@spinajs/authn-keys 0.0.0-stage → 3.0.0

package/README.md

@@ -1,3 +1,166 @@
-# Temporary Holding Version
+# `@spinajs/authn-keys`
+
+Public-key authentication for SpinaJS: a key registry, strict JWS (the
+canvas C8 rules), JWS client assertions, RFC 9421 HTTP signatures and a
+challenge-response login.
+
+## Keys
+
+- Ed25519 (`{ "kty": "OKP", "crv": "Ed25519", "x" }`, RFC 8037) and P-256
+  (`{ "kty": "EC", "crv": "P-256", "x", "y" }`) public JWKs only. The
+  algorithm comes from the key type (`EdDSA`, `ES256`), never from a token.
+- Refused: private parts (`d`), other key types and curves, values that are
+  not strict unpadded base64url of 32 bytes, Ed25519 points that are not
+  canonical or have small order, P-256 points off the curve.
+- `kid`: 1–64 of `[A-Za-z0-9._-]`; default: the RFC 7638 thumbprint.
+- Owners: a user, a service or an agent. A user's key needs a proof of
+  possession (below); services and agents are registered by an admin route
+  or the CLI.
+- Table `authn_key` (migration `AuthnKeys_2026_10_02_00_00_00`).
+
+`DefaultKeyRegistry` implements `KeyRegistry` over a `KeyStore`
+(`OrmKeyStore` by default, `MemoryKeyStore` for tests) and a `SecretStore`.
+The registry and the strategies get their dependencies through DI. Tests
+build them with `new`, passing the dependencies in one object, e.g.
+`new DefaultKeyRegistry({ store, secrets, throttle, options })` or
+`new HttpSignatureStrategy({ registry, nonces, options })`. `OrmKeyStore`
+and `DbKeyNonceStore` inject the `Orm`, so the `authn:key-*` commands bring
+the database up on their own.
+
+## Challenges
+
+`KeyRegistry.challenge` answers `{ id, nonce, expiresAt }`. The client signs
+the UTF-8 bytes of
+
+```
+spinajs-key-<purpose>:<nonce>:<audience>
+```
+
+where `<purpose>` is `register` (proof of possession when a user adds a
+key) or `login` (challenge-response login), `<nonce>` is the `nonce`
+exactly as received (base64url, so it holds no `:`), and `<audience>` is
+the service's `authn.keys.challenge.audience` (default: its
+`authn.keys.assertion.audience`). The client knows the audience from its
+own configuration of the service, never from the challenge answer: a
+service that relays another one's challenge then gets a signature the
+other one refuses. It sends the raw signature as unpadded base64url:
+64 bytes for Ed25519, and for P-256 an ECDSA SHA-256 signature as
+IEEE P1363 `r || s` (64 bytes, not DER). It names the challenge by its
+`id`, unchanged: the id carries the nonce back to the server, so treat it
+as opaque.
+
+- Registration: `{ owner, jwk, proof: { challengeId: id, signature } }`.
+- Login: credentials `{ kind: 'key-challenge', keyId, challengeId: id, signature }`.
+
+A challenge is single use, lives `authn.keys.challenge.ttlSeconds` (default
+120 s), and is redeemed only after the signature holds. A login challenge
+counts against the `login` flow's IP throttle key.
+
+With OpenSSL 3, for an Ed25519 key in `key.pem`:
+
+```sh
+printf 'spinajs-key-login:%s:%s' "$NONCE" "$AUDIENCE" > input.bin
+openssl pkeyutl -sign -inkey key.pem -rawin -in input.bin | basenc --base64url | tr -d '=\n'
+```
+
+From Node: `signChallenge(challenge, 'login', audience, privateKey, 'EdDSA')`.
+
+## JWS
+
+`StrictJwsVerifier` implements `JwsVerifier` under the C8 D4 rules. Checks
+run in this order and the first failure gives the code: `malformed`,
+`bad_header` (exactly `{ alg, kid, typ }`), `unknown_key`, `bad_signature`
+(with the key's own algorithm), `invalid_claims` (JSON read as serde_json
+reads it; integer `iat < exp`, lifetime within the limit), `wrong_issuer`,
+`wrong_audience`, `expired` (`now ≥ exp + skew`), `not_yet_valid`
+(`iat > now + skew`).
+
+`LocalJwsSigner` implements `JwsSigner` over private JWKs the app loads:
