@venizia/ignis-kernel 0.2.0-2 → 0.2.0-21

package/dist/esm/base/auth/authenticate/common/codecs.d.ts

@@ -1,4 +1,4 @@
-import type { IJWTTokenPayload, IPayloadFieldCodec } from './types.js';
+import type { IJWTTokenPayload, IPayloadFieldCodec } from './types/index.js';
 export declare class AuthenticationFieldCodecs {
     static readonly ROLES_CODEC: IPayloadFieldCodec<IJWTTokenPayload['roles']>;
     /** Builds a single payload field codec. */

package/dist/esm/base/auth/authenticate/common/{constants.d.ts → constants/authentication.d.ts}

@@ -2,21 +2,16 @@ import type { TConstValue } from '@venizia/ignis-helpers/common';
 export declare class AuthenticateStrategy {
     static readonly BASIC = "basic";
     static readonly JWT = "jwt";
+    static readonly SERVICE = "service";
     /** The strategies the FRAMEWORK ships. An application registers its own beyond these. */
     static readonly SCHEME_SET: Set<string>;
     static isValid(input: string): boolean;
 }
 export type TAuthStrategy = TConstValue<typeof AuthenticateStrategy> | (string & {});
-export declare class JOSEStandards {
-    static readonly JWS = "JWS";
-    static readonly JWKS = "JWKS";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TJOSEStandard = TConstValue<typeof JOSEStandards>;
 export declare class Authentication {
     static readonly STRATEGY_BASIC = "basic";
     static readonly STRATEGY_JWT = "jwt";
+    static readonly STRATEGY_SERVICE = "service";
     static readonly TYPE_BASIC = "Basic";
     static readonly TYPE_BEARER = "Bearer";
     static readonly AUTHENTICATION_STRATEGY = "authentication.strategy";
@@ -36,25 +31,4 @@ export declare class AuthenticationModes {
     static isValid(input: string): boolean;
 }
 export type TAuthMode = TConstValue<typeof AuthenticationModes>;
-export declare class JWKSModes {
-    static readonly ISSUER = "issuer";
-    static readonly VERIFIER = "verifier";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TJWKSMode = TConstValue<typeof JWKSModes>;
-export declare class JWKSKeyDrivers {
-    static readonly TEXT = "text";
-    static readonly FILE = "file";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TJWKSKeyDriver = TConstValue<typeof JWKSKeyDrivers>;
-export declare class JWKSKeyFormats {
-    static readonly PEM = "pem";
-    static readonly JWK = "jwk";
-    static readonly SCHEME_SET: Set<string>;
-    static isValid(input: string): boolean;
-}
-export type TJWKSKeyFormat = TConstValue<typeof JWKSKeyFormats>;
-//# sourceMappingURL=constants.d.ts.map
+//# sourceMappingURL=authentication.d.ts.map

package/dist/esm/base/auth/authenticate/common/constants/authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/authentication.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,oBAAoB;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW;IAChC,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,OAAO,aAAa;IAEpC,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiD;IAE3E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAID,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,oBAAoB,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAErF,qBAAa,cAAc;IAEzB,MAAM,CAAC,QAAQ,CAAC,cAAc,WAA8B;IAC5D,MAAM,CAAC,QAAQ,CAAC,YAAY,SAA4B;IACxD,MAAM,CAAC,QAAQ,CAAC,gBAAgB,aAAgC;IAGhE,MAAM,CAAC,QAAQ,CAAC,UAAU,WAAW;IACrC,MAAM,CAAC,QAAQ,CAAC,WAAW,YAAY;IAEvC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,6BAA6B;IACpE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,yBAAyB;IAE5D,MAAM,CAAC,QAAQ,CAAC,YAAY,uBAAuB;IACnD,MAAM,CAAC,QAAQ,CAAC,aAAa,mBAAmB;CACjD;AAED,qBAAa,wBAAwB;IACnC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,4BAA4B;IACnE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,sBAAsB;IACvD,MAAM,CAAC,QAAQ,CAAC,kBAAkB,uBAAuB;CAC1D;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/esm/base/auth/authenticate/common/{constants.js → constants/authentication.js}

