@spinajs/authn-keys 0.0.0-stage → 3.0.0

package/lib/mjs/jws/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}

package/lib/mjs/jws/json.d.ts

@@ -0,0 +1,11 @@
+import { isPlainObject } from '@spinajs/util';
+/**
+ * JSON as serde_json reads it, so this verifier agrees with the canvas C8 Rust one: refuses invalid UTF-8, lone
+ * surrogates (escaped or not, keys included, also under a duplicate key), nesting deeper than 127, numbers beyond f64,
+ * and top-level `uintKeys` whose number is not written as a plain integer. A duplicate key keeps its last value
+ * (RFC 7515 §4 allows that, and both C8 verifiers do it). Undefined when refused; never throws.
+ */
+export declare function parseStrictJson(bytes: Uint8Array, uintKeys?: readonly string[]): unknown;
+/** @deprecated Use `isPlainObject` from `@spinajs/util`. */
+export declare const isJsonObject: typeof isPlainObject;
+//# sourceMappingURL=json.d.ts.map

package/lib/mjs/jws/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../src/jws/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAY9C;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAgD5F;AAED,4DAA4D;AAC5D,eAAO,MAAM,YAAY,sBAAgB,CAAC"}

package/lib/mjs/jws/json.js

@@ -0,0 +1,72 @@
+import { isPlainObject } from '@spinajs/util';
+const LONE_SURROGATE = /\p{Surrogate}/u;
+// serde_json refuses the 128th nested array or object (its recursion limit); canvas C8 refuses it on both sides.
+const MAX_DEPTH = 127;
+// On text JSON.parse accepted, these are exactly its strings, brackets and numbers (literals are skipped).
+const TOKENS = /"[^"\\]*(?:\\.[^"\\]*)*"|[[\]{}]|-?[0-9][0-9.eE+-]*/g;
+const KEY_FOLLOWS = /\s*:/y;
+const UINT_TEXT = /^(0|[1-9][0-9]*)$/;
+const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+/**
+ * JSON as serde_json reads it, so this verifier agrees with the canvas C8 Rust one: refuses invalid UTF-8, lone
+ * surrogates (escaped or not, keys included, also under a duplicate key), nesting deeper than 127, numbers beyond f64,
+ * and top-level `uintKeys` whose number is not written as a plain integer. A duplicate key keeps its last value
+ * (RFC 7515 §4 allows that, and both C8 verifiers do it). Undefined when refused; never throws.
+ */
+export function parseStrictJson(bytes, uintKeys = []) {
+    try {
+        const text = decoder.decode(bytes);
+        const value = JSON.parse(text);
+        // The number text of each top-level key, the last occurrence winning as in JSON.parse; read from the tokens
+        // because the reviver's source text needs Node 21+.
+        const numberText = new Map();
+        const topLevelObject = text.trimStart().startsWith('{');
+        let depth = 0;
+        let key = null;
+        for (const m of text.matchAll(TOKENS)) {
+            const token = m[0];
+            const pending = key;
+            key = null;
+            if (token === '[' || token === '{') {
+                depth += 1;
+                if (depth > MAX_DEPTH) {
+                    return undefined;
+                }
+            }
+            else if (token === ']' || token === '}') {
+                depth -= 1;
+            }
+            else if (token.startsWith('"')) {
+                const s = JSON.parse(token);
+                if (LONE_SURROGATE.test(s)) {
+                    return undefined;
+                }
+                if (topLevelObject && depth === 1) {
+                    KEY_FOLLOWS.lastIndex = m.index + token.length;
+                    if (KEY_FOLLOWS.test(text)) {
+                        key = s;
+                    }
+                }
+            }
+            else if (!Number.isFinite(Number(token))) {
+                return undefined;
+            }
+            else if (pending !== null) {
+                numberText.set(pending, token);
+            }
+        }
+        for (const k of uintKeys) {
+            const t = numberText.get(k);
+            if (t !== undefined && !UINT_TEXT.test(t)) {
+                return undefined;
+            }
+        }
+        return value;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** @deprecated Use `isPlainObject` from `@spinajs/util`. */
+export const isJsonObject = isPlainObject;
+//# sourceMappingURL=json.js.map

