@venizia/ignis-kernel 0.2.0-0 → 0.2.0-10

package/dist/cjs/base/repositories/sqls/recursive-tree.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RecursiveTreeSql = exports.RecursiveTreeDirections = void 0;
+const core_1 = require("@venizia/ignis-helpers/core");
+const drizzle_orm_1 = require("drizzle-orm");
+const pg_core_1 = require("drizzle-orm/pg-core");
+const sqlite_core_1 = require("drizzle-orm/sqlite-core");
+/** Walk direction relative to `rootId`: DOWN follows `parentColumn -> idColumn` (descendants), UP follows the reverse (ancestors). */
+class RecursiveTreeDirections {
+    static { this.UP = 'UP'; }
+    static { this.DOWN = 'DOWN'; }
+    static { this.SCHEME_SET = new Set([this.UP, this.DOWN]); }
+    static isValid(direction) {
+        return this.SCHEME_SET.has(direction);
+    }
+}
+exports.RecursiveTreeDirections = RecursiveTreeDirections;
+/** Internal only - not part of {@link IRecursiveTreeOptions}. Derived from `table`, never accepted as an option. */
+class RecursiveTreeEngines {
+    static { this.POSTGRES = 'POSTGRES'; }
+    static { this.SQLITE = 'SQLITE'; }
+    static { this.SCHEME_SET = new Set([this.POSTGRES, this.SQLITE]); }
+}
+/** A SQL identifier is safe to splice only after it matches this allowlist - see {@link RecursiveTreeSql.assertValidIdentifier}. */
+const IDENTIFIER_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+ * ASCII Unit Separator (0x1F) - chosen because it does not occur in real ids, unlike `/` or `,`.
+ * See {@link RecursiveTreeSql} for the exactness limitation this relies on.
+ */
+const SQLITE_PATH_DELIMITER = drizzle_orm_1.sql.raw('char(31)');
+/**
+ * Returns the CTE definition only - the caller writes its own `SELECT ... FROM <name>` around it.
+ * Engine is read off `table`, never asked of the caller, so no option can disagree with the schema.
+ * SQLite's `path` is `char(31)`-delimited text, not an array: exact unless an id contains that byte,
+ * which this class does not reject. Identifiers cannot be parameterized, so `name`/`idColumn`/
+ * `parentColumn`/`columns` are allowlist-checked before reaching a template.
+ */
+class RecursiveTreeSql {
+    static assertValidIdentifier(opts) {
+        const { field, value } = opts;
+        if (!IDENTIFIER_PATTERN.test(value)) {
+            throw (0, core_1.getError)({
+                message: `[RecursiveTreeSql.walk] Invalid '${field}' | Expected letters, digits and underscores only, not starting with a digit | Got: ${value}`,
+            });
+        }
+    }
+    static walk(opts) {
+        const { name, table, rootId, direction, maxDepth, idColumn = 'id', parentColumn = 'parent_id', columns = [], recursiveFilter, trackPath = false, startDepth = 0, } = opts;
+        RecursiveTreeSql.assertValidIdentifier({ field: 'name', value: name });
+        RecursiveTreeSql.assertValidIdentifier({ field: 'idColumn', value: idColumn });
+        RecursiveTreeSql.assertValidIdentifier({ field: 'parentColumn', value: parentColumn });
+        columns.forEach(column => RecursiveTreeSql.assertValidIdentifier({ field: 'columns', value: column }));
+        if (!RecursiveTreeDirections.isValid(direction)) {
+            throw (0, core_1.getError)({
+                message: `[RecursiveTreeSql.walk] Invalid 'direction' | Expected ${RecursiveTreeDirections.UP} or ${RecursiveTreeDirections.DOWN} | Got: ${direction}`,
+            });
+        }
+        if (!Number.isInteger(maxDepth) || maxDepth <= 0) {
+            throw (0, core_1.getError)({
+                message: `[RecursiveTreeSql.walk] Invalid 'maxDepth' | Expected a positive integer | Got: ${maxDepth}`,
+            });
+        }
+        if (!(0, drizzle_orm_1.is)(table, drizzle_orm_1.Table)) {
+            throw (0, core_1.getError)({
+                message: `[RecursiveTreeSql.walk] Invalid 'table' | Expected a Drizzle table | Got: ${typeof table}`,
+            });
+        }
+        const engine = RecursiveTreeSql.detectEngine(table);
+        const tableName = (0, drizzle_orm_1.getTableName)(table);
+        RecursiveTreeSql.assertValidIdentifier({ field: 'table', value: tableName });
+        const tableIdentifier = drizzle_orm_1.sql.identifier(tableName);
+        const cteIdentifier = drizzle_orm_1.sql.identifier(name);
+        const idIdentifier = drizzle_orm_1.sql.identifier(idColumn);
+        const parentIdentifier = drizzle_orm_1.sql.identifier(parentColumn);
+        const extraIdentifiers = columns.map(column => drizzle_orm_1.sql.identifier(column));
+        const baseColumnList = drizzle_orm_1.sql.join([idIdentifier, parentIdentifier, ...extraIdentifiers], (0, drizzle_orm_1.sql) `, `);