@@ -1,16 +1,9 @@
 export class AuthenticateStrategy {
     static { this.BASIC = 'basic'; }
     static { this.JWT = 'jwt'; }
+    static { this.SERVICE = 'service'; }
     /** The strategies the FRAMEWORK ships. An application registers its own beyond these. */
-    static { this.SCHEME_SET = new Set([this.BASIC, this.JWT]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-export class JOSEStandards {
-    static { this.JWS = 'JWS'; }
-    static { this.JWKS = 'JWKS'; }
-    static { this.SCHEME_SET = new Set([this.JWS, this.JWKS]); }
+    static { this.SCHEME_SET = new Set([this.BASIC, this.JWT, this.SERVICE]); }
     static isValid(input) {
         return this.SCHEME_SET.has(input);
     }
@@ -19,6 +12,7 @@ export class Authentication {
     // Strategy
     static { this.STRATEGY_BASIC = AuthenticateStrategy.BASIC; }
     static { this.STRATEGY_JWT = AuthenticateStrategy.JWT; }
+    static { this.STRATEGY_SERVICE = AuthenticateStrategy.SERVICE; }
     // Token type
     static { this.TYPE_BASIC = 'Basic'; }
     static { this.TYPE_BEARER = 'Bearer'; }
@@ -40,28 +34,4 @@ export class AuthenticationModes {
         return this.SCHEME_SET.has(input);
     }
 }
-export class JWKSModes {
-    static { this.ISSUER = 'issuer'; }
-    static { this.VERIFIER = 'verifier'; }
-    static { this.SCHEME_SET = new Set([this.ISSUER, this.VERIFIER]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-export class JWKSKeyDrivers {
-    static { this.TEXT = 'text'; }
-    static { this.FILE = 'file'; }
-    static { this.SCHEME_SET = new Set([this.TEXT, this.FILE]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-export class JWKSKeyFormats {
-    static { this.PEM = 'pem'; }
-    static { this.JWK = 'jwk'; }
-    static { this.SCHEME_SET = new Set([this.PEM, this.JWK]); }
-    static isValid(input) {
-        return this.SCHEME_SET.has(input);
-    }
-}
-//# sourceMappingURL=constants.js.map
+//# sourceMappingURL=authentication.js.map

package/dist/esm/base/auth/authenticate/common/constants/authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/authentication.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,oBAAoB;aACf,UAAK,GAAG,OAAO,CAAC;aAChB,QAAG,GAAG,KAAK,CAAC;aACZ,YAAO,GAAG,SAAS,CAAC;IAEpC,yFAAyF;aACzE,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3E,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAOH,MAAM,OAAO,cAAc;IACzB,WAAW;aACK,mBAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC;aAC5C,iBAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC;aACxC,qBAAgB,GAAG,oBAAoB,CAAC,OAAO,CAAC;IAEhE,aAAa;aACG,eAAU,GAAG,OAAO,CAAC;aACrB,gBAAW,GAAG,QAAQ,CAAC;aAEvB,4BAAuB,GAAG,yBAAyB,CAAC;aACpD,wBAAmB,GAAG,qBAAqB,CAAC;aAE5C,iBAAY,GAAG,mBAAmB,CAAC;aACnC,kBAAa,GAAG,eAAe,CAAC;;AAGlD,MAAM,OAAO,wBAAwB;aACnB,4BAAuB,GAAG,wBAAwB,CAAC;aACnD,sBAAiB,GAAG,kBAAkB,CAAC;aACvC,uBAAkB,GAAG,mBAAmB,CAAC;;AAG3D,MAAM,OAAO,mBAAmB;aACd,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC"}

package/dist/esm/base/auth/authenticate/common/constants/index.d.ts

@@ -0,0 +1,4 @@
+export * from './authentication.js';
+export * from './jose.js';
+export * from './service-assertion.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authenticate/common/constants/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,QAAQ,CAAC;AACvB,cAAc,qBAAqB,CAAC"}

package/dist/esm/base/auth/authenticate/common/constants/index.js

@@ -0,0 +1,4 @@
+export * from './authentication.js';
+export * from './jose.js';
+export * from './service-assertion.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authenticate/common/constants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,QAAQ,CAAC;AACvB,cAAc,qBAAqB,CAAC"}