+`new LocalJwsSigner(privateJwks, { current: kid })`. It writes the header
+as `{"alg","kid","typ"}` and the claims in the caller's order, so the canvas
+C8 golden tickets come out byte for byte.
+
+## JWS client assertions (`keys-jws`)
+
+`Authorization: Bearer <jws>` → credentials `{ kind: 'jws-assertion', jws }`.
+
+- Header: `{ "alg": "EdDSA" | "ES256", "kid": "<kid>", "typ": "spinajs-client+jwt" }`.
+- Claims: `iss` is the key owner as `<type>:<id>` (`user:<uuid>`,
+  `service:runner-1`), `aud` is `authn.keys.assertion.audience` (required),
+  integer `iat` and `exp` with `exp − iat ≤ 300` (or the configured
+  `maxLifetimeSeconds`), and a `jti` of 1–128 characters.
+- A `jti` is accepted once per key until `exp` plus the skew (`authn_nonce`
+  or memory).
+
+## HTTP signatures (`keys-httpsig`)
+
+An RFC 9421 subset with exactly one signature:
+
+```
+Signature-Input: sig1=("@method" "@target-uri" "content-digest");created=1790000000;expires=1790000300;nonce="<random>";keyid="<kid>"
+Signature: sig1=:<standard base64 of the raw signature>:
+Content-Digest: sha-256=:<standard base64 of SHA-256(body)>:
+```
+
+- Any label; the `Signature-Input` member must be in canonical RFC 8941
+  form (single spaces, no parameters on components).
+- Covered: `@method` and `@target-uri` always; `content-digest` whenever
+  the request has a body (RFC 9530, `sha-256` or `sha-512`, checked against
+  the body); also each name in `authn.keys.httpSignature.requiredComponents`.
+  `@authority`, `@path`, `@query` and present request headers may be
+  covered too.
+- Parameters: `created`, `expires`, `nonce`, `keyid` required; `alg`
+  optional (`ed25519` or `ecdsa-p256-sha256`, and then it must name the
+  key's algorithm); nothing else.
+- `expires − created ≤ maxAgeSeconds` (300), `created` not ahead of now by
+  more than the skew, `now < expires`; the nonce is accepted once per key.
+- The signature base is RFC 9421 §2.5; its `@signature-params` line is the
+  `Signature-Input` member value as sent.
+
+## Strategies
+
+| Name | Credentials kind | Session |
+|---|---|---|
+| `keys-jws` (`JwsAssertionStrategy`) | `jws-assertion` | no |
+| `keys-httpsig` (`HttpSignatureStrategy`) | `http-signature` | no |
+| `keys-challenge` (`KeyChallengeStrategy`) | `key-challenge` | yes |
+
+Each refuses credentials over 8 KiB before parsing them, verifies only
+usable keys (not revoked, not expired), answers an
+unknown key with the same work and result as a bad signature, throttles by
+`key:<kid>`, and returns the key owner as the identity with the key's
+`scope` as the ceiling.
+
+## Configuration (`authn.keys`)
+
+| Key | Default |
+|---|---|
+| `algorithms` | `['EdDSA', 'ES256']` |
+| `challenge.ttlSeconds` | `120` |
+| `challenge.audience` | `null` (then `assertion.audience`; challenges need one) |
+| `assertion.typ` | `'spinajs-client+jwt'` |
+| `assertion.audience` | `null` (required for `keys-jws`) |
+| `assertion.maxLifetimeSeconds` | `300` (at most 300) |
+| `assertion.skewSeconds` | `30` |
+| `httpSignature.maxAgeSeconds` | `300` (at most 300) |
+| `httpSignature.skewSeconds` | `30` |
+| `httpSignature.requiredComponents` | `['@method', '@target-uri', 'content-digest']` |
+
+`authn_nonce` comes with `@spinajs/authn-orm`'s `AuthnInitial` migration.
+
+List the strategies an app uses in `authn.strategies`; `service` is the
+class name:
+
+```ts
+authn: {
+  strategies: [
+    { name: 'keys-jws', service: 'JwsAssertionStrategy' },
+    { name: 'keys-httpsig', service: 'HttpSignatureStrategy' },
+    { name: 'keys-challenge', service: 'KeyChallengeStrategy' },
+  ],
+  keys: { assertion: { audience: 'https://api.example.com' } },
+}
+```
+
+Dates in `authn_key` and `authn_nonce` are UTC instants; the process time zone does not matter.
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.

