@atproto/jwk 0.4.0 → 0.6.0

package/dist/util.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.segmentedStringRefinementFactory = exports.jwtCharsRefinement = exports.cachedGetter = exports.preferredOrderCmp = exports.isDefined = void 0;
 exports.matchesAny = matchesAny;
 exports.parseB64uJson = parseB64uJson;
+exports.isLastOccurrence = isLastOccurrence;
 const base64_1 = require("multiformats/bases/base64");
 const zod_1 = require("zod");
 const isDefined = (i) => i !== undefined;
@@ -140,4 +141,7 @@ const segmentedStringRefinementFactory = (count, minPartLength = 2) => {
     };
 };
 exports.segmentedStringRefinementFactory = segmentedStringRefinementFactory;
+function isLastOccurrence(v, i, arr) {
+    return arr.indexOf(v, i + 1) === -1;
+}
 //# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AA8CA,gCAQC;AAqBD,sCAIC;AA/ED,sDAAqD;AACrD,6BAAiD;AAgC1C,MAAM,SAAS,GAAG,CAAI,CAAgB,EAAU,EAAE,CAAC,CAAC,KAAK,SAAS,CAAA;AAA5D,QAAA,SAAS,aAAmD;AAElE,MAAM,iBAAiB,GAC5B,CAAI,KAAmB,EAAE,EAAE,CAC3B,CAAC,CAAI,EAAE,CAAI,EAAE,EAAE;IACb,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IACzB,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAA;IAC1B,OAAO,IAAI,GAAG,IAAI,CAAA;AACpB,CAAC,CAAA;AATU,QAAA,iBAAiB,qBAS3B;AAEH,SAAgB,UAAU,CACxB,KAA0C;IAE1C,OAAO,KAAK,IAAI,IAAI;QAClB,CAAC,CAAC,CAAC,CAAC,EAAU,EAAE,CAAC,IAAI;QACrB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,CAAC,CAAC,CAAC,CAAC,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC,CAAC,EAAU,EAAE,CAAC,CAAC,KAAK,KAAK,CAAA;AAClC,CAAC;AAED;;GAEG;AACI,MAAM,YAAY,GAAG,CAC1B,MAAsB,EACtB,QAA2C,EAC3C,EAAE;IACF,OAAO;QACL,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;YACvC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;YAChB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;AACH,CAAC,CAAA;AAbY,QAAA,YAAY,gBAaxB;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AACjC,SAAgB,aAAa,CAAC,KAAa;IACzC,MAAM,UAAU,GAAG,kBAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACvC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACI,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,GAAkB,EAAQ,EAAE;IAC3E,uDAAuD;IACvD,IAAI,IAAI,CAAA;IAER,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAEzB;QACE,sCAAsC;QACtC,CAAC,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM;YACpC,CAAC,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,MAAM;YACrC,CAAC,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM;YACpC,IAAI,KAAK,EAAE,IAAI,IAAI;YACnB,IAAI,KAAK,EAAE,IAAI,IAAI;YACnB,wCAAwC;YACxC,IAAI,KAAK,EAAE,CAAC,IAAI;UAChB,CAAC;YACD,WAAW;QACb,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAA;YAC9D,OAAO,GAAG,CAAC,QAAQ,CAAC;gBAClB,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,sBAAsB,WAAW,wBAAwB,CAAC,EAAE;aACtE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AA3BY,QAAA,kBAAkB,sBA2B9B;AAsBD;;;;;;GAMG;AACI,MAAM,gCAAgC,GAAG,CAC9C,KAAQ,EACR,aAAa,GAAG,CAAC,EACjB,EAAE;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,uCAAuC,KAAK,GAAG,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,GAAG,aAAa,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG,oBAAoB,CAAA;IAExC,OAAO,CAAC,IAAY,EAAE,GAAkB,EAA8B,EAAE;QACtE,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,GAAG,WAAW,aAAa;aACrC,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,YAAY,GAAG,CAAC,CAAA;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YAC/C,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;gBACnB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;oBACzB,OAAO,EAAE