@gjermundgaraba/clankerauth-dev 0.9.0 → 0.11.0

package/dist/web/index.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="color-scheme" content="light" />
     <title>clankerauth</title>
-    <script type="module" crossorigin src="/assets/index-Bi2toh59.js"></script>
+    <script type="module" crossorigin src="/assets/index-By6qXbiL.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-9VtsK-ro.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/clankerauth-dev",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Disposable local clankerauth issuer for application development",
   "license": "MIT",
   "repository": {
@@ -21,10 +21,6 @@
     "./edge": {
       "types": "./dist/edge.d.ts",
       "import": "./dist/edge.mjs"
-    },
-    "./testing": {
-      "types": "./dist/testing.d.ts",
-      "import": "./dist/testing.mjs"
     }
   },
   "publishConfig": {
@@ -32,14 +28,14 @@
   },
   "devDependencies": {
     "@clankerauth/admin-api": "0.1.0",
-    "@clankerauth/server": "0.9.0",
+    "@clankerauth/server": "0.11.0",
     "@clankerauth/web": "0.1.0",
-    "@effect/platform-node": "4.0.0-rc.117",
+    "@effect/platform-node": "4.0.0-rc.118",
     "@opentelemetry/api": "1.9.1",
-    "effect": "4.0.0-rc.117",
+    "effect": "4.0.0-rc.118",
     "jose": "6.2.12",
-    "vite": "npm:@voidzero-dev/vite-plus-core@0.3.3",
-    "vite-plus": "0.3.3"
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.0.0",
+    "vite-plus": "1.0.0"
   },
   "engines": {
     "node": ">=26"

package/dist/generate_key_pair-ExJspZNk.mjs

@@ -1 +0,0 @@
-const e=new TextEncoder,t=new TextDecoder,n=new TextDecoder(`utf-8`,{fatal:!0}),r=2**32;function i(...e){let t=e.reduce((e,{length:t})=>e+t,0),n=new Uint8Array(t),r=0;for(let t of e)n.set(t,r),r+=t.length;return n}function a(e,t,n){if(t<0||t>=r)throw RangeError(`value must be >= 0 and <= ${r-1}. Received ${t}`);e.set([t>>>24,t>>>16,t>>>8,t&255],n)}function o(e){let t=Math.floor(e/r),n=e%r,i=/* @__PURE__ */ new Uint8Array(8);return a(i,t,0),a(i,n,4),i}function s(e){let t=/* @__PURE__ */ new Uint8Array(4);return a(t,e),t}const c=/[^\x00-\x7f]/;function l(t){if(typeof t==`string`&&t.length>=128){if(c.test(t))throw TypeError(`non-ASCII string encountered in encode()`);return e.encode(t)}let n=new Uint8Array(t.length);for(let e=0;e<t.length;e++){let r=t.charCodeAt(e);if(r>127)throw TypeError(`non-ASCII string encountered in encode()`);n[e]=r}return n}function u(e,t=!1){if(Uint8Array.prototype.toBase64)return e.toBase64({alphabet:t?`base64url`:`base64`,omitPadding:t});let n=32768,r=[];for(let t=0;t<e.length;t+=n)r.push(String.fromCharCode.apply(null,e.subarray(t,t+n)));let i=btoa(r.join(``));return t?i.replace(/=/g,``).replace(/\+/g,`-`).replace(/\//g,`_`):i}function d(e,t=!1){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e,{alphabet:t?`base64url`:`base64`});if(t){if(e.includes(`+`)||e.includes(`/`))throw TypeError(`Invalid base64url`);e=e.replace(/-/g,`+`).replace(/_/g,`/`)}let n=atob(e),r=new Uint8Array(n.length);for(let e=0;e<n.length;e++)r[e]=n.charCodeAt(e);return r}async function f(e,t){let n=`SHA-${e.