@venizia/ignis-kernel 0.2.0-2 → 0.2.0-20

package/dist/cjs/base/auth/authenticate/common/{constants.d.ts → constants/authentication.d.ts}

@@ -2,21 +2,16 @@ import type { TConstValue } from '@venizia/ignis-helpers/common';
 export declare class AuthenticateStrategy {
     static readonly BASIC = "basic";
     static readonly JWT = "jwt";
+    static readonly SERVICE = "service";
     /** The strategies the FRAMEWORK ships. An application registers its own beyond these. */
     static readonly SCHEME_SET: Set<string>;
     static isValid(input: string): boolean;
 }
 export type TAuthStrategy = TConstValue<typeof AuthenticateStrategy> | (string & {});
-export declare class JOSEStandards {
-    static readonly JWS = "JWS";
-    static readonly JWKS = "JWKS";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TJOSEStandard = TConstValue<typeof JOSEStandards>;
 export declare class Authentication {
     static readonly STRATEGY_BASIC = "basic";
     static readonly STRATEGY_JWT = "jwt";
+    static readonly STRATEGY_SERVICE = "service";
     static readonly TYPE_BASIC = "Basic";
     static readonly TYPE_BEARER = "Bearer";
     static readonly AUTHENTICATION_STRATEGY = "authentication.strategy";
@@ -36,25 +31,4 @@ export declare class AuthenticationModes {
     static isValid(input: string): boolean;
 }
 export type TAuthMode = TConstValue<typeof AuthenticationModes>;
-export declare class JWKSModes {
-    static readonly ISSUER = "issuer";
-    static readonly VERIFIER = "verifier";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TJWKSMode = TConstValue<typeof JWKSModes>;
-export declare class JWKSKeyDrivers {
-    static readonly TEXT = "text";
-    static readonly FILE = "file";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TJWKSKeyDriver = TConstValue<typeof JWKSKeyDrivers>;
-export declare class JWKSKeyFormats {
-    static readonly PEM = "pem";
-    static readonly JWK = "jwk";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TJWKSKeyFormat = TConstValue<typeof JWKSKeyFormats>;
-//# sourceMappingURL=constants.d.ts.map
+//# sourceMappingURL=authentication.d.ts.map

package/dist/cjs/base/auth/authenticate/common/constants/authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiD;IAE3E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAID,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAErF,qBAAa,cAAc;IAEzB,MAAM,CAAC,QAAQ,CAAC,cAAc,WAA8B;IAC5D,MAAM,CAAC,QAAQ,CAAC,YAAY,SAA4B;IACxD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,aAAgC;IAGhE,MAAM,CAAC,QAAQ,CAAC,UAAU,WAAW;IACrC,MAAM,CAAC,QAAQ,CAAC,WAAW,YAAY;IAEvC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,6BAA6B;IACpE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,yBAAyB;IAE5D,MAAM,CAAC,QAAQ,CAAC,YAAY,uBAAuB;IACnD,MAAM,CAAC,QAAQ,CAAC,aAAa,mBAAmB;CACjD;AAED,qBAAa,wBAAwB;IACnC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,4BAA4B;IACnE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,sBAAsB;IACvD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uBAAuB;CAC1D;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/cjs/base/auth/authenticate/common/{constants.js → constants/authentication.js}

