@venizia/ignis 0.2.0-0 → 0.2.0-10

package/dist/components/auth/authenticate/component.js

@@ -14,15 +14,15 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 var AuthenticateComponent_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthenticateComponent = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const ignis_kernel_3 = require("@venizia/ignis-kernel");
-const ignis_kernel_4 = require("@venizia/ignis-kernel");
 const core_1 = require("@venizia/ignis-helpers/core");
 const ignis_inversion_1 = require("@venizia/ignis-inversion");
-const ignis_kernel_5 = require("@venizia/ignis-kernel");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
 const controllers_1 = require("./controllers");
+const service_certs_1 = require("./controllers/service-certs");
 const services_1 = require("./services");
+const signer_service_1 = require("./services/service/signer.service");
+const verifier_service_1 = require("./services/service/verifier.service");
+const service_strategy_1 = require("./strategies/service.strategy");
 const DEFAULT_SECRET = 'unknown_secret';
 let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponent extends ignis_kernel_1.BaseComponent {
     constructor(application) {
@@ -30,8 +30,8 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
             scope: AuthenticateComponent_1.name,
             initDefault: { enable: true, container: application },
             bindings: {
-                [ignis_kernel_5.AuthenticateBindingKeys.REST_OPTIONS]: ignis_inversion_1.Binding.bind({
-                    key: ignis_kernel_5.AuthenticateBindingKeys.REST_OPTIONS,
+                [ignis_kernel_1.AuthenticateBindingKeys.REST_OPTIONS]: ignis_inversion_1.Binding.bind({
+                    key: ignis_kernel_1.AuthenticateBindingKeys.REST_OPTIONS,
                 }).toValue({ useAuthController: false }),
             },
         });
@@ -39,30 +39,36 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
     }
     binding() {
         const jwtOptions = this.application.get({
-            key: ignis_kernel_5.AuthenticateBindingKeys.JWT_OPTIONS,
+            key: ignis_kernel_1.AuthenticateBindingKeys.JWT_OPTIONS,
             isOptional: true,
         });
         const basicOptions = this.application.get({
-            key: ignis_kernel_5.AuthenticateBindingKeys.BASIC_OPTIONS,
+            key: ignis_kernel_1.AuthenticateBindingKeys.BASIC_OPTIONS,
             isOptional: true,
         });
         const restOptions = this.application.get({
-            key: ignis_kernel_5.AuthenticateBindingKeys.REST_OPTIONS,
+            key: ignis_kernel_1.AuthenticateBindingKeys.REST_OPTIONS,
+            isOptional: true,
+        });
+        const serviceOptions = this.application.get({
+            key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_OPTIONS,
             isOptional: true,
         });
-        if (!jwtOptions && !basicOptions) {
+        // A service that only VERIFIES assertions needs neither jwt nor basic - and that application,
+        // an IGNIS app consuming no user tokens at all, is exactly what the service strategy is for.
+        if (!jwtOptions && !basicOptions && !serviceOptions) {
             throw (0, core_1.getError)({
-                message: '[AuthenticateComponent] At least one of jwtOptions or basicOptions must be provided',
+                message: '[AuthenticateComponent] At least one of jwtOptions, basicOptions or serviceOptions must be provided',
             });
         }
-        const options = { restOptions, jwtOptions, basicOptions };
+        const options = { restOptions, jwtOptions, basicOptions, serviceOptions };
         if (jwtOptions) {
             switch (jwtOptions.standard) {
-                case ignis_kernel_5.JOSEStandards.JWS: {
+                case ignis_kernel_1.JOSEStandards.JWS: {
                     this.defineJWSAuth({ options: jwtOptions.options });
                     break;
                 }
-                case ignis_kernel_5.JOSEStandards.JWKS: {
+                case ignis_kernel_1.JOSEStandards.JWKS: {
                     this.defineJWKSAuth({ options: jwtOptions.options });
                     break;
                 }
@@ -74,6 +80,7 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
             }
         }
         this.defineBasicAuth({ basicOptions });
+        this.defineServiceAuth({ serviceOptions });
         this.defineControllers({ options });
         this.defineOAuth2();
     }
@@ -91,7 +98,7 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
             });
         }
         this.application
-            .bind({ key: ignis_kernel_5.AuthenticateBindingKeys.JWT_OPTIONS })
+            .bind({ key: ignis_kernel_1.AuthenticateBindingKeys.JWT_OPTIONS })
             .toValue(jwsOptions);
         this.application.service(services_1.JWSTokenService);
         this.logger.for(this.defineJWSAuth.name).info('JWS authentication configured');
@@ -99,16 +106,16 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
     defineJWKSAuth(opts) {
         const { options: jwksOptions } = opts;
         switch (jwksOptions.mode) {
-            case ignis_kernel_5.JWKSModes.ISSUER: {
+            case ignis_kernel_1.JWKSModes.ISSUER: {
                 const issuerOpts = jwksOptions;
                 if (!issuerOpts.keys?.private || !issuerOpts.keys?.public) {
                     throw (0, core_1.getError)({
                         message: '[defineJWKSAuth] keys.private and keys.public are required for issuer mode',
                     });
                 }
-                if (!issuerOpts.keys?.format || !ignis_kernel_5.JWKSKeyFormats.isValid(issuerOpts.keys.format)) {
+                if (!issuerOpts.keys?.format || !ignis_kernel_1.JWKSKeyFormats.isValid(issuerOpts.keys.format)) {
                     throw (0, core_1.getError)({
-                        message: `[defineJWKSAuth] keys.format is required and must be one of: ${[...ignis_kernel_5.JWKSKeyFormats.SCHEME_SET].join(', ')}`,