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(n,t))}var p=class extends Error{static code=`ERR_JOSE_GENERIC`;code=`ERR_JOSE_GENERIC`;constructor(e,t){super(e,t),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}},m=class extends p{static code=`ERR_JWT_CLAIM_VALIDATION_FAILED`;code=`ERR_JWT_CLAIM_VALIDATION_FAILED`;claim;reason;payload;constructor(e,t,n=`unspecified`,r=`unspecified`){super(e,{cause:{claim:n,reason:r,payload:t}}),this.claim=n,this.reason=r,this.payload=t}},h=class extends p{static code=`ERR_JWT_EXPIRED`;code=`ERR_JWT_EXPIRED`;claim;reason;payload;constructor(e,t,n=`unspecified`,r=`unspecified`){super(e,{cause:{claim:n,reason:r,payload:t}}),this.claim=n,this.reason=r,this.payload=t}},g=class extends p{static code=`ERR_JOSE_ALG_NOT_ALLOWED`;code=`ERR_JOSE_ALG_NOT_ALLOWED`},_=class extends p{static code=`ERR_JOSE_NOT_SUPPORTED`;code=`ERR_JOSE_NOT_SUPPORTED`},v=class extends p{static code=`ERR_JWE_DECRYPTION_FAILED`;code=`ERR_JWE_DECRYPTION_FAILED`;constructor(e=`decryption operation failed`,t){super(e,t)}},y=class extends p{static code=`ERR_JWE_INVALID`;code=`ERR_JWE_INVALID`},b=class extends p{static code=`ERR_JWS_INVALID`;code=`ERR_JWS_INVALID`},x=class extends p{static code=`ERR_JWT_INVALID`;code=`ERR_JWT_INVALID`},ee=class extends p{static code=`ERR_JWK_INVALID`;code=`ERR_JWK_INVALID`},te=class extends p{static code=`ERR_JWKS_INVALID`;code=`ERR_JWKS_INVALID`},ne=class extends p{static code=`ERR_JWKS_NO_MATCHING_KEY`;code=`ERR_JWKS_NO_MATCHING_KEY`;constructor(e=`no applicable key found in the JSON Web Key Set`,t){super(e,t)}},re=class extends p{[Symbol.asyncIterator]=async function*(){};static code=`ERR_JWKS_MULTIPLE_MATCHING_KEYS`;code=`ERR_JWKS_MULTIPLE_MATCHING_KEYS`;constructor(e=`multiple matching keys found in the JSON Web Key Set`,t){super(e,t)}},ie=class extends p{static code=`ERR_JWKS_TIMEOUT`;code=`ERR_JWKS_TIMEOUT`;constructor(e=`request timed out`,t){super(e,t)}},ae=class extends p{static code=`ERR_JWS_SIGNATURE_VERIFICATION_FAILED`;code=`ERR_JWS_SIGNATURE_VERIFICATION_FAILED`;constructor(e=`signature verification failed`,t){super(e,t)}};function S(e){try{return d(typeof e==`string`?e:t.decode(e),!0)}catch(e){throw TypeError(`The input to be decoded is not correctly encoded.`,{cause:e})}}function C(t){return u(typeof t==`string`?e.encode(t):t,!0)}function oe(e,t){if(!(e instanceof Uint8Array))throw TypeError(`${t} must be an instance of Uint8Array`)}function w(e){if(typeof e!=`object`||!e||Object.prototype.toString.call(e)!==`[object Object]`)return!1;let t=Object.getPrototypeOf(e);return t===null||Object.getPrototypeOf(t)===null}function se(e){return w(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(w)}function ce(...e){let t=/* @__PURE__ */ new Set;for(let n of e)if(n)for(let e of Object.keys(n)){if(t.has(e))return!1;t.add(e)}return!0}function le(e,t){if(e!==void 0)throw TypeError(`${t} can only be called once`)}function ue(e,t,n){try{return S(e)}catch{throw new n(`Failed to base64url decode the ${t}`)}}function de(e,t,n){try{return l(e)}catch{throw new n(`The ${t} is not a valid base64url string`)}}function fe(e,t,r){let i;try{i=JSON.parse(n.decode(S(e)))}catch{throw new t(r)}if(!w(i))throw new t(r);return i}const pe={__proto__:null,b64:!0},me={__proto__:null};function he(e,t){if(t!==void 0&&(!Array.isArray(t)||t.some(e=>typeof e!=`string`)))throw TypeError(`"${e}" option must be an array of strings`);return t===void 0?void 0:new Set(t)}function ge(e,t){let{crit:n}=t??