package/lib/mjs/jws/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../src/jws/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,iHAAiH;AACjH,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,2GAA2G;AAC3G,MAAM,MAAM,GAAG,sDAAsD,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAEtC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,QAAQ,GAAsB,EAAE;IACjF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,4GAA4G;QAC5G,oDAAoD;QACpD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,OAAO,GAAG,GAAG,CAAC;YACpB,GAAG,GAAG,IAAI,CAAC;YACX,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBACnC,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;oBACtB,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBAC1C,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;iBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;gBACtC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,IAAI,cAAc,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAClC,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC,KAAM,GAAG,KAAK,CAAC,MAAM,CAAC;oBAChD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC3B,GAAG,GAAG,CAAC,CAAC;oBACV,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;iBAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC"}

package/lib/mjs/jws/signer.d.ts

@@ -0,0 +1,25 @@
+import { JwsSigner } from '@spinajs/authn/contracts';
+import type { JwsClaims, JwsKey, JwsSignOptions } from '@spinajs/authn/contracts';
+/** A private signing JWK: Ed25519 (RFC 8037) or P-256, with its `kid`. */
+export interface PrivateJwk {
+    readonly kty: string;
+    readonly crv: string;
+    readonly kid: string;
+    readonly x: string;
+    readonly y?: string;
+    readonly d: string;
+}
+/**
+ * JwsSigner over private JWKs the app loads (from a secret reference) and passes in; the first key, or `current`,
+ * signs by default. Header and claims are written exactly as canvas C8 does, so EdDSA tickets come out byte for byte.
+ */
+export declare class LocalJwsSigner extends JwsSigner {
+    private readonly keys;
+    private readonly current;
+    constructor(privateJwks: readonly PrivateJwk[], opts?: {
+        readonly current?: string;
+    });
+    sign<C extends JwsClaims>(claims: C, opts: JwsSignOptions): Promise<string>;
+    publicKeys(): Promise<readonly JwsKey[]>;
+}
+//# sourceMappingURL=signer.d.ts.map

package/lib/mjs/jws/signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../../src/jws/signer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAQlF,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAgCD;;;GAGG;AACH,qBAAa,cAAe,SAAQ,SAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,YAAY,WAAW,EAAE,SAAS,UAAU,EAAE,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,EAavF;IAEK,IAAI,CAAC,CAAC,SAAS,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBhF;IAEK,UAAU,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAE7C;CACF"}

