@spinajs/authn-keys 0.0.0-stage → 3.0.0

package/lib/cjs/migrations/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./AuthnKeys_2026_10_02_00_00_00.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qEAAmD"}

package/lib/cjs/models/AuthnKey.d.ts

@@ -0,0 +1,22 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** A row of authn_key; OrmKeyStore maps it to the contract's KeyRecord. */
+export declare class AuthnKey extends ModelBase<AuthnKey> {
+    kid: string;
+    owner_type: string;
+    owner_id: string;
+    alg: string;
+    /** The public JWK as JSON text, required members only. */
+    jwk: string;
+    thumbprint: string;
+    /** The Ceiling as JSON text. */
+    scope?: string | null;
+    name?: string | null;
+    expires_at?: DateTime;
+    revoked_at?: DateTime;
+    last_used_at?: DateTime;
+    /** PrincipalRef as `<type>:<id>`. */
+    created_by?: string | null;
+    created_at: DateTime;
+}
+//# sourceMappingURL=AuthnKey.d.ts.map

package/lib/cjs/models/AuthnKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnKey.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,2EAA2E;AAC3E,qBAEa,QAAS,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAExC,GAAG,EAAE,MAAM,CAAC;IAEZ,UAAU,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE,MAAM,CAAC;IAEjB,GAAG,EAAE,MAAM,CAAC;IAEnB,0DAA0D;IACnD,GAAG,EAAE,MAAM,CAAC;IAEZ,UAAU,EAAE,MAAM,CAAC;IAE1B,gCAAgC;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGrB,UAAU,CAAC,EAAE,QAAQ,CAAC;IAGtB,UAAU,CAAC,EAAE,QAAQ,CAAC;IAGtB,YAAY,CAAC,EAAE,QAAQ,CAAC;IAE/B,qCAAqC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3B,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/cjs/models/AuthnKey.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnKey = void 0;
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+/** A row of authn_key; OrmKeyStore maps it to the contract's KeyRecord. */
+let AuthnKey = class AuthnKey extends orm_1.ModelBase {
+};
+exports.AuthnKey = AuthnKey;
+__decorate([
+    (0, orm_1.Primary)(),
+    __metadata("design:type", String)
+], AuthnKey.prototype, "kid", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnKey.prototype, "expires_at", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnKey.prototype, "revoked_at", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnKey.prototype, "last_used_at", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnKey.prototype, "created_at", void 0);
+exports.AuthnKey = AuthnKey = __decorate([
+    (0, orm_1.Connection)('default'),
+    (0, orm_1.Model)('authn_key')
+], AuthnKey);
+//# sourceMappingURL=AuthnKey.js.map

package/lib/cjs/models/AuthnKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnKey.js","sourceRoot":"","sources":["../../../src/models/AuthnKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAqF;AACrF,iCAAiC;AAEjC,2EAA2E;AAGpE,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,eAAmB;CAkChD,CAAA;;AAhCQ;IADN,IAAA,aAAO,GAAE;;qCACS;AAmBZ;IADN,IAAA,cAAE,GAAE;8BACe,gBAAQ;4CAAC;AAGtB;IADN,IAAA,cAAE,GAAE;8BACe,gBAAQ;4CAAC;AAGtB;IADN,IAAA,cAAE,GAAE;8BACiB,gBAAQ;8CAAC;AAMxB;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;4CAAC;mBAjCjB,QAAQ;IAFpB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,WAAW,CAAC;GACN,QAAQ,CAkCpB"}

package/lib/cjs/models/AuthnNonce.d.ts

@@ -0,0 +1,8 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** A row of authn_nonce (design §22.16; the table comes with authn-orm's AuthnInitial migration). */
+export declare class AuthnNonce extends ModelBase<AuthnNonce> {
+    k: string;
+    expires_at: DateTime;
+}
+//# sourceMappingURL=AuthnNonce.d.ts.map

package/lib/cjs/models/AuthnNonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnNonce.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qGAAqG;AACrG,qBAEa,UAAW,SAAQ,SAAS,CAAC,UAAU,CAAC;IAE5C,CAAC,EAAE,MAAM,CAAC;IAGV,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/cjs/models/AuthnNonce.js