{};if(Array.isArray(n)&&new Set(n).size!==n.length)throw new e(`"crit" (Critical) Header Parameter MUST NOT contain duplicate values`)}function _e(e,t,n,r,i){if(i.crit!==void 0&&r?.crit===void 0)throw new e(`"crit" (Critical) Header Parameter MUST be integrity protected`);if(!r||r.crit===void 0)return[];if(!Array.isArray(r.crit)||r.crit.length===0||r.crit.some(e=>typeof e!=`string`||e.length===0))throw new e(`"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present`);let a=n===void 0?t:{__proto__:null,...n,...t};for(let t of r.crit){if(!(t in a))throw new _(`Extension Header Parameter "${t}" is not recognized`);if(!Object.hasOwn(i,t)||i[t]===void 0)throw new e(`Extension Header Parameter "${t}" is missing`);if(a[t]&&(!Object.hasOwn(r,t)||r[t]===void 0))throw new e(`Extension Header Parameter "${t}" MUST be integrity protected`)}return r.crit}function ve(e,t){if(t.includes(`b64`)){let t=e.b64;if(typeof t!=`boolean`)throw new b(`The "b64" (base64url-encode payload) Header Parameter must be a boolean`);return t}return!0}function T(e,t){let n,r;try{n=JSON.stringify(t),r=JSON.parse(n)}catch(t){throw new e(`JOSE Header is not valid JSON`,{cause:t})}if(!w(r))throw new e(`JOSE Header is not a JSON object`);return[r,n]}const ye=e=>e[Symbol.toStringTag],be=(e,t,n)=>{let{alg:r}=e;if(t.use!==void 0){let e=n===`sign`||n===`verify`?`sig`:`enc`;if(t.use!==e)throw TypeError(`Invalid key for this operation, its "use" must be "${e}" when present`)}if(t.alg!==void 0&&t.alg!==r)throw TypeError(`Invalid key for this operation, its "alg" must be "${r}" when present`);if(Array.isArray(t.key_ops)){let r=n===`encrypt`||n===`decrypt`?e.ops?.[n===`encrypt`?0:1]:n;if(r&&!t.key_ops.includes(r))throw TypeError(`Invalid key for this operation, its "key_ops" must include "${r}" when present`)}};async function xe(e,t,n){let{alg:r,secret:i}=e,a=n===`decrypt`||n===`sign`;if(i&&t instanceof Uint8Array)return t;let o,s;if(w(t)){if(o=Ne(t),typeof o.kty!=`string`)throw Oe(r,t,i);if(!(i?o.kty===`oct`&&typeof o.k==`string`:o.kty!==`oct`&&(a?o.kty===`AKP`&&typeof o.priv==`string`||typeof o.d==`string`:o.d===void 0&&o.priv===void 0)))throw TypeError(i?`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`:`JSON Web Key for this operation must be a ${a?`private`:`public`} JWK`);if(be(e,o,n),o.kty===`oct`)return S(o.k);if(!Object.isFrozen(t)){let{key_ops:e}=t;Array.isArray(e)&&Object.freeze(e),Object.freeze(t)}}else{if(!Te(t))throw Oe(r,t,i);let e=i?`secret`:a?`private`:`public`;if(t.type!==e&&(i||[`secret`,`public`,`private`].includes(t.type)))throw TypeError(`${ye(t)} instances must be of type "${e}" for the ${r} algorithm`);if(D(t))return t;if(s=t,s.type===`secret`)return s.export()}E||=/* @__PURE__ */ new WeakMap;let c=t,l=E.get(c);if(l?.[r])return l[r];if(l||E.set(c,l={}),s&&typeof s.toCryptoKey==`function`){let t=s.type===`public`,n=Se[s.asymmetricKeyDetails?.namedCurve],i=e.resolve?.({crv:n,asymmetricKeyType:s.asymmetricKeyType})??e.subtle;return l[r]=s.toCryptoKey(i,t,e.usages[+!t])}return o??=s.export({format:`jwk`}),o.alg=r,l[r]=await Fe(e,o)}let E;const Se={__proto__:null,prime256v1:`P-256`,secp384r1:`P-384`,secp521r1:`P-521`};function Ce(e){if(!D(e))throw Error(`CryptoKey instance expected`)}const D=e=>{if(e?.