @param context - Execution context for the current request or job.
+ * @param callback - Work executed while the context is available.
+ * @returns The callback return value.
+ */
+export function runWithExecutionCtx(context, callback) {
+    return executionContextStorage.run(context, callback);
+}
+/**
+ * Reads the current execution context.
+ *
+ * @group Utils
+ * @category Execution Context
+ * @returns The active {@link ExecutionContext} for the current async scope.
+ * @throws {CustomError} RESOURCE_NOT_FOUND when called outside a {@link runWithExecutionCtx}
+ *   scope, so no context is bound.
+ */
+export function getExecutionCtx() {
+    const context = executionContextStorage.getStore();
+    if (!context) {
+        throw new CustomError({
+            name: 'RESOURCE_NOT_FOUND',
+            message: 'Execution context is not available',
+            cause: 'Async local storage could not get the execution context'
+        });
+    }
+    return context;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udGV4dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9ydW50aW1lL2NvbnRleHQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzNELE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBOENyRCx5RkFBeUY7QUFDekYsTUFBTSx1QkFBdUIsR0FDM0IsSUFBSSxpQkFBaUIsRUFBb0IsQ0FBQztBQUU1Qzs7Ozs7Ozs7Ozs7OztHQWFHO0FBQ0gsTUFBTSxVQUFVLG1CQUFtQixDQUFJLE9BQXlCLEVBQUUsUUFBaUI7SUFDakYsT0FBTyx1QkFBdUIsQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0FBQ3hELENBQUM7QUFFRDs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sVUFBVSxlQUFlO0lBQzdCLE1BQU0sT0FBTyxHQUFpQyx1QkFBdUIsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUVqRixJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDYixNQUFNLElBQUksV0FBVyxDQUFDO1lBQ3BCLElBQUksRUFBRSxvQkFBb0I7WUFDMUIsT0FBTyxFQUFFLG9DQUFvQztZQUM3QyxLQUFLLEVBQUUseURBQXlEO1NBQ2pFLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDIn0=

package/dist/runtime/index.js

@@ -0,0 +1,2 @@
+export * from './context.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcnVudGltZS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGNBQWMsQ0FBQyJ9

