@venizia/ignis-kernel 0.2.0-12 → 0.2.0-14

package/dist/esm/base/auth/authenticate/common/constants/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/jose.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,aAAa;aACR,QAAG,GAAG,KAAK,CAAC;aACZ,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,SAAS;aACJ,WAAM,GAAG,QAAQ,CAAC;aAClB,aAAQ,GAAG,UAAU,CAAC;aAEtB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;aACT,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;aACT,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC"}

package/dist/esm/base/auth/authenticate/common/constants/service-assertion.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
+ * call must agree on them, and a knob here would let two services disagree silently.
+ */
+export declare class ServiceAssertion {
+    /** Its own header, so the end user's token keeps `Authorization` on the same request. */
+    static readonly HEADER = "x-service-assertion";
+    /** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
+    static readonly TYP = "svc+jwt";
+    static readonly ALGORITHM = "EdDSA";
+    static readonly DEFAULT_REST_PATH = "/svc-certs";
+    /** How long a minted assertion stays valid. */
+    static readonly DEFAULT_SIGN_LIFETIME_SECONDS = 60;
+    /** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
+    static readonly DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60;
+    static readonly DEFAULT_CLOCK_TOLERANCE_SECONDS = 5;
+    /** Resolves the accepted age for one caller: its own override, then the service default. */
+    static resolveAcceptMaxAge(opts: {
+        callerOverride?: number;
+        serviceDefault?: number;
+    }): number;
+    static readonly DEFAULT_JWKS_CACHE_MAX_AGE_MS: number;
+    static readonly DEFAULT_JWKS_COOLDOWN_MS: number;
+}
+//# sourceMappingURL=service-assertion.d.ts.map

package/dist/esm/base/auth/authenticate/common/constants/service-assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-assertion.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/service-assertion.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,MAAM,yBAAyB;IAE/C,uGAAuG;IACvG,MAAM,CAAC,QAAQ,CAAC,GAAG,aAAa;IAEhC,MAAM,CAAC,QAAQ,CAAC,SAAS,WAAW;IAEpC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,gBAAgB;IACjD,+CAA+C;IAC/C,MAAM,CAAC,QAAQ,CAAC,6BAA6B,MAAM;IAEnD,sGAAsG;IACtG,MAAM,CAAC,QAAQ,CAAC,8BAA8B,MAAM;IACpD,MAAM,CAAC,QAAQ,CAAC,+BAA+B,KAAK;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAM9F,MAAM,CAAC,QAAQ,CAAC,6BAA6B,SAAkB;IAC/D,MAAM,CAAC,QAAQ,CAAC,wBAAwB,SAAa;CACtD"}

package/dist/esm/base/auth/authenticate/common/constants/service-assertion.js

@@ -0,0 +1,24 @@
+/**
+ * Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
+ * call must agree on them, and a knob here would let two services disagree silently.
+ */
+export class ServiceAssertion {
+    /** Its own header, so the end user's token keeps `Authorization` on the same request. */
+    static { this.HEADER = 'x-service-assertion'; }
+    /** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
+    static { this.TYP = 'svc+jwt'; }
+    static { this.ALGORITHM = 'EdDSA'; }
+    static { this.DEFAULT_REST_PATH = '/svc-certs'; }
+    /** How long a minted assertion stays valid. */
+    static { this.DEFAULT_SIGN_LIFETIME_SECONDS = 60; }
+    /** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
+    static { this.DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60; }
+    static { this.DEFAULT_CLOCK_TOLERANCE_SECONDS = 5; }
+    /** Resolves the accepted age for one caller: its own override, then the service default. */
+    static resolveAcceptMaxAge(opts) {
+        return (opts.callerOverride ?? opts.serviceDefault ?? ServiceAssertion.DEFAULT_ACCEPT_MAX_AGE_SECONDS);
+    }
+    static { this.DEFAULT_JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1000; }
+    static { this.DEFAULT_JWKS_COOLDOWN_MS = 30 * 1000; }
+}
+//# sourceMappingURL=service-assertion.js.map