[Symbol.toStringTag]===`CryptoKey`)return!0;try{return e instanceof CryptoKey}catch{return!1}},we=e=>e?.[Symbol.toStringTag]===`KeyObject`,Te=e=>D(e)||we(e);function Ee(e,t,...n){if(n.length>2){let t=n.pop();e+=`one of type ${n.join(`, `)}, or ${t}.`}else n.length===2?e+=`one of type ${n[0]} or ${n[1]}.`:e+=`of type ${n[0]}.`;return t==null?e+=` Received ${t}`:typeof t==`function`&&t.name?e+=` Received function ${t.name}`:typeof t==`object`&&t&&t.constructor?.name&&(e+=` Received an instance of ${t.constructor.name}`),e}const De=(e,...t)=>Ee(`Key must be `,e,...t);function Oe(e,t,n){let r=[`CryptoKey`,`KeyObject`,`JSON Web Key`];return n&&r.push(`Uint8Array`),TypeError(Ee(`Key for the ${e} algorithm must be `,t,...r))}const O=(e,t=`algorithm.name`)=>/* @__PURE__ */ TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);function ke(e,t){if(t&&!e.usages.includes(t))throw TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function Ae(e,t){let{modulusLength:n}=t.algorithm;if(typeof n!=`number`||n<2048)throw TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}function je(e,t,n){let r=e.algorithm;if(r.name!==t.name)throw O(t.name);if(t.hash&&r.hash?.name!==t.hash)throw O(t.hash,`algorithm.hash`);if(t.namedCurve&&r.namedCurve!==t.namedCurve)throw O(t.namedCurve,`algorithm.namedCurve`);if(t.length!==void 0&&r.length!==t.length)throw O(t.length,`algorithm.length`);ke(e,n)}function Me(e){return{__proto__:null,...e}}function Ne(e){let t=Me(e);if(t.ext!==void 0&&typeof t.ext!=`boolean`)throw TypeError(`"ext" (Extractable) Parameter must be a boolean`);if(t.key_ops!==void 0){let e=t.key_ops,n=Array.isArray(e)?[...e]:void 0;if(!n||n.some(e=>typeof e!=`string`)||new Set(n).size!==n.length)throw TypeError(`"key_ops" (Key Operations) Parameter must be an array of unique strings`);t.key_ops=n}return t}function Pe(e){if(e!==void 0&&typeof e!=`boolean`)throw TypeError(`"extractable" option must be a boolean`);return e}async function Fe(e,t,n){if(!e.kty.includes(t.kty))throw new _(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value`);let r=e.resolve?.({kty:t.kty,crv:t.crv})??e.subtle,i=!!(t.d||t.priv),a={...t,ext:n??t.ext};return a.kty!==`AKP`&&delete a.alg,delete a.use,crypto.subtle.importKey(`jwk`,a,r,a.ext??!i,t.key_ops??e.usages[+!!i])}async function Ie(e,t,n,r=!1){return e instanceof Uint8Array&&(e=await crypto.subtle.importKey(`raw`,e,t,r,[n])),je(e,t,n),e}function k(e){let t={__proto__:null};for(let n in e)t[n]={...e[n],alg:n};return t}const Le=[[`encrypt`,`wrapKey`],[`decrypt`,`unwrapKey`]],Re=[[],[`deriveBits`]],A=[[],[]];function j(e){return{kty:[`RSA`],mode:`key-encryption`,subtle:{name:`RSA-OAEP`,hash:`SHA-${e}`},usages:Le,ops:[`wrapKey`,`unwrapKey`]}}function M(e){return{kty:[`EC`,`OKP`],mode:e,subtle:{name:`ECDH`},resolve:({kty:e,crv:t,asymmetricKeyType:n})=>{if(t===`X25519`||n===`x25519`)return{name:`X25519`};if(e===`OKP`)throw new _(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value`);return{name:`ECDH`,namedCurve:t}},usages:Re,ops:[void 0,`deriveBits`]}}function N(e,t=!1){return{kty:[`oct`],mode:`key-wrapping`,secret:!0,subtle:{name:t?`AES-GCM`:`AES-KW`,length:e},usages:A,ops:t?