@spinajs/authn-keys 3.0.3 → 3.0.5

package/README.md

@@ -24,8 +24,15 @@ The registry and the strategies get their dependencies through DI. Tests
 build them with `new`, passing the dependencies in one object, e.g.
 `new DefaultKeyRegistry({ store, secrets, throttle, options })` or
 `new HttpSignatureStrategy({ registry, nonces, options })`. `OrmKeyStore`
-and `DbKeyNonceStore` inject the `Orm`, so the `authn:key-*` commands bring
-the database up on their own.
+injects the `Orm`, so the `authn:key-*` commands bring the database up on
+their own.
+
+`JwsAssertionStrategy` and `HttpSignatureStrategy` claim each `jti` and
+signature nonce in the core `NonceStore` (`@spinajs/authn/contracts`). Only
+`@spinajs/authn-orm` registers one (`DbNonceStore`), so import it, or register
+your own `NonceStore`; without one the strategies fail at boot with an error
+naming `@spinajs/authn-orm`. `MemoryNonceStore` from `@spinajs/authn/nonces`
+is for tests and single-process apps, and is not registered for you.
 
 ## Challenges
 
@@ -146,7 +153,8 @@ unknown key with the same work and result as a bad signature, throttles by
 | `httpSignature.skewSeconds` | `30` |
 | `httpSignature.requiredComponents` | `['@method', '@target-uri', 'content-digest']` |
 
-`authn_nonce` comes with `@spinajs/authn-orm`'s `AuthnInitial` migration.
+`authn_nonce` and the `NonceStore` that fills it (`DbNonceStore`) come with
+`@spinajs/authn-orm`; this package has no nonce table or model of its own.
 
 List the strategies an app uses in `authn.strategies`; `service` is the
 class name:

package/lib/cjs/cli/AddKey.d.ts

@@ -1,6 +1,6 @@
-import { CliCommand } from '@spinajs/cli';
 import { Log } from '@spinajs/log';
 import { KeyRegistry } from '@spinajs/authn/contracts';
+import { KeyCliCommand } from './KeyCliCommand.js';
 interface AddKeyOptions {
     jwk?: string;
     file?: string;
@@ -9,7 +9,7 @@ interface AddKeyOptions {
     expires?: string;
 }
 /** Services and agents only: a user registers a key with a proof of possession, which the CLI cannot give. */
-export declare class AddKey extends CliCommand {
+export declare class AddKey extends KeyCliCommand {
     protected Log: Log;
     protected Registry: KeyRegistry;
     execute(ownerType: string, ownerId: string, options: AddKeyOptions): Promise<void>;

package/lib/cjs/cli/AddKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AddKey.d.ts","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAmB,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAK9E,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8GAA8G;AAC9G,qBAQa,MAAO,SAAQ,UAAU;IAEpC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9F;CACF"}
+{"version":3,"file":"AddKey.d.ts","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAI9E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8GAA8G;AAC9G,qBAQa,MAAO,SAAQ,aAAa;IAEvC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9F;CACF"}

package/lib/cjs/cli/AddKey.js

@@ -16,8 +16,9 @@ const log_1 = require("@spinajs/log");
 const contracts_1 = require("@spinajs/authn/contracts");
 const exceptions_1 = require("@spinajs/exceptions");
 const common_js_1 = require("./common.js");
+const KeyCliCommand_js_1 = require("./KeyCliCommand.js");
 /** Services and agents only: a user registers a key with a proof of possession, which the CLI cannot give. */
-let AddKey = class AddKey extends cli_1.CliCommand {
+let AddKey = class AddKey extends KeyCliCommand_js_1.KeyCliCommand {
     async execute(ownerType, ownerId, options) {
         const owner = (0, common_js_1.ownerArg)(ownerType, ownerId);
         if (owner.type === 'user') {