+                        message: `[defineJWKSAuth] keys.format is required and must be one of: ${[...ignis_kernel_1.JWKSKeyFormats.SCHEME_SET].join(', ')}`,
                     });
                 }
                 if (!issuerOpts.kid) {
@@ -120,24 +127,24 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
                     });
                 }
                 this.application
-                    .bind({ key: ignis_kernel_5.AuthenticateBindingKeys.JWKS_OPTIONS })
+                    .bind({ key: ignis_kernel_1.AuthenticateBindingKeys.JWKS_OPTIONS })
                     .toValue(issuerOpts);
                 this.application.service(services_1.JWKSIssuerTokenService);
                 // Path depends on a runtime option, so @controller can't be applied statically — decorate here instead.
-                Reflect.decorate([(0, ignis_kernel_3.controller)({ path: issuerOpts?.rest?.path ?? '/certs' })], controllers_1.JWKSController);
+                Reflect.decorate([(0, ignis_kernel_1.controller)({ path: issuerOpts?.rest?.path ?? '/certs' })], controllers_1.JWKSController);
                 this.application.controller(controllers_1.JWKSController);
                 this.logger
                     .for(this.defineJWKSAuth.name)
                     .info('JWKS issuer configured with /certs endpoint');
                 break;
             }
-            case ignis_kernel_5.JWKSModes.VERIFIER: {
+            case ignis_kernel_1.JWKSModes.VERIFIER: {
                 const verifierOpts = jwksOptions;
                 if (!verifierOpts.jwksUrl) {
                     throw (0, core_1.getError)({ message: '[defineJWKSAuth] jwksUrl is required for verifier mode' });
                 }
                 this.application
-                    .bind({ key: ignis_kernel_5.AuthenticateBindingKeys.JWKS_OPTIONS })
+                    .bind({ key: ignis_kernel_1.AuthenticateBindingKeys.JWKS_OPTIONS })
                     .toValue(verifierOpts);
                 this.application.service(services_1.JWKSVerifierTokenService);
                 this.logger.for(this.defineJWKSAuth.name).info('JWKS verifier configured');
@@ -151,6 +158,53 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
             }
         }
     }
+    /**
+     * Service-to-service authentication. Absent options mean no strategy is registered and no route is
+     * mounted, so an application that never sets them is byte-identical to today.
+     *
+     * The certs route is mounted only when SIGNING keys are present. Most services are called and
+     * never call; publishing a key set for a service that signs nothing advertises a capability it
+     * does not have.
+     */
+    defineServiceAuth(opts) {
+        const { serviceOptions } = opts;
+        if (!serviceOptions) {
+            this.logger
+                .for(this.defineServiceAuth.name)
+                .debug('serviceOptions not provided, skipping service authentication');
+            return;
+        }
+        if (!serviceOptions.name) {
+            throw (0, core_1.getError)({
+                message: '[defineServiceAuth] name is required | it is the issuer this service stamps and the audience it demands',
+            });
+        }
+        if (!serviceOptions.resolvePrincipal) {
+            throw (0, core_1.getError)({
+                message: '[defineServiceAuth] resolvePrincipal is required | the framework proves WHICH SERVICE called, the application decides who that acts as',
+            });
+        }
+        this.application.service(verifier_service_1.ServiceAssertionVerifierService);
+        if (serviceOptions.keys) {
+            this.application.service(signer_service_1.ServiceAssertionSignerService);
+            const restPath = serviceOptions.rest?.path ?? ignis_kernel_1.ServiceAssertion.DEFAULT_REST_PATH;
+            this.application
+                .bind({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_CERTS_PATH })
+                .toValue(restPath);
+            // Path depends on a runtime option, so @controller cannot be applied statically.
+            Reflect.decorate([(0, ignis_kernel_1.controller)({ path: restPath })], service_certs_1.ServiceCertsController);
+            this.application.controller(service_certs_1.ServiceCertsController);
+        }
+        ignis_kernel_1.AuthenticationStrategyRegistry.getInstance().register({
+            container: this.application,
+            strategies: [
+                { name: ignis_kernel_1.Authentication.STRATEGY_SERVICE, strategy: service_strategy_1.ServiceAuthenticationStrategy },
+            ],
+        });
+        this.logger
+            .for(this.defineServiceAuth.name)
+            .info('Service authentication configured | name: %s | signs: %s | callers: %s', serviceOptions.name, Boolean(serviceOptions.keys), Object.keys(serviceOptions.callers ?? {}).join(', ') || 'none');
+    }
     defineBasicAuth(opts) {
         const { basicOptions } = opts;
         if (!basicOptions) {
@@ -165,7 +219,7 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
             });
         }
         this.application
-            .bind({ key: ignis_kernel_5.AuthenticateBindingKeys.BASIC_OPTIONS })
+            .bind({ key: ignis_kernel_1.AuthenticateBindingKeys.BASIC_OPTIONS })
             .toValue(basicOptions);
         this.application.service(services_1.BasicTokenService);
         this.logger.for(this.defineBasicAuth.name).info('Basic authentication configured');
@@ -191,7 +245,7 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
 };
 exports.AuthenticateComponent = AuthenticateComponent;
 exports.AuthenticateComponent = AuthenticateComponent = AuthenticateComponent_1 = __decorate([
-    __param(0, (0, ignis_kernel_2.inject)({ key: ignis_kernel_4.CoreBindings.APPLICATION_INSTANCE })),
+    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.CoreBindings.APPLICATION_INSTANCE })),
     __metadata("design:paramtypes", [Function])
 ], AuthenticateComponent);
 //# sourceMappingURL=component.js.map

