@marxbiotech/signet-integration 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Marx Biotech
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,111 @@
+# @marxbiotech/signet-integration
+
+Signet (OAuth 2.1 / OIDC, Ory Hydra) **resource-server** integration for
+NestJS: Bearer access-token verification against the issuer's JWKS, RFC 6750
+`WWW-Authenticate` challenges, RFC 9728 protected-resource metadata, the
+deployment-profile pair check, and token-scope narrowing. Signet is treated as
+an **auth provider**: this package proves `(iss, sub)` and hands the claims to
+your `SignetPrincipalResolver`; who that is locally, and how the mapping is
+stored, is yours.
+
+## Wiring
+
+```ts
+// your-signet.options.ts -- your values, one object
+export const MY_OPTIONS = {
+  admissionScope: 'myservice:access',
+  canonicalResourceFor: (host) => `https://${host}/api/mcp`, // or `https://${host}` for a bare origin
+  deployedProfiles: {
+    production: { host: 'my.example', namespace: 'my-production' },
+    staging: { host: 'my.staging.example', namespace: 'my-staging' },
+  },
+  developmentProfile: { canonicalResource: 'http://localhost/api/mcp', host: 'localhost', namespace: 'development' },
+  env: {
+    deploymentNamespace: 'MY_DEPLOYMENT_NAMESPACE',
+    jwtAudience: 'MY_JWT_AUDIENCE',
+    jwtIssuer: 'MY_JWT_ISSUER',
+    jwtJwksUri: 'MY_JWT_JWKS_URI',
+    jwtClockToleranceS: 'MY_JWT_CLOCK_TOLERANCE_S',
+    signetEnabled: 'SIGNET_AUTH_ENABLED',       // omit = the Bearer channel is always on
+    legacyApiKeyEnabled: 'LEGACY_API_KEY_ENABLED', // omit = no legacy channel
+  },
+  realm: 'myservice',
+  requestPrincipalKey: 'user',            // where the guard attaches your principal
+  scopesSupported: ['myservice:access'],  // RFC 9728 scopes_supported; must include the admission scope
+} as const satisfies SignetIntegrationOptions<'production' | 'staging'>;
+
+// your resolver -- Passport's verify callback, as a Nest provider.
+// Annotate the return type: a class method gets no contextual typing from
+// `implements`, so without it `ok: true` widens to `boolean` and fails to compile.
+@Injectable()
+export class MyResolver implements SignetPrincipalResolver<MyPrincipal> {
+  constructor(private readonly users: UsersRepository) {}
+  async resolve(identity: VerifiedSignetIdentity): Promise<PrincipalResolution<MyPrincipal>> {
+    const user = await this.users.findBySignetSubject(identity.subject); // or identity.claims.erp_user_id
+    if (!user) return { ok: false, reason: 'unknown_subject' };          // → 403, reason only logged
+    return { ok: true, principal: user, logFields: { userId: user.id } }; // logFields render on the decision line
+    // throw new PrincipalStoreUnavailableError(cause) when the store is unreachable → 503
+  }
+}
+
+// your auth module
+@Module({
+  imports: [
+    UsersModule,
+    SignetIntegrationModule.forRoot({
+      options: MY_OPTIONS,
+      resolver: MyResolver,          // a class, or { useFactory, inject } / { useValue } / { useExisting }
+      imports: [UsersModule],        // whatever the resolver's constructor needs
+    }),
+  ],
+  exports: [SignetIntegrationModule], // so the process module below can inject the package's providers
+})
+export class AuthModule {}
+
+// the process module that serves the resource
+@Module({
+  imports: [AuthModule],
+  controllers: [createProtectedResourceController(MY_OPTIONS), ...yourControllers],
+  providers: [
+    { provide: APP_GUARD, useClass: SignetBearerGuard },      // honours @Public(); or call it from your own credential dispatcher
+    { provide: APP_FILTER, useClass: BearerChallengeFilter }, // or call challengeFor() from your own filter
+  ],
+})
+export class ApiModule {}
+```
+
+Requirements: `ConfigModule` must be global (the strategy, filter and profile
+service inject `ConfigService`); validate the env variables named in `options.env`
+in your own config validation (Joi or otherwise), the package only re-checks the
+clock tolerance and throws on a missing issuer or JWKS URI.
+
+Handlers get a typed principal through
+`createSignetPrincipalDecorator(MY_OPTIONS, isMyPrincipal)`; Nest does not check
+the parameter's declared type, so the predicate is the enforcement.
+
+`forRoot` validates the options at construction (admission scope present in
+`scopesSupported`, no quote-breaking characters in `realm`/`admissionScope`,
+unique namespaces and hosts, one resource path across every profile, no
+reserved `requestPrincipalKey`) and `createScopeVocabulary` validates its
+encoder (one-to-one, disjoint from the admission scope, defaults inside the
+vocabulary).
+
+Testing: `@marxbiotech/signet-integration/testing` exports `startTestIssuer()`
+(a local JWKS endpoint plus a signer that mints tokens in the shape Signet
+issues), `startJwksServer()`, `FIXTURE_OPTIONS` and `FIXTURE_DEVELOPMENT_PROFILE`.
+
+## What is deliberately NOT here
+
+- How principals are stored (grant tables, a `users` column, a claim): the resolver's business.
+- Consumer credential dispatch between Bearer and a legacy channel.
+- Config validation of the env variables (see above).
+- The login (OIDC authorization-code) flow. This package is the resource-server side only.
+
+## Rules a consumer relies on
+
+- A canonical resource WITH a path (an MCP endpoint URI): only that path's 401 carries `resource_metadata`. A BARE-ORIGIN resource: every 401 does.
+- The admission scope is checked by the guard (403 with `insufficient_scope`); a 403 carrying `requiredScopes` gets `insufficient_scope`; a resolver refusal is a bare 403.
+- Verifier failures (bad signature, wrong audience, unreachable JWKS) are one uniform 401; the reason is only logged.
+- `iat` is not required and no `maxTokenAge` is applied; `client_id` is required (RFC 9068 §2.2, Signet issues it always).
+- JWKS options are fixed: 3 s timeout, 30 s cooldown, 10 min cache.
+- The guard's decision log line is `metric reason <your logFields> clientId environment`; the fixed keys are reserved.

