@venizia/ignis 0.2.0-2 → 0.2.0-20

package/dist/components/auth/authenticate/component.js

@@ -14,15 +14,15 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 var AuthenticateComponent_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthenticateComponent = void 0;
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const ignis_kernel_2 = require("@venizia/ignis-kernel");
-const ignis_kernel_3 = require("@venizia/ignis-kernel");
-const ignis_kernel_4 = require("@venizia/ignis-kernel");
 const core_1 = require("@venizia/ignis-helpers/core");
 const ignis_inversion_1 = require("@venizia/ignis-inversion");
-const ignis_kernel_5 = require("@venizia/ignis-kernel");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
 const controllers_1 = require("./controllers");
+const service_certs_1 = require("./controllers/service-certs");
 const services_1 = require("./services");
+const signer_service_1 = require("./services/service/signer.service");
+const verifier_service_1 = require("./services/service/verifier.service");
+const service_strategy_1 = require("./strategies/service.strategy");
 const DEFAULT_SECRET = 'unknown_secret';
 let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponent extends ignis_kernel_1.BaseComponent {
     constructor(application) {
@@ -30,8 +30,8 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
             scope: AuthenticateComponent_1.name,
             initDefault: { enable: true, container: application },
             bindings: {
-                [ignis_kernel_5.AuthenticateBindingKeys.REST_OPTIONS]: ignis_inversion_1.Binding.bind({
-                    key: ignis_kernel_5.AuthenticateBindingKeys.REST_OPTIONS,
+                [ignis_kernel_1.AuthenticateBindingKeys.REST_OPTIONS]: ignis_inversion_1.Binding.bind({
+                    key: ignis_kernel_1.AuthenticateBindingKeys.REST_OPTIONS,
                 }).toValue({ useAuthController: false }),
             },
         });
@@ -39,30 +39,36 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
     }
     binding() {
         const jwtOptions = this.application.get({
-            key: ignis_kernel_5.AuthenticateBindingKeys.JWT_OPTIONS,
+            key: ignis_kernel_1.AuthenticateBindingKeys.JWT_OPTIONS,
             isOptional: true,
         });
         const basicOptions = this.application.get({
-            key: ignis_kernel_5.AuthenticateBindingKeys.BASIC_OPTIONS,
+            key: ignis_kernel_1.AuthenticateBindingKeys.BASIC_OPTIONS,
             isOptional: true,
         });
         const restOptions = this.application.get({
-            key: ignis_kernel_5.AuthenticateBindingKeys.REST_OPTIONS,
+            key: ignis_kernel_1.AuthenticateBindingKeys.REST_OPTIONS,
+            isOptional: true,
+        });
+        const serviceOptions = this.application.get({
+            key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_OPTIONS,
             isOptional: true,
         });
-        if (!jwtOptions && !basicOptions) {
+        // A service that only VERIFIES assertions needs neither jwt nor basic - and that application,
+        // an IGNIS app consuming no user tokens at all, is exactly what the service strategy is for.
+        if (!jwtOptions && !basicOptions && !serviceOptions) {
             throw (0, core_1.getError)({
-                message: '[AuthenticateComponent] At least one of jwtOptions or basicOptions must be provided',
+                message: '[AuthenticateComponent] At least one of jwtOptions, basicOptions or serviceOptions must be provided',
             });
         }
-        const options = { restOptions, jwtOptions, basicOptions };
+        const options = { restOptions, jwtOptions, basicOptions, serviceOptions };
         if (jwtOptions) {
             switch (jwtOptions.standard) {
-                case ignis_kernel_5.JOSEStandards.JWS: {
+                case ignis_kernel_1.JOSEStandards.JWS: {
                     this.defineJWSAuth({ options: jwtOptions.options });
                     break;
                 }
-                case ignis_kernel_5.JOSEStandards.JWKS: {
+                case ignis_kernel_1.JOSEStandards.JWKS: {
                     this.defineJWKSAuth({ options: jwtOptions.options });
                     break;
                 }
@@ -74,6 +80,7 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
             }
         }
         this.defineBasicAuth({ basicOptions });
+        this.defineServiceAuth({ serviceOptions });
         this.defineControllers({ options });
         this.defineOAuth2();
     }
@@ -91,7 +98,7 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
             });
         }
         this.application
-            .bind({ key: ignis_kernel_5.AuthenticateBindingKeys.JWT_OPTIONS })
+            .bind({ key: ignis_kernel_1.AuthenticateBindingKeys.JWT_OPTIONS })
             .toValue(jwsOptions);
         this.application.service(services_1.JWSTokenService);
         this.logger.for(this.defineJWSAuth.name).info('JWS authentication configured');
@@ -99,16 +106,16 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
     defineJWKSAuth(opts) {
         const { options: jwksOptions } = opts;
         switch (jwksOptions.mode) {
-            case ignis_kernel_5.JWKSModes.ISSUER: {
+            case ignis_kernel_1.JWKSModes.ISSUER: {
                 const issuerOpts = jwksOptions;
                 if (!issuerOpts.keys?.private || !issuerOpts.keys?.public) {
                     throw (0, core_1.getError)({
                         message: '[defineJWKSAuth] keys.private and keys.public are required for issuer mode',
                     });
                 }
-                if (!issuerOpts.keys?.format || !ignis_kernel_5.JWKSKeyFormats.isValid(issuerOpts.keys.format)) {
+                if (!issuerOpts.keys?.format || !ignis_kernel_1.JWKSKeyFormats.isValid(issuerOpts.keys.format)) {
                     throw (0, core_1.getError)({
-                        message: `[defineJWKSAuth] keys.format is required and must be one of: ${[...ignis_kernel_5.JWKSKeyFormats.SCHEME_SET].join(', ')}`,