@@ -0,0 +1,31 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnNonce = void 0;
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+/** A row of authn_nonce (design §22.16; the table comes with authn-orm's AuthnInitial migration). */
+let AuthnNonce = class AuthnNonce extends orm_1.ModelBase {
+};
+exports.AuthnNonce = AuthnNonce;
+__decorate([
+    (0, orm_1.Primary)(),
+    __metadata("design:type", String)
+], AuthnNonce.prototype, "k", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnNonce.prototype, "expires_at", void 0);
+exports.AuthnNonce = AuthnNonce = __decorate([
+    (0, orm_1.Connection)('default'),
+    (0, orm_1.Model)('authn_nonce')
+], AuthnNonce);
+//# sourceMappingURL=AuthnNonce.js.map

package/lib/cjs/models/AuthnNonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnNonce.js","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAqF;AACrF,iCAAiC;AAEjC,qGAAqG;AAG9F,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,eAAqB;CAMpD,CAAA;;AAJQ;IADN,IAAA,aAAO,GAAE;;qCACO;AAGV;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;8CAAC;qBALjB,UAAU;IAFtB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,aAAa,CAAC;GACR,UAAU,CAMtB"}

package/lib/cjs/models/index.d.ts

@@ -0,0 +1,3 @@
+export * from './AuthnKey.js';
+export * from './AuthnNonce.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/models/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC"}

package/lib/cjs/models/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./AuthnKey.js"), exports);
+__exportStar(require("./AuthnNonce.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/models/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,kDAAgC"}

package/lib/cjs/nonce/index.d.ts

@@ -0,0 +1,2 @@
+export * from './store.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/nonce/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nonce/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/lib/cjs/nonce/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./store.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/nonce/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nonce/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B"}

package/lib/cjs/nonce/store.d.ts

@@ -0,0 +1,22 @@
+import { Orm } from '@spinajs/orm';
+/** Single-use values (assertion jti, HTTP signature nonces) until they expire. */
+export declare abstract class KeyNonceStore {
+    /** True exactly once while `key` is live: the first claim keeps it until `expiresAt`; an expired key may be claimed again. */
+    abstract claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
+}
+/** A fixed-length store key for a value a client chose, scoped to the key that signed it. */
+export declare const nonceKey: (scope: 'jti' | 'sig', kid: string, value: string) => string;
+export declare class MemoryKeyNonceStore extends KeyNonceStore {
+    private readonly live;
+    private claims;
+    claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
+}
+/** authn_nonce through the ORM: the primary key makes a claim atomic across processes. */
+export declare class DbKeyNonceStore extends KeyNonceStore {
+    /** Binds the models when nothing else brought the Orm up. */
+    protected Orm: Orm;
+    private claims;
+    claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
+    private purge;
+}
+//# sourceMappingURL=store.d.ts.map

package/lib/cjs/nonce/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/nonce/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAInC,kFAAkF;AAClF,8BAAsB,aAAa;IACjC,8HAA8H;IAC9H,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3E;AAED,6FAA6F;AAC7F,eAAO,MAAM,QAAQ,UAAW,KAAK,GAAG,KAAK,OAAO,MAAM,SAAS,MAAM,KAAG,MAAmG,CAAC;AAIhL,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,MAAM,CAAK;IAEb,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBrE;CACF;AAKD,0FAA0F;AAC1F,qBACa,eAAgB,SAAQ,aAAa;IAChD,6DAA6D;IAE7D,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,OAAO,CAAC,MAAM,CAAK;IAEb,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBrE;YAEa,KAAK;CAMpB"}