package/dist/storage/records-handler.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { getExecutionCtx } from '../utils/context.js';
+import { getExecutionCtx } from '../runtime/context.js';
 /**
  * Base record handler that applies tenant scope and delegates persistence to an
  * {@link ICrud} adapter.
@@ -137,4 +137,4 @@ export class RecordsHandler {
         return this.crud.find({ ...criteria, tenantId }, findOptions);
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVjb3Jkcy1oYW5kbGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3N0b3JhZ2UvcmVjb3Jkcy1oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFFekMsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBTXREOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLE9BQWdCLGNBQWM7SUFRYjtJQUNGO0lBUm5COzs7OztPQUtHO0lBQ0gsWUFDcUIsSUFBYyxFQUNoQixXQUE2QjtRQUQzQixTQUFJLEdBQUosSUFBSSxDQUFVO1FBQ2hCLGdCQUFXLEdBQVgsV0FBVyxDQUFrQjtJQUM3QyxDQUFDO0lBRUo7Ozs7Ozs7Ozs7T0FVRztJQUNILE1BQU0sQ0FBQyxNQUE0QjtRQUNqQyxNQUFNLEVBQUUsYUFBYSxFQUFFLEdBQUcsZUFBZSxFQUFFLENBQUM7UUFDNUMsTUFBTSxHQUFHLEdBQVMsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUU3QixPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1lBQ3RCLEdBQUcsTUFBTTtZQUNULFdBQVcsRUFBRSxJQUFJLENBQUMsV0FBVztZQUM3QixRQUFRLEVBQUUsYUFBYSxDQUFDLFFBQVE7WUFDaEMsUUFBUSxFQUFFLFVBQVUsRUFBRTtZQUN0QixTQUFTLEVBQUUsR0FBRztZQUNkLFNBQVMsRUFBRSxhQUFhLENBQUMsT0FBTztZQUNoQyxTQUFTLEVBQUUsR0FBRztZQUNkLFNBQVMsRUFBRSxhQUFhLENBQUMsT0FBTztTQUM1QixDQUFDLENBQUM7SUFDVixDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0gsSUFBSSxDQUFDLFFBQWdCO1FBQ25CLE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFckQsTUFBTSxRQUFRLEdBQWU7WUFDM0IsUUFBUTtZQUNSLFFBQVE7U0FDSyxDQUFDO1FBRWhCLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEMsQ0FBQztJQUVEOzs7Ozs7Ozs7OztPQVdHO0lBQ0gsTUFBTSxDQUFDLFFBQWdCLEVBQUUsT0FBeUI7UUFDaEQsTUFBTSxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFOUQsTUFBTSxRQUFRLEdBQWU7WUFDM0IsUUFBUTtZQUNSLFFBQVE7U0FDSyxDQUFDO1FBRWhCLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFO1lBQ2hDLEdBQUcsT0FBTztZQUNWLFNBQVMsRUFBRSxJQUFJLElBQUksRUFBRTtZQUNyQixTQUFTLEVBQUUsT0FBTztTQUNuQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7T0FVRztJQUNILE1BQU0sQ0FBQyxRQUFnQjtRQUNyQixNQUFNLEVBQUUsUUFBUSxFQUFFLEdBQUcsZUFBZSxFQUFFLENBQUMsYUFBYSxDQUFDO1FBRXJELE1BQU0sUUFBUSxHQUFlO1lBQzNCLFFBQVE7WUFDUixRQUFRO1NBQ0ssQ0FBQztRQUVoQixPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7O09BWUc7SUFDSCxJQUFJLENBQUMsV0FBdUIsRUFBRSxFQUFFLE9BQTBCO1FBQ3hELE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFckQsTUFBTSxTQUFTLEdBQXlCO1lBQ3RDLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFO1lBQ3pDLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFO1NBQ3pDLENBQUM7UUFFRixNQUFNLFdBQVcsR0FBbUI7WUFDbEMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUEyQjtZQUMzQyxