@xemahq/xema-npm-auth-plugin 0.1.2

package/dist/logger.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adaptVerdaccioLogger = adaptVerdaccioLogger;
+exports.newCorrelationId = newCorrelationId;
+function adaptVerdaccioLogger(verdaccioLogger) {
+    const v = verdaccioLogger;
+    const level = (key) => {
+        const fn = v?.[key];
+        if (typeof fn === 'function') {
+            return (msg, meta) => fn(meta ?? {}, `[xema-jwt] ${msg}`);
+        }
+        return (msg, meta) => {
+            const out = meta ? `[xema-jwt] ${msg} ${JSON.stringify(meta)}` : `[xema-jwt] ${msg}`;
+            if (key === 'error') {
+                console.error(out);
+            }
+            else if (key === 'warn') {
+                console.warn(out);
+            }
+            else {
+                console.log(out);
+            }
+        };
+    };
+    return {
+        info: level('info'),
+        warn: level('warn'),
+        error: level('error'),
+        debug: level('debug'),
+    };
+}
+function newCorrelationId() {
+    const { randomBytes } = require('node:crypto');
+    return randomBytes(6).toString('hex');
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";;AAkBA,oDA0BC;AAOD,4CAKC;AAtCD,SAAgB,oBAAoB,CAAC,eAAwB;IAC3D,MAAM,CAAC,GAAG,eAAkG,CAAC;IAC7G,MAAM,KAAK,GAAG,CACZ,GAAwC,EACiB,EAAE;QAC3D,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,cAAc,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,cAAc,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,GAAG,EAAE,CAAC;YACrF,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;iBAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;KACtB,CAAC;AACJ,CAAC;AAOD,SAAgB,gBAAgB;IAG9B,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;IAC/E,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC"}

package/dist/plugin.cjs

@@ -0,0 +1,646 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// ../../../../xema-kernel-contracts/packages/kernel/kernel-contracts/dist/project-kit/lib/project-kit.js
+var require_project_kit = __commonJS({
+  "../../../../xema-kernel-contracts/packages/kernel/kernel-contracts/dist/project-kit/lib/project-kit.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.ProjectKitBindingKind = exports2.RegistryVisibilityTier = exports2.ProjectKitSourceKind = exports2.ProjectKitPurpose = exports2.ProjectKitKind = void 0;
+    var ProjectKitKind;
+    (function(ProjectKitKind2) {
+      ProjectKitKind2["NpmDependency"] = "npm-dependency";
+      ProjectKitKind2["ShadcnRegistry"] = "shadcn-registry";
+    })(ProjectKitKind || (exports2.ProjectKitKind = ProjectKitKind = {}));
+    var ProjectKitPurpose;
+    (function(ProjectKitPurpose2) {
+      ProjectKitPurpose2["ComponentLibrary"] = "component-library";
+      ProjectKitPurpose2["GenericDependency"] = "generic-dependency";
+    })(ProjectKitPurpose || (exports2.ProjectKitPurpose = ProjectKitPurpose = {}));
+    var ProjectKitSourceKind;
+    (function(ProjectKitSourceKind2) {
+      ProjectKitSourceKind2["NpmRegistry"] = "npm-registry";
+      ProjectKitSourceKind2["Git"] = "git";
+      ProjectKitSourceKind2["ShadcnRegistry"] = "shadcn-registry";
+    })(ProjectKitSourceKind || (exports2.ProjectKitSourceKind = ProjectKitSourceKind = {}));
+    var RegistryVisibilityTier2;
+    (function(RegistryVisibilityTier3) {
+      RegistryVisibilityTier3["System"] = "system";
+      RegistryVisibilityTier3["SystemShareable"] = "system-shareable";
+      RegistryVisibilityTier3["Org"] = "org";
+      RegistryVisibilityTier3["External"] = "external";
+    })(RegistryVisibilityTier2 || (exports2.RegistryVisibilityTier = RegistryVisibilityTier2 = {}));
+    var ProjectKitBindingKind;
+    (function(ProjectKitBindingKind2) {
+      ProjectKitBindingKind2["Catalog"] = "catalog";
+      ProjectKitBindingKind2["Custom"] = "custom";
+    })(ProjectKitBindingKind || (exports2.ProjectKitBindingKind = ProjectKitBindingKind = {}));
+  }
+});
+
+// ../../../../xema-kernel-contracts/packages/kernel/kernel-contracts/dist/project-kit/index.js