+        const recursiveColumnList = drizzle_orm_1.sql.join([idIdentifier, parentIdentifier, ...extraIdentifiers].map(identifier => (0, drizzle_orm_1.sql) `t.${identifier}`), (0, drizzle_orm_1.sql) `, `);
+        const depthCast = RecursiveTreeSql.compileDepthCast({ engine, depth: startDepth });
+        const { basePathColumns, recursivePathColumns } = trackPath
+            ? RecursiveTreeSql.compileCycleGuardFragments({ engine, idIdentifier })
+            : { basePathColumns: (0, drizzle_orm_1.sql) ``, recursivePathColumns: (0, drizzle_orm_1.sql) `` };
+        const baseCase = (0, drizzle_orm_1.sql) `SELECT ${baseColumnList}, ${depthCast} AS depth${basePathColumns} FROM ${tableIdentifier} WHERE ${idIdentifier} = ${rootId}`;
+        // DOWN walks parent -> children (t.parentColumn = r.idColumn); UP walks child -> parent (t.idColumn = r.parentColumn).
+        const joinCondition = direction === RecursiveTreeDirections.DOWN
+            ? (0, drizzle_orm_1.sql) `t.${parentIdentifier} = r.${idIdentifier}`
+            : (0, drizzle_orm_1.sql) `t.${idIdentifier} = r.${parentIdentifier}`;
+        // `NOT r.is_cycle` stops expanding a row already flagged cyclic - the row itself stays in the
+        // result set with is_cycle = true, only its own children are cut off.
+        const cycleGuard = trackPath ? (0, drizzle_orm_1.sql) ` AND NOT r.is_cycle` : (0, drizzle_orm_1.sql) ``;
+        const extraFilter = recursiveFilter ? (0, drizzle_orm_1.sql) ` AND (${recursiveFilter})` : (0, drizzle_orm_1.sql) ``;
+        const recursiveCase = (0, drizzle_orm_1.sql) `SELECT ${recursiveColumnList}, r.depth + 1${recursivePathColumns} FROM ${tableIdentifier} t JOIN ${cteIdentifier} r ON ${joinCondition} WHERE r.depth + 1 <= ${maxDepth}${cycleGuard}${extraFilter}`;
+        return (0, drizzle_orm_1.sql) `WITH RECURSIVE ${cteIdentifier} AS (${baseCase} UNION ALL ${recursiveCase})`;
+    }
+    /** See {@link RecursiveTreeSql} for why there is no separate `engine` option. */
+    static detectEngine(table) {
+        if ((0, drizzle_orm_1.is)(table, pg_core_1.PgTable)) {
+            return RecursiveTreeEngines.POSTGRES;
+        }
+        if ((0, drizzle_orm_1.is)(table, sqlite_core_1.SQLiteTable)) {
+            return RecursiveTreeEngines.SQLITE;
+        }
+        throw (0, core_1.getError)({
+            message: `[RecursiveTreeSql.walk] Invalid 'table' | Expected a Postgres or SQLite Drizzle table | Got: ${(0, drizzle_orm_1.getTableName)(table)}`,
+        });
+    }
+    /** Postgres needs an explicit cast so the base and recursive terms agree on the `depth` column's type; SQLite's looser typing does not, but casts anyway for parity and to fail loudly on a non-numeric `startDepth`. */
+    static compileDepthCast(opts) {
+        const { engine, depth } = opts;
+        switch (engine) {
+            case RecursiveTreeEngines.POSTGRES: {
+                return (0, drizzle_orm_1.sql) `${depth}::int`;
+            }
+            case RecursiveTreeEngines.SQLITE: {
+                return (0, drizzle_orm_1.sql) `CAST(${depth} AS INTEGER)`;
+            }
+            default: {
+                throw (0, core_1.getError)({
+                    message: `[RecursiveTreeSql.walk] Invalid 'engine' | Got: ${engine}`,
+                });
+            }
+        }
+    }
+    /** See {@link RecursiveTreeSql} for why Postgres and SQLite need different `path`/`is_cycle` shapes. */
+    static compileCycleGuardFragments(opts) {
+        const { engine, idIdentifier } = opts;
+        switch (engine) {
+            case RecursiveTreeEngines.POSTGRES: {
+                return {
+                    basePathColumns: (0, drizzle_orm_1.sql) `, ARRAY[${idIdentifier}] AS path, false AS is_cycle`,
+                    recursivePathColumns: (0, drizzle_orm_1.sql) `, r.path || t.${idIdentifier} AS path, t.${idIdentifier} = ANY(r.path) AS is_cycle`,
+                };
+            }
+            case RecursiveTreeEngines.SQLITE: {
+                return {
+                    basePathColumns: (0, drizzle_orm_1.sql) `, ${SQLITE_PATH_DELIMITER} || ${idIdentifier} || ${SQLITE_PATH_DELIMITER} AS path, 0 AS is_cycle`,
+                    recursivePathColumns: (0, drizzle_orm_1.sql) `, r.path || t.${idIdentifier} || ${SQLITE_PATH_DELIMITER} AS path, instr(r.path, ${SQLITE_PATH_DELIMITER} || t.${idIdentifier} || ${SQLITE_PATH_DELIMITER}) > 0 AS is_cycle`,
+                };
+            }
+            default: {
+                throw (0, core_1.getError)({
+                    message: `[RecursiveTreeSql.walk] Invalid 'engine' | Got: ${engine}`,
+                });
+            }
+        }
+    }
+}
+exports.RecursiveTreeSql = RecursiveTreeSql;
+//# sourceMappingURL=recursive-tree.js.map