[`encrypt`,`decrypt`]:[`wrapKey`,`unwrapKey`]}}function P(){return{kty:[`oct`],mode:`key-wrapping`,secret:!0,subtle:{name:`PBKDF2`},usages:A,ops:[`deriveBits`,`deriveBits`]}}const F=k({dir:{kty:[`oct`],mode:`direct-encryption`,secret:!0,subtle:{name:`AES-GCM`},usages:A,ops:[`encrypt`,`decrypt`]},"RSA-OAEP":j(1),"RSA-OAEP-256":j(256),"RSA-OAEP-384":j(384),"RSA-OAEP-512":j(512),"ECDH-ES":M(`direct-key-agreement`),"ECDH-ES+A128KW":M(`key-agreement-with-key-wrapping`),"ECDH-ES+A192KW":M(`key-agreement-with-key-wrapping`),"ECDH-ES+A256KW":M(`key-agreement-with-key-wrapping`),A128KW:N(128),A192KW:N(192),A256KW:N(256),A128GCMKW:N(128,!0),A192GCMKW:N(192,!0),A256GCMKW:N(256,!0),"PBES2-HS256+A128KW":P(),"PBES2-HS384+A192KW":P(),"PBES2-HS512+A256KW":P()}),ze=[`encrypt`,`decrypt`];function I(e,t=!1){return{kty:[`oct`],secret:!0,subtle:{name:t?`AES-CBC`:`AES-GCM`,length:e},usages:A,ops:ze,cekBits:e,ivBits:t?128:96,cbc:t}}const Be=k({A128GCM:I(128),A192GCM:I(192),A256GCM:I(256),"A128CBC-HS256":I(256,!0),"A192CBC-HS384":I(384,!0),"A256CBC-HS512":I(512,!0)});function Ve(e,t){throw new _(`Invalid or unsupported "${e}" (JWE ${t}) header value`)}function He(e){return(typeof e==`string`?F[e]:void 0)??Ve(`alg`,`Algorithm`)}function Ue(e){return e.mode===`key-wrapping`||e.mode===`key-encryption`||e.mode===`key-agreement-with-key-wrapping`}function We(e){return(typeof e==`string`?Be[e]:void 0)??Ve(`enc`,`Encryption Algorithm`)}const L=[[`verify`],[`sign`]];function R(e){let t={name:`HMAC`,hash:`SHA-${e}`};return{kty:[`oct`],secret:!0,subtle:t,signing:t,usages:L}}function z(e,t){let n={name:t?`RSA-PSS`:`RSASSA-PKCS1-v1_5`,hash:`SHA-${e}`};return{kty:[`RSA`],subtle:n,signing:t?{...n,saltLength:t}:n,usages:L,minRsaBits:2048}}function B(e,t){return{kty:[`EC`],crv:e,subtle:{name:`ECDSA`,namedCurve:e},signing:{name:`ECDSA`,hash:`SHA-${t}`},usages:L}}function Ge(){let e={name:`Ed25519`};return{kty:[`OKP`],crv:`Ed25519`,subtle:e,signing:e,usages:L}}function V(e){let t={name:`ML-DSA-${e}`};return{kty:[`AKP`],subtle:t,signing:t,usages:L}}const H=k({HS256:R(256),HS384:R(384),HS512:R(512),RS256:z(256),RS384:z(384),RS512:z(512),PS256:z(256,32),PS384:z(384,48),PS512:z(512,64),ES256:B(`P-256`,256),ES384:B(`P-384`,384),ES512:B(`P-521`,512),EdDSA:Ge(),Ed25519:Ge(),"ML-DSA-44":V(44),"ML-DSA-65":V(65),"ML-DSA-87":V(87)});function Ke(e){let t=typeof e==`string`?H[e]:void 0;if(!t)throw new _(`alg ${e} is not supported either by JOSE or your javascript runtime`);return t}const U=e=>Math.floor(e.getTime()/1e3),qe={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},Je=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,W=`check_failed`;function G(){throw TypeError(`Invalid time period format`)}function K(e){typeof e!=`string`&&G();let t=Je.exec(e);(!t||t[4]&&t[1])&&G();let n=parseFloat(t[2]),r=Math.round(n*qe[t[3][0].toLowerCase()]);return Number.isFinite(r)||G(),t[1]===`-`||t[4]===`ago`?-r:r}function q(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function J(e,t){if(typeof t!=`string`)throw TypeError(`"${e}" claim must be a string`)}function Ye(e){if(typeof e!=`string`&&(!Array.isArray(e)||Array.from(e).some(e=>typeof e!=`string`)))throw TypeError(`"aud" claim must be a string or an array of strings`)}function Y(e,t){return typeof e==`number`?q(t,e):e instanceof Date?q(t,U(e)):U(/* @__PURE__ */ new Date)+K(e)}const Xe=e=>{let t=e.toLowerCase();return e.includes(`/`)?t:`application/${t}`},Ze=(e,t)=>typeof e==`string`?t.includes(e):Array.isArray(e)?t.some(t=>e.includes(t)):!1;function X(e,t,n=!1){let r=e[t];if(r!