package/dist/esm/base/auth/authenticate/common/constants/service-assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-assertion.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/service-assertion.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAC3B,yFAAyF;aACzE,WAAM,GAAG,qBAAqB,CAAC;IAE/C,uGAAuG;aACvF,QAAG,GAAG,SAAS,CAAC;aAEhB,cAAS,GAAG,OAAO,CAAC;aAEpB,sBAAiB,GAAG,YAAY,CAAC;IACjD,+CAA+C;aAC/B,kCAA6B,GAAG,EAAE,CAAC;IAEnD,sGAAsG;aACtF,mCAA8B,GAAG,EAAE,CAAC;aACpC,oCAA+B,GAAG,CAAC,CAAC;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAA0D;QACnF,OAAO,CACL,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC,8BAA8B,CAC9F,CAAC;IACJ,CAAC;aAEe,kCAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;aAC/C,6BAAwB,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/esm/base/auth/authenticate/common/index.d.ts

@@ -1,6 +1,6 @@
 export * from './errors.js';
 export * from './codecs.js';
-export * from './constants.js';
+export * from './constants/index.js';
 export * from './keys.js';
-export * from './types.js';
+export * from './types/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authenticate/common/index.js

@@ -1,6 +1,6 @@
 export * from './errors.js';
 export * from './codecs.js';
-export * from './constants.js';
+export * from './constants/index.js';
 export * from './keys.js';
-export * from './types.js';
+export * from './types/index.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authenticate/common/types/basic.d.ts

@@ -0,0 +1,14 @@
+import type { TContext } from '../../../../controllers/common/types/index.js';
+import type { Env } from 'hono';
+import type { IAuthUser } from './strategy.js';
+export type TBasicTokenServiceOptions<E extends Env = Env> = {
+    /** Callback to verify basic auth credentials. Returns IAuthUser if valid, null otherwise. */
+    verifyCredentials: (opts: {
+        credentials: {
+            username: string;
+            password: string;
+        };
+        context: TContext<E, string>;
+    }) => Promise<IAuthUser | null>;
+};
+//# sourceMappingURL=basic.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/basic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/basic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,MAAM,yBAAyB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI;IAC3D,6FAA6F;IAC7F,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACxB,WAAW,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACjC,CAAC"}

package/dist/esm/base/auth/authenticate/common/types/basic.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=basic.js.map

package/dist/esm/base/auth/authenticate/common/types/basic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/basic.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authenticate/common/types/index.d.ts

@@ -0,0 +1,7 @@
+export * from './basic.js';
+export * from './jwt.js';
+export * from './options.js';
+export * from './rest.js';
+export * from './service.js';
+export * from './strategy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/esm/base/auth/authenticate/common/types/index.js

@@ -0,0 +1,7 @@
+export * from './basic.js';
+export * from './jwt.js';
+export * from './options.js';
+export * from './rest.js';
+export * from './service.js';
+export * from './strategy.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authenticate/common/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/esm/base/auth/authenticate/common/types/jwt.d.ts