package/dist/bearer-challenge.d.ts

@@ -0,0 +1,27 @@
+import { ForbiddenException, UnauthorizedException } from '@nestjs/common';
+import { type ChannelFlags } from './config';
+import { type DeploymentProfile } from './deployment-profile';
+import { type SignetIntegrationOptions } from './options';
+export declare function protectedResourceMetadataUrl(canonicalResource: string): string;
+export declare function protectedResourceMetadataPath(options: SignetIntegrationOptions): string;
+export declare function isResourceRequest(profile: DeploymentProfile, requestPath: string): boolean;
+export declare function bearerChallenge(options: SignetIntegrationOptions, profile: DeploymentProfile, request: {
+    resource: boolean;
+}): string;
+export declare function insufficientScopeChallenge(options: SignetIntegrationOptions, scopes: readonly string[]): string;
+export interface ScopeChallengeCarrier {
+    readonly requiredScopes: readonly string[];
+}
+export declare function carriesScopeChallenge(exception: ForbiddenException): exception is ForbiddenException & ScopeChallengeCarrier;
+export declare class InsufficientScopeException extends ForbiddenException implements ScopeChallengeCarrier {
+    readonly requiredScopes: readonly string[];
+    constructor(admissionScope: string);
+}
+export type ChallengeDecision = {
+    header: null;
+    malformedCarrier: boolean;
+} | {
+    header: string;
+    malformedCarrier: false;
+};
+export declare function challengeFor(options: SignetIntegrationOptions, profile: DeploymentProfile, channels: ChannelFlags, exception: ForbiddenException | UnauthorizedException, requestPath: string): ChallengeDecision;

package/dist/bearer-challenge.filter.d.ts

@@ -0,0 +1,13 @@
+import { type ArgumentsHost, ForbiddenException, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { BaseExceptionFilter, HttpAdapterHost } from '@nestjs/core';
+import { SignetDeploymentProfileService } from './deployment-profile';
+import { type SignetIntegrationOptions } from './options';
+export declare class BearerChallengeFilter extends BaseExceptionFilter {
+    private readonly profiles;
+    private readonly options;
+    private readonly logger;
+    private readonly channels;
+    constructor(profiles: SignetDeploymentProfileService, adapterHost: HttpAdapterHost, configService: ConfigService, options: SignetIntegrationOptions);
+    catch(exception: ForbiddenException | UnauthorizedException, host: ArgumentsHost): void;
+}