package/dist/components/auth/authenticate/component.js.map

@@ -1 +1 @@
-{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../../src/components/auth/authenticate/component.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAAsD;AACtD,wDAA+C;AAC/C,wDAAmD;AACnD,wDAAqD;AACrD,sDAAuD;AAEvD,8DAAmD;AACnD,wDAa+B;AAC/B,+CAAqE;AACrE,yCAKoB;AAEpB,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,IAAa,qBAAqB,6BAAlC,MAAa,qBAAsB,SAAQ,4BAAa;IACtD,YAC8D,WAA4B;QAExF,KAAK,CAAC;YACJ,KAAK,EAAE,uBAAqB,CAAC,IAAI;YACjC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;YACrD,QAAQ,EAAE;gBACR,CAAC,sCAAuB,CAAC,YAAY,CAAC,EAAE,yBAAO,CAAC,IAAI,CAA6B;oBAC/E,GAAG,EAAE,sCAAuB,CAAC,YAAY;iBAC1C,CAAC,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;aACzC;SACF,CAAC,CAAC;QAVyD,gBAAW,GAAX,WAAW,CAAiB;IAW1F,CAAC;IAEQ,OAAO;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA0B;YAC/D,GAAG,EAAE,sCAAuB,CAAC,WAAW;YACxC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA4B;YACnE,GAAG,EAAE,sCAAuB,CAAC,aAAa;YAC1C,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA6B;YACnE,GAAG,EAAE,sCAAuB,CAAC,YAAY;YACzC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YACjC,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,qFAAqF;aACxF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QAEhF,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC5B,KAAK,4BAAa,CAAC,GAAG,CAAC,CAAC,CAAC;oBACvB,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBACpD,MAAM;gBACR,CAAC;gBACD,KAAK,4BAAa,CAAC,IAAI,CAAC,CAAC,CAAC;oBACxB,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBACrD,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,kDAAmD,UAAkB,CAAC,QAAQ,EAAE;qBAC1F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvC,IAAI,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpC,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,aAAa,CAAC,IAA0C;QAC9D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAErC,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,UAAU,CAAC;QAEpD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YAC/C,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,iDAAiD,SAAS,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAA0B,EAAE,GAAG,EAAE,sCAAuB,CAAC,WAAW,EAAE,CAAC;aAC3E,OAAO,CAAC,UAAU,CAAC,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAe,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjF,CAAC;IAEO,cAAc,CAAC,IAA2C;QAChE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QAEtC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,wBAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,WAAW,CAAC;gBAE/B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAC1D,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,4EAA4E;qBACtF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,6BAAc,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChF,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,gEAAgE,CAAC,GAAG,6BAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACrH,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;oBACpB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;gBAClF,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;oBAClC,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,gEAAgE;qBAC1E,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,WAAW;qBACb,IAAI,CAAqB,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC;qBACvE,OAAO,CAAC,UAAU,CAAC,CAAC;gBACvB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,iCAAsB,CAAC,CAAC;gBAEjD,wGAAwG;gBACxG,OAAO,CAAC,QAAQ,CACd,CAAC,IAAA,yBAAU,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,EAC1D,4BAAc,CACf,CAAC;gBACF,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,4BAAc,CAAC,CAAC;gBAE5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;qBAC7B,IAAI,CAAC,6CAA6C,CAAC,CAAC;gBACvD,MAAM;YACR,CAAC;YAED,KAAK,wBAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxB,MAAM,YAAY,GAAG,WAAW,CAAC;gBAEjC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;gBACxF,CAAC;gBAED,IAAI,CAAC,WAAW;qBACb,IAAI,CAAuB,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC;qBACzE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,mCAAwB,CAAC,CAAC;gBAEnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBAC3E,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,wFAAwF;gBACxF,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,uCAAwC,WAAkC,CAAC,IAAI,EAAE;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,IAAkD;QACxE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QAE9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;iBAC9B,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAA4B,EAAE,GAAG,EAAE,sCAAuB,CAAC,aAAa,EAAE,CAAC;aAC/E,OAAO,CAAC,YAAY,CAAC,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,4BAAiB,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACrF,CAAC;IAEO,iBAAiB,CAAC,IAAuC;QAC/D,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEjD,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,kCAAoB,EAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC;IAED,YAAY;QACV,wBAAwB;IAC1B,CAAC;CACF,CAAA;AA/MY,sDAAqB;gCAArB,qBAAqB;IAE7B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,2BAAY,CAAC,oBAAoB,EAAE,CAAC,CAAA;;GAF1C,qBAAqB,CA+MjC"}
