@atproto/jwk 0.7.1 → 0.7.3

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @atproto/jwk
 
+## 0.7.3
+
+### Patch Changes
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update TypeScript build to rely on references to composite internal projects
+
+- [#5099](https://github.com/bluesky-social/atproto/pull/5099) [`b43ec31`](https://github.com/bluesky-social/atproto/commit/b43ec31f247f4461725b01226885f88bd430ca07) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Bundle only necessary files in the NPM tarball, including the `CHANGELOG.md` and `README.md` files (if present).
+
+## 0.7.2
+
+### Patch Changes
+
+- [#5151](https://github.com/bluesky-social/atproto/pull/5151) [`a51c45d`](https://github.com/bluesky-social/atproto/commit/a51c45d38f6bd7b8765f640e564cf921d52162e7) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Update dependencies
+
 ## 0.7.1
 
 ### Patch Changes

package/package.json

@@ -1,9 +1,6 @@
 {
   "name": "@atproto/jwk",
-  "version": "0.7.1",
-  "engines": {
-    "node": ">=22"
-  },
+  "version": "0.7.3",
   "license": "MIT",
   "description": "A library for working with JSON Web Keys (JWKs) in TypeScript. This is meant to be extended by environment-specific libraries like @atproto/jwk-jose.",
   "keywords": [
@@ -19,6 +16,10 @@
     "url": "https://github.com/bluesky-social/atproto",
     "directory": "packages/oauth/jwk"
   },
+  "files": [
+    "./dist",
+    "./CHANGELOG.md"
+  ],
   "type": "module",
   "exports": {
     ".": {
@@ -26,11 +27,13 @@
       "default": "./dist/index.js"
     }
   },
+  "engines": {
+    "node": ">=22"
+  },
   "dependencies": {
     "multiformats": "^13.0.0",
     "zod": "^3.23.8"
   },
-  "devDependencies": {},
   "scripts": {
     "build": "tsgo --build tsconfig.build.json"
   }

package/src/alg.ts

@@ -1,111 +0,0 @@
-import { JwkError } from './errors.js'
-import { JwkBase, isEncKeyUsage, isSigKeyUsage } from './jwk.js'
-
-// Copy variable to prevent bundlers from automatically polyfilling "process" (e.g. parcel)
-const { process } = globalThis
-const IS_NODE_RUNTIME =
-  typeof process !== 'undefined' && typeof process?.versions?.node === 'string'
-
-export function* jwkAlgorithms(jwk: JwkBase): Generator<string, void, unknown> {
-  // Ed25519, Ed448, and secp256k1 always have "alg"
-
-  if (typeof jwk.alg === 'string') {
-    yield jwk.alg
-    return
-  }
-
-  switch (jwk.kty) {
-    case 'EC': {
-      if (jwkSupportsEnc(jwk)) {
-        yield 'ECDH-ES'
-        yield 'ECDH-ES+A128KW'
-        yield 'ECDH-ES+A192KW'
-        yield 'ECDH-ES+A256KW'
-      }
-
-      if (jwkSupportsSig(jwk)) {
-        const crv = 'crv' in jwk ? jwk.crv : undefined
-        switch (crv) {
-          case 'P-256':
-          case 'P-384':
-            yield `ES${crv.slice(-3)}`
-            break
-          case 'P-521':
-            yield 'ES512'
-            break
-          case 'secp256k1':
-            if (IS_NODE_RUNTIME) yield 'ES256K'
-            break
-          default:
-            throw new JwkError(`Unsupported crv "${crv}"`)
-        }
-      }
-
-      return
-    }
-
-    case 'OKP': {
-      if (!jwk.use) throw new JwkError('Missing "use" Parameter value')
-      yield 'ECDH-ES'
-      yield 'ECDH-ES+A128KW'
-      yield 'ECDH-ES+A192KW'
-      yield 'ECDH-ES+A256KW'
-      return
-    }
-
-    case 'RSA': {
-      if (jwkSupportsEnc(jwk)) {
-        yield 'RSA-OAEP'
-        yield 'RSA-OAEP-256'
-        yield 'RSA-OAEP-384'
-        yield 'RSA-OAEP-512'
-        if (IS_NODE_RUNTIME) yield 'RSA1_5'
-      }
-
-      if (jwkSupportsSig(jwk)) {
-        yield 'PS256'
-        yield 'PS384'
-        yield 'PS512'
-        yield 'RS256'
-        yield 'RS384'
-        yield 'RS512'
-      }
-
-      return
-    }
-
-    case 'oct': {
-      if (jwkSupportsEnc(jwk)) {
-        yield 'A128GCMKW'
-        yield 'A192GCMKW'
-        yield 'A256GCMKW'
-        yield 'A128KW'
-        yield 'A192KW'
-        yield 'A256KW'
-      }
-
-      if (jwkSupportsSig(jwk)) {
-        yield 'HS256'
-        yield 'HS384'
-        yield 'HS512'
-      }
-
-      return
-    }
-
-    default:
-      throw new JwkError(`Unsupported kty "${jwk.kty}"`)
-  }
-}
-
-function jwkSupportsEnc(jwk: JwkBase): boolean {
-  return (
-    jwk.key_ops?.some(isEncKeyUsage) ?? (jwk.use == null || jwk.use === 'enc')
-  )
-}
-
-function jwkSupportsSig(jwk: JwkBase): boolean {
-  return (
-    jwk.key_ops?.some(isSigKeyUsage) ?? (jwk.use == null || jwk.use === 'sig')
-  )
-}

