@venizia/ignis 0.2.0-2 → 0.2.0-3

package/dist/components/auth/authenticate/controllers/service-certs/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./controller"), exports);
+__exportStar(require("./definitions"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/controllers/service-certs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/controllers/service-certs/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,gDAA8B"}

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts

@@ -18,6 +18,22 @@ export declare class JWKSIssuerTokenService<E extends Env = Env> extends Abstrac
         priv: string;
         pub: string;
     }>;
+    /**
+     * Refuses a JWK carrying private material where a PUBLIC key is expected.
+     *
+     * The `pem` format cannot reach this state - `importSPKI` rejects a private PEM outright. The
+     * `jwk` format can: `importJWK` imports whatever it is handed, and a private JWK marked
+     * `"ext": true` yields an EXTRACTABLE key, so `exportJWK` then carries `d` straight into the
+     * document `/certs` serves without authentication. Measured on jose 6.2.3: with `ext: true` the
+     * round trip returns `d`; without it, export throws. So the only thing standing between a
+     * mis-pasted key and a published signing key was an optional flag on attacker-irrelevant input.
+     *
+     * Named members, not a blanket scan: `d` covers EC/OKP and RSA's private exponent, and the CRT
+     * members are the rest of an RSA private key.
+     */
+    protected assertPublicJWK(opts: {
+        jwk: JWK;
+    }): void;
     protected parseKeyMaterial(opts: {
         raw: {
             priv: string;

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issuer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,EAEL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAIhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EACL,SAAS,EAKT,GAAG,EAEH,OAAO,EACR,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,sBAAsB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAOxF,SAAS,CAAC,OAAO,EAAE,kBAAkB;IANvC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC/D,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC9D,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,GAAG,IAAI,CAAQ;gBAIlC,OAAO,EAAE,kBAAkB;cAad,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cA4BpC,iBAAiB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAA;KAAE;;;;cA0B5D,gBAAgB,CAAC,IAAI,EAAE;QACrC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;KAClC;;;;cAoDwB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B;cAiBkB,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;cAQvD,wBAAwB,IAAI,kBAAkB;IAIjE,OAAO,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE;IAWpB,YAAY,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;CAI/C"}
+{"version":3,"file":"issuer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,SAAS,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEhF,OAAO,EAEL,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAIhB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC3B,OAAO,EACL,SAAS,EAKT,GAAG,EAEH,OAAO,EACR,MAAM,MAAM,CAAC;AAEd,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,sBAAsB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAOxF,SAAS,CAAC,OAAO,EAAE,kBAAkB;IANvC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC/D,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC9D,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,GAAG,IAAI,CAAQ;gBAIlC,OAAO,EAAE,kBAAkB;cAad,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cAkCpC,iBAAiB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAA;KAAE;;;;IA0B5E;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,IAAI;cAcnC,gBAAgB,CAAC,IAAI,EAAE;QACrC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;KAClC;;;;cAsDwB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAM5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B;cAiBkB,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;cAQvD,wBAAwB,IAAI,kBAAkB;IAIjE,OAAO,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE;IAWpB,YAAY,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;CAI/C"}

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.js

@@ -42,6 +42,10 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
         this.privateKey = built.priv;
         this.publicKey = built.pub;
         const publicJWK = await (0, jose_1.exportJWK)(this.publicKey);
+        // Belt and braces. `assertPublicJWK` already refused a private JWK on the way IN, but this is
+        // the exact object an unauthenticated `/certs` serves - the last place to notice a signing key
+        // about to be published, whatever route the material took to get here.
+        this.assertPublicJWK({ jwk: publicJWK });
         publicJWK.kid = this.options.kid;
         publicJWK.alg = algorithm;
         publicJWK.use = 'sig';
@@ -75,6 +79,30 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
             }
         }
     }
+    /**
+     * Refuses a JWK carrying private material where a PUBLIC key is expected.
+     *
+     * The `pem` format cannot reach this state - `importSPKI` rejects a private PEM outright. The
+     * `jwk` format can: `importJWK` imports whatever it is handed, and a private JWK marked
+     * `"ext": true` yields an EXTRACTABLE key, so `exportJWK` then carries `d` straight into the
+     * document `/certs` serves without authentication. Measured on jose 6.2.3: with `ext: true` the
+     * round trip returns `d`; without it, export throws. So the only thing standing between a
+     * mis-pasted key and a published signing key was an optional flag on attacker-irrelevant input.
+     *
+     * Named members, not a blanket scan: `d` covers EC/OKP and RSA's private exponent, and the CRT
+     * members are the rest of an RSA private key.
+     */
+    assertPublicJWK(opts) {
+        const PRIVATE_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'k'];
+        const present = PRIVATE_MEMBERS.filter(member => opts.jwk[member] !== undefined);
+        if (present.length === 0) {
+            return;
+        }
+        throw (0, core_1.getError)({
+            statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
+            message: `[JWKSIssuerTokenService] The public key material carries PRIVATE members (${present.join(', ')}) | this key would be published at the JWKS endpoint | pass the public half in keys.public`,
+        });
+    }
     async parseKeyMaterial(opts) {
         const { raw, algorithm, keys } = opts;
         if (!raw.priv) {
@@ -101,6 +129,7 @@ let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenSer
                         priv: JSON.parse(raw.priv),
                         pub: JSON.parse(raw.pub),
                     };
+                    this.assertPublicJWK({ jwk: parsed.pub });
                     const priv = await (0, jose_1.importJWK)(parsed.priv, algorithm);
                     const pub = await (0, jose_1.importJWK)(parsed.pub, algorithm);
                     return { priv, pub };