+{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../../src/components/auth/authenticate/component.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAEA,sDAAuD;AACvD,8DAAmD;AACnD,wDAqB+B;AAC/B,+CAAqE;AACrE,+DAAqE;AACrE,yCAKoB;AACpB,sEAAkF;AAClF,0EAAsF;AACtF,oEAA8E;AAE9E,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,IAAa,qBAAqB,6BAAlC,MAAa,qBAAsB,SAAQ,4BAAa;IACtD,YAC8D,WAA4B;QAExF,KAAK,CAAC;YACJ,KAAK,EAAE,uBAAqB,CAAC,IAAI;YACjC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;YACrD,QAAQ,EAAE;gBACR,CAAC,sCAAuB,CAAC,YAAY,CAAC,EAAE,yBAAO,CAAC,IAAI,CAA6B;oBAC/E,GAAG,EAAE,sCAAuB,CAAC,YAAY;iBAC1C,CAAC,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;aACzC;SACF,CAAC,CAAC;QAVyD,gBAAW,GAAX,WAAW,CAAiB;IAW1F,CAAC;IAEQ,OAAO;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA0B;YAC/D,GAAG,EAAE,sCAAuB,CAAC,WAAW;YACxC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA4B;YACnE,GAAG,EAAE,sCAAuB,CAAC,aAAa;YAC1C,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA6B;YACnE,GAAG,EAAE,sCAAuB,CAAC,YAAY;YACzC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAsB;YAC/D,GAAG,EAAE,sCAAuB,CAAC,eAAe;YAC5C,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,8FAA8F;QAC9F,6FAA6F;QAC7F,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,qGAAqG;aACxG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;QAEhG,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC5B,KAAK,4BAAa,CAAC,GAAG,CAAC,CAAC,CAAC;oBACvB,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBACpD,MAAM;gBACR,CAAC;gBACD,KAAK,4BAAa,CAAC,IAAI,CAAC,CAAC,CAAC;oBACxB,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBACrD,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,kDAAmD,UAAkB,CAAC,QAAQ,EAAE;qBAC1F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAE3C,IAAI,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpC,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,aAAa,CAAC,IAA0C;QAC9D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAErC,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,UAAU,CAAC;QAEpD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YAC/C,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,iDAAiD,SAAS,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAA0B,EAAE,GAAG,EAAE,sCAAuB,CAAC,WAAW,EAAE,CAAC;aAC3E,OAAO,CAAC,UAAU,CAAC,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAe,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjF,CAAC;IAEO,cAAc,CAAC,IAA2C;QAChE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QAEtC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,wBAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,WAAW,CAAC;gBAE/B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAC1D,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,4EAA4E;qBACtF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,6BAAc,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChF,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,gEAAgE,CAAC,GAAG,6BAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACrH,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;oBACpB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;gBAClF,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;oBAClC,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,gEAAgE;qBAC1E,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,WAAW;qBACb,IAAI,CAAqB,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC;qBACvE,OAAO,CAAC,UAAU,CAAC,CAAC;gBACvB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,iCAAsB,CAAC,CAAC;gBAEjD,wGAAwG;gBACxG,OAAO,CAAC,QAAQ,CACd,CAAC,IAAA,yBAAU,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,EAC1D,4BAAc,CACf,CAAC;gBACF,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,4BAAc,CAAC,CAAC;gBAE5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;qBAC7B,IAAI,CAAC,6CAA6C,CAAC,CAAC;gBACvD,MAAM;YACR,CAAC;YAED,KAAK,wBAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxB,MAAM,YAAY,GAAG,WAAW,CAAC;gBAEjC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;gBACxF,CAAC;gBAED,IAAI,CAAC,WAAW;qBACb,IAAI,CAAuB,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC;qBACzE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,mCAAwB,CAAC,CAAC;gBAEnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBAC3E,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,wFAAwF;gBACxF,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,uCAAwC,WAAkC,CAAC,IAAI,EAAE;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,IAA8C;QACtE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QAEhC,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;iBAChC,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,yGAAyG;aAC5G,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC;YACrC,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,wIAAwI;aAC3I,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,kDAA+B,CAAC,CAAC;QAE1D,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,8CAA6B,CAAC,CAAC;YAExD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,IAAI,+BAAgB,CAAC,iBAAiB,CAAC;YACjF,IAAI,CAAC,WAAW;iBACb,IAAI,CAAS,EAAE,GAAG,EAAE,sCAAuB,CAAC,kBAAkB,EAAE,CAAC;iBACjE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAErB,iFAAiF;YACjF,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAA,yBAAU,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,sCAAsB,CAAC,CAAC;YAC3E,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,sCAAsB,CAAC,CAAC;QACtD,CAAC;QAED,6CAA8B,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACpD,SAAS,EAAE,IAAI,CAAC,WAAW;YAC3B,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,6BAAc,CAAC,gBAAgB,EAAE,QAAQ,EAAE,gDAA6B,EAAE;aACnF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;aAChC,IAAI,CACH,wEAAwE,EACxE,cAAc,CAAC,IAAI,EACnB,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAC/D,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,IAAkD;QACxE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QAE9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;iBAC9B,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAA4B,EAAE,GAAG,EAAE,sCAAuB,CAAC,aAAa,EAAE,CAAC;aAC/E,OAAO,CAAC,YAAY,CAAC,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,4BAAiB,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACrF,CAAC;IAEO,iBAAiB,CAAC,IAAuC;QAC/D,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEjD,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,kCAAoB,EAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC;IAED,YAAY;QACV,wBAAwB;IAC1B,CAAC;CACF,CAAA;AAtRY,sDAAqB;gCAArB,qBAAqB;IAE7B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,2BAAY,CAAC,oBAAoB,EAAE,CAAC,CAAA;;GAF1C,qBAAqB,CAsRjC"}