+var require_project_kit2 = __commonJS({
+  "../../../../xema-kernel-contracts/packages/kernel/kernel-contracts/dist/project-kit/index.js"(exports2) {
+    "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: /* @__PURE__ */ __name(function() {
+          return m[k];
+        }, "get") };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __exportStar = exports2 && exports2.__exportStar || function(m, exports3) {
+      for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports3, p)) __createBinding(exports3, m, p);
+    };
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    __exportStar(require_project_kit(), exports2);
+  }
+});
+
+// src/plugin.ts
+var plugin_exports = {};
+__export(plugin_exports, {
+  AclDenyReason: () => AclDenyReason,
+  JwtVerifier: () => JwtVerifier,
+  PackageTier: () => PackageTier,
+  XemaRegistryRole: () => XemaRegistryRole,
+  __buildBiomeForTests: () => buildPlugin,
+  buildPlugin: () => buildPlugin,
+  classifyPackage: () => classifyPackage,
+  default: () => plugin_default,
+  evaluateAcl: () => evaluateAcl,
+  packageTierToVisibility: () => packageTierToVisibility,
+  pluginFactory: () => pluginFactory
+});
+module.exports = __toCommonJS(plugin_exports);
+
+// src/acl.ts
+var import_project_kit = __toESM(require_project_kit2());
+
+// src/types.ts
+var XemaRegistryRole = /* @__PURE__ */ ((XemaRegistryRole2) => {
+  XemaRegistryRole2["Platform"] = "platform";
+  XemaRegistryRole2["OrgAdmin"] = "org_admin";
+  XemaRegistryRole2["OrgMember"] = "org_member";
+  XemaRegistryRole2["Anonymous"] = "anonymous";
+  return XemaRegistryRole2;
+})(XemaRegistryRole || {});
+var AclDenyReason = /* @__PURE__ */ ((AclDenyReason3) => {
+  AclDenyReason3["MissingJwt"] = "missing_jwt";
+  AclDenyReason3["InvalidJwt"] = "invalid_jwt";
+  AclDenyReason3["ExpiredJwt"] = "expired_jwt";
+  AclDenyReason3["WrongRoleForSystem"] = "wrong_role_for_system";
+  AclDenyReason3["WrongRoleForSystemShareablePublish"] = "wrong_role_for_system_shareable_publish";
+  AclDenyReason3["AnonymousOrgRead"] = "anonymous_org_read";
+  AclDenyReason3["CrossOrgAccess"] = "cross_org_access";
+  AclDenyReason3["UnknownPackagePattern"] = "unknown_package_pattern";
+  return AclDenyReason3;
+})(AclDenyReason || {});
+var PackageTier = /* @__PURE__ */ ((PackageTier2) => {
+  PackageTier2["System"] = "system";
+  PackageTier2["SystemShareable"] = "system_shareable";
+  PackageTier2["Org"] = "org";
+  PackageTier2["Uplink"] = "uplink";
+  return PackageTier2;
+})(PackageTier || {});
+
+// src/acl.ts
+var SYSTEM_SCOPE = "@xema-system";
+var SHAREABLE_SCOPE = "@xema-shareable";
+function packageTierToVisibility(tier) {
+  switch (tier) {
+    case "system" /* System */:
+      return import_project_kit.RegistryVisibilityTier.System;
+    case "system_shareable" /* SystemShareable */:
+      return import_project_kit.RegistryVisibilityTier.SystemShareable;
+    case "org" /* Org */:
+      return import_project_kit.RegistryVisibilityTier.Org;
+    case "uplink" /* Uplink */:
+      return import_project_kit.RegistryVisibilityTier.External;
+  }
+}
+__name(packageTierToVisibility, "packageTierToVisibility");
+function classifyPackage(packageName) {
+  if (packageName.startsWith("@")) {
+    const slashIdx = packageName.indexOf("/");
+    if (slashIdx <= 1) {
+      return { tier: "uplink" /* Uplink */, orgScope: null, raw: packageName };
+    }
+    const scope = packageName.slice(0, slashIdx);
+    if (scope === SYSTEM_SCOPE) {
+      return { tier: "system" /* System */, orgScope: null, raw: packageName };
+    }
+    if (scope === SHAREABLE_SCOPE) {
+      return { tier: "system_shareable" /* SystemShareable */, orgScope: null, raw: packageName };
+    }
+    return {
+      tier: "org" /* Org */,
+      orgScope: scope.slice(1),
+      // drop leading '@'
+      raw: packageName
+    };
+  }
+  return { tier: "uplink" /* Uplink */, orgScope: null, raw: packageName };
+}