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUs7WUFDcEIsT0FBTyxFQUFFLFNBQVM7U0FDbkIsQ0FBQztRQUVGLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLFFBQVEsRUFBRSxRQUFRLEVBQUUsRUFBRSxXQUFXLENBQUMsQ0FBQztJQUNoRSxDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVjb3Jkcy1oYW5kbGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3N0b3JhZ2UvcmVjb3Jkcy1oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFFekMsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBTXhEOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLE9BQWdCLGNBQWM7SUFRYjtJQUNGO0lBUm5COzs7OztPQUtHO0lBQ0gsWUFDcUIsSUFBYyxFQUNoQixXQUE2QjtRQUQzQixTQUFJLEdBQUosSUFBSSxDQUFVO1FBQ2hCLGdCQUFXLEdBQVgsV0FBVyxDQUFrQjtJQUM3QyxDQUFDO0lBRUo7Ozs7Ozs7Ozs7T0FVRztJQUNILE1BQU0sQ0FBQyxNQUE0QjtRQUNqQyxNQUFNLEVBQUUsYUFBYSxFQUFFLEdBQUcsZUFBZSxFQUFFLENBQUM7UUFDNUMsTUFBTSxHQUFHLEdBQVMsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUU3QixPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1lBQ3RCLEdBQUcsTUFBTTtZQUNULFdBQVcsRUFBRSxJQUFJLENBQUMsV0FBVztZQUM3QixRQUFRLEVBQUUsYUFBYSxDQUFDLFFBQVE7WUFDaEMsUUFBUSxFQUFFLFVBQVUsRUFBRTtZQUN0QixTQUFTLEVBQUUsR0FBRztZQUNkLFNBQVMsRUFBRSxhQUFhLENBQUMsT0FBTztZQUNoQyxTQUFTLEVBQUUsR0FBRztZQUNkLFNBQVMsRUFBRSxhQUFhLENBQUMsT0FBTztTQUM1QixDQUFDLENBQUM7SUFDVixDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0gsSUFBSSxDQUFDLFFBQWdCO1FBQ25CLE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFckQsTUFBTSxRQUFRLEdBQWU7WUFDM0IsUUFBUTtZQUNSLFFBQVE7U0FDSyxDQUFDO1FBRWhCLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEMsQ0FBQztJQUVEOzs7Ozs7Ozs7OztPQVdHO0lBQ0gsTUFBTSxDQUFDLFFBQWdCLEVBQUUsT0FBeUI7UUFDaEQsTUFBTSxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFOUQsTUFBTSxRQUFRLEdBQWU7WUFDM0IsUUFBUTtZQUNSLFFBQVE7U0FDSyxDQUFDO1FBRWhCLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFO1lBQ2hDLEdBQUcsT0FBTztZQUNWLFNBQVMsRUFBRSxJQUFJLElBQUksRUFBRTtZQUNyQixTQUFTLEVBQUUsT0FBTztTQUNuQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7T0FVRztJQUNILE1BQU0sQ0FBQyxRQUFnQjtRQUNyQixNQUFNLEVBQUUsUUFBUSxFQUFFLEdBQUcsZUFBZSxFQUFFLENBQUMsYUFBYSxDQUFDO1FBRXJELE1BQU0sUUFBUSxHQUFlO1lBQzNCLFFBQVE7WUFDUixRQUFRO1NBQ0ssQ0FBQztRQUVoQixPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7O09BWUc7SUFDSCxJQUFJLENBQUMsV0FBdUIsRUFBRSxFQUFFLE9BQTBCO1FBQ3hELE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFckQsTUFBTSxTQUFTLEdBQXlCO1lBQ3RDLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFO1lBQ3pDLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFO1NBQ3pDLENBQUM7UUFFRixNQUFNLFdBQVcsR0FBbUI7WUFDbEMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUEyQjtZQUMzQyxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUs7WUFDcEIsT0FBTyxFQUFFLFNBQVM7U0FDbkIsQ0FBQztRQUVGLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLFFBQVEsRUFBRSxRQUFRLEVBQUUsRUFBRSxXQUFXLENBQUMsQ0FBQztJQUNoRSxDQUFDO0NBQ0YifQ==

