@spinajs/authn-keys 3.0.3 → 3.0.5

package/lib/cjs/strategies/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/strategies/keys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAIzJ,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGrE,wHAAwH;AACxH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,sHAAsH;AACtH,eAAO,MAAM,eAAe,UAAW,QAAQ,GAAG,WAAW,KAAG,MAAqC,CAAC;AAEtG,kHAAkH;AAClH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,YAAY,GAAG,SAAS,WAAW,EAAE,CAM7F;AAED,iHAAiH;AACjH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAA;CAAE,CAAC;AAEzI,yHAAyH;AACzH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CASzG;AAED,eAAO,MAAM,OAAO,WAAY,YAAY,KAAG,eAA0C,CAAC;AAE1F,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;CAChC;AAED,sHAAsH;AACtH,8BAAsB,WAAW,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,CAAE,SAAQ,sBAAsB;IAU/F,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IARvC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAGjC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAGhC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,YAA+B,IAAI,CAAC,EAAE,CAAC,YAAA,EAEtC;IAED,SAAS,KAAK,QAAQ,IAAI,WAAW,CAEpC;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,qHAAqH;IACrH,SAAS,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,IAAI,CAEzF;IAED,wGAAwG;IACxG,UAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAUnG;CACF"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/strategies/keys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAKrK,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGrE,wHAAwH;AACxH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,sHAAsH;AACtH,eAAO,MAAM,eAAe,UAAW,QAAQ,GAAG,WAAW,KAAG,MAAqC,CAAC;AAEtG,kHAAkH;AAClH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,YAAY,GAAG,SAAS,WAAW,EAAE,CAM7F;AAED,iHAAiH;AACjH,MAAM,MAAM,SAAS,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAA;CAAE,CAAC;AAEzI,yHAAyH;AACzH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CASzG;AAED,2HAA2H;AAC3H,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,CAK9F;AAED,eAAO,MAAM,OAAO,WAAY,YAAY,KAAG,eAA0C,CAAC;AAE1F,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,sDAAsD;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;CAChC;AAED,sHAAsH;AACtH,8BAAsB,WAAW,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,CAAE,SAAQ,sBAAsB;IAU/F,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IARvC,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAGjC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAGhC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,YAA+B,IAAI,CAAC,EAAE,CAAC,YAAA,EAEtC;IAED,SAAS,KAAK,QAAQ,IAAI,WAAW,CAEpC;IAED,SAAS,KAAK,OAAO,IAAI,WAAW,CAEnC;IAED,qHAAqH;IACrH,SAAS,CAAC,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,IAAI,CAEzF;IAED,wGAAwG;IACxG,UAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAUnG;CACF"}

package/lib/cjs/strategies/keys.js

@@ -12,11 +12,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeyStrategy = exports.failure = exports.assertionIssuer = exports.MAX_CREDENTIAL_LENGTH = void 0;
 exports.keyThrottleKeys = keyThrottleKeys;
 exports.usableKey = usableKey;
+exports.requireNonceStore = requireNonceStore;
 const di_1 = require("@spinajs/di");
 const configuration_1 = require("@spinajs/configuration");
 const log_1 = require("@spinajs/log");
 require("../register-schema.js");
 const contracts_1 = require("@spinajs/authn/contracts");
+const exceptions_1 = require("@spinajs/exceptions");
 const keys_js_1 = require("../jwk/keys.js");
 const signature_js_1 = require("../jwk/signature.js");
 const options_js_1 = require("../options/options.js");
@@ -45,6 +47,13 @@ async function usableKey(registry, kid, ctx) {
     }
     return { key };
 }
+/** Only authn-orm registers a NonceStore, so an app without it fails when the strategy boots, not on the first request. */
+function requireNonceStore(nonces, strategy) {
+    if (!nonces) {
+        throw new exceptions_1.InvalidOption(`${strategy} needs a NonceStore: import @spinajs/authn-orm (DbNonceStore) or register your own NonceStore`);
+    }
+    return nonces;
+}
 const failure = (reason) => ({ ok: false, reason });
 exports.failure = failure;
 /** What the key strategies share: the registry, `authn.keys`, the cost of an unusable key and the success outcome. */

