life-as-api 0.2.0

package/dist/audit/sqlite-audit-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-audit-log.js","sourceRoot":"","sources":["../../src/audit/sqlite-audit-log.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,kFAAkF;AAClF,yFAAyF;AACzF,wFAAwF;AACxF,iFAAiF;AACjF,2FAA2F;AAC3F,oGAAoG;AACpG,8GAA8G;AAC9G,iGAAiG;AACjG,gFAAgF;AAChF,4HAA4H;AAC5H,EAAE;AACF,8FAA8F;AAC9F,sFAAsF;AACtF,0FAA0F;AAC1F,yFAAyF;AAEzF,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAItC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AA+BpD,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,8FAA8F;IAC9F,wFAAwF;IACxF,mFAAmF;IACnF,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,CAAC,kBAAkB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAmBD,SAAS,eAAe,CAAC,GAAkB;IACzC,OAAO;QACL,EAAE,EAAmB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,UAAU,EAAW,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC;QAC/C,KAAK,EAAgB,GAAG,CAAC,KAAK;QAC9B,QAAQ,EAAa,GAAG,CAAC,QAAQ;QACjC,UAAU,EAAW,GAAG,CAAC,WAA8B;QACvD,mBAAmB,EAAE,GAAG,CAAC,oBAAoB;QAC7C,WAAW,EAAU,GAAG,CAAC,YAAY;QACrC,cAAc,EAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5F,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAY,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAW,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAA+C,CAAC,CAAC,CAAC,EAAE,CAAC;QACnI,GAAG,CAAC,GAAG,CAAC,OAAO,IAAa,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAW,GAAG,CAAC,OAAqB,EAA6C,CAAC,CAAC,CAAC,EAAE,CAAC;QACnI,GAAG,CAAC,GAAG,CAAC,YAAY,IAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAc,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrI,GAAG,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAa,EAAyD,CAAC,CAAC,CAAC,EAAE,CAAC;QACnI,GAAG,CAAC,GAAG,CAAC,OAAO,IAAa,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAY,GAAG,CAAC,OAAO,EAA2D,CAAC,CAAC,CAAC,EAAE,CAAC;KACpI,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IACzB,6EAA6E;IACpE,iBAAiB,GAAG,mBAA4B,CAAC;IACzC,GAAG,CAAoB;IACvB,eAAe,CAAU;IAE1C,4EAA4E;IAC5E,qEAAqE;IACrE,YAAY,UAAsC;QAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC;YACtB,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,eAAe;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,mEAAmE;IACnE,4FAA4F;IAC5F,2FAA2F;IAC3F,4FAA4F;IAC5F,KAAK,CAAC,KAAK,CAAC,KAAiB;QAC3B,MAAM,OAAO,GAAY,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;QAC/C,MAAM,OAAO,GAAY,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;QAC/C,MAAM,YAAY,GAAO,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;QACnE,MAAM,WAAW,GAAQ,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnG,6DAA6D;QAC7D,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,MAAM,MAAM,GAAa,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QAE9C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE;YAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;iBACjB,OAAO,CACN;;sEAE4D,CAC7D;iBACA,GAAG,EAA+D,CAAC;YAEtE,MAAM,OAAO,GAAgB,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAkB,GAAG,EAAE,eAAe,IAAI,IAAI,CAAC;YAE7D,MAAM,SAAS,GAAG,mBAAmB,CAAC;gBACpC,KAAK,EAAiB,KAAK,CAAC,KAAK;gBACjC,YAAY,EAAU,WAAW;gBACjC,QAAQ,EAAc,KAAK,CAAC,QAAQ;gBACpC,QAAQ,EAAc,OAAO;gBAC7B,EAAE,EAAoB,KAAK,CAAC,EAAE;gBAC9B,SAAS,EAAa,QAAQ;gBAC9B,OAAO,EAAe,OAAO;gBAC7B,WAAW,EAAW,KAAK,CAAC,UAAU;gBACtC,WAAW,EAAW,KAAK,CAAC,UAAU;gBACtC,gBAAgB,EAAM,YAAY;gBAClC,YAAY,EAAU,KAAK,CAAC,WAAW;gBACvC,oBAAoB,EAAE,KAAK,CAAC,mBAAmB;gBAC/C,QAAQ,EAAc,OAAO;gBAC7B,4GAA4G;gBAC5G,kBAAkB,EAAI,gBAAgB;gBACtC,OAAO,EAAe,MAAM;aAC7B,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YAE3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;;;;;;OAMhB,CAAC,CAAC,GAAG,CACJ,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,KAAK,EACX,OAAO,EACP,OAAO,EACP,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,WAAW,EACjB,YAAY,EACZ,WAAW,EACX,OAAO,EACP,QAAQ,EACR,SAAS,EACT,gBAAgB,EAChB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,uFAAuF;QACvF,6EAA6E;QAC7E,aAAa,CAAC,SAAS,EAAE,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,OAAQ,IAAI,CAAC,GAAG;aACb,OAAO,CAAC,+CAA+C,CAAC;aACxD,GAAG,EAAsB;aACzB,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/auth/access-context-issuer.d.ts

@@ -0,0 +1,18 @@
+import type { AccessContext, OwnerContext, AgentConsentContext, SystemProjectionContext, TestContext, AuditContext, PurposeTag } from "../types/access-context.js";
+import type { PersonId, GrantId, ISOTime } from "../types/ids.js";
+export declare class AccessContextIssuer {
+    private readonly _trusted;
+    isTrusted(ctx: unknown): ctx is AccessContext;
+    assertTrusted(ctx: unknown): asserts ctx is AccessContext;
+    mintOwner(personId: PersonId): OwnerContext;
+    mintSystemProjection(): SystemProjectionContext;
+    mintTest(label: string): TestContext;
+    mintAudit(personId: PersonId): AuditContext;
+    mintAgent(opts: {
+        readonly agentId: string;
+        readonly grantId: GrantId;
+        readonly purpose: PurposeTag;
+        readonly notAfter: ISOTime;
+    }): AgentConsentContext;
+}
+export declare function createAccessContextIssuerForTest(): AccessContextIssuer;