==void 0||n){if(typeof r!=`number`)throw new m(`"${t}" claim must be a number`,e,t,`invalid`);return r}}function Z(e,t){throw new m(`unexpected "${t}" claim value`,e,t,W)}function Qe(e,t,r={}){let i;try{i=JSON.parse(n.decode(t))}catch{}if(!w(i))throw new x(`JWT Claims Set must be a top-level JSON object`);let{typ:a}=r;if(a!==void 0&&(typeof e.typ!=`string`||Xe(e.typ)!==Xe(a)))throw new m(`unexpected "typ" JWT header value`,i,`typ`,W);let{requiredClaims:o=[],issuer:s,subject:c,audience:l,maxTokenAge:u}=r,d=[...o];u!==void 0&&d.push(`iat`),l!==void 0&&d.push(`aud`),c!==void 0&&d.push(`sub`),s!==void 0&&d.push(`iss`);for(let e of new Set(d.reverse()))if(!Object.hasOwn(i,e))throw new m(`missing required "${e}" claim`,i,e,`missing`);s!==void 0&&!(Array.isArray(s)?s:[s]).includes(i.iss)&&Z(i,`iss`),c!==void 0&&i.sub!==c&&Z(i,`sub`),l!==void 0&&!Ze(i.aud,typeof l==`string`?[l]:l)&&Z(i,`aud`);let{clockTolerance:f}=r,p=0;if(typeof f==`string`)p=K(f);else if(f!==void 0){if(typeof f!=`number`)throw TypeError(`Invalid clockTolerance option type`);p=f}q(`clockTolerance option`,p);let{currentDate:g}=r,_=q(`currentDate option`,U(g===void 0?/* @__PURE__ */ new Date:g)),v=X(i,`iat`,u!==void 0),y=X(i,`nbf`);if(y!==void 0&&y>_+p)throw new m(`"nbf" claim timestamp check failed`,i,`nbf`,W);let b=X(i,`exp`);if(b!==void 0&&b<=_-p)throw new h(`"exp" claim timestamp check failed`,i,`exp`,W);if(u!==void 0){let e=_-v,t=q(`maxTokenAge option`,typeof u==`number`?u:K(u));if(e-p>t)throw new h(`"iat" claim timestamp check failed (too far in the past)`,i,`iat`,W);if(e<-p)throw new m(`"iat" claim timestamp check failed (it should be in the past)`,i,`iat`,W)}return i}let Q;function $(e){return Q.get(e)}function $e(t){let n=$(t);for(let e of[`iat`,`nbf`,`exp`]){let t=n[e];if(typeof t==`number`&&!Number.isFinite(t))throw TypeError(`"${e}" claim must be a finite number`)}return e.encode(JSON.stringify(n))}function et(e,t){return $(e)[t]}var tt=class{constructor(e={}){if(!w(e))throw TypeError(`JWT Claims Set MUST be an object`);(Q||=/* @__PURE__ */ new WeakMap).set(this,structuredClone(e))}setIssuer(e){return J(`iss`,e),$(this).iss=e,this}setSubject(e){return J(`sub`,e),$(this).sub=e,this}setAudience(e){return Ye(e),$(this).aud=e,this}setJti(e){return J(`jti`,e),$(this).jti=e,this}setNotBefore(e){return $(this).nbf=Y(e,`setNotBefore`),this}setExpirationTime(e){return $(this).exp=Y(e,`setExpirationTime`),this}setIssuedAt(e){let t=$(this);return t.iat=e===void 0?U(/* @__PURE__ */ new Date):typeof e==`string`?q(`setIssuedAt`,U(/* @__PURE__ */ new Date)+K(e)):Y(e,`setIssuedAt`),this}};async function nt(t,n,r){let[a,o,s,c]=t,u=``;if(o!==void 0){let e=T(b,o);o=e[0],u=C(e[1])}if(s!==void 0&&(s=T(b,s)[0]),!o&&!s)throw new b(`either setProtectedHeader or setUnprotectedHeader must be called before #sign()`);if(!ce(o,s))throw new b(`JWS Protected and JWS Unprotected Header Parameter names must be disjoint`);let d={...o,...s};ge(b,o);let f=ve(o,_e(b,pe,c,o,d));f||r?.();let{alg:p}=d;if(typeof p!=`string`||!p)throw new b(`JWS "alg" (Algorithm) Header Parameter missing or invalid`);let m=Ke(p),h=``,g=a,_;if(f){let n=t[4];n?(h=n[0]??=C(a),g=n[1]??=l(h)):(h=C(a),_=e.encode(`${u}.