@salamandradevs/core 0.1.4 → 0.2.0

package/dist/keys/schema.js

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+/**
+ * Public JSON Web Key material schema.
+ *
+ * - Kty: Key type.
+ * - Kid: Public key identifier.
+ * - Use: Optional intended key use.
+ * - Alg: Optional JOSE algorithm.
+ * - Crv: Optional elliptic curve name.
+ * - X: Optional elliptic-curve or RSA coordinate.
+ * - Y: Optional elliptic-curve coordinate.
+ * - N: Optional RSA modulus.
+ * - E: Optional RSA exponent.
+ *
+ * @remarks
+ * Provider-neutral: this is the public key as served to every key consumer, so it carries
+ * no provider-specific fields. Shared across every signing-key provider so each validates
+ * the lifecycle document against one definition.
+ * @group Keys
+ * @category Key Providers
+ */
+export const publicJwkSchema = z
+    .object({
+    kty: z.string(),
+    kid: z.string().min(1),
+    use: z.string().optional(),
+    alg: z.string().optional(),
+    crv: z.string().optional(),
+    x: z.string().optional(),
+    y: z.string().optional(),
+    n: z.string().optional(),
+    e: z.string().optional()
+})
+    .strict();
+/**
+ * Durable signing-key lifecycle document schema.
+ *
+ * - CurrentKid: Identifier of the sole active key.
+ * - Keys: Complete provider-managed key lifecycle.
+ *
+ * @remarks
+ * The neutral contract every provider's durable store must satisfy. Behavioural invariants
+ * beyond this shape (exactly one active key, status-consistent timestamps) live in
+ * {@link validateSigningKeyState}.
+ * @group Keys
+ * @category Key Providers
+ */
+export const signingKeyStateSchema = z
+    .object({
+    currentKid: z.string().min(1).nullable(),
+    keys: z.array(z
+        .object({
+        kid: z.string().min(1),
+        providerKeyId: z.string().min(1),
+        status: z.enum(['pending', 'active', 'retired']),
+        publicJwk: publicJwkSchema,
+        activateAfter: z.string().pipe(z.iso.datetime()),
+        activatedAt: z.string().pipe(z.iso.datetime()).nullable(),
+        retiredAt: z.string().pipe(z.iso.datetime()).nullable(),
+        verifyUntil: z.string().pipe(z.iso.datetime()).nullable()
+    })
+        .strict())
+})
+    .strict();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2tleXMvc2NoZW1hLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxDQUFDLEVBQUUsTUFBTSxLQUFLLENBQUM7QUFFeEI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FtQkc7QUFDSCxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQztLQUM3QixNQUFNLENBQUM7SUFDTixHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRTtJQUNmLEdBQUcsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUN0QixHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUMxQixHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUMxQixHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUMxQixDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUN4QixDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUN4QixDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtJQUN4QixDQUFDLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRTtDQUN6QixDQUFDO0tBQ0QsTUFBTSxFQUFFLENBQUM7QUFFWjs7Ozs7Ozs7Ozs7O0dBWUc7QUFDSCxNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDO0tBQ25DLE1BQU0sQ0FBQztJQUNOLFVBQVUsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRTtJQUN4QyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEtBQUssQ0FDWCxDQUFDO1NBQ0UsTUFBTSxDQUFDO1FBQ04sR0FBRyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ3RCLGFBQWEsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNoQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDaEQsU0FBUyxFQUFFLGVBQWU7UUFDMUIsYUFBYSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNoRCxXQUFXLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsUUFBUSxFQUFFO1FBQ3pELFNBQVMsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUU7UUFDdkQsV0FBVyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRTtLQUMxRCxDQUFDO1NBQ0QsTUFBTSxFQUFFLENBQ1o7Q0FDRixDQUFDO0tBQ0QsTUFBTSxFQUFFLENBQUMifQ==

package/dist/keys/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMva2V5cy90eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiIn0=