package/lib/cjs/cli/AddKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"AddKey.js","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAAqE;AACrE,sCAA2C;AAC3C,wDAA8E;AAE9E,oDAAsD;AACtD,2CAAsD;AAUtD,8GAA8G;AASvG,IAAM,MAAM,GAAZ,MAAM,MAAO,SAAQ,gBAAU;IAO7B,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,OAAsB;QAC7E,MAAM,KAAK,GAAG,IAAA,oBAAQ,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAe,CAAC,4EAA4E,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,wEAAwE;QACxE,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAQ,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,4BAAe,CAAC,6DAA6D,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,GAAG,GAAG;YACV,KAAK;YACL,KAAK,EAAE,qBAAS;YAChB,GAAG,EAAE,IAAA,yBAAa,EAAC,OAAO,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjB,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAA,sBAAU,GAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,4BAAe,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,8DAA8D,CAAC,CAAC;IACrJ,CAAC;CACF,CAAA;;AA7BW;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;mCAAC;AAGT;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;wCAAC;iBALrB,MAAM;IARlB,IAAA,aAAO,EAAC,eAAe,EAAE,oEAAoE,CAAC;IAC9F,IAAA,cAAQ,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IAC/G,IAAA,cAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,4BAA4B,CAAC;IACvD,IAAA,YAAM,EAAC,cAAc,EAAE,KAAK,EAAE,wBAAwB,CAAC;IACvD,IAAA,YAAM,EAAC,eAAe,EAAE,KAAK,EAAE,uDAAuD,CAAC;IACvF,IAAA,YAAM,EAAC,aAAa,EAAE,KAAK,EAAE,kEAAkE,CAAC;IAChG,IAAA,YAAM,EAAC,eAAe,EAAE,KAAK,EAAE,6BAA6B,CAAC;IAC7D,IAAA,YAAM,EAAC,iBAAiB,EAAE,KAAK,EAAE,6CAA6C,CAAC;GACnE,MAAM,CA+BlB"}
+{"version":3,"file":"AddKey.js","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAAyD;AACzD,sCAA2C;AAC3C,wDAA8E;AAE9E,oDAAsD;AACtD,2CAAsD;AACtD,yDAAmD;AAUnD,8GAA8G;AASvG,IAAM,MAAM,GAAZ,MAAM,MAAO,SAAQ,gCAAa;IAOhC,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,OAAsB;QAC7E,MAAM,KAAK,GAAG,IAAA,oBAAQ,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAe,CAAC,4EAA4E,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,wEAAwE;QACxE,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAQ,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,4BAAe,CAAC,6DAA6D,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,GAAG,GAAG;YACV,KAAK;YACL,KAAK,EAAE,qBAAS;YAChB,GAAG,EAAE,IAAA,yBAAa,EAAC,OAAO,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjB,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAA,sBAAU,GAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,4BAAe,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,8DAA8D,CAAC,CAAC;IACrJ,CAAC;CACF,CAAA;;AA7BW;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;mCAAC;AAGT;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;wCAAC;iBALrB,MAAM;IARlB,IAAA,aAAO,EAAC,eAAe,EAAE,oEAAoE,CAAC;IAC9F,IAAA,cAAQ,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IAC/G,IAAA,cAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,4BAA4B,CAAC;IACvD,IAAA,YAAM,EAAC,cAAc,EAAE,KAAK,EAAE,wBAAwB,CAAC;IACvD,IAAA,YAAM,EAAC,eAAe,EAAE,KAAK,EAAE,uDAAuD,CAAC;IACvF,IAAA,YAAM,EAAC,aAAa,EAAE,KAAK,EAAE,kEAAkE,CAAC;IAChG,IAAA,YAAM,EAAC,eAAe,EAAE,KAAK,EAAE,6BAA6B,CAAC;IAC7D,IAAA,YAAM,EAAC,iBAAiB,EAAE,KAAK,EAAE,6CAA6C,CAAC;GACnE,MAAM,CA+BlB"}

package/lib/cjs/cli/KeyCliCommand.d.ts

@@ -0,0 +1,10 @@
+import { CliCommand } from '@spinajs/cli';
+import { OrmMigrator } from '@spinajs/orm';
+/**
+ * The cli resolves only the command it runs, so the command boots the Orm and the `Migration.OnStartup` pass that
+ * creates the key tables, as an app process does; model queries on such a connection throw until that pass ran.
+ */
+export declare abstract class KeyCliCommand extends CliCommand {
+    protected Migrator: OrmMigrator;
+}
+//# sourceMappingURL=KeyCliCommand.d.ts.map

package/lib/cjs/cli/KeyCliCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyCliCommand.d.ts","sourceRoot":"","sources":["../../../src/cli/KeyCliCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C;;;GAGG;AACH,8BAAsB,aAAc,SAAQ,UAAU;IAEpD,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;CACjC"}