@@ -0,0 +1,137 @@
+import type { IdType } from '../../../../models/common/index.js';
+import type { ValueOrPromise } from '@venizia/ignis-helpers/common';
+import type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers/core';
+import type { JWTPayload } from 'jose';
+import type { JOSEStandards, JWKSModes, TJWKSKeyDriver, TJWKSKeyFormat } from '../constants/index.js';
+import type { IAuthUser } from './strategy.js';
+/**
+ * Claim checks applied when VERIFYING a JWT. Field names and types mirror jose's `JWTVerifyOptions`
+ * exactly, so this is a pass-through with no translation layer.
+ *
+ * Every field is optional and unset by default, which is today's behaviour: nothing is checked
+ * beyond the signature and the time claims. In a fleet where every verifier points at the same
+ * issuer JWKS, that means a token minted for one service is accepted verbatim by every other -
+ * `audience` is what makes "this token was meant for me" a cryptographic statement rather than a
+ * convention.
+ */
+export interface IJWTVerifyOptions {
+    /** Expected `aud`. Setting it makes the claim required. Matching is jose's OVERLAP semantics, not equality: a token carrying `['a','b']` satisfies `audience: 'a'`. Enforce single-valued audiences at issue time if that matters. */
+    audience?: string | string[];
+    /** Expected `iss`. Setting it makes the claim required. */
+    issuer?: string | string[];
+    /** Expected `sub`. Setting it makes the claim required. */
+    subject?: string;
+    /** Clock skew tolerance: seconds, or a jose duration string such as `'30 seconds'`. */
+    clockTolerance?: string | number;
+    /** Accepted JWS `alg` header values. Unset means the accepted algorithm is decided entirely by what the JWKS serves. */
+    algorithms?: string[];
+    /** Caps elapsed time since `iat`. The real replay window for a short-lived assertion, independent of whatever `exp` the caller chose to stamp. */
+    maxTokenAge?: string | number;
+    /** Expected JWS `typ` header. The standard defence against cross-token-type confusion when one JWKS serves more than one kind of token. */
+    typ?: string;
+    /** Claims that must be present, beyond those implied by the checks above. */
+    requiredClaims?: string[];
+}
+/** Default `iss` / `aud` stamped on every issued token. Configured values are AUTHORITATIVE - see {@link IJWTIssueClaims}. */
+export interface IJWTSignOptions {
+    issuer?: string;
+    audience?: string | string[];
+}
+/**
+ * Per-token registered claims, passed to `generate()`.
+ *
+ * This is the supported way to vary `aud` or `sub` per token. Putting them on the payload used to
+ * work by accident - `iss`, `aud`, `sub` and `jti` ride through the AES envelope in the clear
+ * because they are standard JWT fields - but a claim the payload can set is a claim any caller who
+ * shapes the payload can forge. These win over {@link IJWTSignOptions}; the payload never does.
+ */
+export interface IJWTIssueClaims {
+    issuer?: string;
+    audience?: string | string[];
+    subject?: string;
+    jwtId?: string;
+}
+export interface IJWSTokenServiceOptions {
+    headerAlgorithm?: string;
+    jwtSecret: string;
+    getTokenExpiresFn: TGetTokenExpiresFn;
+    aesAlgorithm?: AESAlgorithmType;
+    applicationSecret?: string;
+    fieldCodecs?: IPayloadFieldCodec[];
+    /** Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. */
+    cipher?: IPayloadCipher;
+    /** Claim checks applied on verify. Unset means signature and time claims only. */
+    verify?: IJWTVerifyOptions;
+    /** Claims stamped on every issued token. A configured value WINS over one supplied in the payload. */
+    sign?: IJWTSignOptions;
+}
+export type TJWKSAlgorithm = 'ES256' | 'RS256' | 'EdDSA';
+export interface IJWKSIssuerOptions {
+    mode: typeof JWKSModes.ISSUER;
+    algorithm: TJWKSAlgorithm;
+    rest?: {
+        path: string;
+    };
+    keys: {
+        driver: TJWKSKeyDriver;
+        format: TJWKSKeyFormat;
+        private: string;
+        public: string;
+    };
+    kid: string;
+    getTokenExpiresFn: TGetTokenExpiresFn;
+    aesAlgorithm?: AESAlgorithmType;
+    applicationSecret?: string;
+    fieldCodecs?: IPayloadFieldCodec[];
+    /** Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. */
+    cipher?: IPayloadCipher;
+    /** Claim checks applied on verify. Unset means signature and time claims only. */
+    verify?: IJWTVerifyOptions;
+    /** Claims stamped on every issued token. A configured value WINS over one supplied in the payload. */
+    sign?: IJWTSignOptions;
+}
+export interface IJWKSVerifierOptions {
+    mode: typeof JWKSModes.VERIFIER;
+    jwksUrl: string;
+    cacheTtlMs?: number;
+    cooldownMs?: number;
+    aesAlgorithm?: AESAlgorithmType;
+    applicationSecret?: string;
+    fieldCodecs?: IPayloadFieldCodec[];
+    /** Overrides the payload cipher - pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope. */
+    cipher?: IPayloadCipher;
+    /** Claim checks applied on verify. Unset means signature and time claims only. */
+    verify?: IJWTVerifyOptions;
+}
+export type TJWKSTokenServiceOptions = IJWKSIssuerOptions | IJWKSVerifierOptions;
+export type TJWTTokenServiceOptions = {
+    standard: typeof JOSEStandards.JWS;
+    options: IJWSTokenServiceOptions;
+} | {
+    standard: typeof JOSEStandards.JWKS;
+    options: TJWKSTokenServiceOptions;
+};
+export interface IJWTTokenPayload extends JWTPayload, IAuthUser {
+    userId: IdType;
+    roles: {
+        id: IdType;
+        identifier: string;
+        priority: number;
+    }[];
+    clientId?: string;
+    provider?: string;
+    email?: string;
+    name?: string;
+    [extra: string | symbol]: any;
+}
+export interface IPayloadFieldCodec<T = unknown> {
+    key: string;
+    serialize(opts: {
+        value: T;
+    }): string;
+    deserialize(opts: {
+        raw: string;
+    }): T;
+}
+export type TGetTokenExpiresFn = () => ValueOrPromise<number>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,sOAAsO;IACtO,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEjC,wHAAwH;IACxH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,kJAAkJ;IAClJ,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B,2IAA2I;IAC3I,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,8HAA8H;AAC9H,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,IAAI,EAAE;QACJ,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAEjF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,GACxE;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,IAAI,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,gBAAiB,SAAQ,UAAU,EAAE,SAAS;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAE9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC;IACtC,WAAW,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC"}