package/src/errors.ts

@@ -1,56 +0,0 @@
-export type ErrorOptions = { cause?: unknown }
-
-export const ERR_JWKS_NO_MATCHING_KEY = 'ERR_JWKS_NO_MATCHING_KEY'
-export const ERR_JWK_INVALID = 'ERR_JWK_INVALID'
-export const ERR_JWK_NOT_FOUND = 'ERR_JWK_NOT_FOUND'
-export const ERR_JWT_INVALID = 'ERR_JWT_INVALID'
-export const ERR_JWT_CREATE = 'ERR_JWT_CREATE'
-export const ERR_JWT_VERIFY = 'ERR_JWT_VERIFY'
-
-export class JwkError extends TypeError {
-  constructor(
-    message = 'JWK error',
-    public readonly code = ERR_JWK_INVALID,
-    options?: ErrorOptions,
-  ) {
-    super(message, options)
-  }
-}
-
-export class JwtCreateError extends Error {
-  constructor(
-    message = 'Unable to create JWT',
-    public readonly code = ERR_JWT_CREATE,
-    options?: ErrorOptions,
-  ) {
-    super(message, options)
-  }
-
-  static from(cause: unknown, code?: string, message?: string): JwtCreateError {
-    if (cause instanceof JwtCreateError) return cause
-    if (cause instanceof JwkError) {
-      return new JwtCreateError(message, cause.code, { cause })
-    }
-
-    return new JwtCreateError(message, code, { cause })
-  }
-}
-
-export class JwtVerifyError extends Error {
-  constructor(
-    message = 'Invalid JWT',
-    public readonly code = ERR_JWT_VERIFY,
-    options?: ErrorOptions,
-  ) {
-    super(message, options)
-  }
-
-  static from(cause: unknown, code?: string, message?: string): JwtVerifyError {
-    if (cause instanceof JwtVerifyError) return cause
-    if (cause instanceof JwkError) {
-      return new JwtVerifyError(message, cause.code, { cause })
-    }
-
-    return new JwtVerifyError(message, code, { cause })
-  }
-}

package/src/index.ts

@@ -1,14 +0,0 @@
-// Since we expose zod schemas, let's expose ZodError (under a generic name) so
-// that dependents can catch schema parsing errors without requiring an explicit
-// dependency on zod, or risking a conflict in case of mismatching zob versions.
-export { ZodError as ValidationError } from 'zod'
-
-export * from './alg.js'
-export * from './errors.js'
-export * from './jwk.js'
-export * from './jwks.js'
-export * from './jwt-decode.js'
-export * from './jwt-verify.js'
-export * from './jwt.js'
-export * from './key.js'
-export * from './keyset.js'