package/lib/cjs/{models/AuthnNonce.js → cli/KeyCliCommand.js}

@@ -9,23 +9,19 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthnNonce = void 0;
+exports.KeyCliCommand = void 0;
+const cli_1 = require("@spinajs/cli");
+const di_1 = require("@spinajs/di");
 const orm_1 = require("@spinajs/orm");
-const luxon_1 = require("luxon");
-/** A row of authn_nonce (design §22.16; the table comes with authn-orm's AuthnInitial migration). */
-let AuthnNonce = class AuthnNonce extends orm_1.ModelBase {
-};
-exports.AuthnNonce = AuthnNonce;
-__decorate([
-    (0, orm_1.Primary)(),
-    __metadata("design:type", String)
-], AuthnNonce.prototype, "k", void 0);
+/**
+ * The cli resolves only the command it runs, so the command boots the Orm and the `Migration.OnStartup` pass that
+ * creates the key tables, as an app process does; model queries on such a connection throw until that pass ran.
+ */
+class KeyCliCommand extends cli_1.CliCommand {
+}
+exports.KeyCliCommand = KeyCliCommand;
 __decorate([
-    (0, orm_1.DateTime)(),
-    __metadata("design:type", luxon_1.DateTime)
-], AuthnNonce.prototype, "expires_at", void 0);
-exports.AuthnNonce = AuthnNonce = __decorate([
-    (0, orm_1.Connection)('default'),
-    (0, orm_1.Model)('authn_nonce')
-], AuthnNonce);
-//# sourceMappingURL=AuthnNonce.js.map
+    (0, di_1.Autoinject)(orm_1.OrmMigrator),
+    __metadata("design:type", orm_1.OrmMigrator)
+], KeyCliCommand.prototype, "Migrator", void 0);
+//# sourceMappingURL=KeyCliCommand.js.map

package/lib/cjs/cli/KeyCliCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyCliCommand.js","sourceRoot":"","sources":["../../../src/cli/KeyCliCommand.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAA0C;AAC1C,oCAAyC;AACzC,sCAA2C;AAE3C;;;GAGG;AACH,mBAAoC,SAAQ,gBAAU;CAGrD;;AADW;IADT,IAAA,eAAU,EAAC,iBAAW,CAAC;8BACJ,iBAAW;+CAAC"}

package/lib/cjs/cli/ListKeys.d.ts

@@ -1,9 +1,9 @@
-import { CliCommand } from '@spinajs/cli';
 import { Log } from '@spinajs/log';
 import { KeyRegistry } from '@spinajs/authn/contracts';
 import type { KeyRecord } from '@spinajs/authn/contracts';
+import { KeyCliCommand } from './KeyCliCommand.js';
 export declare function keyLine(k: KeyRecord): string;
-export declare class ListKeys extends CliCommand {
+export declare class ListKeys extends KeyCliCommand {
     protected Log: Log;
     protected Registry: KeyRegistry;
     execute(ownerType: string, ownerId: string): Promise<void>;

package/lib/cjs/cli/ListKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ListKeys.d.ts","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAK1D,wBAAgB,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAE5C;AAED,qBAGa,QAAS,SAAQ,UAAU;IAEtC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;CACF"}
+{"version":3,"file":"ListKeys.d.ts","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAInD,wBAAgB,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAE5C;AAED,qBAGa,QAAS,SAAQ,aAAa;IAEzC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;CACF"}

package/lib/cjs/cli/ListKeys.js

@@ -16,11 +16,12 @@ const cli_1 = require("@spinajs/cli");
 const log_1 = require("@spinajs/log");
 const contracts_1 = require("@spinajs/authn/contracts");
 const common_js_1 = require("./common.js");
+const KeyCliCommand_js_1 = require("./KeyCliCommand.js");
 const iso = (d) => (d ? d.toISOString() : '-');
 function keyLine(k) {
     return [k.kid, k.alg, k.name ?? '-', `created ${iso(k.createdAt)}`, `expires ${iso(k.expiresAt)}`, `revoked ${iso(k.revokedAt)}`, `last used ${iso(k.lastUsedAt)}`].join('  ');
 }
-let ListKeys = class ListKeys extends cli_1.CliCommand {
+let ListKeys = class ListKeys extends KeyCliCommand_js_1.KeyCliCommand {
     async execute(ownerType, ownerId) {
         const keys = await this.Registry.list((0, common_js_1.ownerArg)(ownerType, ownerId));
         if (keys.length === 0) {