package/dist/esm/base/auth/authenticate/common/constants/jose.d.ts

@@ -0,0 +1,30 @@
+import type { TConstValue } from '@venizia/ignis-helpers/common';
+export declare class JOSEStandards {
+    static readonly JWS = "JWS";
+    static readonly JWKS = "JWKS";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TJOSEStandard = TConstValue<typeof JOSEStandards>;
+export declare class JWKSModes {
+    static readonly ISSUER = "issuer";
+    static readonly VERIFIER = "verifier";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TJWKSMode = TConstValue<typeof JWKSModes>;
+export declare class JWKSKeyDrivers {
+    static readonly TEXT = "text";
+    static readonly FILE = "file";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TJWKSKeyDriver = TConstValue<typeof JWKSKeyDrivers>;
+export declare class JWKSKeyFormats {
+    static readonly PEM = "pem";
+    static readonly JWK = "jwk";
+    static readonly SCHEME_SET: Set<string>;
+    static isValid(input: string): boolean;
+}
+export type TJWKSKeyFormat = TConstValue<typeof JWKSKeyFormats>;
+//# sourceMappingURL=jose.d.ts.map

package/dist/esm/base/auth/authenticate/common/constants/jose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/jose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,qBAAa,aAAa;IACxB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAkC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,aAAa,CAAC,CAAC;AAE9D,qBAAa,SAAS;IACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY;IAClC,MAAM,CAAC,QAAQ,CAAC,QAAQ,cAAc;IAEtC,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAyC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,SAAS,CAAC,CAAC;AAEtD,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAC9B,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU;IAE9B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAmC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC;AAEhE,qBAAa,cAAc;IACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAC5B,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;IAE5B,MAAM,CAAC,QAAQ,CAAC,UAAU,cAAiC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;CAGvC;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/esm/base/auth/authenticate/common/constants/jose.js

@@ -0,0 +1,33 @@
+export class JOSEStandards {
+    static { this.JWS = 'JWS'; }
+    static { this.JWKS = 'JWKS'; }
+    static { this.SCHEME_SET = new Set([this.JWS, this.JWKS]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+export class JWKSModes {
+    static { this.ISSUER = 'issuer'; }
+    static { this.VERIFIER = 'verifier'; }
+    static { this.SCHEME_SET = new Set([this.ISSUER, this.VERIFIER]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+export class JWKSKeyDrivers {
+    static { this.TEXT = 'text'; }
+    static { this.FILE = 'file'; }
+    static { this.SCHEME_SET = new Set([this.TEXT, this.FILE]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+export class JWKSKeyFormats {
+    static { this.PEM = 'pem'; }
+    static { this.JWK = 'jwk'; }
+    static { this.SCHEME_SET = new Set([this.PEM, this.JWK]); }
+    static isValid(input) {
+        return this.SCHEME_SET.has(input);
+    }
+}
+//# sourceMappingURL=jose.js.map

package/dist/esm/base/auth/authenticate/common/constants/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/jose.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,aAAa;aACR,QAAG,GAAG,KAAK,CAAC;aACZ,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,SAAS;aACJ,WAAM,GAAG,QAAQ,CAAC;aAClB,aAAQ,GAAG,UAAU,CAAC;aAEtB,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;aACT,SAAI,GAAG,MAAM,CAAC;aACd,SAAI,GAAG,MAAM,CAAC;aAEd,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;;AAKH,MAAM,OAAO,cAAc;aACT,QAAG,GAAG,KAAK,CAAC;aACZ,QAAG,GAAG,KAAK,CAAC;aAEZ,eAAU,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,OAAO,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC"}

package/dist/esm/base/auth/authenticate/common/constants/service-assertion.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
+ * call must agree on them, and a knob here would let two services disagree silently.
+ */
+export declare class ServiceAssertion {
+    /** Its own header, so the end user's token keeps `Authorization` on the same request. */
+    static readonly HEADER = "x-service-assertion";
+    /** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
+    static readonly TYP = "svc+jwt";
+    static readonly ALGORITHM = "EdDSA";
+    static readonly DEFAULT_REST_PATH = "/svc-certs";
+    /** How long a minted assertion stays valid. */
+    static readonly DEFAULT_SIGN_LIFETIME_SECONDS = 60;
+    /** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
+    static readonly DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60;
+    static readonly DEFAULT_CLOCK_TOLERANCE_SECONDS = 5;
+    /** Resolves the accepted age for one caller: its own override, then the service default. */
+    static resolveAcceptMaxAge(opts: {
+        callerOverride?: number;
+        serviceDefault?: number;
+    }): number;
+    static readonly DEFAULT_JWKS_CACHE_MAX_AGE_MS: number;
+    static readonly DEFAULT_JWKS_COOLDOWN_MS: number;
+}
+//# sourceMappingURL=service-assertion.d.ts.map

