@venizia/ignis 0.4.3 → 0.4.5

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"issuer.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE1F,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAIrB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAG3C,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,sBAAsB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAOxF,SAAS,CAAC,OAAO,EAAE,kBAAkB;IANvC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC/D,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,GAAG,UAAU,CAAC,CAAQ;IAC9D,SAAS,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,GAAG,IAAI,CAAQ;gBAIlC,OAAO,EAAE,kBAAkB;cAad,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cAmCpC,iBAAiB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAA;KAAE;;;;IA0B5E;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,IAAI;cAcnC,gBAAgB,CAAC,IAAI,EAAE;QACrC,GAAG,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC;QACnC,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;KAClC;;;;cAwDwB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAO5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B;cAkBkB,aAAa,IAAI,cAAc,CAAC,UAAU,GAAG,SAAS,CAAC;cAQvD,wBAAwB,IAAI,kBAAkB;IAIjE,OAAO,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE;IAWpB,YAAY,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;CAI/C"}

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.js

@@ -1,204 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var JWKSIssuerTokenService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWKSIssuerTokenService = void 0;
-const common_1 = require("@venizia/ignis-helpers/common");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const promises_1 = require("node:fs/promises");
-const jose_loader_1 = require("../../jose-loader");
-const abstract_service_1 = require("./abstract.service");
-let JWKSIssuerTokenService = JWKSIssuerTokenService_1 = class JWKSIssuerTokenService extends abstract_service_1.AbstractJWKSTokenService {
-    constructor(options) {
-        super({ scope: JWKSIssuerTokenService_1.name });
-        this.options = options;
-        this.privateKey = null;
-        this.publicKey = null;
-        this.jwks = null;
-        this.configurePayloadEncryption({
-            aesAlgorithm: this.options.aesAlgorithm,
-            applicationSecret: this.options.applicationSecret,
-            fieldCodecs: this.options.fieldCodecs,
-            cipher: this.options.cipher,
-            sign: this.options.sign,
-        });
-    }
-    async initialize() {
-        const { keys, algorithm } = this.options;
-        const raw = await this.resolveKeyContent({ keys });
-        const built = await this.parseKeyMaterial({ raw, algorithm, keys });
-        this.privateKey = built.priv;
-        this.publicKey = built.pub;
-        const { exportJWK } = await jose_loader_1.JoseLoader.load();
-        const publicJWK = await exportJWK(this.publicKey);
-        // Belt and braces. `assertPublicJWK` already refused a private JWK on the way IN, but this is
-        // the exact object an unauthenticated `/certs` serves - the last place to notice a signing key
-        // about to be published, whatever route the material took to get here.
-        this.assertPublicJWK({ jwk: publicJWK });
-        publicJWK.kid = this.options.kid;
-        publicJWK.alg = algorithm;
-        publicJWK.use = 'sig';
-        this.jwks = { keys: [publicJWK] };
-        this.initialized = true;
-        this.logger
-            .for(this.initialize.name)
-            .info('JWKS issuer initialized | driver: %s | format: %s | kid: %s', keys.driver, keys.format, this.options.kid);
-    }
-    async resolveKeyContent(opts) {
-        const { keys } = opts;
-        switch (keys.driver) {
-            case ignis_kernel_1.JWKSKeyDrivers.FILE: {
-                const [priv, pub] = await Promise.all([
-                    (0, promises_1.readFile)(keys.private, 'utf-8'),
-                    (0, promises_1.readFile)(keys.public, 'utf-8'),
-                ]);
-                return { priv, pub };
-            }
-            case ignis_kernel_1.JWKSKeyDrivers.TEXT: {
-                return {
-                    priv: keys.private,
-                    pub: keys.public,
-                };
-            }
-            default: {
-                throw (0, core_1.getError)({
-                    statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                    message: `[JWKSIssuerTokenService] Unknown key driver: ${keys.driver}`,
-                });
-            }
-        }
-    }
-    /**
-     * Refuses a JWK carrying private material where a PUBLIC key is expected.
-     *
-     * The `pem` format cannot reach this state - `importSPKI` rejects a private PEM outright. The
-     * `jwk` format can: `importJWK` imports whatever it is handed, and a private JWK marked
-     * `"ext": true` yields an EXTRACTABLE key, so `exportJWK` then carries `d` straight into the
-     * document `/certs` serves without authentication. Measured on jose 6.2.3: with `ext: true` the
-     * round trip returns `d`; without it, export throws. So the only thing standing between a
-     * mis-pasted key and a published signing key was an optional flag on attacker-irrelevant input.
-     *
-     * Named members, not a blanket scan: `d` covers EC/OKP and RSA's private exponent, and the CRT
-     * members are the rest of an RSA private key.
-     */
-    assertPublicJWK(opts) {
-        const PRIVATE_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'k'];
-        const present = PRIVATE_MEMBERS.filter((member) => opts.jwk[member] !== undefined);
-        if (present.length === 0) {
-            return;
-        }
-        throw (0, core_1.getError)({
-            statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-            message: `[JWKSIssuerTokenService] The public key material carries PRIVATE members (${present.join(', ')}) | this key would be published at the JWKS endpoint | pass the public half in keys.public`,
-        });
-    }
-    async parseKeyMaterial(opts) {
-        const { raw, algorithm, keys } = opts;
-        if (!raw.priv) {
-            throw (0, core_1.getError)({
-                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                message: '[JWKSIssuerTokenService] Invalid raw.priv key!',
-            });
-        }
-        if (!raw.pub) {
-            throw (0, core_1.getError)({
-                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                message: '[JWKSIssuerTokenService] Invalid raw.pub key!',
-            });
-        }
-        const { importJWK, importPKCS8, importSPKI } = await jose_loader_1.JoseLoader.load();
-        switch (keys.format) {
-            case ignis_kernel_1.JWKSKeyFormats.PEM: {
-                const priv = await importPKCS8(raw.priv, algorithm);
-                const pub = await importSPKI(raw.pub, algorithm);
-                return { priv, pub };
-            }
-            case ignis_kernel_1.JWKSKeyFormats.JWK: {
-                try {
-                    const parsed = {
-                        priv: JSON.parse(raw.priv),
-                        pub: JSON.parse(raw.pub),
-                    };
-                    this.assertPublicJWK({ jwk: parsed.pub });
-                    const priv = await importJWK(parsed.priv, algorithm);
-                    const pub = await importJWK(parsed.pub, algorithm);
-                    return { priv, pub };
-                }
-                catch (error) {
-                    this.logger
-                        .for(this.parseKeyMaterial.name)
-                        .error('Invalid JWK key material | Error: %s', error);
-                    throw (0, core_1.getError)({
-                        statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                        message: '[JWKSIssuerTokenService] Invalid JWK key material',
-                    });
-                }
-            }
-            default: {
-                throw (0, core_1.getError)({
-                    statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                    message: `[JWKSIssuerTokenService] Unknown key format: ${keys.format}`,
-                });
-            }
-        }
-    }
-    async doVerify(token) {
-        await this.ensureInitialized();
-        const { jwtVerify } = await jose_loader_1.JoseLoader.load();
-        const result = await jwtVerify(token, this.publicKey, this.options.verify);
-        return this.decryptPayload({ result });
-    }
-    async getSigner(opts) {
-        await this.ensureInitialized();
-        const { SignJWT } = await jose_loader_1.JoseLoader.load();
-        const now = Math.floor(Date.now() / 1000);
-        const expiresIn = await opts.getTokenExpiresFn();
-        const encryptedPayload = this.encryptPayload(opts.payload);
-        const signer = new SignJWT({ ...encryptedPayload })
-            .setProtectedHeader({ alg: this.options.algorithm, kid: this.options.kid })
-            .setIssuedAt()
-            .setExpirationTime(now + expiresIn)
-            .setNotBefore(now);
-        return this.applySignClaims({ signer, payload: encryptedPayload, claims: opts.claims });
-    }
-    getSigningKey() {
-        if (!this.privateKey) {
-            throw (0, core_1.getError)({ message: '[getSigningKey] Invalid privateKey!' });
-        }
-        return this.privateKey;
-    }
-    getDefaultTokenExpiresFn() {
-        return this.options.getTokenExpiresFn;
-    }
-    getJWKS() {
-        if (!this.jwks) {
-            throw (0, core_1.getError)({
-                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                message: '[JWKSIssuerTokenService] JWKS not initialized yet. Call getJWKSAsync() instead.',
-            });
-        }
-        return this.jwks;
-    }
-    async getJWKSAsync() {
-        await this.ensureInitialized();
-        return this.jwks;
-    }
-};
-exports.JWKSIssuerTokenService = JWKSIssuerTokenService;
-exports.JWKSIssuerTokenService = JWKSIssuerTokenService = JWKSIssuerTokenService_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.JWKS_OPTIONS })),
-    __metadata("design:paramtypes", [Object])
-], JWKSIssuerTokenService);
-//# sourceMappingURL=issuer.service.js.map