package/lib/cjs/cli/ListKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"ListKeys.js","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAA6D;AAC7D,sCAA2C;AAC3C,wDAAuD;AAEvD,2CAAoD;AAEpD,MAAM,GAAG,GAAG,CAAC,CAAQ,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE9D,iBAAwB,CAAY;IAClC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjL,CAAC;AAKM,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,gBAAU;IAO/B,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,oBAAQ,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF,CAAA;;AAdW;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;qCAAC;AAGT;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;0CAAC;mBALrB,QAAQ;IAHpB,IAAA,aAAO,EAAC,gBAAgB,EAAE,2FAA2F,CAAC;IACtH,IAAA,cAAQ,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAW,EAAE,CAAC;IAC1G,IAAA,cAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;GACvD,QAAQ,CAgBpB"}
+{"version":3,"file":"ListKeys.js","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAAiD;AACjD,sCAA2C;AAC3C,wDAAuD;AAEvD,2CAAoD;AACpD,yDAAmD;AAEnD,MAAM,GAAG,GAAG,CAAC,CAAQ,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE9D,iBAAwB,CAAY;IAClC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjL,CAAC;AAKM,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,gCAAa;IAOlC,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,oBAAQ,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF,CAAA;;AAdW;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;qCAAC;AAGT;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;0CAAC;mBALrB,QAAQ;IAHpB,IAAA,aAAO,EAAC,gBAAgB,EAAE,2FAA2F,CAAC;IACtH,IAAA,cAAQ,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAW,EAAE,CAAC;IAC1G,IAAA,cAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;GACvD,QAAQ,CAgBpB"}

package/lib/cjs/cli/RevokeKey.d.ts

@@ -1,7 +1,7 @@
-import { CliCommand } from '@spinajs/cli';
 import { Log } from '@spinajs/log';
 import { KeyRegistry } from '@spinajs/authn/contracts';
-export declare class RevokeKey extends CliCommand {
+import { KeyCliCommand } from './KeyCliCommand.js';
+export declare class RevokeKey extends KeyCliCommand {
     protected Log: Log;
     protected Registry: KeyRegistry;
     execute(ownerType: string, ownerId: string, kid: string): Promise<void>;

package/lib/cjs/cli/RevokeKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RevokeKey.d.ts","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAI9E,qBAIa,SAAU,SAAQ,UAAU;IAEvC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnF;CACF"}
+{"version":3,"file":"RevokeKey.d.ts","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAG9E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,qBAIa,SAAU,SAAQ,aAAa;IAE1C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnF;CACF"}

package/lib/cjs/cli/RevokeKey.js

@@ -16,7 +16,8 @@ const log_1 = require("@spinajs/log");
 const contracts_1 = require("@spinajs/authn/contracts");
 const exceptions_1 = require("@spinajs/exceptions");
 const common_js_1 = require("./common.js");
-let RevokeKey = class RevokeKey extends cli_1.CliCommand {
+const KeyCliCommand_js_1 = require("./KeyCliCommand.js");
+let RevokeKey = class RevokeKey extends KeyCliCommand_js_1.KeyCliCommand {
     async execute(ownerType, ownerId, kid) {
         if (!(await this.Registry.revoke((0, common_js_1.ownerArg)(ownerType, ownerId), kid, (0, contracts_1.cliContext)(), { actor: contracts_1.CLI_ACTOR }))) {
             throw new exceptions_1.InvalidArgument(`no key ${kid} of ${ownerType} ${ownerId}`);

package/lib/cjs/cli/RevokeKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"RevokeKey.js","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAA6D;AAC7D,sCAA2C;AAC3C,wDAA8E;AAC9E,oDAAsD;AACtD,2CAAoD;AAM7C,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,gBAAU;IAOhC,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,GAAW;QAClE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAA,oBAAQ,EAAC,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,IAAA,sBAAU,GAAE,EAAE,EAAE,KAAK,EAAE,qBAAS,EAAE,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,4BAAe,CAAC,UAAU,GAAG,OAAO,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;;AAXW;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;sCAAC;AAGT;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;2CAAC;oBALrB,SAAS;IAJrB,IAAA,aAAO,EAAC,kBAAkB,EAAE,oDAAoD,CAAC;IACjF,IAAA,cAAQ,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAW,EAAE,CAAC;IAC1G,IAAA,cAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;IACnE,IAAA,cAAQ,EAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC;GACnB,SAAS,CAarB"}
+{"version":3,"file":"RevokeKey.js","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAAiD;AACjD,sCAA2C;AAC3C,wDAA8E;AAC9E,oDAAsD;AACtD,2CAAoD;AACpD,yDAAmD;AAM5C,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,gCAAa;IAOnC,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,GAAW;QAClE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAA,oBAAQ,EAAC,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,IAAA,sBAAU,GAAE,EAAE,EAAE,KAAK,EAAE,qBAAS,EAAE,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,4BAAe,CAAC,UAAU,GAAG,OAAO,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;;AAXW;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;sCAAC;AAGT;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;2CAAC;oBALrB,SAAS;IAJrB,IAAA,aAAO,EAAC,kBAAkB,EAAE,oDAAoD,CAAC;IACjF,IAAA,cAAQ,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAW,EAAE,CAAC;IAC1G,IAAA,cAAQ,EAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;IACnE,IAAA,cAAQ,EAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC;GACnB,SAAS,CAarB"}