package/dist/cjs/base/repositories/sqls/recursive-tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recursive-tree.js","sourceRoot":"","sources":["../../../../../src/base/repositories/sqls/recursive-tree.ts"],"names":[],"mappings":";;;AACA,sDAAuD;AAEvD,6CAA2D;AAC3D,iDAA8C;AAC9C,yDAAsD;AAEtD,sIAAsI;AACtI,MAAa,uBAAuB;aAClB,OAAE,GAAG,IAAI,CAAC;aACV,SAAI,GAAG,MAAM,CAAC;aACd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,SAAiB;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;;AAPH,0DAQC;AAID,oHAAoH;AACpH,MAAM,oBAAoB;aACR,aAAQ,GAAG,UAAU,CAAC;aACtB,WAAM,GAAG,QAAQ,CAAC;aAClB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;;AAKrE,oIAAoI;AACpI,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAEtD;;;GAGG;AACH,MAAM,qBAAqB,GAAG,iBAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAoClD;;;;;;GAMG;AACH,MAAa,gBAAgB;IACnB,MAAM,CAAC,qBAAqB,CAAC,IAAsC;QACzE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE9B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,oCAAoC,KAAK,uFAAuF,KAAK,EAAE;aACjJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,IAA2B;QACrC,MAAM,EACJ,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,EACT,QAAQ,EACR,QAAQ,GAAG,IAAI,EACf,YAAY,GAAG,WAAW,EAC1B,OAAO,GAAG,EAAE,EACZ,eAAe,EACf,SAAS,GAAG,KAAK,EACjB,UAAU,GAAG,CAAC,GACf,GAAG,IAAI,CAAC;QAET,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC/E,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CACvB,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAC5E,CAAC;QAEF,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0DAA0D,uBAAuB,CAAC,EAAE,OAAO,uBAAuB,CAAC,IAAI,WAAW,SAAS,EAAE;aACvJ,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,mFAAmF,QAAQ,EAAE;aACvG,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAA,gBAAE,EAAC,KAAK,EAAE,mBAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,6EAA6E,OAAO,KAAK,EAAE;aACrG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpD,MAAM,SAAS,GAAG,IAAA,0BAAY,EAAC,KAAK,CAAC,CAAC;QACtC,gBAAgB,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAE7E,MAAM,eAAe,GAAG,iBAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,iBAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,iBAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,gBAAgB,GAAG,iBAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAEvE,MAAM,cAAc,GAAG,iBAAG,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAAC,EAAE,IAAA,iBAAG,EAAA,IAAI,CAAC,CAAC;QAChG,MAAM,mBAAmB,GAAG,iBAAG,CAAC,IAAI,CAClC,CAAC,YAAY,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,IAAA,iBAAG,EAAA,KAAK,UAAU,EAAE,CAAC,EAC7F,IAAA,iBAAG,EAAA,IAAI,CACR,CAAC;QAEF,MAAM,SAAS,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QACnF,MAAM,EAAE,eAAe,EAAE,oBAAoB,EAAE,GAAG,SAAS;YACzD,CAAC,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACvE,CAAC,CAAC,EAAE,eAAe,EAAE,IAAA,iBAAG,EAAA,EAAE,EAAE,oBAAoB,EAAE,IAAA,iBAAG,EAAA,EAAE,EAAE,CAAC;QAE5D,MAAM,QAAQ,GAAG,IAAA,iBAAG,EAAA,UAAU,cAAc,KAAK,SAAS,YAAY,eAAe,SAAS,eAAe,UAAU,YAAY,MAAM,MAAM,EAAE,CAAC;QAElJ,uHAAuH;QACvH,MAAM,aAAa,GACjB,SAAS,KAAK,uBAAuB,CAAC,IAAI;YACxC,CAAC,CAAC,IAAA,iBAAG,EAAA,KAAK,gBAAgB,QAAQ,YAAY,EAAE;YAChD,CAAC,CAAC,IAAA,iBAAG,EAAA,KAAK,YAAY,QAAQ,gBAAgB,EAAE,CAAC;QAErD,8FAA8F;QAC9F,sEAAsE;QACtE,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,IAAA,iBAAG,EAAA,qBAAqB,CAAC,CAAC,CAAC,IAAA,iBAAG,EAAA,EAAE,CAAC;QAChE,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,IAAA,iBAAG,EAAA,SAAS,eAAe,GAAG,CAAC,CAAC,CAAC,IAAA,iBAAG,EAAA,EAAE,CAAC;QAE7E,MAAM,aAAa,GAAG,IAAA,iBAAG,EAAA,UAAU,mBAAmB,gBAAgB,oBAAoB,SAAS,eAAe,WAAW,aAAa,SAAS,aAAa,yBAAyB,QAAQ,GAAG,UAAU,GAAG,WAAW,EAAE,CAAC;QAE/N,OAAO,IAAA,iBAAG,EAAA,kBAAkB,aAAa,QAAQ,QAAQ,cAAc,aAAa,GAAG,CAAC;IAC1F,CAAC;IAED,iFAAiF;IACzE,MAAM,CAAC,YAAY,CAAC,KAAY;QACtC,IAAI,IAAA,gBAAE,EAAC,KAAK,EAAE,iBAAO,CAAC,EAAE,CAAC;YACvB,OAAO,oBAAoB,CAAC,QAAQ,CAAC;QACvC,CAAC;QAED,IAAI,IAAA,gBAAE,EAAC,KAAK,EAAE,yBAAW,CAAC,EAAE,CAAC;YAC3B,OAAO,oBAAoB,CAAC,MAAM,CAAC;QACrC,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,OAAO,EAAE,gGAAgG,IAAA,0BAAY,EAAC,KAAK,CAAC,EAAE;SAC/H,CAAC,CAAC;IACL,CAAC;IAED,yNAAyN;IACjN,MAAM,CAAC,gBAAgB,CAAC,IAAqD;QACnF,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE/B,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACnC,OAAO,IAAA,iBAAG,EAAA,GAAG,KAAK,OAAO,CAAC;YAC5B,CAAC;YACD,KAAK,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjC,OAAO,IAAA,iBAAG,EAAA,QAAQ,KAAK,cAAc,CAAC;YACxC,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,mDAAmD,MAAM,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,wGAAwG;IAChG,MAAM,CAAC,0BAA0B,CAAC,IAGzC;QACC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QAEtC,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACnC,OAAO;oBACL,eAAe,EAAE,IAAA,iBAAG,EAAA,WAAW,YAAY,8BAA8B;oBACzE,oBAAoB,EAAE,IAAA,iBAAG,EAAA,iBAAiB,YAAY,eAAe,YAAY,4BAA4B;iBAC9G,CAAC;YACJ,CAAC;YACD,KAAK,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjC,OAAO;oBACL,eAAe,EAAE,IAAA,iBAAG,EAAA,KAAK,qBAAqB,OAAO,YAAY,OAAO,qBAAqB,yBAAyB;oBACtH,oBAAoB,EAAE,IAAA,iBAAG,EAAA,iBAAiB,YAAY,OAAO,qBAAqB,2BAA2B,qBAAqB,SAAS,YAAY,OAAO,qBAAqB,mBAAmB;iBACvM,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,mDAAmD,MAAM,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAxJD,4CAwJC"}