package/dist/esm/base/auth/authenticate/common/types/jwt.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt.js.map

package/dist/esm/base/auth/authenticate/common/types/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authenticate/common/types/options.d.ts

@@ -0,0 +1,15 @@
+import type { TBasicTokenServiceOptions } from './basic.js';
+import type { TJWTTokenServiceOptions } from './jwt.js';
+import type { TAuthenticationRestOptions } from './rest.js';
+import type { IServiceAuthOptions } from './service.js';
+/**
+ * Composes the four topic option types into the framework's single authenticate config knob.
+ * The only file in this folder allowed more than one sibling import - it is their parent.
+ */
+export interface IAuthenticateOptions {
+    restOptions?: TAuthenticationRestOptions;
+    jwtOptions?: TJWTTokenServiceOptions;
+    basicOptions?: TBasicTokenServiceOptions;
+    serviceOptions?: IServiceAuthOptions;
+}
+//# sourceMappingURL=options.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,OAAO,CAAC;AACrD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,0BAA0B,CAAC;IACzC,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC"}

package/dist/esm/base/auth/authenticate/common/types/options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=options.js.map

package/dist/esm/base/auth/authenticate/common/types/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/options.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authenticate/common/types/rest.d.ts

@@ -0,0 +1,49 @@
+import type { TAnyObjectSchema } from '../../../../../utilities/schema.utility.js';
+export type TDefineAuthControllerOpts = {
+    restPath?: string;
+    serviceKey: string;
+    requireAuthenticatedSignUp?: boolean;
+    payload?: {
+        signIn?: {
+            request: {
+                schema: TAnyObjectSchema;
+            };
+            response: {
+                schema: TAnyObjectSchema;
+            };
+        };
+        signUp?: {
+            request: {
+                schema: TAnyObjectSchema;
+            };
+            response: {
+                schema: TAnyObjectSchema;
+            };
+        };
+        changePassword?: {
+            request: {
+                schema?: TAnyObjectSchema;
+            };
+            response: {
+                schema: TAnyObjectSchema;
+            };
+        };
+        refreshToken?: {
+            response: {
+                schema: TAnyObjectSchema;
+            };
+        };
+        getUserInformation?: {
+            response: {
+                schema: TAnyObjectSchema;
+            };
+        };
+    };
+};
+export type TAuthenticationRestOptions = {} & ({
+    useAuthController?: false | undefined;
+} | {
+    useAuthController: true;
+    controllerOpts: TDefineAuthControllerOpts;
+});
+//# sourceMappingURL=rest.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/rest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/rest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE;YACP,OAAO,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACtC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,MAAM,CAAC,EAAE;YACP,OAAO,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACtC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,cAAc,CAAC,EAAE;YACf,OAAO,EAAE;gBAAE,MAAM,CAAC,EAAE,gBAAgB,CAAA;aAAE,CAAC;YACvC,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,YAAY,CAAC,EAAE;YACb,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;QACF,kBAAkB,CAAC,EAAE;YACnB,QAAQ,EAAE;gBAAE,MAAM,EAAE,gBAAgB,CAAA;aAAE,CAAC;SACxC,CAAC;KACH,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,EAAE,GAAG,CAC1C;IAAE,iBAAiB,CAAC,EAAE,KAAK,GAAG,SAAS,CAAA;CAAE,GACzC;IACE,iBAAiB,EAAE,IAAI,CAAC;IACxB,cAAc,EAAE,yBAAyB,CAAC;CAC3C,CACJ,CAAC"}

package/dist/esm/base/auth/authenticate/common/types/rest.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rest.js.map

package/dist/esm/base/auth/authenticate/common/types/rest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rest.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/rest.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authenticate/common/types/service.d.ts