package/dist/auth/access-context-issuer.js

@@ -0,0 +1,88 @@
+// Authenticated AccessContext boundary — Slice-15 / Slice-15c.
+//
+// AUTH_CONTEXT_BOUNDARY_EXISTS_001: each AccessContextIssuer owns a private WeakSet.
+// AUTH_CONTEXT_RAW_STRUCTURAL_FORGERY_DENIED_001: plain structural objects not in the
+//   paired issuer's WeakSet are rejected by the API that holds that issuer.
+// AUTH_CONTEXT_TRUST_IS_AUTHORITY_SCOPED_001: contexts are bound to the issuer that
+//   minted them — not accepted by an API paired with a different issuer.
+// AUTH_CONTEXT_CROSS_AUTHORITY_REPLAY_DENIED_001: bundleA.auth.mintOwner() is denied
+//   by bundleB.api — cross-bundle replay is impossible as long as each factory call
+//   produces a fresh AccessContextIssuer with its own WeakSet.
+// AUTH_CONTEXT_ISSUER_MINTS_TRUSTED_CONTEXT_001: only AccessContextIssuer.mint*()
+//   adds to the private WeakSet; spreading or JSON round-tripping creates a new object
+//   outside the set — trust destroyed.
+// AUTH_CONTEXT_NO_REAL_IDP_CLAIM_001: this module does not integrate with any real
+//   identity provider. It provides the boundary and enforcement mechanism only.
+// ─── AccessContextIssuer ──────────────────────────────────────────────────────
+// Each instance owns its own private WeakSet — the trust boundary is
+// per-authority, not module-global. A context minted by issuer A cannot pass
+// the trust check of an API paired with issuer B.
+//
+// Obtain an instance via the test/dev factory:
+//   const { api, auth } = await createInMemoryLifeApiForTest();
+// The returned `auth` is the sole authority accepted by the returned `api`.
+export class AccessContextIssuer {
+    _trusted = new WeakSet();
+    // ─── Instance-scoped trust verification ──────────────────────────────────
+    // AUTH_CONTEXT_PUBLIC_INDEX_NO_GLOBAL_TRUST_ORACLE_001: these methods are on
+    // the instance, not a module-level export. Trust is meaningful only relative
+    // to the authority that minted the context.
+    isTrusted(ctx) {
+        return typeof ctx === "object" && ctx !== null && this._trusted.has(ctx);
+    }
+    assertTrusted(ctx) {
+        if (!this.isTrusted(ctx)) {
+            throw new Error("AUTH_CONTEXT_RAW_STRUCTURAL_FORGERY_DENIED_001: context was not minted by " +
+                "the AccessContextIssuer paired with this API instance — plain structural " +
+                "objects and contexts from a different API bundle are not accepted");
+        }
+    }
+    // ─── Mint methods ─────────────────────────────────────────────────────────
+    // AUTH_CONTEXT_OWNER_PRIVILEGE_REQUIRES_TRUSTED_CONTEXT_001
+    mintOwner(personId) {
+        const ctx = { kind: "owner", personId };
+        this._trusted.add(ctx);
+        return ctx;
+    }
+    mintSystemProjection() {
+        const ctx = { kind: "system_projection" };
+        this._trusted.add(ctx);
+        return ctx;
+    }
+    // AUTH_CONTEXT_INTERNAL_TEST_ESCAPE_HATCH_DOCUMENTED_001
+    // mintTest() is the intentional escape hatch for SDK tests.
+    // Arbitrary { kind: "test" } plain objects are still rejected.
+    mintTest(label) {
+        const ctx = { kind: "test", label };
+        this._trusted.add(ctx);
+        return ctx;
+    }
+    // AUTH_CONTEXT_AUDIT_CONTEXT_NOT_PRIVILEGED_001
+    // A minted AuditContext still cannot perform privileged mutations —
+    // _assertPrivileged() blocks it regardless of trust status.
+    mintAudit(personId) {
+        const ctx = { kind: "audit", personId };
+        this._trusted.add(ctx);
+        return ctx;
+    }
+    // AUTH_CONTEXT_AGENT_PRIVILEGE_REQUIRES_TRUSTED_GRANT_BINDING_001
+    // Minting a trusted agent context is necessary but not sufficient.
+    // GrantRegistry still validates the grant on every queryContracts / createProposal call.
+    mintAgent(opts) {
+        const ctx = {
+            kind: "agent",
+            agentId: opts.agentId,
+            grantId: opts.grantId,
+            purpose: opts.purpose,
+            notAfter: opts.notAfter,
+        };
+        this._trusted.add(ctx);
+        return ctx;
+    }
+}
+// ─── Internal standalone factory (not in src/index.ts) ───────────────────────
+// Used by internal tests that directly test the issuer without the full bundle.
+export function createAccessContextIssuerForTest() {
+    return new AccessContextIssuer();
+}
+//# sourceMappingURL=access-context-issuer.js.map

package/dist/auth/access-context-issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-context-issuer.js","sourceRoot":"","sources":["../../src/auth/access-context-issuer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,qFAAqF;AACrF,sFAAsF;AACtF,4EAA4E;AAC5E,oFAAoF;AACpF,yEAAyE;AACzE,qFAAqF;AACrF,oFAAoF;AACpF,+DAA+D;AAC/D,kFAAkF;AAClF,uFAAuF;AACvF,uCAAuC;AACvC,mFAAmF;AACnF,gFAAgF;AAahF,iFAAiF;AACjF,qEAAqE;AACrE,6EAA6E;AAC7E,kDAAkD;AAClD,EAAE;AACF,+CAA+C;AAC/C,gEAAgE;AAChE,4EAA4E;AAE5E,MAAM,OAAO,mBAAmB;IACb,QAAQ,GAAG,IAAI,OAAO,EAAU,CAAC;IAElD,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,4CAA4C;IAE5C,SAAS,CAAC,GAAY;QACpB,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,aAAa,CAAC,GAAY;QACxB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,4EAA4E;gBAC5E,2EAA2E;gBAC3E,mEAAmE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAE7E,4DAA4D;IAC5D,SAAS,CAAC,QAAkB;QAC1B,MAAM,GAAG,GAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oBAAoB;QAClB,MAAM,GAAG,GAA4B,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,yDAAyD;IACzD,4DAA4D;IAC5D,+DAA+D;IAC/D,QAAQ,CAAC,KAAa;QACpB,MAAM,GAAG,GAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gDAAgD;IAChD,oEAAoE;IACpE,4DAA4D;IAC5D,SAAS,CAAC,QAAkB;QAC1B,MAAM,GAAG,GAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,kEAAkE;IAClE,mEAAmE;IACnE,yFAAyF;IACzF,SAAS,CAAC,IAKT;QACC,MAAM,GAAG,GAAwB;YAC/B,IAAI,EAAM,OAAO;YACjB,OAAO,EAAG,IAAI,CAAC,OAAO;YACtB,OAAO,EAAG,IAAI,CAAC,OAAO;YACtB,OAAO,EAAG,IAAI,CAAC,OAAO;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,UAAU,gCAAgC;IAC9C,OAAO,IAAI,mBAAmB,EAAE,CAAC;AACnC,CAAC"}

package/dist/auth/assert-authorized-for-subject.d.ts

@@ -0,0 +1,2 @@
+import type { MintedContext } from "./types.js";
+export declare function assertAuthorizedForSubject(minted: MintedContext, requestedSubject: string): void;

