@spinajs/authn-keys 0.0.0-stage → 3.0.1

package/lib/cjs/registry/orm-store.js

@@ -0,0 +1,109 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrmKeyStore = void 0;
+const di_1 = require("@spinajs/di");
+const orm_1 = require("@spinajs/orm");
+const contracts_1 = require("@spinajs/authn/contracts");
+const AuthnKey_js_1 = require("../models/AuthnKey.js");
+const luxon_1 = require("luxon");
+const store_js_1 = require("./store.js");
+function toRecord(row) {
+    const createdBy = row.created_by ? (0, store_js_1.decodePrincipalRef)(row.created_by) : undefined;
+    const expiresAt = row.expires_at?.toJSDate();
+    const revokedAt = row.revoked_at?.toJSDate();
+    const lastUsedAt = row.last_used_at?.toJSDate();
+    return Object.freeze({
+        kid: row.kid,
+        owner: Object.freeze({ type: row.owner_type, id: row.owner_id }),
+        alg: row.alg,
+        jwk: Object.freeze(JSON.parse(row.jwk)),
+        thumbprint: row.thumbprint,
+        ...(row.name ? { name: row.name } : {}),
+        ...(row.scope ? { scope: (0, store_js_1.decodeCeiling)(row.scope) } : {}),
+        createdAt: row.created_at.toJSDate(),
+        ...(createdBy ? { createdBy } : {}),
+        ...(expiresAt ? { expiresAt } : {}),
+        ...(revokedAt ? { revokedAt } : {}),
+        ...(lastUsedAt ? { lastUsedAt } : {}),
+    });
+}
+/** authn_key through the ORM (connection 'default', migration AuthnKeys_2026_10_02_00_00_00). */
+let OrmKeyStore = class OrmKeyStore extends store_js_1.KeyStore {
+    async taken(key) {
+        const byKid = await AuthnKey_js_1.AuthnKey.where('kid', key.kid);
+        const byThumb = await AuthnKey_js_1.AuthnKey.where('thumbprint', key.thumbprint);
+        return byKid.length > 0 || byThumb.length > 0;
+    }
+    async insert(key) {
+        if (await this.taken(key)) {
+            return 'duplicate';
+        }
+        const row = new AuthnKey_js_1.AuthnKey({
+            kid: key.kid,
+            owner_type: key.owner.type,
+            owner_id: key.owner.id,
+            alg: key.alg,
+            jwk: JSON.stringify(key.jwk),
+            thumbprint: key.thumbprint,
+            scope: key.scope ? (0, store_js_1.encodeCeiling)(key.scope) : null,
+            name: key.name ?? null,
+            created_by: key.createdBy ? (0, store_js_1.encodePrincipalRef)(key.createdBy) : null,
+            created_at: luxon_1.DateTime.fromJSDate(key.createdAt),
+            ...(key.expiresAt ? { expires_at: luxon_1.DateTime.fromJSDate(key.expiresAt) } : {}),
+        });
+        try {
+            await row.insert();
+        }
+        catch (e) {
+            // Drivers report a unique violation differently; a row that now exists means another insert won the race.
+            if (await this.taken(key)) {
+                return 'duplicate';
+            }
+            throw e;
+        }
+        return 'inserted';
+    }
+    async get(kid) {
+        // A case-insensitive collation (MySQL's default) would also match another case of the kid.
+        const row = (await AuthnKey_js_1.AuthnKey.where('kid', kid)).find((r) => r.kid === kid);
+        return row ? toRecord(row) : null;
+    }
+    async listByOwner(owner) {
+        const rows = await AuthnKey_js_1.AuthnKey.where({ owner_type: owner.type, owner_id: owner.id });
+        return rows.map(toRecord);
+    }
+    async revoke(owner, kid, at) {
+        const row = await this.get(kid);
+        if (!row || !(0, contracts_1.sameRef)(row.owner, owner)) {
+            return 'none';
+        }
+        if (row.revokedAt) {
+            return 'already';
+        }
+        const r = await AuthnKey_js_1.AuthnKey.update({ revoked_at: luxon_1.DateTime.fromJSDate(at) })
+            .where('kid', kid)
+            .whereNull('revoked_at');
+        return (0, orm_1.rowsAffected)(r) > 0 ? 'revoked' : 'already';
+    }
+    async touch(kid, at) {
+        await AuthnKey_js_1.AuthnKey.update({ last_used_at: luxon_1.DateTime.fromJSDate(at) }).where('kid', kid);
+    }
+};
+exports.OrmKeyStore = OrmKeyStore;
+__decorate([
+    (0, di_1.Autoinject)(orm_1.Orm),
+    __metadata("design:type", orm_1.Orm)
+], OrmKeyStore.prototype, "Orm", void 0);
+exports.OrmKeyStore = OrmKeyStore = __decorate([
+    (0, di_1.Injectable)(store_js_1.KeyStore)
+], OrmKeyStore);
+//# sourceMappingURL=orm-store.js.map

