@spinajs/authn-keys 3.0.2 → 3.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spinajs/authn-keys",
-  "version": "3.0.2",
+  "version": "3.0.4",
   "description": "Key registry, JWS and HTTP signature authentication for SpinaJS",
   "main": "lib/cjs/index.js",
   "module": "lib/mjs/index.js",
@@ -64,18 +64,27 @@
   },
   "homepage": "https://github.com/spinajs/main#readme",
   "dependencies": {
-    "@spinajs/authn": "3.0.2",
-    "@spinajs/cli": "3.0.2",
-    "@spinajs/configuration": "3.0.2",
-    "@spinajs/di": "3.0.2",
-    "@spinajs/exceptions": "3.0.2",
-    "@spinajs/log": "3.0.2",
-    "@spinajs/orm": "3.0.2",
-    "@spinajs/util": "3.0.2",
+    "@spinajs/authn": "3.0.4",
+    "@spinajs/cli": "3.0.4",
+    "@spinajs/configuration": "3.0.4",
+    "@spinajs/di": "3.0.4",
+    "@spinajs/exceptions": "3.0.4",
+    "@spinajs/log": "3.0.4",
+    "@spinajs/orm": "3.0.4",
+    "@spinajs/util": "3.0.4",
     "luxon": "^3.6.1"
   },
+  "peerDependencies": {
+    "@spinajs/authn-orm": "3.0.4"
+  },
+  "peerDependenciesMeta": {
+    "@spinajs/authn-orm": {
+      "optional": true
+    }
+  },
   "devDependencies": {
-    "@spinajs/authn-testing": "3.0.2",
-    "@spinajs/orm-sqlite": "3.0.2"
+    "@spinajs/authn-orm": "3.0.4",
+    "@spinajs/authn-testing": "3.0.4",
+    "@spinajs/orm-sqlite": "3.0.4"
   }
 }

package/lib/cjs/models/AuthnNonce.d.ts

@@ -1,8 +0,0 @@
-import { ModelBase } from '@spinajs/orm';
-import { DateTime } from 'luxon';
-/** A row of authn_nonce (design §22.16; the table comes with authn-orm's AuthnInitial migration). */
-export declare class AuthnNonce extends ModelBase<AuthnNonce> {
-    k: string;
-    expires_at: DateTime;
-}
-//# sourceMappingURL=AuthnNonce.d.ts.map

package/lib/cjs/models/AuthnNonce.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthnNonce.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qGAAqG;AACrG,qBAEa,UAAW,SAAQ,SAAS,CAAC,UAAU,CAAC;IAE5C,CAAC,EAAE,MAAM,CAAC;IAGV,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/cjs/models/AuthnNonce.js

@@ -1,31 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthnNonce = void 0;
-const orm_1 = require("@spinajs/orm");
-const luxon_1 = require("luxon");
-/** A row of authn_nonce (design §22.16; the table comes with authn-orm's AuthnInitial migration). */
-let AuthnNonce = class AuthnNonce extends orm_1.ModelBase {
-};
-exports.AuthnNonce = AuthnNonce;
-__decorate([
-    (0, orm_1.Primary)(),
-    __metadata("design:type", String)
-], AuthnNonce.prototype, "k", void 0);
-__decorate([
-    (0, orm_1.DateTime)(),
-    __metadata("design:type", luxon_1.DateTime)
-], AuthnNonce.prototype, "expires_at", void 0);
-exports.AuthnNonce = AuthnNonce = __decorate([
-    (0, orm_1.Connection)('default'),
-    (0, orm_1.Model)('authn_nonce')
-], AuthnNonce);
-//# sourceMappingURL=AuthnNonce.js.map

package/lib/cjs/models/AuthnNonce.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthnNonce.js","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAqF;AACrF,iCAAiC;AAEjC,qGAAqG;AAG9F,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,eAAqB;CAMpD,CAAA;;AAJQ;IADN,IAAA,aAAO,GAAE;;qCACO;AAGV;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;8CAAC;qBALjB,UAAU;IAFtB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,aAAa,CAAC;GACR,UAAU,CAMtB"}

package/lib/cjs/nonce/index.d.ts

@@ -1,2 +0,0 @@
-export * from './store.js';
-//# sourceMappingURL=index.d.ts.map

package/lib/cjs/nonce/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nonce/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/lib/cjs/nonce/index.js