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"issuer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAgF;AAChF,sDAAuD;AACvD,wDAS+B;AAE/B,+BASc;AACd,+CAA4C;AAC5C,yDAA8D;AAE9D,IAAa,sBAAsB,8BAAnC,MAAa,sBAA4C,SAAQ,2CAA2B;IAK1F,YAEE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAoB;QAN7B,eAAU,GAAsC,IAAI,CAAC;QACrD,cAAS,GAAsC,IAAI,CAAC;QACpD,SAAI,GAA2B,IAAI,CAAC;QAQ5C,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;QAE3B,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAS,EAAC,IAAI,CAAC,SAAU,CAAC,CAAC;QACnD,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC;QAC1B,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CACH,6DAA6D,EAC7D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;IACN,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,IAA0C;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpC,IAAA,mBAAQ,EAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC/B,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,OAAO;oBAClB,GAAG,EAAE,IAAI,CAAC,MAAM;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,IAIhC;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,IAAA,kBAAW,EAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,GAAG,GAAG,MAAM,IAAA,iBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACjD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAQ;wBACjC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAQ;qBAChC,CAAC;oBAEF,MAAM,IAAI,GAAG,MAAM,IAAA,gBAAS,EAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACrD,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACnD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM;yBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;yBAC/B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACxD,MAAM,IAAA,eAAQ,EAAC;wBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;wBACrD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAAmB,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,cAAO,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;aAChD,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;aAC1E,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAK,CAAC;IACpB,CAAC;CACF,CAAA;AAxLY,wDAAsB;iCAAtB,sBAAsB;IAM9B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAN7C,sBAAsB,CAwLlC"}
+{"version":3,"file":"issuer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAgF;AAChF,sDAAuD;AACvD,wDAS+B;AAE/B,+BASc;AACd,+CAA4C;AAC5C,yDAA8D;AAE9D,IAAa,sBAAsB,8BAAnC,MAAa,sBAA4C,SAAQ,2CAA2B;IAK1F,YAEE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAoB;QAN7B,eAAU,GAAsC,IAAI,CAAC;QACrD,cAAS,GAAsC,IAAI,CAAC;QACpD,SAAI,GAA2B,IAAI,CAAC;QAQ5C,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;QAE3B,MAAM,SAAS,GAAG,MAAM,IAAA,gBAAS,EAAC,IAAI,CAAC,SAAU,CAAC,CAAC;QAEnD,8FAA8F;QAC9F,+FAA+F;QAC/F,uEAAuE;QACvE,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzC,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC;QAC1B,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CACH,6DAA6D,EAC7D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;IACN,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,IAA0C;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpC,IAAA,mBAAQ,EAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC/B,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,OAAO;oBAClB,GAAG,EAAE,IAAI,CAAC,MAAM;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACO,eAAe,CAAC,IAAkB;QAC1C,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAU,CAAC;QAExE,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;SACrM,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,IAIhC;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,IAAA,kBAAW,EAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,GAAG,GAAG,MAAM,IAAA,iBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACjD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAQ;wBACjC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAQ;qBAChC,CAAC;oBAEF,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;oBAE1C,MAAM,IAAI,GAAG,MAAM,IAAA,gBAAS,EAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACrD,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACnD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM;yBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;yBAC/B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACxD,MAAM,IAAA,eAAQ,EAAC;wBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;wBACrD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAAmB,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,cAAO,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;aAChD,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;aAC1E,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAK,CAAC;IACpB,CAAC;CACF,CAAA;AA3NY,wDAAsB;iCAAtB,sBAAsB;IAM9B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAN7C,sBAAsB,CA2NlC"}