package/dist/keys/validation.js

@@ -0,0 +1,100 @@
+import { CustomError } from '@salamandradevs/tools/shared';
+import { signingKeyStateSchema } from './schema.js';
+/**
+ * Parses the signing-key lifecycle document and enforces every invariant providers rely on.
+ *
+ * @remarks
+ * Shared by every signing-key provider so the lifecycle invariants have one definition:
+ * unique identifiers, an ES256 P-256 public JWK per entry whose `kid` matches its entry,
+ * status-consistent timestamps, exactly one active key, at most one pending key, and a
+ * `currentKid` that names the active key. Nothing downstream re-checks any of this, so a
+ * failure here is fatal on purpose.
+ * @group Keys
+ * @category Key Providers
+ * @param value - Raw lifecycle document read from a provider's durable store.
+ * @param algorithm - JOSE algorithm every published key must declare.
+ * @returns Validated signing-key state.
+ * @throws {CustomError} KEYS_PROVIDER_ERROR when any signing-key invariant fails.
+ */
+export function validateSigningKeyState(value, algorithm) {
+    const candidate = signingKeyStateSchema.parse(value);
+    const keys = candidate.keys;
+    const kids = new Set();
+    const providerKeyIds = new Set();
+    for (const entry of keys) {
+        // Duplicates would make `kid` lookup ambiguous and could point two entries at one signing
+        // key, so retiring one would destroy the other's material.
+        if (kids.has(entry.kid) || providerKeyIds.has(entry.providerKeyId)) {
+            throw new CustomError({
+                name: 'KEYS_PROVIDER_ERROR',
+                message: 'Signing-key lifecycle state contains duplicate key identifiers'
+            });
+        }
+        kids.add(entry.kid);
+        providerKeyIds.add(entry.providerKeyId);
+        // The JWK is served verbatim to every token consumer, so it must be exactly an ES256
+        // P-256 verification key whose `kid` matches the entry that carries it.
+        if (entry.publicJwk.kty !== 'EC' ||
+            entry.publicJwk.crv !== 'P-256' ||
+            entry.publicJwk.alg !== algorithm ||
+            entry.publicJwk.use !== 'sig' ||
+            entry.publicJwk.kid !== entry.kid ||
+            !entry.publicJwk.x ||
+            !entry.publicJwk.y) {
+            throw new CustomError({
+                name: 'KEYS_PROVIDER_ERROR',
+                message: 'Signing-key lifecycle state contains an invalid public JWK'
+            });
+        }
+        validateEntryTimestamps(entry);
+    }
+    const active = keys.filter((entry) => entry.status === 'active');
+    const pending = keys.filter((entry) => entry.status === 'pending');
+    // Exactly one active key, because issuance picks it by status alone; at most one pending,
+    // because a second would be promoted into a key the first already replaced.
+    if (active.length !== 1 || pending.length > 1) {
+        throw new CustomError({
+            name: 'KEYS_PROVIDER_ERROR',
+            message: 'Signing-key lifecycle state must contain one active and at most one pending key'
+        });
+    }
+    // `currentKid` is redundant with the active entry, which makes it a useful cross-check that
+    // a hand-written or externally provisioned document did not leave the two disagreeing.
+    if (candidate.currentKid !== active[0].kid) {
+        throw new CustomError({
+            name: 'KEYS_PROVIDER_ERROR',
+            message: 'Signing-key lifecycle state has an invalid current key'
+        });
+    }
+    return { currentKid: candidate.currentKid, keys };
+}
+/**
+ * Enforces the timestamps each signing-key status permits, and their chronological order.
+ *
+ * @param entry - Signing-key entry to check.
+ * @throws {CustomError} KEYS_PROVIDER_ERROR when the entry carries timestamps its status
+ *   forbids.
+ */
+function validateEntryTimestamps(entry) {
+    // Each status implies exactly which timestamps may be set. Checking this here is what lets
+    // the rest of the system treat a present `verifyUntil` as proof the entry is retired.
+    const pendingIsClean = entry.activatedAt === null && entry.retiredAt === null && entry.verifyUntil === null;
+    const activeIsClean = entry.activatedAt !== null && entry.retiredAt === null && entry.verifyUntil === null;
+    const retiredIsOrdered = entry.activatedAt !== null &&