package/lib/mjs/jws/signer.js

@@ -0,0 +1,79 @@
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import { JwsSigner } from '@spinajs/authn/contracts';
+import { _is_string, _non_empty, _try_check_arg, isNonNegativeInt } from '@spinajs/util';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { decodeB64url, encodeB64url } from '../jwk/base64url.js';
+import { checkPublicJwk, isValidKid } from '../jwk/keys.js';
+import { signRaw } from '../jwk/signature.js';
+import { parseStrictJson } from './json.js';
+function signingKey(jwk) {
+    const where = `signing key ${JSON.stringify(jwk?.kid)}`;
+    if (!isValidKid(jwk?.kid)) {
+        throw new InvalidArgument(`${where}: kid must be 1-64 of [A-Za-z0-9._-]`);
+    }
+    const material = checkPublicJwk(jwk.kty === 'EC' ? { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y } : { kty: jwk.kty, crv: jwk.crv, x: jwk.x });
+    if (!material) {
+        throw new InvalidArgument(`${where}: not a valid Ed25519 or P-256 key`);
+    }
+    if (decodeB64url(jwk.d)?.length !== 32) {
+        throw new InvalidArgument(`${where}: d must be 32 bytes of base64url`);
+    }
+    let privateKey;
+    try {
+        privateKey = createPrivateKey({ key: { ...material.jwk, d: jwk.d }, format: 'jwk' });
+    }
+    catch {
+        throw new InvalidArgument(`${where}: the private key does not load`);
+    }
+    const derived = createPublicKey(privateKey).export({ format: 'jwk' });
+    if (derived.x !== material.jwk.x || (material.jwk.kty === 'EC' && derived.y !== material.jwk.y)) {
+        throw new InvalidArgument(`${where}: the public part does not match d`);
+    }
+    return { publicKey: Object.freeze({ ...material, kid: jwk.kid }), privateKey };
+}
+/**
+ * JwsSigner over private JWKs the app loads (from a secret reference) and passes in; the first key, or `current`,
+ * signs by default. Header and claims are written exactly as canvas C8 does, so EdDSA tickets come out byte for byte.
+ */
+export class LocalJwsSigner extends JwsSigner {
+    constructor(privateJwks, opts = {}) {
+        super();
+        this.keys = new Map();
+        for (const jwk of privateJwks) {
+            if (this.keys.has(jwk.kid)) {
+                throw new InvalidArgument(`signing key ${JSON.stringify(jwk.kid)} appears twice`);
+            }
+            this.keys.set(jwk.kid, signingKey(jwk));
+        }
+        const current = opts.current ?? privateJwks[0]?.kid;
+        if (current === undefined || !this.keys.has(current)) {
+            throw new InvalidArgument(`no signing key ${JSON.stringify(current)}`);
+        }
+        this.current = current;
+    }
+    async sign(claims, opts) {
+        const kid = opts.kid ?? this.current;
+        const key = this.keys.get(kid);
+        if (!key) {
+            throw new InvalidArgument(`no signing key ${JSON.stringify(kid)}`);
+        }
+        const [hasTyp] = _try_check_arg(_is_string(_non_empty()))(opts.typ, 'opts.typ');
+        if (!hasTyp) {
+            throw new InvalidArgument('a JWS needs a typ');
+        }
+        if (typeof claims.iss !== 'string' || typeof claims.aud !== 'string' || !isNonNegativeInt(claims.iat) || !isNonNegativeInt(claims.exp) || claims.exp <= claims.iat) {
+            throw new InvalidArgument('claims need string iss and aud, and integer iat < exp in Unix seconds');
+        }
+        const header = JSON.stringify({ alg: key.publicKey.alg, kid, typ: opts.typ });
+        const payload = JSON.stringify(claims);
+        if (parseStrictJson(Buffer.from(payload, 'utf8'), ['iat', 'exp']) === undefined) {
+            throw new InvalidArgument('claims must be JSON a strict verifier reads (no lone surrogates, no nesting deeper than 127)');
+        }
+        const input = `${encodeB64url(header)}.${encodeB64url(payload)}`;
+        return `${input}.${encodeB64url(signRaw(key.publicKey.alg, key.privateKey, Buffer.from(input, 'ascii')))}`;
+    }
+    async publicKeys() {
+        return Object.freeze([...this.keys.values()].map((k) => k.publicKey));
+    }
+}
+//# sourceMappingURL=signer.js.map

package/lib/mjs/jws/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../../src/jws/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAiB5C,SAAS,UAAU,CAAC,GAAe;IACjC,MAAM,KAAK,GAAG,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClJ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,UAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAW,EAAE,UAAU,EAAE,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,SAAS;IAI3C,YAAY,WAAkC,EAAE,IAAI,GAAkC,EAAE;QACtF,KAAK,EAAE,CAAC;QAJO,SAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QAKpD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,eAAe,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,eAAe,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CAAsB,MAAS,EAAE,IAAoB;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,eAAe,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACnK,MAAM,IAAI,eAAe,CAAC,uEAAuE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAChF,MAAM,IAAI,eAAe,CAAC,8FAA8F,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7G,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;CACF"}