${h}`))}_??=i(l(u),l(`.`),g);let v=await Ie(await xe(m,n,`sign`),m.subtle,`sign`);m.minRsaBits&&Ae(m.alg,v);let y={signature:C(new Uint8Array(await crypto.subtle.sign(m.signing,v,_))),payload:h};return o&&(y.protected=u),s&&(y.header=s),[y,f]}async function rt(e,t,n,r,i){let[a]=await nt([e,t,void 0,n],r,i);return`${a.protected}.${a.payload}.${a.signature}`}const it=tt;var at=class extends it{#e;setProtectedHeader(e){return le(this.#e,`setProtectedHeader`),this.#e=e,this}async sign(e,t){return rt($e(this),this.#e,t?.crit,e,()=>{throw new x(`JWTs MUST NOT use unencoded payload`)})}};function ot(e=`JWK "alg" (Algorithm) Parameter`){throw new _(`Invalid or unsupported ${e} value`)}function st(e,t){return(typeof e==`string`?H[e]??F[e]:void 0)??ot(t)}async function ct(e){if(we(e)){if(e.type===`secret`)e=e.export();else return e.export({format:`jwk`})}if(e instanceof Uint8Array)return{kty:`oct`,k:C(e)};if(!D(e))throw TypeError(De(e,`CryptoKey`,`KeyObject`,`Uint8Array`));if(!e.extractable)throw TypeError(`non-extractable CryptoKey cannot be exported as a JWK`);let t=await crypto.subtle.exportKey(`jwk`,e);delete t.ext,delete t.key_ops,delete t.use,t.kty!==`AKP`&&delete t.alg;for(let e of Object.keys(t))t[e]===void 0&&delete t[e];return t}function lt(e){let t=e?.modulusLength??2048;if(typeof t!=`number`||!Number.isInteger(t)||t<2048)throw new _(`Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used`);return t}async function ut(e,t){let n=Pe(t?.extractable),r=st(e,`"alg" (Algorithm)`);r.secret&&ot(`"alg" (Algorithm)`);let i;if(r.resolve){let e=t?.crv??`P-256`;if(![`P-256`,`P-384`,`P-521`,`X25519`].includes(e))throw new _(`Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519`);i=r.resolve({crv:e})}else{if(r.crv!==void 0&&t?.crv!==void 0&&t.crv!==r.crv)throw new _(`Invalid or unsupported crv option provided, the only supported value for ${e} is ${r.crv}`);i=r.kty[0]===`RSA`?{...r.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:lt(t)}:r.subtle}return crypto.subtle.generateKey(i,n??!1,[...r.usages[1],...r.usages[0]])}export{ne as $,le as A,ve as B,Ne as C,Pe as D,Me as E,se as F,g as G,ge as H,w as I,v as J,p as K,fe as L,ue as M,de as N,me as O,ce as P,re as Q,T as R,Fe as S,Ie as T,S as U,_e as V,C as W,ee as X,y as Y,te as Z,Ae as _,tt as a,x as at,D as b,Qe as c,f as ct,F as d,s as dt,ie as et,Ue as f,o as ft,je as g,Ce as h,at as i,h as it,oe as j,pe as k,H as l,l as lt,We as m,ct as n,ae as nt,et as o,i as ot,He as p,_ as q,st as r,m as rt,$e as s,t as st,ut as t,b as tt,Ke as u,n as ut,ke as v,xe as w,Te as x,De as y,he as z};

package/dist/testing.d.ts

@@ -1,40 +0,0 @@
-/** Claims set on a signed token. Each one overrides this issuer's default. */
-export interface TokenClaims {
-    readonly iss?: string;
-    readonly sub?: string;
-    readonly aud?: string | Array<string>;
-    readonly iat?: number;
-    /** Epoch seconds. Default: five minutes from now. */
-    readonly exp?: number;
-    /** Space-separated, as the wire carries it. */
-    readonly scope?: string;
-    readonly client_id?: string;
-    /** Proof of possession, for checking that a sender-constrained token is refused. */
-    readonly cnf?: {
-        readonly jkt: string;
-    };
-}
-export interface FakeIssuerOptions {