+        entry.retiredAt !== null &&
+        entry.verifyUntil !== null &&
+        Date.parse(entry.activatedAt) <= Date.parse(entry.retiredAt) &&
+        Date.parse(entry.retiredAt) <= Date.parse(entry.verifyUntil);
+    const valid = entry.status === 'pending'
+        ? pendingIsClean
+        : entry.status === 'active'
+            ? activeIsClean
+            : retiredIsOrdered;
+    if (!valid) {
+        throw new CustomError({
+            name: 'KEYS_PROVIDER_ERROR',
+            message: `Signing-key lifecycle entry '${entry.kid}' has timestamps its status forbids`
+        });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9rZXlzL3ZhbGlkYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRTNELE9BQU8sRUFBRSxxQkFBcUIsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUdwRDs7Ozs7Ozs7Ozs7Ozs7O0dBZUc7QUFDSCxNQUFNLFVBQVUsdUJBQXVCLENBQ3JDLEtBQWMsRUFDZCxTQUFrQjtJQUVsQixNQUFNLFNBQVMsR0FBb0IscUJBQXFCLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3RFLE1BQU0sSUFBSSxHQUErQixTQUFTLENBQUMsSUFBSSxDQUFDO0lBQ3hELE1BQU0sSUFBSSxHQUFnQixJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQzVDLE1BQU0sY0FBYyxHQUFnQixJQUFJLEdBQUcsRUFBVSxDQUFDO0lBRXRELEtBQUssTUFBTSxLQUFLLElBQUksSUFBSSxFQUFFLENBQUM7UUFDekIsMEZBQTBGO1FBQzFGLDJEQUEyRDtRQUMzRCxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLGNBQWMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7WUFDbkUsTUFBTSxJQUFJLFdBQVcsQ0FBQztnQkFDcEIsSUFBSSxFQUFFLHFCQUFxQjtnQkFDM0IsT0FBTyxFQUFFLGdFQUFnRTthQUMxRSxDQUFDLENBQUM7UUFDTCxDQUFDO1FBRUQsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDcEIsY0FBYyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUM7UUFFeEMscUZBQXFGO1FBQ3JGLHdFQUF3RTtRQUN4RSxJQUNFLEtBQUssQ0FBQyxTQUFTLENBQUMsR0FBRyxLQUFLLElBQUk7WUFDNUIsS0FBSyxDQUFDLFNBQVMsQ0FBQyxHQUFHLEtBQUssT0FBTztZQUMvQixLQUFLLENBQUMsU0FBUyxDQUFDLEdBQUcsS0FBSyxTQUFTO1lBQ2pDLEtBQUssQ0FBQyxTQUFTLENBQUMsR0FBRyxLQUFLLEtBQUs7WUFDN0IsS0FBSyxDQUFDLFNBQVMsQ0FBQyxHQUFHLEtBQUssS0FBSyxDQUFDLEdBQUc7WUFDakMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDbEIsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsRUFDbEIsQ0FBQztZQUNELE1BQU0sSUFBSSxXQUFXLENBQUM7Z0JBQ3BCLElBQUksRUFBRSxxQkFBcUI7Z0JBQzNCLE9BQU8sRUFBRSw0REFBNEQ7YUFDdEUsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELHVCQUF1QixDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2pDLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBc0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQztJQUNwRixNQUFNLE9BQU8sR0FBc0IsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQztJQUV0RiwwRkFBMEY7SUFDMUYsNEVBQTRFO0lBQzVFLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM5QyxNQUFNLElBQUksV0FBVyxDQUFDO1lBQ3BCLElBQUksRUFBRSxxQkFBcUI7WUFDM0IsT0FBTyxFQUNMLGlGQUFpRjtTQUNwRixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsNEZBQTRGO0lBQzVGLHVGQUF1RjtJQUN2RixJQUFJLFNBQVMsQ0FBQyxVQUFVLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQzNDLE1BQU0sSUFBSSxXQUFXLENBQUM7WUFDcEIsSUFBSSxFQUFFLHFCQUFxQjtZQUMzQixPQUFPLEVBQUUsd0RBQXdEO1NBQ2xFLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxPQUFPLEVBQUUsVUFBVSxFQUFFLFNBQVMsQ0FBQyxVQUFVLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFDcEQsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILFNBQVMsdUJBQXVCLENBQUMsS0FBc0I7SUFDckQsMkZBQTJGO0lBQzNGLHNGQUFzRjtJQUN0RixNQUFNLGNBQWMsR0FDbEIsS0FBSyxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksS0FBSyxDQUFDLFNBQVMsS0FBSyxJQUFJLElBQUksS0FBSyxDQUFDLFdBQVcsS0FBSyxJQUFJLENBQUM7SUFDdkYsTUFBTSxhQUFhLEdBQ2pCLEtBQUssQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssSUFBSSxJQUFJLEtBQUssQ0FBQyxXQUFXLEtBQUssSUFBSSxDQUFDO0lBQ3ZGLE1BQU0sZ0JBQWdCLEdBQ3BCLEtBQUssQ0FBQyxXQUFXLEtBQUssSUFBSTtRQUMxQixLQUFLLENBQUMsU0FBUyxLQUFLLElBQUk7UUFDeEIsS0FBSyxDQUFDLFdBQVcsS0FBSyxJQUFJO1FBQzFCLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUM1RCxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUUvRCxNQUFNLEtBQUssR0FDVCxLQUFLLENBQUMsTUFBTSxLQUFLLFNBQVM7UUFDeEIsQ0FBQyxDQUFDLGNBQWM7UUFDaEIsQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUTtZQUN6QixDQUFDLENBQUMsYUFBYTtZQUNmLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQztJQUV6QixJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDWCxNQUFNLElBQUksV0FBVyxDQUFDO1lBQ3BCLElBQUksRUFBRSxxQkFBcUI7WUFDM0IsT0FBTyxFQUFFLGdDQUFnQyxLQUFLLENBQUMsR0FBRyxxQ0FBcUM7U0FDeEYsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztBQUNILENBQUMifQ==

package/dist/runtime/context.js

@@ -0,0 +1,42 @@
+import { CustomError } from '@salamandradevs/tools/shared';
+import { AsyncLocalStorage } from 'node:async_hooks';
+// Async local storage backing the ambient execution context for the current async scope.
+const executionContextStorage = new AsyncLocalStorage();
+/**
+ * Runs one callback with the supplied execution context bound to the current async scope.
+ *
+ * @remarks
+ * The context is visible to every asynchronous operation started within `callback` and is
+ * torn down when it returns, so nested calls to {@link getExecutionCtx} resolve the same
+ * identity without explicit propagation. Transport middleware wraps request handling in
+ * this call.
+ * @group Utils
+ * @category Execution Context
+ * @param context - Execution context for the current request or job.
+ * @param callback - Work executed while the context is available.
+ * @returns The callback return value.
+ */
+export function runWithExecutionCtx(context, callback) {
+    return executionContextStorage.run(context, callback);
+}
+/**
+ * Reads the current execution context.
+ *
+ * @group Utils
+ * @category Execution Context
+ * @returns The active {@link ExecutionContext} for the current async scope.
+ * @throws {CustomError} RESOURCE_NOT_FOUND when called outside a {@link runWithExecutionCtx}
+ *   scope, so no context is bound.
+ */
+export function getExecutionCtx() {
+    const context = executionContextStorage.getStore();
+    if (!context) {
+        throw new CustomError({
+            name: 'RESOURCE_NOT_FOUND',
+            message: 'Execution context is not available',
+            cause: 'Async local storage could not get the execution context'
+        });
+    }
+    return context;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udGV4dC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9ydW50aW1lL2NvbnRleHQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzNELE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBOENyRCx5RkFBeUY7QUFDekYsTUFBTSx1QkFBdUIsR0FDM0IsSUFBSSxpQkFBaUIsRUFBb0IsQ0FBQztBQUU1Qzs7Ozs7Ozs7Ozs7OztHQWFHO0FBQ0gsTUFBTSxVQUFVLG1CQUFtQixDQUFJLE9BQXlCLEVBQUUsUUFBaUI7SUFDakYsT0FBTyx1QkFBdUIsQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0FBQ3hELENBQUM7QUFFRDs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sVUFBVSxlQUFlO0lBQzdCLE1BQU0sT0FBTyxHQUFpQyx1QkFBdUIsQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUVqRixJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDYixNQUFNLElBQUksV0FBVyxDQUFDO1lBQ3BCLElBQUksRUFBRSxvQkFBb0I7WUFDMUIsT0FBTyxFQUFFLG9DQUFvQztZQUM3QyxLQUFLLEVBQUUseURBQXlEO1NBQ2pFLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDIn0=