package/dist/esm/base/auth/authenticate/common/constants/service-assertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-assertion.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/service-assertion.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,MAAM,yBAAyB;IAE/C,uGAAuG;IACvG,MAAM,CAAC,QAAQ,CAAC,GAAG,aAAa;IAEhC,MAAM,CAAC,QAAQ,CAAC,SAAS,WAAW;IAEpC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,gBAAgB;IACjD,+CAA+C;IAC/C,MAAM,CAAC,QAAQ,CAAC,6BAA6B,MAAM;IAEnD,sGAAsG;IACtG,MAAM,CAAC,QAAQ,CAAC,8BAA8B,MAAM;IACpD,MAAM,CAAC,QAAQ,CAAC,+BAA+B,KAAK;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM;IAM9F,MAAM,CAAC,QAAQ,CAAC,6BAA6B,SAAkB;IAC/D,MAAM,CAAC,QAAQ,CAAC,wBAAwB,SAAa;CACtD"}

package/dist/esm/base/auth/authenticate/common/constants/service-assertion.js

@@ -0,0 +1,24 @@
+/**
+ * Wire-level constants of the service assertion. Fixed rather than configurable: both ends of a
+ * call must agree on them, and a knob here would let two services disagree silently.
+ */
+export class ServiceAssertion {
+    /** Its own header, so the end user's token keeps `Authorization` on the same request. */
+    static { this.HEADER = 'x-service-assertion'; }
+    /** The JWS `typ`. What stops a user token being replayed as an assertion when one JWKS serves both. */
+    static { this.TYP = 'svc+jwt'; }
+    static { this.ALGORITHM = 'EdDSA'; }
+    static { this.DEFAULT_REST_PATH = '/svc-certs'; }
+    /** How long a minted assertion stays valid. */
+    static { this.DEFAULT_SIGN_LIFETIME_SECONDS = 60; }
+    /** The oldest assertion a callee accepts, measured from `iat`. Its own decision, not the caller's. */
+    static { this.DEFAULT_ACCEPT_MAX_AGE_SECONDS = 60; }
+    static { this.DEFAULT_CLOCK_TOLERANCE_SECONDS = 5; }
+    /** Resolves the accepted age for one caller: its own override, then the service default. */
+    static resolveAcceptMaxAge(opts) {
+        return (opts.callerOverride ?? opts.serviceDefault ?? ServiceAssertion.DEFAULT_ACCEPT_MAX_AGE_SECONDS);
+    }
+    static { this.DEFAULT_JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1000; }
+    static { this.DEFAULT_JWKS_COOLDOWN_MS = 30 * 1000; }
+}
+//# sourceMappingURL=service-assertion.js.map

package/dist/esm/base/auth/authenticate/common/constants/service-assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-assertion.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/constants/service-assertion.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAC3B,yFAAyF;aACzE,WAAM,GAAG,qBAAqB,CAAC;IAE/C,uGAAuG;aACvF,QAAG,GAAG,SAAS,CAAC;aAEhB,cAAS,GAAG,OAAO,CAAC;aAEpB,sBAAiB,GAAG,YAAY,CAAC;IACjD,+CAA+C;aAC/B,kCAA6B,GAAG,EAAE,CAAC;IAEnD,sGAAsG;aACtF,mCAA8B,GAAG,EAAE,CAAC;aACpC,oCAA+B,GAAG,CAAC,CAAC;IAEpD,4FAA4F;IAC5F,MAAM,CAAC,mBAAmB,CAAC,IAA0D;QACnF,OAAO,CACL,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC,8BAA8B,CAC9F,CAAC;IACJ,CAAC;aAEe,kCAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;aAC/C,6BAAwB,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/esm/base/auth/authenticate/common/errors.d.ts