package/dist/cjs/helpers/inversion/common/types.d.ts

@@ -1,10 +1,10 @@
+import type { TAuthMode, TAuthStrategy } from '../../../base/auth/authenticate/common';
+import type { IAuthorizationSpec } from '../../../base/auth/authorize/common/types';
 import type { ControllerTransports } from '../../../base/controllers/common/constants';
 import type { IDataSource, TDataSourceDriverClass } from '../../../base/datasources';
 import type { AbstractEntity } from '../../../base/models';
-import type { IRepository, TFilter, TRepositoryOperationScope } from '../../../base/repositories';
-import type { TAuthMode, TAuthStrategy } from '../../../base/auth/authenticate/common';
-import type { IAuthorizationSpec } from '../../../base/auth/authorize/common/types';
-import type { TClass, TGrpcMethod, TValueOrResolver } from '@venizia/ignis-helpers/common';
+import type { IRepository, ScopeFilters, TFilter, TRepositoryOperationScope, TScopeFilterMissingBehavior, TWhere } from '../../../base/repositories';
+import type { TClass, TGrpcMethod, TNullable, TValueOrResolver } from '@venizia/ignis-helpers/common';
 import { type IInjectMetadata as _IInjectMetadata, type IPropertyMetadata as _IPropertyMetadata } from '@venizia/ignis-inversion';
 interface IBaseControllerMetadata {
     path: string;
@@ -44,11 +44,41 @@ export interface IModelAuthorizeSettings {
     /** Extensible - consumers can add any extra authorization metadata. */
     [extra: string | symbol]: any;
 }
+/**
+ * Row-scope resolver for `@model` settings.scopeFilter - resolved per query, so it can depend on
+ * the current request (tenant, org, membership). Framework-internal escape hatches aside, nothing
+ * short of removing this setting from the model turns scoping off.
+ */
+export interface IScopeFilterSettings {
+    /**
+     * Returns the scope `where`; `ScopeFilters.UNRESTRICTED` to apply no scope for THIS call (an
+     * internal operator, a caller the application has decided sees everything); or null/undefined
+     * when this caller's scope cannot be determined at all.
+     */
+    resolve: () => TNullable<TWhere> | typeof ScopeFilters.UNRESTRICTED;
+    /**
+     * What `applyScopeFilter` does when `resolve()` returns null/undefined - no request context, no
+     * tenant, a background job. Defaults to `deny`: an unresolved scope matches zero rows, never
+     * every row. `allow` is an explicit, reviewed opt-out for migrations and background jobs, declared
+     * per MODEL - it cannot express a per-USER bypass; use `ScopeFilters.UNRESTRICTED` for that.
+     */
+    onMissing?: TScopeFilterMissingBehavior;
+}
 export interface IModelSettings {
     /** Properties excluded from all query results at SQL level. */
     hiddenProperties?: string[];
     /** Default filter auto-applied to all repository operations. Bypassable via shouldSkipDefaultFilter. */
     defaultFilter?: TFilter;
+    /**
+     * Row scope: ANDed into every read and write whose scope is expressible as a filter clause, and
+     * NOT removable by `shouldSkipDefaultFilter`. Resolved per query, so it can depend on the current
+     * request. Ownership resolved per row or through a polymorphic reference is NOT expressible here -
+     * that check is still the application's to perform.
+     *
+     * Relational repositories only - a search-backed model (Typesense, Meilisearch) never reads
+     * this setting, so mirroring a scoped entity into a search index needs its own query-time scope.
+     */
+    scopeFilter?: IScopeFilterSettings;
     /** Default row limit when a query omits `limit`. Must be a positive integer. Falls back to DEFAULT_LIMIT (10). */
     defaultLimit?: number;
     /**