package/dist/runtime/index.js

@@ -0,0 +1,2 @@
+export * from './context.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcnVudGltZS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGNBQWMsQ0FBQyJ9

package/dist/storage/records-handler.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { getExecutionCtx } from '../utils/context.js';
+import { getExecutionCtx } from '../runtime/context.js';
 /**
  * Base record handler that applies tenant scope and delegates persistence to an
  * {@link ICrud} adapter.
@@ -137,4 +137,4 @@ export class RecordsHandler {
         return this.crud.find({ ...criteria, tenantId }, findOptions);
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVjb3Jkcy1oYW5kbGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3N0b3JhZ2UvcmVjb3Jkcy1oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFFekMsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBTXREOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLE9BQWdCLGNBQWM7SUFRYjtJQUNGO0lBUm5COzs7OztPQUtHO0lBQ0gsWUFDcUIsSUFBYyxFQUNoQixXQUE2QjtRQUQzQixTQUFJLEdBQUosSUFBSSxDQUFVO1FBQ2hCLGdCQUFXLEdBQVgsV0FBVyxDQUFrQjtJQUM3QyxDQUFDO0lBRUo7Ozs7Ozs7Ozs7T0FVRztJQUNILE1BQU0sQ0FBQyxNQUE0QjtRQUNqQyxNQUFNLEVBQUUsYUFBYSxFQUFFLEdBQUcsZUFBZSxFQUFFLENBQUM7UUFDNUMsTUFBTSxHQUFHLEdBQVMsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUU3QixPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1lBQ3RCLEdBQUcsTUFBTTtZQUNULFdBQVcsRUFBRSxJQUFJLENBQUMsV0FBVztZQUM3QixRQUFRLEVBQUUsYUFBYSxDQUFDLFFBQVE7WUFDaEMsUUFBUSxFQUFFLFVBQVUsRUFBRTtZQUN0QixTQUFTLEVBQUUsR0FBRztZQUNkLFNBQVMsRUFBRSxhQUFhLENBQUMsT0FBTztZQUNoQyxTQUFTLEVBQUUsR0FBRztZQUNkLFNBQVMsRUFBRSxhQUFhLENBQUMsT0FBTztTQUM1QixDQUFDLENBQUM7SUFDVixDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0gsSUFBSSxDQUFDLFFBQWdCO1FBQ25CLE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFckQsTUFBTSxRQUFRLEdBQWU7WUFDM0IsUUFBUTtZQUNSLFFBQVE7U0FDSyxDQUFDO1FBRWhCLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEMsQ0FBQztJQUVEOzs7Ozs7Ozs7OztPQVdHO0lBQ0gsTUFBTSxDQUFDLFFBQWdCLEVBQUUsT0FBeUI7UUFDaEQsTUFBTSxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFOUQsTUFBTSxRQUFRLEdBQWU7WUFDM0IsUUFBUTtZQUNSLFFBQVE7U0FDSyxDQUFDO1FBRWhCLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFO1lBQ2hDLEdBQUcsT0FBTztZQUNWLFNBQVMsRUFBRSxJQUFJLElBQUksRUFBRTtZQUNyQixTQUFTLEVBQUUsT0FBTztTQUNuQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7T0FVRztJQUNILE1BQU0sQ0FBQyxRQUFnQjtRQUNyQixNQUFNLEVBQUUsUUFBUSxFQUFFLEdBQUcsZUFBZSxFQUFFLENBQUMsYUFBYSxDQUFDO1FBRXJELE1BQU0sUUFBUSxHQUFlO1lBQzNCLFFBQVE7WUFDUixRQUFRO1NBQ0ssQ0FBQztRQUVoQixPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7O09BWUc7SUFDSCxJQUFJLENBQUMsV0FBdUIsRUFBRSxFQUFFLE9BQTBCO1FBQ3hELE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFckQsTUFBTSxTQUFTLEdBQXlCO1lBQ3RDLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFO1lBQ3pDLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFO1NBQ3pDLENBQUM7UUFFRixNQUFNLFdBQVcsR0FBbUI7WUFDbEMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUEyQjtZQUMzQyxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUs7WUFDcEIsT0FBTyxFQUFFLFNBQVM7U0FDbkIsQ0FBQztRQUVGLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLFFBQVEsRUFBRSxRQUFRLEVBQUUsRUFBRSxXQUFXLENBQUMsQ0FBQztJQUNoRSxDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVjb3Jkcy1oYW5kbGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3N0b3JhZ2UvcmVjb3Jkcy1oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFFekMsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBTXhEOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLE9BQWdCLGNBQWM7SUFRYjtJQUNGO0lBUm5COzs7OztPQUtHO0lBQ0gsWUFDcUIsSUFBYyxFQUNoQixXQUE2QjtRQUQzQixTQUFJLEdBQUosSUFBSSxDQUFVO1FBQ2hCLGdCQUFXLEdBQVgsV0FBVyxDQUFrQjtJQUM3QyxDQUFDO0lBRUo7Ozs7Ozs7Ozs7T0FVRztJQUNILE1BQU0sQ0FBQyxNQUE0QjtRQUNqQyxNQUFNLEVBQUUsYUFBYSxFQUFFLEdBQUcsZUFBZSxFQUFFLENBQUM7UUFDNUMsTUFBTSxHQUFHLEdBQVMsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUU3QixPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1lBQ3RCLEdBQUcsTUFBTTtZQUNULFdBQVcsRUFBRSxJQUFJLENBQUMsV0FBVztZQUM3QixRQUFRLEVBQUUsYUFBYSxDQUFDLFFBQVE7WUFDaEMsUUFBUSxFQUFFLFVBQVUsRUFBRTtZQUN0QixTQUFTLEVBQUUsR0FBRztZQUNkLFNBQVMsRUFBRSxhQUFhLENBQUMsT0FBTztZQUNoQyxTQUFTLEVBQUUsR0FBRztZQUNkLFNBQVMsRUFBRSxhQUFhLENBQUMsT0FBTztTQUM1QixDQUFDLENBQUM7SUFDVixDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0gsSUFBSSxDQUFDLFFBQWdCO1FBQ25CLE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFckQsTUFBTSxRQUFRLEdBQWU7WUFDM0IsUUFBUTtZQUNSLFFBQVE7U0FDSyxDQUFDO1FBRWhCLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEMsQ0FBQztJQUVEOzs7Ozs7Ozs7OztPQVdHO0lBQ0gsTUFBTSxDQUFDLFFBQWdCLEVBQUUsT0FBeUI7UUFDaEQsTUFBTSxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFOUQsTUFBTSxRQUFRLEdBQWU7WUFDM0IsUUFBUTtZQUNSLFFBQVE7U0FDSyxDQUFDO1FBRWhCLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFO1lBQ2hDLEdBQUcsT0FBTztZQUNWLFNBQVMsRUFBRSxJQUFJLElBQUksRUFBRTtZQUNyQixTQUFTLEVBQUUsT0FBTztTQUNuQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7T0FVRztJQUNILE1BQU0sQ0FBQyxRQUFnQjtRQUNyQixNQUFNLEVBQUUsUUFBUSxFQUFFLEdBQUcsZUFBZSxFQUFFLENBQUMsYUFBYSxDQUFDO1FBRXJELE1BQU0sUUFBUSxHQUFlO1lBQzNCLFFBQVE7WUFDUixRQUFRO1NBQ0ssQ0FBQztRQUVoQixPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7O09BWUc7SUFDSCxJQUFJLENBQUMsV0FBdUIsRUFBRSxFQUFFLE9BQTBCO1FBQ3hELE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFFckQsTUFBTSxTQUFTLEdBQXlCO1lBQ3RDLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFO1lBQ3pDLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFO1NBQ3pDLENBQUM7UUFFRixNQUFNLFdBQVcsR0FBbUI7WUFDbEMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUEyQjtZQUMzQyxLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUs7WUFDcEIsT0FBTyxFQUFFLFNBQVM7U0FDbkIsQ0FBQztRQUVGLE9BQU8sSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLFFBQVEsRUFBRSxRQUFRLEVBQUUsRUFBRSxXQUFXLENBQUMsQ0FBQztJQUNoRSxDQUFDO0NBQ0YifQ==