package/dist/bearer-challenge.filter.js

@@ -0,0 +1,76 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var BearerChallengeFilter_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BearerChallengeFilter = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const core_1 = require("@nestjs/core");
+const bearer_challenge_1 = require("./bearer-challenge");
+const config_2 = require("./config");
+const deployment_profile_1 = require("./deployment-profile");
+const log_sanitise_1 = require("./log-sanitise");
+const options_1 = require("./options");
+// Attaches `WWW-Authenticate` to the refusals that admit one (RFC 6750 §3,
+// RFC 9728 §5.1). A 401 raised anywhere the Nest router reaches -- a guard,
+// an interceptor, a handler -- carries the same header. Middleware mounted on
+// the http adapter (Swagger's Basic auth, say) never reaches the router and
+// keeps its own challenge.
+//
+// The rendering of the response itself is untouched -- `super.catch` is
+// Nest's own -- so the body stays whatever the exception carries, and only
+// the header is added. A consumer that renders its own bodies keeps its own
+// filter and calls `challengeFor` from it instead of registering this one.
+//
+// With the Signet channel on, a 401 from a route that authenticates with a
+// different credential gets the Bearer challenge too.
+let BearerChallengeFilter = BearerChallengeFilter_1 = class BearerChallengeFilter extends core_1.BaseExceptionFilter {
+    profiles;
+    options;
+    logger = new common_1.Logger(BearerChallengeFilter_1.name);
+    channels;
+    constructor(profiles, adapterHost, configService, options) {
+        super(adapterHost.httpAdapter);
+        this.profiles = profiles;
+        this.options = options;
+        this.channels = (0, config_2.readChannelFlags)(options, configService);
+    }
+    catch(exception, host) {
+        const request = host.switchToHttp().getRequest();
+        const decision = (0, bearer_challenge_1.challengeFor)(this.options, this.profiles.profile, this.channels, exception, request.path);
+        if (decision.header !== null) {
+            host
+                .switchToHttp()
+                .getResponse()
+                .setHeader('WWW-Authenticate', decision.header);
+        }
+        else if (decision.malformedCarrier) {
+            // A 403 that CARRIES `requiredScopes` in a shape that cannot be
+            // rendered is a bug in a carrier: still answered bare (a broken header
+            // helps no one), but not SILENTLY bare -- the structural check would
+            // otherwise turn a bug into a correct-looking response.
+            this.logger.warn(`403 carries malformed requiredScopes, answered without challenge: metric=scope_challenge_malformed errorName=${(0, log_sanitise_1.sanitiseLogToken)(exception.name)}`);
+        }
+        super.catch(exception, host);
+    }
+};
+exports.BearerChallengeFilter = BearerChallengeFilter;
+exports.BearerChallengeFilter = BearerChallengeFilter = BearerChallengeFilter_1 = __decorate([
+    (0, common_1.Catch)(common_1.ForbiddenException, common_1.UnauthorizedException),
+    __param(3, (0, common_1.Inject)(options_1.SIGNET_INTEGRATION_OPTIONS)),
+    __metadata("design:paramtypes", [deployment_profile_1.SignetDeploymentProfileService,
+        core_1.HttpAdapterHost,
+        config_1.ConfigService, Object])
+], BearerChallengeFilter);
+//# sourceMappingURL=bearer-challenge.filter.js.map

package/dist/bearer-challenge.filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-challenge.filter.js","sourceRoot":"","sources":["../src/bearer-challenge.filter.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,2CAA+C;AAC/C,uCAAoE;AAGpE,yDAAkD;AAClD,qCAA+D;AAC/D,6DAAsE;AACtE,iDAAkD;AAClD,uCAGmB;AAEnB,2EAA2E;AAC3E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,2BAA2B;AAC3B,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,EAAE;AACF,2EAA2E;AAC3E,sDAAsD;AAE/C,IAAM,qBAAqB,6BAA3B,MAAM,qBAAsB,SAAQ,0BAAmB;IAKzC;IAIA;IARF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAChD,QAAQ,CAAe;IAExC,YACmB,QAAwC,EACzD,WAA4B,EAC5B,aAA4B,EAEX,OAAiC;QAElD,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QANd,aAAQ,GAAR,QAAQ,CAAgC;QAIxC,YAAO,GAAP,OAAO,CAA0B;QAGlD,IAAI,CAAC,QAAQ,GAAG,IAAA,yBAAgB,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC3D,CAAC;IAEQ,KAAK,CACZ,SAAqD,EACrD,IAAmB;QAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAA,+BAAY,EAC3B,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,CAAC,OAAO,EACrB,IAAI,CAAC,QAAQ,EACb,SAAS,EACT,OAAO,CAAC,IAAI,CACb,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC7B,IAAI;iBACD,YAAY,EAAE;iBACd,WAAW,EAAY;iBACvB,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACrC,gEAAgE;YAChE,uEAAuE;YACvE,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gHAAgH,IAAA,+BAAgB,EAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACnJ,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF,CAAA;AA3CY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,cAAK,EAAC,2BAAkB,EAAE,8BAAqB,CAAC;IAS5C,WAAA,IAAA,eAAM,EAAC,oCAA0B,CAAC,CAAA;qCAHR,mDAA8B;QAC5C,sBAAe;QACb,sBAAa;GAPnB,qBAAqB,CA2CjC"}