@@ -1,18 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./store.js"), exports);
-//# sourceMappingURL=index.js.map

package/lib/cjs/nonce/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nonce/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B"}

package/lib/cjs/nonce/store.d.ts

@@ -1,22 +0,0 @@
-import { Orm } from '@spinajs/orm';
-/** Single-use values (assertion jti, HTTP signature nonces) until they expire. */
-export declare abstract class KeyNonceStore {
-    /** True exactly once while `key` is live: the first claim keeps it until `expiresAt`; an expired key may be claimed again. */
-    abstract claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
-}
-/** A fixed-length store key for a value a client chose, scoped to the key that signed it. */
-export declare const nonceKey: (scope: 'jti' | 'sig', kid: string, value: string) => string;
-export declare class MemoryKeyNonceStore extends KeyNonceStore {
-    private readonly live;
-    private claims;
-    claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
-}
-/** authn_nonce through the ORM: the primary key makes a claim atomic across processes. */
-export declare class DbKeyNonceStore extends KeyNonceStore {
-    /** Binds the models when nothing else brought the Orm up. */
-    protected Orm: Orm;
-    private claims;
-    claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
-    private purge;
-}
-//# sourceMappingURL=store.d.ts.map

package/lib/cjs/nonce/store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/nonce/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAInC,kFAAkF;AAClF,8BAAsB,aAAa;IACjC,8HAA8H;IAC9H,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3E;AAED,6FAA6F;AAC7F,eAAO,MAAM,QAAQ,UAAW,KAAK,GAAG,KAAK,OAAO,MAAM,SAAS,MAAM,KAAG,MAAmG,CAAC;AAIhL,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,MAAM,CAAK;IAEb,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBrE;CACF;AAKD,0FAA0F;AAC1F,qBACa,eAAgB,SAAQ,aAAa;IAChD,6DAA6D;IAE7D,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,OAAO,CAAC,MAAM,CAAK;IAEb,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBrE;YAEa,KAAK;CAMpB"}