package/lib/cjs/strategies/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/strategies/keys.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA,oCAAyC;AACzC,0DAAgD;AAChD,sCAA2C;AAC3C,iCAA+B;AAC/B,wDAA+E;AAE/E,4CAA4C;AAC5C,sDAAkD;AAClD,sDAAsD;AAEtD,yDAAsD;AAEtD,wHAAwH;AAC3G,QAAA,qBAAqB,GAAG,IAAI,CAAC;AAE1C,sHAAsH;AAC/G,MAAM,eAAe,GAAG,CAAC,KAA6B,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;AAAzF,QAAA,eAAe,GAAf,eAAe,CAA0E;AAEtG,kHAAkH;AAClH,yBAAgC,GAAkB,EAAE,GAAiB;IACnE,MAAM,EAAE,GAAG,GAAG,KAAK,IAAI,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACpE,OAAO;QACL,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9B,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;KACvD,CAAC;AACJ,CAAC;AAKD,yHAAyH;AAClH,KAAK,oBAAoB,QAAqB,EAAE,GAAW,EAAE,GAAiB;IACnF,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAA,yBAAW,EAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAEM,MAAM,OAAO,GAAG,CAAC,MAAoB,EAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAA7E,QAAA,OAAO,GAAP,OAAO,CAAsE;AAS1F,sHAAsH;AACtH,iBAA+E,SAAQ,kCAAsB;IAU3G,YAA+B,IAAQ;QACrC,KAAK,EAAE,CAAC;oBADqB,IAAI;IAEnC,CAAC;IAED,IAAc,QAAQ;QACpB,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,IAAc,OAAO;QACnB,OAAO,IAAA,0BAAa,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED,qHAAqH;IAC3G,cAAc,CAAC,GAAiB,EAAE,IAAgB,EAAE,SAAqB;QACjF,IAAA,0BAAW,EAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IAC9F,KAAK,CAAC,OAAO,CAAC,GAAc,EAAE,MAAc,EAAE,GAAiB;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClI,CAAC;CACF;;AArCW;IADT,IAAA,sBAAM,EAAC,YAAY,CAAC;;+CACY;AAGvB;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;6CAAC;AAGtB;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;wCAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/strategies/keys.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oCAAyC;AACzC,0DAAgD;AAChD,sCAA2C;AAC3C,iCAA+B;AAC/B,wDAA+E;AAE/E,oDAAoD;AACpD,4CAA4C;AAC5C,sDAAkD;AAClD,sDAAsD;AAEtD,yDAAsD;AAEtD,wHAAwH;AAC3G,QAAA,qBAAqB,GAAG,IAAI,CAAC;AAE1C,sHAAsH;AAC/G,MAAM,eAAe,GAAG,CAAC,KAA6B,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;AAAzF,QAAA,eAAe,GAAf,eAAe,CAA0E;AAEtG,kHAAkH;AAClH,yBAAgC,GAAkB,EAAE,GAAiB;IACnE,MAAM,EAAE,GAAG,GAAG,KAAK,IAAI,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACpE,OAAO;QACL,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9B,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;KACvD,CAAC;AACJ,CAAC;AAKD,yHAAyH;AAClH,KAAK,oBAAoB,QAAqB,EAAE,GAAW,EAAE,GAAiB;IACnF,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,IAAA,yBAAW,EAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED,2HAA2H;AAC3H,2BAAkC,MAA8B,EAAE,QAAgB;IAChF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,0BAAa,CAAC,GAAG,QAAQ,+FAA+F,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,MAAM,OAAO,GAAG,CAAC,MAAoB,EAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAA7E,QAAA,OAAO,GAAP,OAAO,CAAsE;AAS1F,sHAAsH;AACtH,iBAA+E,SAAQ,kCAAsB;IAU3G,YAA+B,IAAQ;QACrC,KAAK,EAAE,CAAC;oBADqB,IAAI;IAEnC,CAAC;IAED,IAAc,QAAQ;QACpB,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAED,IAAc,OAAO;QACnB,OAAO,IAAA,0BAAa,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,CAAC;IAED,qHAAqH;IAC3G,cAAc,CAAC,GAAiB,EAAE,IAAgB,EAAE,SAAqB;QACjF,IAAA,0BAAW,EAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,wGAAwG;IAC9F,KAAK,CAAC,OAAO,CAAC,GAAc,EAAE,MAAc,EAAE,GAAiB;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClI,CAAC;CACF;;AArCW;IADT,IAAA,sBAAM,EAAC,YAAY,CAAC;;+CACY;AAGvB;IADT,IAAA,eAAU,EAAC,uBAAW,CAAC;8BACJ,uBAAW;6CAAC;AAGtB;IADT,IAAA,YAAM,EAAC,YAAY,CAAC;8BACN,SAAG;wCAAC"}

package/lib/cjs/strategies/nonce-key.d.ts

@@ -0,0 +1,3 @@
+/** A fixed-length store key for a value a client chose, scoped to the key that signed it. */
+export declare const nonceKey: (scope: 'jti' | 'sig', kid: string, value: string) => string;
+//# sourceMappingURL=nonce-key.d.ts.map

package/lib/cjs/strategies/nonce-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-key.d.ts","sourceRoot":"","sources":["../../../src/strategies/nonce-key.ts"],"names":[],"mappings":"AAEA,6FAA6F;AAC7F,eAAO,MAAM,QAAQ,UAAW,KAAK,GAAG,KAAK,OAAO,MAAM,SAAS,MAAM,KAAG,MAAmG,CAAC"}

package/lib/cjs/strategies/nonce-key.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nonceKey = void 0;
+const node_crypto_1 = require("node:crypto");
+/** A fixed-length store key for a value a client chose, scoped to the key that signed it. */
+const nonceKey = (scope, kid, value) => `${scope}:${(0, node_crypto_1.createHash)('sha256').update(`${kid}\n${value}`, 'utf8').digest('base64url')}`;
+exports.nonceKey = nonceKey;
+//# sourceMappingURL=nonce-key.js.map