package/dist/cjs/helpers/inversion/common/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/helpers/inversion/common/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EACL,KAAK,eAAe,IAAI,gBAAgB,EACxC,KAAK,iBAAiB,IAAI,kBAAkB,EAC7C,MAAM,0BAA0B,CAAC;AAElC,UAAU,uBAAuB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACtE,SAAS,CAAC,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,uBAAuB,CAAC,WAAW,GAAG,OAAO,CAAE,SAAQ,uBAAuB;IAC7F,SAAS,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC;IAC5C,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAEpF,MAAM,WAAW,YAAY;IAC3B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IAEb,uDAAuD;IACvD,MAAM,EAAE,WAAW,CAAC;IAEpB,iDAAiD;IACjD,YAAY,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAElE,iDAAiD;IACjD,SAAS,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;CAAG;AAEhE,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;CAAG;AAE5D,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,wGAAwG;IACxG,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,kHAAkH;IAClH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,oEAAoE;IACpE,SAAS,CAAC,EAAE,uBAAuB,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc,IAAI,MAAM,CAAC,KAAK,CAAC,GACpF,cAAc,CAAC;AAEjB,qGAAqG;AACrG,MAAM,MAAM,qBAAqB,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc,IAC7E,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,cAAc,CAAC,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB,CAClC,KAAK,SAAS,cAAc,GAAG,cAAc,EAC7C,UAAU,SAAS,WAAW,GAAG,WAAW;IAE5C,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1D,cAAc,CAAC,EAAE,yBAAyB,CAAC;CAC5C;AAED,0DAA0D;AAC1D,MAAM,WAAW,2BAA2B,CAC1C,KAAK,SAAS,cAAc,GAAG,cAAc,EAC7C,UAAU,SAAS,WAAW,GAAG,WAAW;IAE5C,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACzC,cAAc,CAAC,EAAE,yBAAyB,CAAC;CAC5C;AAED,MAAM,WAAW,mBAAmB,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc;IAChF,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAEhB,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAErD,mDAAmD;IACnD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB,CACjC,KAAK,SAAS,cAAc,GAAG,cAAc,EAC7C,UAAU,SAAS,WAAW,GAAG,WAAW;IAE5C,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,UAAU,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5D,UAAU,EAAE,gBAAgB,CAAC,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;CACrE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/helpers/inversion/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,OAAO,EACP,yBAAyB,EACzB,2BAA2B,EAC3B,MAAM,EACP,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,MAAM,EACN,WAAW,EACX,SAAS,EACT,gBAAgB,EACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,eAAe,IAAI,gBAAgB,EACxC,KAAK,iBAAiB,IAAI,kBAAkB,EAC7C,MAAM,0BAA0B,CAAC;AAElC,UAAU,uBAAuB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACtE,SAAS,CAAC,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,uBAAuB,CAAC,WAAW,GAAG,OAAO,CAAE,SAAQ,uBAAuB;IAC7F,SAAS,EAAE,OAAO,oBAAoB,CAAC,IAAI,CAAC;IAC5C,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,MAAM,mBAAmB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAEpF,MAAM,WAAW,YAAY;IAC3B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IAEb,uDAAuD;IACvD,MAAM,EAAE,WAAW,CAAC;IAEpB,iDAAiD;IACjD,YAAY,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAElE,iDAAiD;IACjD,SAAS,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;CAAG;AAEhE,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;CAAG;AAE5D,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,CAAC,CAAC,GAAG,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;IAEpE;;;;;OAKG;IACH,SAAS,CAAC,EAAE,2BAA2B,CAAC;CACzC;AAED,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B,wGAAwG;IACxG,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;IAEnC,kHAAkH;IAClH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,oEAAoE;IACpE,SAAS,CAAC,EAAE,uBAAuB,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,GAAG,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc,IAAI,MAAM,CAAC,KAAK,CAAC,GACpF,cAAc,CAAC;AAEjB,qGAAqG;AACrG,MAAM,MAAM,qBAAqB,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc,IAC7E,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,cAAc,CAAC,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB,CAClC,KAAK,SAAS,cAAc,GAAG,cAAc,EAC7C,UAAU,SAAS,WAAW,GAAG,WAAW;IAE5C,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1D,cAAc,CAAC,EAAE,yBAAyB,CAAC;CAC5C;AAED,0DAA0D;AAC1D,MAAM,WAAW,2BAA2B,CAC1C,KAAK,SAAS,cAAc,GAAG,cAAc,EAC7C,UAAU,SAAS,WAAW,GAAG,WAAW;IAE5C,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACzC,cAAc,CAAC,EAAE,yBAAyB,CAAC;CAC5C;AAED,MAAM,WAAW,mBAAmB,CAAC,KAAK,SAAS,cAAc,GAAG,cAAc;IAChF,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,QAAQ,EAAE,cAAc,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;IAEhB,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAErD,mDAAmD;IACnD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB,CACjC,KAAK,SAAS,cAAc,GAAG,cAAc,EAC7C,UAAU,SAAS,WAAW,GAAG,WAAW;IAE5C,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,UAAU,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5D,UAAU,EAAE,gBAAgB,CAAC,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;CACrE"}

package/dist/esm/base/auth/authenticate/common/constants.d.ts

@@ -2,10 +2,12 @@ import type { TConstValue } from '@venizia/ignis-helpers/common';
 export declare class AuthenticateStrategy {
     static readonly BASIC = "basic";
     static readonly JWT = "jwt";
+    static readonly SERVICE = "service";
+    /** The strategies the FRAMEWORK ships. An application registers its own beyond these. */
     static readonly SCHEME_SET: Set<string>;
     static isValid(input: string): boolean;
 }
-export type TAuthStrategy = TConstValue<typeof AuthenticateStrategy>;
+export type TAuthStrategy = TConstValue<typeof AuthenticateStrategy> | (string & {});
 export declare class JOSEStandards {
     static readonly JWS = "JWS";
     static readonly JWKS = "JWKS";
@@ -16,6 +18,7 @@ export type TJOSEStandard = TConstValue<typeof JOSEStandards>;
 export declare class Authentication {
     static readonly STRATEGY_BASIC = "basic";
     static readonly STRATEGY_JWT = "jwt";
+    static readonly STRATEGY_SERVICE = "service";
     static readonly TYPE_BASIC = "Basic";
     static readonly TYPE_BEARER = "Bearer";
     static readonly AUTHENTICATION_STRATEGY = "authentication.strategy";
@@ -56,4 +59,28 @@ export declare class JWKSKeyFormats {
     static isValid(input: string): boolean;
 }
 export type TJWKSKeyFormat = TConstValue<typeof JWKSKeyFormats>;
+/**
+ * Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
+ * call must agree on them, and a knob here would let two services disagree silently.
+ */
+export declare class ServiceAssertion {
+    /** Its own header, so the end user's token keeps `Authorization` on the same request. */
+    static readonly HEADER = "x-service-assertion";
+    /** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
+    static readonly TYP = "svc+jwt";
+    static readonly ALGORITHM = "EdDSA";
+    static readonly DEFAULT_REST_PATH = "/svc-certs";
+    /** How long a minted assertion stays valid. */
+    static readonly DEFAULT_SIGN_LIFETIME_SECONDS = 60;
+    /** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
+    static readonly DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60;
+    static readonly DEFAULT_CLOCK_TOLERANCE_SECONDS = 5;
+    /** Resolves the accepted age for one caller: its own override, then the service default. */
+    static resolveAcceptMaxAge(opts: {
+        callerOverride?: number;
+        serviceDefault?: number;
+    }): number;
+    static readonly DEFAULT_JWKS_CACHE_MAX_AGE_MS: number;
+    static readonly DEFAULT_JWKS_COOLDOWN_MS: number;
+}
 //# sourceMappingURL=constants.d.ts.map