package/lib/cjs/registry/orm-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orm-store.js","sourceRoot":"","sources":["../../../src/registry/orm-store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAqD;AACrD,sCAAiD;AAEjD,wDAAmD;AACnD,uDAAiD;AACjD,iCAAiC;AACjC,yCAA4G;AAE5G,SAAS,QAAQ,CAAC,GAAa;IAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAA,6BAAkB,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAa;QAC5E,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAA,wBAAa,EAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE;QACpC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAc,CAAC;AAClB,CAAC;AAED,iGAAiG;AAE1F,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,mBAAQ;IAK/B,KAAK,CAAC,KAAK,CAAC,GAAc;QAChC,MAAM,KAAK,GAAG,MAAM,sBAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,sBAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAc;QACzB,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,sBAAQ,CAAC;YACvB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI;YAC1B,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;YACtB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAA,wBAAa,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YAClD,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,6BAAkB,EAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YACpE,UAAU,EAAE,gBAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,gBAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0GAA0G;YAC1G,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,2FAA2F;QAC3F,MAAM,GAAG,GAAG,CAAC,MAAM,sBAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC1E,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAkB;QAClC,MAAM,IAAI,GAAG,MAAM,sBAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB,EAAE,GAAW,EAAE,EAAQ;QACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAA,mBAAO,EAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,sBAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,gBAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;aACrE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;aACjB,SAAS,CAAC,YAAY,CAAC,CAAC;QAC3B,OAAO,IAAA,kBAAY,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,EAAQ;QAC/B,MAAM,sBAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,gBAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrF,CAAC;CACF,CAAA;;AAjEW;IADT,IAAA,eAAU,EAAC,SAAG,CAAC;8BACD,SAAG;wCAAC;sBAHR,WAAW;IADvB,IAAA,eAAU,EAAC,mBAAQ,CAAC;GACR,WAAW,CAoEvB"}

package/lib/cjs/registry/registry.d.ts

@@ -0,0 +1,54 @@
+import '../register-schema.js';
+import { AuthnAudit } from '@spinajs/authn/audit';
+import type { AuthnAuditor, AuthnEventBody } from '@spinajs/authn/audit';
+import { AuthnThrottle, KeyRegistry, SecretStore } from '@spinajs/authn/contracts';
+import type { AuthnContext, IdentityRef, KeyChallengeRequest, KeyChallengeResult, KeyMaterial, KeyOwner, KeyRecord, KeyRegisterResult, KeyRegistration, PrincipalRef } from '@spinajs/authn/contracts';
+import type { KeysConfig, KeysOptions } from '../options/options.js';
+import { KeyStore } from './store.js';
+/** Usable for verification: neither revoked nor expired at `now`. */
+export declare const isUsableKey: (key: KeyRecord, now: Date) => boolean;
+/**
+ * A login challenge is stored for the key it names; a name that is not a kid still gets a challenge of the same shape
+ * (A02), stored under a digest so anonymous input never becomes a long identity id.
+ */
+export declare const loginChallengeIdentity: (kid: string) => IdentityRef;
+/** A test seam for building the registry with `new`: each field replaces what DI injects. */
+export interface DefaultKeyRegistryDeps {
+    readonly store?: KeyStore;
+    readonly secrets?: SecretStore;
+    readonly throttle?: AuthnThrottle;
+    /** Published to instead of the container's AuthnAudit. */
+    readonly audit?: AuthnAuditor;
+    /** Complete options that bypass the configuration. */
+    readonly options?: KeysOptions;
+}
+/** KeyRegistry over a KeyStore, challenges in SecretStore (lane notes D7, D12). */
+export declare class DefaultKeyRegistry extends KeyRegistry {
+    protected readonly Deps?: DefaultKeyRegistryDeps | undefined;
+    protected KeysConfig: KeysConfig;
+    protected Audit: AuthnAudit;
+    protected Store: KeyStore;
+    protected Secrets: SecretStore;
+    protected Throttle: AuthnThrottle;
+    private readonly stamped;
+    /** Kids whose last stamp is remembered; past this the least recently stamped is forgotten and costs one extra write. */
+    protected readonly maxStamped: number;
+    constructor(Deps?: DefaultKeyRegistryDeps | undefined);
+    protected get store(): KeyStore;
+    protected get secrets(): SecretStore;
+    protected get throttle(): AuthnThrottle;
+    protected get options(): KeysOptions;
+    protected publish(ctx: AuthnContext, e: AuthnEventBody): Promise<void>;
+    /** The new key's signature over a 'register' challenge issued to this user; the challenge is redeemed only after the signature holds. */
+    protected proofHolds(owner: KeyOwner, key: KeyMaterial, proof: unknown): Promise<boolean>;
+    register(reg: KeyRegistration, ctx: AuthnContext): Promise<KeyRegisterResult>;
+    list(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    revoke(owner: IdentityRef, kid: string, ctx: AuthnContext, opts?: {
+        readonly actor?: PrincipalRef;
+    }): Promise<boolean>;
+    byId(kid: string): Promise<KeyRecord | null>;
+    /** Stamps last_used_at after a successful verification, at most once a minute per key so busy clients write little. */
+    touch(kid: string, at: Date): Promise<void>;
+    challenge(req: KeyChallengeRequest, ctx: AuthnContext): Promise<KeyChallengeResult>;
+}
+//# sourceMappingURL=registry.d.ts.map