package/dist/tokens/access-token-verifier.js

@@ -0,0 +1,75 @@
+import { decodeProtectedHeader, jwtVerify } from 'jose';
+import { CustomError } from '@salamandradevs/tools/shared';
+import { accessTokenClaimsSchema } from './schema.js';
+/**
+ * Verifies platform access tokens and reconstructs their session grant.
+ *
+ * @remarks
+ * Checks the protected header, resolves the public key by `kid` through the injected
+ * {@link IVerificationKeyProvider}, verifies signature, issuer, audience, and expiry with
+ * `jose`, then parses the claims with {@link accessTokenClaimsSchema}.
+ * @group Tokens
+ * @category Access Tokens
+ */
+export class AccessTokenVerifier {
+    config;
+    keys;
+    /**
+     * @param config - Issuer, audience, and clock tolerance every token must satisfy.
+     * @param keys - Source of public verification keys by `kid`.
+     */
+    constructor(config, keys) {
+        this.config = config;
+        this.keys = keys;
+    }
+    /**
+     * Verifies one bearer access token.
+     *
+     * @param credential - Bearer credential selected by the transport layer.
+     * @returns Trusted session grant read from the token claims.
+     * @throws {CustomError} AUTHENTICATION_FAILED when the token is malformed, signed by an
+     *   unknown key, expired, or carries incomplete claims.
+     * @throws {CustomError} EXTERNAL_API_ERROR or CONFIG_ERROR when the key provider fails;
+     *   propagated unchanged.
+     */
+    async verify(credential) {
+        try {
+            const header = decodeProtectedHeader(credential.token);
+            if (header.kid === undefined || header.alg !== 'ES256' || header.typ !== 'JWT') {
+                throw new Error('JWT protected header is invalid');
+            }
+            const key = await this.keys.getPublicKey(header.kid);
+            if (!key) {
+                throw new Error('JWT signing key is unknown');
+            }
+            const { payload } = await jwtVerify(credential.token, key, {
+                algorithms: ['ES256'],
+                issuer: this.config.issuer,
+                audience: this.config.audience,
+                clockTolerance: this.config.clockToleranceSecs
+            });
+            const claims = accessTokenClaimsSchema.parse(payload);
+            return {
+                sessionId: claims.sid,
+                subject: claims.sub,
+                actorId: claims.actorId,
+                tenantId: claims.tenantId,
+                roles: claims.roles
+            };
+        }
+        catch (error) {
+            // An infrastructure fault keeps its classification, so a key-source outage is
+            // never reported as an invalid credential.
+            if (error instanceof CustomError &&
+                (error.name === 'EXTERNAL_API_ERROR' || error.name === 'CONFIG_ERROR')) {
+                throw error;
+            }
+            throw new CustomError({
+                name: 'AUTHENTICATION_FAILED',
+                message: 'Credentials verification failed',
+                cause: error
+            });
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjZXNzLXRva2VuLXZlcmlmaWVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3Rva2Vucy9hY2Nlc3MtdG9rZW4tdmVyaWZpZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLHFCQUFxQixFQUFFLFNBQVMsRUFBRSxNQUFNLE1BQU0sQ0FBQztBQUN4RCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFHM0QsT0FBTyxFQUFFLHVCQUF1QixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBUXREOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sT0FBTyxtQkFBbUI7SUFNWDtJQUNBO0lBTm5COzs7T0FHRztJQUNILFlBQ21CLE1BQStCLEVBQy9CLElBQThCO1FBRDlCLFdBQU0sR0FBTixNQUFNLENBQXlCO1FBQy9CLFNBQUksR0FBSixJQUFJLENBQTBCO0lBQzlDLENBQUM7SUFFSjs7Ozs7Ozs7O09BU0c7SUFDSCxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQXVCO1FBQ2xDLElBQUksQ0FBQztZQUNILE1BQU0sTUFBTSxHQUE4QixxQkFBcUIsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7WUFFbEYsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLE9BQU8sSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLEtBQUssRUFBRSxDQUFDO2dCQUMvRSxNQUFNLElBQUksS0FBSyxDQUFDLGlDQUFpQyxDQUFDLENBQUM7WUFDckQsQ0FBQztZQUVELE1BQU0sR0FBRyxHQUFxQixNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUV2RSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7Z0JBQ1QsTUFBTSxJQUFJLEtBQUssQ0FBQyw0QkFBNEIsQ0FBQyxDQUFDO1lBQ2hELENBQUM7WUFFRCxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxTQUFTLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUU7Z0JBQ3pELFVBQVUsRUFBRSxDQUFDLE9BQU8sQ0FBQztnQkFDckIsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTTtnQkFDMUIsUUFBUSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUTtnQkFDOUIsY0FBYyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsa0JBQWtCO2FBQy9DLENBQUMsQ0FBQztZQUNILE1BQU0sTUFBTSxHQUFzQix1QkFBdUIsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7WUFFekUsT0FBTztnQkFDTCxTQUFTLEVBQUUsTUFBTSxDQUFDLEdBQUc7Z0JBQ3JCLE9BQU8sRUFBRSxNQUFNLENBQUMsR0FBRztnQkFDbkIsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO2dCQUN2QixRQUFRLEVBQUUsTUFBTSxDQUFDLFFBQVE7Z0JBQ3pCLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSzthQUNwQixDQUFDO1FBQ0osQ0FBQztRQUFDLE9BQU8sS0FBYyxFQUFFLENBQUM7WUFDeEIsOEVBQThFO1lBQzlFLDJDQUEyQztZQUMzQyxJQUNFLEtBQUssWUFBWSxXQUFXO2dCQUM1QixDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssb0JBQW9CLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxjQUFjLENBQUMsRUFDdEUsQ0FBQztnQkFDRCxNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7WUFFRCxNQUFNLElBQUksV0FBVyxDQUFDO2dCQUNwQixJQUFJLEVBQUUsdUJBQXVCO2dCQUM3QixPQUFPLEVBQUUsaUNBQWlDO2dCQUMxQyxLQUFLLEVBQUUsS0FBSzthQUNiLENBQUMsQ0FBQztRQUNMLENBQUM7SUFDSCxDQUFDO0NBQ0YifQ==