,GAAG,WAAW,cAAc,KAAK,kBAAkB,CAAC,GAAG,CAAC,EAAE;iBACpE,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,OAAO,GAAG,YAAY,GAAG,aAAa,EAAE,CAAC;gBAC3C,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;oBACzB,OAAO,EAAE,GAAG,WAAW,aAAa,CAAC,GAAG,CAAC,eAAe;iBACzD,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC;YACD,YAAY,GAAG,OAAO,GAAG,CAAC,CAAA;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,GAAG,WAAW,qBAAqB;aAC7C,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY,GAAG,aAAa,EAAE,CAAC;YAC/C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,GAAG,WAAW,6BAA6B;aACrD,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC,CAAA;AAtDY,QAAA,gCAAgC,oCAsD5C"}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;;AA4BA,gCAQC;AAqBD,sCAIC;AAyHD,4CAIC;AA1LD,sDAAqD;AACrD,6BAAiD;AAc1C,MAAM,SAAS,GAAG,CAAI,CAAgB,EAAU,EAAE,CAAC,CAAC,KAAK,SAAS,CAAA;AAA5D,QAAA,SAAS,aAAmD;AAElE,MAAM,iBAAiB,GAC5B,CAAI,KAAmB,EAAE,EAAE,CAC3B,CAAC,CAAI,EAAE,CAAI,EAAE,EAAE;IACb,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IACzB,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAA;IAC1B,OAAO,IAAI,GAAG,IAAI,CAAA;AACpB,CAAC,CAAA;AATU,QAAA,iBAAiB,qBAS3B;AAEH,SAAgB,UAAU,CACxB,KAA0C;IAE1C,OAAO,KAAK,IAAI,IAAI;QAClB,CAAC,CAAC,CAAC,CAAC,EAAU,EAAE,CAAC,IAAI;QACrB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,CAAC,CAAC,CAAC,CAAC,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC,CAAC,EAAU,EAAE,CAAC,CAAC,KAAK,KAAK,CAAA;AAClC,CAAC;AAED;;GAEG;AACI,MAAM,YAAY,GAAG,CAC1B,MAAsB,EACtB,QAA2C,EAC3C,EAAE;IACF,OAAO;QACL,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;YACvC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK;YAChB,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;QACF,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;AACH,CAAC,CAAA;AAbY,QAAA,YAAY,gBAaxB;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AACjC,SAAgB,aAAa,CAAC,KAAa;IACzC,MAAM,UAAU,GAAG,kBAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACvC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACI,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAE,GAAkB,EAAQ,EAAE;IAC3E,uDAAuD;IACvD,IAAI,IAAI,CAAA;IAER,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAEzB;QACE,sCAAsC;QACtC,CAAC,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM;YACpC,CAAC,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,MAAM;YACrC,CAAC,EAAE,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM;YACpC,IAAI,KAAK,EAAE,IAAI,IAAI;YACnB,IAAI,KAAK,EAAE,IAAI,IAAI;YACnB,wCAAwC;YACxC,IAAI,KAAK,EAAE,CAAC,IAAI;UAChB,CAAC;YACD,WAAW;QACb,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAA;YAC9D,OAAO,GAAG,CAAC,QAAQ,CAAC;gBAClB,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,sBAAsB,WAAW,wBAAwB,CAAC,EAAE;aACtE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AA3BY,QAAA,kBAAkB,sBA2B9B;AAsBD;;;;;;GAMG;AACI,MAAM,gCAAgC,GAAG,CAC9C,KAAQ,EACR,aAAa,GAAG,CAAC,EACjB,EAAE;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,uCAAuC,KAAK,GAAG,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,GAAG,aAAa,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG,oBAAoB,CAAA;IAExC,OAAO,CAAC,IAAY,EAAE,GAAkB,EAA8B,EAAE;QACtE,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,GAAG,WAAW,aAAa;aACrC,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,YAAY,GAAG,CAAC,CAAA;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;YAC/C,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;gBACnB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;oBACzB,OAAO,EAAE,GAAG,WAAW,cAAc,KAAK,kBAAkB,CAAC,GAAG,CAAC,EAAE;iBACpE,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,OAAO,GAAG,YAAY,GAAG,aAAa,EAAE,CAAC;gBAC3C,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;oBACzB,OAAO,EAAE,GAAG,WAAW,aAAa,CAAC,GAAG,CAAC,eAAe;iBACzD,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC;YACD,YAAY,GAAG,OAAO,GAAG,CAAC,CAAA;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,GAAG,WAAW,qBAAqB;aAC7C,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY,GAAG,aAAa,EAAE,CAAC;YAC/C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,kBAAY,CAAC,MAAM;gBACzB,OAAO,EAAE,GAAG,WAAW,6BAA6B;aACrD,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;AACH,CAAC,CAAA;AAtDY,QAAA,gCAAgC,oCAsD5C;AAED,SAAgB,gBAAgB,CAE9B,CAAI,EAAE,CAAS,EAAE,GAAiB;IAClC,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AACrC,CAAC","sourcesContent":["import { base64url } from 'multiformats/bases/base64'\nimport { RefinementCtx, ZodIssueCode } from 'zod'\n\n// eslint-disable-next-line @typescript-eslint/ban-types\nexport type Simplify<T> = { [K in keyof T]: T[K] } & {}\nexport type Override<T, V> = Simplify<V & Omit<T, keyof V>>\n\nexport type RequiredKey<T, K extends keyof T = never> = Simplify<\n  T & {\n    [L in K]-?: unknown extends T[L]\n      ? NonNullable<unknown> | null\n      : Exclude<T[L], undefined>\n  }\n>\n\nexport const isDefined = <T>(i: T | undefined): i is T => i !== undefined\n\nexport const preferredOrderCmp =\n  <T>(order: readonly T[]) =>\n  (a: T, b: T) => {\n    const aIdx = order.indexOf(a)\n    const bIdx = order.indexOf(b)\n    if (aIdx === bIdx) return 0\n    if (aIdx === -1) return 1\n    if (bIdx === -1) return -1\n    return aIdx - bIdx\n  }\n\nexport function matchesAny<T extends string | number | symbol | boolean>(\n  value: null | undefined | T | readonly T[],\n): (v: unknown) => v is T {\n  return value == null\n    ? (v): v is T => true\n    : Array.isArray(value)\n      ? (v): v is T => value.includes(v)\n      : (v): v is T => v === value\n}\n\n/**\n * Decorator to cache the result of a getter on a class instance.\n */\nexport const cachedGetter = <T extends object, V>(\n  target: (this: T) => V,\n  _context: ClassGetterDecoratorContext<T, V>,\n) => {\n  return function (this: T) {\n    const value = target.call(this)\n    Object.defineProperty(this, target.name, {\n      get: () => value,\n      enumerable: true,\n      configurable: true,\n    })\n    return value\n  }\n}\n\nconst decoder = new TextDecoder()\nexport function parseB64uJson(input: string): unknown {\n  const inputBytes = base64url.baseDecode(input)\n  const json = decoder.decode(inputBytes)\n  return JSON.parse(json)\n}\n\n/**\n * @example\n * ```ts\n * // jwtSchema will only allow base64url chars & \".\" (dot)\n * const jwtSchema = z.string().superRefine(jwtCharsRefinement)\n * ```\n */\nexport const jwtCharsRefinement = (data: string, ctx: RefinementCtx): void => {\n  // Note: this is a hot path, let's avoid using a RegExp\n  let char\n\n  for (let i = 0; i < data.length; i++) {\n    char = data.charCodeAt(i)\n\n    if (\n      // Base64 URL encoding (most frequent)\n      (65 <= char && char <= 90) || // A-Z\n      (97 <= char && char <= 122) || // a-z\n      (48 <= char && char <= 57) || // 0-9\n      char === 45 || // -\n      char === 95 || // _\n      // Boundary (least frequent, check last)\n      char === 46 // .\n    ) {\n      // continue\n    } else {\n      // Invalid char might be a surrogate pair\n      const invalidChar = String.fromCodePoint(data.codePointAt(i)!)