package/src/jwk.ts

@@ -1,263 +0,0 @@
-import { z } from 'zod'
-import { isLastOccurrence } from './util.js'
-
-export const PUBLIC_KEY_USAGE = ['verify', 'encrypt', 'wrapKey'] as const
-export const publicKeyUsageSchema = z.enum(PUBLIC_KEY_USAGE)
-export type PublicKeyUsage = (typeof PUBLIC_KEY_USAGE)[number]
-export function isPublicKeyUsage(usage: unknown): usage is PublicKeyUsage {
-  return (PUBLIC_KEY_USAGE as readonly unknown[]).includes(usage)
-}
-
-/**
- * Determines if the given key usage is consistent for "sig" (signature) public
- * key use.
- */
-export function isSigKeyUsage(v: KeyUsage) {
-  return v === 'verify'
-}
-
-/**
- * Determines if the given key usage is consistent for "enc" (encryption) public
- * key use.
- *
- * > When a key is used to wrap another key and a public key use
- * > designation for the first key is desired, the "enc" (encryption)
- * > key use value is used, since key wrapping is a kind of encryption.
- * > The "enc" value is also to be used for public keys used for key
- * > agreement operations.
- * @see {@link https://datatracker.ietf.org/doc/html/rfc7517#section-4.2}
- */
-export function isEncKeyUsage(v: KeyUsage) {
-  return v === 'encrypt' || v === 'wrapKey'
-}
-
-export const PRIVATE_KEY_USAGE = [
-  'sign',
-  'decrypt',
-  'unwrapKey',
-  'deriveKey',
-  'deriveBits',
-] as const
-export const privateKeyUsageSchema = z.enum(PRIVATE_KEY_USAGE)
-export type PrivateKeyUsage = (typeof PRIVATE_KEY_USAGE)[number]
-export function isPrivateKeyUsage(usage: unknown): usage is PrivateKeyUsage {
-  return (PRIVATE_KEY_USAGE as readonly unknown[]).includes(usage)
-}
-
-export const KEY_USAGE = [...PRIVATE_KEY_USAGE, ...PUBLIC_KEY_USAGE] as const
-export const keyUsageSchema = z.enum(KEY_USAGE)
-export type KeyUsage = (typeof KEY_USAGE)[number]
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/rfc7517#section-4 JSON Web Key (JWK) Format}
- * @see {@link https://www.iana.org/assignments/jose/jose.xhtml#web-key-parameters IANA "JSON Web Key Parameters" registry}
- */
-const jwkBaseSchema = z.object({
-  kty: z.string().min(1),
-  alg: z.string().min(1).optional(),
-  kid: z.string().min(1).optional(),
-  use: z.enum(['sig', 'enc']).optional(),
-  key_ops: z
-    .array(keyUsageSchema)
-    .min(1, { message: 'At least one key usage must be specified' })
-    // https://datatracker.ietf.org/doc/html/rfc7517#section-4.3
-    // > Duplicate key operation values MUST NOT be present in the array.
-    .refine((ops) => ops.every(isLastOccurrence), {
-      message: 'key_ops must not contain duplicates',
-    })
-    .optional(),
-
-  x5c: z.array(z.string()).optional(), // X.509 Certificate Chain
-  x5t: z.string().min(1).optional(), // X.509 Certificate SHA-1 Thumbprint
-  'x5t#S256': z.string().min(1).optional(), // X.509 Certificate SHA-256 Thumbprint
-  x5u: z.string().url().optional(), // X.509 URL
-
-  // https://www.w3.org/TR/webcrypto/
-  ext: z.boolean().optional(), // Extractable
-
-  // Federation Historical Keys Response
-  // https://openid.net/specs/openid-federation-1_0.html#name-federation-historical-keys-res
-  iat: z.number().int().optional(), // Issued At (timestamp)
-  exp: z.number().int().optional(), // Expiration Time (timestamp)
-  nbf: z.number().int().optional(), // Not Before (timestamp)
-  revoked: z //  properties of the revocation
-    .object({
-      revoked_at: z.number().int(),
-      reason: z.string().optional(),
-    })
-    .optional(),
-})
-
-export type JwkBase = z.infer<typeof jwkBaseSchema>
-
-const jwkRsaKeySchema = jwkBaseSchema.extend({
-  kty: z.literal('RSA'),
-  alg: z
-    .enum(['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512'])
-    .optional(),
-
-  n: z.string().min(1), // Modulus
-  e: z.string().min(1), // Exponent
-
-  d: z.string().min(1).optional(), // Private Exponent
-  p: z.string().min(1).optional(), // First Prime Factor
-  q: z.string().min(1).optional(), // Second Prime Factor
-  dp: z.string().min(1).optional(), // First Factor CRT Exponent
-  dq: z.string().min(1).optional(), // Second Factor CRT Exponent
-  qi: z.string().min(1).optional(), // First CRT Coefficient
-  oth: z
-    .array(
-      z.object({
-        r: z.string().optional(),
-        d: z.string().optional(),
-        t: z.string().optional(),