package/lib/cjs/nonce/store.js

@@ -1,98 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbKeyNonceStore = exports.MemoryKeyNonceStore = exports.nonceKey = exports.KeyNonceStore = void 0;
-const node_crypto_1 = require("node:crypto");
-const di_1 = require("@spinajs/di");
-const orm_1 = require("@spinajs/orm");
-const luxon_1 = require("luxon");
-const AuthnNonce_js_1 = require("../models/AuthnNonce.js");
-/** Single-use values (assertion jti, HTTP signature nonces) until they expire. */
-class KeyNonceStore {
-}
-exports.KeyNonceStore = KeyNonceStore;
-/** A fixed-length store key for a value a client chose, scoped to the key that signed it. */
-const nonceKey = (scope, kid, value) => `${scope}:${(0, node_crypto_1.createHash)('sha256').update(`${kid}\n${value}`, 'utf8').digest('base64url')}`;
-exports.nonceKey = nonceKey;
-const SWEEP_EVERY = 256;
-class MemoryKeyNonceStore extends KeyNonceStore {
-    constructor() {
-        super(...arguments);
-        this.live = new Map();
-        this.claims = 0;
-    }
-    async claim(key, expiresAt, now) {
-        const nowMs = now.getTime();
-        this.claims += 1;
-        if (this.claims % SWEEP_EVERY === 0) {
-            for (const [k, until] of this.live) {
-                if (until <= nowMs) {
-                    this.live.delete(k);
-                }
-            }
-        }
-        const until = this.live.get(key);
-        if (until !== undefined && until > nowMs) {
-            return false;
-        }
-        this.live.set(key, expiresAt.getTime());
-        return true;
-    }
-}
-exports.MemoryKeyNonceStore = MemoryKeyNonceStore;
-const PURGE_EVERY = 64;
-const PURGE_BATCH = 500;
-/** authn_nonce through the ORM: the primary key makes a claim atomic across processes. */
-let DbKeyNonceStore = class DbKeyNonceStore extends KeyNonceStore {
-    constructor() {
-        super(...arguments);
-        this.claims = 0;
-    }
-    async claim(key, expiresAt, now) {
-        const nowDt = luxon_1.DateTime.fromJSDate(now);
-        this.claims += 1;
-        if (this.claims % PURGE_EVERY === 0) {
-            await this.purge(nowDt);
-        }
-        try {
-            await new AuthnNonce_js_1.AuthnNonce({ k: key, expires_at: luxon_1.DateTime.fromJSDate(expiresAt) }).insert();
-            return true;
-        }
-        catch (e) {
-            // Taken: only an expired row may be taken over, and the conditional update lets one claimant win.
-            const r = (await AuthnNonce_js_1.AuthnNonce.update({ expires_at: luxon_1.DateTime.fromJSDate(expiresAt) })
-                .where('k', key)
-                .where('expires_at', '<=', nowDt));
-            if ((r?.RowsAffected ?? 0) === 1) {
-                return true;
-            }
-            if ((await AuthnNonce_js_1.AuthnNonce.where('k', key)).length === 0) {
-                throw e;
-            }
-            return false;
-        }
-    }
-    async purge(now) {
-        const expired = await AuthnNonce_js_1.AuthnNonce.where('expires_at', '<=', now).take(PURGE_BATCH);
-        if (expired.length > 0) {
-            await AuthnNonce_js_1.AuthnNonce.destroy(expired.map((r) => r.k)).where('expires_at', '<=', now);
-        }
-    }
-};
-exports.DbKeyNonceStore = DbKeyNonceStore;
-__decorate([
-    (0, di_1.Autoinject)(orm_1.Orm),
-    __metadata("design:type", orm_1.Orm)
-], DbKeyNonceStore.prototype, "Orm", void 0);
-exports.DbKeyNonceStore = DbKeyNonceStore = __decorate([
-    (0, di_1.Injectable)(KeyNonceStore)
-], DbKeyNonceStore);
-//# sourceMappingURL=store.js.map

package/lib/cjs/nonce/store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/nonce/store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAyC;AACzC,oCAAqD;AACrD,sCAAmC;AACnC,iCAAiC;AACjC,2DAAqD;AAErD,kFAAkF;AAClF;CAGC;;AAED,6FAA6F;AACtF,MAAM,QAAQ,GAAG,CAAC,KAAoB,EAAE,GAAW,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,KAAK,IAAI,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAAnK,QAAA,QAAQ,GAAR,QAAQ,CAA2J;AAEhL,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,yBAAiC,SAAQ,aAAa;IAAtD;;QACmB,SAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,WAAM,GAAG,CAAC,CAAC;IAmBrB,CAAC;IAjBC,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS;QACjD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;oBACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;;AAED,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,0FAA0F;AAEnF,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,aAAa;IAA3C;;QAKG,WAAM,GAAG,CAAC,CAAC;IAgCrB,CAAC;IA9BC,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS;QACjD,MAAM,KAAK,GAAG,gBAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,0BAAU,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kGAAkG;YAClG,MAAM,CAAC,GAAG,CAAC,MAAM,0BAAU,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,gBAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;iBAC/E,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;iBACf,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAyC,CAAC;YAC7E,IAAI,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,0BAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,CAAC;YACV,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAa;QAC/B,MAAM,OAAO,GAAiB,MAAM,0BAAU,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,0BAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF,CAAA;;AAlCW;IADT,IAAA,eAAU,EAAC,SAAG,CAAC;8BACD,SAAG;4CAAC;0BAHR,eAAe;IAD3B,IAAA,eAAU,EAAC,aAAa,CAAC;GACb,eAAe,CAqC3B"}

package/lib/mjs/models/AuthnNonce.d.ts

@@ -1,8 +0,0 @@
-import { ModelBase } from '@spinajs/orm';
-import { DateTime } from 'luxon';
-/** A row of authn_nonce (design §22.16; the table comes with authn-orm's AuthnInitial migration). */
-export declare class AuthnNonce extends ModelBase<AuthnNonce> {
-    k: string;
-    expires_at: DateTime;
-}
-//# sourceMappingURL=AuthnNonce.d.ts.map

package/lib/mjs/models/AuthnNonce.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthnNonce.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qGAAqG;AACrG,qBAEa,UAAW,SAAQ,SAAS,CAAC,UAAU,CAAC;IAE5C,CAAC,EAAE,MAAM,CAAC;IAGV,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/mjs/models/AuthnNonce.js