package/lib/cjs/registry/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/registry/registry.ts"],"names":[],"mappings":"AAGA,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAW,WAAW,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAMhN,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAoD,QAAQ,EAAE,MAAM,YAAY,CAAC;AA4CxF,qEAAqE;AACrE,eAAO,MAAM,WAAW,QAAS,SAAS,OAAO,IAAI,KAAG,OAAwF,CAAC;AAEjJ;;;GAGG;AACH,eAAO,MAAM,sBAAsB,QAAS,MAAM,KAAG,WAAoH,CAAC;AAE1K,6FAA6F;AAC7F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;CAChC;AAED,mFAAmF;AACnF,qBACa,kBAAmB,SAAQ,WAAW;IAqBrC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB;IAnB5D,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAGjC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;IAG5B,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC;IAG1B,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;IAG/B,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC;IAElC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,wHAAwH;IACxH,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAU;IAE/C,YAA+B,IAAI,CAAC,EAAE,sBAAsB,YAAA,EAE3D;IAED,SAAS,KAAK,KAAK,IAAI,QAAQ,CAE9B;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,SAAS,KAAK,QAAQ,IAAI,aAAa,CAEtC;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;IAED,yIAAyI;IACzI,UAAgB,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9F;IAEK,QAAQ,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkDlF;IAEK,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAE5D;IAEK,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAU3H;IAEK,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAEjD;IAED,uHAAuH;IACjH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhD;IAEK,SAAS,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8BxF;CACF"}