@@ -1,29 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWKSKeyFormats = exports.JWKSKeyDrivers = exports.JWKSModes = exports.AuthenticationModes = exports.AuthenticationTokenTypes = exports.Authentication = exports.JOSEStandards = exports.AuthenticateStrategy = void 0;
+exports.AuthenticationModes = exports.AuthenticationTokenTypes = exports.Authentication = exports.AuthenticateStrategy = void 0;
 class AuthenticateStrategy {
     static { this.BASIC = 'basic'; }
     static { this.JWT = 'jwt'; }
+    static { this.SERVICE = 'service'; }
     /** The strategies the FRAMEWORK ships. An application registers its own beyond these. */
-    static { this.SCHEME_SET = new Set([this.BASIC, this.JWT]); }
+    static { this.SCHEME_SET = new Set([this.BASIC, this.JWT, this.SERVICE]); }
     static isValid(input) {
         return this.SCHEME_SET.has(input);
     }
 }
 exports.AuthenticateStrategy = AuthenticateStrategy;
-class JOSEStandards {
-    static { this.JWS = 'JWS'; }
-    static { this.JWKS = 'JWKS'; }
-    static { this.SCHEME_SET = new Set([this.JWS, this.JWKS]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.JOSEStandards = JOSEStandards;
 class Authentication {
     // Strategy
     static { this.STRATEGY_BASIC = AuthenticateStrategy.BASIC; }
     static { this.STRATEGY_JWT = AuthenticateStrategy.JWT; }
+    static { this.STRATEGY_SERVICE = AuthenticateStrategy.SERVICE; }
     // Token type
     static { this.TYPE_BASIC = 'Basic'; }
     static { this.TYPE_BEARER = 'Bearer'; }
@@ -48,31 +41,4 @@ class AuthenticationModes {
     }
 }
 exports.AuthenticationModes = AuthenticationModes;
-class JWKSModes {
-    static { this.ISSUER = 'issuer'; }
-    static { this.VERIFIER = 'verifier'; }
-    static { this.SCHEME_SET = new Set([this.ISSUER, this.VERIFIER]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.JWKSModes = JWKSModes;
-class JWKSKeyDrivers {
-    static { this.TEXT = 'text'; }
-    static { this.FILE = 'file'; }
-    static { this.SCHEME_SET = new Set([this.TEXT, this.FILE]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.JWKSKeyDrivers = JWKSKeyDrivers;
-class JWKSKeyFormats {
-    static { this.PEM = 'pem'; }
-    static { this.JWK = 'jwk'; }
-    static { this.SCHEME_SET = new Set([this.PEM, this.JWK]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-exports.JWKSKeyFormats = JWKSKeyFormats;
-//# sourceMappingURL=constants.js.map
+//# sourceMappingURL=authentication.js.map

package/dist/cjs/base/auth/authenticate/common/constants/authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/authentication.ts"],"names":[],"mappings":";;;AAEA,MAAa,oBAAoB;aACf,UAAK,GAAG,OAAO,CAAC;aAChB,QAAG,GAAG,KAAK,CAAC;aACZ,YAAO,GAAG,SAAS,CAAC;IAEpC,yFAAyF;aACzE,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAVH,oDAWC;AAMD,MAAa,cAAc;IACzB,WAAW;aACK,mBAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC;aAC5C,iBAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC;aACxC,qBAAgB,GAAG,oBAAoB,CAAC,OAAO,CAAC;IAEhE,aAAa;aACG,eAAU,GAAG,OAAO,CAAC;aACrB,gBAAW,GAAG,QAAQ,CAAC;aAEvB,4BAAuB,GAAG,yBAAyB,CAAC;aACpD,wBAAmB,GAAG,qBAAqB,CAAC;aAE5C,iBAAY,GAAG,mBAAmB,CAAC;aACnC,kBAAa,GAAG,eAAe,CAAC;;AAdlD,wCAeC;AAED,MAAa,wBAAwB;aACnB,4BAAuB,GAAG,wBAAwB,CAAC;aACnD,sBAAiB,GAAG,kBAAkB,CAAC;aACvC,uBAAkB,GAAG,mBAAmB,CAAC;;AAH3D,4DAIC;AAED,MAAa,mBAAmB;aACd,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,kDASC"}

package/dist/cjs/base/auth/authenticate/common/constants/index.d.ts

@@ -0,0 +1,4 @@
+export * from './authentication';
+export * from './jose';
+export * from './service-assertion';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authenticate/common/constants/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,QAAQ,CAAC;AACvB,cAAc,qBAAqB,CAAC"}

package/dist/cjs/base/auth/authenticate/common/constants/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./authentication"), exports);
+__exportStar(require("./jose"), exports);
+__exportStar(require("./service-assertion"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authenticate/common/constants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,yCAAuB;AACvB,sDAAoC"}

