@crvouga/mockingbird-service-oauth 3.11.7 → 3.11.8

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog — @crvouga/mockingbird-service-oauth
 
+## 3.11.8 (2026-11-03)
+
+### Fixes and improvements
+
+- rewrite mounted HTML for any media type case, formaction, srcset and meta refresh ([c70f512](https://github.com/crvouga/mockingbird/commit/c70f5126a340da0217d0217fb9652daf465e1ecb))
+- show a placeholder for an audit event without a time ([2b2611b](https://github.com/crvouga/mockingbird/commit/2b2611b1af75fc48ec91e07ba15b96372946695f))
+- attach the snapshot download link and revoke its URL later ([a106903](https://github.com/crvouga/mockingbird/commit/a106903abe9d7d5def7f2857e2d7644c4ebcdae2))
+- revoke the tokens issued from an authorization code when the code is replayed ([f603a9a](https://github.com/crvouga/mockingbird/commit/f603a9ab2653eb8a3669f4a40acc05295906b7a1))
+- stop the page-hide save inheriting the last write's result as `force` ([551c2dc](https://github.com/crvouga/mockingbird/commit/551c2dcd3615f82e70e0cd0b8a11c82a663d18b6))
+- keep the record id in the State table's id column ([2fc9bee](https://github.com/crvouga/mockingbird/commit/2fc9beeba6dd8bfe129993a4ff53fbd2925bf569))
+- prune idempotency keys after 24 hours on the mock clock ([094c8b1](https://github.com/crvouga/mockingbird/commit/094c8b124211ae02901c26eb96cca410434b855a))
+- drop the previous emulator's manifest when switching emulators ([7ed4666](https://github.com/crvouga/mockingbird/commit/7ed46661288662a3789dbe013f1a195905b217e4))
+- reject a migration list that repeats an id, naming it ([47721d9](https://github.com/crvouga/mockingbird/commit/47721d96a29f4b5184322d19c1b10750086e8da4))
+- reserve the manual admin view id ([3d4da92](https://github.com/crvouga/mockingbird/commit/3d4da926182ce609fba44e0fd58abcbb253eee2c))
+
+### Dependencies
+
+- `@crvouga/mockingbird-service-sqlite`
+
 ## 3.11.7 (2026-11-02)
 
 ### Fixes and improvements

package/README.md

@@ -175,7 +175,7 @@ tapping `oauth-mock-form-post-continue`; with scripts, the page submits the form
 - Authorization-code flow with exact redirect matching, including explicitly registered private-use URI schemes for native apps, state and nonce; duplicate parameters rejected. Invalid clients/callbacks never redirect. Public native clients require S256 PKCE unless the client opts in with `pkceOptional`.
 - Real RSA-2048 / RS256 ID tokens and independent public JWKS; correct issuer, audience, expiry, auth time and scope-filtered claims. Keys remain stable until explicitly rotated.
 - Codes expire after 5 minutes and are consumed atomically, including concurrent PKCE redemption. Access/ID tokens last 1 hour. Generic OIDC refresh tokens default to 30 days; Microsoft defaults to 90 days. Apple/Google refresh tokens have no fixed deadline by default; Google inactivity, testing mode and issuance limits still apply. GitHub OAuth app access tokens have no fixed deadline in the emulator. The injected emulator clock controls expiry.
-- Google `access_type=offline` issues refresh tokens on first consent or `prompt=consent`; generic/Microsoft `offline_access` and Apple issue refresh tokens. Refresh cannot expand scopes. Revocation invalidates related access and refresh tokens; unknown tokens succeed idempotently. Refresh tokens are reusable by default; Microsoft returns a replacement without invalidating the old token. Opt-in strict rotation detects reuse and revokes the token family.
+- Google `access_type=offline` issues refresh tokens on first consent or `prompt=consent`; generic/Microsoft `offline_access` and Apple issue refresh tokens. Refresh cannot expand scopes. Revocation invalidates related access and refresh tokens; unknown tokens succeed idempotently. Refresh tokens are reusable by default; Microsoft returns a replacement without invalidating the old token. Opt-in strict rotation detects reuse and revokes the token family. Authorization codes are single-use: replaying a redeemed code fails with `invalid_grant` and revokes every access and refresh token issued from it ([RFC 6749 §4.1.2](https://www.rfc-editor.org/rfc/rfc6749#section-4.1.2)).
 - `prompt=none` returns `login_required` or `consent_required`; `login`, `consent`, `select_account`, `login_hint` and `max_age` are supported. HttpOnly, SameSite=Lax browser sessions last 24 hours. Cancel returns `access_denied` with state.
 - Apple supports `code id_token`, `c_hash`, `form_post` with an automatic POST and a no-JavaScript Continue button, string `email_verified` / `is_private_email`, no userinfo endpoint, and first-consent-only `user` data. `name` / `email` scopes require `form_post`.
 - Semantic server-rendered HTML needs no frontend framework, hydration, external fonts, images or network assets. Native forms, labelled fields, visible focus rings, a skip link, error announcements, responsive layout, reduced-motion preference and automatic system light/dark colors are included.

package/dist/{chunk-S2EGDFOQ.js → chunk-EJPEJFKC.js}

@@ -11,7 +11,7 @@ import {
   parseFaultHeader,
   resolveAdminPrefix,
   restoreClock
-} from "./chunk-BWGDZLMA.js";
+} from "./chunk-X6Z2EBEA.js";
 
 // src/server.ts
 import { readFile as readFile6 } from "node:fs/promises";
@@ -3062,7 +3062,7 @@ async function preflightFleet(config, options) {
             break;
         }
       }
-      targets.set(name, { ...target, packageVersion: packageVersion ?? "3.11.7" });
+      targets.set(name, { ...target, packageVersion: packageVersion ?? "3.11.8" });
     } catch (error) {
       throw new Error(`service ${name}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -5062,4 +5062,4 @@ export {
   createMultiServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-S2EGDFOQ.js.map
+//# sourceMappingURL=chunk-EJPEJFKC.js.map