package/dist/tokens/contracts.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udHJhY3RzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3Rva2Vucy9jb250cmFjdHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/tokens/index.js

@@ -0,0 +1,5 @@
+export * from './access-token-verifier.js';
+export * from './contracts.js';
+export * from './schema.js';
+export * from './types.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdG9rZW5zL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQyJ9

package/dist/tokens/schema.js

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+/**
+ * Access-token verification policy every verifier shares with the issuer.
+ *
+ * - Issuer: Required `iss`, the issuing service's base URL.
+ * - Audience: Required `aud`.
+ * - ClockToleranceSecs: Allowed clock skew when checking `exp` and `iat`.
+ */
+export const accessTokenVerifyConfigSchema = z
+    .object({
+    issuer: z.url(),
+    audience: z.string().min(1),
+    clockToleranceSecs: z.number().int().nonnegative()
+})
+    .strict();
+/**
+ * Platform claims carried by every access token.
+ *
+ * - Sid: Server-side session identifier.
+ * - Sub: Authenticated subject.
+ * - ActorId: Local actor represented by the session.
+ * - TenantId: Tenant the session belongs to.
+ * - Roles: Roles granted to the session.
+ *
+ * @remarks
+ * Not strict: `jwtVerify` already checks the registered claims (`iss`, `aud`, `iat`,
+ * `exp`), and parsing strips them.
+ */
+export const accessTokenClaimsSchema = z.object({
+    sid: z.string(),
+    sub: z.string(),
+    actorId: z.string(),
+    tenantId: z.string(),
+    roles: z.array(z.string().min(1))
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3Rva2Vucy9zY2hlbWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLENBQUMsRUFBRSxNQUFNLEtBQUssQ0FBQztBQUV4Qjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxDQUFDO0tBQzNDLE1BQU0sQ0FBQztJQUNOLE1BQU0sRUFBRSxDQUFDLENBQUMsR0FBRyxFQUFFO0lBQ2YsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzNCLGtCQUFrQixFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxXQUFXLEVBQUU7Q0FDbkQsQ0FBQztLQUNELE1BQU0sRUFBRSxDQUFDO0FBRVo7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUM5QyxHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRTtJQUNmLEdBQUcsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFO0lBQ2YsT0FBTyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUU7SUFDbkIsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUU7SUFDcEIsS0FBSyxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztDQUNsQyxDQUFDLENBQUMifQ==

package/dist/tokens/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdG9rZW5zL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salamandradevs/core",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "Shared record layer and database contracts",
   "type": "module",
   "packageManager": "pnpm@12.16.1",
@@ -47,6 +47,7 @@
   ],
   "dependencies": {
     "@salamandradevs/tools": "^0.1.0",
+    "jose": "^6.2.12",
     "mongodb": "^7.6.0",
     "mysql2": "^3.23.4",
     "zod": "^4.5.4"