package/dist/cjs/base/auth/authenticate/common/constants/jose.d.ts

@@ -0,0 +1,30 @@
+import type { TConstValue } from '@venizia/ignis-helpers/common';
+export declare class JOSEStandards {
+    static readonly JWS = "JWS";
+    static readonly JWKS = "JWKS";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TJOSEStandard = TConstValue<typeof JOSEStandards>;
+export declare class JWKSModes {
+    static readonly ISSUER = "issuer";
+    static readonly VERIFIER = "verifier";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TJWKSMode = TConstValue<typeof JWKSModes>;
+export declare class JWKSKeyDrivers {
+    static readonly TEXT = "text";
+    static readonly FILE = "file";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TJWKSKeyDriver = TConstValue<typeof JWKSKeyDrivers>;
+export declare class JWKSKeyFormats {
+    static readonly PEM = "pem";
+    static readonly JWK = "jwk";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TJWKSKeyFormat = TConstValue<typeof JWKSKeyFormats>;
+//# sourceMappingURL=jose.d.ts.map

package/dist/cjs/base/auth/authenticate/common/constants/jose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/jose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,aAAa,CAAC,CAAC;AAE9D,qBAAa,SAAS;IACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,QAAQ,cAAc;IAEtC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAyC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,SAAS,CAAC,CAAC;AAEtD,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAmC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;AAEhE,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/cjs/base/auth/authenticate/common/constants/jose.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JWKSKeyFormats = exports.JWKSKeyDrivers = exports.JWKSModes = exports.JOSEStandards = void 0;
+class JOSEStandards {
+    static { this.JWS = 'JWS'; }
+    static { this.JWKS = 'JWKS'; }
+    static { this.SCHEME_SET = new Set([this.JWS, this.JWKS]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+exports.JOSEStandards = JOSEStandards;
+class JWKSModes {
+    static { this.ISSUER = 'issuer'; }
+    static { this.VERIFIER = 'verifier'; }
+    static { this.SCHEME_SET = new Set([this.ISSUER, this.VERIFIER]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+exports.JWKSModes = JWKSModes;
+class JWKSKeyDrivers {
+    static { this.TEXT = 'text'; }
+    static { this.FILE = 'file'; }
+    static { this.SCHEME_SET = new Set([this.TEXT, this.FILE]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+exports.JWKSKeyDrivers = JWKSKeyDrivers;
+class JWKSKeyFormats {
+    static { this.PEM = 'pem'; }
+    static { this.JWK = 'jwk'; }
+    static { this.SCHEME_SET = new Set([this.PEM, this.JWK]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+exports.JWKSKeyFormats = JWKSKeyFormats;
+//# sourceMappingURL=jose.js.map

package/dist/cjs/base/auth/authenticate/common/constants/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/jose.ts"],"names":[],"mappings":";;;AAEA,MAAa,aAAa;aACR,QAAG,GAAG,KAAK,CAAC;aACZ,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,sCASC;AAID,MAAa,SAAS;aACJ,WAAM,GAAG,QAAQ,CAAC;aAClB,aAAQ,GAAG,UAAU,CAAC;aAEtB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,8BASC;AAID,MAAa,cAAc;aACT,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,wCASC;AAID,MAAa,cAAc;aACT,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AARH,wCASC"}

package/dist/cjs/base/auth/authenticate/common/constants/service-assertion.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
+ * call must agree on them, and a knob here would let two services disagree silently.
+ */
+export declare class ServiceAssertion {
+    /** Its own header, so the end user's token keeps `Authorization` on the same request. */
+    static readonly HEADER = "x-service-assertion";
+    /** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
+    static readonly TYP = "svc+jwt";
+    static readonly ALGORITHM = "EdDSA";
+    static readonly DEFAULT_REST_PATH = "/svc-certs";
+    /** How long a minted assertion stays valid. */
+    static readonly DEFAULT_SIGN_LIFETIME_SECONDS = 60;
+    /** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
+    static readonly DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60;
+    static readonly DEFAULT_CLOCK_TOLERANCE_SECONDS = 5;
+    /** Resolves the accepted age for one caller: its own override, then the service default. */
+    static resolveAcceptMaxAge(opts: {
+        callerOverride?: number;
+        serviceDefault?: number;
+    }): number;
+    static readonly DEFAULT_JWKS_CACHE_MAX_AGE_MS: number;
+    static readonly DEFAULT_JWKS_COOLDOWN_MS: number;
+}
+//# sourceMappingURL=service-assertion.d.ts.map

