@c9up/transit 0.1.0

package/dist/dsig.js

@@ -0,0 +1,273 @@
+/**
+ * XML Signature verification.
+ *
+ * The danger in XML-DSig is not the cryptography — it is that a signature can
+ * be perfectly valid over one part of a document while the application reads
+ * another. That is XML Signature Wrapping, and it has broken SAML
+ * implementations repeatedly. The mitigation is structural, not a check:
+ *
+ *   **This returns the element the signature actually covers, and the caller
+ *   must read that object. Never search the document again afterwards.**
+ *
+ * Everything else here exists to make that guarantee hold:
+ *
+ *   - Exactly one reference. Several is not a shape a signed assertion needs,
+ *     and it multiplies what "the signed element" could mean.
+ *   - The reference must resolve to exactly ONE element. A second element
+ *     carrying the same ID is the classic wrapping payload.
+ *   - The signature must sit inside the element it signs. A signature that
+ *     references a sibling is describing a document this refuses to reason
+ *     about.
+ *   - Only the enveloped-signature and exclusive-c14n transforms are accepted.
+ *     XPath and XSLT transforms are a way to make the digest cover something
+ *     other than the element, and XSLT is executable.
+ *   - SHA-1 is refused. Collisions against it are practical, and a signature
+ *     over attacker-influenced XML is exactly where that matters.
+ *   - The key comes from the caller, from the provider's metadata. The
+ *     certificate embedded in the document is checked against it, never
+ *     trusted on its own: verifying a document against a key it carries is
+ *     verifying it against itself.
+ */
+import { createHash, verify as verifySignature, X509Certificate, } from "node:crypto";
+import { canonicalize } from "./c14n.js";
+import { childrenNamed, textOf, walk, } from "./xml.js";
+export const DSIG_NS = "http://www.w3.org/2000/09/xmldsig#";
+const EXC_C14N = "http://www.w3.org/2001/10/xml-exc-c14n#";
+const EXC_C14N_COMMENTS = "http://www.w3.org/2001/10/xml-exc-c14n#WithComments";
+const ENVELOPED = "http://www.w3.org/2000/09/xmldsig#enveloped-signature";
+const EC_NS = "http://www.w3.org/2001/10/xml-exc-c14n#";
+/** Digest algorithms, by their URI. SHA-1 is absent on purpose. */
+const DIGESTS = {
+    "http://www.w3.org/2001/04/xmlenc#sha256": "sha256",
+    "http://www.w3.org/2001/04/xmldsig-more#sha384": "sha384",
+    "http://www.w3.org/2001/04/xmlenc#sha512": "sha512",
+};
+/** Signature algorithms, by their URI. SHA-1 is absent on purpose. */
+const SIGNATURES = {
+    "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256": {
+        hash: "sha256",
+        kind: "rsa",
+    },
+    "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384": {
+        hash: "sha384",
+        kind: "rsa",
+    },
+    "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512": {
+        hash: "sha512",
+        kind: "rsa",
+    },
+    "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256": {
+        hash: "sha256",
+        kind: "ec",
+    },
+    "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384": {
+        hash: "sha384",
+        kind: "ec",
+    },
+    "http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512": {
+        hash: "sha512",
+        kind: "ec",
+    },
+};
+export class SignatureError extends Error {
+    constructor(message) {
+        super(`[transit] ${message}`);
+        this.name = "SignatureError";
+    }
+}
+/**
+ * Verify one signature under `root`, and answer with the element it covers.
+ *
+ * Read the returned element. Reading anything found by searching the document
+ * afterwards throws the guarantee away.
+ */
+export function verifyXmlSignature(root, options) {
+    const signatures = [...walk(root)].filter((element) => element.namespaceUri === DSIG_NS && element.local === "Signature");
+    if (signatures.length === 0) {
+        throw new SignatureError("the document carries no signature");
+    }
+    if (signatures.length > 1) {
+        // Which one covers what a reader will use is exactly the ambiguity
+        // wrapping attacks live in.
