@atproto/jwk-jose 0.2.2 → 0.2.3

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @atproto/jwk-jose
 
+## 0.2.3
+
+### Patch Changes
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update TypeScript build to rely on references to composite internal projects
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Bundle only necessary files in the NPM tarball, including the `CHANGELOG.md` and `README.md` files (if present).
+
+- Updated dependencies [[`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07), [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07)]:
+  - @atproto/jwk@0.7.3
+
 ## 0.2.2
 
 ### Patch Changes

package/package.json

@@ -1,9 +1,6 @@
 {
   "name": "@atproto/jwk-jose",
-  "version": "0.2.2",
-  "engines": {
-    "node": ">=22"
-  },
+  "version": "0.2.3",
   "license": "MIT",
   "description": "`jose` based implementation of @atproto/jwk Key's",
   "keywords": [
@@ -17,6 +14,10 @@
     "url": "https://github.com/bluesky-social/atproto",
     "directory": "packages/oauth/jwk-jose"
   },
+  "files": [
+    "./dist",
+    "./CHANGELOG.md"
+  ],
   "type": "module",
   "exports": {
     ".": {
@@ -24,11 +25,13 @@
       "default": "./dist/index.js"
     }
   },
+  "engines": {
+    "node": ">=22"
+  },
   "dependencies": {
     "jose": "^5.2.0",
-    "@atproto/jwk": "^0.7.2"
+    "@atproto/jwk": "^0.7.3"
   },
-  "devDependencies": {},
   "scripts": {
     "build": "tsgo --build tsconfig.build.json"
   }

package/src/index.ts

@@ -1 +0,0 @@
-export * from './jose-key.js'