package/lib/cjs/registry/registry.js

@@ -0,0 +1,244 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultKeyRegistry = exports.loginChallengeIdentity = exports.isUsableKey = void 0;
+const node_crypto_1 = require("node:crypto");
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+require("../register-schema.js");
+const audit_1 = require("@spinajs/authn/audit");
+const contracts_1 = require("@spinajs/authn/contracts");
+const util_1 = require("@spinajs/util");
+const exceptions_1 = require("@spinajs/exceptions");
+const challenge_js_1 = require("../challenge/challenge.js");
+const keys_js_1 = require("../jwk/keys.js");
+const options_js_1 = require("../options/options.js");
+const store_js_1 = require("./store.js");
+const OWNER_TYPES = ['user', 'service', 'agent'];
+const MAX_OWNER_ID = 64;
+const MAX_NAME = 128;
+const TOUCH_INTERVAL_MS = 60_000;
+const MAX_CREATED_BY = 100;
+const CEILING_KEYS = ['roles', 'permissions', 'resources', 'expiresAt', 'reason'];
+const nonEmpty = (v, max) => typeof v === 'string' && v.length > 0 && v.length <= max;
+function ownerOf(v) {
+    const o = (0, util_1.isPlainObject)(v) ? v : {};
+    const [typeOk, type] = (0, util_1._try_check_arg)((0, util_1._is_string)((0, util_1._contains)(OWNER_TYPES)))(o.type, 'owner.type');
+    const [idOk, id] = (0, util_1._try_check_arg)((0, util_1._is_string)((0, util_1._between)(1, MAX_OWNER_ID)))(o.id, 'owner.id');
+    if (!typeOk || !idOk) {
+        throw new exceptions_1.InvalidArgument('a key owner is a user, a service or an agent with an id of 1-64 characters');
+    }
+    return Object.freeze({ type: type, id: id });
+}
+/** An actor that fits authn_key.created_by (varchar 100). */
+function principalRefOf(v) {
+    const o = (0, util_1.isPlainObject)(v) ? v : {};
+    const [typeOk, type] = (0, util_1._try_check_arg)((0, util_1._is_string)((0, util_1._between)(1, MAX_CREATED_BY)))(o.type, 'actor.type');
+    const [idOk, id] = (0, util_1._try_check_arg)((0, util_1._is_string)((0, util_1._between)(1, MAX_CREATED_BY)))(o.id, 'actor.id');
+    if (!typeOk || !idOk) {
+        return null;
+    }
+    const ref = Object.freeze({ type: type, id: id });
+    return (0, store_js_1.encodePrincipalRef)(ref).length <= MAX_CREATED_BY ? ref : null;
+}
+const strings = (v) => Array.isArray(v) && v.every((x) => typeof x === 'string');
+/** The Ceiling shape (design §5), so a malformed scope never reaches storage. */
+function isCeiling(v) {
+    if (!(0, util_1.isPlainObject)(v) || Object.keys(v).some((k) => !CEILING_KEYS.includes(k))) {
+        return false;
+    }
+    const resources = v.resources;
+    return (v.roles === undefined || strings(v.roles)) && (v.permissions === undefined || strings(v.permissions)) && (resources === undefined || (Array.isArray(resources) && resources.every((r) => (0, util_1.isPlainObject)(r) && typeof r.type === 'string' && (r.id === undefined || typeof r.id === 'string')))) && (v.expiresAt === undefined || (v.expiresAt instanceof Date && !Number.isNaN(v.expiresAt.getTime()))) && (v.reason === undefined || typeof v.reason === 'string');
+}
+/** Usable for verification: neither revoked nor expired at `now`. */
+const isUsableKey = (key, now) => !key.revokedAt && (!key.expiresAt || now.getTime() < key.expiresAt.getTime());
+exports.isUsableKey = isUsableKey;
+/**
+ * A login challenge is stored for the key it names; a name that is not a kid still gets a challenge of the same shape
+ * (A02), stored under a digest so anonymous input never becomes a long identity id.
+ */
+const loginChallengeIdentity = (kid) => ({ type: 'key', id: (0, keys_js_1.isValidKid)(kid) ? kid : (0, node_crypto_1.createHash)('sha256').update(kid, 'utf8').digest('hex') });
+exports.loginChallengeIdentity = loginChallengeIdentity;
+/** KeyRegistry over a KeyStore, challenges in SecretStore (lane notes D7, D12). */
+let DefaultKeyRegistry = class DefaultKeyRegistry extends contracts_1.KeyRegistry {
+    constructor(Deps) {
+        super();
+        this.Deps = Deps;
+        this.stamped = new Map();
+        /** Kids whose last stamp is remembered; past this the least recently stamped is forgotten and costs one extra write. */
+        this.maxStamped = 10_000;
+    }
+    get store() {
+        return this.Deps?.store ?? this.Store;
+    }
+    get secrets() {
+        return this.Deps?.secrets ?? this.Secrets;
+    }
+    get throttle() {
+        return this.Deps?.throttle ?? this.Throttle;
+    }
+    get options() {
+        return (0, options_js_1.keysOptionsOf)(this.Deps?.options ?? this.KeysConfig);
+    }
+    publish(ctx, e) {
+        return (this.Deps?.audit ?? this.Audit).publishIn(ctx, e);
+    }
+    /** The new key's signature over a 'register' challenge issued to this user; the challenge is redeemed only after the signature holds. */
+    async proofHolds(owner, key, proof) {
+        if (!(0, util_1.isPlainObject)(proof)) {
+            return false;
+        }
+        const parsed = (0, challenge_js_1.parseChallengeId)(proof.challengeId);
+        const audience = this.options.challenge.audience;
+        if (!parsed || audience === null || !(0, challenge_js_1.verifyChallengeSignature)(key, parsed.nonce, 'register', audience, proof.signature)) {
+            return false;
+        }
+        return this.secrets.redeem({ type: 'user', id: owner.id }, (0, challenge_js_1.challengeSecretPurpose)(parsed.rid), parsed.nonce);
+    }
+    async register(reg, ctx) {
+        const r = reg;
+        const owner = ownerOf(r.owner);
+        const fail = async (code) => {
+            await this.publish(ctx, { type: 'key.register', outcome: 'failure', identity: owner, reason: code });
+            return { ok: false, code };
+        };
+        const material = (0, keys_js_1.checkPublicJwk)(r.jwk, this.options.algorithms);
+        const kid = r.kid === undefined && material ? (0, keys_js_1.thumbprint)(material.jwk) : r.kid;
+        const expiresAt = r.expiresAt;
+        const badExpiry = expiresAt !== undefined && (!(expiresAt instanceof Date) || !(expiresAt.getTime() > ctx.now.getTime()));
+        // Names reach admin terminals (authn:key-list): no control characters.