-    /** The resource identifier tokens are minted for: an application's public origin root. */
-    readonly resource: string;
-    /** The scopes a signed token carries unless the caller names its own. */
-    readonly scopes: readonly string[];
-    /** Who every credential belongs to. Default `"owner"`. */
-    readonly subject?: string;
-}
-export interface FakeIssuer {
-    /** What a resource server is configured with: `http://127.0.0.1:<port>/api/auth`. */
-    readonly issuer: string;
-    /** Sign an access token this issuer's JWKS verifies. */
-    readonly sign: (claims?: TokenClaims, typ?: string) => Promise<string>;
-    /** Mint an API key the verification endpoint accepts, granted on one resource. */
-    readonly apiKey: (scopes: readonly string[], resource?: string) => string;
-    /** Stop accepting a minted key, so the next verification answers `401`. */
-    readonly revoke: (key: string) => void;
-    /** Answer both endpoints with this status instead of serving them; omit to restore. */
-    readonly fail: (status?: number) => void;
-    /** API-key verifications served, so a test can see that revocation is checked online. */
-    readonly verifications: () => number;
-    readonly close: () => Promise<void>;
-}
-export declare const startFakeIssuer: (options: FakeIssuerOptions) => Promise<FakeIssuer>;

package/dist/testing.mjs

@@ -1 +0,0 @@
-import{i as e,n as t,t as n}from"./generate_key_pair-ExJspZNk.mjs";import{randomBytes as r}from"node:crypto";import{createServer as i}from"node:http";const a=e=>typeof e==`string`,o=e=>{try{let t=JSON.parse(e);if(!(t instanceof Object)||!(`resource`in t))return;let n=t.resource;return a(n)?n:void 0}catch{return}},s=async a=>{let s=a.subject??`owner`,c=await n(`EdDSA`),l={...await t(c.publicKey),kid:`fixture`,alg:`EdDSA`,use:`sig`},u=/* @__PURE__ */ new Map,d=0,f,p=i(async(e,t)=>{let n=(e,n)=>{t.writeHead(e,{"content-type":`application/json`}),t.end(n)};if(e.url===`/api/auth/jwks`)return n(f??200,JSON.stringify({keys:[l]}));if(e.url!==`/api/issuer/verifyApiKey`||e.method!==`POST`)return n(404,`{}`);if(d++,f!==void 0)return n(f,`{}`);let r=u.get(e.headers.authorization?.replace(/^Bearer /iu,``)??``);if(r===void 0)return n(401,`{"error":"Invalid API key"}`);let i=``;for await(let t of e)i+=String(t);let a=o(i);return a===void 0?n(400,`{"error":"Invalid request"}`):a===r.resource?n(200,JSON.stringify({keyId:r.keyId,ownerId:s,resource:r.resource,scopes:r.scopes,expiresAt:null})):n(403,`{"error":"No access to this Resource"}`)});await new Promise(e=>p.listen(0,`127.0.0.1`,e));let m=p.address();if(!(m instanceof Object))throw Error(`The fake issuer failed to bind a TCP port`);let h=`http://127.0.0.1:${m.port}/api/auth`;return{issuer:h,sign:(t={},n=`at+jwt`)=>{let r=Math.floor(Date.now()/1e3);return new e({iss:h,sub:s,aud:a.resource,iat:r,exp:r+300,client_id:`fixture`,scope:a.scopes.join(` `),...t}).setProtectedHeader({alg:`EdDSA`,kid:`fixture`,typ:n}).sign(c.privateKey)},apiKey:(e,t=a.resource)=>{let n=`clankerauth_${r(24).toString(`base64url`)}`;return u.set(n,{keyId:`key-${u.size+1}`,resource:t,scopes:e}),n},revoke:e=>{u.delete(e)},fail:e=>{f=e},verifications:()=>d,close:()=>new Promise((e,t)=>{p.closeAllConnections(),p.close(n=>n?t(n):e())})}};export{s as startFakeIssuer};