+                        message: `[defineJWKSAuth] keys.format is required and must be one of: ${[...ignis_kernel_1.JWKSKeyFormats.SCHEME_SET].join(', ')}`,
                     });
                 }
                 if (!issuerOpts.kid) {
@@ -120,24 +127,24 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
                     });
                 }
                 this.application
-                    .bind({ key: ignis_kernel_5.AuthenticateBindingKeys.JWKS_OPTIONS })
+                    .bind({ key: ignis_kernel_1.AuthenticateBindingKeys.JWKS_OPTIONS })
                     .toValue(issuerOpts);
                 this.application.service(services_1.JWKSIssuerTokenService);
                 // Path depends on a runtime option, so @controller can't be applied statically — decorate here instead.
-                Reflect.decorate([(0, ignis_kernel_3.controller)({ path: issuerOpts?.rest?.path ?? '/certs' })], controllers_1.JWKSController);
+                Reflect.decorate([(0, ignis_kernel_1.controller)({ path: issuerOpts?.rest?.path ?? '/certs' })], controllers_1.JWKSController);
                 this.application.controller(controllers_1.JWKSController);
                 this.logger
                     .for(this.defineJWKSAuth.name)
                     .info('JWKS issuer configured with /certs endpoint');
                 break;
             }
-            case ignis_kernel_5.JWKSModes.VERIFIER: {
+            case ignis_kernel_1.JWKSModes.VERIFIER: {
                 const verifierOpts = jwksOptions;
                 if (!verifierOpts.jwksUrl) {
                     throw (0, core_1.getError)({ message: '[defineJWKSAuth] jwksUrl is required for verifier mode' });
                 }
                 this.application
-                    .bind({ key: ignis_kernel_5.AuthenticateBindingKeys.JWKS_OPTIONS })
+                    .bind({ key: ignis_kernel_1.AuthenticateBindingKeys.JWKS_OPTIONS })
                     .toValue(verifierOpts);
                 this.application.service(services_1.JWKSVerifierTokenService);
                 this.logger.for(this.defineJWKSAuth.name).info('JWKS verifier configured');
@@ -151,6 +158,53 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
             }
         }
     }
+    /**
+     * Service-to-service authentication. Absent options mean no strategy is registered and no route is
+     * mounted, so an application that never sets them is byte-identical to today.
+     *
+     * The certs route is mounted only when SIGNING keys are present. Most services are called and
+     * never call; publishing a key set for a service that signs nothing advertises a capability it
+     * does not have.
+     */
+    defineServiceAuth(opts) {
+        const { serviceOptions } = opts;
+        if (!serviceOptions) {
+            this.logger
+                .for(this.defineServiceAuth.name)
+                .debug('serviceOptions not provided, skipping service authentication');
+            return;
+        }
+        if (!serviceOptions.name) {
+            throw (0, core_1.getError)({
+                message: '[defineServiceAuth] name is required | it is the issuer this service stamps and the audience it demands',
+            });
+        }
+        if (!serviceOptions.resolvePrincipal) {
+            throw (0, core_1.getError)({
+                message: '[defineServiceAuth] resolvePrincipal is required | the framework proves WHICH SERVICE called, the application decides who that acts as',
+            });
+        }
+        this.application.service(verifier_service_1.ServiceAssertionVerifierService);
+        if (serviceOptions.keys) {
+            this.application.service(signer_service_1.ServiceAssertionSignerService);
+            const restPath = serviceOptions.rest?.path ?? ignis_kernel_1.ServiceAssertion.DEFAULT_REST_PATH;
+            this.application
+                .bind({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_CERTS_PATH })
+                .toValue(restPath);
+            // Path depends on a runtime option, so @controller cannot be applied statically.
+            Reflect.decorate([(0, ignis_kernel_1.controller)({ path: restPath })], service_certs_1.ServiceCertsController);
+            this.application.controller(service_certs_1.ServiceCertsController);
+        }
+        ignis_kernel_1.AuthenticationStrategyRegistry.getInstance().register({
+            container: this.application,
+            strategies: [
+                { name: ignis_kernel_1.Authentication.STRATEGY_SERVICE, strategy: service_strategy_1.ServiceAuthenticationStrategy },
+            ],
+        });
+        this.logger
+            .for(this.defineServiceAuth.name)
+            .info('Service authentication configured | name: %s | signs: %s | callers: %s', serviceOptions.name, Boolean(serviceOptions.keys), Object.keys(serviceOptions.callers ?? {}).join(', ') || 'none');
+    }
     defineBasicAuth(opts) {
         const { basicOptions } = opts;
         if (!basicOptions) {
@@ -165,7 +219,7 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
             });
         }
         this.application
-            .bind({ key: ignis_kernel_5.AuthenticateBindingKeys.BASIC_OPTIONS })
+            .bind({ key: ignis_kernel_1.AuthenticateBindingKeys.BASIC_OPTIONS })
             .toValue(basicOptions);
         this.application.service(services_1.BasicTokenService);
         this.logger.for(this.defineBasicAuth.name).info('Basic authentication configured');
@@ -191,7 +245,7 @@ let AuthenticateComponent = AuthenticateComponent_1 = class AuthenticateComponen
 };
 exports.AuthenticateComponent = AuthenticateComponent;
 exports.AuthenticateComponent = AuthenticateComponent = AuthenticateComponent_1 = __decorate([
-    __param(0, (0, ignis_kernel_2.inject)({ key: ignis_kernel_4.CoreBindings.APPLICATION_INSTANCE })),
+    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.CoreBindings.APPLICATION_INSTANCE })),
     __metadata("design:paramtypes", [Function])
 ], AuthenticateComponent);
 //# sourceMappingURL=component.js.map