package/dist/components/auth/authenticate/services/bearer/jwks/issuer.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"issuer.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/issuer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAA0F;AAC1F,sDAAuD;AACvD,wDAS+B;AAG/B,+CAA4C;AAC5C,mDAA+C;AAC/C,yDAA8D;AAE9D,IAAa,sBAAsB,8BAAnC,MAAa,sBAA4C,SAAQ,2CAA2B;IAK1F,YAEE,OAAqC;QAErC,KAAK,CAAC,EAAE,KAAK,EAAE,wBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFpC,YAAO,GAAP,OAAO,CAAoB;QAN7B,eAAU,GAAsC,IAAI,CAAC;QACrD,cAAS,GAAsC,IAAI,CAAC;QACpD,SAAI,GAA2B,IAAI,CAAC;QAQ5C,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;SACxB,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;QAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC;QAEnD,8FAA8F;QAC9F,+FAA+F;QAC/F,uEAAuE;QACvE,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzC,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC;QAC1B,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;QAElC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CACH,6DAA6D,EAC7D,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CAAC,GAAG,CACjB,CAAC;IACN,CAAC;IAES,KAAK,CAAC,iBAAiB,CAAC,IAA0C;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACpC,IAAA,mBAAQ,EAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAC/B,IAAA,mBAAQ,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzB,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,OAAO;oBAClB,GAAG,EAAE,IAAI,CAAC,MAAM;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACO,eAAe,CAAC,IAAkB;QAC1C,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAU,CAAC;QAExE,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;QACnF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;SACrM,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,IAIhC;QACC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QAEtC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,gDAAgD;aAC1D,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,+CAA+C;aACzD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAEvE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACpD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACjD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YACvB,CAAC;YACD,KAAK,6BAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAQ;wBACjC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAQ;qBAChC,CAAC;oBAEF,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;oBAE1C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACrD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACnD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM;yBACR,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;yBAC/B,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACxD,MAAM,IAAA,eAAQ,EAAC;wBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;wBACrD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,IAAA,eAAQ,EAAC;oBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;oBACrD,OAAO,EAAE,gDAAgD,IAAI,CAAC,MAAM,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAmB,KAAK,EAAE,IAAI,CAAC,SAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAE5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;aAChD,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;aAC1E,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAK,CAAC;IACpB,CAAC;CACF,CAAA;AAhOY,wDAAsB;iCAAtB,sBAAsB;IAM9B,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAN7C,sBAAsB,CAgOlC","sourcesContent":["import { HTTP, type TNullable, type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport {\n  AuthenticateBindingKeys,\n  type IJWKSIssuerOptions,\n  type IJWTIssueClaims,\n  type IJWTTokenPayload,\n  inject,\n  JWKSKeyDrivers,\n  JWKSKeyFormats,\n  type TGetTokenExpiresFn,\n} from '@venizia/ignis-kernel';\nimport { type Env } from 'hono';\nimport type { CryptoKey, JWK } from 'jose';\nimport { readFile } from 'node:fs/promises';\nimport { JoseLoader } from '../../jose-loader';\nimport { AbstractJWKSTokenService } from './abstract.service';\n\nexport class JWKSIssuerTokenService<E extends Env = Env> extends AbstractJWKSTokenService<E> {\n  protected privateKey: TNullable<CryptoKey | Uint8Array> = null;\n  protected publicKey: TNullable<CryptoKey | Uint8Array> = null;\n  protected jwks: { keys: JWK[] } | null = null;\n\n  constructor(\n    @inject({ key: AuthenticateBindingKeys.JWKS_OPTIONS })\n    protected options: IJWKSIssuerOptions,\n  ) {\n    super({ scope: JWKSIssuerTokenService.name });\n\n    this.configurePayloadEncryption({\n      aesAlgorithm: this.options.aesAlgorithm,\n      applicationSecret: this.options.applicationSecret,\n      fieldCodecs: this.options.fieldCodecs,\n      cipher: this.options.cipher,\n      sign: this.options.sign,\n    });\n  }\n\n  protected override async initialize(): Promise<void> {\n    const { keys, algorithm } = this.options;\n\n    const raw = await this.resolveKeyContent({ keys });\n    const built = await this.parseKeyMaterial({ raw, algorithm, keys });\n\n    this.privateKey = built.priv;\n    this.publicKey = built.pub;\n\n    const { exportJWK } = await JoseLoader.load();\n    const publicJWK = await exportJWK(this.publicKey!);\n\n    // Belt and braces. `assertPublicJWK` already refused a private JWK on the way IN, but this is\n    // the exact object an unauthenticated `/certs` serves - the last place to notice a signing key\n    // about to be published, whatever route the material took to get here.