package/lib/cjs/cli/index.d.ts

@@ -1,4 +1,5 @@
 export * from './common.js';
+export * from './KeyCliCommand.js';
 export * from './AddKey.js';
 export * from './ListKeys.js';
 export * from './RevokeKey.js';

package/lib/cjs/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}

package/lib/cjs/cli/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./common.js"), exports);
+__exportStar(require("./KeyCliCommand.js"), exports);
 __exportStar(require("./AddKey.js"), exports);
 __exportStar(require("./ListKeys.js"), exports);
 __exportStar(require("./RevokeKey.js"), exports);

package/lib/cjs/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,8CAA4B;AAC5B,gDAA8B;AAC9B,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,qDAAmC;AACnC,8CAA4B;AAC5B,gDAA8B;AAC9B,iDAA+B"}

package/lib/cjs/index.d.ts

@@ -5,7 +5,6 @@ export * from './models/index.js';
 export * from './migrations/index.js';
 export * from './registry/index.js';
 export * from './jws/index.js';
-export * from './nonce/index.js';
 export * from './strategies/index.js';
 export * from './httpsig/index.js';
 export * from './schema.js';

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/lib/cjs/index.js

@@ -21,7 +21,6 @@ __exportStar(require("./models/index.js"), exports);
 __exportStar(require("./migrations/index.js"), exports);
 __exportStar(require("./registry/index.js"), exports);
 __exportStar(require("./jws/index.js"), exports);
-__exportStar(require("./nonce/index.js"), exports);
 __exportStar(require("./strategies/index.js"), exports);
 __exportStar(require("./httpsig/index.js"), exports);
 __exportStar(require("./schema.js"), exports);

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,oDAAkC;AAClC,wDAAsC;AACtC,sDAAoC;AACpC,iDAA+B;AAC/B,mDAAiC;AACjC,wDAAsC;AACtC,qDAAmC;AACnC,8CAA4B;AAC5B,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,oDAAkC;AAClC,wDAAsC;AACtC,sDAAoC;AACpC,iDAA+B;AAC/B,wDAAsC;AACtC,qDAAmC;AACnC,8CAA4B;AAC5B,iDAA+B"}

package/lib/cjs/jws/index.d.ts

@@ -1,4 +1,5 @@
 export * from './json.js';
 export * from './verifier.js';
 export * from './signer.js';
+export * from './register.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/jws/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/lib/cjs/jws/index.js

@@ -17,4 +17,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./json.js"), exports);
 __exportStar(require("./verifier.js"), exports);
 __exportStar(require("./signer.js"), exports);
+__exportStar(require("./register.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/jws/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,gDAA8B;AAC9B,8CAA4B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,gDAA8B;AAC9B,8CAA4B;AAC5B,gDAA8B"}

package/lib/cjs/jws/register.d.ts

@@ -0,0 +1,18 @@
+import { Bootstrapper } from '@spinajs/di';
+import type { IContainer } from '@spinajs/di';
+import '../register-schema.js';
+import { LocalJwsSigner } from './signer.js';
+/** `authn.keys.signer`. */
+export interface SignerConfig {
+    readonly current: string;
+    /** Secret references the configuration resolves to private JWKs as JSON text. */
+    readonly keys: readonly string[];
+}
+/** Registers a JwsSigner built from `authn.keys.signer` in `container`; null, and nothing registered, when it is null. */
+export declare function registerJwsSigner(container: IContainer): Promise<LocalJwsSigner | null>;
+/** Registers the configured JwsSigner at boot, so the JWKS route and the verifiers' key lookup find it. */
+export declare class AuthnKeysSignerBootstrapper extends Bootstrapper {
+    protected Container: IContainer;
+    bootstrap(): Promise<void>;
+}
+//# sourceMappingURL=register.d.ts.map

package/lib/cjs/jws/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/jws/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAyB,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAM9C,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,2BAA2B;AAC3B,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAgBD,0HAA0H;AAC1H,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAe7F;AAED,2GAA2G;AAC3G,qBACa,2BAA4B,SAAQ,YAAY;IAE3D,SAAS,CAAC,SAAS,EAAG,UAAU,CAAC;IAEpB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAEtC;CACF"}