-      }),
-    )
-    .min(1)
-    .optional(), // Other Primes Info
-})
-
-const jwkEcKeySchema = jwkBaseSchema.extend({
-  kty: z.literal('EC'),
-  alg: z.enum(['ES256', 'ES384', 'ES512']).optional(),
-  crv: z.enum(['P-256', 'P-384', 'P-521']),
-
-  x: z.string().min(1),
-  y: z.string().min(1),
-
-  d: z.string().min(1).optional(), // ECC Private Key
-})
-
-const jwkEcSecp256k1KeySchema = jwkBaseSchema.extend({
-  kty: z.literal('EC'),
-  alg: z.enum(['ES256K']).optional(),
-  crv: z.enum(['secp256k1']),
-
-  x: z.string().min(1),
-  y: z.string().min(1),
-
-  d: z.string().min(1).optional(), // ECC Private Key
-})
-
-const jwkOkpKeySchema = jwkBaseSchema.extend({
-  kty: z.literal('OKP'),
-  alg: z.enum(['EdDSA']).optional(),
-  crv: z.enum(['Ed25519', 'Ed448']),
-
-  x: z.string().min(1),
-  d: z.string().min(1).optional(), // ECC Private Key
-})
-
-const jwkSymKeySchema = jwkBaseSchema.extend({
-  kty: z.literal('oct'), // Octet Sequence (used to represent symmetric keys)
-  alg: z.enum(['HS256', 'HS384', 'HS512']).optional(),
-
-  k: z.string(), // Key Value (base64url encoded)
-})
-
-/**
- * Zod parser for known JWK types
- */
-export const jwkSchema = z
-  .union([
-    jwkRsaKeySchema,
-    jwkEcKeySchema,
-    jwkEcSecp256k1KeySchema,
-    jwkOkpKeySchema,
-    jwkSymKeySchema,
-  ])
-  // @TODO These rules should be applied to jwkBaseSchema, but Zod 3 doesn't
-  // support extending refined schemas. Move these to the base schema when we
-  // upgrade to Zod 4.
-  .refine(
-    // https://datatracker.ietf.org/doc/html/rfc7517#section-4.2
-    // > The "use" (public key use) parameter identifies the intended use of the
-    // > public key
-    (k): boolean => k.use == null || isPublicJwk(k),
-    {
-      message: '"use" can only be used with public keys',
-      path: ['use'],
-    },
-  )
-  .refine(
-    (k): boolean => !k.key_ops?.some(isPrivateKeyUsage) || isPrivateJwk(k),
-    {
-      message: 'private key usage not allowed for public keys',
-      path: ['key_ops'],
-    },
-  )
-  .refine(
-    // https://datatracker.ietf.org/doc/html/rfc7517#section-4.3
-    // > The "use" and "key_ops" JWK members SHOULD NOT be used together;
-    // > however, if both are used, the information they convey MUST be
-    // > consistent.
-    (k): boolean =>
-      k.use == null ||
-      k.key_ops == null ||
-      (k.use === 'sig' && k.key_ops.every(isSigKeyUsage)) ||
-      (k.use === 'enc' && k.key_ops.every(isEncKeyUsage)),
-    {
-      message: '"key_ops" must be consistent with "use"',
-      path: ['key_ops'],
-    },
-  )
-
-export type Jwk = z.output<typeof jwkSchema>
-
-/** @deprecated use {@link jwkSchema} instead */
-export const jwkValidator = jwkSchema
-
-export const jwkPubSchema = jwkSchema
-  .refine(hasKid, {
-    message: '"kid" is required',
-    path: ['kid'],
-  })
-  // @NOTE for legacy reasons, we don't impose the presence of either "use" or "key_ops"
-  .refine(isPublicJwk, {
-    message: 'private key not allowed',
-  })
-  .refine((k): boolean => !k.key_ops || k.key_ops.every(isPublicKeyUsage), {
-    message: '"key_ops" must not contain private key usage for public keys',
-    path: ['key_ops'],
-  })
-
-export type PublicJwk = z.output<typeof jwkPubSchema>
-
-export const jwkPrivateSchema = jwkSchema
-  // @NOTE we don't impose the presence of "kid"
-  .refine(isPrivateJwk, {
-    message: 'private key required',
-  })
-
-export type PrivateJwk = z.output<typeof jwkPrivateSchema>
-
-export function hasKid<J extends object>(
-  jwk: J,
-): jwk is J & { kid: NonNullable<unknown> } {
-  return 'kid' in jwk && jwk.kid != null
-}
-
-export function hasSharedSecretJwk<J extends object>(
-  jwk: J,
-): jwk is J & { k: NonNullable<unknown> } {
-  return 'k' in jwk && jwk.k != null
-}
-
-export function hasPrivateSecretJwk<J extends object>(
-  jwk: J,
-): jwk is J & { d: NonNullable<unknown> } {
-  return 'd' in jwk && jwk.d != null
-}
-
-export function isPrivateJwk<J extends object>(jwk: J) {
-  return hasPrivateSecretJwk(jwk) || hasSharedSecretJwk(jwk)
-}
-
-export function isPublicJwk<J extends object>(
-  jwk: J,
-): jwk is Extract<
-  Exclude<J, { k: NonNullable<unknown> }>,
-  { d?: NonNullable<unknown> }
-> & { d?: never } {
-  return !hasPrivateSecretJwk(jwk) && !hasSharedSecretJwk(jwk)
-}