package/lib/cjs/bootstrap.d.ts

@@ -0,0 +1,6 @@
+import { Bootstrapper } from '@spinajs/di';
+/** Registers the authn.keys schema, so the configuration validates that subtree and fills its defaults. */
+export declare class AuthnKeysConfigBootstrapper extends Bootstrapper {
+    bootstrap(): void;
+}
+//# sourceMappingURL=bootstrap.d.ts.map

package/lib/cjs/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAIvD,2GAA2G;AAC3G,qBACa,2BAA4B,SAAQ,YAAY;IACpD,SAAS,IAAI,IAAI,CAEvB;CACF"}

package/lib/cjs/bootstrap.js

@@ -0,0 +1,23 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnKeysConfigBootstrapper = void 0;
+const configuration_1 = require("@spinajs/configuration");
+const di_1 = require("@spinajs/di");
+const schema_js_1 = require("./schema.js");
+/** Registers the authn.keys schema, so the configuration validates that subtree and fills its defaults. */
+let AuthnKeysConfigBootstrapper = class AuthnKeysConfigBootstrapper extends di_1.Bootstrapper {
+    bootstrap() {
+        (0, configuration_1.registerConfigurationSchema)(schema_js_1.AUTHN_KEYS_CONFIGURATION_SCHEMA);
+    }
+};
+exports.AuthnKeysConfigBootstrapper = AuthnKeysConfigBootstrapper;
+exports.AuthnKeysConfigBootstrapper = AuthnKeysConfigBootstrapper = __decorate([
+    (0, di_1.Injectable)(di_1.Bootstrapper)
+], AuthnKeysConfigBootstrapper);
+//# sourceMappingURL=bootstrap.js.map

package/lib/cjs/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/bootstrap.ts"],"names":[],"mappings":";;;;;;;;;AAAA,0DAAqE;AACrE,oCAAuD;AAEvD,2CAA8D;AAE9D,2GAA2G;AAEpG,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,iBAAY;IACpD,SAAS;QACd,IAAA,2CAA2B,EAAC,2CAA+B,CAAC,CAAC;IAC/D,CAAC;CACF,CAAA;;sCAJY,2BAA2B;IADvC,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,2BAA2B,CAIvC"}

package/lib/cjs/challenge/challenge.d.ts

@@ -0,0 +1,27 @@
+import type { KeyObject } from 'node:crypto';
+import type { KeyAlgorithm, KeyChallenge, KeyMaterial } from '@spinajs/authn/contracts';
+export type ChallengePurpose = 'register' | 'login';
+/** The SecretStore purpose of one challenge; `rid` keeps it within authn_secret.purpose (varchar 32). */
+export declare const challengeSecretPurpose: (rid: string) => string;
+export declare const newChallengeRid: () => string;
+/**
+ * `<rid>.<nonce>`. SecretStore keeps only a hash of the nonce and redeems by the raw value, and the credentials carry
+ * only the challenge id and a signature, so the id has to bring the nonce back.
+ */
+export declare const challengeId: (rid: string, nonce: string) => string;
+export declare function parseChallengeId(id: unknown): {
+    rid: string;
+    nonce: string;
+} | null;
+/** Nonces are base64url, so the first ':' after one ends it and the signing input has exactly one reading. */
+export declare const isChallengeNonce: (nonce: unknown) => nonce is string;
+/**
+ * The bytes a key signs to answer a challenge: UTF-8 of `spinajs-key-<purpose>:<nonce>:<audience>`. The purpose keeps
+ * a login signature from proving a registration; the audience is the service as the client knows it (never taken from
+ * the challenge answer), so a service that relays another one's challenge gets a signature the other one refuses.
+ */
+export declare function challengeSigningInput(challenge: Pick<KeyChallenge, 'nonce'>, purpose: ChallengePurpose, audience: string): Buffer;
+/** The answer a client sends: the raw signature (64 bytes; ES256 as IEEE P1363) as unpadded base64url. */
+export declare function signChallenge(challenge: Pick<KeyChallenge, 'nonce'>, purpose: ChallengePurpose, audience: string, privateKey: KeyObject, alg: KeyAlgorithm): string;
+export declare function verifyChallengeSignature(key: KeyMaterial, nonce: string, purpose: ChallengePurpose, audience: string, signature: unknown): boolean;
+//# sourceMappingURL=challenge.d.ts.map

package/lib/cjs/challenge/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../../src/challenge/challenge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAKxF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,OAAO,CAAC;AAEpD,yGAAyG;AACzG,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,MAAgC,CAAC;AAQtF,eAAO,MAAM,eAAe,QAAO,MAAsD,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,WAAW,QAAS,MAAM,SAAS,MAAM,KAAG,MAA2B,CAAC;AAErF,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,OAAO,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAQnF;AAED,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,UAAW,OAAO,KAAG,KAAK,IAAI,MAAwD,CAAC;AAEpH;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjI;AAED,0GAA0G;AAC1G,wBAAgB,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,MAAM,CAEnK;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAGlJ"}