package/lib/cjs/strategies/nonce-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-key.js","sourceRoot":"","sources":["../../../src/strategies/nonce-key.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AAEzC,6FAA6F;AACtF,MAAM,QAAQ,GAAG,CAAC,KAAoB,EAAE,GAAW,EAAE,KAAa,EAAU,EAAE,CAAC,GAAG,KAAK,IAAI,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAAnK,QAAA,QAAQ,GAAR,QAAQ,CAA2J"}

package/lib/mjs/cli/AddKey.d.ts

@@ -1,6 +1,6 @@
-import { CliCommand } from '@spinajs/cli';
 import { Log } from '@spinajs/log';
 import { KeyRegistry } from '@spinajs/authn/contracts';
+import { KeyCliCommand } from './KeyCliCommand.js';
 interface AddKeyOptions {
     jwk?: string;
     file?: string;
@@ -9,7 +9,7 @@ interface AddKeyOptions {
     expires?: string;
 }
 /** Services and agents only: a user registers a key with a proof of possession, which the CLI cannot give. */
-export declare class AddKey extends CliCommand {
+export declare class AddKey extends KeyCliCommand {
     protected Log: Log;
     protected Registry: KeyRegistry;
     execute(ownerType: string, ownerId: string, options: AddKeyOptions): Promise<void>;

package/lib/mjs/cli/AddKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AddKey.d.ts","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAmB,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAK9E,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8GAA8G;AAC9G,qBAQa,MAAO,SAAQ,UAAU;IAEpC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9F;CACF"}
+{"version":3,"file":"AddKey.d.ts","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAI9E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8GAA8G;AAC9G,qBAQa,MAAO,SAAQ,aAAa;IAEvC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB9F;CACF"}

package/lib/mjs/cli/AddKey.js

@@ -8,13 +8,14 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { Autoinject } from '@spinajs/di';
-import { Argument, CliCommand, Command, Option } from '@spinajs/cli';
+import { Argument, Command, Option } from '@spinajs/cli';
 import { Log, Logger } from '@spinajs/log';
 import { CLI_ACTOR, KeyRegistry, cliContext } from '@spinajs/authn/contracts';
 import { InvalidArgument } from '@spinajs/exceptions';
 import { ownerArg, readPublicJwk } from './common.js';
+import { KeyCliCommand } from './KeyCliCommand.js';
 /** Services and agents only: a user registers a key with a proof of possession, which the CLI cannot give. */
-let AddKey = class AddKey extends CliCommand {
+let AddKey = class AddKey extends KeyCliCommand {
     async execute(ownerType, ownerId, options) {
         const owner = ownerArg(ownerType, ownerId);
         if (owner.type === 'user') {

package/lib/mjs/cli/AddKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"AddKey.js","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAUtD,8GAA8G;AASvG,IAAM,MAAM,GAAZ,MAAM,MAAO,SAAQ,UAAU;IAO7B,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,OAAsB;QAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,4EAA4E,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,wEAAwE;QACxE,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAQ,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,eAAe,CAAC,6DAA6D,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,GAAG,GAAG;YACV,KAAK;YACL,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjB,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,8DAA8D,CAAC,CAAC;IACrJ,CAAC;CACF,CAAA;AA7BW;IADT,MAAM,CAAC,YAAY,CAAC;8BACN,GAAG;mCAAC;AAGT;IADT,UAAU,CAAC,WAAW,CAAC;8BACJ,WAAW;wCAAC;AALrB,MAAM;IARlB,OAAO,CAAC,eAAe,EAAE,oEAAoE,CAAC;IAC9F,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IAC/G,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,4BAA4B,CAAC;IACvD,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,wBAAwB,CAAC;IACvD,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,uDAAuD,CAAC;IACvF,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,kEAAkE,CAAC;IAChG,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,6BAA6B,CAAC;IAC7D,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,6CAA6C,CAAC;GACnE,MAAM,CA+BlB"}
+{"version":3,"file":"AddKey.js","sourceRoot":"","sources":["../../../src/cli/AddKey.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE9E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAUnD,8GAA8G;AASvG,IAAM,MAAM,GAAZ,MAAM,MAAO,SAAQ,aAAa;IAOhC,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,OAAsB;QAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,4EAA4E,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxF,wEAAwE;QACxE,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAQ,CAAC,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,eAAe,CAAC,6DAA6D,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,GAAG,GAAG;YACV,KAAK;YACL,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjB,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,eAAe,CAAC,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,8DAA8D,CAAC,CAAC;IACrJ,CAAC;CACF,CAAA;AA7BW;IADT,MAAM,CAAC,YAAY,CAAC;8BACN,GAAG;mCAAC;AAGT;IADT,UAAU,CAAC,WAAW,CAAC;8BACJ,WAAW;wCAAC;AALrB,MAAM;IARlB,OAAO,CAAC,eAAe,EAAE,oEAAoE,CAAC;IAC9F,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IAC/G,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,4BAA4B,CAAC;IACvD,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,wBAAwB,CAAC;IACvD,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,uDAAuD,CAAC;IACvF,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,kEAAkE,CAAC;IAChG,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,6BAA6B,CAAC;IAC7D,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,6CAA6C,CAAC;GACnE,MAAM,CA+BlB"}