@@ -1,28 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
-import { DateTime } from 'luxon';
-/** A row of authn_nonce (design §22.16; the table comes with authn-orm's AuthnInitial migration). */
-let AuthnNonce = class AuthnNonce extends ModelBase {
-};
-__decorate([
-    Primary(),
-    __metadata("design:type", String)
-], AuthnNonce.prototype, "k", void 0);
-__decorate([
-    DT(),
-    __metadata("design:type", DateTime)
-], AuthnNonce.prototype, "expires_at", void 0);
-AuthnNonce = __decorate([
-    Connection('default'),
-    Model('authn_nonce')
-], AuthnNonce);
-export { AuthnNonce };
-//# sourceMappingURL=AuthnNonce.js.map

package/lib/mjs/models/AuthnNonce.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthnNonce.js","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qGAAqG;AAG9F,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,SAAqB;CAMpD,CAAA;AAJQ;IADN,OAAO,EAAE;;qCACO;AAGV;IADN,EAAE,EAAE;8BACc,QAAQ;8CAAC;AALjB,UAAU;IAFtB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,aAAa,CAAC;GACR,UAAU,CAMtB"}

package/lib/mjs/nonce/index.d.ts

@@ -1,2 +0,0 @@
-export * from './store.js';
-//# sourceMappingURL=index.d.ts.map

package/lib/mjs/nonce/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nonce/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/lib/mjs/nonce/index.js

@@ -1,2 +0,0 @@
-export * from './store.js';
-//# sourceMappingURL=index.js.map

package/lib/mjs/nonce/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nonce/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/lib/mjs/nonce/store.d.ts

@@ -1,22 +0,0 @@
-import { Orm } from '@spinajs/orm';
-/** Single-use values (assertion jti, HTTP signature nonces) until they expire. */
-export declare abstract class KeyNonceStore {
-    /** True exactly once while `key` is live: the first claim keeps it until `expiresAt`; an expired key may be claimed again. */
-    abstract claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
-}
-/** A fixed-length store key for a value a client chose, scoped to the key that signed it. */
-export declare const nonceKey: (scope: 'jti' | 'sig', kid: string, value: string) => string;
-export declare class MemoryKeyNonceStore extends KeyNonceStore {
-    private readonly live;
-    private claims;
-    claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
-}
-/** authn_nonce through the ORM: the primary key makes a claim atomic across processes. */
-export declare class DbKeyNonceStore extends KeyNonceStore {
-    /** Binds the models when nothing else brought the Orm up. */
-    protected Orm: Orm;
-    private claims;
-    claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
-    private purge;
-}
-//# sourceMappingURL=store.d.ts.map

package/lib/mjs/nonce/store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/nonce/store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAInC,kFAAkF;AAClF,8BAAsB,aAAa;IACjC,8HAA8H;IAC9H,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3E;AAED,6FAA6F;AAC7F,eAAO,MAAM,QAAQ,UAAW,KAAK,GAAG,KAAK,OAAO,MAAM,SAAS,MAAM,KAAG,MAAmG,CAAC;AAIhL,qBAAa,mBAAoB,SAAQ,aAAa;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,MAAM,CAAK;IAEb,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBrE;CACF;AAKD,0FAA0F;AAC1F,qBACa,eAAgB,SAAQ,aAAa;IAChD,6DAA6D;IAE7D,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,OAAO,CAAC,MAAM,CAAK;IAEb,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBrE;YAEa,KAAK;CAMpB"}