+        throw new SignatureError(`the document carries ${signatures.length} signatures, and this verifies documents with one`);
+    }
+    const signature = signatures[0];
+    const signedInfo = only(signature, "SignedInfo");
+    const method = only(signedInfo, "SignatureMethod").attributes.find((a) => a.local === "Algorithm")?.value;
+    const spec = method === undefined ? undefined : SIGNATURES[method];
+    if (spec === undefined) {
+        throw new SignatureError(`the signature uses '${method ?? "no algorithm"}', which this refuses. SHA-1 and the symmetric methods are not accepted.`);
+    }
+    const canonicalizationMethod = only(signedInfo, "CanonicalizationMethod").attributes.find((a) => a.local === "Algorithm")?.value;
+    if (canonicalizationMethod !== EXC_C14N &&
+        canonicalizationMethod !== EXC_C14N_COMMENTS) {
+        throw new SignatureError(`SignedInfo is canonicalized with '${canonicalizationMethod ?? "nothing"}', and this verifies exclusive canonicalization`);
+    }
+    // The signature is over SignedInfo, canonicalized. Everything the reference
+    // claims is only trustworthy once this holds.
+    const signedBytes = Buffer.from(canonicalize(signedInfo, {
+        withComments: canonicalizationMethod === EXC_C14N_COMMENTS,
+    }), "utf8");
+    const signatureValue = Buffer.from(textOf(only(signature, "SignatureValue")).replace(/\s+/g, ""), "base64");
+    const key = resolveKey(signature, options.certificates);
+    const holds = verifySignature(spec.hash, signedBytes, spec.kind === "ec" ? { key, dsaEncoding: "ieee-p1363" } : key, signatureValue);
+    if (!holds) {
+        throw new SignatureError("the signature does not verify");
+    }
+    return verifyReference(root, signature, signedInfo);
+}
+/**
+ * Check the digest, and answer with the element it was computed over.
+ *
+ * The element is resolved once, here, and handed back. That is the whole
+ * defence: a caller that uses this object cannot be reading a different part of
+ * the document than the one the signature covers.
+ */
+function verifyReference(root, signature, signedInfo) {
+    const references = childrenNamed(signedInfo, DSIG_NS, "Reference");
+    if (references.length !== 1) {
+        throw new SignatureError(`SignedInfo carries ${references.length} references, and this verifies one`);
+    }
+    const reference = references[0];
+    const uri = reference.attributes.find((a) => a.local === "URI")?.value;
+    if (uri === undefined || !uri.startsWith("#") || uri.length < 2) {
+        throw new SignatureError(`the reference points at '${uri ?? "nothing"}', and this verifies a same-document '#id' reference`);
+    }
+    const id = uri.slice(1);
+    const matches = [...walk(root)].filter((element) => element.attributes.some((a) => a.namespaceUri === "" && isIdAttribute(a.local) && a.value === id));
+    if (matches.length === 0) {
+        throw new SignatureError(`the reference names '${id}', which is not in the document`);
+    }
+    if (matches.length > 1) {
+        // A second element carrying the signed element's ID is the classic
+        // wrapping payload: the signature stays valid, and a reader that looks
+        // the ID up finds the attacker's copy.
+        throw new SignatureError(`${matches.length} elements carry the id '${id}', which is how a signature gets pointed at the wrong one`);
+    }
+    const signed = matches[0];
+    if (!contains(signed, signature)) {
+        throw new SignatureError("the signature sits outside the element it references, which this refuses to reason about");
+    }
+    const { inclusivePrefixes, withComments } = readTransforms(reference, signature);
+    const digestMethod = only(reference, "DigestMethod").attributes.find((a) => a.local === "Algorithm")?.value;
+    const hash = digestMethod === undefined ? undefined : DIGESTS[digestMethod];
+    if (hash === undefined) {
+        throw new SignatureError(`the digest uses '${digestMethod ?? "no algorithm"}', which this refuses. SHA-1 is not accepted.`);
+    }
+    // The enveloped-signature transform: the element cannot carry a digest of
+    // itself, so the signature is left out of what is hashed.