package/types/index.d.ts

@@ -1,4 +1,6 @@
 export * from './storage/index.js';
 export * from './infra/database/index.js';
-export * from './utils/index.js';
+export * from './keys/index.js';
+export * from './tokens/index.js';
+export * from './runtime/index.js';
 //# sourceMappingURL=index.d.ts.map

package/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}

package/types/infra/database/contracts.d.ts

@@ -18,6 +18,8 @@ export interface IDatabaseProvider {
      * Opens the underlying connection and caches its backend-tagged handle.
      *
      * @returns The connected database handle.
+     * @throws {CustomError} DB_BACKEND_ERROR when the server is unreachable or rejects the
+     *   connection; the driver error is kept as the cause.
      */
     connect(): Promise<DatabaseHandle>;
     /**
@@ -45,7 +47,13 @@ export interface IDatabaseProvider {
  * @template THandle - Raw driver handle produced by `connect`.
  */
 export interface IDbConnection<THandle> {
-    /** Opens the database connection and returns the backend handle. */
+    /**
+     * Opens the database connection and returns the backend handle.
+     *
+     * @returns The connected raw driver handle.
+     * @throws {CustomError} DB_BACKEND_ERROR when the server is unreachable or rejects the
+     *   connection; the driver error is kept as the cause.
+     */
     connect(): Promise<THandle>;
     /** Closes the database connection. */
     close(): Promise<void>;

package/types/infra/database/contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../src/infra/database/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAEnC,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAEnC;;;;OAIG;IACH,SAAS,IAAI,cAAc,CAAC;IAE5B;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa,CAAC,OAAO;IACpC,oEAAoE;IACpE,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5B,sCAAsC;IACtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAQ,CAAC,OAAO,EAAE,MAAM,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;IAChE,yCAAyC;IACzC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErC,mDAAmD;IACnD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5D,kEAAkE;IAClE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE1E,iCAAiC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,2BAA2B;IAC3B,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE9B,qDAAqD;IACrD,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9C,uDAAuD;IACvD,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAErE,uDAAuD;IACvD,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEhD,6EAA6E;IAC7E,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;CAC7E;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB,CAAC,IAAI;IACvC;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../src/infra/database/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAEnC,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC;;;;;;OAMG;IACH,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAEnC;;;;OAIG;IACH,SAAS,IAAI,cAAc,CAAC;IAE5B;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa,CAAC,OAAO;IACpC;;;;;;OAMG;IACH,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5B,sCAAsC;IACtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,QAAQ,CAAC,OAAO,EAAE,MAAM,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;IAChE,yCAAyC;IACzC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErC,mDAAmD;IACnD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5D,kEAAkE;IAClE,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE1E,iCAAiC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,2BAA2B;IAC3B,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAE9B,qDAAqD;IACrD,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9C,uDAAuD;IACvD,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAErE,uDAAuD;IACvD,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEhD,6EAA6E;IAC7E,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;CAC7E;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB,CAAC,IAAI;IACvC;;;;;OAKG;IACH,SAAS,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/types/infra/database/database-provider.d.ts

@@ -33,6 +33,8 @@ export declare class DatabaseProvider implements IDatabaseProvider {
      * without a matching `case` fails the `never` exhaustiveness check. Calling it again
      * reconnects and replaces the cached handle.
      * @returns The connected database handle.
+     * @throws {CustomError} DB_BACKEND_ERROR when the server is unreachable or rejects the
+     *   connection; propagated from the backend connection.
      */
     connect(): Promise<DatabaseHandle>;
     /**