+        const badName = r.name !== undefined && (!nonEmpty(r.name, MAX_NAME) || /[\u0000-\u001f\u007f-\u009f]/.test(r.name));
+        const badScope = r.scope !== undefined && !isCeiling(r.scope);
+        if (!material || !(0, keys_js_1.isValidKid)(kid) || badExpiry || badName || badScope) {
+            return fail('invalid_key');
+        }
+        let createdBy;
+        if (owner.type === 'user') {
+            if (!(await this.proofHolds(owner, material, r.proof))) {
+                return fail('invalid_proof');
+            }
+        }
+        else {
+            const actor = principalRefOf(r.actor);
+            if (!actor) {
+                throw new exceptions_1.InvalidArgument('a service or agent key is registered by an actor (admin route or CLI)');
+            }
+            createdBy = actor;
+        }
+        const key = {
+            ...material,
+            kid,
+            owner,
+            thumbprint: (0, keys_js_1.thumbprint)(material.jwk),
+            ...(r.name !== undefined ? { name: r.name } : {}),
+            // A copy through the stored form, so the memory store keeps what the ORM store would return.
+            ...(r.scope !== undefined ? { scope: (0, store_js_1.decodeCeiling)((0, store_js_1.encodeCeiling)(r.scope)) } : {}),
+            createdAt: ctx.now,
+            ...(createdBy ? { createdBy } : {}),
+            ...(expiresAt !== undefined ? { expiresAt: expiresAt } : {}),
+        };
+        if ((await this.store.insert(key)) === 'duplicate') {
+            return fail('duplicate');
+        }
+        const stored = (await this.store.get(kid)) ?? key;
+        await this.publish(ctx, { type: 'key.register', outcome: 'success', identity: owner, ...(createdBy ? { actor: createdBy } : {}), data: { kid, thumbprint: stored.thumbprint, alg: stored.alg } });
+        return { ok: true, key: stored };
+    }
+    async list(owner) {
+        return this.store.listByOwner(owner);
+    }
+    async revoke(owner, kid, ctx, opts) {
+        const done = (0, keys_js_1.isValidKid)(kid) ? await this.store.revoke(owner, kid, ctx.now) : 'none';
+        if (done === 'none') {
+            return false;
+        }
+        if (done === 'already') {
+            return true;
+        }
+        await this.publish(ctx, { type: 'key.revoke', outcome: 'success', identity: owner, ...(opts?.actor ? { actor: opts.actor } : {}), data: { kid } });
+        return true;
+    }
+    async byId(kid) {
+        return (0, keys_js_1.isValidKid)(kid) ? this.store.get(kid) : null;
+    }
+    /** Stamps last_used_at after a successful verification, at most once a minute per key so busy clients write little. */
+    async touch(kid, at) {
+        const last = this.stamped.get(kid);
+        if (last !== undefined && at.getTime() - last < TOUCH_INTERVAL_MS && at.getTime() >= last) {
+            return;
+        }
+        this.stamped.delete(kid);
+        if (this.stamped.size >= this.maxStamped) {
+            this.stamped.delete(this.stamped.keys().next().value);
+        }
+        this.stamped.set(kid, at.getTime());
+        await this.store.touch(kid, at);
+    }
+    async challenge(req, ctx) {
+        const r = req;
+        let identity;
+        if (r.purpose === 'register') {
+            const owner = ownerOf(r.owner);
+            if (owner.type !== 'user') {
+                throw new exceptions_1.InvalidArgument('register challenges are issued to users; services and agents register without a proof');
+            }
+            identity = owner;
+        }
+        else if (r.purpose === 'login' && typeof r.kid === 'string') {
+            if (ctx.ip) {
+                const t = await this.throttle.attempt([{ kind: 'ip', value: ctx.ip }], 'login', ctx);
+                if (!t.allowed) {
+                    return { ok: false, retryAfterSeconds: t.retryAfterSeconds };
+                }
+            }
+            identity = (0, exports.loginChallengeIdentity)(r.kid);
+        }
+        else {
+            throw new exceptions_1.InvalidArgument('a key challenge is { purpose: register, owner } or { purpose: login, kid }');
+        }
+        const { ttlSeconds: ttl, audience } = this.options.challenge;
+        if (audience === null) {
+            throw new exceptions_1.InvalidOption('authn.keys.challenge.audience (or authn.keys.assertion.audience) must be set to issue key challenges');
+        }
+        const rid = (0, challenge_js_1.newChallengeRid)();
+        const nonce = await this.secrets.issue(identity, (0, challenge_js_1.challengeSecretPurpose)(rid), ttl);
+        if (!(0, challenge_js_1.isChallengeNonce)(nonce)) {
+            throw new exceptions_1.UnexpectedServerError('the SecretStore must issue base64url secrets of at least 128 bits for key challenges');
+        }
+        return { ok: true, challenge: Object.freeze({ id: (0, challenge_js_1.challengeId)(rid, nonce), nonce, expiresAt: new Date(ctx.now.getTime() + ttl * 1000) }) };
+    }
+};
+exports.DefaultKeyRegistry = DefaultKeyRegistry;
+__decorate([
+    (0, configuration_1.Config)('authn.keys'),
+    __metadata("design:type", Object)
+], DefaultKeyRegistry.prototype, "KeysConfig", void 0);
+__decorate([
+    (0, di_1.Autoinject)(audit_1.AuthnAudit),
+    __metadata("design:type", audit_1.AuthnAudit)
+], DefaultKeyRegistry.prototype, "Audit", void 0);
+__decorate([
+    (0, di_1.Autoinject)(store_js_1.KeyStore),
+    __metadata("design:type", store_js_1.KeyStore)
+], DefaultKeyRegistry.prototype, "Store", void 0);
+__decorate([
+    (0, di_1.Autoinject)(contracts_1.SecretStore),
+    __metadata("design:type", contracts_1.SecretStore)
+], DefaultKeyRegistry.prototype, "Secrets", void 0);
+__decorate([
+    (0, di_1.Autoinject)(contracts_1.AuthnThrottle),
+    __metadata("design:type", contracts_1.AuthnThrottle)
+], DefaultKeyRegistry.prototype, "Throttle", void 0);
+exports.DefaultKeyRegistry = DefaultKeyRegistry = __decorate([
+    (0, di_1.Injectable)(contracts_1.KeyRegistry),
+    __metadata("design:paramtypes", [Object])
+], DefaultKeyRegistry);
+//# sourceMappingURL=registry.js.map