package/lib/cjs/nonce/store.js

@@ -0,0 +1,98 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbKeyNonceStore = exports.MemoryKeyNonceStore = exports.nonceKey = exports.KeyNonceStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const di_1 = require("@spinajs/di");
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+const AuthnNonce_js_1 = require("../models/AuthnNonce.js");
+/** Single-use values (assertion jti, HTTP signature nonces) until they expire. */
+class KeyNonceStore {
+}
+exports.KeyNonceStore = KeyNonceStore;
+/** A fixed-length store key for a value a client chose, scoped to the key that signed it. */
+const nonceKey = (scope, kid, value) => `${scope}:${(0, node_crypto_1.createHash)('sha256').update(`${kid}\n${value}`, 'utf8').digest('base64url')}`;
+exports.nonceKey = nonceKey;
+const SWEEP_EVERY = 256;
+class MemoryKeyNonceStore extends KeyNonceStore {
+    constructor() {
+        super(...arguments);
+        this.live = new Map();
+        this.claims = 0;
+    }
+    async claim(key, expiresAt, now) {
+        const nowMs = now.getTime();
+        this.claims += 1;
+        if (this.claims % SWEEP_EVERY === 0) {
+            for (const [k, until] of this.live) {
+                if (until <= nowMs) {
+                    this.live.delete(k);
+                }
+            }
+        }
+        const until = this.live.get(key);
+        if (until !== undefined && until > nowMs) {
+            return false;
+        }
+        this.live.set(key, expiresAt.getTime());
+        return true;
+    }
+}
+exports.MemoryKeyNonceStore = MemoryKeyNonceStore;
+const PURGE_EVERY = 64;
+const PURGE_BATCH = 500;
+/** authn_nonce through the ORM: the primary key makes a claim atomic across processes. */
+let DbKeyNonceStore = class DbKeyNonceStore extends KeyNonceStore {
+    constructor() {
+        super(...arguments);
+        this.claims = 0;
+    }
+    async claim(key, expiresAt, now) {
+        const nowDt = luxon_1.DateTime.fromJSDate(now);
+        this.claims += 1;
+        if (this.claims % PURGE_EVERY === 0) {
+            await this.purge(nowDt);
+        }
+        try {
+            await new AuthnNonce_js_1.AuthnNonce({ k: key, expires_at: luxon_1.DateTime.fromJSDate(expiresAt) }).insert();
+            return true;
+        }
+        catch (e) {
+            // Taken: only an expired row may be taken over, and the conditional update lets one claimant win.
+            const r = (await AuthnNonce_js_1.AuthnNonce.update({ expires_at: luxon_1.DateTime.fromJSDate(expiresAt) })
+                .where('k', key)
+                .where('expires_at', '<=', nowDt));
+            if ((r?.RowsAffected ?? 0) === 1) {
+                return true;
+            }
+            if ((await AuthnNonce_js_1.AuthnNonce.where('k', key)).length === 0) {
+                throw e;
+            }
+            return false;
+        }
+    }
+    async purge(now) {
+        const expired = await AuthnNonce_js_1.AuthnNonce.where('expires_at', '<=', now).take(PURGE_BATCH);
+        if (expired.length > 0) {
+            await AuthnNonce_js_1.AuthnNonce.destroy(expired.map((r) => r.k)).where('expires_at', '<=', now);
+        }
+    }
+};
+exports.DbKeyNonceStore = DbKeyNonceStore;
+__decorate([
+    (0, di_1.Autoinject)(orm_1.Orm),
+    __metadata("design:type", orm_1.Orm)
+], DbKeyNonceStore.prototype, "Orm", void 0);
+exports.DbKeyNonceStore = DbKeyNonceStore = __decorate([
+    (0, di_1.Injectable)(KeyNonceStore)
+], DbKeyNonceStore);
+//# sourceMappingURL=store.js.map

package/lib/cjs/nonce/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/nonce/store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAyC;AACzC,oCAAqD;AACrD,sCAAmC;AACnC,iCAAiC;AACjC,2DAAqD;AAErD,kFAAkF;AAClF;CAGC;;AAED,6FAA6F;AACtF,MAAM,QAAQ,GAAG,CAAC,KAAoB,EAAE,GAAW,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,KAAK,IAAI,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAAnK,QAAA,QAAQ,GAAR,QAAQ,CAA2J;AAEhL,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,yBAAiC,SAAQ,aAAa;IAAtD;;QACmB,SAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,WAAM,GAAG,CAAC,CAAC;IAmBrB,CAAC;IAjBC,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS;QACjD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;oBACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;;AAED,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,0FAA0F;AAEnF,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,aAAa;IAA3C;;QAKG,WAAM,GAAG,CAAC,CAAC;IAgCrB,CAAC;IA9BC,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS;QACjD,MAAM,KAAK,GAAG,gBAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,0BAAU,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kGAAkG;YAClG,MAAM,CAAC,GAAG,CAAC,MAAM,0BAAU,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,gBAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;iBAC/E,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;iBACf,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAyC,CAAC;YAC7E,IAAI,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,0BAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,CAAC;YACV,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAa;QAC/B,MAAM,OAAO,GAAiB,MAAM,0BAAU,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,0BAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF,CAAA;;AAlCW;IADT,IAAA,eAAU,EAAC,SAAG,CAAC;8BACD,SAAG;4CAAC;0BAHR,eAAe;IAD3B,IAAA,eAAU,EAAC,aAAa,CAAC;GACb,eAAe,CAqC3B"}