@@ -0,0 +1,95 @@
+import type { TContext } from '../../../../controllers/common/types/index.js';
+import type { TNullable, ValueOrPromise } from '@venizia/ignis-helpers/common';
+import type { Env } from 'hono';
+import type { JWTPayload } from 'jose';
+import type { TJWKSKeyDriver, TJWKSKeyFormat } from '../constants/index.js';
+import type { IAuthUser } from './strategy.js';
+/**
+ * The request binding, following RFC 9449's `htm`/`htu`. A captured assertion cannot be replayed
+ * against a different method or path.
+ *
+ * `htu` is the percent-ENCODED pathname on both ends. Compare it against
+ * `new URL(context.req.url).pathname`, never `context.req.path` - Hono hands that one back DECODED,
+ * so any route carrying a space or a non-ASCII slug would never match what the caller signed.
+ */
+export interface IServiceAssertionClaims extends JWTPayload {
+    htm: string;
+    htu: string;
+}
+/**
+ * One entry in the caller allowlist: the JWKS url, or that url plus settings for this caller alone.
+ */
+export type TServiceCallerEntry = string | {
+    jwksUrl: string;
+    /** Widens the accepted age for THIS caller only. Falls back to the service-wide setting. */
+    acceptMaxAgeSeconds?: number;
+};
+/** Service-to-service authentication: an Ed25519 assertion per request, verified against the caller's JWKS. */
+export interface IServiceAuthOptions<E extends Env = Env> {
+    /** What this service calls itself: the `iss` it stamps, and the `aud` it demands. */
+    name: string;
+    /**
+     * Present only on a service that CALLS OUT. Absent means verify-only, and no certs route is
+     * mounted - which is the common case, since most services are called and never call.
+     */
+    keys?: {
+        driver: TJWKSKeyDriver;
+        format: TJWKSKeyFormat;
+        /** PEM or JWK by `format`; content for the `text` driver, a path for `file`. */
+        private: string;
+        public: string;
+        kid?: string;
+    };
+    /**
+     * Caller name to its JWKS url. THIS IS ALSO THE ALLOWLIST - a name absent from the map cannot
+     * call, and an empty map correctly allows nobody.
+     *
+     * The bare-string form is the common case. The object form exists to widen the accepted age for
+     * ONE caller: a nightly batch may legitimately need more slack than an interactive service, and
+     * granting it per caller keeps the concession named and visible in config.
+     */
+    callers?: Record<string, TServiceCallerEntry>;
+    /** Where the certs route is mounted. Defaults to `ServiceAssertion.DEFAULT_REST_PATH`. */
+    rest?: {
+        path: string;
+    };
+    /**
+     * How long the assertions this service MINTS stay valid. Only meaningful where `keys` is set.
+     */
+    signLifetimeSeconds?: number;
+    /**
+     * The oldest assertion this service ACCEPTS, measured from `iat`.
+     *
+     * Deliberately separate from `signLifetimeSeconds`, and deliberately not requestable by the
+     * caller. The caller already controls `exp` - it signs the token - so this is the only bound that
+     * survives a compromised caller. A per-caller override belongs in {@link callers}, never in the
+     * assertion.
+     *
+     * Composes with `clockToleranceSeconds`: the real acceptance window is the sum of the two.
+     */
+    acceptMaxAgeSeconds?: number;
+    /**
+     * Clock skew allowance. A SECURITY knob, not an operational one.
+     *
+     * Its job is the future case: two machines never agree to the second, and without it a caller one
+     * second ahead is refused outright. But it also widens the REPLAY window second for second - a
+     * callee accepting an `iat` 5s in its own future keeps accepting that token for the rest of the
+     * window too. Measured at the defaults: 65s accepted on our clock, 70s of wall-clock life for a
+     * capture minted by a caller running the full tolerance fast.
+     */
+    clockToleranceSeconds?: number;
+    jwks?: {
+        cacheMaxAgeMs?: number;
+        cooldownMs?: number;
+    };
+    /**
+     * WHO a verified assertion acts as. The framework has already proven the caller; this only maps a
+     * caller name onto an application principal. Return `null` to refuse a caller the allowlist
+     * admits but the application does not recognise.
+     */
+    resolvePrincipal: (opts: {
+        issuer: string;
+        context: TContext<E, string>;
+    }) => ValueOrPromise<TNullable<IAuthUser>>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEN,+GAA+G;AAC/G,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IACtD,qFAAqF;IACrF,IAAI,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,gFAAgF;QAChF,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IAEF;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAE9C,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAExB;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAEvD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,KAAK,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;CAC5C"}

