@bajustone/fortress 1.0.0-rc.1

package/dist/jwt.cjs

@@ -0,0 +1,255 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/core/auth/jwt.ts
+var jwt_exports = {};
+__export(jwt_exports, {
+  RESERVED_JWT_CLAIMS: () => RESERVED_JWT_CLAIMS,
+  signAccessToken: () => signAccessToken,
+  stripReservedClaims: () => stripReservedClaims,
+  verifyAccessToken: () => verifyAccessToken
+});
+module.exports = __toCommonJS(jwt_exports);
+var import_jose = require("jose");
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/core/auth/jwt.ts
+var RESERVED_JWT_CLAIMS = /* @__PURE__ */ new Set([
+  "sub",
+  "iss",
+  "iat",
+  "exp",
+  "nbf",
+  "aud",
+  "jti",
+  "act",
+  "groups",
+  "subjectType",
+  "name"
+]);
+var REQUIRED_ACCESS_TOKEN_CLAIMS = ["sub", "subjectType", "name", "groups", "iss", "iat", "exp"];
+var SUBJECT_TYPES = ["USER", "GROUP", "SERVICE_ACCOUNT"];
+function stripReservedClaims(claims, context) {
+  if (!claims)
+    return {};
+  const out = {};
+  let stripped;
+  for (const [key, value] of Object.entries(claims)) {
+    if (RESERVED_JWT_CLAIMS.has(key)) {
+      (stripped ??= []).push(key);
+      continue;
+    }
+    out[key] = value;
+  }
+  if (stripped && typeof process !== "undefined" && process.env?.NODE_ENV !== "production") {
+    console.warn(`[fortress/jwt] dropping reserved claim(s) from ${context}: ${stripped.join(", ")}`);
+  }
+  return out;
+}
+function encodeSecret(secret) {
+  return new TextEncoder().encode(secret);
+}
+function normalizeKeys(key) {
+  const keys = Array.isArray(key) ? key : [key];
+  return keys.map(encodeSecret);
+}
+async function signAccessToken(claims, key, expiresInSeconds, options) {
+  const [signingKey] = normalizeKeys(key);
+  const safeCustom = stripReservedClaims(claims.customClaims, "signAccessToken.customClaims");
+  let jwt = new import_jose.SignJWT({
+    name: claims.name,
+    subjectType: claims.subjectType,
+    groups: claims.groups,
+    ...claims.act ? { act: claims.act } : {},
+    ...safeCustom
+  }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(`${expiresInSeconds}s`).setIssuer(claims.iss);
+  if (options?.audience !== void 0)
+    jwt = jwt.setAudience(options.audience);
+  return jwt.setSubject(claims.sub).sign(signingKey);
+}
+async function verifyAccessToken(token, key, options) {
+  const keys = normalizeKeys(key);
+  const requiredClaims = [.../* @__PURE__ */ new Set([...REQUIRED_ACCESS_TOKEN_CLAIMS, ...options?.requiredClaims ?? []])];
+  const verifyOptions = { algorithms: ["HS256"], requiredClaims };
+  if (options?.issuer)
+    verifyOptions.issuer = options.issuer;
+  if (options?.audience)
+    verifyOptions.audience = options.audience;
+  if (options?.clockTolerance !== void 0)
+    verifyOptions.clockTolerance = options.clockTolerance;
+  for (const candidate of keys) {
+    try {
+      const { payload } = await (0, import_jose.jwtVerify)(token, candidate, verifyOptions);
+      const subjectType = payload.subjectType;
+      const groups = payload.groups;
+      const name = payload.name;
+      const issuer = payload.iss;
+      const audience = payload.aud;
+      const issuedAt = payload.iat;
+      const expiresAt = payload.exp;
+      if (typeof payload.sub !== "string" || payload.sub.length === 0)
+        throw new Error("Invalid sub claim");
+      if (typeof subjectType !== "string" || !SUBJECT_TYPES.includes(subjectType))
+        throw new Error("Invalid subjectType claim");
+      if (typeof name !== "string")
+        throw new Error("Invalid name claim");
+      if (!Array.isArray(groups) || !groups.every((group) => typeof group === "string"))
+        throw new Error("Invalid groups claim");
+      if (typeof issuer !== "string" || issuer.length === 0)
+        throw new Error("Invalid iss claim");
+      if (audience !== void 0 && (!Array.isArray(audience) || !audience.every((value) => typeof value === "string")) && typeof audience !== "string")
+        throw new Error("Invalid aud claim");
+      if (typeof issuedAt !== "number")