package/dist/auth/assert-authorized-for-subject.js

@@ -0,0 +1,20 @@
+// AUTH_CONTEXT_SUBJECT_SCOPE_HELPER_001
+//
+// When MintedContext.authorizedPersonId is set, enforces that requestedSubject
+// matches it exactly. Throws AUTH_SUBJECT_SCOPE_VIOLATION_001 on mismatch.
+//
+// When authorizedPersonId is absent (undefined), this helper does NOT throw.
+// Absence means the principal is tenant-scoped rather than subject-scoped;
+// the caller is responsible for tenant-level enforcement in that case.
+//
+// IMPORTANT: This helper is NOT full LifeApi callsite enforcement.
+// AUTH_CONTEXT_SUBJECT_SCOPE_ENFORCED_001 (full enforcement at every LifeApi
+// call site, including agent grants) remains deferred to Production-01c/01d.
+export function assertAuthorizedForSubject(minted, requestedSubject) {
+    if (minted.authorizedPersonId !== undefined &&
+        minted.authorizedPersonId !== requestedSubject) {
+        throw Object.assign(new Error(`AUTH_SUBJECT_SCOPE_VIOLATION_001: MintedContext.authorizedPersonId ` +
+            `does not match requestedSubject`), { code: "AUTH_SUBJECT_SCOPE_VIOLATION_001" });
+    }
+}
+//# sourceMappingURL=assert-authorized-for-subject.js.map

package/dist/auth/assert-authorized-for-subject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assert-authorized-for-subject.js","sourceRoot":"","sources":["../../src/auth/assert-authorized-for-subject.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,uEAAuE;AACvE,EAAE;AACF,mEAAmE;AACnE,6EAA6E;AAC7E,6EAA6E;AAI7E,MAAM,UAAU,0BAA0B,CACxC,MAA+B,EAC/B,gBAAwB;IAExB,IACE,MAAM,CAAC,kBAAkB,KAAK,SAAS;QACvC,MAAM,CAAC,kBAAkB,KAAK,gBAAgB,EAC9C,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,qEAAqE;YACrE,iCAAiC,CAClC,EACD,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/auth/backend-context-minting-boundary.d.ts

@@ -0,0 +1,23 @@
+import type { TrustedAgentRegistry } from "../agent/trusted-agent-registry.js";
+import type { GuardianRegistry } from "../guardian/guardian-registry.js";
+import type { AuthAdapter, AuthorizationPolicy, Clock, GuardianContextMintingBoundary, GrantResolver, MintedContext, MintOptions, TenantBoundary } from "./types.js";
+import type { AccessContextIssuer } from "./access-context-issuer.js";
+import type { AuditLog } from "../audit/audit-log.js";
+/** @remarks TEST/DEV ONLY — not for production use. */
+export declare class BackendContextMintingBoundary implements GuardianContextMintingBoundary {
+    private readonly _opts;
+    constructor(_opts: {
+        readonly adapter: AuthAdapter;
+        readonly policy: AuthorizationPolicy;
+        readonly issuer: AccessContextIssuer;
+        readonly clock: Clock;
+        readonly tenantBoundary: TenantBoundary;
+        readonly grantResolver: GrantResolver;
+        readonly trustedAgentRegistry?: TrustedAgentRegistry;
+        readonly guardianRegistry?: GuardianRegistry;
+        readonly guardianAuditLog?: AuditLog;
+    });
+    mint(credential: string, targetPersonId: string, requestedKind: "owner" | "agent" | "system" | "audit", options?: MintOptions): Promise<MintedContext>;
+    private _guardianDeny;
+    mintGuardianContext(credential: string, wardId: string): Promise<MintedContext>;
+}