+__name(classifyPackage, "classifyPackage");
+function evaluateAcl(input) {
+  const pkg = classifyPackage(input.packageName);
+  const isPublish = input.action === "publish";
+  switch (pkg.tier) {
+    case "system" /* System */: {
+      if (!input.claims) {
+        return {
+          allow: false,
+          reason: "missing_jwt" /* MissingJwt */,
+          message: `system tier (${pkg.raw}) requires platform JWT`
+        };
+      }
+      if (input.claims.x_role !== "platform" /* Platform */) {
+        return {
+          allow: false,
+          reason: "wrong_role_for_system" /* WrongRoleForSystem */,
+          message: `system tier (${pkg.raw}) requires role=platform, got role=${input.claims.x_role}`
+        };
+      }
+      return { allow: true };
+    }
+    case "system_shareable" /* SystemShareable */: {
+      if (!isPublish) {
+        return { allow: true };
+      }
+      if (!input.claims) {
+        return {
+          allow: false,
+          reason: "missing_jwt" /* MissingJwt */,
+          message: `system-shareable publish (${pkg.raw}) requires platform JWT`
+        };
+      }
+      if (input.claims.x_role !== "platform" /* Platform */) {
+        return {
+          allow: false,
+          reason: "wrong_role_for_system_shareable_publish" /* WrongRoleForSystemShareablePublish */,
+          message: `system-shareable publish (${pkg.raw}) requires role=platform, got role=${input.claims.x_role}`
+        };
+      }
+      return { allow: true };
+    }
+    case "org" /* Org */: {
+      if (!input.claims) {
+        return {
+          allow: false,
+          reason: "anonymous_org_read" /* AnonymousOrgRead */,
+          message: `org tier (${pkg.raw}) requires authentication`
+        };
+      }
+      if (input.claims.x_role === "platform" /* Platform */) {
+        return { allow: true };
+      }
+      if (input.claims.x_role === "anonymous" /* Anonymous */) {
+        return {
+          allow: false,
+          reason: "anonymous_org_read" /* AnonymousOrgRead */,
+          message: `org tier (${pkg.raw}) denied for role=anonymous`
+        };
+      }
+      if (pkg.orgScope !== input.claims.x_org_id) {
+        return {
+          allow: false,
+          reason: "cross_org_access" /* CrossOrgAccess */,
+          message: `package scope "@${pkg.orgScope}" does not match jwt x_org_id "${input.claims.x_org_id}"`
+        };
+      }
+      return { allow: true };
+    }
+    case "uplink" /* Uplink */: {
+      if (isPublish) {
+        return {
+          allow: false,
+          reason: "unknown_package_pattern" /* UnknownPackagePattern */,
+          message: `cannot publish unscoped package "${pkg.raw}" \u2014 only scoped tiers accept writes`
+        };
+      }
+      return { allow: true };
+    }
+  }
+}
+__name(evaluateAcl, "evaluateAcl");
+
+// src/jwks.ts
+var import_node_crypto = require("node:crypto");
+var ALLOWED_ALG = /* @__PURE__ */ new Set(["RS256", "RS384", "RS512"]);
+var ALG_TO_DIGEST = {
+  RS256: "sha256",
+  RS384: "sha384",
+  RS512: "sha512"
+};
+var JwtVerifier = class {
+  static {
+    __name(this, "JwtVerifier");
+  }
+  jwksUrl;
+  expectedIssuer;
+  refreshMs;
+  fetchFn;
+  logger;
+  now;
+  keys = /* @__PURE__ */ new Map();
+  lastRefreshedAt = 0;
+  inflight = null;
+  constructor(opts) {
+    if (!opts.jwksUrl) {
+      throw new Error("JwtVerifier requires jwksUrl");
+    }
+    this.jwksUrl = opts.jwksUrl;
+    this.expectedIssuer = opts.expectedIssuer;
+    this.refreshMs = opts.refreshMs ?? 10 * 60 * 1e3;
+    this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+    if (typeof this.fetchFn !== "function") {
+      throw new Error("JwtVerifier requires a fetch implementation");
+    }
+    this.logger = opts.logger;
+    this.now = opts.now ?? (() => Math.floor(Date.now() / 1e3));
+  }
+  /**
+   * Verify a bearer token. Returns the decoded {@link XemaJwtClaims} on
+   * success. Throws on ANY failure — caller MUST catch and map to a deny.