\n    this.assertPublicJWK({ jwk: publicJWK });\n\n    publicJWK.kid = this.options.kid;\n    publicJWK.alg = algorithm;\n    publicJWK.use = 'sig';\n\n    this.jwks = { keys: [publicJWK] };\n\n    this.initialized = true;\n\n    this.logger\n      .for(this.initialize.name)\n      .info(\n        'JWKS issuer initialized | driver: %s | format: %s | kid: %s',\n        keys.driver,\n        keys.format,\n        this.options.kid,\n      );\n  }\n\n  protected async resolveKeyContent(opts: { keys: IJWKSIssuerOptions['keys'] }) {\n    const { keys } = opts;\n\n    switch (keys.driver) {\n      case JWKSKeyDrivers.FILE: {\n        const [priv, pub] = await Promise.all([\n          readFile(keys.private, 'utf-8'),\n          readFile(keys.public, 'utf-8'),\n        ]);\n        return { priv, pub };\n      }\n      case JWKSKeyDrivers.TEXT: {\n        return {\n          priv: keys.private,\n          pub: keys.public,\n        };\n      }\n      default: {\n        throw getError({\n          statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n          message: `[JWKSIssuerTokenService] Unknown key driver: ${keys.driver}`,\n        });\n      }\n    }\n  }\n\n  /**\n   * Refuses a JWK carrying private material where a PUBLIC key is expected.\n   *\n   * The `pem` format cannot reach this state - `importSPKI` rejects a private PEM outright. The\n   * `jwk` format can: `importJWK` imports whatever it is handed, and a private JWK marked\n   * `\"ext\": true` yields an EXTRACTABLE key, so `exportJWK` then carries `d` straight into the\n   * document `/certs` serves without authentication. Measured on jose 6.2.3: with `ext: true` the\n   * round trip returns `d`; without it, export throws. So the only thing standing between a\n   * mis-pasted key and a published signing key was an optional flag on attacker-irrelevant input.\n   *\n   * Named members, not a blanket scan: `d` covers EC/OKP and RSA's private exponent, and the CRT\n   * members are the rest of an RSA private key.\n   */\n  protected assertPublicJWK(opts: { jwk: JWK }): void {\n    const PRIVATE_MEMBERS = ['d', 'p', 'q', 'dp', 'dq', 'qi', 'k'] as const;\n\n    const present = PRIVATE_MEMBERS.filter((member) => opts.jwk[member] !== undefined);\n    if (present.length === 0) {\n      return;\n    }\n\n    throw getError({\n      statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n      message: `[JWKSIssuerTokenService] The public key material carries PRIVATE members (${present.join(', ')}) | this key would be published at the JWKS endpoint | pass the public half in keys.public`,\n    });\n  }\n\n  protected async parseKeyMaterial(opts: {\n    raw: { priv: string; pub: string };\n    algorithm: IJWKSIssuerOptions['algorithm'];\n    keys: IJWKSIssuerOptions['keys'];\n  }) {\n    const { raw, algorithm, keys } = opts;\n\n    if (!raw.priv) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: '[JWKSIssuerTokenService] Invalid raw.priv key!',\n      });\n    }\n\n    if (!raw.pub) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: '[JWKSIssuerTokenService] Invalid raw.pub key!',\n      });\n    }\n\n    const { importJWK, importPKCS8, importSPKI } = await JoseLoader.load();\n\n    switch (keys.format) {\n      case JWKSKeyFormats.PEM: {\n        const priv = await importPKCS8(raw.priv, algorithm);\n        const pub = await importSPKI(raw.pub, algorithm);\n        return { priv, pub };\n      }\n      case JWKSKeyFormats.JWK: {\n        try {\n          const parsed = {\n            priv: JSON.parse(raw.priv) as JWK,\n            pub: JSON.parse(raw.pub) as JWK,\n          };\n\n          this.assertPublicJWK({ jwk: parsed.pub });\n\n          const priv = await importJWK(parsed.priv, algorithm);\n          const pub = await importJWK(parsed.pub, algorithm);\n          return { priv, pub };\n        } catch (error) {\n          this.logger\n            .for(this.parseKeyMaterial.name)\n            .error('Invalid JWK key material | Error: %s', error);\n          throw getError({\n            statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n            message: '[JWKSIssuerTokenService] Invalid JWK key material',\n          });\n        }\n      }\n      default: {\n        throw getError({\n          statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n          message: `[JWKSIssuerTokenService] Unknown key format: ${keys.format}`,\n        });\n      }\n    }\n  }\n\n  protected override async doVerify(token: string): Promise<IJWTTokenPayload> {\n    await this.ensureInitialized();\n    const { jwtVerify } = await JoseLoader.load();\n    const result = await jwtVerify<IJWTTokenPayload>(token, this.publicKey!, this.options.verify);\n    return this.decryptPayload({ result });\n  }\n\n  override async getSigner(opts: {\n    payload: IJWTTokenPayload;\n    getTokenExpiresFn: TGetTokenExpiresFn;\n    claims?: IJWTIssueClaims;\n  }) {\n    await this.ensureInitialized();\n    const { SignJWT } = await JoseLoader.load();\n\n    const now = Math.floor(Date.now() / 1000);\n    const expiresIn = await opts.getTokenExpiresFn();\n\n    const encryptedPayload = this.encryptPayload(opts.payload);\n\n    const signer = new SignJWT({ ...encryptedPayload })\n      .setProtectedHeader({ alg: this.options.algorithm, kid: this.options.kid })\n      .setIssuedAt()\n      .setExpirationTime(now + expiresIn)\n      .setNotBefore(now);\n\n    return this.applySignClaims({ signer, payload: encryptedPayload, claims: opts.claims });\n  }\n\n  protected override getSigningKey(): ValueOrPromise<Uint8Array | CryptoKey> {\n    if (!this.privateKey) {\n      throw getError({ message: '[getSigningKey] Invalid privateKey!' });\n    }\n\n    return this.privateKey;\n  }\n\n  protected override getDefaultTokenExpiresFn(): TGetTokenExpiresFn {\n    return this.options.getTokenExpiresFn;\n  }\n\n  getJWKS(): { keys: JWK[] } {\n    if (!this.jwks) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: '[JWKSIssuerTokenService] JWKS not initialized yet. Call getJWKSAsync() instead.',\n      });\n    }\n\n    return this.jwks;\n  }\n\n  async getJWKSAsync(): Promise<{ keys: JWK[] }> {\n    await this.ensureInitialized();\n    return this.jwks!;\n  }\n}\n"]}