package/dist/auth/backend-context-minting-boundary.js

@@ -0,0 +1,281 @@
+// TEST/DEV ONLY — BackendContextMintingBoundary.
+// AUTH_OWNER_TENANT_BOUNDARY_CHECKED_001: TenantBoundary.assertOwnership fires before every
+//   OwnerContext mint; fail-closed on throw.
+// AUTH_AGENT_GRANT_RESOLUTION_CHECKED_001: GrantResolver.resolveActiveGrant fires before every
+//   AgentConsentContext mint; undefined → fail-closed.
+// AUTH_AGENT_CONTEXT_NOT_AFTER_BOUNDED_001: AgentConsentContext.notAfter is bounded by the
+//   earlier of decision.notAfter and grantDescriptor.notAfter, compared as UTC instants
+//   (Date.parse epoch ms) — NOT lexicographically. Offset-form ISO strings are handled correctly.
+// AUTH_AGENT_CONTEXT_NOT_AFTER_INVALID_001: fail-closed if either notAfter string is unparseable.
+// PRODUCTION_AUTH_GRANT_PERSON_SCOPE_PROPAGATED_001: agent contexts carry authorizedPersonId from GrantDescriptor.personId.
+//   Broad grants (personId === undefined) are denied with PRODUCTION_AUTH_BROAD_GRANT_DEFERRED_001.
+// AUTH_OWNER_CONTEXT_MINT_DENIED_001: thrown when TenantBoundary denies; internal
+//   AUTH_TENANT_OWNERSHIP_DENIED_001 is NOT propagated — fail closed.
+// AUTH_AGENT_CONTEXT_MINT_DENIED_001: thrown when GrantResolver returns undefined; internal
+//   denial reason (missing/revoked/expired/mismatch) is NOT propagated — fail closed.
+// TRUSTED_AGENT_REGISTRY_GATES_GRANT_001: if trustedAgentRegistry is configured, every
+//   AgentConsentContext mint requires isAgentTrusted(agentId, purpose) === true before
+//   the context is minted. Denial maps to AUTH_AGENT_CONTEXT_MINT_DENIED_001.
+// TRUSTED_AGENT_REGISTRY_FAIL_CLOSED_001: registry exception → treated as untrusted.
+// TRUSTED_AGENT_REGISTRY_OPTIONAL_NO_CHECK_WHEN_ABSENT_001: absent registry → no change.
+//
+// Platform-03 — Guardianship — mintGuardianContext:
+// GUARDIAN_CONTEXT_MINT_GATED_001: registry check (getRelationship + isAuthorized) fires
+//   BEFORE the minting call — no context exists that could access data if the check fails.
+// GUARDIAN_PRINCIPAL_USER_REQUIRED_001: only "user" principals may be guardians; agents,
+//   services, and audit principals are denied via the opaque guardian-deny path.
+// GUARDIAN_REGISTRY_NOT_CONFIGURED_001: no guardianRegistry configured → distinct fail-closed
+//   code (deployment configuration state, not per-ward denial info).
+// GUARDIAN_REGISTRY_FAIL_CLOSED_001: getRelationship/isAuthorized exception → denied.
+// GUARDIAN_CONTEXT_MINT_TENANT_CHECKED_001: TenantBoundary.assertOwnership checked for the
+//   ward before mint; AUTH_TENANT_OWNERSHIP_DENIED_001 maps to the guardian-deny path; any
+//   other tenant-boundary error propagates unchanged.
+// GUARDIAN_CONTEXT_MARKED_001: returned MintedContext carries guardianOf + a snapshot of
+//   guardianScopes at mint time.
+// GUARDIAN_ACTION_UNAUTHORIZED_AUDITED_001: every guardian-deny writes a best-effort audit
+//   event (guardianAuditLog); the single opaque AUTH_GUARDIAN_CONTEXT_MINT_DENIED_001 code is
+//   thrown regardless of the internal reason.
+// AUTH_TOKEN_SECRETS_NOT_AUDITED_001: raw credential never stored or audited.
+//
+// Platform-04 — Purpose enforcement (agent mint path only):
+// PURPOSE_ENFORCEMENT_GATES_GRANT_ACCESS_001: when the caller passes
+//   options.declaredPurpose to mint() AND the resolved grant has a `purpose` set AND
+//   the two differ, the mint is denied. Omitting declaredPurpose (or a grant without
+//   `purpose`) preserves prior unenforced behavior exactly —
+//   GRANT_PURPOSE_DECLARED_NOT_ENFORCED_LIBRARY_LEVEL_001 still holds in that case.
+// PURPOSE_MISMATCH_DENIED_OPAQUE_001: the mismatch denial throws the exact same error
+//   (message + code: AUTH_AGENT_CONTEXT_MINT_DENIED_001) as the grant-not-found path,
+//   so a caller cannot distinguish "no such grant" from "purpose declared doesn't match
+//   the grant's declared purpose" — neither the grant's purpose nor the caller's
+//   declaredPurpose is ever included in the thrown error.
+import { buildAuditEvent } from "../audit/audit-log.js";
+import { asGrantId, asISOTime, asPersonId } from "../types/ids.js";
+// PURPOSE_MISMATCH_DENIED_OPAQUE_001: shared denial thrower — identical error to the
+// grant-not-found path. Extracted so both call sites throw byte-for-byte the same thing.
+function throwAgentContextMintDenied() {
+    throw Object.assign(new Error("AUTH_AGENT_CONTEXT_MINT_DENIED_001: agent context mint denied — " +
+        "grant not found, revoked, expired, or scope mismatch"), { code: "AUTH_AGENT_CONTEXT_MINT_DENIED_001" });
+}
+// AUTH_AGENT_CONTEXT_NOT_AFTER_INVALID_001: both notAfter strings must parse as valid instants.
+// Uses Date.parse (epoch ms) so UTC offset forms like "+02:00" are handled correctly.
+function parseInstantMs(value) {
+    const ms = Date.parse(value);
+    if (Number.isNaN(ms)) {
+        throw Object.assign(new Error(`AUTH_AGENT_CONTEXT_NOT_AFTER_INVALID_001: unparseable notAfter timestamp: ${value}`), { code: "AUTH_AGENT_CONTEXT_NOT_AFTER_INVALID_001" });
+    }
+    return ms;
+}
+// Returns the original string whose instant is earlier. Fails closed on invalid input.
+function earlierNotAfter(a, b) {
+    return parseInstantMs(a) <= parseInstantMs(b) ? a : b;
+}
+/** @remarks TEST/DEV ONLY — not for production use. */
+export class BackendContextMintingBoundary {
+    _opts;
+    constructor(_opts) {
+        this._opts = _opts;
+    }
+    async mint(credential, targetPersonId, requestedKind, options) {
+        const { adapter, policy, issuer, clock, tenantBoundary, grantResolver, trustedAgentRegistry } = this._opts;
+        const declaredPurpose = options?.declaredPurpose;
+        // 1. Verify credential — AUTH_TOKEN_SECRETS_NOT_AUDITED_001: raw credential not stored
+        const principal = await adapter.verify(credential);
+        // 2. Expiry check before policy — AUTH_TOKEN_EXPIRY_CHECKED_001
+        if (principal.expiresAt <= clock.now()) {
+            throw Object.assign(new Error("AUTH_CREDENTIAL_EXPIRED_001: credential has expired"), { code: "AUTH_CREDENTIAL_EXPIRED_001" });
+        }
+        // 3. Resolve authorization decision
+        const decision = await policy.resolve(principal, targetPersonId);
+        // 4. Kind check — AUTH_DECISION_KIND_MISMATCH_001
+        if (decision.kind !== requestedKind) {
+            if (requestedKind === "owner" && principal.principalType === "agent") {
+                throw Object.assign(new Error("AUTH_AGENT_CANNOT_MINT_OWNER_001: an agent principal may not receive an OwnerContext"), { code: "AUTH_AGENT_CANNOT_MINT_OWNER_001" });
+            }
+            if (requestedKind === "system" && principal.principalType !== "service") {
+                throw Object.assign(new Error("AUTH_SERVICE_PRINCIPAL_REQUIRED_FOR_SYSTEM_CONTEXT_001: " +
+                    "only service principals may mint a SystemProjectionContext"), { code: "AUTH_SERVICE_PRINCIPAL_REQUIRED_FOR_SYSTEM_CONTEXT_001" });
+            }
+            throw Object.assign(new Error(`AUTH_DECISION_KIND_MISMATCH_001: policy resolved "${decision.kind}" ` +
+                `but "${requestedKind}" was requested`), { code: "AUTH_DECISION_KIND_MISMATCH_001" });
+        }
+        const base = {
+            principalId: principal.principalId,
+            principalType: principal.principalType,
+            tenantId: principal.tenantId,
+        };
+        switch (decision.kind) {
+            case "owner": {
+                // AUTH_OWNER_TENANT_BOUNDARY_CHECKED_001
+                try {
+                    await tenantBoundary.assertOwnership(principal.tenantId, decision.personId);
+                }
+                catch (err) {
+                    const code = (typeof err === "object" && err !== null)
+                        ? err.code
+                        : undefined;
+                    if (code === "AUTH_TENANT_OWNERSHIP_DENIED_001") {
+                        // AUTH_OWNER_CONTEXT_MINT_DENIED_001: remap denial; internal code not propagated
+                        throw Object.assign(new Error("AUTH_OWNER_CONTEXT_MINT_DENIED_001: owner context mint denied by TenantBoundary"), { code: "AUTH_OWNER_CONTEXT_MINT_DENIED_001" });
+                    }
+                    throw err; // storage/read failure — propagate
+                }
+                const ctx = issuer.mintOwner(asPersonId(decision.personId));
+                return {
+                    ...base,
+                    context: ctx,
+                    authorizedPersonId: principal.authorizedPersonId ?? decision.personId,
+                };