package/lib/cjs/registry/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/registry/registry.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAyC;AACzC,oCAAqD;AACrD,0DAAgD;AAChD,iCAA+B;AAC/B,gDAAkD;AAElD,wDAAmF;AAEnF,wCAA+F;AAC/F,oDAA4F;AAC5F,4DAA+J;AAC/J,4CAAwE;AACxE,sDAAsD;AAEtD,yCAAwF;AAExF,MAAM,WAAW,GAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAElF,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,GAAW,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;AAEpH,SAAS,OAAO,CAAC,CAAU;IACzB,MAAM,CAAC,GAA4B,IAAA,oBAAa,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,gBAAS,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAChG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,4BAAe,CAAC,4EAA4E,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAwB,EAAE,EAAE,EAAE,EAAY,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,6DAA6D;AAC7D,SAAS,cAAc,CAAC,CAAU;IAChC,MAAM,CAAC,GAA4B,IAAA,oBAAa,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACrG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,eAAQ,EAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAc,EAAE,EAAE,EAAE,EAAY,EAAE,CAAC,CAAC;IACtE,OAAO,IAAA,6BAAkB,EAAC,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAEnG,iFAAiF;AACjF,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,IAAA,oBAAa,EAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC9B,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAa,EAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AAC7c,CAAC;AAED,qEAAqE;AAC9D,MAAM,WAAW,GAAG,CAAC,GAAc,EAAE,GAAS,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;AAApI,QAAA,WAAW,GAAX,WAAW,CAAyH;AAEjJ;;;GAGG;AACI,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAe,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAA7J,QAAA,sBAAsB,GAAtB,sBAAsB,CAAuI;AAa1K,mFAAmF;AAE5E,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,uBAAW;IAqBjD,YAA+B,IAA6B;QAC1D,KAAK,EAAE,CAAC;QADqB,SAAI,GAAJ,IAAI,CAAyB;QAL3C,YAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAErD,wHAAwH;QACrG,eAAU,GAAW,MAAM,CAAC;IAI/C,CAAC;IAED,IAAc,KAAK;QACjB,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;IACxC,CAAC;IAED,IAAc,OAAO;QACnB,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;IAC5C,CAAC;IAED,IAAc,QAAQ;QACpB,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,IAAc,OAAO;QACnB,OAAO,IAAA,0BAAa,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAES,OAAO,CAAC,GAAiB,EAAE,CAAiB;QACpD,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,yIAAyI;IAC/H,KAAK,CAAC,UAAU,CAAC,KAAe,EAAE,GAAgB,EAAE,KAAc;QAC1E,IAAI,CAAC,IAAA,oBAAa,EAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAA,uCAAwB,EAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACxH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,IAAA,qCAAsB,EAAC,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/G,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAoB,EAAE,GAAiB;QACpD,MAAM,CAAC,GAAG,GAAyC,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,EAAE,IAAmD,EAA8B,EAAE;YACrG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,IAAA,wBAAc,EAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAA,oBAAU,EAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/E,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,YAAY,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1H,uEAAuE;QACvE,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACrH,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC,IAAI,SAAS,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,SAAmC,CAAC;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,4BAAe,CAAC,uEAAuE,CAAC,CAAC;YACrG,CAAC;YACD,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,GAAG,GAAG;YACV,GAAG,QAAQ;YACX,GAAG;YACH,KAAK;YACL,UAAU,EAAE,IAAA,oBAAU,EAAC,QAAQ,CAAC,GAAG,CAAC;YACpC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,6FAA6F;YAC7F,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAA,wBAAa,EAAC,IAAA,wBAAa,EAAC,CAAC,CAAC,KAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7F,SAAS,EAAE,GAAG,CAAC,GAAG;YAClB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;QACf,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;QAClD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClM,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAkB;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB,EAAE,GAAW,EAAE,GAAiB,EAAE,IAAwC;QACvG,MAAM,IAAI,GAAG,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACrF,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACnJ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QACpB,OAAO,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAED,uHAAuH;IACvH,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,EAAQ;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,iBAAiB,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAwB,EAAE,GAAiB;QACzD,MAAM,CAAC,GAAG,GAAyC,CAAC;QACpD,IAAI,QAAqB,CAAC;QAC1B,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,4BAAe,CAAC,uFAAuF,CAAC,CAAC;YACrH,CAAC;YACD,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;aAAM,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC9D,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBACrF,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;oBACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,QAAQ,GAAG,IAAA,QAAA,sBAAsB,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,4BAAe,CAAC,4EAA4E,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,0BAAa,CAAC,sGAAsG,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,8BAAe,GAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAA,qCAAsB,EAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACnF,IAAI,CAAC,IAAA,+BAAgB,EAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,kCAAqB,CAAC,sFAAsF,CAAC,CAAC;QAC1H,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,0BAAW,EAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7I,CAAC;CACF,CAAA;;AA7KW;IADT,IAAA,sBAAM,EAAC,YAAY,CAAC;;sDACY;AAGvB;IADT,IAAA,eAAU,EAAC,kBAAU,CAAC;8BACN,kBAAU;iDAAC;AAGlB;IADT,IAAA,eAAU,EAAC,mBAAQ,CAAC;8BACJ,mBAAQ;iDAAC;AAGhB;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACL,uBAAW;mDAAC;AAGrB;IADT,IAAA,eAAU,EAAC,yBAAa,CAAC;8BACN,yBAAa;oDAAC;6BAdvB,kBAAkB;IAD9B,IAAA,eAAU,EAAC,uBAAW,CAAC;;GACX,kBAAkB,CA+K9B"}