+        throw new Error("Invalid iat claim");
+      if (typeof expiresAt !== "number")
+        throw new Error("Invalid exp claim");
+      return {
+        sub: payload.sub,
+        subjectType,
+        name,
+        groups,
+        iss: issuer,
+        ...audience !== void 0 ? { aud: audience } : {},
+        iat: issuedAt,
+        exp: expiresAt,
+        act: payload.act,
+        customClaims: Object.fromEntries(
+          Object.entries(payload).filter(([k]) => !RESERVED_JWT_CLAIMS.has(k))
+        )
+      };
+    } catch {
+      continue;
+    }
+  }
+  throw Errors.unauthorized("Invalid or expired token");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RESERVED_JWT_CLAIMS,
+  signAccessToken,
+  stripReservedClaims,
+  verifyAccessToken
+});

package/dist/jwt.d.cts

@@ -0,0 +1,90 @@
+import { T as TokenClaims } from './types-et0R8tsC.cjs';
+
+/**
+ * JWT signing and verification helpers built on `jose` (Web Crypto API).
+ *
+ * Provides {@link signAccessToken} and {@link verifyAccessToken} for short-lived
+ * access tokens. Refresh tokens are handled separately in
+ * `core/auth/refresh-token.ts`. Supports key rotation by accepting an array
+ * of keys — the first is used to sign, all are accepted on verify.
+ *
+ * @module
+ */
+
+/**
+ * Key material accepted by {@link signAccessToken} / {@link verifyAccessToken}.
+ *
+ * Today this is just an HS256 shared secret (string) or a rotation array of
+ * shared secrets. The alias exists so the public signature is stable when we
+ * expand to asymmetric algorithms (RS256 / EdDSA) and JWKS-backed verification.
+ *
+ * Expected expansion:
+ *
+ * ```ts
+ * import type { CryptoKey, JWK, JWTVerifyGetKey, KeyObject } from 'jose';
+ *
+ * export type JwtStaticKey =
+ *   | string        // HS* shared secret (utf-8)
+ *   | Uint8Array    // HS* shared secret (raw bytes)
+ *   | CryptoKey     // Web Crypto key (any alg)
+ *   | KeyObject     // Node KeyObject (any alg)
+ *   | JWK;          // JSON Web Key
+ *
+ * export type JwtKeyMaterial = JwtStaticKey | readonly JwtStaticKey[];
+ *
+ * // Verification additionally accepts a resolver (e.g. createRemoteJWKSet):
+ * export type JwtVerifyKeyMaterial = JwtKeyMaterial | JWTVerifyGetKey;
+ * ```
+ *
+ * Until then, the runtime helpers ({@link normalizeKeys}) only know how to
+ * encode strings — widening the type without widening the helpers would be a
+ * lie, so do both together.
+ */
+type JwtKeyMaterial = string | string[];
+/**
+ * JWT claim names fortress controls and that must never be overridable by
+ * caller-supplied `customClaims` or by plugin `enrichTokenClaims` output.
+ *
+ * Letting a caller set `act` would forge an impersonation marker; letting a
+ * caller set `sub`/`iss`/`exp` would let them mint a token for any subject
+ * or extend its lifetime. The denylist is enforced in {@link signAccessToken}
+ * — extra claims are dropped (with a `warn` log in dev) before the safe
+ * claims are spread.
+ */
+declare const RESERVED_JWT_CLAIMS: ReadonlySet<string>;
+interface SignAccessTokenOptions {
+    /** Audience to include in the JWT `aud` claim. Omitted when unset. */
+    audience?: string | string[];
+}
+interface VerifyAccessTokenOptions {
+    /** Expected issuer. When set, jose also requires the `iss` claim to be present. */
+    issuer?: string | string[];
+    /** Expected audience. When set, jose also requires the `aud` claim to be present. */
+    audience?: string | string[];
+    /** Clock skew tolerance for `nbf`, `exp`, and max-token-age checks. */
+    clockTolerance?: string | number;
+    /** Additional claim names that must be present alongside Fortress's required access-token claims. */
+    requiredClaims?: string[];
+}
+/**
+ * Strip any reserved keys from a custom-claims object. In development we
+ * log a warning so library users notice the collision; in production we
+ * silently drop (the safe default — a misbehaving plugin shouldn't be able
+ * to break token issuance).