\n      return ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: `Invalid character \"${invalidChar}\" in JWT at position ${i}`,\n      })\n    }\n  }\n}\n\n/**\n * @example\n * ```ts\n * type SegmentedString3 = SegmentedString<3> // `${string}.${string}.${string}`\n * type SegmentedString4 = SegmentedString<4> // `${string}.${string}.${string}.${string}`\n * ```\n *\n * @note\n * This utility only provides one way type safety (A SegmentedString<4> can be\n * assigned to SegmentedString<3> but not vice versa). The purpose of this\n * utility is to improve DX by avoiding as many potential errors as build time.\n * DO NOT rely on this to enforce security or data integrity.\n */\ntype SegmentedString<\n  C extends number,\n  Acc extends string[] = [string],\n> = Acc['length'] extends C\n  ? `${Acc[0]}`\n  : `${Acc[0]}.${SegmentedString<C, [string, ...Acc]>}`\n\n/**\n * @example\n * ```ts\n * const jwtSchema = z.string().superRefine(segmentedStringRefinementFactory(3))\n * type Jwt = z.infer<typeof jwtSchema> // `${string}.${string}.${string}`\n * ```\n */\nexport const segmentedStringRefinementFactory = <C extends number>(\n  count: C,\n  minPartLength = 2,\n) => {\n  if (!Number.isFinite(count) || count < 1 || (count | 0) !== count) {\n    throw new TypeError(`Count must be a natural number (got ${count})`)\n  }\n\n  const minTotalLength = count * minPartLength + (count - 1)\n  const errorPrefix = `Invalid JWT format`\n\n  return (data: string, ctx: RefinementCtx): data is SegmentedString<C> => {\n    if (data.length < minTotalLength) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: `${errorPrefix}: too short`,\n      })\n      return false\n    }\n    let currentStart = 0\n    for (let i = 0; i < count - 1; i++) {\n      const nextDot = data.indexOf('.', currentStart)\n      if (nextDot === -1) {\n        ctx.addIssue({\n          code: ZodIssueCode.custom,\n          message: `${errorPrefix}: expected ${count} segments, got ${i + 1}`,\n        })\n        return false\n      }\n      if (nextDot - currentStart < minPartLength) {\n        ctx.addIssue({\n          code: ZodIssueCode.custom,\n          message: `${errorPrefix}: segment ${i + 1} is too short`,\n        })\n        return false\n      }\n      currentStart = nextDot + 1\n    }\n    if (data.indexOf('.', currentStart) !== -1) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: `${errorPrefix}: too many segments`,\n      })\n      return false\n    }\n    if (data.length - currentStart < minPartLength) {\n      ctx.addIssue({\n        code: ZodIssueCode.custom,\n        message: `${errorPrefix}: last segment is too short`,\n      })\n      return false\n    }\n    return true\n  }\n}\n\nexport function isLastOccurrence<\n  T extends number | boolean | string | null | undefined | symbol | bigint,\n>(v: T, i: number, arr: readonly T[]): boolean {\n  return arr.indexOf(v, i + 1) === -1\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atproto/jwk",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "license": "MIT",
   "description": "A library for working with JSON Web Keys (JWKs) in TypeScript. This is meant to be extended by environment-specific libraries like @atproto/jwk-jose.",
   "keywords": [
@@ -33,6 +33,6 @@
     "typescript": "^5.6.3"
   },
   "scripts": {
-    "build": "tsc --build tsconfig.json"
+    "build": "tsc --build tsconfig.build.json"
   }
 }