package/lib/mjs/jws/verifier.d.ts

@@ -0,0 +1,10 @@
+import { JwsVerifier } from '@spinajs/authn/contracts';
+import type { JwsClaims, JwsKey, JwsVerification, JwsVerifyOptions } from '@spinajs/authn/contracts';
+/**
+ * Compact JWS under the canvas C8 D4 rules (lane notes D3): the first failing check gives the code. The signature is
+ * checked with the key's own algorithm; a key that fails the key checks counts as unknown.
+ */
+export declare class StrictJwsVerifier extends JwsVerifier {
+    verify<C extends JwsClaims, K extends JwsKey = JwsKey>(token: string, opts: JwsVerifyOptions<C, K>): Promise<JwsVerification<C, K>>;
+}
+//# sourceMappingURL=verifier.d.ts.map

package/lib/mjs/jws/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/jws/verifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAA2B,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAgB,MAAM,0BAA0B,CAAC;AAW5I;;;GAGG;AACH,qBACa,iBAAkB,SAAQ,WAAW;IAC1C,MAAM,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CA2DxI;CACF"}

package/lib/mjs/jws/verifier.js

@@ -0,0 +1,83 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@spinajs/di';
+import { JwsVerifier } from '@spinajs/authn/contracts';
+import { isNonNegativeInt, isPlainObject } from '@spinajs/util';
+import { decodeB64url } from '../jwk/base64url.js';
+import { publicKeyObject } from '../jwk/keys.js';
+import { SIGNATURE_BYTES, verifySignature } from '../jwk/signature.js';
+import { parseStrictJson } from './json.js';
+const HEADER_MEMBERS = ['alg', 'kid', 'typ'];
+const fail = (code) => ({ ok: false, code });
+/**
+ * Compact JWS under the canvas C8 D4 rules (lane notes D3): the first failing check gives the code. The signature is
+ * checked with the key's own algorithm; a key that fails the key checks counts as unknown.
+ */
+let StrictJwsVerifier = class StrictJwsVerifier extends JwsVerifier {
+    async verify(token, opts) {
+        if (typeof token !== 'string') {
+            return fail('malformed');
+        }
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return fail('malformed');
+        }
+        const [headerText, payloadText, signatureText] = parts;
+        const headerBytes = decodeB64url(headerText);
+        const payloadBytes = decodeB64url(payloadText);
+        const signature = decodeB64url(signatureText);
+        if (!headerBytes || !payloadBytes || signature?.length !== SIGNATURE_BYTES) {
+            return fail('malformed');
+        }
+        const h = parseStrictJson(headerBytes);
+        if (!isPlainObject(h) || Object.keys(h).length !== HEADER_MEMBERS.length || !HEADER_MEMBERS.every((m) => typeof h[m] === 'string')) {
+            return fail('bad_header');
+        }
+        const header = Object.freeze({ alg: h.alg, kid: h.kid, typ: h.typ });
+        if (!opts.algorithms.includes(header.alg) || header.typ !== opts.typ) {
+            return fail('bad_header');
+        }
+        const key = await opts.keys(header.kid);
+        if (!key || key.alg !== header.alg || publicKeyObject(key) === null) {
+            return fail('unknown_key');
+        }
+        if (!verifySignature(key, Buffer.from(`${headerText}.${payloadText}`, 'ascii'), signature)) {
+            return fail('bad_signature');
+        }
+        const payload = parseStrictJson(payloadBytes, ['iat', 'exp']);
+        if (!isPlainObject(payload)) {
+            return fail('invalid_claims');
+        }
+        const { iss, aud, iat, exp } = payload;
+        if (typeof iss !== 'string' || typeof aud !== 'string' || !isNonNegativeInt(iat) || !isNonNegativeInt(exp) || exp <= iat || exp - iat > opts.maxLifetimeSeconds) {
+            return fail('invalid_claims');
+        }
+        const claims = opts.claims(payload);
+        if (claims === null) {
+            return fail('invalid_claims');
+        }
+        if (typeof opts.issuer === 'function' ? !opts.issuer(iss, key) : iss !== opts.issuer) {
+            return fail('wrong_issuer');
+        }
+        if (aud !== opts.audience) {
+            return fail('wrong_audience');
+        }
+        const nowS = Math.floor(opts.now.getTime() / 1000);
+        if (nowS >= exp + opts.skewSeconds) {
+            return fail('expired');
+        }
+        if (iat > nowS + opts.skewSeconds) {
+            return fail('not_yet_valid');
+        }
+        return { ok: true, header, claims, key };
+    }
+};
+StrictJwsVerifier = __decorate([
+    Injectable(JwsVerifier)
+], StrictJwsVerifier);
+export { StrictJwsVerifier };
+//# sourceMappingURL=verifier.js.map