package/lib/cjs/challenge/challenge.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isChallengeNonce = exports.challengeId = exports.newChallengeRid = exports.challengeSecretPurpose = void 0;
+exports.parseChallengeId = parseChallengeId;
+exports.challengeSigningInput = challengeSigningInput;
+exports.signChallenge = signChallenge;
+exports.verifyChallengeSignature = verifyChallengeSignature;
+const node_crypto_1 = require("node:crypto");
+const util_1 = require("@spinajs/util");
+const base64url_js_1 = require("../jwk/base64url.js");
+const signature_js_1 = require("../jwk/signature.js");
+/** The SecretStore purpose of one challenge; `rid` keeps it within authn_secret.purpose (varchar 32). */
+const challengeSecretPurpose = (rid) => `key-challenge:${rid}`;
+exports.challengeSecretPurpose = challengeSecretPurpose;
+const RID_BYTES = 12;
+const RID_LENGTH = 16;
+const RID = /^[A-Za-z0-9_-]{16}$/;
+const MAX_NONCE_LENGTH = 512;
+const NONCE = /^[A-Za-z0-9_-]{22,512}$/;
+const newChallengeRid = () => (0, node_crypto_1.randomBytes)(RID_BYTES).toString('base64url');
+exports.newChallengeRid = newChallengeRid;
+/**
+ * `<rid>.<nonce>`. SecretStore keeps only a hash of the nonce and redeems by the raw value, and the credentials carry
+ * only the challenge id and a signature, so the id has to bring the nonce back.
+ */
+const challengeId = (rid, nonce) => `${rid}.${nonce}`;
+exports.challengeId = challengeId;
+function parseChallengeId(id) {
+    const [ok, text] = (0, util_1._try_check_arg)((0, util_1._is_string)((0, util_1._between)(RID_LENGTH + 2, RID_LENGTH + 1 + MAX_NONCE_LENGTH), (0, util_1._custom)((s) => s[RID_LENGTH] === '.')))(id, 'id');
+    if (!ok) {
+        return null;
+    }
+    const rid = text.slice(0, RID_LENGTH);
+    const nonce = text.slice(RID_LENGTH + 1);
+    return RID.test(rid) && (0, exports.isChallengeNonce)(nonce) ? { rid, nonce } : null;
+}
+/** Nonces are base64url, so the first ':' after one ends it and the signing input has exactly one reading. */
+const isChallengeNonce = (nonce) => typeof nonce === 'string' && NONCE.test(nonce);
+exports.isChallengeNonce = isChallengeNonce;
+/**
+ * The bytes a key signs to answer a challenge: UTF-8 of `spinajs-key-<purpose>:<nonce>:<audience>`. The purpose keeps
+ * a login signature from proving a registration; the audience is the service as the client knows it (never taken from
+ * the challenge answer), so a service that relays another one's challenge gets a signature the other one refuses.
+ */
+function challengeSigningInput(challenge, purpose, audience) {
+    return Buffer.from(`spinajs-key-${purpose}:${challenge.nonce}:${audience}`, 'utf8');
+}
+/** The answer a client sends: the raw signature (64 bytes; ES256 as IEEE P1363) as unpadded base64url. */
+function signChallenge(challenge, purpose, audience, privateKey, alg) {
+    return (0, base64url_js_1.encodeB64url)((0, signature_js_1.signRaw)(alg, privateKey, challengeSigningInput(challenge, purpose, audience)));
+}
+function verifyChallengeSignature(key, nonce, purpose, audience, signature) {
+    const raw = (0, base64url_js_1.decodeB64url)(signature);
+    return raw !== null && (0, exports.isChallengeNonce)(nonce) && (0, signature_js_1.verifySignature)(key, challengeSigningInput({ nonce }, purpose, audience), raw);
+}
+//# sourceMappingURL=challenge.js.map