package/lib/mjs/nonce/store.js

@@ -1,92 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { createHash } from 'node:crypto';
-import { Autoinject, Injectable } from '@spinajs/di';
-import { Orm } from '@spinajs/orm';
-import { DateTime } from 'luxon';
-import { AuthnNonce } from '../models/AuthnNonce.js';
-/** Single-use values (assertion jti, HTTP signature nonces) until they expire. */
-export class KeyNonceStore {
-}
-/** A fixed-length store key for a value a client chose, scoped to the key that signed it. */
-export const nonceKey = (scope, kid, value) => `${scope}:${createHash('sha256').update(`${kid}\n${value}`, 'utf8').digest('base64url')}`;
-const SWEEP_EVERY = 256;
-export class MemoryKeyNonceStore extends KeyNonceStore {
-    constructor() {
-        super(...arguments);
-        this.live = new Map();
-        this.claims = 0;
-    }
-    async claim(key, expiresAt, now) {
-        const nowMs = now.getTime();
-        this.claims += 1;
-        if (this.claims % SWEEP_EVERY === 0) {
-            for (const [k, until] of this.live) {
-                if (until <= nowMs) {
-                    this.live.delete(k);
-                }
-            }
-        }
-        const until = this.live.get(key);
-        if (until !== undefined && until > nowMs) {
-            return false;
-        }
-        this.live.set(key, expiresAt.getTime());
-        return true;
-    }
-}
-const PURGE_EVERY = 64;
-const PURGE_BATCH = 500;
-/** authn_nonce through the ORM: the primary key makes a claim atomic across processes. */
-let DbKeyNonceStore = class DbKeyNonceStore extends KeyNonceStore {
-    constructor() {
-        super(...arguments);
-        this.claims = 0;
-    }
-    async claim(key, expiresAt, now) {
-        const nowDt = DateTime.fromJSDate(now);
-        this.claims += 1;
-        if (this.claims % PURGE_EVERY === 0) {
-            await this.purge(nowDt);
-        }
-        try {
-            await new AuthnNonce({ k: key, expires_at: DateTime.fromJSDate(expiresAt) }).insert();
-            return true;
-        }
-        catch (e) {
-            // Taken: only an expired row may be taken over, and the conditional update lets one claimant win.
-            const r = (await AuthnNonce.update({ expires_at: DateTime.fromJSDate(expiresAt) })
-                .where('k', key)
-                .where('expires_at', '<=', nowDt));
-            if ((r?.RowsAffected ?? 0) === 1) {
-                return true;
-            }
-            if ((await AuthnNonce.where('k', key)).length === 0) {
-                throw e;
-            }
-            return false;
-        }
-    }
-    async purge(now) {
-        const expired = await AuthnNonce.where('expires_at', '<=', now).take(PURGE_BATCH);
-        if (expired.length > 0) {
-            await AuthnNonce.destroy(expired.map((r) => r.k)).where('expires_at', '<=', now);
-        }
-    }
-};
-__decorate([
-    Autoinject(Orm),
-    __metadata("design:type", Orm)
-], DbKeyNonceStore.prototype, "Orm", void 0);
-DbKeyNonceStore = __decorate([
-    Injectable(KeyNonceStore)
-], DbKeyNonceStore);
-export { DbKeyNonceStore };
-//# sourceMappingURL=store.js.map

package/lib/mjs/nonce/store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/nonce/store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,kFAAkF;AAClF,MAAM,OAAgB,aAAa;CAGlC;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAoB,EAAE,GAAW,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAEhL,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IAAtD;;QACmB,SAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,WAAM,GAAG,CAAC,CAAC;IAmBrB,CAAC;IAjBC,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS;QACjD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;oBACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,0FAA0F;AAEnF,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,aAAa;IAA3C;;QAKG,WAAM,GAAG,CAAC,CAAC;IAgCrB,CAAC;IA9BC,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACtF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,kGAAkG;YAClG,MAAM,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;iBAC/E,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;iBACf,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAyC,CAAC;YAC7E,IAAI,CAAC,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,CAAC;YACV,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,GAAa;QAC/B,MAAM,OAAO,GAAiB,MAAM,UAAU,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;CACF,CAAA;AAlCW;IADT,UAAU,CAAC,GAAG,CAAC;8BACD,GAAG;4CAAC;AAHR,eAAe;IAD3B,UAAU,CAAC,aAAa,CAAC;GACb,eAAe,CAqC3B"}