package/src/alg.ts

@@ -1,29 +1,29 @@
 import { JwkError } from './errors.js'
-import { Jwk } from './jwk.js'
+import { JwkBase, isEncKeyUsage, isSigKeyUsage } from './jwk.js'
 
 // Copy variable to prevent bundlers from automatically polyfilling "process" (e.g. parcel)
 const { process } = globalThis
 const IS_NODE_RUNTIME =
   typeof process !== 'undefined' && typeof process?.versions?.node === 'string'
 
-export function* jwkAlgorithms(jwk: Jwk): Generator<string> {
+export function* jwkAlgorithms(jwk: JwkBase): Generator<string, void, unknown> {
   // Ed25519, Ed448, and secp256k1 always have "alg"
-  // OKP always has "use"
-  if (jwk.alg) {
+
+  if (typeof jwk.alg === 'string') {
     yield jwk.alg
     return
   }
 
   switch (jwk.kty) {
     case 'EC': {
-      if (jwk.use === 'enc' || jwk.use === undefined) {
+      if (jwkSupportsEnc(jwk)) {
         yield 'ECDH-ES'
         yield 'ECDH-ES+A128KW'
         yield 'ECDH-ES+A192KW'
         yield 'ECDH-ES+A256KW'
       }
 
-      if (jwk.use === 'sig' || jwk.use === undefined) {
+      if (jwkSupportsSig(jwk)) {
         const crv = 'crv' in jwk ? jwk.crv : undefined
         switch (crv) {
           case 'P-256':
@@ -54,7 +54,7 @@ export function* jwkAlgorithms(jwk: Jwk): Generator<string> {
     }
 
     case 'RSA': {
-      if (jwk.use === 'enc' || jwk.use === undefined) {
+      if (jwkSupportsEnc(jwk)) {
         yield 'RSA-OAEP'
         yield 'RSA-OAEP-256'
         yield 'RSA-OAEP-384'
@@ -62,7 +62,7 @@ export function* jwkAlgorithms(jwk: Jwk): Generator<string> {
         if (IS_NODE_RUNTIME) yield 'RSA1_5'
       }
 
-      if (jwk.use === 'sig' || jwk.use === undefined) {
+      if (jwkSupportsSig(jwk)) {
         yield 'PS256'
         yield 'PS384'
         yield 'PS512'
@@ -75,7 +75,7 @@ export function* jwkAlgorithms(jwk: Jwk): Generator<string> {
     }
 
     case 'oct': {
-      if (jwk.use === 'enc' || jwk.use === undefined) {
+      if (jwkSupportsEnc(jwk)) {
         yield 'A128GCMKW'
         yield 'A192GCMKW'
         yield 'A256GCMKW'
@@ -84,7 +84,7 @@ export function* jwkAlgorithms(jwk: Jwk): Generator<string> {
         yield 'A256KW'
       }
 
-      if (jwk.use === 'sig' || jwk.use === undefined) {
+      if (jwkSupportsSig(jwk)) {
         yield 'HS256'
         yield 'HS384'
         yield 'HS512'
@@ -97,3 +97,15 @@ export function* jwkAlgorithms(jwk: Jwk): Generator<string> {
       throw new JwkError(`Unsupported kty "${jwk.kty}"`)
   }
 }
+
+function jwkSupportsEnc(jwk: JwkBase): boolean {
+  return (
+    jwk.key_ops?.some(isEncKeyUsage) ?? (jwk.use == null || jwk.use === 'enc')
+  )
+}
+
+function jwkSupportsSig(jwk: JwkBase): boolean {
+  return (
+    jwk.key_ops?.some(isSigKeyUsage) ?? (jwk.use == null || jwk.use === 'sig')
+  )
+}

package/src/jwk.ts

@@ -1,45 +1,96 @@
 import { z } from 'zod'
+import { isLastOccurrence } from './util'
 
-export const keyUsageSchema = z.enum([
+export const PUBLIC_KEY_USAGE = ['verify', 'encrypt', 'wrapKey'] as const
+export const publicKeyUsageSchema = z.enum(PUBLIC_KEY_USAGE)
+export type PublicKeyUsage = (typeof PUBLIC_KEY_USAGE)[number]
+export function isPublicKeyUsage(usage: unknown): usage is PublicKeyUsage {
+  return (PUBLIC_KEY_USAGE as readonly unknown[]).includes(usage)
+}
+
+/**
+ * Determines if the given key usage is consistent for "sig" (signature) public
+ * key use.
+ */
+export function isSigKeyUsage(v: KeyUsage) {
+  return v === 'verify'
+}
+
+/**
+ * Determines if the given key usage is consistent for "enc" (encryption) public
+ * key use.
+ *
+ * > When a key is used to wrap another key and a public key use
+ * > designation for the first key is desired, the "enc" (encryption)
+ * > key use value is used, since key wrapping is a kind of encryption.
+ * > The "enc" value is also to be used for public keys used for key
+ * > agreement operations.
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7517#section-4.2}
+ */
+export function isEncKeyUsage(v: KeyUsage) {
+  return v === 'encrypt' || v === 'wrapKey'
+}
+
+export const PRIVATE_KEY_USAGE = [
   'sign',
-  'verify',
-  'encrypt',
   'decrypt',
-  'wrapKey',
   'unwrapKey',
   'deriveKey',
   'deriveBits',
-])
+] as const
+export const privateKeyUsageSchema = z.enum(PRIVATE_KEY_USAGE)
+export type PrivateKeyUsage = (typeof PRIVATE_KEY_USAGE)[number]
+export function isPrivateKeyUsage(usage: unknown): usage is PrivateKeyUsage {
+  return (PRIVATE_KEY_USAGE as readonly unknown[]).includes(usage)
+}
 