package/dist/components/auth/authenticate/services/index.d.ts

@@ -1,3 +1,4 @@
 export * from './basic';
 export * from './bearer';
+export * from './service';
 //# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC"}

package/dist/components/auth/authenticate/services/index.js

@@ -16,4 +16,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./basic"), exports);
 __exportStar(require("./bearer"), exports);
+__exportStar(require("./service"), exports);
 //# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/services/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,2CAAyB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,2CAAyB;AACzB,4CAA0B"}

package/dist/components/auth/authenticate/services/service/index.d.ts

@@ -0,0 +1,3 @@
+export * from './signer.service';
+export * from './verifier.service';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/service/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC"}

package/dist/components/auth/authenticate/services/service/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./signer.service"), exports);
+__exportStar(require("./verifier.service"), exports);
+//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/services/service/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,qDAAmC"}

package/dist/components/auth/authenticate/services/service/signer.service.d.ts

@@ -0,0 +1,46 @@
+import { BaseService } from '@venizia/ignis-kernel';
+import type { IServiceAuthOptions } from '@venizia/ignis-kernel';
+import type { JWK } from 'jose';
+/**
+ * Mints the outgoing assertion, and publishes the public half for callees to verify against.
+ *
+ * Only a service that CALLS OUT needs this. `isEnabled()` is false when the application configured
+ * no keys, and the component then mounts no certs route.
+ */
+export declare class ServiceAssertionSignerService extends BaseService {
+    private readonly options;
+    private readonly requestIdGenerator;
+    private privateKey?;
+    private jwks?;
+    constructor(options: IServiceAuthOptions);
+    isEnabled(): boolean;
+    /** `<name>_<rest path without its slash>`, so a rotated mount changes the kid rather than colliding. */
+    getKeyId(): string;
+    /**
+     * One assertion, bound to this exact call.
+     *
+     * `path` must be the percent-ENCODED pathname - `new URL(target).pathname`. The verifier compares
+     * against the same shape, and a decoded path here would fail every route carrying a space or a
+     * non-ASCII slug.
+     */
+    sign(opts: {
+        method: string;
+        path: string;
+        audience: string;
+    }): Promise<string>;
+    /**
+     * The document `/svc-certs` serves, built from the PUBLIC key only.
+     *
+     * `importSPKI` refuses a private PEM outright, which is what makes the private half unreachable
+     * from here by construction rather than by care. The JWK format is deliberately NOT accepted for
+     * this path: `importJWK` imports whatever it is handed, and a private JWK marked `"ext": true`
+     * round-trips its `d` straight into this document. See `JWKSIssuerTokenService.assertPublicJWK`.
+     */
+    getPublicJWKS(): Promise<{
+        keys: JWK[];
+    }>;
+    private resolvePrivateKey;
+    private readKey;
+    private assertEnabled;
+}
+//# sourceMappingURL=signer.service.d.ts.map

package/dist/components/auth/authenticate/services/service/signer.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAIjE,OAAO,KAAK,EAAa,GAAG,EAAE,MAAM,MAAM,CAAC;AAI3C;;;;;GAKG;AACH,qBAAa,6BAA8B,SAAQ,WAAW;IAU1D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEhC;IAEH,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,OAAO,CAAC,IAAI,CAAC,CAAkB;gBAIZ,OAAO,EAAE,mBAAmB;IAK/C,SAAS,IAAI,OAAO;IAIpB,wGAAwG;IACxG,QAAQ,IAAI,MAAM;IAKlB;;;;;;OAMG;IACG,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAwBrF;;;;;;;OAOG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;YAyBjC,iBAAiB;YAUjB,OAAO;IAiBrB,OAAO,CAAC,aAAa;CAUtB"}