package/lib/mjs/cli/KeyCliCommand.d.ts

@@ -0,0 +1,10 @@
+import { CliCommand } from '@spinajs/cli';
+import { OrmMigrator } from '@spinajs/orm';
+/**
+ * The cli resolves only the command it runs, so the command boots the Orm and the `Migration.OnStartup` pass that
+ * creates the key tables, as an app process does; model queries on such a connection throw until that pass ran.
+ */
+export declare abstract class KeyCliCommand extends CliCommand {
+    protected Migrator: OrmMigrator;
+}
+//# sourceMappingURL=KeyCliCommand.d.ts.map

package/lib/mjs/cli/KeyCliCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyCliCommand.d.ts","sourceRoot":"","sources":["../../../src/cli/KeyCliCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C;;;GAGG;AACH,8BAAsB,aAAc,SAAQ,UAAU;IAEpD,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;CACjC"}

package/lib/mjs/{models/AuthnNonce.js → cli/KeyCliCommand.js}

@@ -7,22 +7,17 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
-import { DateTime } from 'luxon';
-/** A row of authn_nonce (design §22.16; the table comes with authn-orm's AuthnInitial migration). */
-let AuthnNonce = class AuthnNonce extends ModelBase {
-};
-__decorate([
-    Primary(),
-    __metadata("design:type", String)
-], AuthnNonce.prototype, "k", void 0);
+import { CliCommand } from '@spinajs/cli';
+import { Autoinject } from '@spinajs/di';
+import { OrmMigrator } from '@spinajs/orm';
+/**
+ * The cli resolves only the command it runs, so the command boots the Orm and the `Migration.OnStartup` pass that
+ * creates the key tables, as an app process does; model queries on such a connection throw until that pass ran.
+ */
+export class KeyCliCommand extends CliCommand {
+}
 __decorate([
-    DT(),
-    __metadata("design:type", DateTime)
-], AuthnNonce.prototype, "expires_at", void 0);
-AuthnNonce = __decorate([
-    Connection('default'),
-    Model('authn_nonce')
-], AuthnNonce);
-export { AuthnNonce };
-//# sourceMappingURL=AuthnNonce.js.map
+    Autoinject(OrmMigrator),
+    __metadata("design:type", OrmMigrator)
+], KeyCliCommand.prototype, "Migrator", void 0);
+//# sourceMappingURL=KeyCliCommand.js.map

package/lib/mjs/cli/KeyCliCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyCliCommand.js","sourceRoot":"","sources":["../../../src/cli/KeyCliCommand.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C;;;GAGG;AACH,MAAM,OAAgB,aAAc,SAAQ,UAAU;CAGrD;AADW;IADT,UAAU,CAAC,WAAW,CAAC;8BACJ,WAAW;+CAAC"}

package/lib/mjs/cli/ListKeys.d.ts

@@ -1,9 +1,9 @@
-import { CliCommand } from '@spinajs/cli';
 import { Log } from '@spinajs/log';
 import { KeyRegistry } from '@spinajs/authn/contracts';
 import type { KeyRecord } from '@spinajs/authn/contracts';
+import { KeyCliCommand } from './KeyCliCommand.js';
 export declare function keyLine(k: KeyRecord): string;
-export declare class ListKeys extends CliCommand {
+export declare class ListKeys extends KeyCliCommand {
     protected Log: Log;
     protected Registry: KeyRegistry;
     execute(ownerType: string, ownerId: string): Promise<void>;

package/lib/mjs/cli/ListKeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ListKeys.d.ts","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAK1D,wBAAgB,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAE5C;AAED,qBAGa,QAAS,SAAQ,UAAU;IAEtC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;CACF"}
+{"version":3,"file":"ListKeys.d.ts","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAInD,wBAAgB,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAE5C;AAED,qBAGa,QAAS,SAAQ,aAAa;IAEzC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtE;CACF"}

package/lib/mjs/cli/ListKeys.js

@@ -8,15 +8,16 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { Autoinject } from '@spinajs/di';
-import { Argument, CliCommand, Command } from '@spinajs/cli';
+import { Argument, Command } from '@spinajs/cli';
 import { Log, Logger } from '@spinajs/log';
 import { KeyRegistry } from '@spinajs/authn/contracts';
 import { OWNER_TYPES, ownerArg } from './common.js';
+import { KeyCliCommand } from './KeyCliCommand.js';
 const iso = (d) => (d ? d.toISOString() : '-');
 export function keyLine(k) {
     return [k.kid, k.alg, k.name ?? '-', `created ${iso(k.createdAt)}`, `expires ${iso(k.expiresAt)}`, `revoked ${iso(k.revokedAt)}`, `last used ${iso(k.lastUsedAt)}`].join('  ');
 }
-let ListKeys = class ListKeys extends CliCommand {
+let ListKeys = class ListKeys extends KeyCliCommand {
     async execute(ownerType, ownerId) {
         const keys = await this.Registry.list(ownerArg(ownerType, ownerId));
         if (keys.length === 0) {