+            }
+            case "agent": {
+                // AUTH_AGENT_GRANT_RESOLUTION_CHECKED_001: pre-mint resolution; storage throws propagate
+                const grant = await grantResolver.resolveActiveGrant(decision.agentId, decision.grantId, principal.tenantId);
+                if (grant === undefined)
+                    throwAgentContextMintDenied();
+                // PRODUCTION_AUTH_BROAD_GRANT_DEFERRED_001: broad grants (no personId) are not
+                // implemented for MVP production agent contexts. Fail closed at mint time.
+                // PRODUCTION_AUTH_NO_SILENT_TENANT_WIDE_AGENT_SCOPE_001
+                if (grant.personId === undefined) {
+                    throw Object.assign(new Error("PRODUCTION_AUTH_BROAD_GRANT_DEFERRED_001: agent grant has no personId — " +
+                        "broad grants are not implemented for production agent contexts"), { code: "PRODUCTION_AUTH_BROAD_GRANT_DEFERRED_001" });
+                }
+                // TRUSTED_AGENT_REGISTRY_GATES_GRANT_001: registry configured → scope-check fires
+                //   BEFORE issuer.mintAgent — no AgentConsentContext exists if the check fails.
+                // TRUSTED_AGENT_REGISTRY_FAIL_CLOSED_001: registry exception → denied.
+                // Denial mapped to AUTH_AGENT_CONTEXT_MINT_DENIED_001 (reason not propagated).
+                if (trustedAgentRegistry !== undefined) {
+                    let trusted = false;
+                    try {
+                        trusted = await trustedAgentRegistry.isAgentTrusted(decision.agentId, decision.purpose);
+                    }
+                    catch {
+                        trusted = false;
+                    }
+                    if (!trusted)
+                        throwAgentContextMintDenied();
+                }
+                // PURPOSE_ENFORCEMENT_GATES_GRANT_ACCESS_001: caller opted in by passing declaredPurpose;
+                // grant also declares a purpose; they differ → opaque denial identical to grant-not-found.
+                if (declaredPurpose !== undefined && grant.purpose !== undefined && grant.purpose !== declaredPurpose) {
+                    throwAgentContextMintDenied();
+                }
+                // AUTH_AGENT_CONTEXT_NOT_AFTER_BOUNDED_001: instant comparison via Date.parse epoch ms
+                // AUTH_AGENT_CONTEXT_NOT_AFTER_INVALID_001: throws if either string is unparseable
+                const boundedNotAfter = earlierNotAfter(decision.notAfter, grant.notAfter);
+                const ctx = issuer.mintAgent({
+                    agentId: decision.agentId,
+                    grantId: asGrantId(decision.grantId),
+                    purpose: decision.purpose,
+                    notAfter: asISOTime(boundedNotAfter),
+                });
+                // PRODUCTION_AUTH_GRANT_PERSON_SCOPE_PROPAGATED_001: authorizedPersonId set from grant.personId
+                // PURPOSE_ENFORCEMENT_GATES_GRANT_ACCESS_001: declaredPurpose carried when caller declared one.
+                return {
+                    ...base,
+                    context: ctx,
+                    authorizedGrantId: decision.grantId,
+                    authorizedPersonId: grant.personId,
+                    ...(declaredPurpose !== undefined ? { declaredPurpose } : {}),
+                };
+            }
+            case "system": {
+                const ctx = issuer.mintSystemProjection();
+                return { ...base, context: ctx };
+            }
+            case "audit": {
+                const ctx = issuer.mintAudit(asPersonId(targetPersonId));
+                return { ...base, context: ctx };
+            }
+        }
+    }
+    // ─── Platform-03 — Guardianship ──────────────────────────────────────────────
+    // GUARDIAN_ACTION_UNAUTHORIZED_AUDITED_001: best-effort audit write (swallowed on failure),
+    //   then throw the single opaque AUTH_GUARDIAN_CONTEXT_MINT_DENIED_001 code — the internal
+    //   reason (unknown relationship, missing scope, expired, tenant mismatch, wrong principal
+    //   type) is never propagated to the caller.
+    async _guardianDeny(principal, wardId) {
+        const { guardianAuditLog, clock } = this._opts;
+        if (guardianAuditLog !== undefined) {
+            try {
+                await guardianAuditLog.write(buildAuditEvent({
+                    actor: `${principal.principalType}:${principal.principalId}`,
+                    decision: "deny",
+                    reasonCode: "GUARDIAN_ACTION_UNAUTHORIZED",
+                    selectorFingerprint: `guardian:mint:ward=${wardId}`,
+                    resultCount: 0,
+                    resultClaimIds: [],
+                    actingAsGuardian: true,
+                    wardId,
+                    now: asISOTime(clock.now()),
+                }));
+            }
+            catch {
+                // Best-effort — audit write failure must not mask the underlying denial.
+            }
+        }
+        throw Object.assign(new Error("AUTH_GUARDIAN_CONTEXT_MINT_DENIED_001: guardian context mint denied — " +
+            "no active guardianship, missing scope, expired, or tenant mismatch"), { code: "AUTH_GUARDIAN_CONTEXT_MINT_DENIED_001" });
+    }
+    // GUARDIAN_CONTEXT_MINT_GATED_001 / GUARDIAN_PRINCIPAL_USER_REQUIRED_001 /
+    // GUARDIAN_REGISTRY_NOT_CONFIGURED_001 / GUARDIAN_CONTEXT_MINT_TENANT_CHECKED_001 /
+    // GUARDIAN_CONTEXT_MARKED_001 — see file header.
+    async mintGuardianContext(credential, wardId) {
+        const { adapter, clock, tenantBoundary, guardianRegistry, issuer } = this._opts;
+        // 1. Verify credential — AUTH_TOKEN_SECRETS_NOT_AUDITED_001: raw credential not stored.
+        const principal = await adapter.verify(credential);
+        // 2. Expiry check — identical to mint().
+        if (principal.expiresAt <= clock.now()) {
+            throw Object.assign(new Error("AUTH_CREDENTIAL_EXPIRED_001: credential has expired"), { code: "AUTH_CREDENTIAL_EXPIRED_001" });
+        }
+        // 3. GUARDIAN_PRINCIPAL_USER_REQUIRED_001: only human user principals may be guardians.
+        if (principal.principalType !== "user") {
+            return this._guardianDeny(principal, wardId);
+        }
+        // 4. GUARDIAN_REGISTRY_NOT_CONFIGURED_001: distinct fail-closed code — deployment
+        //    configuration state, not a per-ward denial reason. Not routed through guardian-deny.
+        if (guardianRegistry === undefined) {
+            throw Object.assign(new Error("GUARDIAN_REGISTRY_NOT_CONFIGURED_001: guardianship not enabled on this " +
+                "deployment; fail-closed"), { code: "GUARDIAN_REGISTRY_NOT_CONFIGURED_001" });
+        }
+        // 5. GUARDIAN_REGISTRY_FAIL_CLOSED_001: any registry exception → rel=undefined/authorized=false.
+        let rel;
+        let authorized = false;
+        try {
+            rel = await guardianRegistry.getRelationship(principal.principalId, wardId);
+            authorized = await guardianRegistry.isAuthorized(principal.principalId, wardId, "context:mint");
+        }
+        catch {
+            rel = undefined;
+            authorized = false;
+        }
+        if (rel === undefined || !authorized) {
+            return this._guardianDeny(principal, wardId);
+        }
+        // 6. GUARDIAN_CONTEXT_MINT_TENANT_CHECKED_001: tenant boundary check for the ward.
+        try {
+            await tenantBoundary.assertOwnership(principal.tenantId, wardId);
+        }
+        catch (err) {
+            const code = (typeof err === "object" && err !== null)
+                ? err.code
+                : undefined;
+            if (code === "AUTH_TENANT_OWNERSHIP_DENIED_001") {
+                return this._guardianDeny(principal, wardId);
+            }
+            throw err; // storage/read failure — propagate unchanged
+        }
+        // 7. GUARDIAN_CONTEXT_MINT_GATED_001: registry + tenant checks (steps 3–6) all complete
+        //    before any context is minted.
+        const ctx = issuer.mintOwner(asPersonId(wardId));
+        // 8. GUARDIAN_CONTEXT_MARKED_001: rel is guaranteed defined here (step 5 already checked).
+        return {
+            context: ctx,
+            principalId: principal.principalId,
+            principalType: principal.principalType,
+            tenantId: principal.tenantId,
+            authorizedPersonId: wardId,
+            guardianOf: asPersonId(wardId),
+            guardianScopes: [...rel.guardianScopes],
+        };
+    }
+}
+//# sourceMappingURL=backend-context-minting-boundary.js.map