package/dist/components/auth/authenticate/services/service/signer.service.js

@@ -0,0 +1,135 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ServiceAssertionSignerService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAssertionSignerService = void 0;
+const metadata_1 = require("../../../../../base/metadata");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
+const core_1 = require("@venizia/ignis-helpers/core");
+const common_1 = require("@venizia/ignis-helpers/common");
+const jose_1 = require("jose");
+const promises_1 = require("node:fs/promises");
+const ignis_kernel_2 = require("@venizia/ignis-kernel");
+/**
+ * Mints the outgoing assertion, and publishes the public half for callees to verify against.
+ *
+ * Only a service that CALLS OUT needs this. `isEnabled()` is false when the application configured
+ * no keys, and the component then mounts no certs route.
+ */
+let ServiceAssertionSignerService = ServiceAssertionSignerService_1 = class ServiceAssertionSignerService extends ignis_kernel_1.BaseService {
+    constructor(options) {
+        super({ scope: ServiceAssertionSignerService_1.name });
+        this.options = options;
+        this.requestIdGenerator = new core_1.RequestIdGenerator({
+            scope: ServiceAssertionSignerService_1.name,
+        });
+    }
+    isEnabled() {
+        return Boolean(this.options.keys);
+    }
+    /** `<name>_<rest path without its slash>`, so a rotated mount changes the kid rather than colliding. */
+    getKeyId() {
+        const restPath = this.options.rest?.path ?? ignis_kernel_1.ServiceAssertion.DEFAULT_REST_PATH;
+        return this.options.keys?.kid ?? `${this.options.name}_${restPath.replace(/^\//, '')}`;
+    }
+    /**
+     * One assertion, bound to this exact call.
+     *
+     * `path` must be the percent-ENCODED pathname - `new URL(target).pathname`. The verifier compares
+     * against the same shape, and a decoded path here would fail every route carrying a space or a
+     * non-ASCII slug.
+     */
+    async sign(opts) {
+        const { method, path, audience } = opts;
+        this.assertEnabled();
+        const now = Math.floor(Date.now() / 1000);
+        const lifetime = this.options.signLifetimeSeconds ?? ignis_kernel_1.ServiceAssertion.DEFAULT_SIGN_LIFETIME_SECONDS;
+        return new jose_1.SignJWT({ htm: method.toUpperCase(), htu: path })
+            .setProtectedHeader({
+            alg: ignis_kernel_1.ServiceAssertion.ALGORITHM,
+            kid: this.getKeyId(),
+            typ: ignis_kernel_1.ServiceAssertion.TYP,
+        })
+            .setIssuer(this.options.name)
+            .setSubject(this.options.name)
+            .setAudience(audience)
+            .setJti(this.requestIdGenerator.nextId())
+            .setIssuedAt(now)
+            .setExpirationTime(now + lifetime)
+            .sign(await this.resolvePrivateKey());
+    }
+    /**
+     * The document `/svc-certs` serves, built from the PUBLIC key only.
+     *
+     * `importSPKI` refuses a private PEM outright, which is what makes the private half unreachable
+     * from here by construction rather than by care. The JWK format is deliberately NOT accepted for
+     * this path: `importJWK` imports whatever it is handed, and a private JWK marked `"ext": true`
+     * round-trips its `d` straight into this document. See `JWKSIssuerTokenService.assertPublicJWK`.
+     */
+    async getPublicJWKS() {
+        if (this.jwks) {
+            return this.jwks;
+        }
+        this.assertEnabled();
+        const raw = await this.readKey({ source: this.options.keys.public });
+        const publicKey = await (0, jose_1.importSPKI)(raw, ignis_kernel_1.ServiceAssertion.ALGORITHM);
+        const jwk = await (0, jose_1.exportJWK)(publicKey);
+        if (jwk.d !== undefined) {
+            throw (0, core_1.getError)({
+                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
+                message: `[${ServiceAssertionSignerService_1.name}] The public key material carries a private exponent | this key would be published at the certs endpoint`,
+            });
+        }
+        this.jwks = {
+            keys: [{ ...jwk, kid: this.getKeyId(), alg: ignis_kernel_1.ServiceAssertion.ALGORITHM, use: 'sig' }],
+        };
+        return this.jwks;
+    }
+    async resolvePrivateKey() {
+        if (this.privateKey) {
+            return this.privateKey;
+        }
+        const raw = await this.readKey({ source: this.options.keys.private });
+        this.privateKey = await (0, jose_1.importPKCS8)(raw, ignis_kernel_1.ServiceAssertion.ALGORITHM);
+        return this.privateKey;
+    }
+    async readKey(opts) {
+        const { format, driver } = this.options.keys;
+        if (format !== ignis_kernel_2.JWKSKeyFormats.PEM) {
+            throw (0, core_1.getError)({
+                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
+                message: `[${ServiceAssertionSignerService_1.name}] Only the '${ignis_kernel_2.JWKSKeyFormats.PEM}' key format is supported | got: ${format}`,
+            });
+        }
+        if (driver === ignis_kernel_2.JWKSKeyDrivers.FILE) {
+            return (0, promises_1.readFile)(opts.source, 'utf-8');
+        }
+        return opts.source;
+    }
+    assertEnabled() {
+        if (this.options.keys) {
+            return;
+        }
+        throw (0, core_1.getError)({
+            statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
+            message: `[${ServiceAssertionSignerService_1.name}] This service has no signing keys | it can verify assertions but not mint them`,
+        });
+    }
+};
+exports.ServiceAssertionSignerService = ServiceAssertionSignerService;
+exports.ServiceAssertionSignerService = ServiceAssertionSignerService = ServiceAssertionSignerService_1 = __decorate([
+    __param(0, (0, metadata_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_OPTIONS })),
+    __metadata("design:paramtypes", [Object])
+], ServiceAssertionSignerService);
+//# sourceMappingURL=signer.service.js.map