package/dist/bearer-challenge.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InsufficientScopeException = void 0;
+exports.protectedResourceMetadataUrl = protectedResourceMetadataUrl;
+exports.protectedResourceMetadataPath = protectedResourceMetadataPath;
+exports.isResourceRequest = isResourceRequest;
+exports.bearerChallenge = bearerChallenge;
+exports.insufficientScopeChallenge = insufficientScopeChallenge;
+exports.carriesScopeChallenge = carriesScopeChallenge;
+exports.challengeFor = challengeFor;
+const common_1 = require("@nestjs/common");
+// RFC 9728 §3.1: for a resource identifier WITH a path, the well-known
+// segment is inserted between host and path --
+//   https://h/api/mcp → https://h/.well-known/oauth-protected-resource/api/mcp
+// -- and for a bare origin it is appended at the root.
+function protectedResourceMetadataUrl(canonicalResource) {
+    const url = new URL(canonicalResource);
+    if (url.search !== '' || url.hash !== '') {
+        throw new Error(`canonical resource must not carry a query or fragment: ${canonicalResource}`);
+    }
+    const path = url.pathname === '/' ? '' : url.pathname;
+    return `${url.origin}/.well-known/oauth-protected-resource${path}`;
+}
+// The metadata path relative to the origin, taken from the same builder the
+// challenge uses and read off the development profile. Assumes every
+// profile's canonical resource carries the same path; the consumer pins that
+// for its own table. The metadata controller mounts its route on it.
+function protectedResourceMetadataPath(options) {
+    return new URL(protectedResourceMetadataUrl(options.developmentProfile.canonicalResource)).pathname;
+}
+// The request paths whose 401 may carry `resource_metadata`: the ones that
+// ARE the canonical resource. With a resource that carries a path (an MCP
+// endpoint URI), only that path qualifies -- any other path's 401 must not
+// announce it. With a bare-origin resource the whole origin is the resource,
+// so every request qualifies. Express serves the trailing-slash spelling too,
+// so the two spellings reach the same decision.
+function isResourceRequest(profile, requestPath) {
+    const resourcePath = new URL(profile.canonicalResource).pathname;
+    if (resourcePath === '/')
+        return true;
+    const trim = (value) => value.replace(/\/+$/, '');
+    return trim(requestPath) === trim(resourcePath);
+}
+// RFC 6750 §3 challenge for a 401. `scope` names the SERVICE scope the token
+// must carry; a client that already holds it and is still refused has a
+// local-authorization problem no re-authorisation solves, which is why the
+// 403 for that case carries no challenge at all (see carriesScopeChallenge).
+function bearerChallenge(options, profile, request) {
+    const parts = [`Bearer realm="${options.realm}"`];
+    if (request.resource) {
+        parts.push(`resource_metadata="${protectedResourceMetadataUrl(profile.canonicalResource)}"`);
+    }
+    parts.push(`scope="${options.admissionScope}"`);
+    return parts.join(', ');
+}
+// RFC 6750 §3.1 `insufficient_scope`: the token is valid but does not carry
+// the scope the request needs. This IS solvable by re-authorising with the
+// right scope, so it says so -- and the 403s that carry it are the only ones
+// that do. `scopes` is what the caller must carry, not what it is missing.
+function insufficientScopeChallenge(options, scopes) {
+    return `Bearer realm="${options.realm}", error="insufficient_scope", scope="${scopes.join(' ')}"`;
+}
+// Checked for shape, not presence: a `requiredScopes` that is not a
+// non-empty string array would render an unusable `scope=`. A plain
+// authorization refusal carries no field at all. The filter logs the
+// malformed case; this predicate only decides.
+function carriesScopeChallenge(exception) {
+    const { requiredScopes } = exception;
+    return (Array.isArray(requiredScopes) &&
+        requiredScopes.length > 0 &&
+        requiredScopes.every((scope) => typeof scope === 'string'));
+}
+// A valid token without the admission scope. Takes the scope, not the
+// options: the message and `requiredScopes` are both built from it here, so
+// the guard cannot spell one without the other.
+class InsufficientScopeException extends common_1.ForbiddenException {
+    requiredScopes;
+    constructor(admissionScope) {
+        super(`token does not carry the ${admissionScope} scope`);
+        this.requiredScopes = [admissionScope];
+    }
+}
+exports.InsufficientScopeException = InsufficientScopeException;
+// The whole of the `WWW-Authenticate` decision, as a pure function, so a
+// consumer with an exception filter of its own (a catch-all that renders its
+// own bodies, guards streaming responses, ...) can make the same decision
+// BearerChallengeFilter does and set the header itself.
+//
+//   Signet channel off            → no header: advertising a closed channel
+//                                   sends clients to log in for nothing
+//   403 carrying requiredScopes   → insufficient_scope (re-authorising fixes it)
+//   403 with a malformed field    → no header, malformedCarrier: true (a bug
+//                                   in a carrier; the caller should log it)
+//   any other 403                 → no header: a wider OAuth scope supplies
+//                                   no local authorization
+//   401                           → Bearer challenge; resource_metadata only
+//                                   when the request IS the resource
+function challengeFor(options, profile, channels, exception, requestPath) {
+    if (!channels.signetEnabled)
+        return { header: null, malformedCarrier: false };
+    if (exception instanceof common_1.ForbiddenException) {
+        if (carriesScopeChallenge(exception)) {
+            return {
+                header: insufficientScopeChallenge(options, exception.requiredScopes),
+                malformedCarrier: false,
+            };
+        }
+        return {
+            header: null,
+            malformedCarrier: 'requiredScopes' in exception,
+        };
+    }
+    return {
+        header: bearerChallenge(options, profile, {
+            resource: isResourceRequest(profile, requestPath),
+        }),
+        malformedCarrier: false,
+    };
+}
+//# sourceMappingURL=bearer-challenge.js.map