package/lib/cjs/jws/register.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnKeysSignerBootstrapper = void 0;
+exports.registerJwsSigner = registerJwsSigner;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const contracts_1 = require("@spinajs/authn/contracts");
+const exceptions_1 = require("@spinajs/exceptions");
+const util_1 = require("@spinajs/util");
+require("../register-schema.js");
+const signer_js_1 = require("./signer.js");
+// The error names the position only: the text is a private key.
+function privateJwkOf(secret, index) {
+    let jwk;
+    try {
+        jwk = JSON.parse(secret);
+    }
+    catch {
+        jwk = undefined;
+    }
+    if (!(0, util_1.isPlainObject)(jwk)) {
+        throw new exceptions_1.InvalidOption(`authn.keys.signer.keys.${index} does not resolve to a private JWK as a JSON object`);
+    }
+    return jwk;
+}
+/** Registers a JwsSigner built from `authn.keys.signer` in `container`; null, and nothing registered, when it is null. */
+async function registerJwsSigner(container) {
+    const configuration = await container.resolve(configuration_1.Configuration);
+    const config = configuration.get('authn.keys.signer', null);
+    if (!config) {
+        return null;
+    }
+    let signer;
+    try {
+        signer = new signer_js_1.LocalJwsSigner(config.keys.map(privateJwkOf), { current: config.current });
+    }
+    catch (e) {
+        throw e instanceof exceptions_1.InvalidArgument ? new exceptions_1.InvalidOption(`authn.keys.signer: ${e.message}`) : e;
+    }
+    container.register({ ConfiguredJwsSigner: () => signer }.ConfiguredJwsSigner).as(contracts_1.JwsSigner);
+    return signer;
+}
+/** Registers the configured JwsSigner at boot, so the JWKS route and the verifiers' key lookup find it. */
+let AuthnKeysSignerBootstrapper = class AuthnKeysSignerBootstrapper extends di_1.Bootstrapper {
+    async bootstrap() {
+        await registerJwsSigner(this.Container);
+    }
+};
+exports.AuthnKeysSignerBootstrapper = AuthnKeysSignerBootstrapper;
+__decorate([
+    (0, di_1.Autoinject)(di_1.Container),
+    __metadata("design:type", Object)
+], AuthnKeysSignerBootstrapper.prototype, "Container", void 0);
+exports.AuthnKeysSignerBootstrapper = AuthnKeysSignerBootstrapper = __decorate([
+    (0, di_1.Injectable)(di_1.Bootstrapper)
+], AuthnKeysSignerBootstrapper);
+//# sourceMappingURL=register.js.map

package/lib/cjs/jws/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/jws/register.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,oCAA8E;AAE9E,0DAAuD;AACvD,wDAAqD;AACrD,oDAAqE;AACrE,wCAA8C;AAE9C,iCAA+B;AAC/B,2CAA6C;AAU7C,gEAAgE;AAChE,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,IAAA,oBAAa,EAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,0BAAa,CAAC,0BAA0B,KAAK,qDAAqD,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,GAA4B,CAAC;AACtC,CAAC;AAED,0HAA0H;AACnH,KAAK,4BAA4B,SAAqB;IAC3D,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,6BAAa,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAsB,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,0BAAc,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,YAAY,4BAAe,CAAC,CAAC,CAAC,IAAI,0BAAa,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,SAAS,CAAC,QAAQ,CAAC,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,qBAAS,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2GAA2G;AAEpG,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,iBAAY;IAIpD,KAAK,CAAC,SAAS;QACpB,MAAM,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;;AALW;IADT,IAAA,eAAU,EAAC,cAAS,CAAC;;8DACW;sCAFtB,2BAA2B;IADvC,IAAA,eAAU,EAAC,iBAAY,CAAC;GACZ,2BAA2B,CAOvC"}

package/lib/cjs/models/index.d.ts

@@ -1,3 +1,2 @@
 export * from './AuthnKey.js';
-export * from './AuthnNonce.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/models/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC"}

package/lib/cjs/models/index.js

@@ -15,5 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./AuthnKey.js"), exports);
-__exportStar(require("./AuthnNonce.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/models/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,kDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B"}

package/lib/cjs/options/options.d.ts

@@ -17,7 +17,16 @@ export interface KeysConfig {
         readonly skewSeconds: number;
         readonly requiredComponents: readonly string[];
     };
+    /** Absent: {@link DEFAULT_KEY_CACHE}. */
+    readonly cache?: KeyCacheOptions;
 }
+/** `authn.keys.cache`: how long `KeyRegistry.byId` serves a key from memory. */
+export interface KeyCacheOptions {
+    /** 0 turns the cache off. */
+    readonly ttlSeconds: number;
+    readonly maxEntries: number;
+}
+export declare const DEFAULT_KEY_CACHE: KeyCacheOptions;
 /** `authn.keys` (design §22.5) after defaults. */
 export interface KeysOptions {
     readonly algorithms: readonly KeyAlgorithm[];
@@ -38,6 +47,7 @@ export interface KeysOptions {
         readonly skewSeconds: number;
         readonly requiredComponents: readonly string[];
     };
+    readonly cache: KeyCacheOptions;
 }
 /**
  * The options of a validated `authn.keys`: frozen, with the challenge audience falling back to the assertion audience.