-export type KeyUsage = z.infer<typeof keyUsageSchema>
+export const KEY_USAGE = [...PRIVATE_KEY_USAGE, ...PUBLIC_KEY_USAGE] as const
+export const keyUsageSchema = z.enum(KEY_USAGE)
+export type KeyUsage = (typeof KEY_USAGE)[number]
 
 /**
- * The "use" and "key_ops" JWK members SHOULD NOT be used together;
- * however, if both are used, the information they convey MUST be
- * consistent.  Applications should specify which of these members they
- * use, if either is to be used by the application.
- *
- * @todo Actually check that "use" and "key_ops" are consistent when both are present.
- * @see {@link https://datatracker.ietf.org/doc/html/rfc7517#section-4.3}
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7517#section-4 JSON Web Key (JWK) Format}
+ * @see {@link https://www.iana.org/assignments/jose/jose.xhtml#web-key-parameters IANA "JSON Web Key Parameters" registry}
  */
-export const jwkBaseSchema = z.object({
+const jwkBaseSchema = z.object({
   kty: z.string().min(1),
   alg: z.string().min(1).optional(),
   kid: z.string().min(1).optional(),
-  ext: z.boolean().optional(),
   use: z.enum(['sig', 'enc']).optional(),
-  key_ops: z.array(keyUsageSchema).optional(),
+  key_ops: z
+    .array(keyUsageSchema)
+    .min(1, { message: 'At least one key usage must be specified' })
+    // https://datatracker.ietf.org/doc/html/rfc7517#section-4.3
+    // > Duplicate key operation values MUST NOT be present in the array.
+    .refine((ops) => ops.every(isLastOccurrence), {
+      message: 'key_ops must not contain duplicates',
+    })
+    .optional(),
 
   x5c: z.array(z.string()).optional(), // X.509 Certificate Chain
   x5t: z.string().min(1).optional(), // X.509 Certificate SHA-1 Thumbprint
   'x5t#S256': z.string().min(1).optional(), // X.509 Certificate SHA-256 Thumbprint
   x5u: z.string().url().optional(), // X.509 URL
+
+  // https://www.w3.org/TR/webcrypto/
+  ext: z.boolean().optional(), // Extractable
+
+  // Federation Historical Keys Response
+  // https://openid.net/specs/openid-federation-1_0.html#name-federation-historical-keys-res
+  iat: z.number().int().optional(), // Issued At (timestamp)
+  exp: z.number().int().optional(), // Expiration Time (timestamp)
+  nbf: z.number().int().optional(), // Not Before (timestamp)
+  revoked: z //  properties of the revocation
+    .object({
+      revoked_at: z.number().int(),
+      reason: z.string().optional(),
+    })
+    .optional(),
 })
 
-/**
- * @todo: properly implement this
- */
-export const jwkRsaKeySchema = jwkBaseSchema.extend({
+export type JwkBase = z.infer<typeof jwkBaseSchema>
+
+const jwkRsaKeySchema = jwkBaseSchema.extend({
   kty: z.literal('RSA'),
   alg: z
     .enum(['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512'])
@@ -62,12 +113,11 @@ export const jwkRsaKeySchema = jwkBaseSchema.extend({
         t: z.string().optional(),
       }),
     )
-    .nonempty()
-
+    .min(1)
     .optional(), // Other Primes Info
 })
 
-export const jwkEcKeySchema = jwkBaseSchema.extend({
+const jwkEcKeySchema = jwkBaseSchema.extend({
   kty: z.literal('EC'),
   alg: z.enum(['ES256', 'ES384', 'ES512']).optional(),
   crv: z.enum(['P-256', 'P-384', 'P-521']),
@@ -78,7 +128,7 @@ export const jwkEcKeySchema = jwkBaseSchema.extend({
   d: z.string().min(1).optional(), // ECC Private Key
 })
 