package/lib/mjs/jws/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/jws/verifier.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAE7C,MAAM,IAAI,GAAG,CAAC,IAAkB,EAAuD,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhH;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,WAAW;IAChD,KAAK,CAAC,MAAM,CAAiD,KAAa,EAAE,IAA4B;QACtG,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC;QACvD,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE,MAAM,KAAK,eAAe,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,CAAC,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACnI,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAc,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAa,EAAE,CAAC,CAAC;QACpH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,WAAW,EAAE,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,OAAO,GAAG,eAAe,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChK,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACnD,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC3C,CAAC;CACF,CAAA;AA7DY,iBAAiB;IAD7B,UAAU,CAAC,WAAW,CAAC;GACX,iBAAiB,CA6D7B"}

package/lib/mjs/migrations/AuthnKeys_2026_10_02_00_00_00.d.ts

@@ -0,0 +1,7 @@
+import { OrmDriver, OrmMigration } from '@spinajs/orm';
+/** Design §22.16 `authn_key`, plus an owner index for GET /user/keys. */
+export declare class AuthnKeys_2026_10_02_00_00_00 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    down(connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=AuthnKeys_2026_10_02_00_00_00.d.ts.map

package/lib/mjs/migrations/AuthnKeys_2026_10_02_00_00_00.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnKeys_2026_10_02_00_00_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/AuthnKeys_2026_10_02_00_00_00.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAElE,yEAAyE;AACzE,qBACa,6BAA8B,SAAQ,YAAY;IAChD,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBpD;IAEY,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;CACF"}

package/lib/mjs/migrations/AuthnKeys_2026_10_02_00_00_00.js

@@ -0,0 +1,37 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Migration, OrmMigration } from '@spinajs/orm';
+/** Design §22.16 `authn_key`, plus an owner index for GET /user/keys. */
+let AuthnKeys_2026_10_02_00_00_00 = class AuthnKeys_2026_10_02_00_00_00 extends OrmMigration {
+    async up(connection) {
+        await connection.schema().createTable('authn_key', (table) => {
+            table.string('kid', 64).primaryKey();
+            table.string('owner_type', 16).notNull();
+            table.string('owner_id', 64).notNull();
+            table.string('alg', 16).notNull();
+            table.text('jwk').notNull();
+            table.string('thumbprint', 64).notNull();
+            table.text('scope');
+            table.string('name', 128);
+            table.dateTime('expires_at');
+            table.dateTime('revoked_at');
+            table.dateTime('last_used_at');
+            table.string('created_by', 100);
+            table.dateTime('created_at').notNull();
+        });
+        await connection.index().unique().table('authn_key').name('authn_key_thumb').columns(['thumbprint']);
+        await connection.index().table('authn_key').name('authn_key_owner').columns(['owner_type', 'owner_id']);
+    }
+    async down(connection) {
+        await connection.schema().dropTable('authn_key');
+    }
+};
+AuthnKeys_2026_10_02_00_00_00 = __decorate([
+    Migration('default')
+], AuthnKeys_2026_10_02_00_00_00);
+export { AuthnKeys_2026_10_02_00_00_00 };
+//# sourceMappingURL=AuthnKeys_2026_10_02_00_00_00.js.map

package/lib/mjs/migrations/AuthnKeys_2026_10_02_00_00_00.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnKeys_2026_10_02_00_00_00.js","sourceRoot":"","sources":["../../../src/migrations/AuthnKeys_2026_10_02_00_00_00.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,SAAS,EAAa,YAAY,EAAE,MAAM,cAAc,CAAC;AAElE,yEAAyE;AAElE,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,YAAY;IACtD,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3D,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;YACrC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACzC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACvC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5B,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1B,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7B,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7B,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAC/B,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAChC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACrG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1G,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,UAAqB;QACrC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAxBY,6BAA6B;IADzC,SAAS,CAAC,SAAS,CAAC;GACR,6BAA6B,CAwBzC"}