+    const omit = new Set([signature]);
+    const digest = createHash(hash)
+        .update(canonicalize(signed, { inclusivePrefixes, withComments, omit }), "utf8")
+        .digest("base64");
+    const expected = textOf(only(reference, "DigestValue")).replace(/\s+/g, "");
+    if (digest !== expected) {
+        throw new SignatureError("the signed element does not match its digest — it was changed after signing");
+    }
+    return signed;
+}
+/** Which transforms the reference asks for, refusing the dangerous ones. */
+function readTransforms(reference, signature) {
+    const container = childrenNamed(reference, DSIG_NS, "Transforms")[0];
+    const transforms = container
+        ? childrenNamed(container, DSIG_NS, "Transform")
+        : [];
+    let sawEnveloped = false;
+    let inclusivePrefixes = [];
+    let withComments = false;
+    for (const transform of transforms) {
+        const algorithm = transform.attributes.find((a) => a.local === "Algorithm")?.value;
+        if (algorithm === ENVELOPED) {
+            sawEnveloped = true;
+            continue;
+        }
+        if (algorithm === EXC_C14N || algorithm === EXC_C14N_COMMENTS) {
+            withComments = algorithm === EXC_C14N_COMMENTS;
+            const list = childrenNamed(transform, EC_NS, "InclusiveNamespaces")[0];
+            const prefixes = list?.attributes.find((a) => a.local === "PrefixList")?.value;
+            if (prefixes) {
+                inclusivePrefixes = prefixes.split(/\s+/).filter(Boolean);
+            }
+            continue;
+        }
+        // XPath and XSLT can make the digest cover something other than the
+        // element, and one of them is executable.
+        throw new SignatureError(`the reference asks for the transform '${algorithm ?? "(none)"}', which this refuses`);
+    }
+    if (!sawEnveloped && contains(signature.parent ?? signature, signature)) {
+        // A signature inside the element it signs has to be excluded from the
+        // digest, and the transform is how that is declared.
+        throw new SignatureError("the signature is inside the element it signs and does not declare the enveloped-signature transform");
+    }
+    return { inclusivePrefixes, withComments };
+}
+/**
+ * The key to verify with — the caller's, from the provider's metadata.
+ *
+ * When the document carries a certificate it must be one of them. That check
+ * gives a clear error instead of an opaque "does not verify" when a provider
+ * has rotated and the metadata has not been updated.
+ */
+function resolveKey(signature, certificates) {
+    if (certificates.length === 0) {
+        throw new SignatureError("no certificate was supplied — the key has to come from the provider's metadata, never from the document itself");
+    }
+    const known = certificates.map(toCertificate);
+    const embedded = embeddedCertificate(signature);
+    if (embedded !== undefined) {
+        const match = known.find((cert) => cert.raw.equals(embedded.raw));
+        if (!match) {
+            throw new SignatureError("the document is signed with a certificate the provider's metadata does not list");
+        }
+        return match.publicKey;
+    }
+    // No certificate in the document: the metadata is all there is, which is
+    // the safer of the two cases.
+    return known[0].publicKey;
+}
+function embeddedCertificate(signature) {
+    for (const element of walk(signature)) {
+        if (element.namespaceUri === DSIG_NS &&
+            element.local === "X509Certificate") {
+            return toCertificate(textOf(element));
+        }
+    }
+    return undefined;
+}
+function toCertificate(value) {
+    const trimmed = value.trim();
+    const pem = trimmed.includes("BEGIN CERTIFICATE")
+        ? trimmed
+        : `-----BEGIN CERTIFICATE-----\n${trimmed.replace(/\s+/g, "").replace(/(.{64})/g, "$1\n")}\n-----END CERTIFICATE-----`;
+    try {
+        return new X509Certificate(pem);
+    }
+    catch {
+        throw new SignatureError("a certificate could not be read");
+    }
+}
+/** Exactly one child named `local`, or a clear refusal. */
+function only(parent, local) {
+    const found = childrenNamed(parent, DSIG_NS, local);
+    if (found.length !== 1) {
+        throw new SignatureError(`expected one <${local}> under <${parent.local}>, and there are ${found.length}`);
+    }
+    return found[0];
+}
+/** Whether `descendant` sits inside `ancestor`, or is it. */
+function contains(ancestor, descendant) {
+    for (let node = descendant; node !== undefined; node = node.parent) {
+        if (node === ancestor)
+            return true;
+    }
+    return false;
+}
+/**
+ * SAML identifies signed elements with `ID`; other dialects use `Id` or `id`.