-export const jwkEcSecp256k1KeySchema = jwkBaseSchema.extend({
+const jwkEcSecp256k1KeySchema = jwkBaseSchema.extend({
   kty: z.literal('EC'),
   alg: z.enum(['ES256K']).optional(),
   crv: z.enum(['secp256k1']),
@@ -89,7 +139,7 @@ export const jwkEcSecp256k1KeySchema = jwkBaseSchema.extend({
   d: z.string().min(1).optional(), // ECC Private Key
 })
 
-export const jwkOkpKeySchema = jwkBaseSchema.extend({
+const jwkOkpKeySchema = jwkBaseSchema.extend({
   kty: z.literal('OKP'),
   alg: z.enum(['EdDSA']).optional(),
   crv: z.enum(['Ed25519', 'Ed448']),
@@ -98,49 +148,116 @@ export const jwkOkpKeySchema = jwkBaseSchema.extend({
   d: z.string().min(1).optional(), // ECC Private Key
 })
 
-export const jwkSymKeySchema = jwkBaseSchema.extend({
+const jwkSymKeySchema = jwkBaseSchema.extend({
   kty: z.literal('oct'), // Octet Sequence (used to represent symmetric keys)
   alg: z.enum(['HS256', 'HS384', 'HS512']).optional(),
 
   k: z.string(), // Key Value (base64url encoded)
 })
 
-export const jwkUnknownKeySchema = jwkBaseSchema.extend({
-  kty: z
-    .string()
-    .refine((v) => v !== 'RSA' && v !== 'EC' && v !== 'OKP' && v !== 'oct'),
-})
-
-export const jwkSchema = z.union([
-  jwkUnknownKeySchema,
-  jwkRsaKeySchema,
-  jwkEcKeySchema,
-  jwkEcSecp256k1KeySchema,
-  jwkOkpKeySchema,
-  jwkSymKeySchema,
-])
+/**
+ * Zod parser for known JWK types
+ */
+export const jwkSchema = z
+  .union([
+    jwkRsaKeySchema,
+    jwkEcKeySchema,
+    jwkEcSecp256k1KeySchema,
+    jwkOkpKeySchema,
+    jwkSymKeySchema,
+  ])
+  // @TODO These rules should be applied to jwkBaseSchema, but Zod 3 doesn't
+  // support extending refined schemas. Move these to the base schema when we
+  // upgrade to Zod 4.
+  .refine(
+    // https://datatracker.ietf.org/doc/html/rfc7517#section-4.2
+    // > The "use" (public key use) parameter identifies the intended use of the
+    // > public key
+    (k): boolean => k.use == null || isPublicJwk(k),
+    {
+      message: '"use" can only be used with public keys',
+      path: ['use'],
+    },
+  )
+  .refine(
+    (k): boolean => !k.key_ops?.some(isPrivateKeyUsage) || isPrivateJwk(k),
+    {
+      message: 'private key usage not allowed for public keys',
+      path: ['key_ops'],
+    },
+  )
+  .refine(
+    // https://datatracker.ietf.org/doc/html/rfc7517#section-4.3
+    // > The "use" and "key_ops" JWK members SHOULD NOT be used together;
+    // > however, if both are used, the information they convey MUST be
+    // > consistent.
+    (k): boolean =>
+      k.use == null ||
+      k.key_ops == null ||
+      (k.use === 'sig' && k.key_ops.every(isSigKeyUsage)) ||
+      (k.use === 'enc' && k.key_ops.every(isEncKeyUsage)),
+    {
+      message: '"key_ops" must be consistent with "use"',
+      path: ['key_ops'],
+    },
+  )
 
-export type Jwk = z.infer<typeof jwkSchema>
+export type Jwk = z.output<typeof jwkSchema>
 
+/** @deprecated use {@link jwkSchema} instead */
 export const jwkValidator = jwkSchema
-  .refine((k) => k.use != null || k.key_ops != null, 'use or key_ops required')
-  .refine(
-    (k) =>
-      !k.use ||
-      !k.key_ops ||
-      k.key_ops.every((o) =>
-        k.use === 'sig'
-          ? o === 'sign' || o === 'verify'
-          : o === 'encrypt' || o === 'decrypt',
-      ),
-    'use and key_ops must be consistent',
-  )
 