@@ -82,8 +82,47 @@ export declare const AuthenticationErrors: {
         readonly statusCode: 401;
         readonly category: "auth";
     };
+    readonly ASSERTION_MISSING: {
+        readonly message: {
+            readonly text: "Missing service assertion";
+            readonly code: "core.authentication.service.assertion_missing";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly ASSERTION_INVALID: {
+        readonly message: {
+            readonly text: "Invalid service assertion";
+            readonly code: "core.authentication.service.assertion_invalid";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly CALLER_NOT_ALLOWED: {
+        readonly message: {
+            readonly text: "Service caller is not allowed";
+            readonly code: "core.authentication.service.caller_not_allowed";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly REQUEST_BINDING_MISMATCH: {
+        readonly message: {
+            readonly text: "Service assertion does not match this request";
+            readonly code: "core.authentication.service.request_binding_mismatch";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
+    readonly PRINCIPAL_UNRESOLVED: {
+        readonly message: {
+            readonly text: "Service caller resolved to no principal";
+            readonly code: "core.authentication.service.principal_unresolved";
+        };
+        readonly statusCode: 401;
+        readonly category: "auth";
+    };
 };
-/** Registers these codes with the shared key registry so a consumer gets autocomplete on `messageCode`. Augments the `/core` subpath, not the root barrel - kernel never imports the bare package, so nothing else in this program would make the root specifier resolvable for the merge. */
 declare module '@venizia/ignis-helpers/core' {
     interface IErrorKeyRegistry extends TRegisterErrors<typeof AuthenticationErrors> {
     }

package/dist/esm/base/auth/authenticate/common/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAIrF,kJAAkJ;AAClJ,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8B/B,iIAAiI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2C9E,CAAC;AAEtD,8RAA8R;AAC9R,OAAO,QAAQ,6BAA6B,CAAC;IAC3C,UAAU,iBAAkB,SAAQ,eAAe,CAAC,OAAO,oBAAoB,CAAC;KAAG;CACpF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAoB,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAGrF,kJAAkJ;AAClJ,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA8B/B,iIAAiI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmF9E,CAAC;AAEtD,OAAO,QAAQ,6BAA6B,CAAC;IAC3C,UAAU,iBAAkB,SAAQ,eAAe,CAAC,OAAO,oBAAoB,CAAC;KAAG;CACpF"}

package/dist/esm/base/auth/authenticate/common/errors.js

@@ -1,5 +1,5 @@
-import { ErrorScopes } from '@venizia/ignis-helpers/core';
 import { HTTP } from '@venizia/ignis-helpers/common';
+import { ErrorScopes } from '@venizia/ignis-helpers/core';
 /** Codes a client branches on for a failed authentication. A throw site may override `message` for detail; the code and status come from here. */
 export const AuthenticationErrors = {
     HEADER_MISSING: {
@@ -74,5 +74,45 @@ export const AuthenticationErrors = {
         statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
         category: ErrorScopes.AUTH,
     },
+    ASSERTION_MISSING: {
+        message: {
+            text: 'Missing service assertion',
+            code: 'core.authentication.service.assertion_missing',
+        },
+        statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
+        category: ErrorScopes.AUTH,
+    },
+    ASSERTION_INVALID: {
+        message: {
+            text: 'Invalid service assertion',
+            code: 'core.authentication.service.assertion_invalid',
+        },
+        statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
+        category: ErrorScopes.AUTH,
+    },
+    CALLER_NOT_ALLOWED: {
+        message: {
+            text: 'Service caller is not allowed',
+            code: 'core.authentication.service.caller_not_allowed',
+        },
+        statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
+        category: ErrorScopes.AUTH,
+    },
+    REQUEST_BINDING_MISMATCH: {
+        message: {
+            text: 'Service assertion does not match this request',
+            code: 'core.authentication.service.request_binding_mismatch',
+        },
+        statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
+        category: ErrorScopes.AUTH,
+    },
+    PRINCIPAL_UNRESOLVED: {
+        message: {
+            text: 'Service caller resolved to no principal',
+            code: 'core.authentication.service.principal_unresolved',
+        },
+        statusCode: HTTP.ResultCodes.RS_4.Unauthorized,
+        category: ErrorScopes.AUTH,
+    },
 };
 //# sourceMappingURL=errors.js.map