package/dist/esm/base/auth/authenticate/common/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAmC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AACD,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAErE,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,aAAa,CAAC,CAAC;AAE9D,qBAAa,cAAc;IAEzB,MAAM,CAAC,QAAQ,CAAC,cAAc,WAA8B;IAC5D,MAAM,CAAC,QAAQ,CAAC,YAAY,SAA4B;IAGxD,MAAM,CAAC,QAAQ,CAAC,UAAU,WAAW;IACrC,MAAM,CAAC,QAAQ,CAAC,WAAW,YAAY;IAEvC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,6BAA6B;IACpE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,yBAAyB;IAE5D,MAAM,CAAC,QAAQ,CAAC,YAAY,uBAAuB;IACnD,MAAM,CAAC,QAAQ,CAAC,aAAa,mBAAmB;CACjD;AAED,qBAAa,wBAAwB;IACnC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,4BAA4B;IACnE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,sBAAsB;IACvD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uBAAuB;CAC1D;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,qBAAa,SAAS;IACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,QAAQ,cAAc;IAEtC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAyC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,SAAS,CAAC,CAAC;AAEtD,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAmC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;AAEhE,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiD;IAE3E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAID,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAErF,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,aAAa,CAAC,CAAC;AAE9D,qBAAa,cAAc;IAEzB,MAAM,CAAC,QAAQ,CAAC,cAAc,WAA8B;IAC5D,MAAM,CAAC,QAAQ,CAAC,YAAY,SAA4B;IACxD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,aAAgC;IAGhE,MAAM,CAAC,QAAQ,CAAC,UAAU,WAAW;IACrC,MAAM,CAAC,QAAQ,CAAC,WAAW,YAAY;IAEvC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,6BAA6B;IACpE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,yBAAyB;IAE5D,MAAM,CAAC,QAAQ,CAAC,YAAY,uBAAuB;IACnD,MAAM,CAAC,QAAQ,CAAC,aAAa,mBAAmB;CACjD;AAED,qBAAa,wBAAwB;IACnC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,4BAA4B;IACnE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,sBAAsB;IACvD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uBAAuB;CAC1D;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,qBAAa,SAAS;IACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,QAAQ,cAAc;IAEtC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAyC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,SAAS,CAAC,CAAC;AAEtD,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAmC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;AAEhE,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;AAEhE;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,MAAM,yBAAyB;IAE/C,uGAAuG;IACvG,MAAM,CAAC,QAAQ,CAAC,GAAG,aAAa;IAEhC,MAAM,CAAC,QAAQ,CAAC,SAAS,WAAW;IAEpC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,gBAAgB;IACjD,+CAA+C;IAC/C,MAAM,CAAC,QAAQ,CAAC,6BAA6B,MAAM;IAEnD,sGAAsG;IACtG,MAAM,CAAC,QAAQ,CAAC,8BAA8B,MAAM;IACpD,MAAM,CAAC,QAAQ,CAAC,+BAA+B,KAAK;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAM9F,MAAM,CAAC,QAAQ,CAAC,6BAA6B,SAAkB;IAC/D,MAAM,CAAC,QAAQ,CAAC,wBAAwB,SAAa;CACtD"}

package/dist/esm/base/auth/authenticate/common/constants.js

@@ -1,7 +1,9 @@
 export class AuthenticateStrategy {
     static { this.BASIC = 'basic'; }
     static { this.JWT = 'jwt'; }
-    static { this.SCHEME_SET = new Set([this.BASIC, this.JWT]); }
+    static { this.SERVICE = 'service'; }
+    /** The strategies the FRAMEWORK ships. An application registers its own beyond these. */
+    static { this.SCHEME_SET = new Set([this.BASIC, this.JWT, this.SERVICE]); }
     static isValid(input) {
         return this.SCHEME_SET.has(input);
     }
@@ -18,6 +20,7 @@ export class Authentication {
     // Strategy
     static { this.STRATEGY_BASIC = AuthenticateStrategy.BASIC; }
     static { this.STRATEGY_JWT = AuthenticateStrategy.JWT; }
+    static { this.STRATEGY_SERVICE = AuthenticateStrategy.SERVICE; }
     // Token type
     static { this.TYPE_BASIC = 'Basic'; }
     static { this.TYPE_BEARER = 'Bearer'; }
@@ -63,4 +66,27 @@ export class JWKSKeyFormats {
         return this.SCHEME_SET.has(input);
     }
 }
+/**
+ * Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
+ * call must agree on them, and a knob here would let two services disagree silently.
+ */
+export class ServiceAssertion {
+    /** Its own header, so the end user's token keeps `Authorization` on the same request. */
+    static { this.HEADER = 'x-service-assertion'; }
+    /** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
+    static { this.TYP = 'svc+jwt'; }
+    static { this.ALGORITHM = 'EdDSA'; }
+    static { this.DEFAULT_REST_PATH = '/svc-certs'; }
+    /** How long a minted assertion stays valid. */
+    static { this.DEFAULT_SIGN_LIFETIME_SECONDS = 60; }
+    /** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
+    static { this.DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60; }
+    static { this.DEFAULT_CLOCK_TOLERANCE_SECONDS = 5; }
+    /** Resolves the accepted age for one caller: its own override, then the service default. */
+    static resolveAcceptMaxAge(opts) {
+        return (opts.callerOverride ?? opts.serviceDefault ?? ServiceAssertion.DEFAULT_ACCEPT_MAX_AGE_SECONDS);
+    }
+    static { this.DEFAULT_JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1000; }
+    static { this.DEFAULT_JWKS_COOLDOWN_MS = 30 * 1000; }
+}
 //# sourceMappingURL=constants.js.map