package/dist/tokens/access-token-verifier.js

@@ -0,0 +1,75 @@
+import { decodeProtectedHeader, jwtVerify } from 'jose';
+import { CustomError } from '@salamandradevs/tools/shared';
+import { accessTokenClaimsSchema } from './schema.js';
+/**
+ * Verifies platform access tokens and reconstructs their session grant.
+ *
+ * @remarks
+ * Checks the protected header, resolves the public key by `kid` through the injected
+ * {@link IVerificationKeyProvider}, verifies signature, issuer, audience, and expiry with
+ * `jose`, then parses the claims with {@link accessTokenClaimsSchema}.
+ * @group Tokens
+ * @category Access Tokens
+ */
+export class AccessTokenVerifier {
+    config;
+    keys;
+    /**
+     * @param config - Issuer, audience, and clock tolerance every token must satisfy.
+     * @param keys - Source of public verification keys by `kid`.
+     */
+    constructor(config, keys) {
+        this.config = config;
+        this.keys = keys;
+    }
+    /**
+     * Verifies one bearer access token.
+     *
+     * @param credential - Bearer credential selected by the transport layer.
+     * @returns Trusted session grant read from the token claims.
+     * @throws {CustomError} AUTHENTICATION_FAILED when the token is malformed, signed by an
+     *   unknown key, expired, or carries incomplete claims.
+     * @throws {CustomError} EXTERNAL_API_ERROR or CONFIG_ERROR when the key provider fails;
+     *   propagated unchanged.
+     */
+    async verify(credential) {
+        try {
+            const header = decodeProtectedHeader(credential.token);
+            if (header.kid === undefined || header.alg !== 'ES256' || header.typ !== 'JWT') {
+                throw new Error('JWT protected header is invalid');
+            }
+            const key = await this.keys.getPublicKey(header.kid);
+            if (!key) {
+                throw new Error('JWT signing key is unknown');
+            }
+            const { payload } = await jwtVerify(credential.token, key, {
+                algorithms: ['ES256'],
+                issuer: this.config.issuer,
+                audience: this.config.audience,
+                clockTolerance: this.config.clockToleranceSecs
+            });
+            const claims = accessTokenClaimsSchema.parse(payload);
+            return {
+                sessionId: claims.sid,
+                subject: claims.sub,
+                actorId: claims.actorId,
+                tenantId: claims.tenantId,
+                roles: claims.roles
+            };
+        }
+        catch (error) {
+            // An infrastructure fault keeps its classification, so a key-source outage is
+            // never reported as an invalid credential.
+            if (error instanceof CustomError &&
+                (error.name === 'EXTERNAL_API_ERROR' || error.name === 'CONFIG_ERROR')) {
+                throw error;
+            }
+            throw new CustomError({
+                name: 'AUTHENTICATION_FAILED',
+                message: 'Credentials verification failed',
+                cause: error
+            });
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNjZXNzLXRva2VuLXZlcmlmaWVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3Rva2Vucy9hY2Nlc3MtdG9rZW4tdmVyaWZpZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLHFCQUFxQixFQUFFLFNBQVMsRUFBRSxNQUFNLE1BQU0sQ0FBQztBQUN4RCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFHM0QsT0FBTyxFQUFFLHVCQUF1QixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBUXREOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sT0FBTyxtQkFBbUI7SUFNWDtJQUNBO0lBTm5COzs7T0FHRztJQUNILFlBQ21CLE1BQStCLEVBQy9CLElBQThCO1FBRDlCLFdBQU0sR0FBTixNQUFNLENBQXlCO1FBQy9CLFNBQUksR0FBSixJQUFJLENBQTBCO0lBQzlDLENBQUM7SUFFSjs7Ozs7Ozs7O09BU0c7SUFDSCxLQUFLLENBQUMsTUFBTSxDQUFDLFVBQXVCO1FBQ2xDLElBQUksQ0FBQztZQUNILE1BQU0sTUFBTSxHQUE4QixxQkFBcUIsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7WUFFbEYsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLE9BQU8sSUFBSSxNQUFNLENBQUMsR0FBRyxLQUFLLEtBQUssRUFBRSxDQUFDO2dCQUMvRSxNQUFNLElBQUksS0FBSyxDQUFDLGlDQUFpQyxDQUFDLENBQUM7WUFDckQsQ0FBQztZQUVELE1BQU0sR0FBRyxHQUFxQixNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUV2RSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7Z0JBQ1QsTUFBTSxJQUFJLEtBQUssQ0FBQyw0QkFBNEIsQ0FBQyxDQUFDO1lBQ2hELENBQUM7WUFFRCxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsTUFBTSxTQUFTLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUU7Z0JBQ3pELFVBQVUsRUFBRSxDQUFDLE9BQU8sQ0FBQztnQkFDckIsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTTtnQkFDMUIsUUFBUSxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUTtnQkFDOUIsY0FBYyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsa0JBQWtCO2FBQy9DLENBQUMsQ0FBQztZQUNILE1BQU0sTUFBTSxHQUFzQix1QkFBdUIsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7WUFFekUsT0FBTztnQkFDTCxTQUFTLEVBQUUsTUFBTSxDQUFDLEdBQUc7Z0JBQ3JCLE9BQU8sRUFBRSxNQUFNLENBQUMsR0FBRztnQkFDbkIsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPO2dCQUN2QixRQUFRLEVBQUUsTUFBTSxDQUFDLFFBQVE7Z0JBQ3pCLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSzthQUNwQixDQUFDO1FBQ0osQ0FBQztRQUFDLE9BQU8sS0FBYyxFQUFFLENBQUM7WUFDeEIsOEVBQThFO1lBQzlFLDJDQUEyQztZQUMzQyxJQUNFLEtBQUssWUFBWSxXQUFXO2dCQUM1QixDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssb0JBQW9CLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxjQUFjLENBQUMsRUFDdEUsQ0FBQztnQkFDRCxNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7WUFFRCxNQUFNLElBQUksV0FBVyxDQUFDO2dCQUNwQixJQUFJLEVBQUUsdUJBQXVCO2dCQUM3QixPQUFPLEVBQUUsaUNBQWlDO2dCQUMxQyxLQUFLLEVBQUUsS0FBSzthQUNiLENBQUMsQ0FBQztRQUNMLENBQUM7SUFDSCxDQUFDO0NBQ0YifQ==

package/dist/tokens/contracts.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29udHJhY3RzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3Rva2Vucy9jb250cmFjdHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/tokens/index.js

@@ -0,0 +1,5 @@
+export * from './access-token-verifier.js';
+export * from './contracts.js';
+export * from './schema.js';
+export * from './types.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdG9rZW5zL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQyJ9

