@gjermundgaraba/clankerauth-dev 0.7.1 → 0.8.0

package/README.md

@@ -26,7 +26,7 @@ issuer.clientSecret;
 await issuer.close();
 ```
 
-Each call listens on a random loopback port, creates a fresh SQLite database and secret in a temporary directory, provisions the owner, the resources and the client in-process through the server's administration module, and returns. Only the returned issuer is reached over HTTP. The client is first party: once the owner is signed in, an authorization request redirects straight to the callback with a code and no consent step. `close()` drains in-flight requests, closes the database and deletes the directory. Nothing is shared between calls and nothing survives them.
+Each call listens on a random loopback port, creates a fresh SQLite database and secret in a temporary directory, provisions the owner, the resources and the client in-process through the server's administration module, and returns. Only the returned issuer is reached over HTTP. The client is first party: once the owner is signed in, an authorization request redirects straight to the callback with a code and no consent step. `close()` drains in-flight requests, closes the database and deletes the directory. Nothing is shared between calls and nothing survives them. A start that fails, for example on an invalid `cookieDomain`, rejects after doing the same, so it leaves no port bound and nothing to close.
 
 ## Provisioning
 
@@ -53,7 +53,7 @@ Pass `dataDir` and a fixed `port` to keep the issuer's state:
 const issuer = await startDisposableIssuer({ ...options, dataDir: ".dev/auth", port: 5174 });
 ```
 
-The owner account and password, the signing secret, the registered client and the database are kept in that directory, and provisioning is idempotent, so the next start reuses them: the same sign-in works, API keys minted before still verify, and browser storage keyed by the origin survives. A fixed port is part of that, because the origin is what cookies and registered redirect URIs are keyed by. `close()` leaves the directory alone. Treat it as the whole secret of the workspace and keep it out of version control. Without `dataDir`, nothing changes: a temporary directory, a random port, and everything removed by `close()`.
+The owner account and password, the signing secret, the registered client and the database are kept in that directory, and provisioning is idempotent, so the next start reuses them: the same sign-in works, API keys minted before still verify, and browser storage keyed by the origin survives. A fixed port is part of that, because the origin is what cookies and registered redirect URIs are keyed by. `close()` leaves the directory alone. Treat it as the whole secret of the workspace and keep it out of version control. `credentials.json` is written and read by this package alone and is validated against its schema on every start, so an edited or truncated file is refused rather than half-read. Without `dataDir`, nothing changes: a temporary directory, a random port, and everything removed by `close()`.
 
 To develop an app behind forward auth, pass a `cookieDomain`:
 

package/dist/THIRD_PARTY_NOTICES.txt

@@ -418,7 +418,7 @@ SOFTWARE.
 
 ---
 
-@effect/platform-node-shared@4.0.0-rc.116
+@effect/platform-node-shared@4.0.0-rc.117
 LICENSE
 MIT License
 
@@ -445,7 +445,7 @@ SOFTWARE.
 
 ---
 
-@effect/platform-node@4.0.0-rc.116
+@effect/platform-node@4.0.0-rc.117
 LICENSE
 MIT License
 
@@ -472,7 +472,7 @@ SOFTWARE.
 
 ---
 
-@gjermundgaraba/effect-actions@0.4.1
+@gjermundgaraba/effect-actions@0.7.0
 LICENSE
 MIT License
 
@@ -1294,7 +1294,7 @@ SOFTWARE.
 
 ---
 
-effect@4.0.0-rc.116
+effect@4.0.0-rc.117
 LICENSE
 MIT License