package/dist/bearer-challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-challenge.js","sourceRoot":"","sources":["../src/bearer-challenge.ts"],"names":[],"mappings":";;;AAUA,oEAWC;AAMD,sEAMC;AAQD,8CAQC;AAMD,0CAaC;AAMD,gEAKC;AAsBD,sDASC;AAmCD,oCA0BC;AA3KD,2CAA2E;AAM3E,uEAAuE;AACvE,+CAA+C;AAC/C,+EAA+E;AAC/E,uDAAuD;AACvD,SAAgB,4BAA4B,CAC1C,iBAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,0DAA0D,iBAAiB,EAAE,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACtD,OAAO,GAAG,GAAG,CAAC,MAAM,wCAAwC,IAAI,EAAE,CAAC;AACrE,CAAC;AAED,4EAA4E;AAC5E,qEAAqE;AACrE,6EAA6E;AAC7E,qEAAqE;AACrE,SAAgB,6BAA6B,CAC3C,OAAiC;IAEjC,OAAO,IAAI,GAAG,CACZ,4BAA4B,CAAC,OAAO,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAC3E,CAAC,QAAQ,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,gDAAgD;AAChD,SAAgB,iBAAiB,CAC/B,OAA0B,EAC1B,WAAmB;IAEnB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC;IACjE,IAAI,YAAY,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;AAClD,CAAC;AAED,6EAA6E;AAC7E,wEAAwE;AACxE,2EAA2E;AAC3E,6EAA6E;AAC7E,SAAgB,eAAe,CAC7B,OAAiC,EACjC,OAA0B,EAC1B,OAA8B;IAE9B,MAAM,KAAK,GAAG,CAAC,iBAAiB,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,sBAAsB,4BAA4B,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,SAAgB,0BAA0B,CACxC,OAAiC,EACjC,MAAyB;IAEzB,OAAO,iBAAiB,OAAO,CAAC,KAAK,yCAAyC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACpG,CAAC;AAkBD,oEAAoE;AACpE,oEAAoE;AACpE,qEAAqE;AACrE,+CAA+C;AAC/C,SAAgB,qBAAqB,CACnC,SAA6B;IAE7B,MAAM,EAAE,cAAc,EAAE,GAAG,SAA2C,CAAC;IACvE,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAC7B,cAAc,CAAC,MAAM,GAAG,CAAC;QACzB,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,gDAAgD;AAChD,MAAa,0BACX,SAAQ,2BAAkB;IAGjB,cAAc,CAAoB;IAE3C,YAAY,cAAsB;QAChC,KAAK,CAAC,4BAA4B,cAAc,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC;CACF;AAVD,gEAUC;AAMD,yEAAyE;AACzE,6EAA6E;AAC7E,0EAA0E;AAC1E,wDAAwD;AACxD,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,iFAAiF;AACjF,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,2DAA2D;AAC3D,6EAA6E;AAC7E,qEAAqE;AACrE,SAAgB,YAAY,CAC1B,OAAiC,EACjC,OAA0B,EAC1B,QAAsB,EACtB,SAAqD,EACrD,WAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IAC9E,IAAI,SAAS,YAAY,2BAAkB,EAAE,CAAC;QAC5C,IAAI,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,0BAA0B,CAAC,OAAO,EAAE,SAAS,CAAC,cAAc,CAAC;gBACrE,gBAAgB,EAAE,KAAK;aACxB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;SAChD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE;YACxC,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC;SAClD,CAAC;QACF,gBAAgB,EAAE,KAAK;KACxB,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,23 @@
+import { type ConfigService } from '@nestjs/config';
+import { type DeploymentProfile } from './deployment-profile';
+import { type SignetIntegrationOptions } from './options';
+export type SignetEnvOptions = Pick<SignetIntegrationOptions, 'env'>;
+export interface JwtSettings {
+    readonly audience: string;
+    readonly clockToleranceS: number;
+    readonly issuer: string;
+    readonly jwksUri: string;
+}
+export interface ChannelFlags {
+    readonly legacyApiKeyEnabled: boolean;
+    readonly signetEnabled: boolean;
+}
+export type SignetAuthConfig = ChannelFlags & ({
+    readonly jwt: JwtSettings;
+    readonly signetEnabled: true;
+} | {
+    readonly jwt: null;
+    readonly signetEnabled: false;
+});
+export declare function readChannelFlags(options: SignetEnvOptions, configService: ConfigService): ChannelFlags;
+export declare function readSignetAuthConfig(options: SignetEnvOptions, configService: ConfigService, profile: DeploymentProfile): SignetAuthConfig;