package/lib/cjs/options/index.d.ts

@@ -0,0 +1,2 @@
+export * from './options.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/options/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/options/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC"}

package/lib/cjs/options/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./options.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/options/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/options/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B"}

package/lib/cjs/options/options.d.ts

@@ -0,0 +1,47 @@
+import type { KeyAlgorithm } from '@spinajs/authn/contracts';
+/** `authn.keys` as the schema validates and defaults it. */
+export interface KeysConfig {
+    readonly algorithms: readonly KeyAlgorithm[];
+    readonly challenge: {
+        readonly ttlSeconds: number;
+        readonly audience: string | null;
+    };
+    readonly assertion: {
+        readonly typ: string;
+        readonly audience: string | null;
+        readonly maxLifetimeSeconds: number;
+        readonly skewSeconds: number;
+    };
+    readonly httpSignature: {
+        readonly maxAgeSeconds: number;
+        readonly skewSeconds: number;
+        readonly requiredComponents: readonly string[];
+    };
+}
+/** `authn.keys` (design §22.5) after defaults. */
+export interface KeysOptions {
+    readonly algorithms: readonly KeyAlgorithm[];
+    readonly challenge: {
+        readonly ttlSeconds: number;
+        /** What clients put in a challenge's signing input; default: assertion.audience. Challenges need one of them. */
+        readonly audience: string | null;
+    };
+    readonly assertion: {
+        readonly typ: string;
+        /** Required once a strategy that reads assertions is listed. */
+        readonly audience: string | null;
+        readonly maxLifetimeSeconds: number;
+        readonly skewSeconds: number;
+    };
+    readonly httpSignature: {
+        readonly maxAgeSeconds: number;
+        readonly skewSeconds: number;
+        readonly requiredComponents: readonly string[];
+    };
+}
+/**
+ * The options of a validated `authn.keys`: frozen, with the challenge audience falling back to the assertion audience.
+ * Cached per config object, so a reloaded configuration gives fresh options. Takes options it returned as they are.
+ */
+export declare function keysOptionsOf(config: KeysConfig): KeysOptions;
+//# sourceMappingURL=options.d.ts.map

package/lib/cjs/options/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG7D,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClJ,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC1I;AAED,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,iHAAiH;QACjH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,gEAAgE;QAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,CAAC;CACH;AAuBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAc7D"}

package/lib/cjs/options/options.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keysOptionsOf = keysOptionsOf;
+const exceptions_1 = require("@spinajs/exceptions");
+const derived = new WeakMap();
+const RANGES = [
+    ['challenge', 'ttlSeconds', 1, 3600],
+    ['assertion', 'maxLifetimeSeconds', 1, 300],
+    ['assertion', 'skewSeconds', 0, 300],
+    ['httpSignature', 'maxAgeSeconds', 1, 300],
+    ['httpSignature', 'skewSeconds', 0, 300],
+];
+// The schema is the gate; this floor holds for values that never went through it (explicit Options, runtime
+// Configuration.set): a NaN or missing bound switches the lifetime and skew checks off.
+function checkRanges(config) {
+    for (const [block, key, min, max] of RANGES) {
+        const value = config[block]?.[key];
+        if (!(Number.isInteger(value) && value >= min && value <= max)) {
+            throw new exceptions_1.InvalidOption(`authn.keys.${block}.${key} must be an integer from ${min} to ${max}`);
+        }
+    }
+}
+/**
+ * The options of a validated `authn.keys`: frozen, with the challenge audience falling back to the assertion audience.
+ * Cached per config object, so a reloaded configuration gives fresh options. Takes options it returned as they are.
+ */
+function keysOptionsOf(config) {
+    let options = derived.get(config);
+    if (!options) {
+        checkRanges(config);
+        options = Object.freeze({
+            algorithms: Object.freeze([...config.algorithms]),
+            challenge: Object.freeze({ ttlSeconds: config.challenge.ttlSeconds, audience: config.challenge.audience ?? config.assertion.audience }),
+            assertion: Object.freeze({ ...config.assertion }),
+            httpSignature: Object.freeze({ ...config.httpSignature, requiredComponents: Object.freeze([...config.httpSignature.requiredComponents]) }),
+        });
+        derived.set(config, options);
+        derived.set(options, options);
+    }
+    return options;
+}
+//# sourceMappingURL=options.js.map