package/lib/cjs/registry/store.d.ts

@@ -0,0 +1,25 @@
+import type { Ceiling, IdentityRef, KeyRecord, PrincipalRef } from '@spinajs/authn/contracts';
+/** authn_key behind DefaultKeyRegistry: MemoryKeyStore, or OrmKeyStore in apps. */
+export declare abstract class KeyStore {
+    /** 'duplicate' when the kid or the thumbprint is taken, also when another insert won a race. */
+    abstract insert(key: KeyRecord): Promise<'inserted' | 'duplicate'>;
+    abstract get(kid: string): Promise<KeyRecord | null>;
+    abstract listByOwner(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    /** Sets revokedAt unless already set ('already'); 'none' when the key does not exist or belongs to another owner (type and id). */
+    abstract revoke(owner: IdentityRef, kid: string, at: Date): Promise<'revoked' | 'already' | 'none'>;
+    abstract touch(kid: string, at: Date): Promise<void>;
+}
+export declare function encodePrincipalRef(ref: PrincipalRef): string;
+export declare function decodePrincipalRef(text: string): PrincipalRef;
+export declare function encodeCeiling(scope: Ceiling): string;
+export declare function decodeCeiling(text: string): Ceiling;
+/** In-process authn_key, for tests and single-process apps. */
+export declare class MemoryKeyStore extends KeyStore {
+    private readonly rows;
+    insert(key: KeyRecord): Promise<'inserted' | 'duplicate'>;
+    get(kid: string): Promise<KeyRecord | null>;
+    listByOwner(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    revoke(owner: IdentityRef, kid: string, at: Date): Promise<'revoked' | 'already' | 'none'>;
+    touch(kid: string, at: Date): Promise<void>;
+}
+//# sourceMappingURL=store.d.ts.map

package/lib/cjs/registry/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/registry/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG9F,mFAAmF;AACnF,8BAAsB,QAAQ;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,WAAW,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACrD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACxE,mIAAmI;IACnI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAAC;IACpG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,MAAM,CAE5D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAG7D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD;AAID,+DAA+D;AAC/D,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;IAE/C,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,WAAW,CAAC,CAM9D;IAEK,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAEhD;IAEK,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAEnE;IAEK,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAU/F;IAEK,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhD;CACF"}

package/lib/cjs/registry/store.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryKeyStore = exports.KeyStore = void 0;
+exports.encodePrincipalRef = encodePrincipalRef;
+exports.decodePrincipalRef = decodePrincipalRef;
+exports.encodeCeiling = encodeCeiling;
+exports.decodeCeiling = decodeCeiling;
+const contracts_1 = require("@spinajs/authn/contracts");
+/** authn_key behind DefaultKeyRegistry: MemoryKeyStore, or OrmKeyStore in apps. */
+class KeyStore {
+}
+exports.KeyStore = KeyStore;
+function encodePrincipalRef(ref) {
+    return (0, contracts_1.principalKey)(ref);
+}
+function decodePrincipalRef(text) {
+    const at = text.indexOf(':');
+    return { type: decodeURIComponent(text.slice(0, at)), id: text.slice(at + 1) };
+}
+function encodeCeiling(scope) {
+    return JSON.stringify(scope);
+}
+function decodeCeiling(text) {
+    const raw = JSON.parse(text);
+    return Object.freeze(raw.expiresAt === undefined ? raw : { ...raw, expiresAt: new Date(raw.expiresAt) });
+}
+const freeze = (k) => Object.freeze({ ...k, owner: Object.freeze({ ...k.owner }), jwk: Object.freeze({ ...k.jwk }) });
+/** In-process authn_key, for tests and single-process apps. */
+class MemoryKeyStore extends KeyStore {
+    constructor() {
+        super(...arguments);
+        this.rows = new Map();
+    }
+    async insert(key) {
+        if (this.rows.has(key.kid) || [...this.rows.values()].some((r) => r.thumbprint === key.thumbprint)) {
+            return 'duplicate';
+        }
+        this.rows.set(key.kid, freeze(key));
+        return 'inserted';
+    }
+    async get(kid) {
+        return this.rows.get(kid) ?? null;
+    }
+    async listByOwner(owner) {
+        return [...this.rows.values()].filter((r) => (0, contracts_1.sameRef)(r.owner, owner));
+    }
+    async revoke(owner, kid, at) {
+        const row = this.rows.get(kid);
+        if (!row || !(0, contracts_1.sameRef)(row.owner, owner)) {
+            return 'none';
+        }
+        if (row.revokedAt) {
+            return 'already';
+        }
+        this.rows.set(kid, freeze({ ...row, revokedAt: at }));
+        return 'revoked';
+    }
+    async touch(kid, at) {
+        const row = this.rows.get(kid);
+        if (row) {
+            this.rows.set(kid, freeze({ ...row, lastUsedAt: at }));
+        }
+    }
+}
+exports.MemoryKeyStore = MemoryKeyStore;
+//# sourceMappingURL=store.js.map