+ */
+declare function stripReservedClaims(claims: Record<string, unknown> | undefined, context: string): Record<string, unknown>;
+/**
+ * Sign a JWT access token.
+ */
+declare function signAccessToken(claims: Omit<TokenClaims, 'iat' | 'exp' | 'aud'>, key: JwtKeyMaterial, expiresInSeconds: number, options?: SignAccessTokenOptions): Promise<string>;
+/**
+ * Verify a JWT access token. Tries each key in order for rotation support.
+ *
+ * Pins `alg: HS256` and (when supplied) the expected `issuer`. jose already
+ * rejects `alg: none` by default; the explicit allowlist is defense in
+ * depth against future jose behavioural drift and against confused-deputy
+ * attacks if anyone later adds asymmetric key support.
+ */
+declare function verifyAccessToken(token: string, key: JwtKeyMaterial, options?: VerifyAccessTokenOptions): Promise<TokenClaims>;
+
+export { type JwtKeyMaterial, RESERVED_JWT_CLAIMS, type SignAccessTokenOptions, type VerifyAccessTokenOptions, signAccessToken, stripReservedClaims, verifyAccessToken };

package/dist/jwt.d.ts

@@ -0,0 +1,90 @@
+import { T as TokenClaims } from './types-et0R8tsC.js';
+
+/**
+ * JWT signing and verification helpers built on `jose` (Web Crypto API).
+ *
+ * Provides {@link signAccessToken} and {@link verifyAccessToken} for short-lived
+ * access tokens. Refresh tokens are handled separately in
+ * `core/auth/refresh-token.ts`. Supports key rotation by accepting an array
+ * of keys — the first is used to sign, all are accepted on verify.
+ *
+ * @module
+ */
+
+/**
+ * Key material accepted by {@link signAccessToken} / {@link verifyAccessToken}.
+ *
+ * Today this is just an HS256 shared secret (string) or a rotation array of
+ * shared secrets. The alias exists so the public signature is stable when we
+ * expand to asymmetric algorithms (RS256 / EdDSA) and JWKS-backed verification.
+ *
+ * Expected expansion:
+ *
+ * ```ts
+ * import type { CryptoKey, JWK, JWTVerifyGetKey, KeyObject } from 'jose';
+ *
+ * export type JwtStaticKey =
+ *   | string        // HS* shared secret (utf-8)
+ *   | Uint8Array    // HS* shared secret (raw bytes)
+ *   | CryptoKey     // Web Crypto key (any alg)
+ *   | KeyObject     // Node KeyObject (any alg)
+ *   | JWK;          // JSON Web Key
+ *
+ * export type JwtKeyMaterial = JwtStaticKey | readonly JwtStaticKey[];
+ *
+ * // Verification additionally accepts a resolver (e.g. createRemoteJWKSet):
+ * export type JwtVerifyKeyMaterial = JwtKeyMaterial | JWTVerifyGetKey;
+ * ```
+ *
+ * Until then, the runtime helpers ({@link normalizeKeys}) only know how to
+ * encode strings — widening the type without widening the helpers would be a
+ * lie, so do both together.
+ */
+type JwtKeyMaterial = string | string[];
+/**
+ * JWT claim names fortress controls and that must never be overridable by
+ * caller-supplied `customClaims` or by plugin `enrichTokenClaims` output.
+ *
+ * Letting a caller set `act` would forge an impersonation marker; letting a
+ * caller set `sub`/`iss`/`exp` would let them mint a token for any subject
+ * or extend its lifetime. The denylist is enforced in {@link signAccessToken}
+ * — extra claims are dropped (with a `warn` log in dev) before the safe
+ * claims are spread.
