@crvouga/mockingbird-service-oauth 1.3.0 → 1.4.0

package/dist/cli.js

@@ -3,8 +3,8 @@ import {
   runCli,
   serveCommand,
   serveTarget
-} from "./chunk-MKBPAVYU.js";
-import "./chunk-WHI7Y2UA.js";
+} from "./chunk-D4IAZYMT.js";
+import "./chunk-SYFF4UFD.js";
 
 // src/cli.ts
 var code = await runCli(

package/dist/index.d.ts

@@ -775,6 +775,29 @@ declare class BehaviorState {
     decisions(): Decisions;
 }
 
+/** A caller-supplied RS256 signing key pair. `kid` is published in the JWKS and token headers. */
+type SigningKey = {
+    privateJwk: JsonWebKey;
+    publicJwk: JsonWebKey;
+    kid: string;
+};
+/**
+ * Opt-in control over every opaque value the provider mints. With none of these set the provider
+ * uses cryptographic randomness, exactly as before.
+ */
+type CredentialOptions = {
+    /**
+     * Derive authorization codes, tokens, transaction ids, session ids, CSP nonces and signing keys
+     * from `seed` (default 0) instead of `crypto`, so the same seed and the same requests replay
+     * byte-for-byte. Test-only: the values are guessable.
+     */
+    deterministicCredentials?: boolean;
+    /** Replaces `crypto.getRandomValues` for every minted value, and wins over the seeded source. */
+    randomBytes?: (length: number) => Uint8Array;
+    /** Signing keys used in order: the first is current and each rotation takes the next. */
+    signingKeys?: SigningKey[];
+};
+
 type Provider = "google" | "apple" | "oidc" | "microsoft" | "github";
 type Account = {
     id: string;
@@ -1053,7 +1076,7 @@ type OAuthMultiRuntime = {
 /** Compose independent provider runtimes behind exact path mounts on one listener. */
 declare function createMultiRuntime(options: OAuthMultiRuntimeOptions): OAuthMultiRuntime;
 
-type OAuthAPIOptions = APIOptions & {
+type OAuthAPIOptions = APIOptions & CredentialOptions & {
     /** Browser Fetch forbids Cookie/Set-Cookie; local transports may explicitly remap them. */
     cookieHeaders?: {
         request: string;
@@ -1068,7 +1091,7 @@ type OAuthAPIOptions = APIOptions & {
     accounts?: Account[];
     clients?: Client[];
     behavior?: BehaviorInput;
-    /** Replays behavior choices, never credentials. */
+    /** Replays behavior choices; also credentials when `deterministicCredentials` is set. */
     seed?: number | string;
     /** CSP nonce source for form-post responses. Defaults to `crypto.randomUUID`. */
     nonce?: () => string;
@@ -1088,9 +1111,10 @@ declare class OAuthAPI {
     private readonly sessions;
     private readonly consents;
     private signer;
+    private readonly credentials;
     private previousSigners;
     /** Never published: signs ID tokens for `tokens.idTokenSigningKey: "unpublished"`. */
-    private unpublishedSigner?;
+    private unpublishedSigner;
     readonly behavior: BehaviorState;
     private readonly identities;
     private readonly appleDisclosures;
@@ -1160,4 +1184,4 @@ declare class OAuthAPI {
 }
 
 export { OAUTH_PRESETS, OAUTH_SCENARIOS, OAuthAPI, createMultiRuntime, createRuntime, document, operationIds, supportedOperationIds };
-export type { Account, AppleNotificationType, BehaviorEvent, BehaviorInput, Client, EdgeCase, GrantView, NotificationDelivery, OAuthAPIOptions, OAuthBehavior, OAuthMount, OAuthMultiRuntime, OAuthMultiRuntimeOptions, OAuthRuntime, OAuthRuntimeOptions, OAuthScenario, Provider };
+export type { Account, AppleNotificationType, BehaviorEvent, BehaviorInput, Client, CredentialOptions, EdgeCase, GrantView, NotificationDelivery, OAuthAPIOptions, OAuthBehavior, OAuthMount, OAuthMultiRuntime, OAuthMultiRuntimeOptions, OAuthRuntime, OAuthRuntimeOptions, OAuthScenario, Provider, SigningKey };

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   document,
   operationIds,
   supportedOperationIds
-} from "./chunk-WHI7Y2UA.js";
+} from "./chunk-SYFF4UFD.js";
 export {
   OAUTH_PRESETS,
   OAUTH_SCENARIOS,

package/dist/server.d.ts

@@ -1314,6 +1314,29 @@ declare class BehaviorState {
     decisions(): Decisions;
 }
 
+/** A caller-supplied RS256 signing key pair. `kid` is published in the JWKS and token headers. */
+type SigningKey = {
+    privateJwk: JsonWebKey;
+    publicJwk: JsonWebKey;
+    kid: string;
+};
+/**
+ * Opt-in control over every opaque value the provider mints. With none of these set the provider
+ * uses cryptographic randomness, exactly as before.
+ */
+type CredentialOptions = {
+    /**
+     * Derive authorization codes, tokens, transaction ids, session ids, CSP nonces and signing keys
+     * from `seed` (default 0) instead of `crypto`, so the same seed and the same requests replay
+     * byte-for-byte. Test-only: the values are guessable.
+     */
+    deterministicCredentials?: boolean;
+    /** Replaces `crypto.getRandomValues` for every minted value, and wins over the seeded source. */
+    randomBytes?: (length: number) => Uint8Array;
+    /** Signing keys used in order: the first is current and each rotation takes the next. */
+    signingKeys?: SigningKey[];
+};
+
 type Provider = "google" | "apple" | "oidc" | "microsoft" | "github";
 type Account = {
     id: string;
@@ -1389,7 +1412,7 @@ type GrantView = {
     userDisclosed: boolean;
 };
 
-type OAuthAPIOptions = APIOptions & {
+type OAuthAPIOptions = APIOptions & CredentialOptions & {
     /** Browser Fetch forbids Cookie/Set-Cookie; local transports may explicitly remap them. */
     cookieHeaders?: {
         request: string;
@@ -1404,7 +1427,7 @@ type OAuthAPIOptions = APIOptions & {
     accounts?: Account[];
     clients?: Client[];
     behavior?: BehaviorInput;
-    /** Replays behavior choices, never credentials. */
+    /** Replays behavior choices; also credentials when `deterministicCredentials` is set. */
     seed?: number | string;
     /** CSP nonce source for form-post responses. Defaults to `crypto.randomUUID`. */
     nonce?: () => string;
@@ -1424,9 +1447,10 @@ declare class OAuthAPI {
     private readonly sessions;
     private readonly consents;
     private signer;
+    private readonly credentials;
     private previousSigners;
     /** Never published: signs ID tokens for `tokens.idTokenSigningKey: "unpublished"`. */
-    private unpublishedSigner?;
+    private unpublishedSigner;
     readonly behavior: BehaviorState;
     private readonly identities;
     private readonly appleDisclosures;

package/dist/server.js

@@ -3,8 +3,8 @@ import {
   createMultiServer,
   createServer,
   serveTarget
-} from "./chunk-MKBPAVYU.js";
-import "./chunk-WHI7Y2UA.js";
+} from "./chunk-D4IAZYMT.js";
+import "./chunk-SYFF4UFD.js";
 export {
   DEFAULT_PORT,
   createMultiServer,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crvouga/mockingbird-service-oauth",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Portable social-login mock with Google, Apple, Microsoft, GitHub and generic OIDC profiles, private relay identities, reproducible edge cases, signed tokens and an accessible UI.",
   "license": "MIT",
   "type": "module",