package/lib/mjs/cli/ListKeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"ListKeys.js","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,GAAG,GAAG,CAAC,CAAQ,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE9D,MAAM,UAAU,OAAO,CAAC,CAAY;IAClC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjL,CAAC;AAKM,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,UAAU;IAO/B,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF,CAAA;AAdW;IADT,MAAM,CAAC,YAAY,CAAC;8BACN,GAAG;qCAAC;AAGT;IADT,UAAU,CAAC,WAAW,CAAC;8BACJ,WAAW;0CAAC;AALrB,QAAQ;IAHpB,OAAO,CAAC,gBAAgB,EAAE,2FAA2F,CAAC;IACtH,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1G,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;GACvD,QAAQ,CAgBpB"}
+{"version":3,"file":"ListKeys.js","sourceRoot":"","sources":["../../../src/cli/ListKeys.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,GAAG,GAAG,CAAC,CAAQ,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAE9D,MAAM,UAAU,OAAO,CAAC,CAAY;IAClC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjL,CAAC;AAKM,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,aAAa;IAOlC,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;CACF,CAAA;AAdW;IADT,MAAM,CAAC,YAAY,CAAC;8BACN,GAAG;qCAAC;AAGT;IADT,UAAU,CAAC,WAAW,CAAC;8BACJ,WAAW;0CAAC;AALrB,QAAQ;IAHpB,OAAO,CAAC,gBAAgB,EAAE,2FAA2F,CAAC;IACtH,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1G,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;GACvD,QAAQ,CAgBpB"}

package/lib/mjs/cli/RevokeKey.d.ts

@@ -1,7 +1,7 @@
-import { CliCommand } from '@spinajs/cli';
 import { Log } from '@spinajs/log';
 import { KeyRegistry } from '@spinajs/authn/contracts';
-export declare class RevokeKey extends CliCommand {
+import { KeyCliCommand } from './KeyCliCommand.js';
+export declare class RevokeKey extends KeyCliCommand {
     protected Log: Log;
     protected Registry: KeyRegistry;
     execute(ownerType: string, ownerId: string, kid: string): Promise<void>;

package/lib/mjs/cli/RevokeKey.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RevokeKey.d.ts","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,UAAU,EAAW,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAI9E,qBAIa,SAAU,SAAQ,UAAU;IAEvC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnF;CACF"}
+{"version":3,"file":"RevokeKey.d.ts","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAa,WAAW,EAAc,MAAM,0BAA0B,CAAC;AAG9E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,qBAIa,SAAU,SAAQ,aAAa;IAE1C,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAEnB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnF;CACF"}

package/lib/mjs/cli/RevokeKey.js

@@ -8,12 +8,13 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 import { Autoinject } from '@spinajs/di';
-import { Argument, CliCommand, Command } from '@spinajs/cli';
+import { Argument, Command } from '@spinajs/cli';
 import { Log, Logger } from '@spinajs/log';
 import { CLI_ACTOR, KeyRegistry, cliContext } from '@spinajs/authn/contracts';
 import { InvalidArgument } from '@spinajs/exceptions';
 import { OWNER_TYPES, ownerArg } from './common.js';
-let RevokeKey = class RevokeKey extends CliCommand {
+import { KeyCliCommand } from './KeyCliCommand.js';
+let RevokeKey = class RevokeKey extends KeyCliCommand {
     async execute(ownerType, ownerId, kid) {
         if (!(await this.Registry.revoke(ownerArg(ownerType, ownerId), kid, cliContext(), { actor: CLI_ACTOR }))) {
             throw new InvalidArgument(`no key ${kid} of ${ownerType} ${ownerId}`);

package/lib/mjs/cli/RevokeKey.js.map

@@ -1 +1 @@
-{"version":3,"file":"RevokeKey.js","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAM7C,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,UAAU;IAOhC,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,GAAW;QAClE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,eAAe,CAAC,UAAU,GAAG,OAAO,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAXW;IADT,MAAM,CAAC,YAAY,CAAC;8BACN,GAAG;sCAAC;AAGT;IADT,UAAU,CAAC,WAAW,CAAC;8BACJ,WAAW;2CAAC;AALrB,SAAS;IAJrB,OAAO,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;IACjF,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1G,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;IACnE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC;GACnB,SAAS,CAarB"}
+{"version":3,"file":"RevokeKey.js","sourceRoot":"","sources":["../../../src/cli/RevokeKey.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAM5C,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,aAAa;IAOnC,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe,EAAE,GAAW;QAClE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,IAAI,eAAe,CAAC,UAAU,GAAG,OAAO,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAXW;IADT,MAAM,CAAC,YAAY,CAAC;8BACN,GAAG;sCAAC;AAGT;IADT,UAAU,CAAC,WAAW,CAAC;8BACJ,WAAW;2CAAC;AALrB,SAAS;IAJrB,OAAO,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;IACjF,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC1G,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,wCAAwC,CAAC;IACnE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC;GACnB,SAAS,CAarB"}