+   */
+  async verify(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      throw new Error("JWT is not a three-segment compact-serialization token");
+    }
+    const [headerB64, payloadB64, signatureB64] = parts;
+    const header = decodeJsonSegment(headerB64);
+    if (!ALLOWED_ALG.has(header.alg)) {
+      throw new Error(`Unsupported JWT alg "${header.alg}" (only RS256/RS384/RS512 accepted)`);
+    }
+    if (!header.kid) {
+      throw new Error('JWT header missing "kid"');
+    }
+    await this.ensureKeysFresh();
+    let key = this.keys.get(header.kid);
+    if (!key) {
+      await this.refreshNow();
+      key = this.keys.get(header.kid);
+      if (!key) {
+        throw new Error(`JWT kid "${header.kid}" not found in JWKS`);
+      }
+    }
+    const signingInput = `${headerB64}.${payloadB64}`;
+    const signature = Buffer.from(signatureB64, "base64url");
+    const verifier = (0, import_node_crypto.createVerify)(ALG_TO_DIGEST[header.alg]);
+    verifier.update(signingInput);
+    verifier.end();
+    if (!verifier.verify(key, signature)) {
+      throw new Error("JWT signature did not verify against any JWKS key");
+    }
+    const payload = decodeJsonSegment(payloadB64);
+    const claims = this.assertClaims(payload);
+    if (this.expectedIssuer && payload["iss"] !== this.expectedIssuer) {
+      throw new Error(
+        `JWT iss "${String(payload["iss"])}" does not match expected "${this.expectedIssuer}"`
+      );
+    }
+    return claims;
+  }
+  /** Force a synchronous refresh — used by tests and on kid miss. */
+  async refreshNow() {
+    if (this.inflight) {
+      await this.inflight;
+      return;
+    }
+    this.inflight = this.doRefresh().finally(() => {
+      this.inflight = null;
+    });
+    await this.inflight;
+  }
+  async ensureKeysFresh() {
+    const ageMs = Date.now() - this.lastRefreshedAt;
+    if (this.keys.size > 0 && ageMs < this.refreshMs) {
+      return;
+    }
+    await this.refreshNow();
+  }
+  async doRefresh() {
+    this.logger.debug("JWKS refresh start", { jwksUrl: this.jwksUrl });
+    const res = await this.fetchFn(this.jwksUrl, {
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) {
+      throw new Error(`JWKS fetch failed: ${res.status} ${res.statusText}`);
+    }
+    const doc = await res.json();
+    if (!doc || !Array.isArray(doc.keys)) {
+      throw new Error('JWKS response is missing "keys" array');
+    }
+    const next = /* @__PURE__ */ new Map();
+    for (const k of doc.keys) {
+      if (k.kty !== "RSA" || !k.kid || !k.n || !k.e) {
+        continue;
+      }
+      try {
+        const keyObj = (0, import_node_crypto.createPublicKey)({
+          key: {
+            kty: "RSA",
+            n: k.n,
+            e: k.e
+          },
+          format: "jwk"
+        });
+        next.set(k.kid, keyObj);
+      } catch (err) {
+        this.logger.warn("JWKS key skipped (createPublicKey failed)", {
+          kid: k.kid,
+          error: err.message
+        });
+      }
+    }
+    if (next.size === 0) {
+      throw new Error("JWKS contained zero usable RSA keys");
+    }
+    this.keys = next;
+    this.lastRefreshedAt = Date.now();
+    this.logger.info("JWKS refresh ok", { keyCount: next.size });
+  }
+  assertClaims(payload) {
+    const exp = payload["exp"];
+    if (typeof exp !== "number") {
+      throw new Error('JWT missing numeric "exp"');
+    }
+    if (exp <= this.now()) {
+      throw new Error("JWT is expired");
+    }
+    const sub = payload["sub"];
+    if (typeof sub !== "string" || sub.length === 0) {
+      throw new Error('JWT missing "sub"');