package/lib/mjs/migrations/index.d.ts

@@ -0,0 +1,2 @@
+export * from './AuthnKeys_2026_10_02_00_00_00.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC"}

package/lib/mjs/migrations/index.js

@@ -0,0 +1,2 @@
+export * from './AuthnKeys_2026_10_02_00_00_00.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC"}

package/lib/mjs/models/AuthnKey.d.ts

@@ -0,0 +1,22 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** A row of authn_key; OrmKeyStore maps it to the contract's KeyRecord. */
+export declare class AuthnKey extends ModelBase<AuthnKey> {
+    kid: string;
+    owner_type: string;
+    owner_id: string;
+    alg: string;
+    /** The public JWK as JSON text, required members only. */
+    jwk: string;
+    thumbprint: string;
+    /** The Ceiling as JSON text. */
+    scope?: string | null;
+    name?: string | null;
+    expires_at?: DateTime;
+    revoked_at?: DateTime;
+    last_used_at?: DateTime;
+    /** PrincipalRef as `<type>:<id>`. */
+    created_by?: string | null;
+    created_at: DateTime;
+}
+//# sourceMappingURL=AuthnKey.d.ts.map

package/lib/mjs/models/AuthnKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnKey.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,2EAA2E;AAC3E,qBAEa,QAAS,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAExC,GAAG,EAAE,MAAM,CAAC;IAEZ,UAAU,EAAE,MAAM,CAAC;IAEnB,QAAQ,EAAE,MAAM,CAAC;IAEjB,GAAG,EAAE,MAAM,CAAC;IAEnB,0DAA0D;IACnD,GAAG,EAAE,MAAM,CAAC;IAEZ,UAAU,EAAE,MAAM,CAAC;IAE1B,gCAAgC;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGrB,UAAU,CAAC,EAAE,QAAQ,CAAC;IAGtB,UAAU,CAAC,EAAE,QAAQ,CAAC;IAGtB,YAAY,CAAC,EAAE,QAAQ,CAAC;IAE/B,qCAAqC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3B,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/mjs/models/AuthnKey.js

@@ -0,0 +1,40 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** A row of authn_key; OrmKeyStore maps it to the contract's KeyRecord. */
+let AuthnKey = class AuthnKey extends ModelBase {
+};
+__decorate([
+    Primary(),
+    __metadata("design:type", String)
+], AuthnKey.prototype, "kid", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnKey.prototype, "expires_at", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnKey.prototype, "revoked_at", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnKey.prototype, "last_used_at", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnKey.prototype, "created_at", void 0);
+AuthnKey = __decorate([
+    Connection('default'),
+    Model('authn_key')
+], AuthnKey);
+export { AuthnKey };
+//# sourceMappingURL=AuthnKey.js.map

package/lib/mjs/models/AuthnKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnKey.js","sourceRoot":"","sources":["../../../src/models/AuthnKey.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,2EAA2E;AAGpE,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,SAAmB;CAkChD,CAAA;AAhCQ;IADN,OAAO,EAAE;;qCACS;AAmBZ;IADN,EAAE,EAAE;8BACe,QAAQ;4CAAC;AAGtB;IADN,EAAE,EAAE;8BACe,QAAQ;4CAAC;AAGtB;IADN,EAAE,EAAE;8BACiB,QAAQ;8CAAC;AAMxB;IADN,EAAE,EAAE;8BACc,QAAQ;4CAAC;AAjCjB,QAAQ;IAFpB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,WAAW,CAAC;GACN,QAAQ,CAkCpB"}

package/lib/mjs/models/AuthnNonce.d.ts

@@ -0,0 +1,8 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** A row of authn_nonce (design §22.16; the table comes with authn-orm's AuthnInitial migration). */
+export declare class AuthnNonce extends ModelBase<AuthnNonce> {
+    k: string;
+    expires_at: DateTime;
+}
+//# sourceMappingURL=AuthnNonce.d.ts.map

package/lib/mjs/models/AuthnNonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnNonce.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qGAAqG;AACrG,qBAEa,UAAW,SAAQ,SAAS,CAAC,UAAU,CAAC;IAE5C,CAAC,EAAE,MAAM,CAAC;IAGV,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/mjs/models/AuthnNonce.js