package/dist/cjs/base/auth/authenticate/common/constants/service-assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-assertion.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/service-assertion.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,MAAM,yBAAyB;IAE/C,uGAAuG;IACvG,MAAM,CAAC,QAAQ,CAAC,GAAG,aAAa;IAEhC,MAAM,CAAC,QAAQ,CAAC,SAAS,WAAW;IAEpC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,gBAAgB;IACjD,+CAA+C;IAC/C,MAAM,CAAC,QAAQ,CAAC,6BAA6B,MAAM;IAEnD,sGAAsG;IACtG,MAAM,CAAC,QAAQ,CAAC,8BAA8B,MAAM;IACpD,MAAM,CAAC,QAAQ,CAAC,+BAA+B,KAAK;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAM9F,MAAM,CAAC,QAAQ,CAAC,6BAA6B,SAAkB;IAC/D,MAAM,CAAC,QAAQ,CAAC,wBAAwB,SAAa;CACtD"}

package/dist/cjs/base/auth/authenticate/common/constants/service-assertion.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAssertion = void 0;
+/**
+ * Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
+ * call must agree on them, and a knob here would let two services disagree silently.
+ */
+class ServiceAssertion {
+    /** Its own header, so the end user's token keeps `Authorization` on the same request. */
+    static { this.HEADER = 'x-service-assertion'; }
+    /** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
+    static { this.TYP = 'svc+jwt'; }
+    static { this.ALGORITHM = 'EdDSA'; }
+    static { this.DEFAULT_REST_PATH = '/svc-certs'; }
+    /** How long a minted assertion stays valid. */
+    static { this.DEFAULT_SIGN_LIFETIME_SECONDS = 60; }
+    /** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
+    static { this.DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60; }
+    static { this.DEFAULT_CLOCK_TOLERANCE_SECONDS = 5; }
+    /** Resolves the accepted age for one caller: its own override, then the service default. */
+    static resolveAcceptMaxAge(opts) {
+        return (opts.callerOverride ?? opts.serviceDefault ?? ServiceAssertion.DEFAULT_ACCEPT_MAX_AGE_SECONDS);
+    }
+    static { this.DEFAULT_JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1000; }
+    static { this.DEFAULT_JWKS_COOLDOWN_MS = 30 * 1000; }
+}
+exports.ServiceAssertion = ServiceAssertion;
+//# sourceMappingURL=service-assertion.js.map

package/dist/cjs/base/auth/authenticate/common/constants/service-assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-assertion.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/service-assertion.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,MAAa,gBAAgB;IAC3B,yFAAyF;aACzE,WAAM,GAAG,qBAAqB,CAAC;IAE/C,uGAAuG;aACvF,QAAG,GAAG,SAAS,CAAC;aAEhB,cAAS,GAAG,OAAO,CAAC;aAEpB,sBAAiB,GAAG,YAAY,CAAC;IACjD,+CAA+C;aAC/B,kCAA6B,GAAG,EAAE,CAAC;IAEnD,sGAAsG;aACtF,mCAA8B,GAAG,EAAE,CAAC;aACpC,oCAA+B,GAAG,CAAC,CAAC;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAA0D;QACnF,OAAO,CACL,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC,8BAA8B,CAC9F,CAAC;IACJ,CAAC;aAEe,kCAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;aAC/C,6BAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;;AAzBvD,4CA0BC"}