package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.d.ts

@@ -1,18 +0,0 @@
-import { type IJWKSVerifierOptions, type IJWTTokenPayload, type TGetTokenExpiresFn } from '@venizia/ignis-kernel';
-import { type Env } from 'hono';
-import type { createRemoteJWKSet, SignJWT } from 'jose';
-import { AbstractJWKSTokenService } from './abstract.service';
-export declare class JWKSVerifierTokenService<E extends Env = Env> extends AbstractJWKSTokenService<E> {
-    protected options: IJWKSVerifierOptions;
-    protected jwksVerifier: ReturnType<typeof createRemoteJWKSet> | null;
-    constructor(options: IJWKSVerifierOptions);
-    protected initialize(): Promise<void>;
-    protected doVerify(token: string): Promise<IJWTTokenPayload>;
-    getSigner(_opts: {
-        payload: IJWTTokenPayload;
-        getTokenExpiresFn: TGetTokenExpiresFn;
-    }): Promise<SignJWT>;
-    protected getSigningKey(): never;
-    protected getDefaultTokenExpiresFn(): never;
-}
-//# sourceMappingURL=verifier.service.d.ts.map

package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifier.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAChC,OAAO,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,qBAAa,wBAAwB,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,wBAAwB,CAAC,CAAC,CAAC;IAK1F,SAAS,CAAC,OAAO,EAAE,oBAAoB;IAJzC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,GAAG,IAAI,CAAQ;gBAIhE,OAAO,EAAE,oBAAoB;cAWhB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;cAe3B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAW5D,SAAS,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;KACvC,GAAG,OAAO,CAAC,OAAO,CAAC;cAOD,aAAa,IAAI,KAAK;cAOtB,wBAAwB,IAAI,KAAK;CAMrD"}