package/dist/esm/base/auth/authenticate/common/types/service.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service.js.map

package/dist/esm/base/auth/authenticate/common/types/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/service.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authenticate/common/types/strategy.d.ts

@@ -0,0 +1,26 @@
+import type { TContext } from '../../../../controllers/common/types/index.js';
+import type { IdType } from '../../../../models/common/index.js';
+import type { AnyObject } from '@venizia/ignis-helpers/common';
+import type { Env, MiddlewareHandler } from 'hono';
+import type { TChangePasswordRequest, TSignInRequest, TSignUpRequest } from '../../../models/requests/index.js';
+import type { TAuthMode } from '../constants/index.js';
+export interface IAuthUser {
+    userId: IdType;
+    [extra: string | symbol]: any;
+}
+export interface IAuthenticationStrategy<E extends Env = Env> {
+    name: string;
+    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
+}
+export type TAuthenticateFn<RouteEnv extends Env = Env> = (opts: {
+    strategies: string[];
+    mode?: TAuthMode;
+}) => MiddlewareHandler<RouteEnv>;
+export interface IAuthService<E extends Env = Env, SIRQ extends TSignInRequest = TSignInRequest, SIRS = AnyObject, SURQ extends TSignUpRequest = TSignUpRequest, SURS = AnyObject, CPRQ extends TChangePasswordRequest = TChangePasswordRequest, CPRS = AnyObject, UIRQ = AnyObject, UIRS = AnyObject, RTRS = AnyObject> {
+    signIn(context: TContext<E>, opts: SIRQ): Promise<SIRS>;
+    signUp(context: TContext<E>, opts: SURQ): Promise<SURS>;
+    changePassword(context: TContext<E>, opts: CPRQ): Promise<CPRS>;
+    getUserInformation?(context: TContext<E>, opts: UIRQ): Promise<UIRS>;
+    refreshToken?(context: TContext<E>): Promise<RTRS>;
+}
+//# sourceMappingURL=strategy.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACnD,OAAO,KAAK,EACV,sBAAsB,EACtB,cAAc,EACd,cAAc,EACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAChE;AAED,MAAM,MAAM,eAAe,CAAC,QAAQ,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB,KAAK,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AAElC,MAAM,WAAW,YAAY,CAC3B,CAAC,SAAS,GAAG,GAAG,GAAG,EAEnB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,cAAc,GAAG,cAAc,EAC5C,IAAI,GAAG,SAAS,EAEhB,IAAI,SAAS,sBAAsB,GAAG,sBAAsB,EAC5D,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS,EAChB,IAAI,GAAG,SAAS,EAEhB,IAAI,GAAG,SAAS;IAEhB,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,kBAAkB,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD"}

package/dist/esm/base/auth/authenticate/common/types/strategy.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=strategy.js.map

package/dist/esm/base/auth/authenticate/common/types/strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/strategy.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authorize/builders/grant.builder.d.ts

@@ -1,4 +1,4 @@
-import type { IdType } from '../../../../base/index.js';
+import type { IdType } from '../../../index.js';
 import { BaseHelper } from '@venizia/ignis-helpers/core';
 import { type TNullable } from '@venizia/ignis-helpers/common';
 import { type TAuthorizationAction, type TAuthorizationDecision, type TGrantIntent, type TPlannedGrantRow } from '../common/index.js';

package/dist/esm/base/auth/authorize/builders/permission.builder.d.ts

@@ -1,6 +1,6 @@
-import type { IdType } from '../../../../base/index.js';
+import type { IdType } from '../../../index.js';
 import type { TNullable } from '@venizia/ignis-helpers/common';
-import type { TAuthorizationAction } from '../common/constants.js';
+import type { TAuthorizationAction } from '../common/constants/index.js';
 /** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
 export declare class AuthorizationPermissionBuilder {
     /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */

package/dist/esm/base/auth/authorize/builders/permission.builder.js

@@ -1,4 +1,4 @@
-import { AuthorizationActions } from '../common/constants.js';
+import { AuthorizationActions } from '../common/constants/index.js';
 /** Builders for `Permission` catalog rows (the `obj` axis the scoped matcher resolves), generic over `TName` so i18n and plain-text apps both fit; only framework-owned columns (code/subject/method/action/scope/description/parentId) are produced - app columns are added by the caller. */
 export class AuthorizationPermissionBuilder {
     /** Sentinel `method` for a coarse resource node (a grant target that is not a route). */

package/dist/esm/base/auth/authorize/builders/policy.builder.d.ts

@@ -1,7 +1,7 @@
-import type { IdType } from '../../../../base/index.js';
+import type { IdType } from '../../../index.js';
 import type { TNullable } from '@venizia/ignis-helpers/common';
-import type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants.js';
-import { AuthorizationActions, AuthorizationPolicyVariants } from '../common/constants.js';
+import type { TAuthorizationAction, TAuthorizationDecision } from '../common/constants/index.js';
+import { AuthorizationActions, AuthorizationPolicyVariants } from '../common/constants/index.js';
 /** A grant/assignment domain: a scope literal (`SYSTEM_WIDE`/`ANY_MEMBER`) or a typed domain entity. */
 export type TPolicyDomainInput = string | {
     type: string;
@@ -22,30 +22,27 @@ type TBuilderGrantRow = {
     targetId: IdType;
     action: string;
     effect: TAuthorizationDecision;
-    domain: TNullable<string>;
     domainType: TNullable<string>;
     domainId: TNullable<IdType>;
 };
+/**
+ * What IGNIS itself stores in `PolicyDefinition.metadata`: the operations of a subset grant, read
+ * back by `ScopedCasbinAdapter` through `parseCustomGrantMetadata`. An application whose own
+ * metadata has a different shape points the adapter at a different column
+ * (`entities.policyDefinition.metadata.columnName`) rather than widening this one.
+ *
+ * Declared here, beside the only writer, so the column type and the row type cannot drift.
+ */
+export type TSubsetGrantMetadata = {
+    ops: string[];
+};
 type TBuilderCustomGrantRow = Omit<TBuilderGrantRow, 'action'> & {
     action: typeof AuthorizationActions.CUSTOM;
-    metadata: {
-        ops: string[];
-    };
+    metadata: TSubsetGrantMetadata;
 };
 export declare class AuthorizationPolicyBuilder {
     static readonly ACTION_PRINCIPAL = "Action";
-    /** Serialize to the casbin token {@link resolveRequestDomain} emits: scope literals pass through; typed domains become `<type>_<id>` so `g3` cascades; null stays null (the adapter defaults grants to `ANY_MEMBER`). */
-    private static serializeDomain;
-    /**
-     * The same value as {@link serializeDomain}, in the two-column form that replaces it. Written
-     * alongside `domain` while `domain` is still the read source.
-     *
-     * `ANY_MEMBER` NORMALISES TO NULL, so `domain` and `domainType` deliberately disagree for a caller
-     * that passed the literal: `domain: 'ANY_MEMBER'` but `domainType: null`. A backfill check
-     * comparing the two columns by equality WILL report those rows and must not treat it as drift -
-     * null already meant `ANY_MEMBER` to the adapter, and admitting both spellings would make one
-     * state reachable two ways.
-     */
+    /** A domain as the two columns that store it. `ANY_MEMBER` normalises to null - admitting both spellings would leave one state reachable two ways. */
     private static splitDomain;
     /** A grant (casbin `p`): role/user -> permission, carrying action + effect + domain. A null `domain` means `ANY_MEMBER` (adapter default); pass a scope literal or a typed `{ type, id }` domain. */
     static grant(opts: {
@@ -94,7 +91,6 @@ export declare class AuthorizationPolicyBuilder {
         subjectId: IdType;
         targetType: string;
         targetId: IdType;
-        domain: TNullable<string>;
     };
     /** A user joins a domain (casbin `g2`) - backs the `ANY_MEMBER` grant scope. */
     static joinDomain(opts: {