+ */
+declare const RESERVED_JWT_CLAIMS: ReadonlySet<string>;
+interface SignAccessTokenOptions {
+    /** Audience to include in the JWT `aud` claim. Omitted when unset. */
+    audience?: string | string[];
+}
+interface VerifyAccessTokenOptions {
+    /** Expected issuer. When set, jose also requires the `iss` claim to be present. */
+    issuer?: string | string[];
+    /** Expected audience. When set, jose also requires the `aud` claim to be present. */
+    audience?: string | string[];
+    /** Clock skew tolerance for `nbf`, `exp`, and max-token-age checks. */
+    clockTolerance?: string | number;
+    /** Additional claim names that must be present alongside Fortress's required access-token claims. */
+    requiredClaims?: string[];
+}
+/**
+ * Strip any reserved keys from a custom-claims object. In development we
+ * log a warning so library users notice the collision; in production we
+ * silently drop (the safe default — a misbehaving plugin shouldn't be able
+ * to break token issuance).
+ */
+declare function stripReservedClaims(claims: Record<string, unknown> | undefined, context: string): Record<string, unknown>;
+/**
+ * Sign a JWT access token.
+ */
+declare function signAccessToken(claims: Omit<TokenClaims, 'iat' | 'exp' | 'aud'>, key: JwtKeyMaterial, expiresInSeconds: number, options?: SignAccessTokenOptions): Promise<string>;
+/**
+ * Verify a JWT access token. Tries each key in order for rotation support.
+ *
+ * Pins `alg: HS256` and (when supplied) the expected `issuer`. jose already
+ * rejects `alg: none` by default; the explicit allowlist is defense in
+ * depth against future jose behavioural drift and against confused-deputy
+ * attacks if anyone later adds asymmetric key support.
+ */
+declare function verifyAccessToken(token: string, key: JwtKeyMaterial, options?: VerifyAccessTokenOptions): Promise<TokenClaims>;
+
+export { type JwtKeyMaterial, RESERVED_JWT_CLAIMS, type SignAccessTokenOptions, type VerifyAccessTokenOptions, signAccessToken, stripReservedClaims, verifyAccessToken };

package/dist/jwt.js

@@ -0,0 +1,227 @@
+// src/core/auth/jwt.ts
+import { jwtVerify, SignJWT } from "jose";
+
+// src/core/errors.ts
+var FortressError = class extends Error {
+  code;
+  statusCode;
+  retryAfter;
+  details;
+  /** RFC 6749 §5.2 / §4.1.2.1 machine code. Set by `Errors.oauth()`. */
+  oauthError;
+  /** Human-readable description for the OAuth `error_description` field. */
+  oauthDescription;
+  /** Optional URI for the OAuth `error_uri` field (§5.2). */
+  oauthErrorUri;
+  constructor(code, message, statusCode, options) {
+    super(message, { cause: options?.cause });
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryAfter = options?.retryAfter;
+    this.details = options?.details;
+    this.oauthError = options?.oauthError;
+    this.oauthDescription = options?.oauthDescription;
+    this.oauthErrorUri = options?.oauthErrorUri;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      statusCode: this.statusCode,
+      ...this.details !== void 0 && { details: this.details }
+    };
+  }
+};
+var Errors = {
+  unauthorized: (message = "Unauthorized") => new FortressError("UNAUTHORIZED", message, 401),
+  tokenReuse: () => new FortressError("TOKEN_REUSE", "Token reuse detected", 401),
+  sessionIdleTimeout: () => new FortressError("SESSION_IDLE_TIMEOUT", "Session idle timeout exceeded", 401),
+  sessionAbsoluteTimeout: () => new FortressError("SESSION_ABSOLUTE_TIMEOUT", "Session absolute timeout exceeded", 401),
+  forbidden: (message = "Forbidden") => new FortressError("FORBIDDEN", message, 403),
+  badRequest: (message = "Bad request") => new FortressError("BAD_REQUEST", message, 400),
+  notFound: (message = "Not found") => new FortressError("NOT_FOUND", message, 404),
+  conflict: (message = "Conflict", options) => new FortressError("CONFLICT", message, 409, options),
+  unprocessable: (message = "Unprocessable entity", options) => new FortressError("UNPROCESSABLE_ENTITY", message, 422, options),
+  rateLimited: (retryAfter) => new FortressError("RATE_LIMITED", "Too many requests", 429, { retryAfter }),
+  database: (message = "Database error", cause) => new FortressError("DATABASE_ERROR", message, 500, { cause }),
+  serviceUnavailable: (message = "Service unavailable", options) => new FortressError("SERVICE_UNAVAILABLE", message, 503, options),
+  validationError: (issues) => new FortressError("VALIDATION_ERROR", "Validation failed", 422, { details: issues }),
+  /**
+   * RFC 6749 §5.2 / §4.1.2.1 OAuth error.