package/lib/cjs/options/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":";;;AACA,oDAAoD;AAgCpD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAuB,CAAC;AAEnD,MAAM,MAAM,GAAsH;IAChI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC;IACpC,CAAC,WAAW,EAAE,oBAAoB,EAAE,CAAC,EAAE,GAAG,CAAC;IAC3C,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;IACpC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,GAAG,CAAC;IAC1C,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;CACzC,CAAC;AAEF,4GAA4G;AAC5G,wFAAwF;AACxF,SAAS,WAAW,CAAC,MAAkB;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAa,MAAM,CAAC,KAAK,CAAoD,EAAE,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,GAAG,IAAK,KAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,0BAAa,CAAC,cAAc,KAAK,IAAI,GAAG,4BAA4B,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,uBAA8B,MAAkB;IAC9C,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvI,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;SAC3I,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/lib/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/lib/cjs/register-schema.d.ts

@@ -0,0 +1,2 @@
+import '@spinajs/authn/register-schema';
+//# sourceMappingURL=register-schema.d.ts.map

package/lib/cjs/register-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-schema.d.ts","sourceRoot":"","sources":["../../src/register-schema.ts"],"names":[],"mappings":"AAAA,OAAO,gCAAgC,CAAC"}

package/lib/cjs/register-schema.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+require("@spinajs/authn/register-schema");
+const configuration_1 = require("@spinajs/configuration");
+const schema_js_1 = require("./schema.js");
+// What `@spinajs/authn/register-schema` is for authn.*, for authn.keys: every module of this package that reads it
+// imports it.
+(0, configuration_1.registerConfigurationSchemaAtImport)(schema_js_1.AUTHN_KEYS_CONFIGURATION_SCHEMA);
+//# sourceMappingURL=register-schema.js.map

package/lib/cjs/register-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-schema.js","sourceRoot":"","sources":["../../src/register-schema.ts"],"names":[],"mappings":";;AAAA,0CAAwC;AACxC,0DAA6E;AAE7E,2CAA8D;AAE9D,mHAAmH;AACnH,cAAc;AACd,IAAA,mDAAmC,EAAC,2CAA+B,CAAC,CAAC"}

package/lib/cjs/registry/index.d.ts

@@ -0,0 +1,4 @@
+export * from './store.js';
+export * from './orm-store.js';
+export * from './registry.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/registry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/registry/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC"}

package/lib/cjs/registry/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./store.js"), exports);
+__exportStar(require("./orm-store.js"), exports);
+__exportStar(require("./registry.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/registry/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/registry/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,iDAA+B;AAC/B,gDAA8B"}

package/lib/cjs/registry/orm-store.d.ts

@@ -0,0 +1,15 @@
+import { Orm } from '@spinajs/orm';
+import type { IdentityRef, KeyRecord } from '@spinajs/authn/contracts';
+import { KeyStore } from './store.js';
+/** authn_key through the ORM (connection 'default', migration AuthnKeys_2026_10_02_00_00_00). */
+export declare class OrmKeyStore extends KeyStore {
+    /** The cli resolves only the command it runs, so without this the models are unbound and every query throws. */
+    protected Orm: Orm;
+    private taken;
+    insert(key: KeyRecord): Promise<'inserted' | 'duplicate'>;
+    get(kid: string): Promise<KeyRecord | null>;
+    listByOwner(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    revoke(owner: IdentityRef, kid: string, at: Date): Promise<'revoked' | 'already' | 'none'>;
+    touch(kid: string, at: Date): Promise<void>;
+}
+//# sourceMappingURL=orm-store.d.ts.map

package/lib/cjs/registry/orm-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-store.d.ts","sourceRoot":"","sources":["../../../src/registry/orm-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAgB,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAY,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAIjF,OAAO,EAAwE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAuB5G,iGAAiG;AACjG,qBACa,WAAY,SAAQ,QAAQ;IACvC,gHAAgH;IAEhH,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;YAEL,KAAK;IAMb,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,WAAW,CAAC,CA2B9D;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAIhD;IAEK,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAGnE;IAEK,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAY/F;IAEK,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhD;CACF"}