package/types/infra/database/database-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database-provider.d.ts","sourceRoot":"","sources":["../../../src/infra/database/database-provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAElE;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,iBAAiB;aAatC,OAAO,EAAE,eAAe;IAZ1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwC;IACnE,OAAO,CAAC,MAAM,CAA+B;IAE7C;;;;;;;OAOG;gBAEe,OAAO,EAAE,eAAe,EACxC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM;IA4BtB;;;;;;;;;OASG;IACG,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC;IA2BxC;;;;;;OAMG;IACH,SAAS,IAAI,cAAc;IAW3B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"database-provider.d.ts","sourceRoot":"","sources":["../../../src/infra/database/database-provider.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAElE;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,YAAW,iBAAiB;aAatC,OAAO,EAAE,eAAe;IAZ1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAwC;IACnE,OAAO,CAAC,MAAM,CAA+B;IAE7C;;;;;;;OAOG;gBAEe,OAAO,EAAE,eAAe,EACxC,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM;IA4BtB;;;;;;;;;;;OAWG;IACG,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC;IA2BxC;;;;;;OAMG;IACH,SAAS,IAAI,cAAc;IAW3B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/types/infra/database/mongo/mongo-db-connection.d.ts

@@ -27,6 +27,8 @@ export declare class MongoDbConnection implements IDbConnection<Db> {
      * Opens the Mongo connection and returns the database handle.
      *
      * @returns Connected Mongo database handle.
+     * @throws {CustomError} DB_BACKEND_ERROR when the server is unreachable or rejects the
+     *   connection; the driver error is kept as the cause.
      */
     connect(): Promise<Db>;
     /**

package/types/infra/database/mongo/mongo-db-connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mongo-db-connection.d.ts","sourceRoot":"","sources":["../../../../src/infra/database/mongo/mongo-db-connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,EAAE,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;GASG;AACH,qBAAa,iBAAkB,YAAW,aAAa,CAAC,EAAE,CAAC;IAavD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAbzB,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAG,SAAS,CAAU;IAEtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IAErC;;;;;OAKG;gBAEgB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM;IAKjC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;IAK5B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"mongo-db-connection.d.ts","sourceRoot":"","sources":["../../../../src/infra/database/mongo/mongo-db-connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,EAAE,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;GASG;AACH,qBAAa,iBAAkB,YAAW,aAAa,CAAC,EAAE,CAAC;IAavD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAbzB,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAG,SAAS,CAAU;IAEtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IAErC;;;;;OAKG;gBAEgB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM;IAKjC;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;IAc5B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/types/infra/database/mysql/mysql-db-connection.d.ts

@@ -27,6 +27,8 @@ export declare class MySqlDbConnection implements IDbConnection<Pool> {
      * Opens the MySQL connection and returns the backend handle.
      *
      * @returns Connected MySQL backend handle.
+     * @throws {CustomError} DB_BACKEND_ERROR when the server is unreachable or rejects the
+     *   connection; the driver error is kept as the cause.
      */
     connect(): Promise<Pool>;
     /**

package/types/infra/database/mysql/mysql-db-connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mysql-db-connection.d.ts","sourceRoot":"","sources":["../../../../src/infra/database/mysql/mysql-db-connection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;GASG;AACH,qBAAa,iBAAkB,YAAW,aAAa,CAAC,IAAI,CAAC;IAazD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAb/B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAG,OAAO,CAAU;IAEpC,OAAO,CAAC,IAAI,CAAqB;IAEjC;;;;;OAKG;gBAEgB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM;IAGvC;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAW9B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ7B"}
+{"version":3,"file":"mysql-db-connection.d.ts","sourceRoot":"","sources":["../../../../src/infra/database/mysql/mysql-db-connection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;GASG;AACH,qBAAa,iBAAkB,YAAW,aAAa,CAAC,IAAI,CAAC;IAazD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAb/B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAG,OAAO,CAAU;IAEpC,OAAO,CAAC,IAAI,CAAqB;IAEjC;;;;;OAKG;gBAEgB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM;IAGvC;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB9B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ7B"}

package/types/keys/config/index.d.ts

@@ -0,0 +1,3 @@
+export * from './schema.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/types/keys/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/keys/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}