package/dist/auth/backend-context-minting-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-context-minting-boundary.js","sourceRoot":"","sources":["../../src/auth/backend-context-minting-boundary.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,4FAA4F;AAC5F,6CAA6C;AAC7C,+FAA+F;AAC/F,uDAAuD;AACvD,2FAA2F;AAC3F,wFAAwF;AACxF,kGAAkG;AAClG,kGAAkG;AAClG,4HAA4H;AAC5H,oGAAoG;AACpG,kFAAkF;AAClF,sEAAsE;AACtE,4FAA4F;AAC5F,sFAAsF;AACtF,uFAAuF;AACvF,uFAAuF;AACvF,8EAA8E;AAC9E,qFAAqF;AACrF,yFAAyF;AACzF,EAAE;AACF,oDAAoD;AACpD,yFAAyF;AACzF,2FAA2F;AAC3F,yFAAyF;AACzF,iFAAiF;AACjF,8FAA8F;AAC9F,qEAAqE;AACrE,sFAAsF;AACtF,2FAA2F;AAC3F,2FAA2F;AAC3F,sDAAsD;AACtD,yFAAyF;AACzF,iCAAiC;AACjC,2FAA2F;AAC3F,8FAA8F;AAC9F,8CAA8C;AAC9C,8EAA8E;AAC9E,EAAE;AACF,4DAA4D;AAC5D,qEAAqE;AACrE,qFAAqF;AACrF,qFAAqF;AACrF,6DAA6D;AAC7D,oFAAoF;AACpF,sFAAsF;AACtF,sFAAsF;AACtF,wFAAwF;AACxF,iFAAiF;AACjF,0DAA0D;AAkB1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEnE,qFAAqF;AACrF,yFAAyF;AACzF,SAAS,2BAA2B;IAClC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,kEAAkE;QAClE,sDAAsD,CACvD,EACD,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAC/C,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,sFAAsF;AACtF,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,6EAA6E,KAAK,EAAE,CAAC,EAC/F,EAAE,IAAI,EAAE,0CAA0C,EAAE,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,uFAAuF;AACvF,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IAC3C,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,uDAAuD;AACvD,MAAM,OAAO,6BAA6B;IAErB;IADnB,YACmB,KAUhB;QAVgB,UAAK,GAAL,KAAK,CAUrB;IACA,CAAC;IAEJ,KAAK,CAAC,IAAI,CACR,UAAsB,EACtB,cAAsB,EACtB,aAAsD,EACtD,OAA2B;QAE3B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3G,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAC;QAEjD,uFAAuF;QACvF,MAAM,SAAS,GAAsB,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEtE,gEAAgE;QAChE,IAAI,SAAS,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;YACvC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,EAAE,IAAI,EAAE,6BAA6B,EAAE,CACxC,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAEjE,kDAAkD;QAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,IAAI,aAAa,KAAK,OAAO,IAAI,SAAS,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;gBACrE,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,sFAAsF,CAAC,EACjG,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;YACJ,CAAC;YACD,IAAI,aAAa,KAAK,QAAQ,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACxE,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0DAA0D;oBAC1D,4DAA4D,CAC7D,EACD,EAAE,IAAI,EAAE,wDAAwD,EAAE,CACnE,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,qDAAqD,QAAQ,CAAC,IAAI,IAAI;gBACtE,QAAQ,aAAa,iBAAiB,CACvC,EACD,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG;YACX,WAAW,EAAI,SAAS,CAAC,WAAW;YACpC,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,QAAQ,EAAO,SAAS,CAAC,QAAQ;SACzB,CAAC;QAEX,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,yCAAyC;gBACzC,IAAI,CAAC;oBACH,MAAM,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC9E,CAAC;gBAAC,OAAO,GAAY,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC;wBACpD,CAAC,CAAE,GAA0B,CAAC,IAAI;wBAClC,CAAC,CAAC,SAAS,CAAC;oBACd,IAAI,IAAI,KAAK,kCAAkC,EAAE,CAAC;wBAChD,iFAAiF;wBACjF,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,iFAAiF,CAAC,EAC5F,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAC/C,CAAC;oBACJ,CAAC;oBACD,MAAM,GAAG,CAAC,CAAC,mCAAmC;gBAChD,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC5D,OAAO;oBACL,GAAG,IAAI;oBACP,OAAO,EAAa,GAAG;oBACvB,kBAAkB,EAAE,SAAS,CAAC,kBAAkB,IAAI,QAAQ,CAAC,QAAQ;iBACtE,CAAC;YACJ,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,yFAAyF;gBACzF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,kBAAkB,CAClD,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,OAAO,EAChB,SAAS,CAAC,QAAQ,CACnB,CAAC;gBACF,IAAI,KAAK,KAAK,SAAS;oBAAE,2BAA2B,EAAE,CAAC;gBACvD,+EAA+E;gBAC/E,2EAA2E;gBAC3E,wDAAwD;gBACxD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,0EAA0E;wBAC1E,gEAAgE,CACjE,EACD,EAAE,IAAI,EAAE,0CAA0C,EAAE,CACrD,CAAC;gBACJ,CAAC;gBACD,kFAAkF;gBAClF,gFAAgF;gBAChF,uEAAuE;gBACvE,+EAA+E;gBAC/E,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;oBACvC,IAAI,OAAO,GAAG,KAAK,CAAC;oBACpB,IAAI,CAAC;wBAAC,OAAO,GAAG,MAAM,oBAAoB,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;oBAAC,CAAC;oBAChG,MAAM,CAAC;wBAAC,OAAO,GAAG,KAAK,CAAC;oBAAC,CAAC;oBAC1B,IAAI,CAAC,OAAO;wBAAE,2BAA2B,EAAE,CAAC;gBAC9C,CAAC;gBACD,0FAA0F;gBAC1F,2FAA2F;gBAC3F,IAAI,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;oBACtG,2BAA2B,EAAE,CAAC;gBAChC,CAAC;gBACD,uFAAuF;gBACvF,mFAAmF;gBACnF,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;oBAC3B,OAAO,EAAG,QAAQ,CAAC,OAAO;oBAC1B,OAAO,EAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACrC,OAAO,EAAG,QAAQ,CAAC,OAAO;oBAC1B,QAAQ,EAAE,SAAS,CAAC,eAAe,CAAC;iBACrC,CAAC,CAAC;gBACH,gGAAgG;gBAChG,gGAAgG;gBAChG,OAAO;oBACL,GAAG,IAAI;oBACP,OAAO,EAAa,GAAG;oBACvB,iBAAiB,EAAG,QAAQ,CAAC,OAAO;oBACpC,kBAAkB,EAAE,KAAK,CAAC,QAAQ;oBAClC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC;YACJ,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAC1C,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACnC,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;gBACzD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,4FAA4F;IAC5F,2FAA2F;IAC3F,2FAA2F;IAC3F,6CAA6C;IACrC,KAAK,CAAC,aAAa,CAAC,SAA4B,EAAE,MAAc;QACtE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC/C,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC;oBAC3C,KAAK,EAAgB,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE;oBAC1E,QAAQ,EAAa,MAAM;oBAC3B,UAAU,EAAW,8BAA8B;oBACnD,mBAAmB,EAAE,sBAAsB,MAAM,EAAE;oBACnD,WAAW,EAAU,CAAC;oBACtB,cAAc,EAAO,EAAE;oBACvB,gBAAgB,EAAK,IAAI;oBACzB,MAAM;oBACN,GAAG,EAAkB,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;iBAC5C,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;YAC3E,CAAC;QACH,CAAC;QACD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,wEAAwE;YACxE,oEAAoE,CACrE,EACD,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,oFAAoF;IACpF,iDAAiD;IACjD,KAAK,CAAC,mBAAmB,CAAC,UAAkB,EAAE,MAAc;QAC1D,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAEhF,wFAAwF;QACxF,MAAM,SAAS,GAAsB,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAEtE,yCAAyC;QACzC,IAAI,SAAS,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;YACvC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,qDAAqD,CAAC,EAChE,EAAE,IAAI,EAAE,6BAA6B,EAAE,CACxC,CAAC;QACJ,CAAC;QAED,wFAAwF;QACxF,IAAI,SAAS,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,kFAAkF;QAClF,0FAA0F;QAC1F,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,yEAAyE;gBACzE,yBAAyB,CAC1B,EACD,EAAE,IAAI,EAAE,sCAAsC,EAAE,CACjD,CAAC;QACJ,CAAC;QAED,iGAAiG;QACjG,IAAI,GAAqC,CAAC;QAC1C,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,gBAAgB,CAAC,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC5E,UAAU,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,SAAS,CAAC;YAChB,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/C,CAAC;QAED,mFAAmF;QACnF,IAAI,CAAC;YACH,MAAM,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC;gBACpD,CAAC,CAAE,GAA0B,CAAC,IAAI;gBAClC,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,IAAI,KAAK,kCAAkC,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,GAAG,CAAC,CAAC,6CAA6C;QAC1D,CAAC;QAED,wFAAwF;QACxF,mCAAmC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAEjD,2FAA2F;QAC3F,OAAO;YACL,OAAO,EAAa,GAAG;YACvB,WAAW,EAAS,SAAS,CAAC,WAAW;YACzC,aAAa,EAAO,SAAS,CAAC,aAAa;YAC3C,QAAQ,EAAY,SAAS,CAAC,QAAQ;YACtC,kBAAkB,EAAE,MAAM;YAC1B,UAAU,EAAU,UAAU,CAAC,MAAM,CAAC;YACtC,cAAc,EAAM,CAAC,GAAG,GAAG,CAAC,cAAc,CAAC;SAC5C,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/default-authorization-policy.d.ts