+ * All three are accepted, and a document mixing them is what the
+ * duplicate check above catches.
+ */
+function isIdAttribute(local) {
+    return local === "ID" || local === "Id" || local === "id";
+}
+//# sourceMappingURL=dsig.js.map

package/dist/dsig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsig.js","sourceRoot":"","sources":["../src/dsig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACN,UAAU,EAEV,MAAM,IAAI,eAAe,EACzB,eAAe,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EACN,aAAa,EACb,MAAM,EACN,IAAI,GAGJ,MAAM,UAAU,CAAC;AAElB,MAAM,CAAC,MAAM,OAAO,GAAG,oCAAoC,CAAC;AAC5D,MAAM,QAAQ,GAAG,yCAAyC,CAAC;AAC3D,MAAM,iBAAiB,GAAG,qDAAqD,CAAC;AAChF,MAAM,SAAS,GAAG,uDAAuD,CAAC;AAC1E,MAAM,KAAK,GAAG,yCAAyC,CAAC;AAExD,mEAAmE;AACnE,MAAM,OAAO,GAA2B;IACvC,yCAAyC,EAAE,QAAQ;IACnD,+CAA+C,EAAE,QAAQ;IACzD,yCAAyC,EAAE,QAAQ;CACnD,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,GAAyD;IACxE,mDAAmD,EAAE;QACpD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,KAAK;KACX;IACD,mDAAmD,EAAE;QACpD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,KAAK;KACX;IACD,mDAAmD,EAAE;QACpD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,KAAK;KACX;IACD,qDAAqD,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI;KACV;IACD,qDAAqD,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI;KACV;IACD,qDAAqD,EAAE;QACtD,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,IAAI;KACV;CACD,CAAC;AAEF,MAAM,OAAO,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAe;QAC1B,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC9B,CAAC;CACD;AAWD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,IAAgB,EAChB,OAAsB;IAEtB,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CACxC,CAAC,OAAO,EAAE,EAAE,CACX,OAAO,CAAC,YAAY,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,CAClE,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CAAC,mCAAmC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,mEAAmE;QACnE,4BAA4B;QAC5B,MAAM,IAAI,cAAc,CACvB,wBAAwB,UAAU,CAAC,MAAM,mDAAmD,CAC5F,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAe,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,UAAU,CAAC,IAAI,CACjE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAC9B,EAAE,KAAK,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACvB,uBAAuB,MAAM,IAAI,cAAc,0EAA0E,CACzH,CAAC;IACH,CAAC;IAED,MAAM,sBAAsB,GAAG,IAAI,CAClC,UAAU,EACV,wBAAwB,CACxB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,EAAE,KAAK,CAAC;IACzD,IACC,sBAAsB,KAAK,QAAQ;QACnC,sBAAsB,KAAK,iBAAiB,EAC3C,CAAC;QACF,MAAM,IAAI,cAAc,CACvB,qCAAqC,sBAAsB,IAAI,SAAS,iDAAiD,CACzH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC9B,YAAY,CAAC,UAAU,EAAE;QACxB,YAAY,EAAE,sBAAsB,KAAK,iBAAiB;KAC1D,CAAC,EACF,MAAM,CACN,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CACjC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAC7D,QAAQ,CACR,CAAC;IAEF,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,eAAe,CAC5B,IAAI,CAAC,IAAI,EACT,WAAW,EACX,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,GAAG,EAC7D,cAAc,CACd,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,cAAc,CAAC,+BAA+B,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CACvB,IAAgB,EAChB,SAAqB,EACrB,UAAsB;IAEtB,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACnE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CACvB,sBAAsB,UAAU,CAAC,MAAM,oCAAoC,CAC3E,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAe,CAAC;IAE9C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC;IACvE,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,cAAc,CACvB,4BAA4B,GAAG,IAAI,SAAS,sDAAsD,CAClG,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAExB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAClD,OAAO,CAAC,UAAU,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,EAAE,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,CACxE,CACD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,cAAc,CACvB,wBAAwB,EAAE,iCAAiC,CAC3D,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,mEAAmE;QACnE,uEAAuE;QACvE,uCAAuC;QACvC,MAAM,IAAI,cAAc,CACvB,GAAG,OAAO,CAAC,MAAM,2BAA2B,EAAE,2DAA2D,CACzG,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAe,CAAC;IAExC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,cAAc,CACvB,0FAA0F,CAC1F,CAAC;IACH,CAAC;IAED,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,cAAc,CACzD,SAAS,EACT,SAAS,CACT,CAAC;IAEF,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,UAAU,CAAC,IAAI,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAC9B,EAAE,KAAK,CAAC;IACT,MAAM,IAAI,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACvB,oBAAoB,YAAY,IAAI,cAAc,+CAA+C,CACjG,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,0DAA0D;IAC1D,MAAM,IAAI,GAAyB,IAAI,GAAG,CAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC;SAC7B,MAAM,CACN,YAAY,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAC/D,MAAM,CACN;SACA,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEnB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,cAAc,CACvB,6EAA6E,CAC7E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,SAAS,cAAc,CACtB,SAAqB,EACrB,SAAqB;IAErB,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,SAAS;QAC3B,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC;QAChD,CAAC,CAAC,EAAE,CAAC;IAEN,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,iBAAiB,GAAa,EAAE,CAAC;IACrC,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAC9B,EAAE,KAAK,CAAC;QACT,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7B,YAAY,GAAG,IAAI,CAAC;YACpB,SAAS;QACV,CAAC;QACD,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YAC/D,YAAY,GAAG,SAAS,KAAK,iBAAiB,CAAC;YAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,QAAQ,GAAG,IAAI,EAAE,UAAU,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,CAC/B,EAAE,KAAK,CAAC;YACT,IAAI,QAAQ,EAAE,CAAC;gBACd,iBAAiB,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3D,CAAC;YACD,SAAS;QACV,CAAC;QACD,oEAAoE;QACpE,0CAA0C;QAC1C,MAAM,IAAI,cAAc,CACvB,yCAAyC,SAAS,IAAI,QAAQ,uBAAuB,CACrF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACzE,sEAAsE;QACtE,qDAAqD;QACrD,MAAM,IAAI,cAAc,CACvB,qGAAqG,CACrG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,SAAqB,EAAE,YAAsB;IAChE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,cAAc,CACvB,gHAAgH,CAChH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CACvB,iFAAiF,CACjF,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,SAAS,CAAC;IACxB,CAAC;IACD,yEAAyE;IACzE,8BAA8B;IAC9B,OAAQ,KAAK,CAAC,CAAC,CAAqB,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAC3B,SAAqB;IAErB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,IACC,OAAO,CAAC,YAAY,KAAK,OAAO;YAChC,OAAO,CAAC,KAAK,KAAK,iBAAiB,EAClC,CAAC;YACF,OAAO,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAChD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,gCAAgC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,6BAA6B,CAAC;IACxH,IAAI,CAAC;QACJ,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,cAAc,CAAC,iCAAiC,CAAC,CAAC;IAC7D,CAAC;AACF,CAAC;AAED,2DAA2D;AAC3D,SAAS,IAAI,CAAC,MAAkB,EAAE,KAAa;IAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACvB,iBAAiB,KAAK,YAAY,MAAM,CAAC,KAAK,oBAAoB,KAAK,CAAC,MAAM,EAAE,CAChF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAe,CAAC;AAC/B,CAAC;AAED,6DAA6D;AAC7D,SAAS,QAAQ,CAAC,QAAoB,EAAE,UAAsB;IAC7D,KACC,IAAI,IAAI,GAA2B,UAAU,EAC7C,IAAI,KAAK,SAAS,EAClB,IAAI,GAAG,IAAI,CAAC,MAAM,EACjB,CAAC;QACF,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC;AAC3D,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @c9up/transit — federated sign-in for the Ream framework.