package/dist/cjs/base/auth/authenticate/common/errors.d.ts

@@ -82,8 +82,47 @@ export declare const AuthenticationErrors: {
         readonly statusCode: 401;
         readonly category: "auth";
     };
+    readonly ASSERTION_MISSING: {
+        readonly message: {
+            readonly text: "Missing service assertion";
+            readonly code: "core.authentication.service.assertion_missing";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly ASSERTION_INVALID: {
+        readonly message: {
+            readonly text: "Invalid service assertion";
+            readonly code: "core.authentication.service.assertion_invalid";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly CALLER_NOT_ALLOWED: {
+        readonly message: {
+            readonly text: "Service caller is not allowed";
+            readonly code: "core.authentication.service.caller_not_allowed";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly REQUEST_BINDING_MISMATCH: {
+        readonly message: {
+            readonly text: "Service assertion does not match this request";
+            readonly code: "core.authentication.service.request_binding_mismatch";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly PRINCIPAL_UNRESOLVED: {
+        readonly message: {
+            readonly text: "Service caller resolved to no principal";
+            readonly code: "core.authentication.service.principal_unresolved";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
 };
-/** Registers these codes with the shared key registry so a consumer gets autocomplete on `messageCode`. Augments the `/core` subpath, not the root barrel - kernel never imports the bare package, so nothing else in this program would make the root specifier resolvable for the merge. */
 declare module '@venizia/ignis-helpers/core' {
     interface IErrorKeyRegistry extends TRegisterErrors<typeof AuthenticationErrors> {
     }

package/dist/cjs/base/auth/authenticate/common/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAIrF,kJAAkJ;AAClJ,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8B/B,iIAAiI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2C9E,CAAC;AAEtD,8RAA8R;AAC9R,OAAO,QAAQ,6BAA6B,CAAC;IAC3C,UAAU,iBAAkB,SAAQ,eAAe,CAAC,OAAO,oBAAoB,CAAC;KAAG;CACpF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGrF,kJAAkJ;AAClJ,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8B/B,iIAAiI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmF9E,CAAC;AAEtD,OAAO,QAAQ,6BAA6B,CAAC;IAC3C,UAAU,iBAAkB,SAAQ,eAAe,CAAC,OAAO,oBAAoB,CAAC;KAAG;CACpF"}

package/dist/cjs/base/auth/authenticate/common/errors.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthenticationErrors = void 0;
-const core_1 = require("@venizia/ignis-helpers/core");
 const common_1 = require("@venizia/ignis-helpers/common");
+const core_1 = require("@venizia/ignis-helpers/core");
 /** Codes a client branches on for a failed authentication. A throw site may override `message` for detail; the code and status come from here. */
 exports.AuthenticationErrors = {
     HEADER_MISSING: {
@@ -77,5 +77,45 @@ exports.AuthenticationErrors = {
         statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
         category: core_1.ErrorScopes.AUTH,
     },
+    ASSERTION_MISSING: {
+        message: {
+            text: 'Missing service assertion',
+            code: 'core.authentication.service.assertion_missing',
+        },
+        statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
+        category: core_1.ErrorScopes.AUTH,
+    },
+    ASSERTION_INVALID: {
+        message: {
+            text: 'Invalid service assertion',
+            code: 'core.authentication.service.assertion_invalid',
+        },
+        statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
+        category: core_1.ErrorScopes.AUTH,
+    },
+    CALLER_NOT_ALLOWED: {
+        message: {
+            text: 'Service caller is not allowed',
+            code: 'core.authentication.service.caller_not_allowed',
+        },
+        statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
+        category: core_1.ErrorScopes.AUTH,
+    },
+    REQUEST_BINDING_MISMATCH: {
+        message: {
+            text: 'Service assertion does not match this request',
+            code: 'core.authentication.service.request_binding_mismatch',
+        },
+        statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
+        category: core_1.ErrorScopes.AUTH,
+    },
+    PRINCIPAL_UNRESOLVED: {
+        message: {
+            text: 'Service caller resolved to no principal',
+            code: 'core.authentication.service.principal_unresolved',
+        },
+        statusCode: common_1.HTTP.ResultCodes.RS_4.Unauthorized,
+        category: core_1.ErrorScopes.AUTH,
+    },
 };
 //# sourceMappingURL=errors.js.map

package/dist/cjs/base/auth/authenticate/common/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":";;;AACA,sDAA0D;AAC1D,0DAAqD;AAErD,kJAAkJ;AACrI,QAAA,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACrF,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iIAAiI;IACjI,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACxF,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,yCAAyC;SAChD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9E,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,qCAAqC;SAC5C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;CACkD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":";;;AAAA,0DAAqD;AAErD,sDAA0D;AAE1D,kJAAkJ;AACrI,QAAA,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACrF,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iIAAiI;IACjI,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACxF,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,yCAAyC;SAChD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9E,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,qCAAqC;SAC5C;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE;YACP,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,gDAAgD;SACvD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,wBAAwB,EAAE;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,sDAAsD;SAC7D;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE;YACP,IAAI,EAAE,yCAAyC;YAC/C,IAAI,EAAE,kDAAkD;SACzD;QACD,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,kBAAW,CAAC,IAAI;KAC3B;CACkD,CAAC"}