package/dist/esm/base/auth/authenticate/common/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AAErD,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACrF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iIAAiI;IACjI,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACxF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,yCAAyC;SAChD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9E,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,qCAAqC;SAC5C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;CACkD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,kJAAkJ;AAClJ,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,cAAc,EAAE;QACd,OAAO,EAAE;YACP,IAAI,EAAE,kCAAkC;YACxC,IAAI,EAAE,oCAAoC;SAC3C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,gBAAgB,EAAE;QAChB,OAAO,EAAE;YACP,IAAI,EAAE,gCAAgC;YACtC,IAAI,EAAE,sCAAsC;SAC7C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACrF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iIAAiI;IACjI,aAAa,EAAE;QACb,OAAO,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,mCAAmC,EAAE;QACxF,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,qBAAqB,EAAE;QACrB,OAAO,EAAE;YACP,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,2CAA2C;SAClD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,mBAAmB,EAAE;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,8BAA8B;YACpC,IAAI,EAAE,yCAAyC;SAChD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,4BAA4B,EAAE;QAC9E,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,eAAe,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,qCAAqC;SAC5C;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,iBAAiB,EAAE;QACjB,OAAO,EAAE;YACP,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,+CAA+C;SACtD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,kBAAkB,EAAE;QAClB,OAAO,EAAE;YACP,IAAI,EAAE,+BAA+B;YACrC,IAAI,EAAE,gDAAgD;SACvD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,wBAAwB,EAAE;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,sDAAsD;SAC7D;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;IACD,oBAAoB,EAAE;QACpB,OAAO,EAAE;YACP,IAAI,EAAE,yCAAyC;YAC/C,IAAI,EAAE,kDAAkD;SACzD;QACD,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY;QAC9C,QAAQ,EAAE,WAAW,CAAC,IAAI;KAC3B;CACkD,CAAC"}

package/dist/esm/base/auth/authenticate/common/index.d.ts

@@ -1,6 +1,6 @@
 export * from './errors.js';
 export * from './codecs.js';
-export * from './constants.js';
+export * from './constants/index.js';
 export * from './keys.js';
-export * from './types.js';
+export * from './types/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authenticate/common/index.js

@@ -1,6 +1,6 @@
 export * from './errors.js';
 export * from './codecs.js';
-export * from './constants.js';
+export * from './constants/index.js';
 export * from './keys.js';
-export * from './types.js';
+export * from './types/index.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authenticate/common/keys.d.ts

@@ -3,5 +3,7 @@ export declare class AuthenticateBindingKeys {
     static readonly JWT_OPTIONS = "@app/authenticate/jwt-options";
     static readonly JWKS_OPTIONS = "@app/authenticate/jwks-options";
     static readonly BASIC_OPTIONS = "@app/authenticate/basic-options";
+    static readonly SERVICE_OPTIONS = "@app/authenticate/service-options";
+    static readonly SERVICE_CERTS_PATH = "@app/authenticate/service-certs-path";
 }
 //# sourceMappingURL=keys.d.ts.map

package/dist/esm/base/auth/authenticate/common/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IAC9D,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,qCAAqC;CACnE"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,qBAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,WAAW,mCAAmC;IAC9D,MAAM,CAAC,QAAQ,CAAC,YAAY,oCAAoC;IAChE,MAAM,CAAC,QAAQ,CAAC,aAAa,qCAAqC;IAClE,MAAM,CAAC,QAAQ,CAAC,eAAe,uCAAuC;IACtE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,0CAA0C;CAC7E"}

package/dist/esm/base/auth/authenticate/common/keys.js

@@ -3,5 +3,7 @@ export class AuthenticateBindingKeys {
     static { this.JWT_OPTIONS = '@app/authenticate/jwt-options'; }
     static { this.JWKS_OPTIONS = '@app/authenticate/jwks-options'; }
     static { this.BASIC_OPTIONS = '@app/authenticate/basic-options'; }
+    static { this.SERVICE_OPTIONS = '@app/authenticate/service-options'; }
+    static { this.SERVICE_CERTS_PATH = '@app/authenticate/service-certs-path'; }
 }
 //# sourceMappingURL=keys.js.map