@@ -0,0 +1,7 @@
+import type { AuthorizationDecision, AuthorizationPolicy, Clock, VerifiedPrincipal } from "./types.js";
+/** @remarks TEST/DEV/REFERENCE ONLY — not for production use. */
+export declare class DefaultAuthorizationPolicy implements AuthorizationPolicy {
+    private readonly _clock;
+    constructor(_clock: Clock);
+    resolve(principal: VerifiedPrincipal, targetPersonId: string): Promise<AuthorizationDecision>;
+}

package/dist/auth/default-authorization-policy.js

@@ -0,0 +1,64 @@
+// TEST/DEV/REFERENCE ONLY — do NOT export from src/index.ts.
+// This is not a production-ready AuthorizationPolicy.
+// Hosts MUST implement their own AuthorizationPolicy backed by a real TenantBoundary
+// and GrantResolver. DefaultAuthorizationPolicy uses no database and no real grant lookup.
+// AUTH_TEST_ISSUER_NOT_PRODUCTION_001
+/** @remarks TEST/DEV/REFERENCE ONLY — not for production use. */
+export class DefaultAuthorizationPolicy {
+    _clock;
+    constructor(_clock) {
+        this._clock = _clock;
+    }
+    async resolve(principal, targetPersonId) {
+        const { principalType, roles, authorizedPersonId, grantIds, expiresAt } = principal;
+        switch (principalType) {
+            case "service": {
+                if (!roles.includes("system")) {
+                    throw Object.assign(new Error("AUTH_NO_VALID_DECISION_001: service principal has no system role"), { code: "AUTH_NO_VALID_DECISION_001" });
+                }
+                return { kind: "system", projection: "default" };
+            }
+            case "audit": {
+                if (!roles.includes("audit")) {
+                    throw Object.assign(new Error("AUTH_NO_VALID_DECISION_001: audit principal has no audit role"), { code: "AUTH_NO_VALID_DECISION_001" });
+                }
+                return { kind: "audit" };
+            }
+            case "agent": {
+                // AUTH_AGENT_CANNOT_MINT_OWNER_001: any non-agent role is a privilege escalation signal
+                const hasNonAgentRole = roles.some(r => r !== "agent");
+                if (hasNonAgentRole) {
+                    throw Object.assign(new Error("AUTH_NO_VALID_DECISION_001: agent principal carries non-agent roles — possible privilege escalation"), { code: "AUTH_NO_VALID_DECISION_001" });
+                }
+                if (!roles.includes("agent")) {
+                    throw Object.assign(new Error("AUTH_NO_VALID_DECISION_001: agent principal has no agent role"), { code: "AUTH_NO_VALID_DECISION_001" });
+                }
+                const grantId = grantIds[0];
+                if (grantId === undefined) {
+                    throw Object.assign(new Error("AUTH_NO_VALID_DECISION_001: agent principal has no grantIds"), { code: "AUTH_NO_VALID_DECISION_001" });
+                }
+                return {
+                    kind: "agent",
+                    agentId: principal.principalId,
+                    grantId,
+                    purpose: "obligation_review",
+                    notAfter: expiresAt,
+                };
+            }
+            case "user": {
+                if (authorizedPersonId !== undefined && authorizedPersonId !== targetPersonId) {
+                    throw Object.assign(new Error("AUTH_TENANT_BOUNDARY_VIOLATED_001: credential's authorizedPersonId does not match targetPersonId"), { code: "AUTH_TENANT_BOUNDARY_VIOLATED_001" });
+                }
+                if (!roles.includes("owner")) {
+                    throw Object.assign(new Error("AUTH_NO_VALID_DECISION_001: user principal has no owner role"), { code: "AUTH_NO_VALID_DECISION_001" });
+                }
+                return { kind: "owner", personId: targetPersonId };
+            }
+            default: {
+                const _exhaustive = principalType;
+                throw Object.assign(new Error("AUTH_NO_VALID_DECISION_001: unsupported principalType"), { code: "AUTH_NO_VALID_DECISION_001" });
+            }
+        }
+    }
+}
+//# sourceMappingURL=default-authorization-policy.js.map