package/dist/components/auth/authenticate/services/service/signer.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAAyC;AACzC,wDAA+F;AAE/F,sDAA2E;AAC3E,0DAAqD;AACrD,+BAAmE;AAEnE,+CAA4C;AAC5C,wDAAuE;AAEvE;;;;;GAKG;AACH,IAAa,6BAA6B,qCAA1C,MAAa,6BAA8B,SAAQ,0BAAW;IAQ5D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,+BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAqB;QAT9B,uBAAkB,GAAG,IAAI,yBAAkB,CAAC;YAC3D,KAAK,EAAE,+BAA6B,CAAC,IAAI;SAC1C,CAAC,CAAC;IAUH,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IACxG,QAAQ;QACN,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,+BAAgB,CAAC,iBAAiB,CAAC;QAC/E,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,IAAwD;QACjE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QAExC,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,+BAAgB,CAAC,6BAA6B,CAAC;QAErF,OAAO,IAAI,cAAO,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;aACzD,kBAAkB,CAAC;YAClB,GAAG,EAAE,+BAAgB,CAAC,SAAS;YAC/B,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE;YACpB,GAAG,EAAE,+BAAgB,CAAC,GAAG;SAC1B,CAAC;aACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;aAC7B,WAAW,CAAC,QAAQ,CAAC;aACrB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;aACxC,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,GAAG,GAAG,QAAQ,CAAC;aACjC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,MAAM,IAAA,iBAAU,EAAC,GAAG,EAAE,+BAAgB,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,0GAA0G;aAC1J,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,IAAI,GAAG;YACV,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,+BAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SACtF,CAAC;QAEF,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,MAAM,IAAA,kBAAW,EAAC,GAAG,EAAE,+BAAgB,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAwB;QAC5C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC;QAE9C,IAAI,MAAM,KAAK,6BAAc,CAAC,GAAG,EAAE,CAAC;YAClC,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,eAAe,6BAAc,CAAC,GAAG,oCAAoC,MAAM,EAAE;aAC7H,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,6BAAc,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,IAAI,+BAA6B,CAAC,IAAI,iFAAiF;SACjI,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA9HY,sEAA6B;wCAA7B,6BAA6B;IASrC,WAAA,IAAA,iBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GAThD,6BAA6B,CA8HzC"}

