[nkavian]

Summary

Align session credential handling with AEP specifications #58.

• Preserve API-key values as complete HTTP header values, including Bearer and Basic presentations, while rejecting unsafe header characters.
• Accept case-insensitive OAuth token types and empty Basic usernames, passwords, and realms.
• Allow configured API-key handlers to verify those presentations and reject ambiguous credential matches.
• Update documentation and regression tests for credential issuance, presentation, and revocation.
• Refresh the bundled specification artifacts and include patch changesets.

Validation

• pnpm verify
• pnpm check-publish
• pnpm conformance:agent --specs-dir ../aep-specs
• pnpm conformance:service --specs-dir ../aep-specs
• pnpm conformance:platform --specs-dir ../aep-specs
• pnpm changeset status --since=origin/main

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!