package/lib/cjs/registry/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/registry/store.ts"],"names":[],"mappings":";;;;;;;AACA,wDAAiE;AAEjE,mFAAmF;AACnF;CAQC;;AAED,4BAAmC,GAAiB;IAClD,OAAO,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,4BAAmC,IAAY;IAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,uBAA8B,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,uBAA8B,IAAY;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAC;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AAC3G,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAY,EAAa,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAc,CAAC;AAEzJ,+DAA+D;AAC/D,oBAA4B,SAAQ,QAAQ;IAA5C;;QACmB,SAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAoCvD,CAAC;IAlCC,KAAK,CAAC,MAAM,CAAC,GAAc;QACzB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACnG,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAkB;QAClC,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,mBAAO,EAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAkB,EAAE,GAAW,EAAE,EAAQ;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,IAAI,CAAC,IAAA,mBAAO,EAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,EAAQ;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF"}

package/lib/cjs/schema.d.ts

@@ -0,0 +1,88 @@
+/** The authn.keys fragment of the authn configuration; `assertion.typ` is in the authn schema. */
+export declare const AUTHN_KEYS_CONFIGURATION_SCHEMA: {
+    $id: string;
+    $configurationModule: string;
+    description: string;
+    type: string;
+    properties: {
+        algorithms: {
+            type: string;
+            minItems: number;
+            uniqueItems: boolean;
+            items: {
+                type: string;
+                enum: string[];
+            };
+            default: string[];
+        };
+        challenge: {
+            type: string;
+            default: {};
+            properties: {
+                ttlSeconds: {
+                    type: string;
+                    minimum: number;
+                    maximum: number;
+                    default: number;
+                };
+                audience: {
+                    type: string[];
+                    minLength: number;
+                    default: null;
+                    description: string;
+                };
+            };
+        };
+        assertion: {
+            type: string;
+            default: {};
+            properties: {
+                audience: {
+                    type: string[];
+                    minLength: number;
+                    default: null;
+                    description: string;
+                };
+                maxLifetimeSeconds: {
+                    type: string;
+                    minimum: number;
+                    maximum: number;
+                    default: number;
+                };
+                skewSeconds: {
+                    type: string;
+                    minimum: number;
+                    maximum: number;
+                    default: number;
+                };
+            };
+        };
+        httpSignature: {
+            type: string;
+            default: {};
+            properties: {
+                maxAgeSeconds: {
+                    type: string;
+                    minimum: number;
+                    maximum: number;
+                    default: number;
+                };
+                skewSeconds: {
+                    type: string;
+                    minimum: number;
+                    maximum: number;
+                    default: number;
+                };
+                requiredComponents: {
+                    type: string;
+                    items: {
+                        type: string;
+                        minLength: number;
+                    };
+                    default: string[];
+                };
+            };
+        };
+    };
+};
+//# sourceMappingURL=schema.d.ts.map

package/lib/cjs/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/schema.ts"],"names":[],"mappings":"AAEA,kGAAkG;AAClG,eAAO,MAAM,+BAA+B;;;;;;;YAM1B,IAAI;YAAW,QAAQ;YAAK,WAAW;YAAQ,KAAK;gBAAI,IAAI;gBAAY,IAAI;;YAAwB,OAAO;;;YAEvH,IAAI;YACJ,OAAO;YACP,UAAU;gBACR,UAAU;oBAAI,IAAI;oBAAa,OAAO;oBAAK,OAAO;oBAAQ,OAAO;;gBACjE,QAAQ;oBAAI,IAAI;oBAAsB,SAAS;oBAAK,OAAO;oBAAQ,WAAW;;;;;YAIhF,IAAI;YACJ,OAAO;YACP,UAAU;gBACR,QAAQ;oBAAI,IAAI;oBAAsB,SAAS;oBAAK,OAAO;oBAAQ,WAAW;;gBAC9E,kBAAkB;oBAAI,IAAI;oBAAa,OAAO;oBAAK,OAAO;oBAAO,OAAO;;gBACxE,WAAW;oBAAI,IAAI;oBAAa,OAAO;oBAAK,OAAO;oBAAO,OAAO;;;;;;;;;oBAOhD,IAAI;oBAAa,OAAO;oBAAK,OAAO;oBAAO,OAAO;;;oBACpD,IAAI;oBAAa,OAAO;oBAAK,OAAO;oBAAO,OAAO;;;;;wBAhC5B,IAAI;wBAAY,SAAS;;;;;;;CAqCrE,CAAC"}