package/dist/components/auth/authenticate/services/service/verifier.service.d.ts

@@ -0,0 +1,40 @@
+import { BaseService } from '@venizia/ignis-kernel';
+import type { IServiceAuthOptions } from '@venizia/ignis-kernel';
+/**
+ * Verifies an incoming service assertion against the CALLER's own JWKS.
+ *
+ * What the assertion covers, and nothing else: the HTTP method and the percent-encoded path. It does
+ * NOT cover the query string, any header, or the body. Tenant selectors in particular are usually a
+ * header or a query parameter, so an assertion alone does not authenticate which tenant a call acts
+ * on - the caller allowlist and the application's own scoping have to do that. Stated because the
+ * gap is invisible from the call site.
+ */
+export declare class ServiceAssertionVerifierService extends BaseService {
+    private readonly options;
+    /** One remote key set per caller, kept because `createRemoteJWKSet` owns its own cache. */
+    private readonly keySets;
+    /** Per-caller accepted age, resolved once alongside its key set. */
+    private readonly acceptMaxAges;
+    constructor(options: IServiceAuthOptions);
+    /**
+     * @param path The percent-ENCODED pathname, from `new URL(context.req.url).pathname`. Never
+     * `context.req.path` - Hono decodes that one, and the caller signed the encoded form.
+     */
+    verify(opts: {
+        token: string;
+        method: string;
+        path: string;
+    }): Promise<{
+        issuer: string;
+    }>;
+    /**
+     * Reads `iss` WITHOUT verifying, only to choose which key set checks the signature. The same value
+     * is then enforced as the expected issuer, so a forged `iss` buys nothing beyond selecting the key
+     * set that will reject it.
+     */
+    private readIssuer;
+    private resolveKeySet;
+    private runVerify;
+    private assertRequestBinding;
+}
+//# sourceMappingURL=verifier.service.d.ts.map

package/dist/components/auth/authenticate/services/service/verifier.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/verifier.service.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,WAAW,EAEZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAA2B,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAM1F;;;;;;;;GAQG;AACH,qBAAa,+BAAgC,SAAQ,WAAW;IAS5D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoC;IAE5D,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;gBAIxC,OAAO,EAAE,mBAAmB;IAK/C;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAYhG;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAgBlB,OAAO,CAAC,aAAa;YAyCP,SAAS;IA+CvB,OAAO,CAAC,oBAAoB;CAoB7B"}