package/dist/components/auth/authenticate/controllers/index.d.ts

@@ -1,3 +1,4 @@
 export * from './factory';
 export * from './jwks';
+export * from './service-certs';
 //# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/controllers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/controllers/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/controllers/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,iBAAiB,CAAC"}

package/dist/components/auth/authenticate/controllers/index.js

@@ -16,4 +16,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./factory"), exports);
 __exportStar(require("./jwks"), exports);
+__exportStar(require("./service-certs"), exports);
 //# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/controllers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/controllers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,yCAAuB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/controllers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,yCAAuB;AACvB,kDAAgC"}

package/dist/components/auth/authenticate/controllers/service-certs/controller.d.ts

@@ -0,0 +1,10 @@
+import { BaseRestController } from '@venizia/ignis-kernel';
+import { ValueOrPromise } from '@venizia/ignis-helpers/common';
+import { ServiceAssertionSignerService } from '../../services/service/signer.service';
+/** Publishes this service's assertion-signing public key. Mounted only when signing keys are configured. */
+export declare class ServiceCertsController extends BaseRestController {
+    private readonly signer;
+    constructor(signer: ServiceAssertionSignerService, path: string);
+    binding(): ValueOrPromise<void>;
+}
+//# sourceMappingURL=controller.d.ts.map

package/dist/components/auth/authenticate/controllers/service-certs/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,EAGnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAQ,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AAGtF,4GAA4G;AAC5G,qBAAa,sBAAuB,SAAQ,kBAAkB;IAQ1D,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,6BAA6B,EAEtD,IAAI,EAAE,MAAM;IAKL,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC;CAUzC"}

package/dist/components/auth/authenticate/controllers/service-certs/controller.js

@@ -0,0 +1,50 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ServiceCertsController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceCertsController = void 0;
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
+const common_1 = require("@venizia/ignis-helpers/common");
+const ignis_inversion_1 = require("@venizia/ignis-inversion");
+const signer_service_1 = require("../../services/service/signer.service");
+const definitions_1 = require("./definitions");
+/** Publishes this service's assertion-signing public key. Mounted only when signing keys are configured. */
+let ServiceCertsController = ServiceCertsController_1 = class ServiceCertsController extends ignis_kernel_1.BaseRestController {
+    constructor(signer, path) {
+        super({ scope: ServiceCertsController_1.name, path, isStrict: true });
+        this.signer = signer;
+    }
+    binding() {
+        this.defineRoute({
+            configs: definitions_1.ServiceCertsRouteConfigs.GET_SERVICE_CERTS,
+            handler: async (context) => {
+                const jwks = await this.signer.getPublicJWKS();
+                context.header('Cache-Control', 'public, max-age=600, stale-while-revalidate=86400');
+                return context.json(jwks, common_1.HTTP.ResultCodes.RS_2.Ok);
+            },
+        });
+    }
+};
+exports.ServiceCertsController = ServiceCertsController;
+exports.ServiceCertsController = ServiceCertsController = ServiceCertsController_1 = __decorate([
+    __param(0, (0, ignis_kernel_1.inject)({
+        key: ignis_inversion_1.BindingKeys.build({
+            namespace: ignis_kernel_1.BindingNamespaces.SERVICE,
+            key: signer_service_1.ServiceAssertionSignerService.name,
+        }),
+    })),
+    __param(1, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_CERTS_PATH })),
+    __metadata("design:paramtypes", [signer_service_1.ServiceAssertionSignerService, String])
+], ServiceCertsController);
+//# sourceMappingURL=controller.js.map