package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.js

@@ -1,76 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var JWKSVerifierTokenService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWKSVerifierTokenService = void 0;
-const common_1 = require("@venizia/ignis-helpers/common");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const jose_loader_1 = require("../../jose-loader");
-const abstract_service_1 = require("./abstract.service");
-let JWKSVerifierTokenService = JWKSVerifierTokenService_1 = class JWKSVerifierTokenService extends abstract_service_1.AbstractJWKSTokenService {
-    constructor(options) {
-        super({ scope: JWKSVerifierTokenService_1.name });
-        this.options = options;
-        this.jwksVerifier = null;
-        this.configurePayloadEncryption({
-            aesAlgorithm: this.options.aesAlgorithm,
-            applicationSecret: this.options.applicationSecret,
-            fieldCodecs: this.options.fieldCodecs,
-            cipher: this.options.cipher,
-        });
-    }
-    async initialize() {
-        const { createRemoteJWKSet } = await jose_loader_1.JoseLoader.load();
-        const jwksUrl = new URL(this.options.jwksUrl);
-        this.jwksVerifier = createRemoteJWKSet(jwksUrl, {
-            cacheMaxAge: this.options.cacheTtlMs ?? 43_200_000,
-            cooldownDuration: this.options.cooldownMs ?? 30_000,
-        });
-        this.initialized = true;
-        this.logger
-            .for(this.initialize.name)
-            .info('JWKS verifier initialized | url: %s', this.options.jwksUrl);
-    }
-    async doVerify(token) {
-        await this.ensureInitialized();
-        const { jwtVerify } = await jose_loader_1.JoseLoader.load();
-        const result = await jwtVerify(token, this.jwksVerifier, this.options.verify);
-        return this.decryptPayload({ result });
-    }
-    async getSigner(_opts) {
-        throw (0, core_1.getError)({
-            statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-            message: '[JWKSVerifierTokenService] Verifier mode cannot sign tokens',
-        });
-    }
-    getSigningKey() {
-        throw (0, core_1.getError)({
-            statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-            message: '[JWKSVerifierTokenService] Verifier mode cannot sign tokens',
-        });
-    }
-    getDefaultTokenExpiresFn() {
-        throw (0, core_1.getError)({
-            statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-            message: '[JWKSVerifierTokenService] Verifier mode has no token expiry',
-        });
-    }
-};
-exports.JWKSVerifierTokenService = JWKSVerifierTokenService;
-exports.JWKSVerifierTokenService = JWKSVerifierTokenService = JWKSVerifierTokenService_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.JWKS_OPTIONS })),
-    __metadata("design:paramtypes", [Object])
-], JWKSVerifierTokenService);
-//# sourceMappingURL=verifier.service.js.map

package/dist/components/auth/authenticate/services/bearer/jwks/verifier.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifier.service.js","sourceRoot":"","sources":["../../../../../../../src/components/auth/authenticate/services/bearer/jwks/verifier.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAqD;AACrD,sDAAuD;AACvD,wDAM+B;AAG/B,mDAA+C;AAC/C,yDAA8D;AAE9D,IAAa,wBAAwB,gCAArC,MAAa,wBAA8C,SAAQ,2CAA2B;IAG5F,YAEE,OAAuC;QAEvC,KAAK,CAAC,EAAE,KAAK,EAAE,0BAAwB,CAAC,IAAI,EAAE,CAAC,CAAC;QAFtC,YAAO,GAAP,OAAO,CAAsB;QAJ/B,iBAAY,GAAiD,IAAI,CAAC;QAO1E,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;YACvC,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAEkB,KAAK,CAAC,UAAU;QACjC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE;YAC9C,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,UAAU;YAClD,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,MAAM;SACpD,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAExB,IAAI,CAAC,MAAM;aACR,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;aACzB,IAAI,CAAC,qCAAqC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,IAAI,CAAC,YAAa,EAClB,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,KAGxB;QACC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,aAAa;QAC9B,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAEkB,wBAAwB;QACzC,MAAM,IAAA,eAAQ,EAAC;YACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;YACrD,OAAO,EAAE,8DAA8D;SACxE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjEY,4DAAwB;mCAAxB,wBAAwB;IAIhC,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,YAAY,EAAE,CAAC,CAAA;;GAJ7C,wBAAwB,CAiEpC","sourcesContent":["import { HTTP } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport {\n  AuthenticateBindingKeys,\n  type IJWKSVerifierOptions,\n  type IJWTTokenPayload,\n  inject,\n  type TGetTokenExpiresFn,\n} from '@venizia/ignis-kernel';\nimport { type Env } from 'hono';\nimport type { createRemoteJWKSet, SignJWT } from 'jose';\nimport { JoseLoader } from '../../jose-loader';\nimport { AbstractJWKSTokenService } from './abstract.service';\n\nexport class JWKSVerifierTokenService<E extends Env = Env> extends AbstractJWKSTokenService<E> {\n  protected jwksVerifier: ReturnType<typeof createRemoteJWKSet> | null = null;\n\n  constructor(\n    @inject({ key: AuthenticateBindingKeys.JWKS_OPTIONS })\n    protected options: IJWKSVerifierOptions,\n  ) {\n    super({ scope: JWKSVerifierTokenService.name });\n    this.configurePayloadEncryption({\n      aesAlgorithm: this.options.aesAlgorithm,\n      applicationSecret: this.options.applicationSecret,\n      fieldCodecs: this.options.fieldCodecs,\n      cipher: this.options.cipher,\n    });\n  }\n\n  protected override async initialize(): Promise<void> {\n    const { createRemoteJWKSet } = await JoseLoader.load();\n    const jwksUrl = new URL(this.options.jwksUrl);\n    this.jwksVerifier = createRemoteJWKSet(jwksUrl, {\n      cacheMaxAge: this.options.cacheTtlMs ?? 43_200_000,\n      cooldownDuration: this.options.cooldownMs ?? 30_000,\n    });\n\n    this.initialized = true;\n\n    this.logger\n      .for(this.initialize.name)\n      .info('JWKS verifier initialized | url: %s', this.options.jwksUrl);\n  }\n\n  protected override async doVerify(token: string): Promise<IJWTTokenPayload> {\n    await this.ensureInitialized();\n    const { jwtVerify } = await JoseLoader.load();\n    const result = await jwtVerify<IJWTTokenPayload>(\n      token,\n      this.jwksVerifier!,\n      this.options.verify,\n    );\n    return this.decryptPayload({ result });\n  }\n\n  override async getSigner(_opts: {\n    payload: IJWTTokenPayload;\n    getTokenExpiresFn: TGetTokenExpiresFn;\n  }): Promise<SignJWT> {\n    throw getError({\n      statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n      message: '[JWKSVerifierTokenService] Verifier mode cannot sign tokens',\n    });\n  }\n\n  protected override getSigningKey(): never {\n    throw getError({\n      statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n      message: '[JWKSVerifierTokenService] Verifier mode cannot sign tokens',\n    });\n  }\n\n  protected override getDefaultTokenExpiresFn(): never {\n    throw getError({\n      statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n      message: '[JWKSVerifierTokenService] Verifier mode has no token expiry',\n    });\n  }\n}\n"]}