package/dist/components/auth/authenticate/services/service/verifier.service.js

@@ -0,0 +1,153 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ServiceAssertionVerifierService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAssertionVerifierService = void 0;
+const metadata_1 = require("../../../../../base/metadata");
+const ignis_kernel_1 = require("@venizia/ignis-kernel");
+const core_1 = require("@venizia/ignis-helpers/core");
+const jose_1 = require("jose");
+/**
+ * Verifies an incoming service assertion against the CALLER's own JWKS.
+ *
+ * What the assertion covers, and nothing else: the HTTP method and the percent-encoded path. It does
+ * NOT cover the query string, any header, or the body. Tenant selectors in particular are usually a
+ * header or a query parameter, so an assertion alone does not authenticate which tenant a call acts
+ * on - the caller allowlist and the application's own scoping have to do that. Stated because the
+ * gap is invisible from the call site.
+ */
+let ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = class ServiceAssertionVerifierService extends ignis_kernel_1.BaseService {
+    constructor(options) {
+        super({ scope: ServiceAssertionVerifierService_1.name });
+        this.options = options;
+        /** One remote key set per caller, kept because `createRemoteJWKSet` owns its own cache. */
+        this.keySets = new Map();
+        /** Per-caller accepted age, resolved once alongside its key set. */
+        this.acceptMaxAges = new Map();
+    }
+    /**
+     * @param path The percent-ENCODED pathname, from `new URL(context.req.url).pathname`. Never
+     * `context.req.path` - Hono decodes that one, and the caller signed the encoded form.
+     */
+    async verify(opts) {
+        const { token, method, path } = opts;
+        const issuer = this.readIssuer({ token });
+        const keySet = this.resolveKeySet({ issuer });
+        const payload = await this.runVerify({ token, issuer, keySet });
+        this.assertRequestBinding({ payload, method, path });
+        return { issuer };
+    }
+    /**
+     * Reads `iss` WITHOUT verifying, only to choose which key set checks the signature. The same value
+     * is then enforced as the expected issuer, so a forged `iss` buys nothing beyond selecting the key
+     * set that will reject it.
+     */
+    readIssuer(opts) {
+        try {
+            const { iss } = (0, jose_1.decodeJwt)(opts.token);
+            // Typed, not merely present: a numeric `iss` would index the caller map by coercion.
+            if (typeof iss !== 'string' || iss.length === 0) {
+                throw new Error('missing or non-string iss');
+            }
+            return iss;
+        }
+        catch (error) {
+            this.logger.for(this.readIssuer.name).warn('Undecodable assertion | error: %s', error);
+            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.ASSERTION_INVALID });
+        }
+    }
+    resolveKeySet(opts) {
+        const { issuer } = opts;
+        const cached = this.keySets.get(issuer);
+        if (cached) {
+            return cached;
+        }
+        const callers = this.options.callers ?? {};
+        // `Object.hasOwn`, never a truthiness check on the index: the map arrives as a plain object, so
+        // `iss: 'constructor'` would otherwise return `Function` - truthy - walk past this guard, and
+        // reach `new URL(<function>)` as an uncaught TypeError.
+        if (!Object.hasOwn(callers, issuer)) {
+            this.logger
+                .for(this.resolveKeySet.name)
+                .warn('Caller not on the allowlist | iss: %s', issuer);
+            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.CALLER_NOT_ALLOWED });
+        }
+        const entry = callers[issuer];
+        const jwksUrl = typeof entry === 'string' ? entry : entry.jwksUrl;
+        this.acceptMaxAges.set(issuer, ignis_kernel_1.ServiceAssertion.resolveAcceptMaxAge({
+            callerOverride: typeof entry === 'string' ? undefined : entry.acceptMaxAgeSeconds,
+            serviceDefault: this.options.acceptMaxAgeSeconds,
+        }));
+        const keySet = (0, jose_1.createRemoteJWKSet)(new URL(jwksUrl), {
+            cacheMaxAge: this.options.jwks?.cacheMaxAgeMs ?? ignis_kernel_1.ServiceAssertion.DEFAULT_JWKS_CACHE_MAX_AGE_MS,
+            cooldownDuration: this.options.jwks?.cooldownMs ?? ignis_kernel_1.ServiceAssertion.DEFAULT_JWKS_COOLDOWN_MS,
+        });
+        this.keySets.set(issuer, keySet);
+        return keySet;
+    }
+    async runVerify(opts) {
+        const { token, issuer, keySet } = opts;
+        // Resolved when the key set was, so a per-caller override is already folded in.
+        const maxTokenAge = this.acceptMaxAges.get(issuer) ??
+            ignis_kernel_1.ServiceAssertion.resolveAcceptMaxAge({
+                serviceDefault: this.options.acceptMaxAgeSeconds,
+            });
+        const clockTolerance = this.options.clockToleranceSeconds ?? ignis_kernel_1.ServiceAssertion.DEFAULT_CLOCK_TOLERANCE_SECONDS;
+        try {
+            const { payload } = await (0, jose_1.jwtVerify)(token, keySet, {
+                algorithms: [ignis_kernel_1.ServiceAssertion.ALGORITHM],
+                typ: ignis_kernel_1.ServiceAssertion.TYP,
+                issuer,
+                audience: this.options.name,
+                // NOT redundant with `exp`, though it looks it. An honest caller stamps `exp = iat +
+                // lifetime`, so the two are numerically tied and jose reaches `exp` first - measured.
+                // `maxTokenAge` is the only bound that still holds when the CALLER is the attacker and picks
+                // its own `exp`, which is precisely the case it exists for. Do not delete it as dead config.
+                //
+                // And it is the CALLEE's number, never one the caller may request: a caller that could ask
+                // for a longer window would be choosing its own replay window, which is the whole thing this
+                // is here to deny.
+                maxTokenAge,
+                clockTolerance,
+                requiredClaims: ['htm', 'htu', 'jti'],
+            });
+            return payload;
+        }
+        catch (error) {
+            // One code out, the reason on `cause`: a wrong audience, clock skew and a rotated key are
+            // otherwise the same string to whoever is reading the log at 2am.
+            const reason = error?.cause ?? error;
+            this.logger.for(this.runVerify.name).warn('Rejected | iss: %s | reason: %s', issuer, reason);
+            throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.ASSERTION_INVALID, cause: error });
+        }
+    }
+    assertRequestBinding(opts) {
+        const { payload, method, path } = opts;
+        const signed = `${payload.htm} ${payload.htu}`;
+        const actual = `${method.toUpperCase()} ${path}`;
+        if (signed === actual) {
+            return;
+        }
+        this.logger
+            .for(this.assertRequestBinding.name)
+            .warn('Request binding mismatch | signed: %s | actual: %s', signed, actual);
+        throw (0, core_1.getError)({ error: ignis_kernel_1.AuthenticationErrors.REQUEST_BINDING_MISMATCH });
+    }
+};
+exports.ServiceAssertionVerifierService = ServiceAssertionVerifierService;
+exports.ServiceAssertionVerifierService = ServiceAssertionVerifierService = ServiceAssertionVerifierService_1 = __decorate([
+    __param(0, (0, metadata_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.SERVICE_OPTIONS })),
+    __metadata("design:paramtypes", [Object])
+], ServiceAssertionVerifierService);
+//# sourceMappingURL=verifier.service.js.map