package/dist/components/auth/authenticate/controllers/service-certs/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAK+B;AAC/B,0DAAqE;AACrE,8DAAuD;AACvD,0EAAsF;AACtF,+CAAyD;AAEzD,4GAA4G;AAC5G,IAAa,sBAAsB,8BAAnC,MAAa,sBAAuB,SAAQ,iCAAkB;IAC5D,YAOmB,MAAqC,EAEtD,IAAY;QAEZ,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAJnD,WAAM,GAAN,MAAM,CAA+B;IAKxD,CAAC;IAEQ,OAAO;QACd,IAAI,CAAC,WAAW,CAAC;YACf,OAAO,EAAE,sCAAwB,CAAC,iBAAiB;YACnD,OAAO,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC/C,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;gBACrF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAzBY,wDAAsB;iCAAtB,sBAAsB;IAE9B,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,8CAA6B,CAAC,IAAI;SACxC,CAAC;KACH,CAAC,CAAA;IAED,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,kBAAkB,EAAE,CAAC,CAAA;qCADnC,8CAA6B;GAR7C,sBAAsB,CAyBlC"}

package/dist/components/auth/authenticate/controllers/service-certs/definitions.d.ts

@@ -0,0 +1,73 @@
+import { z } from '@hono/zod-openapi';
+/**
+ * Unauthenticated by design: it serves the PUBLIC key a callee needs to verify this service's
+ * assertions. Whoever can reach it learns only which key signs, which is what verification requires.
+ *
+ * The schema names public members only. That is documentation, not a filter - a zod response schema
+ * does not strip anything - so the guard that private material never gets here lives in the signer.
+ */
+export declare const ServiceCertsRouteConfigs: {
+    readonly GET_SERVICE_CERTS: {
+        readonly path: "/";
+        readonly method: "get";
+        readonly responses: {
+            200: {
+                description: string;
+                content: {
+                    'application/json': {
+                        schema: z.ZodObject<{
+                            keys: z.ZodArray<z.ZodObject<{
+                                kty: z.ZodString;
+                                kid: z.ZodOptional<z.ZodString>;
+                                use: z.ZodOptional<z.ZodString>;
+                                alg: z.ZodOptional<z.ZodString>;
+                                crv: z.ZodOptional<z.ZodString>;
+                                x: z.ZodOptional<z.ZodString>;
+                            }, z.core.$strip>>;
+                        }, z.core.$strip>;
+                    };
+                };
+                required: boolean | undefined;
+            } | {
+                headers: never;
+                description: string;
+                content: {
+                    'application/json': {
+                        schema: z.ZodObject<{
+                            keys: z.ZodArray<z.ZodObject<{
+                                kty: z.ZodString;
+                                kid: z.ZodOptional<z.ZodString>;
+                                use: z.ZodOptional<z.ZodString>;
+                                alg: z.ZodOptional<z.ZodString>;
+                                crv: z.ZodOptional<z.ZodString>;
+                                x: z.ZodOptional<z.ZodString>;
+                            }, z.core.$strip>>;
+                        }, z.core.$strip>;
+                    };
+                };
+                required: boolean | undefined;
+            };
+            "4xx | 5xx": {
+                description: string;
+                content: {
+                    "application/json": {
+                        schema: z.ZodObject<{
+                            statusCode: z.ZodOptional<z.ZodNumber>;
+                            message: z.ZodString;
+                            normalized: z.ZodOptional<z.ZodObject<{
+                                text: z.ZodString;
+                                code: z.ZodString;
+                                args: z.ZodRecord<z.ZodString, z.ZodAny>;
+                            }, z.core.$strip>>;
+                            extra: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+                            requestId: z.ZodOptional<z.ZodString>;
+                            details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+                        }, z.core.$strip>;
+                    };
+                };
+                required: boolean | undefined;
+            };
+        };
+    };
+};
+//# sourceMappingURL=definitions.d.ts.map

package/dist/components/auth/authenticate/controllers/service-certs/definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsB3B,CAAC"}