package/lib/cjs/options/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG7D,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClJ,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC1I;AAED,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,iHAAiH;QACjH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,gEAAgE;QAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,CAAC;CACH;AAuBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAc7D"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG7D,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClJ,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACzI,yCAAyC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;CAClC;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,iBAAiB,EAAE,eAAuE,CAAC;AAExG,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,iHAAiH;QACjH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,gEAAgE;QAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AA6BD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAe7D"}

package/lib/cjs/options/options.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_KEY_CACHE = void 0;
 exports.keysOptionsOf = keysOptionsOf;
 const exceptions_1 = require("@spinajs/exceptions");
+exports.DEFAULT_KEY_CACHE = Object.freeze({ ttlSeconds: 10, maxEntries: 10_000 });
 const derived = new WeakMap();
 const RANGES = [
     ['challenge', 'ttlSeconds', 1, 3600],
@@ -19,6 +21,12 @@ function checkRanges(config) {
             throw new exceptions_1.InvalidOption(`authn.keys.${block}.${key} must be an integer from ${min} to ${max}`);
         }
     }
+    if (config.cache !== undefined) {
+        const { ttlSeconds, maxEntries } = config.cache;
+        if (!(Number.isInteger(ttlSeconds) && ttlSeconds >= 0 && Number.isInteger(maxEntries) && maxEntries >= 1)) {
+            throw new exceptions_1.InvalidOption('authn.keys.cache needs an integer ttlSeconds >= 0 and an integer maxEntries >= 1');
+        }
+    }
 }
 /**
  * The options of a validated `authn.keys`: frozen, with the challenge audience falling back to the assertion audience.
@@ -33,6 +41,7 @@ function keysOptionsOf(config) {
             challenge: Object.freeze({ ttlSeconds: config.challenge.ttlSeconds, audience: config.challenge.audience ?? config.assertion.audience }),
             assertion: Object.freeze({ ...config.assertion }),
             httpSignature: Object.freeze({ ...config.httpSignature, requiredComponents: Object.freeze([...config.httpSignature.requiredComponents]) }),
+            cache: Object.freeze({ ...exports.DEFAULT_KEY_CACHE, ...config.cache }),
         });
         derived.set(config, options);
         derived.set(options, options);

package/lib/cjs/options/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":";;;AACA,oDAAoD;AAgCpD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAuB,CAAC;AAEnD,MAAM,MAAM,GAAsH;IAChI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC;IACpC,CAAC,WAAW,EAAE,oBAAoB,EAAE,CAAC,EAAE,GAAG,CAAC;IAC3C,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;IACpC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,GAAG,CAAC;IAC1C,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;CACzC,CAAC;AAEF,4GAA4G;AAC5G,wFAAwF;AACxF,SAAS,WAAW,CAAC,MAAkB;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAa,MAAM,CAAC,KAAK,CAAoD,EAAE,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,GAAG,IAAK,KAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,0BAAa,CAAC,cAAc,KAAK,IAAI,GAAG,4BAA4B,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,uBAA8B,MAAkB;IAC9C,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvI,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;SAC3I,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":";;;;AACA,oDAAoD;AAmBvC,QAAA,iBAAiB,GAAoB,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;AAyBxG,MAAM,OAAO,GAAG,IAAI,OAAO,EAAuB,CAAC;AAEnD,MAAM,MAAM,GAAsH;IAChI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC;IACpC,CAAC,WAAW,EAAE,oBAAoB,EAAE,CAAC,EAAE,GAAG,CAAC;IAC3C,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;IACpC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,GAAG,CAAC;IAC1C,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;CACzC,CAAC;AAEF,4GAA4G;AAC5G,wFAAwF;AACxF,SAAS,WAAW,CAAC,MAAkB;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAa,MAAM,CAAC,KAAK,CAAoD,EAAE,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,GAAG,IAAK,KAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,0BAAa,CAAC,cAAc,KAAK,IAAI,GAAG,4BAA4B,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,KAAiC,CAAC;QAC5E,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAK,UAAqB,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAK,UAAqB,IAAI,CAAC,CAAC,EAAE,CAAC;YAClI,MAAM,IAAI,0BAAa,CAAC,kFAAkF,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,uBAA8B,MAAkB;IAC9C,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvI,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;YAC1I,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAA,iBAAiB,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/lib/cjs/registry/cache.d.ts