package/dist/tokens/schema.js

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+/**
+ * Access-token verification policy every verifier shares with the issuer.
+ *
+ * - Issuer: Required `iss`, the issuing service's base URL.
+ * - Audience: Required `aud`.
+ * - ClockToleranceSecs: Allowed clock skew when checking `exp` and `iat`.
+ */
+export const accessTokenVerifyConfigSchema = z
+    .object({
+    issuer: z.url(),
+    audience: z.string().min(1),
+    clockToleranceSecs: z.number().int().nonnegative()
+})
+    .strict();
+/**
+ * Platform claims carried by every access token.
+ *
+ * - Sid: Server-side session identifier.
+ * - Sub: Authenticated subject.
+ * - ActorId: Local actor represented by the session.
+ * - TenantId: Tenant the session belongs to.
+ * - Roles: Roles granted to the session.
+ *
+ * @remarks
+ * Not strict: `jwtVerify` already checks the registered claims (`iss`, `aud`, `iat`,
+ * `exp`), and parsing strips them.
+ */
+export const accessTokenClaimsSchema = z.object({
+    sid: z.string(),
+    sub: z.string(),
+    actorId: z.string(),
+    tenantId: z.string(),
+    roles: z.array(z.string().min(1))
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2NoZW1hLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL3Rva2Vucy9zY2hlbWEudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLENBQUMsRUFBRSxNQUFNLEtBQUssQ0FBQztBQUV4Qjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxDQUFDO0tBQzNDLE1BQU0sQ0FBQztJQUNOLE1BQU0sRUFBRSxDQUFDLENBQUMsR0FBRyxFQUFFO0lBQ2YsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzNCLGtCQUFrQixFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxXQUFXLEVBQUU7Q0FDbkQsQ0FBQztLQUNELE1BQU0sRUFBRSxDQUFDO0FBRVo7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQztJQUM5QyxHQUFHLEVBQUUsQ0FBQyxDQUFDLE1BQU0sRUFBRTtJQUNmLEdBQUcsRUFBRSxDQUFDLENBQUMsTUFBTSxFQUFFO0lBQ2YsT0FBTyxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUU7SUFDbkIsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNLEVBQUU7SUFDcEIsS0FBSyxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztDQUNsQyxDQUFDLENBQUMifQ==

package/dist/tokens/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdG9rZW5zL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salamandradevs/core",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "description": "Shared record layer and database contracts",
   "type": "module",
   "packageManager": "pnpm@12.16.1",
@@ -47,6 +47,7 @@
   ],
   "dependencies": {
     "@salamandradevs/tools": "^0.1.0",
+    "jose": "^6.2.12",
     "mongodb": "^7.6.0",
     "mysql2": "^3.23.4",
     "zod": "^4.5.4"

package/types/index.d.ts

@@ -1,4 +1,6 @@
 export * from './storage/index.js';
 export * from './infra/database/index.js';
-export * from './utils/index.js';
+export * from './keys/index.js';
+export * from './tokens/index.js';
+export * from './runtime/index.js';
 //# sourceMappingURL=index.d.ts.map

package/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC"}

package/types/keys/config/index.d.ts

@@ -0,0 +1,3 @@
+export * from './schema.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/types/keys/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/keys/config/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/types/keys/config/schema.d.ts

@@ -0,0 +1,66 @@
+import { z } from 'zod';
+/**
+ * Supported signing-key provider identifiers; grows as new providers are added.
+ *
+ * @group Keys
+ * @category Key Providers
+ */
+export declare const signingKeyProviderSchema: z.ZodEnum<{
+    jose: "jose";
+    openbao: "openbao";
+}>;
+/**
+ * Signing-key provider selector resolved from the environment.
+ *
+ * - Provider: Active signing-key provider; read from `SIGNING_KEY_PROVIDER`.
+ *
+ * @remarks
+ * `provider` is marked `.meta({ env })`, so `loadEnvVariables` resolves it from
+ * `SIGNING_KEY_PROVIDER`; the active provider is chosen at runtime, never baked into the
+ * configuration file.
+ * @group Keys
+ * @category Key Providers
+ */
+export declare const signingKeyProviderSelectorSchema: z.ZodObject<{
+    provider: z.ZodEnum<{
+        jose: "jose";
+        openbao: "openbao";
+    }>;
+}, z.core.$strict>;
+/**
+ * Provider-neutral signing lifecycle schema.
+ *
+ * - Algorithm: JOSE algorithm supported by this key set.
+ * - Jose: Jose provider configuration, present when the deployment may select `jose`.
+ * - Openbao: OpenBao provider configuration, present when the deployment may select
+ *   `openbao`.
+ *
+ * @remarks
+ * Each provider block is optional so a deployment configures only the providers it uses;
+ * the active one is chosen at runtime by `SIGNING_KEY_PROVIDER` and must have its block
+ * present. Composed into each service's own `serviceConfigSchema` and validated there; core
+ * never reads a configuration file.
+ * @group Keys
+ * @category Key Providers
+ */
+export declare const signingKeysConfigSchema: z.ZodObject<{
+    algorithm: z.ZodLiteral<"ES256">;
+    jose: z.ZodOptional<z.ZodObject<{
+        keyNamePrefix: z.ZodString;
+        storage: z.ZodObject<{
+            filePath: z.ZodString;
+            passphrase: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    openbao: z.ZodOptional<z.ZodObject<{
+        transitMount: z.ZodString;
+        kvMount: z.ZodString;
+        statePath: z.ZodString;
+        keyNamePrefix: z.ZodString;
+        requestTimeoutMs: z.ZodDefault<z.ZodNumber>;
+        refreshCooldownSecs: z.ZodNumber;
+        baoAddr: z.ZodURL;
+        baoToken: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+//# sourceMappingURL=schema.d.ts.map

package/types/keys/config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/keys/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;EAA8B,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gCAAgC;;;;;kBAIlC,CAAC;AAEZ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;kBAMzB,CAAC"}

package/types/keys/config/types.d.ts

@@ -0,0 +1,8 @@
+import type { z } from 'zod';
+import type { signingKeyProviderSchema } from './schema.js';
+import type { signingKeysConfigSchema } from './schema.js';
+/** Durable signing lifecycle and per-provider configuration. */
+export type SigningKeysConfig = z.infer<typeof signingKeysConfigSchema>;
+/** Signing-key provider selected at runtime by `SIGNING_KEY_PROVIDER`. */
+export type SigningKeyProvider = z.infer<typeof signingKeyProviderSchema>;
+//# sourceMappingURL=types.d.ts.map

package/types/keys/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/keys/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,gEAAgE;AAChE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0EAA0E;AAC1E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/types/keys/contracts.d.ts