+    }
+    const orgId = payload["x_org_id"];
+    if (typeof orgId !== "string" || orgId.length === 0) {
+      throw new Error('JWT missing "x_org_id" claim');
+    }
+    const role = payload["x_role"];
+    if (typeof role !== "string" || !isXemaRole(role)) {
+      throw new Error(`JWT "x_role" must be one of platform|org_admin|org_member|anonymous (got "${String(role)}")`);
+    }
+    const claims = {
+      sub,
+      exp,
+      x_org_id: orgId,
+      x_role: role
+    };
+    if (typeof payload["iat"] === "number") {
+      claims.iat = payload["iat"];
+    }
+    return claims;
+  }
+};
+function decodeJsonSegment(segment) {
+  const buf = Buffer.from(segment, "base64url");
+  return JSON.parse(buf.toString("utf8"));
+}
+__name(decodeJsonSegment, "decodeJsonSegment");
+function isXemaRole(value) {
+  return value === "platform" /* Platform */ || value === "org_admin" /* OrgAdmin */ || value === "org_member" /* OrgMember */ || value === "anonymous" /* Anonymous */;
+}
+__name(isXemaRole, "isXemaRole");
+
+// src/logger.ts
+function adaptVerdaccioLogger(verdaccioLogger) {
+  const v = verdaccioLogger;
+  const level = /* @__PURE__ */ __name((key) => {
+    const fn = v?.[key];
+    if (typeof fn === "function") {
+      return (msg, meta) => fn(meta ?? {}, `[xema-jwt] ${msg}`);
+    }
+    return (msg, meta) => {
+      const out = meta ? `[xema-jwt] ${msg} ${JSON.stringify(meta)}` : `[xema-jwt] ${msg}`;
+      if (key === "error") {
+        console.error(out);
+      } else if (key === "warn") {
+        console.warn(out);
+      } else {
+        console.log(out);
+      }
+    };
+  }, "level");
+  return {
+    info: level("info"),
+    warn: level("warn"),
+    error: level("error"),
+    debug: level("debug")
+  };
+}
+__name(adaptVerdaccioLogger, "adaptVerdaccioLogger");
+function newCorrelationId() {
+  const { randomBytes } = require("node:crypto");
+  return randomBytes(6).toString("hex");
+}
+__name(newCorrelationId, "newCorrelationId");
+
+// src/plugin.ts
+var AUTHENTICATED_GROUP = "$authenticated";
+function buildPlugin(config, deps = {}) {
+  const env = deps.env ?? process.env;
+  const logger = deps.logger ?? adaptVerdaccioLogger(void 0);
+  const verifier = deps.verifier ?? new JwtVerifier({
+    jwksUrl: requireEnv(config.keycloakRealmUrl ?? env.KEYCLOAK_REALM_URL, "KEYCLOAK_REALM_URL"),
+    ...config.expectedIssuer !== void 0 ? { expectedIssuer: config.expectedIssuer } : env.KEYCLOAK_EXPECTED_ISSUER !== void 0 ? { expectedIssuer: env.KEYCLOAK_EXPECTED_ISSUER } : {},
+    ...config.jwksRefreshMs !== void 0 ? { refreshMs: config.jwksRefreshMs } : {},
+    logger
+  });
+  return {
+    authenticate(user, password, cb) {
+      const cid = newCorrelationId();
+      if (!password) {
+        logger.debug("authenticate skipped (empty password = anonymous read)", {
+          cid,
+          user
+        });
+        cb(null, false);
+        return;
+      }
+      void verifier.verify(password).then((claims) => {
+        logger.info("authenticate ok", {
+          cid,
+          sub: claims.sub,
+          orgId: claims.x_org_id,
+          role: claims.x_role
+        });
+        cb(null, [
+          AUTHENTICATED_GROUP,
+          `xema:role:${claims.x_role}`,
+          `xema:org:${claims.x_org_id}`,
+          `xema:sub:${claims.sub}`
+        ]);
+      }).catch((err) => {
+        logger.warn("authenticate denied", {
+          cid,
+          user,
+          error: err.message
+        });
+        cb(null, false);
+      });
+    },
+    allow_access(remoteUser, pkg, cb) {
+      const cid = newCorrelationId();