package/dist/components/auth/authenticate/services/bearer/jws.service.d.ts

@@ -1,19 +0,0 @@
-import { type ValueOrPromise } from '@venizia/ignis-helpers/common';
-import { type IJWSTokenServiceOptions, type IJWTIssueClaims, type IJWTTokenPayload, type TGetTokenExpiresFn } from '@venizia/ignis-kernel';
-import { type Env } from 'hono';
-import { AbstractBearerTokenService } from './abstract.service';
-/** Symmetric JWT (JWS) token service with optional AES-encrypted payloads. */
-export declare class JWSTokenService<E extends Env = Env> extends AbstractBearerTokenService<E> {
-    protected options: IJWSTokenServiceOptions;
-    protected jwtSecret: Uint8Array;
-    constructor(options: IJWSTokenServiceOptions);
-    protected doVerify(token: string): Promise<IJWTTokenPayload>;
-    getSigner(opts: {
-        payload: IJWTTokenPayload;
-        getTokenExpiresFn: TGetTokenExpiresFn;
-        claims?: IJWTIssueClaims;
-    }): Promise<import("jose", { with: { "resolution-mode": "import" } }).SignJWT>;
-    protected getSigningKey(): ValueOrPromise<Uint8Array>;
-    protected getDefaultTokenExpiresFn(): TGetTokenExpiresFn;
-}
-//# sourceMappingURL=jws.service.d.ts.map

package/dist/components/auth/authenticate/services/bearer/jws.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jws.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAEhE,8EAA8E;AAC9E,qBAAa,eAAe,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,CAAE,SAAQ,0BAA0B,CAAC,CAAC,CAAC;IAKnF,SAAS,CAAC,OAAO,EAAE,uBAAuB;IAJ5C,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC;gBAIpB,OAAO,EAAE,uBAAuB;cA8BnB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAU5D,SAAS,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,gBAAgB,CAAC;QAC1B,iBAAiB,EAAE,kBAAkB,CAAC;QACtC,MAAM,CAAC,EAAE,eAAe,CAAC;KAC1B;cAgBkB,aAAa,IAAI,cAAc,CAAC,UAAU,CAAC;cAQ3C,wBAAwB,IAAI,kBAAkB;CAGlE"}

package/dist/components/auth/authenticate/services/bearer/jws.service.js

@@ -1,81 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-var JWSTokenService_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWSTokenService = void 0;
-const common_1 = require("@venizia/ignis-helpers/common");
-const core_1 = require("@venizia/ignis-helpers/core");
-const ignis_kernel_1 = require("@venizia/ignis-kernel");
-const jose_loader_1 = require("../jose-loader");
-const abstract_service_1 = require("./abstract.service");
-/** Symmetric JWT (JWS) token service with optional AES-encrypted payloads. */
-let JWSTokenService = JWSTokenService_1 = class JWSTokenService extends abstract_service_1.AbstractBearerTokenService {
-    constructor(options) {
-        super({ scope: JWSTokenService_1.name });
-        this.options = options;
-        const { aesAlgorithm, jwtSecret, applicationSecret, getTokenExpiresFn } = options ?? {};
-        if (!jwtSecret) {
-            throw (0, core_1.getError)({
-                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                message: '[JWSTokenService] Invalid jwtSecret',
-            });
-        }
-        if (!getTokenExpiresFn) {
-            throw (0, core_1.getError)({
-                statusCode: common_1.HTTP.ResultCodes.RS_5.InternalServerError,
-                message: '[JWSTokenService] Invalid getTokenExpiresFn',
-            });
-        }
-        this.configurePayloadEncryption({
-            aesAlgorithm,
-            applicationSecret,
-            fieldCodecs: options.fieldCodecs,
-            cipher: options.cipher,
-            sign: options.sign,
-        });
-        this.jwtSecret = new TextEncoder().encode(this.options.jwtSecret);
-    }
-    async doVerify(token) {
-        const { jwtVerify } = await jose_loader_1.JoseLoader.load();
-        const decodedToken = await jwtVerify(token, this.jwtSecret, this.options.verify);
-        return this.decryptPayload({ result: decodedToken });
-    }
-    async getSigner(opts) {
-        const { SignJWT } = await jose_loader_1.JoseLoader.load();
-        const now = Math.floor(Date.now() / 1000);
-        const expiresIn = await opts.getTokenExpiresFn();
-        const encryptedPayload = this.encryptPayload(opts.payload);
-        const signer = new SignJWT(Object.assign({}, encryptedPayload))
-            .setProtectedHeader({ alg: this.options.headerAlgorithm ?? 'HS256' })
-            .setIssuedAt()
-            .setExpirationTime(now + expiresIn)
-            .setNotBefore(now);
-        return this.applySignClaims({ signer, payload: encryptedPayload, claims: opts.claims });
-    }
-    getSigningKey() {
-        if (!this.jwtSecret) {
-            throw (0, core_1.getError)({ message: '[getSigningKey] Invalid jwtSecret!' });
-        }
-        return this.jwtSecret;
-    }
-    getDefaultTokenExpiresFn() {
-        return this.options.getTokenExpiresFn;
-    }
-};
-exports.JWSTokenService = JWSTokenService;
-exports.JWSTokenService = JWSTokenService = JWSTokenService_1 = __decorate([
-    __param(0, (0, ignis_kernel_1.inject)({ key: ignis_kernel_1.AuthenticateBindingKeys.JWT_OPTIONS })),
-    __metadata("design:paramtypes", [Object])
-], JWSTokenService);
-//# sourceMappingURL=jws.service.js.map