+ *
+ * Everything that lets a person prove who they are through an authority the
+ * application does not own. Today that is OAuth1 and OAuth2, and the providers
+ * that speak them.
+ */
+export { type AppleKey, appleClientSecret, parseAppleUser } from "./apple.js";
+export { type CanonicalizeOptions, canonicalize } from "./c14n.js";
+export type { TransitConfig, TransitDriverFactory, TransitProviderEntry, } from "./config.js";
+export { defineConfig, ldap, oidc, saml, socials } from "./config.js";
+export { type AppleConfig, AppleDriver } from "./drivers/AppleDriver.js";
+export { DiscordDriver } from "./drivers/DiscordDriver.js";
+export { FacebookDriver } from "./drivers/FacebookDriver.js";
+export { GitHubDriver } from "./drivers/GitHubDriver.js";
+export { GoogleDriver } from "./drivers/GoogleDriver.js";
+export { type LdapConfig, LdapDirectory } from "./drivers/LdapDirectory.js";
+export { LinkedInDriver } from "./drivers/LinkedInDriver.js";
+export { LinkedInOpenidConnectDriver } from "./drivers/LinkedInOpenidConnectDriver.js";
+export { type OidcConfig, OidcDriver } from "./drivers/OidcDriver.js";
+export { type SamlConfig, SamlDriver } from "./drivers/SamlDriver.js";
+export { SpotifyDriver } from "./drivers/SpotifyDriver.js";
+export { TwitterDriver } from "./drivers/TwitterDriver.js";
+export { TwitterXDriver } from "./drivers/TwitterXDriver.js";
+export type { IdTokenClaims, Jwk, SupportedAlg } from "./jwt.js";
+export { LdapConnection, type LdapEntry, LdapError, type LdapFilter, type LdapOptions, } from "./ldap.js";
+export { Oauth1Driver } from "./Oauth1Driver.js";
+export { createCodeVerifier, Oauth2Driver } from "./Oauth2Driver.js";
+export type { OidcMetadata, RemoteOptions } from "./oidc.js";
+export { type AssertionReplayStore, MemoryAssertionReplayStore, RedisAssertionReplayStore, type ReplayRedisClient, type ReplayRedisResolver, replayStores, } from "./replay.js";
+export { assertionInside, assertResponseSucceeded, SAML_ASSERTION_NS, SAML_PROTOCOL_NS, SamlError, type SamlExpectations, type SamlIdentity, validateAssertion, } from "./saml.js";
+export { TransitManager } from "./TransitManager.js";
+export type { TransitAppContext } from "./TransitProvider.js";
+export { default as TransitProvider } from "./TransitProvider.js";
+export type { DirectoryDriver, EmailVerificationState, OAuthConfig, OAuthToken, RedirectRequest, TransitDriver, TransitEntry, TransitUser, } from "./types.js";
+export { assertOAuthState, isDirectory } from "./types.js";
+export { childrenNamed, findByAttribute, parseXml, resolvePrefix, textOf, walk, XML_NS, type XmlAttribute, type XmlElement, type XmlNamespace, type XmlNode, } from "./xml.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACnE,YAAY,EACX,aAAa,EACb,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,KAAK,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,KAAK,UAAU,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,YAAY,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,EACN,cAAc,EACd,KAAK,SAAS,EACd,SAAS,EACT,KAAK,UAAU,EACf,KAAK,WAAW,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACrE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACN,KAAK,oBAAoB,EACzB,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,iBAAiB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,YAAY,EACX,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,eAAe,EACf,aAAa,EACb,YAAY,EACZ,WAAW,GACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACN,aAAa,EACb,eAAe,EACf,QAAQ,EACR,aAAa,EACb,MAAM,EACN,IAAI,EACJ,MAAM,EACN,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,OAAO,GACZ,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,33 @@
+/**
+ * @c9up/transit — federated sign-in for the Ream framework.