package/dist/components/auth/authenticate/component.js.map

@@ -1 +1 @@
-{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../../src/components/auth/authenticate/component.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AACA,wDAAsD;AACtD,wDAA+C;AAC/C,wDAAmD;AACnD,wDAAqD;AACrD,sDAAuD;AAEvD,8DAAmD;AACnD,wDAa+B;AAC/B,+CAAqE;AACrE,yCAKoB;AAEpB,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,IAAa,qBAAqB,6BAAlC,MAAa,qBAAsB,SAAQ,4BAAa;IACtD,YAC8D,WAA4B;QAExF,KAAK,CAAC;YACJ,KAAK,EAAE,uBAAqB,CAAC,IAAI;YACjC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;YACrD,QAAQ,EAAE;gBACR,CAAC,sCAAuB,CAAC,YAAY,CAAC,EAAE,yBAAO,CAAC,IAAI,CAA6B;oBAC/E,GAAG,EAAE,sCAAuB,CAAC,YAAY;iBAC1C,CAAC,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;aACzC;SACF,CAAC,CAAC;QAVyD,gBAAW,GAAX,WAAW,CAAiB;IAW1F,CAAC;IAEQ,OAAO;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA0B;YAC/D,GAAG,EAAE,sCAAuB,CAAC,WAAW;YACxC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA4B;YACnE,GAAG,EAAE,sCAAuB,CAAC,aAAa;YAC1C,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA6B;YACnE,GAAG,EAAE,sCAAuB,CAAC,YAAY;YACzC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;YACjC,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,qFAAqF;aACxF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;QAEhF,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC5B,KAAK,4BAAa,CAAC,GAAG,CAAC,CAAC,CAAC;oBACvB,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBACpD,MAAM;gBACR,CAAC;gBACD,KAAK,4BAAa,CAAC,IAAI,CAAC,CAAC,CAAC;oBACxB,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBACrD,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,kDAAmD,UAAkB,CAAC,QAAQ,EAAE;qBAC1F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvC,IAAI,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpC,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,aAAa,CAAC,IAA0C;QAC9D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAErC,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,UAAU,CAAC;QAEpD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YAC/C,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,iDAAiD,SAAS,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAA0B,EAAE,GAAG,EAAE,sCAAuB,CAAC,WAAW,EAAE,CAAC;aAC3E,OAAO,CAAC,UAAU,CAAC,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAe,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjF,CAAC;IAEO,cAAc,CAAC,IAA2C;QAChE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QAEtC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,wBAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,WAAW,CAAC;gBAE/B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAC1D,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,4EAA4E;qBACtF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,6BAAc,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChF,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,gEAAgE,CAAC,GAAG,6BAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACrH,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;oBACpB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;gBAClF,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;oBAClC,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,gEAAgE;qBAC1E,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,WAAW;qBACb,IAAI,CAAqB,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC;qBACvE,OAAO,CAAC,UAAU,CAAC,CAAC;gBACvB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,iCAAsB,CAAC,CAAC;gBAEjD,wGAAwG;gBACxG,OAAO,CAAC,QAAQ,CACd,CAAC,IAAA,yBAAU,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,EAC1D,4BAAc,CACf,CAAC;gBACF,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,4BAAc,CAAC,CAAC;gBAE5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;qBAC7B,IAAI,CAAC,6CAA6C,CAAC,CAAC;gBACvD,MAAM;YACR,CAAC;YAED,KAAK,wBAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxB,MAAM,YAAY,GAAG,WAAW,CAAC;gBAEjC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;gBACxF,CAAC;gBAED,IAAI,CAAC,WAAW;qBACb,IAAI,CAAuB,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC;qBACzE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,mCAAwB,CAAC,CAAC;gBAEnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBAC3E,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,wFAAwF;gBACxF,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,uCAAwC,WAAkC,CAAC,IAAI,EAAE;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,IAAkD;QACxE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QAE9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;iBAC9B,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAA4B,EAAE,GAAG,EAAE,sCAAuB,CAAC,aAAa,EAAE,CAAC;aAC/E,OAAO,CAAC,YAAY,CAAC,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,4BAAiB,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACrF,CAAC;IAEO,iBAAiB,CAAC,IAAuC;QAC/D,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEjD,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,kCAAoB,EAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC;IAED,YAAY;QACV,wBAAwB;IAC1B,CAAC;CACF,CAAA;AA/MY,sDAAqB;gCAArB,qBAAqB;IAE7B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,2BAAY,CAAC,oBAAoB,EAAE,CAAC,CAAA;;GAF1C,qBAAqB,CA+MjC"}
+{"version":3,"file":"component.js","sourceRoot":"","sources":["../../../../src/components/auth/authenticate/component.