package/lib/cjs/challenge/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../../src/challenge/challenge.ts"],"names":[],"mappings":";;;;;;;AAAA,6CAA0C;AAG1C,wCAA8E;AAC9E,sDAAiE;AACjE,sDAA+D;AAI/D,yGAAyG;AAClG,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,iBAAiB,GAAG,EAAE,CAAC;AAAzE,QAAA,sBAAsB,GAAtB,sBAAsB,CAAmD;AAEtF,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,GAAG,GAAG,qBAAqB,CAAC;AAClC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,KAAK,GAAG,yBAAyB,CAAC;AAEjC,MAAM,eAAe,GAAG,GAAW,EAAE,CAAC,IAAA,yBAAW,EAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAA7E,QAAA,eAAe,GAAf,eAAe,CAA8D;AAE1F;;;GAGG;AACI,MAAM,WAAW,GAAG,CAAC,GAAW,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;AAAxE,QAAA,WAAW,GAAX,WAAW,CAA6D;AAErF,0BAAiC,EAAW;IAC1C,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,GAAG,gBAAgB,CAAC,EAAE,IAAA,cAAO,EAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACpK,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAI,IAAe,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,KAAK,GAAI,IAAe,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAA,QAAA,gBAAgB,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,8GAA8G;AACvG,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAAvG,QAAA,gBAAgB,GAAhB,gBAAgB,CAAuF;AAEpH;;;;GAIG;AACH,+BAAsC,SAAsC,EAAE,OAAyB,EAAE,QAAgB;IACvH,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,OAAO,IAAI,SAAS,CAAC,KAAK,IAAI,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;AACtF,CAAC;AAED,0GAA0G;AAC1G,uBAA8B,SAAsC,EAAE,OAAyB,EAAE,QAAgB,EAAE,UAAqB,EAAE,GAAiB;IACzJ,OAAO,IAAA,2BAAY,EAAC,IAAA,sBAAO,EAAC,GAAG,EAAE,UAAU,EAAE,qBAAqB,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,kCAAyC,GAAgB,EAAE,KAAa,EAAE,OAAyB,EAAE,QAAgB,EAAE,SAAkB;IACvI,MAAM,GAAG,GAAG,IAAA,2BAAY,EAAC,SAAS,CAAC,CAAC;IACpC,OAAO,GAAG,KAAK,IAAI,IAAI,IAAA,QAAA,gBAAgB,EAAC,KAAK,CAAC,IAAI,IAAA,8BAAe,EAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;AACnI,CAAC"}

package/lib/cjs/challenge/index.d.ts

@@ -0,0 +1,2 @@
+export * from './challenge.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/challenge/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/challenge/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC"}

package/lib/cjs/challenge/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./challenge.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/challenge/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/challenge/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B"}

package/lib/cjs/cli/AddKey.d.ts

@@ -0,0 +1,18 @@
+import { CliCommand } from '@spinajs/cli';
+import { Log } from '@spinajs/log';
+import { KeyRegistry } from '@spinajs/authn/contracts';
+interface AddKeyOptions {
+    jwk?: string;
+    file?: string;
+    kid?: string;
+    name?: string;
+    expires?: string;
+}
+/** Services and agents only: a user registers a key with a proof of possession, which the CLI cannot give. */
+export declare class AddKey extends CliCommand {
+    protected Log: Log;
+    protected Registry: KeyRegistry;
+    execute(ownerType: string, ownerId: string, options: AddKeyOptions): Promise<void>;
+}
+export {};
+//# sourceMappingURL=AddKey.d.ts.map

package/lib/cjs/cli/AddKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AddKey.d.ts","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAmB,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAK9E,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8GAA8G;AAC9G,qBAQa,MAAO,SAAQ,UAAU;IAEpC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9F;CACF"}

package/lib/cjs/cli/AddKey.js

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddKey = void 0;
+const di_1 = require("@spinajs/di");
+const cli_1 = require("@spinajs/cli");
+const log_1 = require("@spinajs/log");
+const contracts_1 = require("@spinajs/authn/contracts");
+const exceptions_1 = require("@spinajs/exceptions");
+const common_js_1 = require("./common.js");
+/** Services and agents only: a user registers a key with a proof of possession, which the CLI cannot give. */
+let AddKey = class AddKey extends cli_1.CliCommand {
+    async execute(ownerType, ownerId, options) {
+        const owner = (0, common_js_1.ownerArg)(ownerType, ownerId);
+        if (owner.type === 'user') {
+            throw new exceptions_1.InvalidArgument('a user registers a key with a proof of possession, through POST /user/keys');
+        }
+        const expiresAt = options.expires === undefined ? undefined : new Date(options.expires);
+        // Without a zone, Date reads the time as local, which differs per host.
+        if (expiresAt !== undefined && (Number.isNaN(expiresAt.getTime()) || !/T.*(Z|[+-]\d{2}:?\d{2})$/i.test(options.expires))) {
+            throw new exceptions_1.InvalidArgument(`--expires is not an ISO 8601 instant with Z or an offset: ${options.expires}`);
+        }
+        const reg = {
+            owner,
+            actor: contracts_1.CLI_ACTOR,
+            jwk: (0, common_js_1.readPublicJwk)(options),
+            ...(options.kid !== undefined ? { kid: options.kid } : {}),
+            ...(options.name !== undefined ? { name: options.name } : {}),
+            ...(expiresAt ? { expiresAt } : {}),
+        };
+        const r = await this.Registry.register(reg, (0, contracts_1.cliContext)());
+        if (!r.ok) {
+            throw new exceptions_1.InvalidArgument(`key not registered: ${r.code}`);
+        }
+        this.Log.success({ kid: r.key.kid, alg: r.key.alg, thumbprint: r.key.thumbprint }, 'Key registered: kid ${kid}, ${alg}, thumbprint ${thumbprint}');
+    }
+};
+exports.AddKey = AddKey;
+__decorate([
+    (0, log_1.Logger)('authn-keys'),
+    __metadata("design:type", log_1.Log)
+], AddKey.prototype, "Log", void 0);
+__decorate([
+    (0, di_1.Autoinject)(contracts_1.KeyRegistry),
+    __metadata("design:type", contracts_1.KeyRegistry)
+], AddKey.prototype, "Registry", void 0);
+exports.AddKey = AddKey = __decorate([
+    (0, cli_1.Command)('authn:key-add', 'Registers an Ed25519 or P-256 public key for a service or an agent'),
+    (0, cli_1.Argument)({ name: 'ownerType', required: true, description: 'service or agent', choices: ['service', 'agent'] }),
+    (0, cli_1.Argument)('ownerId', true, 'id of the service or agent'),
+    (0, cli_1.Option)('--jwk <json>', false, 'the public JWK as JSON'),
+    (0, cli_1.Option)('--file <path>', false, 'a file with the public JWK (JSON) or a PEM public key'),
+    (0, cli_1.Option)('--kid <kid>', false, 'key id, 1-64 of [A-Za-z0-9._-]; default: the RFC 7638 thumbprint'),
+    (0, cli_1.Option)('--name <name>', false, 'label, up to 128 characters'),
+    (0, cli_1.Option)('--expires <iso>', false, 'ISO 8601 expiry instant with Z or an offset')
+], AddKey);
+//# sourceMappingURL=AddKey.js.map