package/dist/esm/base/auth/authenticate/common/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,oBAAoB;aACf,UAAK,GAAG,OAAO,CAAC;aAChB,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAIH,MAAM,OAAO,aAAa;aACR,QAAG,GAAG,KAAK,CAAC;aACZ,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;IACzB,WAAW;aACK,mBAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC;aAC5C,iBAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC;IAExD,aAAa;aACG,eAAU,GAAG,OAAO,CAAC;aACrB,gBAAW,GAAG,QAAQ,CAAC;aAEvB,4BAAuB,GAAG,yBAAyB,CAAC;aACpD,wBAAmB,GAAG,qBAAqB,CAAC;aAE5C,iBAAY,GAAG,mBAAmB,CAAC;aACnC,kBAAa,GAAG,eAAe,CAAC;;AAGlD,MAAM,OAAO,wBAAwB;aACnB,4BAAuB,GAAG,wBAAwB,CAAC;aACnD,sBAAiB,GAAG,kBAAkB,CAAC;aACvC,uBAAkB,GAAG,mBAAmB,CAAC;;AAG3D,MAAM,OAAO,mBAAmB;aACd,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,SAAS;aACJ,WAAM,GAAG,QAAQ,CAAC;aAClB,aAAQ,GAAG,UAAU,CAAC;aAEtB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;aACT,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;aACT,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/constants.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,oBAAoB;aACf,UAAK,GAAG,OAAO,CAAC;aAChB,QAAG,GAAG,KAAK,CAAC;aACZ,YAAO,GAAG,SAAS,CAAC;IAEpC,yFAAyF;aACzE,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAOH,MAAM,OAAO,aAAa;aACR,QAAG,GAAG,KAAK,CAAC;aACZ,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;IACzB,WAAW;aACK,mBAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC;aAC5C,iBAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC;aACxC,qBAAgB,GAAG,oBAAoB,CAAC,OAAO,CAAC;IAEhE,aAAa;aACG,eAAU,GAAG,OAAO,CAAC;aACrB,gBAAW,GAAG,QAAQ,CAAC;aAEvB,4BAAuB,GAAG,yBAAyB,CAAC;aACpD,wBAAmB,GAAG,qBAAqB,CAAC;aAE5C,iBAAY,GAAG,mBAAmB,CAAC;aACnC,kBAAa,GAAG,eAAe,CAAC;;AAGlD,MAAM,OAAO,wBAAwB;aACnB,4BAAuB,GAAG,wBAAwB,CAAC;aACnD,sBAAiB,GAAG,kBAAkB,CAAC;aACvC,uBAAkB,GAAG,mBAAmB,CAAC;;AAG3D,MAAM,OAAO,mBAAmB;aACd,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,SAAS;aACJ,WAAM,GAAG,QAAQ,CAAC;aAClB,aAAQ,GAAG,UAAU,CAAC;aAEtB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;aACT,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;aACT,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAC3B,yFAAyF;aACzE,WAAM,GAAG,qBAAqB,CAAC;IAE/C,uGAAuG;aACvF,QAAG,GAAG,SAAS,CAAC;aAEhB,cAAS,GAAG,OAAO,CAAC;aAEpB,sBAAiB,GAAG,YAAY,CAAC;IACjD,+CAA+C;aAC/B,kCAA6B,GAAG,EAAE,CAAC;IAEnD,sGAAsG;aACtF,mCAA8B,GAAG,EAAE,CAAC;aACpC,oCAA+B,GAAG,CAAC,CAAC;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAA0D;QACnF,OAAO,CACL,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC,8BAA8B,CAC9F,CAAC;IACJ,CAAC;aAEe,kCAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;aAC/C,6BAAwB,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/esm/base/auth/authenticate/common/errors.d.ts

