EXTENSIONS

GSSAPI initial-token producer (no mutual authentication or continuation): native-JS Kerberos 5 / SPNEGO client (no shell-out) — password → AS pre-auth → TGT → TGS → service ticket → SPNEGO `Negotiate` token, with session keys, tickets, and headers stored as vault-backed datastore resources (requires installing a vault named `krb5`; any backend). Drives GSSAPI-protected HTTP endpoints and hands single-use SPNEGO headers to other models via data + CEL. Pure WebCrypto + fetch over MS-KKDCP (works in a fetch-only sandbox); raw TCP/UDP KDC transports available where socket permissions allow.