package/lib/cjs/cli/AddKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AddKey.js","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAAqE;AACrE,sCAA2C;AAC3C,wDAA8E;AAE9E,oDAAsD;AACtD,2CAAsD;AAUtD,8GAA8G;AASvG,IAAM,MAAM,GAAZ,MAAM,MAAO,SAAQ,gBAAU;IAO7B,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,OAAsB;QAC7E,MAAM,KAAK,GAAG,IAAA,oBAAQ,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAe,CAAC,4EAA4E,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,wEAAwE;QACxE,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAQ,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,4BAAe,CAAC,6DAA6D,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,GAAG,GAAG;YACV,KAAK;YACL,KAAK,EAAE,qBAAS;YAChB,GAAG,EAAE,IAAA,yBAAa,EAAC,OAAO,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjB,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAA,sBAAU,GAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,4BAAe,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,8DAA8D,CAAC,CAAC;IACrJ,CAAC;CACF,CAAA;;AA7BW;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;mCAAC;AAGT;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;wCAAC;iBALrB,MAAM;IARlB,IAAA,aAAO,EAAC,eAAe,EAAE,oEAAoE,CAAC;IAC9F,IAAA,cAAQ,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IAC/G,IAAA,cAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,4BAA4B,CAAC;IACvD,IAAA,YAAM,EAAC,cAAc,EAAE,KAAK,EAAE,wBAAwB,CAAC;IACvD,IAAA,YAAM,EAAC,eAAe,EAAE,KAAK,EAAE,uDAAuD,CAAC;IACvF,IAAA,YAAM,EAAC,aAAa,EAAE,KAAK,EAAE,kEAAkE,CAAC;IAChG,IAAA,YAAM,EAAC,eAAe,EAAE,KAAK,EAAE,6BAA6B,CAAC;IAC7D,IAAA,YAAM,EAAC,iBAAiB,EAAE,KAAK,EAAE,6CAA6C,CAAC;GACnE,MAAM,CA+BlB"}

package/lib/cjs/cli/ListKeys.d.ts

@@ -0,0 +1,11 @@
+import { CliCommand } from '@spinajs/cli';
+import { Log } from '@spinajs/log';
+import { KeyRegistry } from '@spinajs/authn/contracts';
+import type { KeyRecord } from '@spinajs/authn/contracts';
+export declare function keyLine(k: KeyRecord): string;
+export declare class ListKeys extends CliCommand {
+    protected Log: Log;
+    protected Registry: KeyRegistry;
+    execute(ownerType: string, ownerId: string): Promise<void>;
+}
+//# sourceMappingURL=ListKeys.d.ts.map

package/lib/cjs/cli/ListKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListKeys.d.ts","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAK1D,wBAAgB,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAE5C;AAED,qBAGa,QAAS,SAAQ,UAAU;IAEtC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;CACF"}

