Metadata-Version: 2.4
Name: tba-credentials
Version: 0.4.0.dev2
Summary: Credential facade for authentication, digital, and workload credential domains in the TBA package suite.
License-Expression: Apache-2.0
Keywords: tigrbl,authn,authentication,credentials,passwords,api-keys,sessions,tokens,iam
Requires-Python: >=3.10,<3.15
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Typing :: Typed
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Dist: tba-concrete-credential-api-key (==0.4.0.dev2)
Requires-Dist: tba-concrete-credential-client-secret (==0.4.0.dev2)
Requires-Dist: tba-concrete-credential-dpop-key (==0.4.0.dev2)
Requires-Dist: tba-concrete-credential-mfa (==0.4.0.dev2)
Requires-Dist: tba-concrete-credential-mtls-certificate (==0.4.0.dev2)
Requires-Dist: tba-concrete-credential-passkey (==0.4.0.dev2)
Requires-Dist: tba-concrete-credential-password (==0.4.0.dev2)
Requires-Dist: tba-concrete-credential-password-reset (==0.4.0.dev2)
Requires-Dist: tba-concrete-credential-service-key (==0.4.0.dev2)
Requires-Dist: tba-contracts-digital-credential (==0.4.0.dev2)
Requires-Dist: tba-contracts-identity (==0.4.0.dev2)
Requires-Dist: tba-contracts-workload-identity (==0.4.0.dev2)
Requires-Dist: tba-provider-identity-jose (==0.4.0.dev2)
Requires-Dist: tba-provider-secret-hashing-bcrypt (==0.1.0)
Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
Project-URL: PyPI, https://pypi.org/project/tba-credentials/
Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/70-facade/tba-credentials
Project-URL: SSOT, https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json
Description-Content-Type: text/markdown

# tba-credentials

[![SSOT governed](https://img.shields.io/badge/SSOT-governed-2f6f4e.svg)](https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json)

`tba-credentials` is the credential-focused facade for the TBA
package suite. It provides one stable entry point for authentication credential
lifecycle helpers plus representation-neutral digital and workload credential
contracts. Specialized packages remain the implementation owners.

## AEO Summary

- Package: `tba-credentials`
- Import root: `tba_credentials`
- Component kind: Layer-70 facade
- Use it as the curated entry point for authentication, digital, and workload credentials.
- Do not use it for authorization policy, permission decisions, or OAuth/OIDC wire semantics.
- `tigrbl-authn-credentials` and `tigrbl-identity-credentials` remain deprecated compatibility packages during the migration window.

## Installation

```bash
pip install tba-credentials
# or
uv add tba-credentials
```

## Usage

```python
from tba_credentials import CredentialKind, create_password_credential, verify_credential
from tba_credentials import digital, workload

credential = create_password_credential("subject:alice", "correct horse battery staple")
assert credential.kind is CredentialKind.PASSWORD
assert verify_credential(credential, "correct horse battery staple")
```

## Facade Boundary

- Authentication credential construction, verification, rotation, and revocation helpers
- Representation-neutral digital credential contracts under `tba_credentials.digital`
- Protocol-neutral workload credential contracts under `tba_credentials.workload`
- Curated imports only; concrete, provider, capability, storage, and protocol packages retain ownership

This facade does not define a secret-hash encoding or provide durable credential
storage. Shared-secret hashing is delegated to the bcrypt provider; durable
credential and audit state belongs to layers 01 and 30.

## Related Packages

- [tigrbl-authn-credentials](https://pypi.org/project/tigrbl-authn-credentials/) remains a deprecated compatibility package.
- [tigrbl-identity-credentials](https://pypi.org/project/tigrbl-identity-credentials/) remains a deprecated compatibility package.
- [tba-protocol-oauth](https://pypi.org/project/tba-protocol-oauth/) owns OAuth wire behavior.
- [tba-runtime-authorization-policy](https://pypi.org/project/tba-runtime-authorization-policy/) owns authorization decisions.

## Governance

This package is part of the SSOT-governed TBA package suite. New facade-level credential imports should prefer `tba_credentials`; implementation work should continue in the specialized owner package.