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAEA,sDAAuD;AACvD,8DAAmD;AACnD,wDAqB+B;AAC/B,+CAAqE;AACrE,+DAAqE;AACrE,yCAKoB;AACpB,sEAAkF;AAClF,0EAAsF;AACtF,oEAA8E;AAE9E,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,IAAa,qBAAqB,6BAAlC,MAAa,qBAAsB,SAAQ,4BAAa;IACtD,YAC8D,WAA4B;QAExF,KAAK,CAAC;YACJ,KAAK,EAAE,uBAAqB,CAAC,IAAI;YACjC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;YACrD,QAAQ,EAAE;gBACR,CAAC,sCAAuB,CAAC,YAAY,CAAC,EAAE,yBAAO,CAAC,IAAI,CAA6B;oBAC/E,GAAG,EAAE,sCAAuB,CAAC,YAAY;iBAC1C,CAAC,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;aACzC;SACF,CAAC,CAAC;QAVyD,gBAAW,GAAX,WAAW,CAAiB;IAW1F,CAAC;IAEQ,OAAO;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA0B;YAC/D,GAAG,EAAE,sCAAuB,CAAC,WAAW;YACxC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA4B;YACnE,GAAG,EAAE,sCAAuB,CAAC,aAAa;YAC1C,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAA6B;YACnE,GAAG,EAAE,sCAAuB,CAAC,YAAY;YACzC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAsB;YAC/D,GAAG,EAAE,sCAAuB,CAAC,eAAe;YAC5C,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,8FAA8F;QAC9F,6FAA6F;QAC7F,IAAI,CAAC,UAAU,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,qGAAqG;aACxG,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;QAEhG,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC5B,KAAK,4BAAa,CAAC,GAAG,CAAC,CAAC,CAAC;oBACvB,IAAI,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBACpD,MAAM;gBACR,CAAC;gBACD,KAAK,4BAAa,CAAC,IAAI,CAAC,CAAC,CAAC;oBACxB,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;oBACrD,MAAM;gBACR,CAAC;gBACD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,kDAAmD,UAAkB,CAAC,QAAQ,EAAE;qBAC1F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAE3C,IAAI,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAEpC,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAEO,aAAa,CAAC,IAA0C;QAC9D,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAErC,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,UAAU,CAAC;QAEpD,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YAC/C,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,iDAAiD,SAAS,EAAE;aACtE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAA0B,EAAE,GAAG,EAAE,sCAAuB,CAAC,WAAW,EAAE,CAAC;aAC3E,OAAO,CAAC,UAAU,CAAC,CAAC;QACvB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAe,CAAC,CAAC;QAE1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjF,CAAC;IAEO,cAAc,CAAC,IAA2C;QAChE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QAEtC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,wBAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtB,MAAM,UAAU,GAAG,WAAW,CAAC;gBAE/B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAC1D,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,4EAA4E;qBACtF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,6BAAc,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChF,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,gEAAgE,CAAC,GAAG,6BAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACrH,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC;oBACpB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;gBAClF,CAAC;gBAED,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;oBAClC,MAAM,IAAA,eAAQ,EAAC;wBACb,OAAO,EAAE,gEAAgE;qBAC1E,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,WAAW;qBACb,IAAI,CAAqB,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC;qBACvE,OAAO,CAAC,UAAU,CAAC,CAAC;gBACvB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,iCAAsB,CAAC,CAAC;gBAEjD,wGAAwG;gBACxG,OAAO,CAAC,QAAQ,CACd,CAAC,IAAA,yBAAU,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,EAC1D,4BAAc,CACf,CAAC;gBACF,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,4BAAc,CAAC,CAAC;gBAE5C,IAAI,CAAC,MAAM;qBACR,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;qBAC7B,IAAI,CAAC,6CAA6C,CAAC,CAAC;gBACvD,MAAM;YACR,CAAC;YAED,KAAK,wBAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxB,MAAM,YAAY,GAAG,WAAW,CAAC;gBAEjC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;gBACxF,CAAC;gBAED,IAAI,CAAC,WAAW;qBACb,IAAI,CAAuB,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC;qBACzE,OAAO,CAAC,YAAY,CAAC,CAAC;gBACzB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,mCAAwB,CAAC,CAAC;gBAEnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBAC3E,MAAM;YACR,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,wFAAwF;gBACxF,MAAM,IAAA,eAAQ,EAAC;oBACb,OAAO,EAAE,uCAAwC,WAAkC,CAAC,IAAI,EAAE;iBAC3F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,iBAAiB,CAAC,IAA8C;QACtE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QAEhC,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;iBAChC,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,yGAAyG;aAC5G,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,gBAAgB,EAAE,CAAC;YACrC,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EACL,wIAAwI;aAC3I,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,kDAA+B,CAAC,CAAC;QAE1D,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,8CAA6B,CAAC,CAAC;YAExD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,IAAI,+BAAgB,CAAC,iBAAiB,CAAC;YACjF,IAAI,CAAC,WAAW;iBACb,IAAI,CAAS,EAAE,GAAG,EAAE,sCAAuB,CAAC,kBAAkB,EAAE,CAAC;iBACjE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAErB,iFAAiF;YACjF,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAA,yBAAU,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,sCAAsB,CAAC,CAAC;YAC3E,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,sCAAsB,CAAC,CAAC;QACtD,CAAC;QAED,6CAA8B,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACpD,SAAS,EAAE,IAAI,CAAC,WAAW;YAC3B,UAAU,EAAE;gBACV,EAAE,IAAI,EAAE,6BAAc,CAAC,gBAAgB,EAAE,QAAQ,EAAE,gDAA6B,EAAE;aACnF;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;aAChC,IAAI,CACH,wEAAwE,EACxE,cAAc,CAAC,IAAI,EACnB,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,EAC5B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAC/D,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,IAAkD;QACxE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;QAE9B,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;iBAC9B,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;YACpC,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0DAA0D;aACpE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,WAAW;aACb,IAAI,CAA4B,EAAE,GAAG,EAAE,sCAAuB,CAAC,aAAa,EAAE,CAAC;aAC/E,OAAO,CAAC,YAAY,CAAC,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,4BAAiB,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IACrF,CAAC;IAEO,iBAAiB,CAAC,IAAuC;QAC/D,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEjD,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAA,eAAQ,EAAC;gBACb,OAAO,EAAE,0EAA0E;aACpF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,kCAAoB,EAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAClF,CAAC;IAED,YAAY;QACV,wBAAwB;IAC1B,CAAC;CACF,CAAA;AAtRY,sDAAqB;gCAArB,qBAAqB;IAE7B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,2BAAY,CAAC,oBAAoB,EAAE,CAAC,CAAA;;GAF1C,qBAAqB,CAsRjC"}