+   *
+   * The HTTP error mapper detects `oauthError` and emits the OAuth-spec
+   * JSON body `{ error, error_description, error_uri? }` instead of the
+   * default fortress `{ code, message }` shape, so strict OAuth clients
+   * (Moodle, openid-client, Spring Security, etc.) can switch behaviour
+   * on the machine-readable `error` field.
+   *
+   * Status is inferred from the OAuth code per the spec table:
+   * - `invalid_client` → 401
+   * - everything else → 400
+   */
+  oauth: (error, description, options) => {
+    const status = options?.status ?? (error === "invalid_client" ? 401 : 400);
+    const code = status === 401 ? "UNAUTHORIZED" : "BAD_REQUEST";
+    return new FortressError(code, description ?? error, status, {
+      oauthError: error,
+      oauthDescription: description,
+      oauthErrorUri: options?.errorUri,
+      cause: options?.cause
+    });
+  },
+  /**
+   * Reconstruct a {@link FortressError} from a JSON error body emitted by
+   * `errorToResponse`. Used by the in-process `fortress.call.*` client to
+   * convert non-2xx responses into typed throws that mirror what a direct
+   * service-method call would produce.
+   *
+   * Maps by HTTP status when the body doesn't carry a recognizable
+   * `{ code, message }` payload, so network errors and opaque upstream
+   * failures still become structured `FortressError`s.
+   */
+  fromHttpResponse: (status, body) => {
+    const payload = body && typeof body === "object" ? body : {};
+    const message = typeof payload.message === "string" ? payload.message : `HTTP ${status}`;
+    const code = typeof payload.code === "string" && isFortressErrorCode(payload.code) ? payload.code : statusToErrorCode(status);
+    return new FortressError(code, message, status, { details: payload.details });
+  }
+};
+function isFortressErrorCode(code) {
+  return code === "UNAUTHORIZED" || code === "TOKEN_REUSE" || code === "SESSION_IDLE_TIMEOUT" || code === "SESSION_ABSOLUTE_TIMEOUT" || code === "FORBIDDEN" || code === "BAD_REQUEST" || code === "NOT_FOUND" || code === "CONFLICT" || code === "UNPROCESSABLE_ENTITY" || code === "RATE_LIMITED" || code === "DATABASE_ERROR" || code === "VALIDATION_ERROR" || code === "SERVICE_UNAVAILABLE";
+}
+function statusToErrorCode(status) {
+  if (status === 401)
+    return "UNAUTHORIZED";
+  if (status === 403)
+    return "FORBIDDEN";
+  if (status === 404)
+    return "NOT_FOUND";
+  if (status === 409)
+    return "CONFLICT";
+  if (status === 422)
+    return "UNPROCESSABLE_ENTITY";
+  if (status === 429)
+    return "RATE_LIMITED";
+  if (status === 503)
+    return "SERVICE_UNAVAILABLE";
+  if (status >= 500)
+    return "DATABASE_ERROR";
+  return "BAD_REQUEST";
+}
+
+// src/core/auth/jwt.ts
+var RESERVED_JWT_CLAIMS = /* @__PURE__ */ new Set([
+  "sub",
+  "iss",
+  "iat",
+  "exp",
+  "nbf",
+  "aud",
+  "jti",
+  "act",
+  "groups",
+  "subjectType",
+  "name"
+]);
+var REQUIRED_ACCESS_TOKEN_CLAIMS = ["sub", "subjectType", "name", "groups", "iss", "iat", "exp"];
+var SUBJECT_TYPES = ["USER", "GROUP", "SERVICE_ACCOUNT"];
+function stripReservedClaims(claims, context) {
+  if (!claims)
+    return {};
+  const out = {};
+  let stripped;
+  for (const [key, value] of Object.entries(claims)) {
+    if (RESERVED_JWT_CLAIMS.has(key)) {
+      (stripped ??= []).push(key);
+      continue;
+    }
+    out[key] = value;
+  }
+  if (stripped && typeof process !== "undefined" && process.env?.NODE_ENV !== "production") {