package/dist/components/auth/authenticate/services/bearer/jws.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jws.service.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/bearer/jws.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAA0E;AAC1E,sDAAuD;AACvD,wDAO+B;AAE/B,gDAA4C;AAC5C,yDAAgE;AAEhE,8EAA8E;AAC9E,IAAa,eAAe,uBAA5B,MAAa,eAAqC,SAAQ,6CAA6B;IAGrF,YAEY,OAAgC;QAE1C,KAAK,CAAC,EAAE,KAAK,EAAE,iBAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAF7B,YAAO,GAAP,OAAO,CAAyB;QAI1C,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAC;QAExF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,qCAAqC;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAA,eAAQ,EAAC;gBACb,UAAU,EAAE,aAAI,CAAC,WAAW,CAAC,IAAI,CAAC,mBAAmB;gBACrD,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC;YAC9B,YAAY;YACZ,iBAAiB;YACjB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEkB,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,SAAS,CAClC,KAAK,EACL,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAO,CAAC,MAAM,CACpB,CAAC;QACF,OAAO,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACvD,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,IAIxB;QACC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,wBAAU,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;aAC5D,kBAAkB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,OAAO,EAAE,CAAC;aACpE,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,GAAG,SAAS,CAAC;aAClC,YAAY,CAAC,GAAG,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEkB,aAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAA,eAAQ,EAAC,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEkB,wBAAwB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,CAAC;CACF,CAAA;AA5EY,0CAAe;0BAAf,eAAe;IAIvB,WAAA,IAAA,qBAAM,EAAC,EAAE,GAAG,EAAE,sCAAuB,CAAC,WAAW,EAAE,CAAC,CAAA;;GAJ5C,eAAe,CA4E3B","sourcesContent":["import { HTTP, type ValueOrPromise } from '@venizia/ignis-helpers/common';\nimport { getError } from '@venizia/ignis-helpers/core';\nimport {\n  AuthenticateBindingKeys,\n  type IJWSTokenServiceOptions,\n  type IJWTIssueClaims,\n  type IJWTTokenPayload,\n  inject,\n  type TGetTokenExpiresFn,\n} from '@venizia/ignis-kernel';\nimport { type Env } from 'hono';\nimport { JoseLoader } from '../jose-loader';\nimport { AbstractBearerTokenService } from './abstract.service';\n\n/** Symmetric JWT (JWS) token service with optional AES-encrypted payloads. */\nexport class JWSTokenService<E extends Env = Env> extends AbstractBearerTokenService<E> {\n  protected jwtSecret: Uint8Array;\n\n  constructor(\n    @inject({ key: AuthenticateBindingKeys.JWT_OPTIONS })\n    protected options: IJWSTokenServiceOptions,\n  ) {\n    super({ scope: JWSTokenService.name });\n\n    const { aesAlgorithm, jwtSecret, applicationSecret, getTokenExpiresFn } = options ?? {};\n\n    if (!jwtSecret) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: '[JWSTokenService] Invalid jwtSecret',\n      });\n    }\n\n    if (!getTokenExpiresFn) {\n      throw getError({\n        statusCode: HTTP.ResultCodes.RS_5.InternalServerError,\n        message: '[JWSTokenService] Invalid getTokenExpiresFn',\n      });\n    }\n\n    this.configurePayloadEncryption({\n      aesAlgorithm,\n      applicationSecret,\n      fieldCodecs: options.fieldCodecs,\n      cipher: options.cipher,\n      sign: options.sign,\n    });\n    this.jwtSecret = new TextEncoder().encode(this.options.jwtSecret);\n  }\n\n  protected override async doVerify(token: string): Promise<IJWTTokenPayload> {\n    const { jwtVerify } = await JoseLoader.load();\n    const decodedToken = await jwtVerify<IJWTTokenPayload>(\n      token,\n      this.jwtSecret,\n      this.options.verify,\n    );\n    return this.decryptPayload({ result: decodedToken });\n  }\n\n  override async getSigner(opts: {\n    payload: IJWTTokenPayload;\n    getTokenExpiresFn: TGetTokenExpiresFn;\n    claims?: IJWTIssueClaims;\n  }) {\n    const { SignJWT } = await JoseLoader.load();\n    const now = Math.floor(Date.now() / 1000);\n    const expiresIn = await opts.getTokenExpiresFn();\n\n    const encryptedPayload = this.encryptPayload(opts.payload);\n\n    const signer = new SignJWT(Object.assign({}, encryptedPayload))\n      .setProtectedHeader({ alg: this.options.headerAlgorithm ?? 'HS256' })\n      .setIssuedAt()\n      .setExpirationTime(now + expiresIn)\n      .setNotBefore(now);\n\n    return this.applySignClaims({ signer, payload: encryptedPayload, claims: opts.claims });\n  }\n\n  protected override getSigningKey(): ValueOrPromise<Uint8Array> {\n    if (!this.jwtSecret) {\n      throw getError({ message: '[getSigningKey] Invalid jwtSecret!' });\n    }\n\n    return this.jwtSecret;\n  }\n\n  protected override getDefaultTokenExpiresFn(): TGetTokenExpiresFn {\n    return this.options.getTokenExpiresFn;\n  }\n}\n"]}