package/dist/components/auth/authenticate/controllers/factory.d.ts

@@ -21,6 +21,33 @@ export declare const defineAuthController: (opts: TDefineAuthControllerOpts) =>
             args: unknown;
             task: () => Promise<R>;
         }): Promise<any>;
+        normalizeCountData<ResponseSchema extends unknown, RequestContext extends import("@venizia/ignis-kernel").TRouteContext<import("hono").Env> = import("@venizia/ignis-kernel").TRouteContext<import("hono").Env>, ResponseData extends {
+            count: number;
+            data?: import("@venizia/ignis-helpers/common").TNullable<ResponseSchema>;
+        } = {
+            count: number;
+            data?: import("@venizia/ignis-helpers/common").TNullable<ResponseSchema>;
+        }>(opts: {
+            context: RequestContext;
+            payload: ResponseData;
+        }): ResponseData | import("@venizia/ignis-helpers/common").TNullable<ResponseSchema>;
+        respond<R>(opts: {
+            context: import("@venizia/ignis-kernel").TRouteContext<import("hono").Env>;
+            format: import("@venizia/ignis-kernel").TResponseFormat;
+            payload: {
+                count: number;
+                data?: import("@venizia/ignis-helpers/common").TNullable<R>;
+            };
+            range?: import("@venizia/ignis-kernel").TDataRange;
+        }): import("@venizia/ignis-helpers/common").TNullable<R> | {
+            count: number;
+            data?: import("@venizia/ignis-helpers/common").TNullable<R>;
+        };
+        setListHeaders(opts: {
+            context: import("@venizia/ignis-kernel").TRouteContext<import("hono").Env>;
+            range: import("@venizia/ignis-kernel").TDataRange;
+            count: number;
+        }): void;
         toHonoHandler<ResponseType = unknown>(opts: {
             handler: import("@venizia/ignis-kernel").TRouteHandler<ResponseType, import("hono").Env>;
         }): import("hono").Handler<import("hono").Env, string, import("hono").Input, (Response | Promise<Response>) | (import("@hono/zod-openapi").RouteConfigToTypedResponse<import("@hono/zod-openapi").RouteConfig> | Promise<import("@hono/zod-openapi").RouteConfigToTypedResponse<import("@hono/zod-openapi").RouteConfig>>)>;
@@ -58,12 +85,12 @@ export declare const defineAuthController: (opts: TDefineAuthControllerOpts) =>
         getRouteConfigs<RouteConfig extends import("@venizia/ignis-kernel").IAuthRouteConfig>(opts: {
             configs: RouteConfig;
         }): RouteConfig & {
-            getRoutingPath(): RouteConfig["path"] extends infer T ? T extends RouteConfig["path"] ? T extends `${infer Head}/{${infer Param}}${infer Tail}` ? `${Head}/:${Param}${Tail extends `${infer Head_1}/{${infer Param_1}}${infer Tail_1}` ? `${Head_1}/:${Param_1}${Tail_1 extends `${infer Head_2}/{${infer Param_2}}${infer Tail_2}` ? `${Head_2}/:${Param_2}${Tail_2 extends `${infer Head_3}/{${infer Param_3}}${infer Tail_3}` ? `${Head_3}/:${Param_3}${Tail_3 extends `${infer Head_4}/{${infer Param_4}}${infer Tail_4}` ? `${Head_4}/:${Param_4}${Tail_4 extends `${infer Head_5}/{${infer Param_5}}${infer Tail_5}` ? `${Head_5}/:${Param_5}${Tail_5 extends `${infer Head_6}/{${infer Param_6}}${infer Tail_6}` ? `${Head_6}/:${Param_6}${Tail_6 extends `${infer Head_7}/{${infer Param_7}}${infer Tail_7}` ? `${Head_7}/:${Param_7}${Tail_7 extends `${infer Head_8}/{${infer Param_8}}${infer Tail_8}` ? `${Head_8}/:${Param_8}${Tail_8 extends `${infer Head_9}/{${infer Param_9}}${infer Tail_9}` ? `${Head_9}/:${Param_9}${Tail_9 extends `${infer Head_10}/{${infer Param_10}}${infer Tail_10}` ? `${Head_10}/:${Param_10}${any}` : Tail_9}` : Tail_8}` : Tail_7}` : Tail_6}` : Tail_5}` : Tail_4}` : Tail_3}` : Tail_2}` : Tail_1}` : Tail}` : T : never : never;
+            getRoutingPath(): RouteConfig["path"] extends infer T ? T extends RouteConfig["path"] ? T extends `${infer Start}/{${infer Param}}${infer Rest}` ? `${Start}/:${Param}${Rest extends `${infer Start_1}/{${infer Param_1}}${infer Rest_1}` ? `${Start_1}/:${Param_1}${Rest_1 extends `${infer Start_2}/{${infer Param_2}}${infer Rest_2}` ? `${Start_2}/:${Param_2}${Rest_2 extends `${infer Start_3}/{${infer Param_3}}${infer Rest_3}` ? `${Start_3}/:${Param_3}${Rest_3 extends `${infer Start_4}/{${infer Param_4}}${infer Rest_4}` ? `${Start_4}/:${Param_4}${Rest_4 extends `${infer Start_5}/{${infer Param_5}}${infer Rest_5}` ? `${Start_5}/:${Param_5}${Rest_5 extends `${infer Start_6}/{${infer Param_6}}${infer Rest_6}` ? `${Start_6}/:${Param_6}${Rest_6 extends `${infer Start_7}/{${infer Param_7}}${infer Rest_7}` ? `${Start_7}/:${Param_7}${Rest_7 extends `${infer Start_8}/{${infer Param_8}}${infer Rest_8}` ? `${Start_8}/:${Param_8}${Rest_8 extends `${infer Start_9}/{${infer Param_9}}${infer Rest_9}` ? `${Start_9}/:${Param_9}${Rest_9 extends `${infer Start_10}/{${infer Param_10}}${infer Rest_10}` ? `${Start_10}/:${Param_10}${any}` : Rest_9}` : Rest_8}` : Rest_7}` : Rest_6}` : Rest_5}` : Rest_4}` : Rest_3}` : Rest_2}` : Rest_1}` : Rest}` : T : never : never;
         };
         getJSXRouteConfigs<RouteConfig extends import("@venizia/ignis-kernel").IAuthRouteConfig>(opts: {
             configs: RouteConfig;
         }): RouteConfig & {
-            getRoutingPath(): RouteConfig["path"] extends infer T ? T extends RouteConfig["path"] ? T extends `${infer Head}/{${infer Param}}${infer Tail}` ? `${Head}/:${Param}${Tail extends `${infer Head_1}/{${infer Param_1}}${infer Tail_1}` ? `${Head_1}/:${Param_1}${Tail_1 extends `${infer Head_2}/{${infer Param_2}}${infer Tail_2}` ? `${Head_2}/:${Param_2}${Tail_2 extends `${infer Head_3}/{${infer Param_3}}${infer Tail_3}` ? `${Head_3}/:${Param_3}${Tail_3 extends `${infer Head_4}/{${infer Param_4}}${infer Tail_4}` ? `${Head_4}/:${Param_4}${Tail_4 extends `${infer Head_5}/{${infer Param_5}}${infer Tail_5}` ? `${Head_5}/:${Param_5}${Tail_5 extends `${infer Head_6}/{${infer Param_6}}${infer Tail_6}` ? `${Head_6}/:${Param_6}${Tail_6 extends `${infer Head_7}/{${infer Param_7}}${infer Tail_7}` ? `${Head_7}/:${Param_7}${Tail_7 extends `${infer Head_8}/{${infer Param_8}}${infer Tail_8}` ? `${Head_8}/:${Param_8}${Tail_8 extends `${infer Head_9}/{${infer Param_9}}${infer Tail_9}` ? `${Head_9}/:${Param_9}${Tail_9 extends `${infer Head_10}/{${infer Param_10}}${infer Tail_10}` ? `${Head_10}/:${Param_10}${any}` : Tail_9}` : Tail_8}` : Tail_7}` : Tail_6}` : Tail_5}` : Tail_4}` : Tail_3}` : Tail_2}` : Tail_1}` : Tail}` : T : never : never;
+            getRoutingPath(): RouteConfig["path"] extends infer T ? T extends RouteConfig["path"] ? T extends `${infer Start}/{${infer Param}}${infer Rest}` ? `${Start}/:${Param}${Rest extends `${infer Start_1}/{${infer Param_1}}${infer Rest_1}` ? `${Start_1}/:${Param_1}${Rest_1 extends `${infer Start_2}/{${infer Param_2}}${infer Rest_2}` ? `${Start_2}/:${Param_2}${Rest_2 extends `${infer Start_3}/{${infer Param_3}}${infer Rest_3}` ? `${Start_3}/:${Param_3}${Rest_3 extends `${infer Start_4}/{${infer Param_4}}${infer Rest_4}` ? `${Start_4}/:${Param_4}${Rest_4 extends `${infer Start_5}/{${infer Param_5}}${infer Rest_5}` ? `${Start_5}/:${Param_5}${Rest_5 extends `${infer Start_6}/{${infer Param_6}}${infer Rest_6}` ? `${Start_6}/:${Param_6}${Rest_6 extends `${infer Start_7}/{${infer Param_7}}${infer Rest_7}` ? `${Start_7}/:${Param_7}${Rest_7 extends `${infer Start_8}/{${infer Param_8}}${infer Rest_8}` ? `${Start_8}/:${Param_8}${Rest_8 extends `${infer Start_9}/{${infer Param_9}}${infer Rest_9}` ? `${Start_9}/:${Param_9}${Rest_9 extends `${infer Start_10}/{${infer Param_10}}${infer Rest_10}` ? `${Start_10}/:${Param_10}${any}` : Rest_9}` : Rest_8}` : Rest_7}` : Rest_6}` : Rest_5}` : Rest_4}` : Rest_3}` : Rest_2}` : Rest_1}` : Rest}` : T : never : never;
         };
         scope: string;
         identifier: string;