package/dist/esm/base/auth/authenticate/common/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../src/base/auth/authenticate/common/keys.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,uBAAuB;aAClB,iBAAY,GAAG,gCAAgC,CAAC;aAChD,gBAAW,GAAG,+BAA+B,CAAC;aAC9C,iBAAY,GAAG,gCAAgC,CAAC;aAChD,kBAAa,GAAG,iCAAiC,CAAC;aAClD,oBAAe,GAAG,mCAAmC,CAAC;aACtD,uBAAkB,GAAG,sCAAsC,CAAC"}

package/dist/esm/base/auth/authenticate/common/types/basic.d.ts

@@ -0,0 +1,14 @@
+import type { TContext } from '../../../../controllers/common/types/index.js';
+import type { Env } from 'hono';
+import type { IAuthUser } from './strategy.js';
+export type TBasicTokenServiceOptions<E extends Env = Env> = {
+    /** Callback to verify basic auth credentials. Returns IAuthUser if valid, null otherwise. */
+    verifyCredentials: (opts: {
+        credentials: {
+            username: string;
+            password: string;
+        };
+        context: TContext<E, string>;
+    }) => Promise<IAuthUser | null>;
+};
+//# sourceMappingURL=basic.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/basic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/basic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,MAAM,yBAAyB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,IAAI;IAC3D,6FAA6F;IAC7F,iBAAiB,EAAE,CAAC,IAAI,EAAE;QACxB,WAAW,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;KAC9B,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACjC,CAAC"}

package/dist/esm/base/auth/authenticate/common/types/basic.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=basic.js.map

package/dist/esm/base/auth/authenticate/common/types/basic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basic.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/basic.ts"],"names":[],"mappings":""}

package/dist/esm/base/auth/authenticate/common/types/index.d.ts

@@ -0,0 +1,7 @@
+export * from './basic.js';
+export * from './jwt.js';
+export * from './options.js';
+export * from './rest.js';
+export * from './service.js';
+export * from './strategy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/esm/base/auth/authenticate/common/types/index.js

@@ -0,0 +1,7 @@
+export * from './basic.js';
+export * from './jwt.js';
+export * from './options.js';
+export * from './rest.js';
+export * from './service.js';
+export * from './strategy.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/base/auth/authenticate/common/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}