package/dist/components/auth/authenticate/controllers/service-certs/definitions.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceCertsRouteConfigs = void 0;
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
+const zod_openapi_1 = require("@hono/zod-openapi");
+/**
+ * Unauthenticated by design: it serves the PUBLIC key a callee needs to verify this service's
+ * assertions. Whoever can reach it learns only which key signs, which is what verification requires.
+ *
+ * The schema names public members only. That is documentation, not a filter - a zod response schema
+ * does not strip anything - so the guard that private material never gets here lives in the signer.
+ */
+exports.ServiceCertsRouteConfigs = {
+    GET_SERVICE_CERTS: {
+        path: '/',
+        method: 'get',
+        responses: (0, ignis_kernel_1.jsonResponse)({
+            schema: zod_openapi_1.z
+                .object({
+                keys: zod_openapi_1.z.array(zod_openapi_1.z.object({
+                    kty: zod_openapi_1.z.string(),
+                    kid: zod_openapi_1.z.string().optional(),
+                    use: zod_openapi_1.z.string().optional(),
+                    alg: zod_openapi_1.z.string().optional(),
+                    crv: zod_openapi_1.z.string().optional(),
+                    x: zod_openapi_1.z.string().optional(),
+                })),
+            })
+                .openapi({ description: 'Service assertion JSON Web Key Set' }),
+            description: 'Service assertion JSON Web Key Set',
+        }),
+    },
+};
+//# sourceMappingURL=definitions.js.map

package/dist/components/auth/authenticate/controllers/service-certs/definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/definitions.ts"],"names":[],"mappings":";;;AAAA,wDAAqD;AACrD,mDAAsC;AAEtC;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG;IACtC,iBAAiB,EAAE;QACjB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,IAAA,2BAAY,EAAC;YACtB,MAAM,EAAE,eAAC;iBACN,MAAM,CAAC;gBACN,IAAI,EAAE,eAAC,CAAC,KAAK,CACX,eAAC,CAAC,MAAM,CAAC;oBACP,GAAG,EAAE,eAAC,CAAC,MAAM,EAAE;oBACf,GAAG,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,CAAC,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;iBACzB,CAAC,CACH;aACF,CAAC;iBACD,OAAO,CAAC,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;YACjE,WAAW,EAAE,oCAAoC;SAClD,CAAC;KACH;CACO,CAAC"}

package/dist/components/auth/authenticate/controllers/service-certs/index.d.ts

@@ -0,0 +1,3 @@
+export * from './controller';
+export * from './definitions';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/controllers/service-certs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/dist/components/auth/authenticate/controllers/service-certs/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./controller"), exports);
+__exportStar(require("./definitions"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/controllers/service-certs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,gDAA8B"}

package/dist/components/auth/authenticate/services/bearer/abstract.service.d.ts

@@ -1,10 +1,9 @@
-import type { TContext } from '@venizia/ignis-kernel';
-import { BaseService } from '@venizia/ignis-kernel';
-import type { ValueOrPromise } from '@venizia/ignis-helpers/common';
 import type { AESAlgorithmType, IPayloadCipher } from '@venizia/ignis-helpers';
+import type { ValueOrPromise } from '@venizia/ignis-helpers/common';
+import type { IJWTIssueClaims, IJWTSignOptions, IJWTTokenPayload, IPayloadFieldCodec, TContext, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
+import { BaseService } from '@venizia/ignis-kernel';
 import type { Env } from 'hono';
 import type { JWTPayload, JWTVerifyResult, SignJWT } from 'jose';
-import type { IJWTTokenPayload, IPayloadFieldCodec, TGetTokenExpiresFn } from '@venizia/ignis-kernel';
 /** Abstract base for Bearer-token services (JWS, JWKS) with optional AES payload encryption. */
 export declare abstract class AbstractBearerTokenService<E extends Env = Env> extends BaseService {
     /** Standard JWT fields that are never encrypted. */
@@ -12,6 +11,8 @@ export declare abstract class AbstractBearerTokenService<E extends Env = Env> ex
     protected aes: IPayloadCipher | null;
     protected applicationSecret: string | null;
     protected fieldCodecs: Map<string, IPayloadFieldCodec>;
+    /** Configured `iss` / `aud`. Authoritative over anything the payload carries. */
+    protected signOptions: IJWTSignOptions | null;
     /** Configures AES payload encryption and field codecs. Both aesAlgorithm and applicationSecret required to activate encryption. */
     protected configurePayloadEncryption(opts: {
         aesAlgorithm?: AESAlgorithmType;
@@ -19,6 +20,7 @@ export declare abstract class AbstractBearerTokenService<E extends Env = Env> ex
         fieldCodecs?: IPayloadFieldCodec[];
         /** Overrides the cipher. Pass `LegacyAES` to keep reading tokens issued before the PBKDF2 envelope; `aesAlgorithm` is then the cipher's own concern and is ignored here. */
         cipher?: IPayloadCipher;
+        sign?: IJWTSignOptions;
     }): void;
     extractCredentials(context: TContext<E, string>): {
         type: string;
@@ -31,6 +33,8 @@ export declare abstract class AbstractBearerTokenService<E extends Env = Env> ex
     generate(opts: {
         payload: IJWTTokenPayload;
         getTokenExpiresFn?: TGetTokenExpiresFn;
+        /** Per-token registered claims. The supported way to vary `aud` / `sub`; the payload is not. */
+        claims?: IJWTIssueClaims;
     }): Promise<string>;
     protected serializeField(opts: {
         key: string;
@@ -41,6 +45,22 @@ export declare abstract class AbstractBearerTokenService<E extends Env = Env> ex
         key: string;
         value: string;
     }): any;
+    /**
+     * Stamps the configured `iss` / `aud` onto a signer, plus any per-token claims the caller passed.
+     *
+     * The configured value is AUTHORITATIVE. `iss` and `aud` are in `JWT_COMMON_FIELDS`, so they ride
+     * through the AES envelope in the clear and an application-shaped payload can carry them - an
+     * issuer identity any payload could overwrite would not be an identity. A conflicting payload
+     * claim is overwritten and reported.
+     *
+     * Per-token audience is an explicit argument rather than a smuggled payload key, so the caller
+     * that legitimately needs one says so.
+     */
+    protected applySignClaims(opts: {
+        signer: SignJWT;
+        payload: Record<string, any>;
+        claims?: IJWTIssueClaims;
+    }): SignJWT;
     decryptPayload(opts: {
         result: JWTVerifyResult<IJWTTokenPayload>;
     }): IJWTTokenPayload;
@@ -48,6 +68,7 @@ export declare abstract class AbstractBearerTokenService<E extends Env = Env> ex
     abstract getSigner(opts: {
         payload: IJWTTokenPayload;
         getTokenExpiresFn: TGetTokenExpiresFn;
+        claims?: IJWTIssueClaims;
     }): Promise<SignJWT>;
     protected abstract getSigningKey(): ValueOrPromise<Uint8Array | CryptoKey>;
     protected abstract getDefaultTokenExpiresFn(): TGetTokenExpiresFn;