+    console.warn(`[fortress/jwt] dropping reserved claim(s) from ${context}: ${stripped.join(", ")}`);
+  }
+  return out;
+}
+function encodeSecret(secret) {
+  return new TextEncoder().encode(secret);
+}
+function normalizeKeys(key) {
+  const keys = Array.isArray(key) ? key : [key];
+  return keys.map(encodeSecret);
+}
+async function signAccessToken(claims, key, expiresInSeconds, options) {
+  const [signingKey] = normalizeKeys(key);
+  const safeCustom = stripReservedClaims(claims.customClaims, "signAccessToken.customClaims");
+  let jwt = new SignJWT({
+    name: claims.name,
+    subjectType: claims.subjectType,
+    groups: claims.groups,
+    ...claims.act ? { act: claims.act } : {},
+    ...safeCustom
+  }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(`${expiresInSeconds}s`).setIssuer(claims.iss);
+  if (options?.audience !== void 0)
+    jwt = jwt.setAudience(options.audience);
+  return jwt.setSubject(claims.sub).sign(signingKey);
+}
+async function verifyAccessToken(token, key, options) {
+  const keys = normalizeKeys(key);
+  const requiredClaims = [.../* @__PURE__ */ new Set([...REQUIRED_ACCESS_TOKEN_CLAIMS, ...options?.requiredClaims ?? []])];
+  const verifyOptions = { algorithms: ["HS256"], requiredClaims };
+  if (options?.issuer)
+    verifyOptions.issuer = options.issuer;
+  if (options?.audience)
+    verifyOptions.audience = options.audience;
+  if (options?.clockTolerance !== void 0)
+    verifyOptions.clockTolerance = options.clockTolerance;
+  for (const candidate of keys) {
+    try {
+      const { payload } = await jwtVerify(token, candidate, verifyOptions);
+      const subjectType = payload.subjectType;
+      const groups = payload.groups;
+      const name = payload.name;
+      const issuer = payload.iss;
+      const audience = payload.aud;
+      const issuedAt = payload.iat;
+      const expiresAt = payload.exp;
+      if (typeof payload.sub !== "string" || payload.sub.length === 0)
+        throw new Error("Invalid sub claim");
+      if (typeof subjectType !== "string" || !SUBJECT_TYPES.includes(subjectType))
+        throw new Error("Invalid subjectType claim");
+      if (typeof name !== "string")
+        throw new Error("Invalid name claim");
+      if (!Array.isArray(groups) || !groups.every((group) => typeof group === "string"))
+        throw new Error("Invalid groups claim");
+      if (typeof issuer !== "string" || issuer.length === 0)
+        throw new Error("Invalid iss claim");
+      if (audience !== void 0 && (!Array.isArray(audience) || !audience.every((value) => typeof value === "string")) && typeof audience !== "string")
+        throw new Error("Invalid aud claim");
+      if (typeof issuedAt !== "number")
+        throw new Error("Invalid iat claim");
+      if (typeof expiresAt !== "number")
+        throw new Error("Invalid exp claim");
+      return {
+        sub: payload.sub,
+        subjectType,
+        name,
+        groups,
+        iss: issuer,
+        ...audience !== void 0 ? { aud: audience } : {},
+        iat: issuedAt,
+        exp: expiresAt,
+        act: payload.act,
+        customClaims: Object.fromEntries(
+          Object.entries(payload).filter(([k]) => !RESERVED_JWT_CLAIMS.has(k))
+        )
+      };
+    } catch {
+      continue;
+    }
+  }
+  throw Errors.unauthorized("Invalid or expired token");
+}
+export {
+  RESERVED_JWT_CLAIMS,
+  signAccessToken,
+  stripReservedClaims,
+  verifyAccessToken
+};