package/dist/components/auth/authenticate/services/index.d.ts

@@ -1,4 +0,0 @@
-export * from './basic';
-export * from './bearer';
-export * from './service';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC"}

package/dist/components/auth/authenticate/services/index.js

@@ -1,20 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./basic"), exports);
-__exportStar(require("./bearer"), exports);
-__exportStar(require("./service"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/services/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,2CAAyB;AACzB,4CAA0B","sourcesContent":["export * from './basic';\nexport * from './bearer';\nexport * from './service';\n"]}

package/dist/components/auth/authenticate/services/jose-loader.d.ts

@@ -1,16 +0,0 @@
-type TJoseModule = typeof import('jose');
-/**
- * Loads `jose` for the auth services, once per process.
- *
- * `jose` is ESM-only and this package is CommonJS. A top-level `require('jose')` runs while the
- * application is still loading, and under Bun it fails with `require() async module ... is
- * unsupported` whenever the application imports `jose` itself. `import()` waits for that load
- * instead of racing it. A string literal, so a bundler still packs `jose` into a compiled binary.
- */
-export declare class JoseLoader {
-    private static importer;
-    private static module;
-    static load(): Promise<TJoseModule>;
-}
-export {};
-//# sourceMappingURL=jose-loader.d.ts.map

package/dist/components/auth/authenticate/services/jose-loader.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jose-loader.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/jose-loader.ts"],"names":[],"mappings":"AAAA,KAAK,WAAW,GAAG,cAAc,MAAM,CAAC,CAAC;AAEzC;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAoD;IAC3E,OAAO,CAAC,MAAM,CAAC,MAAM,CAAqC;IAE1D,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC;CAQpC"}

package/dist/components/auth/authenticate/services/jose-loader.js

@@ -1,25 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JoseLoader = void 0;
-/**
- * Loads `jose` for the auth services, once per process.
- *
- * `jose` is ESM-only and this package is CommonJS. A top-level `require('jose')` runs while the
- * application is still loading, and under Bun it fails with `require() async module ... is
- * unsupported` whenever the application imports `jose` itself. `import()` waits for that load
- * instead of racing it. A string literal, so a bundler still packs `jose` into a compiled binary.
- */
-class JoseLoader {
-    static { this.importer = () => import('jose'); }
-    static { this.module = null; }
-    static load() {
-        // A failed load is dropped, so the next call imports again instead of failing for good.
-        JoseLoader.module ??= JoseLoader.importer().catch((error) => {
-            JoseLoader.module = null;
-            throw error;
-        });
-        return JoseLoader.module;
-    }
-}
-exports.JoseLoader = JoseLoader;
-//# sourceMappingURL=jose-loader.js.map

package/dist/components/auth/authenticate/services/jose-loader.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jose-loader.js","sourceRoot":"","sources":["../../../../../src/components/auth/authenticate/services/jose-loader.ts"],"names":[],"mappings":";;;AAEA;;;;;;;GAOG;AACH,MAAa,UAAU;aACN,aAAQ,GAA+B,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;aAC5D,WAAM,GAAgC,IAAI,CAAC;IAE1D,MAAM,CAAC,IAAI;QACT,wFAAwF;QACxF,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACnE,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;;AAXH,gCAYC","sourcesContent":["type TJoseModule = typeof import('jose');\n\n/**\n * Loads `jose` for the auth services, once per process.\n *\n * `jose` is ESM-only and this package is CommonJS. A top-level `require('jose')` runs while the\n * application is still loading, and under Bun it fails with `require() async module ... is\n * unsupported` whenever the application imports `jose` itself. `import()` waits for that load\n * instead of racing it. A string literal, so a bundler still packs `jose` into a compiled binary.\n */\nexport class JoseLoader {\n  private static importer: () => Promise<TJoseModule> = () => import('jose');\n  private static module: Promise<TJoseModule> | null = null;\n\n  static load(): Promise<TJoseModule> {\n    // A failed load is dropped, so the next call imports again instead of failing for good.\n    JoseLoader.module ??= JoseLoader.importer().catch((error: unknown) => {\n      JoseLoader.module = null;\n      throw error;\n    });\n    return JoseLoader.module;\n  }\n}\n"]}

package/dist/components/auth/authenticate/services/service/index.d.ts

@@ -1,3 +0,0 @@
-export * from './signer.service';
-export * from './verifier.service';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/auth/authenticate/services/service/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC"}

package/dist/components/auth/authenticate/services/service/index.js

@@ -1,19 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./signer.service"), exports);
-__exportStar(require("./verifier.service"), exports);
-//# sourceMappingURL=index.js.map

package/dist/components/auth/authenticate/services/service/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,qDAAmC","sourcesContent":["export * from './signer.service';\nexport * from './verifier.service';\n"]}

package/dist/components/auth/authenticate/services/service/signer.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"signer.service.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/authenticate/services/service/signer.service.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAC/F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,KAAK,EAAa,GAAG,EAAE,MAAM,MAAM,CAAC;AAK3C;;;;;GAKG;AACH,qBAAa,6BAA8B,SAAQ,WAAW;IAU1D,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAEhC;IAEH,OAAO,CAAC,UAAU,CAAC,CAAY;IAC/B,OAAO,CAAC,IAAI,CAAC,CAAkB;gBAIZ,OAAO,EAAE,mBAAmB;IAK/C,SAAS,IAAI,OAAO;IAIpB,wGAAwG;IACxG,QAAQ,IAAI,MAAM;IAKlB;;;;;;OAMG;IACG,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAyBrF;;;;;;;OAOG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;YA0BjC,iBAAiB;YAWjB,OAAO;IAiBrB,OAAO,CAAC,aAAa;CAUtB"}