package/dist/auth/default-authorization-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-authorization-policy.js","sourceRoot":"","sources":["../../src/auth/default-authorization-policy.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,sDAAsD;AACtD,qFAAqF;AACrF,2FAA2F;AAC3F,sCAAsC;AAUtC,iEAAiE;AACjE,MAAM,OAAO,0BAA0B;IACR;IAA7B,YAA6B,MAAa;QAAb,WAAM,GAAN,MAAM,CAAO;IAAG,CAAC;IAE9C,KAAK,CAAC,OAAO,CACX,SAAiC,EACjC,cAAsB;QAEtB,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC;QAEpF,QAAQ,aAAa,EAAE,CAAC;YACtB,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC9B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,kEAAkE,CAAC,EAC7E,EAAE,IAAI,EAAE,4BAA4B,EAAE,CACvC,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YACnD,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,+DAA+D,CAAC,EAC1E,EAAE,IAAI,EAAE,4BAA4B,EAAE,CACvC,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC3B,CAAC;YAED,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,wFAAwF;gBACxF,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;gBACvD,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,qGAAqG,CACtG,EACD,EAAE,IAAI,EAAE,4BAA4B,EAAE,CACvC,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,+DAA+D,CAAC,EAC1E,EAAE,IAAI,EAAE,4BAA4B,EAAE,CACvC,CAAC;gBACJ,CAAC;gBACD,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,6DAA6D,CAAC,EACxE,EAAE,IAAI,EAAE,4BAA4B,EAAE,CACvC,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,IAAI,EAAM,OAAO;oBACjB,OAAO,EAAG,SAAS,CAAC,WAAW;oBAC/B,OAAO;oBACP,OAAO,EAAG,mBAAiC;oBAC3C,QAAQ,EAAE,SAAS;iBACpB,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,KAAK,cAAc,EAAE,CAAC;oBAC9E,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,kGAAkG,CACnG,EACD,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAC9C,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC7B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,8DAA8D,CAAC,EACzE,EAAE,IAAI,EAAE,4BAA4B,EAAE,CACvC,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;YACrD,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,WAAW,GAAU,aAAa,CAAC;gBACzC,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,uDAAuD,CAAC,EAClE,EAAE,IAAI,EAAE,4BAA4B,EAAE,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/auth/fake-auth-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { AuthAdapter, VerifiedPrincipal } from "./types.js";
+/** @remarks TEST-ONLY — pre-configured stub; performs no real credential verification. */
+export declare class FakeAuthAdapter implements AuthAdapter {
+    private readonly _principal;
+    constructor(_principal: VerifiedPrincipal);
+    verify(_credential: string): Promise<VerifiedPrincipal>;
+}

package/dist/auth/fake-auth-adapter.js

@@ -0,0 +1,27 @@
+// TEST-ONLY — FakeAuthAdapter.
+//
+// AUTH_TEST_ISSUER_NOT_PRODUCTION_001: this class does NOT perform real credential
+//   verification. It accepts a pre-configured VerifiedPrincipal and returns it on
+//   every verify() call regardless of the credential string provided.
+//
+// Constraints:
+//   - Do NOT export from src/index.ts.
+//   - Do NOT use in production deployments.
+//   - Do NOT parse JWTs, read environment secrets, or call external services.
+//   - Do NOT create a false impression of production-grade authentication.
+//
+// Usage: inject into tests that verify the auth boundary interface contracts,
+//   not the credential verification logic.
+/** @remarks TEST-ONLY — pre-configured stub; performs no real credential verification. */
+export class FakeAuthAdapter {
+    _principal;
+    constructor(_principal) {
+        this._principal = _principal;
+    }
+    // The credential string is accepted but never inspected or parsed.
+    // No JWT library. No secret reading. No IdP call. No environment variable access.
+    async verify(_credential) {
+        return this._principal;
+    }
+}
+//# sourceMappingURL=fake-auth-adapter.js.map

package/dist/auth/fake-auth-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-auth-adapter.js","sourceRoot":"","sources":["../../src/auth/fake-auth-adapter.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,mFAAmF;AACnF,kFAAkF;AAClF,sEAAsE;AACtE,EAAE;AACF,eAAe;AACf,uCAAuC;AACvC,4CAA4C;AAC5C,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,2CAA2C;AAI3C,0FAA0F;AAC1F,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,UAA6B;QAA7B,eAAU,GAAV,UAAU,CAAmB;IAAG,CAAC;IAE9D,mEAAmE;IACnE,kFAAkF;IAClF,KAAK,CAAC,MAAM,CAAC,WAAmB;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/auth/http-client.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Minimal HTTP client interface for JWKS endpoint fetch.
+ * Implementations must enforce timeoutMs and maxBytes.
+ * Must throw on HTTP error, timeout, or size limit exceeded.
+ * Never called with HTTP (only HTTPS) URLs — enforced at JwksKeyRingAuthAdapter construction.
+ */
+export interface HttpClient {
+    getText(url: string, options: {
+        timeoutMs: number;
+        maxBytes: number;
+    }): Promise<string>;
+}

package/dist/auth/http-client.js

@@ -0,0 +1,7 @@
+// src/auth/http-client.ts
+// INTERNAL — not exported from src/index.ts.
+// Injectable HTTP client interface used by JwksKeyRing.
+// The library does not bundle a default implementation — host supplies one.
+// See docs/specs/post-mvp-external-idp-oidc-spec.md §6.1
+export {};
+//# sourceMappingURL=http-client.js.map

package/dist/auth/http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../../src/auth/http-client.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,6CAA6C;AAC7C,wDAAwD;AACxD,4EAA4E;AAC5E,yDAAyD"}