package/lib/cjs/cli/ListKeys.js

@@ -0,0 +1,48 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ListKeys = void 0;
+exports.keyLine = keyLine;
+const di_1 = require("@spinajs/di");
+const cli_1 = require("@spinajs/cli");
+const log_1 = require("@spinajs/log");
+const contracts_1 = require("@spinajs/authn/contracts");
+const common_js_1 = require("./common.js");
+const iso = (d) => (d ? d.toISOString() : '-');
+function keyLine(k) {
+    return [k.kid, k.alg, k.name ?? '-', `created ${iso(k.createdAt)}`, `expires ${iso(k.expiresAt)}`, `revoked ${iso(k.revokedAt)}`, `last used ${iso(k.lastUsedAt)}`].join('  ');
+}
+let ListKeys = class ListKeys extends cli_1.CliCommand {
+    async execute(ownerType, ownerId) {
+        const keys = await this.Registry.list((0, common_js_1.ownerArg)(ownerType, ownerId));
+        if (keys.length === 0) {
+            this.Log.info('No keys');
+        }
+        for (const k of keys) {
+            this.Log.info(keyLine(k));
+        }
+    }
+};
+exports.ListKeys = ListKeys;
+__decorate([
+    (0, log_1.Logger)('authn-keys'),
+    __metadata("design:type", log_1.Log)
+], ListKeys.prototype, "Log", void 0);
+__decorate([
+    (0, di_1.Autoinject)(contracts_1.KeyRegistry),
+    __metadata("design:type", contracts_1.KeyRegistry)
+], ListKeys.prototype, "Registry", void 0);
+exports.ListKeys = ListKeys = __decorate([
+    (0, cli_1.Command)('authn:key-list', 'Lists the public keys of a user, a service or an agent, revoked and expired ones included'),
+    (0, cli_1.Argument)({ name: 'ownerType', required: true, description: common_js_1.OWNER_TYPES.join(', '), choices: common_js_1.OWNER_TYPES }),
+    (0, cli_1.Argument)('ownerId', true, 'id of the owner (users.Uuid for users)')
+], ListKeys);
+//# sourceMappingURL=ListKeys.js.map

package/lib/cjs/cli/ListKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ListKeys.js","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAA6D;AAC7D,sCAA2C;AAC3C,wDAAuD;AAEvD,2CAAoD;AAEpD,MAAM,GAAG,GAAG,CAAC,CAAQ,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE9D,iBAAwB,CAAY;IAClC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjL,CAAC;AAKM,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,gBAAU;IAO/B,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,oBAAQ,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF,CAAA;;AAdW;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;qCAAC;AAGT;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;0CAAC;mBALrB,QAAQ;IAHpB,IAAA,aAAO,EAAC,gBAAgB,EAAE,2FAA2F,CAAC;IACtH,IAAA,cAAQ,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAW,EAAE,CAAC;IAC1G,IAAA,cAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;GACvD,QAAQ,CAgBpB"}

package/lib/cjs/cli/RevokeKey.d.ts

@@ -0,0 +1,9 @@
+import { CliCommand } from '@spinajs/cli';
+import { Log } from '@spinajs/log';
+import { KeyRegistry } from '@spinajs/authn/contracts';
+export declare class RevokeKey extends CliCommand {
+    protected Log: Log;
+    protected Registry: KeyRegistry;
+    execute(ownerType: string, ownerId: string, kid: string): Promise<void>;
+}
+//# sourceMappingURL=RevokeKey.d.ts.map

package/lib/cjs/cli/RevokeKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevokeKey.d.ts","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAI9E,qBAIa,SAAU,SAAQ,UAAU;IAEvC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnF;CACF"}

package/lib/cjs/cli/RevokeKey.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RevokeKey = void 0;
+const di_1 = require("@spinajs/di");
+const cli_1 = require("@spinajs/cli");
+const log_1 = require("@spinajs/log");
+const contracts_1 = require("@spinajs/authn/contracts");
+const exceptions_1 = require("@spinajs/exceptions");
+const common_js_1 = require("./common.js");
+let RevokeKey = class RevokeKey extends cli_1.CliCommand {
+    async execute(ownerType, ownerId, kid) {
+        if (!(await this.Registry.revoke((0, common_js_1.ownerArg)(ownerType, ownerId), kid, (0, contracts_1.cliContext)(), { actor: contracts_1.CLI_ACTOR }))) {
+            throw new exceptions_1.InvalidArgument(`no key ${kid} of ${ownerType} ${ownerId}`);
+        }
+        this.Log.success({ kid }, 'Key ${kid} revoked');
+    }
+};
+exports.RevokeKey = RevokeKey;
+__decorate([
+    (0, log_1.Logger)('authn-keys'),
+    __metadata("design:type", log_1.Log)
+], RevokeKey.prototype, "Log", void 0);
+__decorate([
+    (0, di_1.Autoinject)(contracts_1.KeyRegistry),
+    __metadata("design:type", contracts_1.KeyRegistry)
+], RevokeKey.prototype, "Registry", void 0);
+exports.RevokeKey = RevokeKey = __decorate([
+    (0, cli_1.Command)('authn:key-revoke', 'Revokes a public key; it fails on the next request'),
+    (0, cli_1.Argument)({ name: 'ownerType', required: true, description: common_js_1.OWNER_TYPES.join(', '), choices: common_js_1.OWNER_TYPES }),
+    (0, cli_1.Argument)('ownerId', true, 'id of the owner (users.Uuid for users)'),
+    (0, cli_1.Argument)('kid', true, 'key id')
+], RevokeKey);
+//# sourceMappingURL=RevokeKey.js.map