package/dist/config.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readChannelFlags = readChannelFlags;
+exports.readSignetAuthConfig = readSignetAuthConfig;
+// The channel switches alone -- what a credential dispatcher needs. Never
+// touches the verifier settings, so a dispatcher can be built (and tested)
+// without an issuer. A channel with no variable name has no switch: Signet
+// is then always on, and there is no legacy channel.
+function readChannelFlags(options, configService) {
+    const { legacyApiKeyEnabled, signetEnabled } = options.env;
+    return {
+        legacyApiKeyEnabled: legacyApiKeyEnabled !== undefined &&
+            configService.get(legacyApiKeyEnabled, 'true') === 'true',
+        signetEnabled: signetEnabled === undefined ||
+            configService.get(signetEnabled, 'false') === 'true',
+    };
+}
+// The clock tolerance, re-checked here rather than trusted. `Number('')` and
+// `Number('none')` differ: the
+// first is 0, the second is NaN, and jose compares `exp` as
+// `exp <= now - clockTolerance`, which is false for every token once the
+// tolerance is NaN. A token would then never expire, silently. Nothing in the
+// type system says a ConfigService was built through validation, and this
+// function takes one from anywhere.
+function readClockTolerance(options, configService) {
+    const raw = configService.get(options.env.jwtClockToleranceS, 60);
+    const seconds = typeof raw === 'string' && raw.trim() === '' ? Number.NaN : Number(raw);
+    if (!Number.isInteger(seconds) || seconds < 0 || seconds > 300) {
+        throw new Error(`${options.env.jwtClockToleranceS} must be an integer between 0 and 300`);
+    }
+    return seconds;
+}
+// Reads the channel flags and the verifier settings. The consumer's config
+// validation is the gate for the issuer and the JWKS URI: this never fills a
+// default for either, so an enabled channel with missing settings must have
+// failed at boot -- and throws here if it did not.
+function readSignetAuthConfig(options, configService, profile) {
+    const { legacyApiKeyEnabled, signetEnabled } = readChannelFlags(options, configService);
+    if (!signetEnabled) {
+        return { jwt: null, legacyApiKeyEnabled, signetEnabled };
+    }
+    const issuer = configService.getOrThrow(options.env.jwtIssuer);
+    const jwksUri = configService.getOrThrow(options.env.jwtJwksUri);
+    const clockToleranceS = readClockTolerance(options, configService);
+    return {
+        jwt: {
+            audience: profile.canonicalResource,
+            clockToleranceS,
+            issuer,
+            jwksUri,
+        },
+        legacyApiKeyEnabled,
+        signetEnabled,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":";;AAmCA,4CAaC;AA+BD,oDAyBC;AAzED,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,qDAAqD;AACrD,SAAgB,gBAAgB,CAC9B,OAAyB,EACzB,aAA4B;IAE5B,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAC3D,OAAO;QACL,mBAAmB,EACjB,mBAAmB,KAAK,SAAS;YACjC,aAAa,CAAC,GAAG,CAAS,mBAAmB,EAAE,MAAM,CAAC,KAAK,MAAM;QACnE,aAAa,EACX,aAAa,KAAK,SAAS;YAC3B,aAAa,CAAC,GAAG,CAAS,aAAa,EAAE,OAAO,CAAC,KAAK,MAAM;KAC/D,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,+BAA+B;AAC/B,4DAA4D;AAC5D,yEAAyE;AACzE,8EAA8E;AAC9E,0EAA0E;AAC1E,oCAAoC;AACpC,SAAS,kBAAkB,CACzB,OAAyB,EACzB,aAA4B;IAE5B,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAC3B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAC9B,EAAE,CACH,CAAC;IACF,MAAM,OAAO,GACX,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,uCAAuC,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,mDAAmD;AACnD,SAAgB,oBAAoB,CAClC,OAAyB,EACzB,aAA4B,EAC5B,OAA0B;IAE1B,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAC7D,OAAO,EACP,aAAa,CACd,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAS,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAS,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACnE,OAAO;QACL,GAAG,EAAE;YACH,QAAQ,EAAE,OAAO,CAAC,iBAAiB;YACnC,eAAe;YACf,MAAM;YACN,OAAO;SACR;QACD,mBAAmB;QACnB,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/deployment-profile.d.ts