package/lib/mjs/cli/index.d.ts

@@ -1,4 +1,5 @@
 export * from './common.js';
+export * from './KeyCliCommand.js';
 export * from './AddKey.js';
 export * from './ListKeys.js';
 export * from './RevokeKey.js';

package/lib/mjs/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}

package/lib/mjs/cli/index.js

@@ -1,4 +1,5 @@
 export * from './common.js';
+export * from './KeyCliCommand.js';
 export * from './AddKey.js';
 export * from './ListKeys.js';
 export * from './RevokeKey.js';

package/lib/mjs/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}

package/lib/mjs/index.d.ts

@@ -5,7 +5,6 @@ export * from './models/index.js';
 export * from './migrations/index.js';
 export * from './registry/index.js';
 export * from './jws/index.js';
-export * from './nonce/index.js';
 export * from './strategies/index.js';
 export * from './httpsig/index.js';
 export * from './schema.js';

package/lib/mjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/lib/mjs/index.js

@@ -5,7 +5,6 @@ export * from './models/index.js';
 export * from './migrations/index.js';
 export * from './registry/index.js';
 export * from './jws/index.js';
-export * from './nonce/index.js';
 export * from './strategies/index.js';
 export * from './httpsig/index.js';
 export * from './schema.js';

package/lib/mjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/lib/mjs/jws/index.d.ts

@@ -1,4 +1,5 @@
 export * from './json.js';
 export * from './verifier.js';
 export * from './signer.js';
+export * from './register.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/mjs/jws/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/lib/mjs/jws/index.js

@@ -1,4 +1,5 @@
 export * from './json.js';
 export * from './verifier.js';
 export * from './signer.js';
+export * from './register.js';
 //# sourceMappingURL=index.js.map

package/lib/mjs/jws/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/lib/mjs/jws/register.d.ts

@@ -0,0 +1,18 @@
+import { Bootstrapper } from '@spinajs/di';
+import type { IContainer } from '@spinajs/di';
+import '../register-schema.js';
+import { LocalJwsSigner } from './signer.js';
+/** `authn.keys.signer`. */
+export interface SignerConfig {
+    readonly current: string;
+    /** Secret references the configuration resolves to private JWKs as JSON text. */
+    readonly keys: readonly string[];
+}
+/** Registers a JwsSigner built from `authn.keys.signer` in `container`; null, and nothing registered, when it is null. */
+export declare function registerJwsSigner(container: IContainer): Promise<LocalJwsSigner | null>;
+/** Registers the configured JwsSigner at boot, so the JWKS route and the verifiers' key lookup find it. */
+export declare class AuthnKeysSignerBootstrapper extends Bootstrapper {
+    protected Container: IContainer;
+    bootstrap(): Promise<void>;
+}
+//# sourceMappingURL=register.d.ts.map

package/lib/mjs/jws/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../src/jws/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAyB,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAM9C,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,2BAA2B;AAC3B,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAgBD,0HAA0H;AAC1H,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAe7F;AAED,2GAA2G;AAC3G,qBACa,2BAA4B,SAAQ,YAAY;IAE3D,SAAS,CAAC,SAAS,EAAG,UAAU,CAAC;IAEpB,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAEtC;CACF"}

package/lib/mjs/jws/register.js

@@ -0,0 +1,62 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Autoinject, Bootstrapper, Container, Injectable } from '@spinajs/di';
+import { Configuration } from '@spinajs/configuration';
+import { JwsSigner } from '@spinajs/authn/contracts';
+import { InvalidArgument, InvalidOption } from '@spinajs/exceptions';
+import { isPlainObject } from '@spinajs/util';
+import '../register-schema.js';
+import { LocalJwsSigner } from './signer.js';
+// The error names the position only: the text is a private key.
+function privateJwkOf(secret, index) {
+    let jwk;
+    try {
+        jwk = JSON.parse(secret);
+    }
+    catch {
+        jwk = undefined;
+    }
+    if (!isPlainObject(jwk)) {
+        throw new InvalidOption(`authn.keys.signer.keys.${index} does not resolve to a private JWK as a JSON object`);
+    }
+    return jwk;
+}
+/** Registers a JwsSigner built from `authn.keys.signer` in `container`; null, and nothing registered, when it is null. */
+export async function registerJwsSigner(container) {
+    const configuration = await container.resolve(Configuration);
+    const config = configuration.get('authn.keys.signer', null);
+    if (!config) {
+        return null;
+    }
+    let signer;
+    try {
+        signer = new LocalJwsSigner(config.keys.map(privateJwkOf), { current: config.current });
+    }
+    catch (e) {
+        throw e instanceof InvalidArgument ? new InvalidOption(`authn.keys.signer: ${e.message}`) : e;
+    }
+    container.register({ ConfiguredJwsSigner: () => signer }.ConfiguredJwsSigner).as(JwsSigner);
+    return signer;
+}
+/** Registers the configured JwsSigner at boot, so the JWKS route and the verifiers' key lookup find it. */
+let AuthnKeysSignerBootstrapper = class AuthnKeysSignerBootstrapper extends Bootstrapper {
+    async bootstrap() {
+        await registerJwsSigner(this.Container);
+    }
+};
+__decorate([
+    Autoinject(Container),
+    __metadata("design:type", Object)
+], AuthnKeysSignerBootstrapper.prototype, "Container", void 0);
+AuthnKeysSignerBootstrapper = __decorate([
+    Injectable(Bootstrapper)
+], AuthnKeysSignerBootstrapper);
+export { AuthnKeysSignerBootstrapper };
+//# sourceMappingURL=register.js.map