package/dist/esm/base/auth/authenticate/common/{types.d.ts → types/jwt.d.ts}

@@ -1,61 +1,9 @@
-import type { TContext } from '../../../../base/controllers/common/types.js';
-import type { IdType } from '../../../../base/models/common/types.js';
-import type { TAnyObjectSchema } from '../../../../utilities/schema.utility.js';
-import type { AnyObject, ValueOrPromise } from '@venizia/ignis-helpers/common';
+import type { IdType } from '../../../../models/common/index.js';
+import type { ValueOrPromise } from '@venizia/ignis-helpers/common';
 import type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers/core';
-import type { Env } from 'hono';
-import { type MiddlewareHandler } from 'hono';
 import type { JWTPayload } from 'jose';
-import type { TChangePasswordRequest, TSignInRequest, TSignUpRequest } from '../../models/requests/index.js';
-import type { JOSEStandards, JWKSModes } from './constants.js';
-import { type TAuthMode, type TJWKSKeyDriver, type TJWKSKeyFormat } from './constants.js';
-export type TDefineAuthControllerOpts = {
-    restPath?: string;
-    serviceKey: string;
-    requireAuthenticatedSignUp?: boolean;
-    payload?: {
-        signIn?: {
-            request: {
-                schema: TAnyObjectSchema;
-            };
-            response: {
-                schema: TAnyObjectSchema;
-            };
-        };
-        signUp?: {
-            request: {
-                schema: TAnyObjectSchema;
-            };
-            response: {
-                schema: TAnyObjectSchema;
-            };
-        };
-        changePassword?: {
-            request: {
-                schema?: TAnyObjectSchema;
-            };
-            response: {
-                schema: TAnyObjectSchema;
-            };
-        };
-        refreshToken?: {
-            response: {
-                schema: TAnyObjectSchema;
-            };
-        };
-        getUserInformation?: {
-            response: {
-                schema: TAnyObjectSchema;
-            };
-        };
-    };
-};
-export type TAuthenticationRestOptions = {} & ({
-    useAuthController?: false | undefined;
-} | {
-    useAuthController: true;
-    controllerOpts: TDefineAuthControllerOpts;
-});
+import type { JOSEStandards, JWKSModes, TJWKSKeyDriver, TJWKSKeyFormat } from '../constants/index.js';
+import type { IAuthUser } from './strategy.js';
 /**
  * Claim checks applied when VERIFYING a JWT. Field names and types mirror jose's `JWTVerifyOptions`
  * exactly, so this is a pass-through with no translation layer.
@@ -163,25 +111,6 @@ export type TJWTTokenServiceOptions = {
     standard: typeof JOSEStandards.JWKS;
     options: TJWKSTokenServiceOptions;
 };
-export type TBasicTokenServiceOptions<E extends Env = Env> = {
-    /** Callback to verify basic auth credentials. Returns IAuthUser if valid, null otherwise. */
-    verifyCredentials: (opts: {
-        credentials: {
-            username: string;
-            password: string;
-        };
-        context: TContext<E, string>;
-    }) => Promise<IAuthUser | null>;
-};
-export interface IAuthenticateOptions {
-    restOptions?: TAuthenticationRestOptions;
-    jwtOptions?: TJWTTokenServiceOptions;
-    basicOptions?: TBasicTokenServiceOptions;
-}
-export interface IAuthUser {
-    userId: IdType;
-    [extra: string | symbol]: any;
-}
 export interface IJWTTokenPayload extends JWTPayload, IAuthUser {
     userId: IdType;
     roles: {
@@ -205,19 +134,4 @@ export interface IPayloadFieldCodec<T = unknown> {
     }): T;
 }
 export type TGetTokenExpiresFn = () => ValueOrPromise<number>;
-export interface IAuthenticationStrategy<E extends Env = Env> {
-    name: string;
-    authenticate(context: TContext<E, string>): Promise<IAuthUser>;
-}
-export type TAuthenticateFn<RouteEnv extends Env = Env> = (opts: {
-    strategies: string[];
-    mode?: TAuthMode;
-}) => MiddlewareHandler<RouteEnv>;
-export interface IAuthService<E extends Env = Env, SIRQ extends TSignInRequest = TSignInRequest, SIRS = AnyObject, SURQ extends TSignUpRequest = TSignUpRequest, SURS = AnyObject, CPRQ extends TChangePasswordRequest = TChangePasswordRequest, CPRS = AnyObject, UIRQ = AnyObject, UIRS = AnyObject, RTRS = AnyObject> {
-    signIn(context: TContext<E>, opts: SIRQ): Promise<SIRS>;
-    signUp(context: TContext<E>, opts: SURQ): Promise<SURS>;
-    changePassword(context: TContext<E>, opts: CPRQ): Promise<CPRS>;
-    getUserInformation?(context: TContext<E>, opts: UIRQ): Promise<UIRS>;
-    refreshToken?(context: TContext<E>): Promise<RTRS>;
-}
-//# sourceMappingURL=types.d.ts.map
+//# sourceMappingURL=jwt.d.ts.map

package/dist/esm/base/auth/authenticate/common/types/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../../../../../src/base/auth/authenticate/common/types/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,sOAAsO;IACtO,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE3B,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEjC,wHAAwH;IACxH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAEtB,kJAAkJ;IAClJ,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B,2IAA2I;IAC3I,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,8HAA8H;AAC9H,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,SAAS,CAAC,MAAM,CAAC;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxB,IAAI,EAAE;QACJ,MAAM,EAAE,cAAc,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAE3B,sGAAsG;IACtG,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,SAAS,CAAC,QAAQ,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACnC,gHAAgH;IAChH,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,kFAAkF;IAClF,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,MAAM,MAAM,wBAAwB,GAAG,kBAAkB,GAAG,oBAAoB,CAAC;AAEjF,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,GAAG,CAAC;IAAC,OAAO,EAAE,uBAAuB,CAAA;CAAE,GACxE;IAAE,QAAQ,EAAE,OAAO,aAAa,CAAC,IAAI,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,gBAAiB,SAAQ,UAAU,EAAE,SAAS;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAE9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,OAAO;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC;IACtC,WAAW,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC"}