package/dist/components/auth/authenticate/controllers/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/controllers/factory.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC,OAAO,EAAQ,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,EAAkB,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAEhG,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAYhC,CAAC;AAEH,eAAO,MAAM,oBAAoB,GAAI,MAAM,yBAAyB;sBAOvC,YAAY;iBAF5B,YAAY;mBAmBD,cAAc,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAflC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0MV,CAAC"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/controllers/factory.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC,OAAO,EAAQ,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAMrE,OAAO,EAAkB,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAEhG,eAAO,MAAM,qBAAqB;;;;;;;;;;iBAYhC,CAAC;AAEH,eAAO,MAAM,oBAAoB,GAAI,MAAM,yBAAyB;sBAOvC,YAAY;iBAF5B,YAAY;mBAmBD,cAAc,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAflC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0MV,CAAC"}

package/dist/components/auth/authenticate/controllers/index.d.ts

@@ -1,3 +1,4 @@
 export * from './factory';
 export * from './jwks';
+export * from './service-certs';
 //# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/controllers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/controllers/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/controllers/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,QAAQ,CAAC;AACvB,cAAc,iBAAiB,CAAC"}

package/dist/components/auth/authenticate/controllers/index.js

@@ -16,4 +16,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./factory"), exports);
 __exportStar(require("./jwks"), exports);
+__exportStar(require("./service-certs"), exports);
 //# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/controllers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/controllers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,yCAAuB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/controllers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,yCAAuB;AACvB,kDAAgC"}

package/dist/components/auth/authenticate/controllers/service-certs/controller.d.ts

@@ -0,0 +1,10 @@
+import { BaseRestController } from '@venizia/ignis-kernel';
+import { ValueOrPromise } from '@venizia/ignis-helpers/common';
+import { ServiceAssertionSignerService } from '../../services/service/signer.service';
+/** Publishes this service's assertion-signing public key. Mounted only when signing keys are configured. */
+export declare class ServiceCertsController extends BaseRestController {
+    private readonly signer;
+    constructor(signer: ServiceAssertionSignerService, path: string);
+    binding(): ValueOrPromise<void>;
+}
+//# sourceMappingURL=controller.d.ts.map

package/dist/components/auth/authenticate/controllers/service-certs/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,kBAAkB,EAGnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAQ,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AAGtF,4GAA4G;AAC5G,qBAAa,sBAAuB,SAAQ,kBAAkB;IAQ1D,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,6BAA6B,EAEtD,IAAI,EAAE,MAAM;IAKL,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC;CAUzC"}

package/dist/components/auth/authenticate/controllers/service-certs/controller.js