package/lib/mjs/jws/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../src/jws/register.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAU7C,gEAAgE;AAChE,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,aAAa,CAAC,0BAA0B,KAAK,qDAAqD,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,GAA4B,CAAC;AACtC,CAAC;AAED,0HAA0H;AAC1H,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAqB;IAC3D,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAsB,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,YAAY,eAAe,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,SAAS,CAAC,QAAQ,CAAC,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2GAA2G;AAEpG,IAAM,2BAA2B,GAAjC,MAAM,2BAA4B,SAAQ,YAAY;IAIpD,KAAK,CAAC,SAAS;QACpB,MAAM,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AALW;IADT,UAAU,CAAC,SAAS,CAAC;;8DACW;AAFtB,2BAA2B;IADvC,UAAU,CAAC,YAAY,CAAC;GACZ,2BAA2B,CAOvC"}

package/lib/mjs/models/index.d.ts

@@ -1,3 +1,2 @@
 export * from './AuthnKey.js';
-export * from './AuthnNonce.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/mjs/models/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC"}

package/lib/mjs/models/index.js

@@ -1,3 +1,2 @@
 export * from './AuthnKey.js';
-export * from './AuthnNonce.js';
 //# sourceMappingURL=index.js.map

package/lib/mjs/models/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC"}

package/lib/mjs/options/options.d.ts

@@ -17,7 +17,16 @@ export interface KeysConfig {
         readonly skewSeconds: number;
         readonly requiredComponents: readonly string[];
     };
+    /** Absent: {@link DEFAULT_KEY_CACHE}. */
+    readonly cache?: KeyCacheOptions;
 }
+/** `authn.keys.cache`: how long `KeyRegistry.byId` serves a key from memory. */
+export interface KeyCacheOptions {
+    /** 0 turns the cache off. */
+    readonly ttlSeconds: number;
+    readonly maxEntries: number;
+}
+export declare const DEFAULT_KEY_CACHE: KeyCacheOptions;
 /** `authn.keys` (design §22.5) after defaults. */
 export interface KeysOptions {
     readonly algorithms: readonly KeyAlgorithm[];
@@ -38,6 +47,7 @@ export interface KeysOptions {
         readonly skewSeconds: number;
         readonly requiredComponents: readonly string[];
     };
+    readonly cache: KeyCacheOptions;
 }
 /**
  * The options of a validated `authn.keys`: frozen, with the challenge audience falling back to the assertion audience.

package/lib/mjs/options/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG7D,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClJ,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC1I;AAED,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,iHAAiH;QACjH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,gEAAgE;QAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,CAAC;CACH;AAuBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAc7D"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAG7D,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClJ,QAAQ,CAAC,aAAa,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACzI,yCAAyC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;CAClC;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,6BAA6B;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,iBAAiB,EAAE,eAAuE,CAAC;AAExG,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,iHAAiH;QACjH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,gEAAgE;QAChE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE;QACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;KAChD,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AA6BD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,CAe7D"}

package/lib/mjs/options/options.js

@@ -1,4 +1,5 @@
 import { InvalidOption } from '@spinajs/exceptions';
+export const DEFAULT_KEY_CACHE = Object.freeze({ ttlSeconds: 10, maxEntries: 10_000 });
 const derived = new WeakMap();
 const RANGES = [
     ['challenge', 'ttlSeconds', 1, 3600],
@@ -16,6 +17,12 @@ function checkRanges(config) {
             throw new InvalidOption(`authn.keys.${block}.${key} must be an integer from ${min} to ${max}`);
         }
     }
+    if (config.cache !== undefined) {
+        const { ttlSeconds, maxEntries } = config.cache;
+        if (!(Number.isInteger(ttlSeconds) && ttlSeconds >= 0 && Number.isInteger(maxEntries) && maxEntries >= 1)) {
+            throw new InvalidOption('authn.keys.cache needs an integer ttlSeconds >= 0 and an integer maxEntries >= 1');
+        }
+    }
 }
 /**
  * The options of a validated `authn.keys`: frozen, with the challenge audience falling back to the assertion audience.
@@ -30,6 +37,7 @@ export function keysOptionsOf(config) {
             challenge: Object.freeze({ ttlSeconds: config.challenge.ttlSeconds, audience: config.challenge.audience ?? config.assertion.audience }),
             assertion: Object.freeze({ ...config.assertion }),
             httpSignature: Object.freeze({ ...config.httpSignature, requiredComponents: Object.freeze([...config.httpSignature.requiredComponents]) }),
+            cache: Object.freeze({ ...DEFAULT_KEY_CACHE, ...config.cache }),
         });
         derived.set(config, options);
         derived.set(options, options);