@@ -82,8 +82,47 @@ export declare const AuthenticationErrors: {
         readonly statusCode: 401;
         readonly category: "auth";
     };
+    readonly ASSERTION_MISSING: {
+        readonly message: {
+            readonly text: "Missing service assertion";
+            readonly code: "core.authentication.service.assertion_missing";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly ASSERTION_INVALID: {
+        readonly message: {
+            readonly text: "Invalid service assertion";
+            readonly code: "core.authentication.service.assertion_invalid";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly CALLER_NOT_ALLOWED: {
+        readonly message: {
+            readonly text: "Service caller is not allowed";
+            readonly code: "core.authentication.service.caller_not_allowed";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly REQUEST_BINDING_MISMATCH: {
+        readonly message: {
+            readonly text: "Service assertion does not match this request";
+            readonly code: "core.authentication.service.request_binding_mismatch";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly PRINCIPAL_UNRESOLVED: {
+        readonly message: {
+            readonly text: "Service caller resolved to no principal";
+            readonly code: "core.authentication.service.principal_unresolved";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
 };
-/** Registers these codes with the shared key registry so a consumer gets autocomplete on `messageCode`. Augments the `/core` subpath, not the root barrel - kernel never imports the bare package, so nothing else in this program would make the root specifier resolvable for the merge. */
 declare module '@venizia/ignis-helpers/core' {
     interface IErrorKeyRegistry extends TRegisterErrors<typeof AuthenticationErrors> {
     }

package/dist/esm/base/auth/authenticate/common/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAIrF,kJAAkJ;AAClJ,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8B/B,iIAAiI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2C9E,CAAC;AAEtD,8RAA8R;AAC9R,OAAO,QAAQ,6BAA6B,CAAC;IAC3C,UAAU,iBAAkB,SAAQ,eAAe,CAAC,OAAO,oBAAoB,CAAC;KAAG;CACpF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGrF,kJAAkJ;AAClJ,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8B/B,iIAAiI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmF9E,CAAC;AAEtD,OAAO,QAAQ,6BAA6B,CAAC;IAC3C,UAAU,iBAAkB,SAAQ,eAAe,CAAC,OAAO,oBAAoB,CAAC;KAAG;CACpF"}

package/dist/esm/base/auth/authenticate/common/errors.js

@@ -1,5 +1,5 @@
-import { ErrorScopes } from '@venizia/ignis-helpers/core';
 import { HTTP } from '@venizia/ignis-helpers/common';
+import { ErrorScopes } from '@venizia/ignis-helpers/core';
 /** Codes a client branches on for a failed authentication. A throw site may override `message` for detail; the code and status come from here. */
 export const AuthenticationErrors = {
     HEADER_MISSING: {
@@ -74,5 +74,45 @@ export const AuthenticationErrors = {
         statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
         category: ErrorScopes.AUTH,
     },
+    ASSERTION_MISSING: {
+        message: {
+            text: 'Missing service assertion',
+            code: 'core.authentication.service.assertion_missing',
+        },
+        statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
+        category: ErrorScopes.AUTH,
+    },
+    ASSERTION_INVALID: {
+        message: {
+            text: 'Invalid service assertion',
+            code: 'core.authentication.service.assertion_invalid',
+        },
+        statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
+        category: ErrorScopes.AUTH,
+    },
+    CALLER_NOT_ALLOWED: {
+        message: {
+            text: 'Service caller is not allowed',
+            code: 'core.authentication.service.caller_not_allowed',
+        },
+        statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
+        category: ErrorScopes.AUTH,
+    },
+    REQUEST_BINDING_MISMATCH: {
+        message: {
+            text: 'Service assertion does not match this request',
+            code: 'core.authentication.service.request_binding_mismatch',
+        },
+        statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
+        category: ErrorScopes.AUTH,
+    },
+    PRINCIPAL_UNRESOLVED: {
+        message: {
+            text: 'Service caller resolved to no principal',
+            code: 'core.authentication.service.principal_unresolved',
+        },
+        statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
+        category: ErrorScopes.AUTH,
+    },
 };
 //# sourceMappingURL=errors.js.map

package/dist/esm/base/auth/authenticate/common/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AAErD,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACrF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iIAAiI;IACjI,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACxF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,yCAAyC;SAChD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9E,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,qCAAqC;SAC5C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;CACkD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACrF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iIAAiI;IACjI,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACxF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,yCAAyC;SAChD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9E,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,qCAAqC;SAC5C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE;YACP,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,gDAAgD;SACvD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,wBAAwB,EAAE;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,sDAAsD;SAC7D;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE;YACP,IAAI,EAAE,yCAAyC;YAC/C,IAAI,EAAE,kDAAkD;SACzD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;CACkD,CAAC"}

package/dist/esm/base/auth/authenticate/common/keys.d.ts

@@ -3,5 +3,7 @@ export declare class AuthenticateBindingKeys {
     static readonly JWT_OPTIONS = "@app/authenticate/jwt-options";
     static readonly JWKS_OPTIONS = "@app/authenticate/jwks-options";
     static readonly BASIC_OPTIONS = "@app/authenticate/basic-options";
+    static readonly SERVICE_OPTIONS = "@app/authenticate/service-options";
+    static readonly SERVICE_CERTS_PATH = "@app/authenticate/service-certs-path";
 }
 //# sourceMappingURL=keys.d.ts.map

package/dist/esm/base/auth/authenticate/common/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IAC9D,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,qCAAqC;CACnE"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IAC9D,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,qCAAqC;IAClE,MAAM,CAAC,QAAQ,CAAC,eAAe,uCAAuC;IACtE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,0CAA0C;CAC7E"}

package/dist/esm/base/auth/authenticate/common/keys.js

@@ -3,5 +3,7 @@ export class AuthenticateBindingKeys {
     static { this.JWT_OPTIONS = '@app/authenticate/jwt-options'; }
     static { this.JWKS_OPTIONS = '@app/authenticate/jwks-options'; }
     static { this.BASIC_OPTIONS = '@app/authenticate/basic-options'; }
+    static { this.SERVICE_OPTIONS = '@app/authenticate/service-options'; }
+    static { this.SERVICE_CERTS_PATH = '@app/authenticate/service-certs-path'; }
 }
 //# sourceMappingURL=keys.js.map

package/dist/esm/base/auth/authenticate/common/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC;aAClD,oBAAe,GAAG,mCAAmC,CAAC;aACtD,uBAAkB,GAAG,sCAAsC,CAAC"}