@@ -0,0 +1,50 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ServiceCertsController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceCertsController = void 0;
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
+const common_1 = require("@venizia/ignis-helpers/common");
+const ignis_inversion_1 = require("@venizia/ignis-inversion");
+const signer_service_1 = require("../../services/service/signer.service");
+const definitions_1 = require("./definitions");
+/** Publishes this service's assertion-signing public key. Mounted only when signing keys are configured. */
+let ServiceCertsController = ServiceCertsController_1 = class ServiceCertsController extends ignis_kernel_1.BaseRestController {
+    constructor(signer, path) {
+        super({ scope: ServiceCertsController_1.name, path, isStrict: true });
+        this.signer = signer;
+    }
+    binding() {
+        this.defineRoute({
+            configs: definitions_1.ServiceCertsRouteConfigs.GET_SERVICE_CERTS,
+            handler: async (context) => {
+                const jwks = await this.signer.getPublicJWKS();
+                context.header('Cache-Control', 'public, max-age=600, stale-while-revalidate=86400');
+                return context.json(jwks, common_1.HTTP.ResultCodes.RS_2.Ok);
+            },
+        });
+    }
+};
+exports.ServiceCertsController = ServiceCertsController;
+exports.ServiceCertsController = ServiceCertsController = ServiceCertsController_1 = __decorate([
+    __param(0, (0, ignis_kernel_1.inject)({
+        key: ignis_inversion_1.BindingKeys.build({
+            namespace: ignis_kernel_1.BindingNamespaces.SERVICE,
+            key: signer_service_1.ServiceAssertionSignerService.name,
+        }),
+    })),
+    __param(1, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_CERTS_PATH })),
+    __metadata("design:paramtypes", [signer_service_1.ServiceAssertionSignerService, String])
+], ServiceCertsController);
+//# sourceMappingURL=controller.js.map

package/dist/components/auth/authenticate/controllers/service-certs/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAK+B;AAC/B,0DAAqE;AACrE,8DAAuD;AACvD,0EAAsF;AACtF,+CAAyD;AAEzD,4GAA4G;AAC5G,IAAa,sBAAsB,8BAAnC,MAAa,sBAAuB,SAAQ,iCAAkB;IAC5D,YAOmB,MAAqC,EAEtD,IAAY;QAEZ,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAJnD,WAAM,GAAN,MAAM,CAA+B;IAKxD,CAAC;IAEQ,OAAO;QACd,IAAI,CAAC,WAAW,CAAC;YACf,OAAO,EAAE,sCAAwB,CAAC,iBAAiB;YACnD,OAAO,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC/C,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,mDAAmD,CAAC,CAAC;gBACrF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAzBY,wDAAsB;iCAAtB,sBAAsB;IAE9B,WAAA,IAAA,qBAAM,EAAC;QACN,GAAG,EAAE,6BAAW,CAAC,KAAK,CAAC;YACrB,SAAS,EAAE,gCAAiB,CAAC,OAAO;YACpC,GAAG,EAAE,8CAA6B,CAAC,IAAI;SACxC,CAAC;KACH,CAAC,CAAA;IAED,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,kBAAkB,EAAE,CAAC,CAAA;qCADnC,8CAA6B;GAR7C,sBAAsB,CAyBlC"}

package/dist/components/auth/authenticate/controllers/service-certs/definitions.d.ts

@@ -0,0 +1,73 @@
+import { z } from '@hono/zod-openapi';
+/**
+ * Unauthenticated by design: it serves the PUBLIC key a callee needs to verify this service's
+ * assertions. Whoever can reach it learns only which key signs, which is what verification requires.
+ *
+ * The schema names public members only. That is documentation, not a filter - a zod response schema
+ * does not strip anything - so the guard that private material never gets here lives in the signer.
+ */
+export declare const ServiceCertsRouteConfigs: {
+    readonly GET_SERVICE_CERTS: {
+        readonly path: "/";
+        readonly method: "get";
+        readonly responses: {
+            200: {
+                description: string;
+                content: {
+                    'application/json': {
+                        schema: z.ZodObject<{
+                            keys: z.ZodArray<z.ZodObject<{
+                                kty: z.ZodString;
+                                kid: z.ZodOptional<z.ZodString>;
+                                use: z.ZodOptional<z.ZodString>;
+                                alg: z.ZodOptional<z.ZodString>;
+                                crv: z.ZodOptional<z.ZodString>;
+                                x: z.ZodOptional<z.ZodString>;
+                            }, z.core.$strip>>;
+                        }, z.core.$strip>;
+                    };
+                };
+                required: boolean | undefined;
+            } | {
+                headers: never;
+                description: string;
+                content: {
+                    'application/json': {
+                        schema: z.ZodObject<{
+                            keys: z.ZodArray<z.ZodObject<{
+                                kty: z.ZodString;
+                                kid: z.ZodOptional<z.ZodString>;
+                                use: z.ZodOptional<z.ZodString>;
+                                alg: z.ZodOptional<z.ZodString>;
+                                crv: z.ZodOptional<z.ZodString>;
+                                x: z.ZodOptional<z.ZodString>;
+                            }, z.core.$strip>>;
+                        }, z.core.$strip>;
+                    };
+                };
+                required: boolean | undefined;
+            };
+            "4xx | 5xx": {
+                description: string;
+                content: {
+                    "application/json": {
+                        schema: z.ZodObject<{
+                            statusCode: z.ZodOptional<z.ZodNumber>;
+                            message: z.ZodString;
+                            normalized: z.ZodOptional<z.ZodObject<{
+                                text: z.ZodString;
+                                code: z.ZodString;
+                                args: z.ZodRecord<z.ZodString, z.ZodAny>;
+                            }, z.core.$strip>>;
+                            extra: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+                            requestId: z.ZodOptional<z.ZodString>;
+                            details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+                        }, z.core.$strip>;
+                    };
+                };
+                required: boolean | undefined;
+            };
+        };
+    };
+};
+//# sourceMappingURL=definitions.d.ts.map