package/src/jwks.ts

@@ -1,39 +0,0 @@
-import { z } from 'zod'
-import { jwkPubSchema, jwkSchema } from './jwk.js'
-
-/**
- * JSON Web Key Set schema. The keys set, in this context, represents a
- * collection of JSON Web Keys (JWKs), that can be both public and private.
- */
-export const jwksSchema = z.object({
-  keys: z.array(z.unknown()).transform((input) => {
-    // > Implementations SHOULD ignore JWKs within a JWK Set that use "kty"
-    // > (key type) values that are not understood by them, that are missing
-    // > required members, or for which values are out of the supported
-    // > ranges.
-    return input
-      .map((item) => jwkSchema.safeParse(item))
-      .filter((res) => res.success)
-      .map((res) => res.data)
-  }),
-})
-
-export type Jwks = z.output<typeof jwksSchema>
-
-/**
- * Public JSON Web Key Set schema.
- */
-export const jwksPubSchema = z.object({
-  keys: z.array(z.unknown()).transform((input) => {
-    // > Implementations SHOULD ignore JWKs within a JWK Set that use "kty"
-    // > (key type) values that are not understood by them, that are missing
-    // > required members, or for which values are out of the supported
-    // > ranges.
-    return input
-      .map((item) => jwkPubSchema.safeParse(item))
-      .filter((res) => res.success)
-      .map((res) => res.data)
-  }),
-})
-
-export type JwksPub = z.output<typeof jwksPubSchema>

package/src/jwt-decode.ts

@@ -1,27 +0,0 @@
-import { ERR_JWT_INVALID, JwtVerifyError } from './errors.js'
-import {
-  JwtHeader,
-  JwtPayload,
-  jwtHeaderSchema,
-  jwtPayloadSchema,
-} from './jwt.js'
-import { parseB64uJson } from './util.js'
-
-export function unsafeDecodeJwt(jwt: string): {
-  header: JwtHeader
-  payload: JwtPayload
-} {
-  const { 0: headerEnc, 1: payloadEnc, length } = jwt.split('.')
-  if (length > 3 || length < 2) {
-    throw new JwtVerifyError(undefined, ERR_JWT_INVALID)
-  }
-
-  const header = jwtHeaderSchema.parse(parseB64uJson(headerEnc!))
-  if (length === 2 && header?.alg !== 'none') {
-    throw new JwtVerifyError(undefined, ERR_JWT_INVALID)
-  }
-
-  const payload = jwtPayloadSchema.parse(parseB64uJson(payloadEnc!))
-
-  return { header, payload }
-}

package/src/jwt-verify.ts

@@ -1,20 +0,0 @@
-import { JwtHeader, JwtPayload } from './jwt.js'
-import { RequiredKey } from './util.js'
-
-export type VerifyOptions<C extends string = never> = {
-  audience?: string | readonly string[]
-  /** in seconds */
-  clockTolerance?: number
-  issuer?: string | readonly string[]
-  /** in seconds */
-  maxTokenAge?: number
-  subject?: string
-  typ?: string
-  currentDate?: Date
-  requiredClaims?: readonly C[]
-}
-
-export type VerifyResult<C extends string = never> = {
-  payload: RequiredKey<JwtPayload, C>
-  protectedHeader: JwtHeader
-}