@absolutejs/auth 0.55.9 → 0.56.1

package/dist/oidc/keys.d.ts

@@ -1,8 +1,17 @@
-export type SigningKey = {
+type SigningKeyIdentity = {
     kid: string;
-    privateJwk: JsonWebKey;
     publicJwk: JsonWebKey;
 };
+/** ES256 signing material can remain local for development or be delegated to
+ * a non-exportable KMS/HSM adapter. External signers return the 64-byte JOSE
+ * ECDSA signature (r || s), not an ASN.1 DER envelope. */
+export type SigningKey = SigningKeyIdentity & ({
+    privateJwk: JsonWebKey;
+    sign?: never;
+} | {
+    privateJwk?: never;
+    sign: (input: Uint8Array) => Promise<Uint8Array>;
+});
 export declare const generateSigningKey: () => Promise<SigningKey>;
 export declare const jwkThumbprint: (jwk: JsonWebKey) => Promise<string>;
 export declare const signJwt: (payload: Record<string, unknown>, signing: SigningKey, typ?: string) => Promise<string>;
@@ -23,3 +32,4 @@ export declare const verifyJwt: (token: string, publicJwk: JsonWebKey) => Promis
         [k: string]: any;
     };
 } | undefined>;
+export {};

package/dist/server.js

@@ -3214,6 +3214,7 @@ init_crypto();
 var ENCODER = new TextEncoder;
 var ES256 = { hash: "SHA-256", name: "ECDSA" };
 var KEY_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var ES256_JOSE_SIGNATURE_BYTES = 64;
 var toBase64Url = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
 var fromBase64Url = (value) => new Uint8Array(Buffer.from(value, "base64url"));
 var encodeSegment = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
@@ -3247,9 +3248,18 @@ var jwkThumbprint = async (jwk) => {
   return toBase64Url(await crypto.subtle.digest("SHA-256", ENCODER.encode(canonical)));
 };
 var signJwt = async (payload, signing, typ = "JWT") => {
-  const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
   const input = `${encodeSegment({ alg: "ES256", kid: signing.kid, typ })}.${encodeSegment(payload)}`;
-  const signature = await crypto.subtle.sign(ES256, key, ENCODER.encode(input));
+  const encoded = ENCODER.encode(input);
+  let signature;
+  if (signing.sign !== undefined) {
+    signature = await signing.sign(encoded);
+  } else {
+    const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
+    signature = await crypto.subtle.sign(ES256, key, encoded);
+  }
+  if (signature.byteLength !== ES256_JOSE_SIGNATURE_BYTES) {
+    throw new Error("ES256 signer must return a 64-byte JOSE signature");
+  }
   return `${input}.${toBase64Url(signature)}`;
 };
 var toPublicJwk = (key) => ({
@@ -29661,5 +29671,5 @@ export {
   auth2 as auth
 };
 
-//# debugId=F0ECED8EFCCFD6F964756E2164756E21
+//# debugId=15A591E91DD3DB9A64756E2164756E21
 //# sourceMappingURL=server.js.map