package/dist/components/auth/authenticate/controllers/service-certs/definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsB3B,CAAC"}

package/dist/components/auth/authenticate/controllers/service-certs/definitions.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceCertsRouteConfigs = void 0;
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
+const zod_openapi_1 = require("@hono/zod-openapi");
+/**
+ * Unauthenticated by design: it serves the PUBLIC key a callee needs to verify this service's
+ * assertions. Whoever can reach it learns only which key signs, which is what verification requires.
+ *
+ * The schema names public members only. That is documentation, not a filter - a zod response schema
+ * does not strip anything - so the guard that private material never gets here lives in the signer.
+ */
+exports.ServiceCertsRouteConfigs = {
+    GET_SERVICE_CERTS: {
+        path: '/',
+        method: 'get',
+        responses: (0, ignis_kernel_1.jsonResponse)({
+            schema: zod_openapi_1.z
+                .object({
+                keys: zod_openapi_1.z.array(zod_openapi_1.z.object({
+                    kty: zod_openapi_1.z.string(),
+                    kid: zod_openapi_1.z.string().optional(),
+                    use: zod_openapi_1.z.string().optional(),
+                    alg: zod_openapi_1.z.string().optional(),
+                    crv: zod_openapi_1.z.string().optional(),
+                    x: zod_openapi_1.z.string().optional(),
+                })),
+            })
+                .openapi({ description: 'Service assertion JSON Web Key Set' }),
+            description: 'Service assertion JSON Web Key Set',
+        }),
+    },
+};
+//# sourceMappingURL=definitions.js.map

package/dist/components/auth/authenticate/controllers/service-certs/definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/definitions.ts"],"names":[],"mappings":";;;AAAA,wDAAqD;AACrD,mDAAsC;AAEtC;;;;;;GAMG;AACU,QAAA,wBAAwB,GAAG;IACtC,iBAAiB,EAAE;QACjB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,IAAA,2BAAY,EAAC;YACtB,MAAM,EAAE,eAAC;iBACN,MAAM,CAAC;gBACN,IAAI,EAAE,eAAC,CAAC,KAAK,CACX,eAAC,CAAC,MAAM,CAAC;oBACP,GAAG,EAAE,eAAC,CAAC,MAAM,EAAE;oBACf,GAAG,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,GAAG,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;oBAC1B,CAAC,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;iBACzB,CAAC,CACH;aACF,CAAC;iBACD,OAAO,CAAC,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;YACjE,WAAW,EAAE,oCAAoC;SAClD,CAAC;KACH;CACO,CAAC"}

package/dist/components/auth/authenticate/controllers/service-certs/index.d.ts

@@ -0,0 +1,3 @@
+export * from './controller';
+export * from './definitions';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/controllers/service-certs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/dist/components/auth/authenticate/controllers/service-certs/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./controller"), exports);
+__exportStar(require("./definitions"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/controllers/service-certs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,gDAA8B"}

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts

@@ -18,6 +18,22 @@ export declare class JWKSIssuerTokenService<E extends Env = Env> extends Abstrac
         priv: string;
         pub: string;
     }>;
+    /**
+     * Refuses a JWK carrying private material where a PUBLIC key is expected.
+     *
+     * The `pem` format cannot reach this state - `importSPKI` rejects a private PEM outright. The
+     * `jwk` format can: `importJWK` imports whatever it is handed, and a private JWK marked
+     * `"ext": true` yields an EXTRACTABLE key, so `exportJWK` then carries `d` straight into the
+     * document `/certs` serves without authentication. Measured on jose 6.2.3: with `ext: true` the
+     * round trip returns `d`; without it, export throws. So the only thing standing between a
+     * mis-pasted key and a published signing key was an optional flag on attacker-irrelevant input.
+     *
+     * Named members, not a blanket scan: `d` covers EC/OKP and RSA's private exponent, and the CRT
+     * members are the rest of an RSA private key.
+     */
+    protected assertPublicJWK(opts: {
+        jwk: JWK;
+    }): void;
     protected parseKeyMaterial(opts: {
         raw: {
             priv: string;

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issuer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,EAEL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAIhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EACL,SAAS,EAKT,GAAG,EAEH,OAAO,EACR,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,sBAAsB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAOxF,SAAS,CAAC,OAAO,EAAE,kBAAkB;IANvC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC/D,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC9D,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,GAAG,IAAI,CAAQ;gBAIlC,OAAO,EAAE,kBAAkB;cAad,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cA4BpC,iBAAiB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAA;KAAE;;;;cA0B5D,gBAAgB,CAAC,IAAI,EAAE;QACrC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;KAClC;;;;cAoDwB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B;cAiBkB,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;cAQvD,wBAAwB,IAAI,kBAAkB;IAIjE,OAAO,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE;IAWpB,YAAY,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;CAI/C"}
+{"version":3,"file":"issuer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,EAEL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAIhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EACL,SAAS,EAKT,GAAG,EAEH,OAAO,EACR,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,sBAAsB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAOxF,SAAS,CAAC,OAAO,EAAE,kBAAkB;IANvC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC/D,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC9D,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,GAAG,IAAI,CAAQ;gBAIlC,OAAO,EAAE,kBAAkB;cAad,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cAkCpC,iBAAiB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAA;KAAE;;;;IA0B5E;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,IAAI;cAcnC,gBAAgB,CAAC,IAAI,EAAE;QACrC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;KAClC;;;;cAsDwB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B;cAiBkB,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;cAQvD,wBAAwB,IAAI,kBAAkB;IAIjE,OAAO,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE;IAWpB,YAAY,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;CAI/C"}