package/src/jose-key.ts

@@ -1,255 +0,0 @@
-import {
-  type GenerateKeyPairOptions,
-  type GenerateKeyPairResult,
-  type JWK,
-  type JWTVerifyOptions,
-  type KeyLike,
-  SignJWT,
-  errors,
-  exportJWK,
-  generateKeyPair,
-  importJWK,
-  importPKCS8,
-  jwtVerify,
-} from 'jose'
-import {
-  Jwk,
-  JwkError,
-  JwtCreateError,
-  JwtHeader,
-  JwtPayload,
-  JwtVerifyError,
-  Key,
-  SignedJwt,
-  VerifyOptions,
-  VerifyResult,
-  isPrivateJwk,
-  jwkSchema,
-  jwtHeaderSchema,
-  jwtPayloadSchema,
-} from '@atproto/jwk'
-import { RequiredKey, either } from './util.js'
-
-const { JOSEError } = errors
-
-export {
-  type GenerateKeyPairOptions,
-  type GenerateKeyPairResult,
-  type Jwk,
-  type JwtHeader,
-  type JwtPayload,
-  type KeyLike,
-  type SignedJwt,
-  type VerifyOptions,
-}
-
-export class JoseKey<J extends Jwk = Jwk> extends Key<J> {
-  /**
-   * Some runtimes (e.g. Bun) require an `alg` second argument to be set when
-   * invoking `importJWK`. In order to be compatible with these runtimes, we
-   * provide the following method to ensure the `alg` is always set. We also
-   * take the opportunity to ensure that the `alg` is compatible with this key.
-   */
-  protected async getKeyObj(alg: string) {
-    if (!this.algorithms.includes(alg)) {
-      throw new JwkError(`Key cannot be used with algorithm "${alg}"`)
-    }
-    try {
-      return await importJWK(this.jwk as JWK, alg)
-    } catch (cause) {
-      throw new JwkError('Failed to import JWK', undefined, { cause })
-    }
-  }
-
-  async createJwt(header: JwtHeader, payload: JwtPayload): Promise<SignedJwt> {
-    try {
-      const { kid } = header
-      if (kid && kid !== this.kid) {
-        throw new JwtCreateError(
-          `Invalid "kid" (${kid}) used to sign with key "${this.kid}"`,
-        )
-      }
-
-      const { alg } = header
-      if (!alg) {
-        throw new JwtCreateError('Missing "alg" in JWT header')
-      }
-
-      const keyObj = await this.getKeyObj(alg)
-      const jwtBuilder = new SignJWT(payload).setProtectedHeader({
-        ...header,
-        alg,
-        kid: this.kid,
-      })
-
-      const signedJwt = await jwtBuilder.sign(keyObj)
-
-      return signedJwt as SignedJwt
-    } catch (cause) {
-      if (cause instanceof JOSEError) {
-        throw new JwtCreateError(cause.message, cause.code, { cause })
-      } else {
-        throw JwtCreateError.from(cause)
-      }
-    }
-  }
-
-  async verifyJwt<C extends string = never>(
-    token: SignedJwt,
-    options?: VerifyOptions<C>,
-  ): Promise<VerifyResult<C>> {
-    try {
-      const result = await jwtVerify(
-        token,
-        async ({ alg }) => this.getKeyObj(alg),
-        { ...options, algorithms: this.algorithms } as JWTVerifyOptions,
-      )
-
-      // @NOTE if all tokens are signed exclusively through createJwt(), then
-      // there should be no need to parse the payload and headers here. But
-      // since the JWT could have been signed with the same key from somewhere
-      // else, let's parse it to ensure the integrity (and type safety) of the
-      // data.
-      const headerParsed = jwtHeaderSchema.safeParse(result.protectedHeader)
-      if (!headerParsed.success) {
-        throw new JwtVerifyError('Invalid JWT header', undefined, {
-          cause: headerParsed.error,
-        })
-      }
-
-      const payloadParsed = jwtPayloadSchema.safeParse(result.payload)
-      if (!payloadParsed.success) {
-        throw new JwtVerifyError('Invalid JWT payload', undefined, {
-          cause: payloadParsed.error,
-        })
-      }
-
-      return {
-        protectedHeader: headerParsed.data,
-        // "requiredClaims" enforced by jwtVerify()
-        payload: payloadParsed.data as RequiredKey<JwtPayload, C>,
-      }
-    } catch (cause) {
-      if (cause instanceof JOSEError) {
-        throw new JwtVerifyError(cause.message, cause.code, { cause })
-      } else {
-        throw JwtVerifyError.from(cause)
-      }
-    }
-  }
-
-  static async generateKeyPair(
-    allowedAlgos: readonly string[] = ['ES256'],
-    options?: GenerateKeyPairOptions,
-  ) {
-    if (!allowedAlgos.length) {
-      throw new JwkError('No algorithms provided for key generation')
-    }
-
-    const errors: unknown[] = []
-    for (const alg of allowedAlgos) {
-      try {
-        return await generateKeyPair(alg, options)
-      } catch (err) {
-        errors.push(err)
-      }
-    }
-
-    throw new JwkError('Failed to generate key pair', undefined, {
-      cause: new AggregateError(errors, 'None of the algorithms worked'),
-    })
-  }
-
-  static async generate(
-    allowedAlgos: string[] = ['ES256'],
-    kid?: string,
-    options?: Omit<GenerateKeyPairOptions, 'extractable'>,
-  ): Promise<JoseKey> {
-    const kp = await this.generateKeyPair(allowedAlgos, {
-      ...options,
-      extractable: true,
-    })
-    return this.fromKeyLike(kp.privateKey, kid)
-  }
-
-  static async fromImportable(
-    input: string | KeyLike | Jwk,
-    kid?: string,
-  ): Promise<JoseKey> {
-    if (typeof input === 'string') {
-      // PKCS8
-      if (input.startsWith('-----')) {
-        // The "alg" is only needed in WebCrypto (NodeJS will be fine)
-        return this.fromPKCS8(input, '', kid)
-      }
-
-      // Jwk (string)
-      if (input.startsWith('{')) {
-        return this.fromJWK(input, kid)
-      }
-
-      throw new JwkError('Invalid input')
-    }
-
-    if (typeof input === 'object') {
-      // Jwk
-      if ('kty' in input || 'alg' in input) {
-        return this.fromJWK(input, kid)
-      }
-
-      // KeyLike
-      return this.fromKeyLike(input, kid)
-    }
-
-    throw new JwkError('Invalid input')
-  }
-
-  /**
-   * @see {@link exportJWK}
-   */
-  static async fromKeyLike(
-    keyLike: KeyLike | Uint8Array,
-    kid?: string,
-    alg?: string,
-  ): Promise<JoseKey> {
-    const jwk = await exportJWK(keyLike)
-    if (alg) {
-      if (!jwk.alg) jwk.alg = alg
-      else if (jwk.alg !== alg) throw new JwkError('Invalid "alg" in JWK')
-    }
-    return this.fromJWK(jwk, kid)
-  }
-
-  /**
-   * @see {@link importPKCS8}
-   */
-  static async fromPKCS8(
-    pem: string,
-    alg: string,
-    kid?: string,
-  ): Promise<JoseKey> {
-    const keyLike = await importPKCS8(pem, alg, { extractable: true })
-    return this.fromKeyLike(keyLike, kid)
-  }
-
-  static async fromJWK(
-    input: string | Record<string, unknown>,
-    inputKid?: string,
-  ): Promise<JoseKey> {
-    const jwk = typeof input === 'string' ? JSON.parse(input) : input
-    if (!jwk || typeof jwk !== 'object') throw new JwkError('Invalid JWK')
-
-    const kid = either(jwk.kid, inputKid)
-
-    // Backwards compatibility with old behavior
-    if (jwk.use != null && isPrivateJwk(jwk)) {
-      console.warn(
-        'Deprecation warning: Private JWK with a "use" property will be rejected in the future. Please remove replace "use" with (valid) "key_ops".',
-      )
-      jwk.key_ops ??= jwk.use === 'sig' ? ['sign'] : ['encrypt']
-      delete jwk.use
-    }
-
-    return new JoseKey<Jwk>(jwkSchema.parse({ ...jwk, kid }))
-  }
-}

package/src/util.ts

@@ -1,20 +0,0 @@
-// eslint-disable-next-line @typescript-eslint/no-empty-object-type
-export type Simplify<T> = { [K in keyof T]: T[K] } & {}
-
-export type RequiredKey<T, K extends keyof T = never> = Simplify<
-  T & {
-    [L in K]-?: unknown extends T[L]
-      ? NonNullable<unknown> | null
-      : Exclude<T[L], undefined>
-  }
->
-
-export function either<T extends string | number | boolean>(
-  a?: T,
-  b?: T,
-): T | undefined {
-  if (a != null && b != null && a !== b) {
-    throw new TypeError(`Expected "${b}", got "${a}"`)
-  }
-  return a ?? b ?? undefined
-}

package/tsconfig.build.json

@@ -1,8 +0,0 @@
-{
-  "extends": ["../../../tsconfig/nodenext.json"],
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src",
-  },
-  "include": ["src"],
-}

package/tsconfig.build.tsbuildinfo

@@ -1 +0,0 @@
-{"version":"7.0.0-dev.20260614.1","root":["./src/index.ts","./src/jose-key.ts","./src/util.ts"]}

package/tsconfig.json

@@ -1,4 +0,0 @@
-{
-  "include": [],
-  "references": [{ "path": "./tsconfig.build.json" }],
-}