@@ -0,0 +1,25 @@
+import { ConfigService } from '@nestjs/config';
+import { DEVELOPMENT_ENVIRONMENT, type SignetIntegrationOptions } from './options';
+export interface DeploymentProfile<E extends string = string> {
+    readonly canonicalResource: string;
+    readonly environment: E | typeof DEVELOPMENT_ENVIRONMENT;
+    readonly host: string;
+    readonly namespace: string;
+}
+export type DeploymentProfileResolution<E extends string> = {
+    ok: false;
+    reason: string;
+} | {
+    ok: true;
+    profile: DeploymentProfile<E>;
+};
+export interface DeploymentProfileInput {
+    audience: string | undefined;
+    namespace: string | undefined;
+    nodeEnv: string | undefined;
+}
+export declare function resolveDeploymentProfile<E extends string>(options: SignetIntegrationOptions<E>, input: DeploymentProfileInput): DeploymentProfileResolution<E>;
+export declare class SignetDeploymentProfileService {
+    readonly profile: Readonly<DeploymentProfile>;
+    constructor(configService: ConfigService, options: SignetIntegrationOptions);
+}

package/dist/deployment-profile.js

@@ -0,0 +1,103 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignetDeploymentProfileService = void 0;
+exports.resolveDeploymentProfile = resolveDeploymentProfile;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const options_1 = require("./options");
+// Pure, so the consumer's boot-time validation and the runtime service
+// evaluate the identical rule. Exact string matches throughout: no
+// trailing-slash tolerance or case folding.
+function resolveDeploymentProfile(options, input) {
+    const { audience, namespace, nodeEnv } = input;
+    const { deploymentNamespace: namespaceEnv, jwtAudience: audienceEnv } = options.env;
+    if (namespace === undefined && audience === undefined) {
+        if (nodeEnv === 'production') {
+            return {
+                ok: false,
+                reason: `${namespaceEnv} and ${audienceEnv} are required in production`,
+            };
+        }
+        return {
+            ok: true,
+            profile: {
+                ...options.developmentProfile,
+                environment: options_1.DEVELOPMENT_ENVIRONMENT,
+            },
+        };
+    }
+    if (namespace === undefined || audience === undefined) {
+        return {
+            ok: false,
+            reason: `${namespaceEnv} and ${audienceEnv} must be configured together`,
+        };
+    }
+    const match = Object.entries(options.deployedProfiles).find(([, profile]) => profile.namespace === namespace);
+    if (match === undefined) {
+        return {
+            ok: false,
+            reason: `${namespaceEnv} names no known deployment (got a value not in the deployed profiles table)`,
+        };
+    }
+    const [environment, { host }] = match;
+    const expectedResource = options.canonicalResourceFor(host);
+    if (audience !== expectedResource) {
+        // The expected value is safe to print: it is a public identifier, and
+        // naming it is what lets an operator see which half of the pair was
+        // copied from the wrong overlay.
+        return {
+            ok: false,
+            reason: `${audienceEnv} does not match ${namespaceEnv}=${namespace} (expected ${expectedResource})`,
+        };
+    }
+    return {
+        ok: true,
+        profile: {
+            canonicalResource: expectedResource,
+            environment,
+            host,
+            namespace,
+        },
+    };
+}
+// Runtime access to the profile the consumer's config validation already
+// checked at boot. Resolved once, at construction, from the same pure
+// function -- so a process whose config bypassed that validation still cannot
+// obtain a profile it should not have: it throws here instead.
+//
+// A consumer that wants `profile.environment` typed as its own union
+// subclasses this and re-declares `profile` with the narrower type; the DI
+// token cannot carry the type parameter.