package/dist/cjs/base/auth/authenticate/common/keys.d.ts

@@ -3,5 +3,7 @@ export declare class AuthenticateBindingKeys {
     static readonly JWT_OPTIONS = "@app/authenticate/jwt-options";
     static readonly JWKS_OPTIONS = "@app/authenticate/jwks-options";
     static readonly BASIC_OPTIONS = "@app/authenticate/basic-options";
+    static readonly SERVICE_OPTIONS = "@app/authenticate/service-options";
+    static readonly SERVICE_CERTS_PATH = "@app/authenticate/service-certs-path";
 }
 //# sourceMappingURL=keys.d.ts.map

package/dist/cjs/base/auth/authenticate/common/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IAC9D,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,qCAAqC;CACnE"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IAC9D,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,qCAAqC;IAClE,MAAM,CAAC,QAAQ,CAAC,eAAe,uCAAuC;IACtE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,0CAA0C;CAC7E"}

package/dist/cjs/base/auth/authenticate/common/keys.js

@@ -6,6 +6,8 @@ class AuthenticateBindingKeys {
     static { this.JWT_OPTIONS = '@app/authenticate/jwt-options'; }
     static { this.JWKS_OPTIONS = '@app/authenticate/jwks-options'; }
     static { this.BASIC_OPTIONS = '@app/authenticate/basic-options'; }
+    static { this.SERVICE_OPTIONS = '@app/authenticate/service-options'; }
+    static { this.SERVICE_CERTS_PATH = '@app/authenticate/service-certs-path'; }
 }
 exports.AuthenticateBindingKeys = AuthenticateBindingKeys;
 //# sourceMappingURL=keys.js.map

package/dist/cjs/base/auth/authenticate/common/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":";;;AAAA,MAAa,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC;;AAJpE,0DAKC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":";;;AAAA,MAAa,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC;aAClD,oBAAe,GAAG,mCAAmC,CAAC;aACtD,uBAAkB,GAAG,sCAAsC,CAAC;;AAN9E,0DAOC"}

package/dist/cjs/base/auth/authenticate/common/types/basic.d.ts

@@ -0,0 +1,14 @@
+import type { TContext } from '../../../../controllers/common/types';
+import type { Env } from 'hono';
+import type { IAuthUser } from './strategy';
+export type TBasicTokenServiceOptions<E extends Env = Env> = {
+    /** Callback to verify basic auth credentials. Returns IAuthUser if valid, null otherwise. */
+    verifyCredentials: (opts: {
+        credentials: {
+            username: string;
+            password: string;
+        };
+        context: TContext<E, string>;
+    }) => Promise<IAuthUser | null>;
+};
+//# sourceMappingURL=basic.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/basic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/basic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,MAAM,yBAAyB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI;IAC3D,6FAA6F;IAC7F,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACxB,WAAW,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACjC,CAAC"}

package/dist/cjs/base/auth/authenticate/common/types/basic.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=basic.js.map

package/dist/cjs/base/auth/authenticate/common/types/basic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/basic.ts"],"names":[],"mappings":""}

package/dist/cjs/base/auth/authenticate/common/types/index.d.ts

@@ -0,0 +1,7 @@
+export * from './basic';
+export * from './jwt';
+export * from './options';
+export * from './rest';
+export * from './service';
+export * from './strategy';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/base/auth/authenticate/common/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/cjs/base/auth/authenticate/common/types/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./basic"), exports);
+__exportStar(require("./jwt"), exports);
+__exportStar(require("./options"), exports);
+__exportStar(require("./rest"), exports);
+__exportStar(require("./service"), exports);
+__exportStar(require("./strategy"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/base/auth/authenticate/common/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,wCAAsB;AACtB,4CAA0B;AAC1B,yCAAuB;AACvB,4CAA0B;AAC1B,6CAA2B"}