{"version":3,"file":"registry-auth-Bm5AR-fB.mjs","sources":["../src/services/registry-auth.ts"],"sourcesContent":["import { generateAccessToken } from \"@renown/sdk/node\";\nimport { getRenown } from \"./auth.js\";\n\n/**\n * Mint a Renown bearer token bound to the given registry URL via the JWT\n * `aud` claim. Throws if the user is not authenticated (`ph login` first).\n *\n * The audience binding is what lets the registry distinguish a token minted\n * for it from one minted for a different service or registry.\n */\nexport async function mintRegistryAuthToken(\n  registryUrl: string,\n  expiresInSeconds: number,\n): Promise<string> {\n  const renown = await getRenown();\n  if (!renown.user) {\n    throw new Error(\"Not authenticated with Renown. Run 'ph login' first.\");\n  }\n  const result = await generateAccessToken(renown, {\n    expiresIn: expiresInSeconds,\n    aud: registryUrl,\n  });\n  return result.token;\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAUA,eAAsB,sBACpB,aACA,kBACiB;CACjB,MAAM,SAAS,MAAM,UAAU;CAC/B,IAAI,CAAC,OAAO,MACV,MAAM,IAAI,MAAM,sDAAsD;CAMxE,QAAO,MAJc,oBAAoB,QAAQ;EAC/C,WAAW;EACX,KAAK;CACP,CAAC,EAAA,CACa;AAChB","debug_id":"d0d0a6bc-dc22-5a36-9c82-560310b04535"}