@@ -0,0 +1,52 @@
+import type { CryptoKey } from 'jose';
+import type { PublicJwk, SigningKeyHandle } from './types.js';
+/**
+ * Owner of a key set that signs with it and lists its public keys.
+ *
+ * @remarks
+ * {@link JoseKeysProvider} and {@link OpenBaoKeysProvider} are the shipped implementations,
+ * each over the key set it owns. A consumer that only issues signatures depends on this
+ * role, never on {@link IVerificationKeyProvider} or {@link IKeysProvider}.
+ * @group Keys
+ * @category Key Providers
+ */
+export interface ISigningKeyProvider {
+    /** Loads durable state and ensures that an active key exists. */
+    initialize(): Promise<void>;
+    /** Returns a signer bound to the active key. */
+    getCurrentSigner(): Promise<SigningKeyHandle>;
+    /** Lists public keys eligible for JWKS publication. */
+    listPublicKeys(): Promise<readonly PublicJwk[]>;
+}
+/**
+ * Source of public keys that verify signatures, looked up by key identifier.
+ *
+ * @remarks
+ * {@link JoseKeysProvider} and {@link OpenBaoKeysProvider} implement it over the key set they
+ * own, next to {@link ISigningKeyProvider}; {@link JwksVerificationKeyProvider} implements it
+ * over a remote JWKS.
+ * @group Keys
+ * @category Key Providers
+ */
+export interface IVerificationKeyProvider {
+    /**
+     * Resolves an eligible public verification key by exact key identifier.
+     *
+     * @param kid - Key identifier carried with the signature.
+     * @returns The public key, or null when no eligible key has that identifier.
+     */
+    getPublicKey(kid: string): Promise<CryptoKey | null>;
+}
+/**
+ * Owner of a key set, which signs with it and verifies against it.
+ *
+ * @remarks
+ * Adds no members: it names the class the composition root builds once, which then hands
+ * each consumer only {@link ISigningKeyProvider} or {@link IVerificationKeyProvider}.
+ * {@link JoseKeysProvider} and {@link OpenBaoKeysProvider} are the shipped implementations.
+ * @group Keys
+ * @category Key Providers
+ */
+export interface IKeysProvider extends ISigningKeyProvider, IVerificationKeyProvider {
+}
+//# sourceMappingURL=contracts.d.ts.map

package/types/keys/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/keys/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEtC,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9D;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B,gDAAgD;IAChD,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAE9C,uDAAuD;IACvD,cAAc,IAAI,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;CACjD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;;OAKG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAc,SAAQ,mBAAmB,EAAE,wBAAwB;CAAG"}

package/types/keys/factory.d.ts

@@ -0,0 +1,22 @@
+import type { IKeysProvider } from './contracts.js';
+import type { SigningKeysConfig } from './config/types.js';
+/**
+ * Selects and constructs the keys provider named by `SIGNING_KEY_PROVIDER`.
+ *
+ * @remarks
+ * Construction only: each provider resolves its own environment as it is constructed but
+ * performs no input or output, so all network and file work is deferred to `initialize()`.
+ * The `switch` is the single extension point; a new provider is a new enum member, a new
+ * `case`, and its own configuration block, with no change to the bootstrap step or the
+ * services that consume the provider. Returns the owner of the key set as
+ * {@link IKeysProvider}; the composition root hands each consumer only the role it uses.
+ * @group Keys
+ * @category Key Providers
+ * @param config - Signing lifecycle and per-provider configuration.
+ * @returns The keys provider named by `SIGNING_KEY_PROVIDER`, ready for `initialize()`.
+ * @throws {CustomError} ENV_VAR_ERROR when `SIGNING_KEY_PROVIDER` is missing or not a
+ *   recognized provider, or (for OpenBao) when the provider's own variables are missing.
+ * @throws {CustomError} CONFIG_ERROR when the selected provider has no configuration block.
+ */
+export declare function createKeysProvider(config: SigningKeysConfig): IKeysProvider;
+//# sourceMappingURL=factory.d.ts.map

package/types/keys/factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../src/keys/factory.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,aAAa,CAiD3E"}

package/types/keys/index.d.ts

@@ -0,0 +1,10 @@
+export * from './config/index.js';
+export * from './contracts.js';
+export * from './factory.js';
+export * from './jose/index.js';
+export * from './jwks/index.js';
+export * from './openbao/index.js';
+export * from './schema.js';
+export * from './types.js';
+export * from './validation.js';
+//# sourceMappingURL=index.d.ts.map

package/types/keys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keys/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}

package/types/keys/jose/index.d.ts

@@ -0,0 +1,3 @@
+export * from './jose-keys-provider.js';
+export * from './schema.js';
+//# sourceMappingURL=index.d.ts.map

package/types/keys/jose/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/keys/jose/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,aAAa,CAAC"}