@@ -0,0 +1,26 @@
+import type { CredentialChangeBus, IdentityRef, KeyRecord } from '@spinajs/authn/contracts';
+import type { KeyCacheOptions } from '../options/options.js';
+import { KeyStore } from './store.js';
+/**
+ * A KeyStore whose `get` is served from memory for `ttlSeconds`. Every write through it and every change the bus
+ * delivers evicts; a key revoked in another process is seen within the ttl. Unknown kids are never cached.
+ */
+export declare class CachedKeyStore extends KeyStore {
+    protected readonly inner: KeyStore;
+    protected readonly options: KeyCacheOptions;
+    protected readonly bus?: CredentialChangeBus | undefined;
+    private readonly keys;
+    /** Bumped by every eviction: a read that started before it must not store what it read. */
+    private epoch;
+    private readonly unsubscribe;
+    constructor(inner: KeyStore, options: KeyCacheOptions, bus?: CredentialChangeBus | undefined);
+    insert(key: KeyRecord): Promise<'inserted' | 'duplicate'>;
+    get(kid: string): Promise<KeyRecord | null>;
+    listByOwner(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    revoke(owner: IdentityRef, kid: string, at: Date): Promise<'revoked' | 'already' | 'none'>;
+    touch(kid: string, at: Date): Promise<void>;
+    /** Stops listening to the bus. */
+    dispose(): Promise<void>;
+    private evict;
+}
+//# sourceMappingURL=cache.d.ts.map

package/lib/cjs/registry/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/registry/cache.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC;;;GAGG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IAOxC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ;IAClC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe;IAC3C,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,mBAAmB;IAR9C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,2FAA2F;IAC3F,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IAEvD,YACqB,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,eAAe,EACxB,GAAG,CAAC,EAAE,mBAAmB,YAAA,EAK7C;IAEY,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,WAAW,CAAC,CAMrE;IAEY,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAWvD;IAEM,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAEpE;IAEY,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAMtG;IAEY,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvD;IAED,kCAAkC;IAC3B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAI9B;IAED,OAAO,CAAC,KAAK;CAId"}

package/lib/cjs/registry/cache.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CachedKeyStore = void 0;
+const bus_1 = require("@spinajs/authn/bus");
+const util_1 = require("@spinajs/util");
+const store_js_1 = require("./store.js");
+/**
+ * A KeyStore whose `get` is served from memory for `ttlSeconds`. Every write through it and every change the bus
+ * delivers evicts; a key revoked in another process is seen within the ttl. Unknown kids are never cached.
+ */
+class CachedKeyStore extends store_js_1.KeyStore {
+    constructor(inner, options, bus) {
+        super();
+        this.inner = inner;
+        this.options = options;
+        this.bus = bus;
+        /** Bumped by every eviction: a read that started before it must not store what it read. */
+        this.epoch = 0;
+        this.keys = options.ttlSeconds > 0 ? new util_1.LruTtlCache({ maxEntries: options.maxEntries, ttlMs: options.ttlSeconds * 1000, expireOnClockRewind: true }) : null;
+        this.unsubscribe = this.keys && bus ? bus.subscribe((change) => this.evict((0, bus_1.credentialChangeTags)(change))) : undefined;
+    }
+    async insert(key) {
+        try {
+            return await this.inner.insert(key);
+        }
+        finally {
+            this.evict([(0, bus_1.credentialTag)('key', key.kid)]);
+        }
+    }
+    async get(kid) {
+        const cached = this.keys?.get(kid);
+        if (cached !== undefined) {
+            return cached;
+        }
+        const since = this.epoch;
+        const key = await this.inner.get(kid);
+        if (key !== null && this.keys !== null && since === this.epoch) {
+            this.keys.set(kid, key, { tags: [(0, bus_1.credentialTag)('key', kid), (0, bus_1.identityTag)(key.owner)] });
+        }
+        return key;
+    }
+    listByOwner(owner) {
+        return this.inner.listByOwner(owner);
+    }
+    async revoke(owner, kid, at) {
+        try {
+            return await this.inner.revoke(owner, kid, at);
+        }
+        finally {
+            this.evict([(0, bus_1.credentialTag)('key', kid)]);
+        }
+    }
+    async touch(kid, at) {
+        try {
+            await this.inner.touch(kid, at);
+        }
+        finally {
+            this.evict([(0, bus_1.credentialTag)('key', kid)]);
+        }
+    }
+    /** Stops listening to the bus. */
+    dispose() {
+        this.unsubscribe?.();
+        this.keys?.clear();
+        return Promise.resolve();
+    }
+    evict(tags) {
+        this.epoch++;
+        this.keys?.invalidate(tags);
+    }
+}
+exports.CachedKeyStore = CachedKeyStore;
+//# sourceMappingURL=cache.js.map