-export const jwkPubSchema = jwkValidator
-  .refine((k) => k.kid != null, 'kid is required')
-  .refine((k) => !('k' in k) && !('d' in k), 'private key not allowed')
+export const jwkPubSchema = jwkSchema
+  .refine(hasKid, {
+    message: '"kid" is required',
+    path: ['kid'],
+  })
+  // @NOTE for legacy reasons, we don't impose the presence of either "use" or "key_ops"
+  .refine(isPublicJwk, {
+    message: 'private key not allowed',
+  })
+  .refine((k): boolean => !k.key_ops || k.key_ops.every(isPublicKeyUsage), {
+    message: '"key_ops" must not contain private key usage for public keys',
+    path: ['key_ops'],
+  })
+
+export type PublicJwk = z.output<typeof jwkPubSchema>
+
+export const jwkPrivateSchema = jwkSchema
+  // @NOTE we don't impose the presence of "kid"
+  .refine(isPrivateJwk, {
+    message: 'private key required',
+  })
+
+export type PrivateJwk = z.output<typeof jwkPrivateSchema>
+
+export function hasKid<J extends object>(
+  jwk: J,
+): jwk is J & { kid: NonNullable<unknown> } {
+  return 'kid' in jwk && jwk.kid != null
+}
+
+export function hasSharedSecretJwk<J extends object>(
+  jwk: J,
+): jwk is J & { k: NonNullable<unknown> } {
+  return 'k' in jwk && jwk.k != null
+}
+
+export function hasPrivateSecretJwk<J extends object>(
+  jwk: J,
+): jwk is J & { d: NonNullable<unknown> } {
+  return 'd' in jwk && jwk.d != null
+}
+
+export function isPrivateJwk<J extends object>(jwk: J) {
+  return hasPrivateSecretJwk(jwk) || hasSharedSecretJwk(jwk)
+}
 
-export const jwkPrivateSchema = jwkValidator.refine(
-  (k) => ('k' in k && k.k != null) || ('d' in k && k.d != null),
-  'private key required',
-)
+export function isPublicJwk<J extends object>(
+  jwk: J,
+): jwk is Extract<
+  Exclude<J, { k: NonNullable<unknown> }>,
+  { d?: NonNullable<unknown> }
+> & { d?: never } {
+  return !hasPrivateSecretJwk(jwk) && !hasSharedSecretJwk(jwk)
+}

package/src/jwks.ts

@@ -1,14 +1,39 @@
 import { z } from 'zod'
 import { jwkPubSchema, jwkSchema } from './jwk.js'
 
+/**
+ * JSON Web Key Set schema. The keys set, in this context, represents a
+ * collection of JSON Web Keys (JWKs), that can be both public and private.
+ */
 export const jwksSchema = z.object({
-  keys: z.array(jwkSchema),
+  keys: z.array(z.unknown()).transform((input) => {
+    // > Implementations SHOULD ignore JWKs within a JWK Set that use "kty"
+    // > (key type) values that are not understood by them, that are missing
+    // > required members, or for which values are out of the supported
+    // > ranges.
+    return input
+      .map((item) => jwkSchema.safeParse(item))
+      .filter((res) => res.success)
+      .map((res) => res.data)
+  }),
 })
 
-export type Jwks = z.infer<typeof jwksSchema>
+export type Jwks = z.output<typeof jwksSchema>
 
+/**
+ * Public JSON Web Key Set schema.
+ */
 export const jwksPubSchema = z.object({
-  keys: z.array(jwkPubSchema),
+  keys: z.array(z.unknown()).transform((input) => {
+    // > Implementations SHOULD ignore JWKs within a JWK Set that use "kty"
+    // > (key type) values that are not understood by them, that are missing
+    // > required members, or for which values are out of the supported
+    // > ranges.
+    return input
+      .map((item) => jwkPubSchema.safeParse(item))
+      .filter((res) => res.success)
+      .map((res) => res.data)
+  }),
 })
 
-export type JwksPub = z.infer<typeof jwksPubSchema>
+export type JwksPub = z.output<typeof jwksPubSchema>