package/dist/components/auth/authenticate/services/service/verifier.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAAyC;AACzC,wDAK+B;AAE/B,sDAAuD;AACvD,+BAAgE;AAIhE;;;;;;;;GAQG;AACH,IAAa,+BAA+B,uCAA5C,MAAa,+BAAgC,SAAQ,0BAAW;IAO9D,YAEE,OAA6C;QAE7C,KAAK,CAAC,EAAE,KAAK,EAAE,iCAA+B,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAqB;QAR/C,2FAA2F;QAC1E,YAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;QAE5D,oEAAoE;QACnD,kBAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAO3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAAqD;QAChE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAErC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhE,IAAI,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAErD,OAAO,EAAE,MAAM,EAAE,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,IAAuB;QACxC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,IAAA,gBAAS,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAEtC,qFAAqF;YACrF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;YACvF,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,IAAwB;QAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAExB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAE3C,gGAAgG;QAChG,8FAA8F;QAC9F,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM;iBACR,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;iBAC5B,IAAI,CAAC,uCAAuC,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAElE,IAAI,CAAC,aAAa,CAAC,GAAG,CACpB,MAAM,EACN,+BAAgB,CAAC,mBAAmB,CAAC;YACnC,cAAc,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB;YACjF,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;SACjD,CAAC,CACH,CAAC;QAEF,MAAM,MAAM,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE;YAClD,WAAW,EACT,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,IAAI,+BAAgB,CAAC,6BAA6B;YACpF,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,+BAAgB,CAAC,wBAAwB;SAC7F,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAIvB;QACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEvC,gFAAgF;QAChF,MAAM,WAAW,GACf,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;YAC9B,+BAAgB,CAAC,mBAAmB,CAAC;gBACnC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;QAEL,MAAM,cAAc,GAClB,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,+BAAgB,CAAC,+BAA+B,CAAC;QAEzF,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAA0B,KAAK,EAAE,MAAM,EAAE;gBAC1E,UAAU,EAAE,CAAC,+BAAgB,CAAC,SAAS,CAAC;gBACxC,GAAG,EAAE,+BAAgB,CAAC,GAAG;gBACzB,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBAC3B,qFAAqF;gBACrF,sFAAsF;gBACtF,6FAA6F;gBAC7F,6FAA6F;gBAC7F,EAAE;gBACF,2FAA2F;gBAC3F,6FAA6F;gBAC7F,mBAAmB;gBACnB,WAAW;gBACX,cAAc;gBACd,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;YAEH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,kEAAkE;YAClE,MAAM,MAAM,GAAI,KAA6B,EAAE,KAAK,IAAI,KAAK,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iCAAiC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAE7F,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,IAI5B;QACC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEvC,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;QAEjD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;aACnC,IAAI,CAAC,oDAAoD,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9E,MAAM,IAAA,eAAQ,EAAC,EAAE,KAAK,EAAE,mCAAoB,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAC3E,CAAC;CACF,CAAA;AA/JY,0EAA+B;0CAA/B,+BAA+B;IAQvC,WAAA,IAAA,iBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,eAAe,EAAE,CAAC,CAAA;;GARhD,+BAA+B,CA+J3C"}

package/dist/components/auth/authenticate/strategies/index.d.ts

@@ -2,4 +2,5 @@ export * from '@venizia/ignis-kernel';
 export * from './basic.strategy';
 export * from './jws.strategy';
 export * from './jwks.strategy';
+export * from './service.strategy';
 //# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/strategies/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAC;AAEtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":"AACA,cAAc,uBAAuB,CAAC;AAEtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}

package/dist/components/auth/authenticate/strategies/index.js

@@ -19,4 +19,5 @@ __exportStar(require("@venizia/ignis-kernel"), exports);
 __exportStar(require("./basic.strategy"), exports);
 __exportStar(require("./jws.strategy"), exports);
 __exportStar(require("./jwks.strategy"), exports);
+__exportStar(require("./service.strategy"), exports);
 //# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/strategies/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iGAAiG;AACjG,wDAAsC;AAEtC,mDAAiC;AACjC,iDAA+B;AAC/B,kDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/strategies/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iGAAiG;AACjG,wDAAsC;AAEtC,mDAAiC;AACjC,iDAA+B;AAC/B,kDAAgC;AAChC,qDAAmC"}