@@ -0,0 +1,28 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** A row of authn_nonce (design §22.16; the table comes with authn-orm's AuthnInitial migration). */
+let AuthnNonce = class AuthnNonce extends ModelBase {
+};
+__decorate([
+    Primary(),
+    __metadata("design:type", String)
+], AuthnNonce.prototype, "k", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnNonce.prototype, "expires_at", void 0);
+AuthnNonce = __decorate([
+    Connection('default'),
+    Model('authn_nonce')
+], AuthnNonce);
+export { AuthnNonce };
+//# sourceMappingURL=AuthnNonce.js.map

package/lib/mjs/models/AuthnNonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnNonce.js","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qGAAqG;AAG9F,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,SAAqB;CAMpD,CAAA;AAJQ;IADN,OAAO,EAAE;;qCACO;AAGV;IADN,EAAE,EAAE;8BACc,QAAQ;8CAAC;AALjB,UAAU;IAFtB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,aAAa,CAAC;GACR,UAAU,CAMtB"}

package/lib/mjs/models/index.d.ts

@@ -0,0 +1,3 @@
+export * from './AuthnKey.js';
+export * from './AuthnNonce.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/models/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC"}

package/lib/mjs/models/index.js

@@ -0,0 +1,3 @@
+export * from './AuthnKey.js';
+export * from './AuthnNonce.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/models/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC"}

package/lib/mjs/nonce/index.d.ts

@@ -0,0 +1,2 @@
+export * from './store.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/nonce/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nonce/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/lib/mjs/nonce/index.js

@@ -0,0 +1,2 @@
+export * from './store.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/nonce/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nonce/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/lib/mjs/nonce/store.d.ts

@@ -0,0 +1,22 @@
+import { Orm } from '@spinajs/orm';
+/** Single-use values (assertion jti, HTTP signature nonces) until they expire. */
+export declare abstract class KeyNonceStore {
+    /** True exactly once while `key` is live: the first claim keeps it until `expiresAt`; an expired key may be claimed again. */
+    abstract claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
+}
+/** A fixed-length store key for a value a client chose, scoped to the key that signed it. */
+export declare const nonceKey: (scope: 'jti' | 'sig', kid: string, value: string) => string;
+export declare class MemoryKeyNonceStore extends KeyNonceStore {
+    private readonly live;
+    private claims;
+    claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
+}
+/** authn_nonce through the ORM: the primary key makes a claim atomic across processes. */
+export declare class DbKeyNonceStore extends KeyNonceStore {
+    /** Binds the models when nothing else brought the Orm up. */
+    protected Orm: Orm;
+    private claims;
+    claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
+    private purge;
+}
+//# sourceMappingURL=store.d.ts.map

package/lib/mjs/nonce/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/nonce/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAInC,kFAAkF;AAClF,8BAAsB,aAAa;IACjC,8HAA8H;IAC9H,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3E;AAED,6FAA6F;AAC7F,eAAO,MAAM,QAAQ,UAAW,KAAK,GAAG,KAAK,OAAO,MAAM,SAAS,MAAM,KAAG,MAAmG,CAAC;AAIhL,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,MAAM,CAAK;IAEb,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBrE;CACF;AAKD,0FAA0F;AAC1F,qBACa,eAAgB,SAAQ,aAAa;IAChD,6DAA6D;IAE7D,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,OAAO,CAAC,MAAM,CAAK;IAEb,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBrE;YAEa,KAAK;CAMpB"}