+ *
+ * Everything that lets a person prove who they are through an authority the
+ * application does not own. Today that is OAuth1 and OAuth2, and the providers
+ * that speak them.
+ */
+export { appleClientSecret, parseAppleUser } from "./apple.js";
+export { canonicalize } from "./c14n.js";
+export { defineConfig, ldap, oidc, saml, socials } from "./config.js";
+export { AppleDriver } from "./drivers/AppleDriver.js";
+export { DiscordDriver } from "./drivers/DiscordDriver.js";
+export { FacebookDriver } from "./drivers/FacebookDriver.js";
+export { GitHubDriver } from "./drivers/GitHubDriver.js";
+export { GoogleDriver } from "./drivers/GoogleDriver.js";
+export { LdapDirectory } from "./drivers/LdapDirectory.js";
+export { LinkedInDriver } from "./drivers/LinkedInDriver.js";
+export { LinkedInOpenidConnectDriver } from "./drivers/LinkedInOpenidConnectDriver.js";
+export { OidcDriver } from "./drivers/OidcDriver.js";
+export { SamlDriver } from "./drivers/SamlDriver.js";
+export { SpotifyDriver } from "./drivers/SpotifyDriver.js";
+export { TwitterDriver } from "./drivers/TwitterDriver.js";
+export { TwitterXDriver } from "./drivers/TwitterXDriver.js";
+export { LdapConnection, LdapError, } from "./ldap.js";
+export { Oauth1Driver } from "./Oauth1Driver.js";
+export { createCodeVerifier, Oauth2Driver } from "./Oauth2Driver.js";
+export { MemoryAssertionReplayStore, RedisAssertionReplayStore, replayStores, } from "./replay.js";
+export { assertionInside, assertResponseSucceeded, SAML_ASSERTION_NS, SAML_PROTOCOL_NS, SamlError, validateAssertion, } from "./saml.js";
+export { TransitManager } from "./TransitManager.js";
+export { default as TransitProvider } from "./TransitProvider.js";
+export { assertOAuthState, isDirectory } from "./types.js";
+export { childrenNamed, findByAttribute, parseXml, resolvePrefix, textOf, walk, XML_NS, } from "./xml.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAiB,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAA4B,YAAY,EAAE,MAAM,WAAW,CAAC;AAMnE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,EAAoB,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAmB,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EAAmB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAmB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EACN,cAAc,EAEd,SAAS,GAGT,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,EAEN,0BAA0B,EAC1B,yBAAyB,EAGzB,YAAY,GACZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,eAAe,EACf,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EAGT,iBAAiB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAWlE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EACN,aAAa,EACb,eAAe,EACf,QAAQ,EACR,aAAa,EACb,MAAM,EACN,IAAI,EACJ,MAAM,GAKN,MAAM,UAAU,CAAC"}

package/dist/jwt.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Verifying an OpenID Connect `id_token`.
+ *
+ * This is the file that decides whether a sign-in is genuine, so it is written
+ * to refuse rather than to accept. Three rules shape it:
+ *
+ *   - The algorithm is chosen by US, never read from the token. A verifier that
+ *     trusts the header's `alg` accepts `none`, and accepts an RS256 public key
+ *     replayed as an HS256 shared secret — the two oldest JWT forgeries there
+ *     are.
+ *   - Every claim that binds the token to this exchange is checked: the issuer,
+ *     the audience, the expiry, and the nonce. A token that is perfectly valid
+ *     for somebody else is not valid here.
+ *   - Nothing is decoded before the signature holds.
+ *
+ * No dependency: Node verifies RSA and EC against a JWK on its own.