package/lib/mjs/options/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAgCpD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAuB,CAAC;AAEnD,MAAM,MAAM,GAAsH;IAChI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC;IACpC,CAAC,WAAW,EAAE,oBAAoB,EAAE,CAAC,EAAE,GAAG,CAAC;IAC3C,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;IACpC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,GAAG,CAAC;IAC1C,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;CACzC,CAAC;AAEF,4GAA4G;AAC5G,wFAAwF;AACxF,SAAS,WAAW,CAAC,MAAkB;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAa,MAAM,CAAC,KAAK,CAAoD,EAAE,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,GAAG,IAAK,KAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,aAAa,CAAC,cAAc,KAAK,IAAI,GAAG,4BAA4B,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB;IAC9C,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvI,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;SAC3I,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/options/options.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAmBpD,MAAM,CAAC,MAAM,iBAAiB,GAAoB,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;AAyBxG,MAAM,OAAO,GAAG,IAAI,OAAO,EAAuB,CAAC;AAEnD,MAAM,MAAM,GAAsH;IAChI,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC;IACpC,CAAC,WAAW,EAAE,oBAAoB,EAAE,CAAC,EAAE,GAAG,CAAC;IAC3C,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;IACpC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,EAAE,GAAG,CAAC;IAC1C,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC;CACzC,CAAC;AAEF,4GAA4G;AAC5G,wFAAwF;AACxF,SAAS,WAAW,CAAC,MAAkB;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAa,MAAM,CAAC,KAAK,CAAoD,EAAE,CAAC,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,GAAG,IAAK,KAAgB,IAAI,GAAG,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,aAAa,CAAC,cAAc,KAAK,IAAI,GAAG,4BAA4B,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,KAAiC,CAAC;QAC5E,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAK,UAAqB,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAK,UAAqB,IAAI,CAAC,CAAC,EAAE,CAAC;YAClI,MAAM,IAAI,aAAa,CAAC,kFAAkF,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB;IAC9C,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;YACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvI,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACjD,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;YAC1I,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,iBAAiB,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;SAChE,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/lib/mjs/registry/cache.d.ts

@@ -0,0 +1,26 @@
+import type { CredentialChangeBus, IdentityRef, KeyRecord } from '@spinajs/authn/contracts';
+import type { KeyCacheOptions } from '../options/options.js';
+import { KeyStore } from './store.js';
+/**
+ * A KeyStore whose `get` is served from memory for `ttlSeconds`. Every write through it and every change the bus
+ * delivers evicts; a key revoked in another process is seen within the ttl. Unknown kids are never cached.
+ */
+export declare class CachedKeyStore extends KeyStore {
+    protected readonly inner: KeyStore;
+    protected readonly options: KeyCacheOptions;
+    protected readonly bus?: CredentialChangeBus | undefined;
+    private readonly keys;
+    /** Bumped by every eviction: a read that started before it must not store what it read. */
+    private epoch;
+    private readonly unsubscribe;
+    constructor(inner: KeyStore, options: KeyCacheOptions, bus?: CredentialChangeBus | undefined);
+    insert(key: KeyRecord): Promise<'inserted' | 'duplicate'>;
+    get(kid: string): Promise<KeyRecord | null>;
+    listByOwner(owner: IdentityRef): Promise<readonly KeyRecord[]>;
+    revoke(owner: IdentityRef, kid: string, at: Date): Promise<'revoked' | 'already' | 'none'>;
+    touch(kid: string, at: Date): Promise<void>;
+    /** Stops listening to the bus. */
+    dispose(): Promise<void>;
+    private evict;
+}
+//# sourceMappingURL=cache.d.ts.map

package/lib/mjs/registry/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/registry/cache.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC;;;GAGG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IAOxC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ;IAClC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe;IAC3C,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,mBAAmB;IAR9C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,2FAA2F;IAC3F,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;IAEvD,YACqB,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,eAAe,EACxB,GAAG,CAAC,EAAE,mBAAmB,YAAA,EAK7C;IAEY,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,WAAW,CAAC,CAMrE;IAEY,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAWvD;IAEM,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAEpE;IAEY,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,CAMtG;IAEY,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvD;IAED,kCAAkC;IAC3B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAI9B;IAED,OAAO,CAAC,KAAK;CAId"}