package/lib/cjs/cli/RevokeKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RevokeKey.js","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAA6D;AAC7D,sCAA2C;AAC3C,wDAA8E;AAC9E,oDAAsD;AACtD,2CAAoD;AAM7C,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,gBAAU;IAOhC,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,GAAW;QAClE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAA,oBAAQ,EAAC,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,IAAA,sBAAU,GAAE,EAAE,EAAE,KAAK,EAAE,qBAAS,EAAE,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,4BAAe,CAAC,UAAU,GAAG,OAAO,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;;AAXW;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;sCAAC;AAGT;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;2CAAC;oBALrB,SAAS;IAJrB,IAAA,aAAO,EAAC,kBAAkB,EAAE,oDAAoD,CAAC;IACjF,IAAA,cAAQ,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAW,EAAE,CAAC;IAC1G,IAAA,cAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;IACnE,IAAA,cAAQ,EAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC;GACnB,SAAS,CAarB"}

package/lib/cjs/cli/common.d.ts

@@ -0,0 +1,9 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+export declare const OWNER_TYPES: string[];
+export declare function ownerArg(type: string, id: string): IdentityRef;
+/** A public JWK given inline as JSON, or a file holding JSON or a PEM public key; private keys are refused. */
+export declare function readPublicJwk(opts: {
+    jwk?: string;
+    file?: string;
+}): unknown;
+//# sourceMappingURL=common.d.ts.map

package/lib/cjs/cli/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/cli/common.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG5D,eAAO,MAAM,WAAW,UAA+B,CAAC;AAExD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAK9D;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAgB5E"}

package/lib/cjs/cli/common.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OWNER_TYPES = void 0;
+exports.ownerArg = ownerArg;
+exports.readPublicJwk = readPublicJwk;
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const exceptions_1 = require("@spinajs/exceptions");
+exports.OWNER_TYPES = ['user', 'service', 'agent'];
+function ownerArg(type, id) {
+    if (!exports.OWNER_TYPES.includes(type)) {
+        throw new exceptions_1.InvalidArgument(`owner type must be one of ${exports.OWNER_TYPES.join(', ')}, not ${JSON.stringify(type)}`);
+    }
+    return { type, id };
+}
+/** A public JWK given inline as JSON, or a file holding JSON or a PEM public key; private keys are refused. */
+function readPublicJwk(opts) {
+    if ((opts.jwk === undefined) === (opts.file === undefined)) {
+        throw new exceptions_1.InvalidArgument('give the key with exactly one of --jwk or --file');
+    }
+    const text = opts.jwk ?? (0, node_fs_1.readFileSync)(opts.file, 'utf8');
+    if (text.includes('-----BEGIN')) {
+        if (!text.includes('-----BEGIN PUBLIC KEY-----') || text.includes('PRIVATE KEY')) {
+            throw new exceptions_1.InvalidArgument('the PEM file must hold a public key (SPKI), never a private key');
+        }
+        return (0, node_crypto_1.createPublicKey)(text).export({ format: 'jwk' });
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new exceptions_1.InvalidArgument('the key is neither JSON nor a PEM public key');
+    }
+}
+//# sourceMappingURL=common.js.map

package/lib/cjs/cli/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../src/cli/common.ts"],"names":[],"mappings":";;;;;AAAA,qCAAuC;AACvC,6CAA8C;AAE9C,oDAAsD;AAEzC,QAAA,WAAW,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAExD,kBAAyB,IAAY,EAAE,EAAU;IAC/C,IAAI,CAAC,QAAA,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,4BAAe,CAAC,6BAA6B,QAAA,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,+GAA+G;AAC/G,uBAA8B,IAAqC;IACjE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,4BAAe,CAAC,kDAAkD,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,IAAA,sBAAY,EAAC,IAAI,CAAC,IAAK,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,4BAAe,CAAC,iEAAiE,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,IAAA,6BAAe,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,4BAAe,CAAC,8CAA8C,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/lib/cjs/cli/index.d.ts

@@ -0,0 +1,5 @@
+export * from './common.js';
+export * from './AddKey.js';
+export * from './ListKeys.js';
+export * from './RevokeKey.js';
+//# sourceMappingURL=index.d.ts.map