+ */
+/** A public key as a provider publishes it. */
+export interface Jwk {
+    kty: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+    [key: string]: unknown;
+}
+export interface IdTokenClaims {
+    iss: string;
+    sub: string;
+    aud: string | string[];
+    exp: number;
+    iat?: number;
+    nonce?: string;
+    azp?: string;
+    [claim: string]: unknown;
+}
+/**
+ * The algorithms this verifies. Asymmetric only, and deliberately so: the
+ * symmetric family signs with the client secret, so anyone holding it — every
+ * copy of the config, every log line that leaked it — can mint a token for any
+ * user. `none` is not an algorithm.
+ */
+declare const SUPPORTED: {
+    readonly RS256: {
+        readonly hash: "sha256";
+        readonly kind: "rsa";
+        readonly kty: "RSA";
+    };
+    readonly RS384: {
+        readonly hash: "sha384";
+        readonly kind: "rsa";
+        readonly kty: "RSA";
+    };
+    readonly RS512: {
+        readonly hash: "sha512";
+        readonly kind: "rsa";
+        readonly kty: "RSA";
+    };
+    readonly PS256: {
+        readonly hash: "sha256";
+        readonly kind: "rsa-pss";
+        readonly kty: "RSA";
+    };
+    readonly PS384: {
+        readonly hash: "sha384";
+        readonly kind: "rsa-pss";
+        readonly kty: "RSA";
+    };
+    readonly PS512: {
+        readonly hash: "sha512";
+        readonly kind: "rsa-pss";
+        readonly kty: "RSA";
+    };
+    readonly ES256: {
+        readonly hash: "sha256";
+        readonly kind: "ec";
+        readonly kty: "EC";
+        readonly crv: "P-256";
+    };
+    readonly ES384: {
+        readonly hash: "sha384";
+        readonly kind: "ec";
+        readonly kty: "EC";
+        readonly crv: "P-384";
+    };
+    readonly ES512: {
+        readonly hash: "sha512";
+        readonly kind: "ec";
+        readonly kty: "EC";
+        readonly crv: "P-521";
+    };
+};
+export type SupportedAlg = keyof typeof SUPPORTED;
+export declare function isSupportedAlg(value: unknown): value is SupportedAlg;
+/** The three parts of a compact JWS, still encoded. */
+interface Parts {
+    header: Record<string, unknown>;
+    payload: Record<string, unknown>;
+    signingInput: string;
+    signature: Buffer;
+}
+/**
+ * Split and decode a compact JWS. This says nothing about whether the token is
+ * genuine — it is what the caller needs to find the right key.
+ */
+export declare function decodeJws(token: string): Parts;
+/**
+ * Check a token's signature against one key.
+ *
+ * `alg` is the caller's choice, not the token's. Passing the header's own
+ * value would be the vulnerability this exists to avoid.
+ */
+export declare function verifyJwsSignature(parts: Parts, jwk: Jwk, alg: SupportedAlg): boolean;
+export interface ClaimExpectations {
+    /** The issuer the discovery document declared. */
+    issuer: string;
+    /** This application's client id. */
+    audience: string;
+    /** The nonce sent on the redirect. Required for the authorization-code flow. */
+    nonce: string;
+    /** Tolerance for clock drift between here and the provider, in seconds. */
+    leewaySeconds?: number;
+    /** Injected in tests; seconds since the epoch. */
+    now?: number;
+}
+/**
+ * Check every claim that binds this token to this exchange.
+ *
+ * Each of these has been a real vulnerability somewhere: a token from another
+ * issuer, a token minted for another client of the same issuer, an expired one
+ * replayed, and — the one people forget — a token from an older sign-in of the
+ * same user, which is what the nonce catches.
+ */
+export declare function assertIdTokenClaims(payload: Record<string, unknown>, expected: ClaimExpectations): IdTokenClaims;
+export {};
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,+CAA+C;AAC/C,MAAM,WAAW,GAAG;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAad,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAC;AAElD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE;AAED,uDAAuD;AACvD,UAAU,KAAK;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAgB9C;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,YAAY,GACf,OAAO,CAgCT;AAED,MAAM,WAAW,iBAAiB;IACjC,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,EAAE,iBAAiB,GACzB,aAAa,CAsDf"}