+let SignetDeploymentProfileService = class SignetDeploymentProfileService {
+    profile;
+    constructor(configService, options) {
+        const resolution = resolveDeploymentProfile(options, {
+            audience: configService.get(options.env.jwtAudience),
+            namespace: configService.get(options.env.deploymentNamespace),
+            nodeEnv: configService.get('NODE_ENV'),
+        });
+        if (!resolution.ok) {
+            throw new Error(`deployment profile rejected: ${resolution.reason}`);
+        }
+        this.profile = resolution.profile;
+    }
+};
+exports.SignetDeploymentProfileService = SignetDeploymentProfileService;
+exports.SignetDeploymentProfileService = SignetDeploymentProfileService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(options_1.SIGNET_INTEGRATION_OPTIONS)),
+    __metadata("design:paramtypes", [config_1.ConfigService, Object])
+], SignetDeploymentProfileService);
+//# sourceMappingURL=deployment-profile.js.map

package/dist/deployment-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-profile.js","sourceRoot":"","sources":["../src/deployment-profile.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAqCA,4DAyDC;AA9FD,2CAAoD;AACpD,2CAA+C;AAE/C,uCAKmB;AA0BnB,uEAAuE;AACvE,mEAAmE;AACnE,4CAA4C;AAC5C,SAAgB,wBAAwB,CACtC,OAAoC,EACpC,KAA6B;IAE7B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC/C,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,GACnE,OAAO,CAAC,GAAG,CAAC;IACd,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG,YAAY,QAAQ,WAAW,6BAA6B;aACxE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE;gBACP,GAAG,OAAO,CAAC,kBAAkB;gBAC7B,WAAW,EAAE,iCAAuB;aACrC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,YAAY,QAAQ,WAAW,8BAA8B;SACzE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GACT,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CACxC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,YAAY,6EAA6E;SACrG,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;IACtC,MAAM,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,sEAAsE;QACtE,oEAAoE;QACpE,iCAAiC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,WAAW,mBAAmB,YAAY,IAAI,SAAS,cAAc,gBAAgB,GAAG;SACpG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE;YACP,iBAAiB,EAAE,gBAAgB;YACnC,WAAW;YACX,IAAI;YACJ,SAAS;SACV;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,sEAAsE;AACtE,8EAA8E;AAC9E,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,2EAA2E;AAC3E,yCAAyC;AAElC,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IAChC,OAAO,CAA8B;IAE9C,YACE,aAA4B,EACQ,OAAiC;QAErE,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,EAAE;YACnD,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAS,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC5D,SAAS,EAAE,aAAa,CAAC,GAAG,CAAS,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACrE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAS,UAAU,CAAC;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACpC,CAAC;CACF,CAAA;AAjBY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,oCAA0B,CAAC,CAAA;qCADpB,sBAAa;GAJnB,8BAA8B,CAiB1C"}

package/dist/guard.d.ts

@@ -0,0 +1,18 @@
+import { type ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { SignetDeploymentProfileService } from './deployment-profile';
+import { type SignetIntegrationOptions } from './options';
+import { type SignetPrincipalResolver } from './principal-resolver';
+declare const SignetBearerGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
+export declare class SignetBearerGuard extends SignetBearerGuard_base {
+    private readonly resolver;
+    private readonly profiles;
+    private readonly signetOptions;
+    private readonly reflector;
+    private readonly logger;
+    constructor(resolver: SignetPrincipalResolver, profiles: SignetDeploymentProfileService, signetOptions: SignetIntegrationOptions, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private logDecision;
+    private logFailure;
+}
+export {};