package/dist/components/auth/authenticate/services/bearer/abstract.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abstract.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/abstract.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAI/E,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACjE,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAG/B,gGAAgG;AAChG,8BAAsB,0BAA0B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,WAAW;IACvF,oDAAoD;IACpD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,wBAQ9B;IAEH,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAQ;IAC5C,SAAS,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAQ;IAClD,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAa;IAEnE,mIAAmI;IACnI,SAAS,CAAC,0BAA0B,CAAC,IAAI,EAAE;QACzC,YAAY,CAAC,EAAE,gBAAgB,CAAC;QAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;QACnC,4KAA4K;QAC5K,MAAM,CAAC,EAAE,cAAc,CAAC;KACzB,GAAG,IAAI;IAiBR,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IA8B3E,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuBxE,QAAQ,CAAC,IAAI,EAAE;QACnB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;KACxC,GAAG,OAAO,CAAC,MAAM,CAAC;IAwBnB,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,MAAM;IAWnE,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAqC9D,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAW/D,cAAc,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAA;KAAE,GAAG,gBAAgB;IAiCrF,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAErE,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;KACvC,GAAG,OAAO,CAAC,OAAO,CAAC;IAEpB,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;IAE1E,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,kBAAkB;CAClE"}
+{"version":3,"file":"abstract.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/abstract.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAGpE,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,QAAQ,EACR,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAwC,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEjE,gGAAgG;AAChG,8BAAsB,0BAA0B,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,WAAW;IACvF,oDAAoD;IACpD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,wBAQ9B;IAEH,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,IAAI,CAAQ;IAC5C,SAAS,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAQ;IAClD,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAa;IAEnE,iFAAiF;IACjF,SAAS,CAAC,WAAW,EAAE,eAAe,GAAG,IAAI,CAAQ;IAErD,mIAAmI;IACnI,SAAS,CAAC,0BAA0B,CAAC,IAAI,EAAE;QACzC,YAAY,CAAC,EAAE,gBAAgB,CAAC;QAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,kBAAkB,EAAE,CAAC;QACnC,4KAA4K;QAC5K,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,IAAI,CAAC,EAAE,eAAe,CAAC;KACxB,GAAG,IAAI;IAmBR,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IA8B3E,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuBxE,QAAQ,CAAC,IAAI,EAAE;QACnB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;QACvC,gGAAgG;QAChG,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B,GAAG,OAAO,CAAC,MAAM,CAAC;IAwBnB,SAAS,CAAC,cAAc,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,MAAM;IAWnE,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;IAqC9D,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE;IAW/D;;;;;;;;;;OAUG;IACH,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE;QAC9B,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B,GAAG,OAAO;IAwCX,cAAc,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAA;KAAE,GAAG,gBAAgB;IAiCrF,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAErE,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE;QACvB,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B,GAAG,OAAO,CAAC,OAAO,CAAC;IAEpB,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;IAE1E,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,kBAAkB;CAClE"}