+      const claims = claimsFromRemoteUser(remoteUser);
+      const decision = evaluateAcl({
+        packageName: pkg.name,
+        action: "access",
+        claims
+      });
+      if (decision.allow) {
+        logger.debug("allow_access ok", {
+          cid,
+          pkg: pkg.name,
+          orgId: claims?.x_org_id,
+          role: claims?.x_role
+        });
+        cb(null, true);
+        return;
+      }
+      logger.warn("allow_access denied", {
+        cid,
+        pkg: pkg.name,
+        reason: decision.reason,
+        message: decision.message,
+        orgId: claims?.x_org_id,
+        role: claims?.x_role
+      });
+      cb(buildDenyError(decision.reason, decision.message), false);
+    },
+    allow_publish(remoteUser, pkg, cb) {
+      const cid = newCorrelationId();
+      const claims = claimsFromRemoteUser(remoteUser);
+      const decision = evaluateAcl({
+        packageName: pkg.name,
+        action: "publish",
+        claims
+      });
+      if (decision.allow) {
+        logger.info("allow_publish ok", {
+          cid,
+          pkg: pkg.name,
+          orgId: claims?.x_org_id,
+          role: claims?.x_role,
+          sub: claims?.sub
+        });
+        cb(null, true);
+        return;
+      }
+      logger.warn("allow_publish denied", {
+        cid,
+        pkg: pkg.name,
+        reason: decision.reason,
+        message: decision.message,
+        orgId: claims?.x_org_id,
+        role: claims?.x_role
+      });
+      cb(buildDenyError(decision.reason, decision.message), false);
+    }
+  };
+}
+__name(buildPlugin, "buildPlugin");
+function requireEnv(value, name) {
+  if (!value) {
+    throw new Error(
+      `[xema-jwt] required env "${name}" is missing \u2014 plugin refuses to start (constitutional rule: no silent fallback to "auth disabled")`
+    );
+  }
+  return value;
+}
+__name(requireEnv, "requireEnv");
+function claimsFromRemoteUser(remoteUser) {
+  const groups = remoteUser.real_groups ?? remoteUser.groups ?? [];
+  if (!groups.includes(AUTHENTICATED_GROUP)) {
+    return void 0;
+  }
+  let role;
+  let orgId;
+  let sub;
+  for (const g of groups) {
+    if (g.startsWith("xema:role:")) {
+      const candidate = g.slice("xema:role:".length);
+      if (candidate === "platform" /* Platform */ || candidate === "org_admin" /* OrgAdmin */ || candidate === "org_member" /* OrgMember */ || candidate === "anonymous" /* Anonymous */) {
+        role = candidate;
+      }
+    } else if (g.startsWith("xema:org:")) {
+      orgId = g.slice("xema:org:".length);
+    } else if (g.startsWith("xema:sub:")) {
+      sub = g.slice("xema:sub:".length);
+    }
+  }
+  if (!role || !orgId || !sub) {
+    return void 0;
+  }
+  return {
+    sub,
+    exp: Number.MAX_SAFE_INTEGER,
+    x_org_id: orgId,
+    x_role: role
+  };
+}
+__name(claimsFromRemoteUser, "claimsFromRemoteUser");
+function buildDenyError(reason, message) {
+  const err = new Error(message);
+  err.code = "XEMA_ACL_DENIED";
+  err.reason = reason;
+  return err;
+}
+__name(buildDenyError, "buildDenyError");
+function pluginFactory(config, stuff = {}) {
+  const logger = adaptVerdaccioLogger(stuff.logger);
+  return buildPlugin(config, { logger });
+}
+__name(pluginFactory, "pluginFactory");
+var plugin_default = pluginFactory;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AclDenyReason,
+  JwtVerifier,
+  PackageTier,
+  XemaRegistryRole,
+  __buildBiomeForTests,
+  buildPlugin,
+  classifyPackage,
+  evaluateAcl,
+  packageTierToVisibility,
+  pluginFactory
+});
+module.exports = module.exports.default;