@daloyjs/core 0.17.0 → 0.29.0

package/dist/jwt.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Wave 5 leftover: first-party `jwt()` sign + verify helpers with secure-by-default
+ * algorithm discipline and time-claim validation.
+ *
+ * The framework refuses `alg: "none"` outright, requires an explicit algorithm
+ * allowlist on the verifier (no implicit "any RS256" default), refuses
+ * symmetric algorithms (`HS*`) when the key source is a JWK / JWKS URL
+ * (the classic confused-deputy attack), refuses to issue tokens without an
+ * `exp` claim or with an `exp` exceeding the construction-time
+ * `maxLifetimeSeconds`, and validates `exp` / `nbf` / `iat` on every verify
+ * (with optional `iss` / `aud` checks) — none of which can be silenced in
+ * production under `secureDefaults`.
+ *
+ * Pair with the Wave 1 webhook HMAC helpers in `@daloyjs/core` for body-bound
+ * authentication, and with the Wave 5 `requireScopes()` middleware for
+ * scope-based authorization on top of a verified JWT.
+ *
+ * @since 0.21.0
+ */
+/** Algorithms understood by the helper. SHA-1 / `none` are deliberately absent. */
+export type JwtAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | "ES256" | "ES384" | "ES512" | "EdDSA";
+/** Default lifetime cap when none is declared in development (`30d`). */
+export declare const DEFAULT_JWT_MAX_LIFETIME_SECONDS: number;
+/** Structured error thrown by every JWT helper. */
+export declare class JwtError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Result of a successful verify. */
+export interface JwtVerified {
+    readonly header: Record<string, unknown>;
+    readonly payload: Record<string, unknown>;
+}
+/** Key material accepted by the signer/verifier. */
+export type JwtKeyMaterial = CryptoKey | Uint8Array | JsonWebKey;
+/** Options for {@link createJwtSigner}. */
+export interface JwtSignerOptions {
+    alg: JwtAlgorithm;
+    key: JwtKeyMaterial;
+    /**
+     * Maximum allowed `exp - iat` window in seconds. Required: refuse-at-
+     * construction when omitted so "default forever" is impossible.
+     */
+    maxLifetimeSeconds: number;
+    /**
+     * Opt-out flag for issuing tokens with no `exp` claim. Refused in
+     * production under `secureDefaults` (a token that never expires is wrong
+     * in every threat model).
+     */
+    acknowledgeNoExp?: boolean;
+    /** Override the resolved environment (defaults to `NODE_ENV`). */
+    env?: "production" | "development" | "test";
+    /** Set `secureDefaults: false` to skip the production opt-out gate. */
+    secureDefaults?: boolean;
+    /** Optional extra header fields (`kid`, `typ`, ...). `alg` is always derived. */
+    header?: Record<string, unknown>;
+}
+/** Options for {@link createJwtVerifier}. */
+export interface JwtVerifierOptions {
+    /** Explicit allowlist — no implicit defaults. Must be non-empty. */
+    algorithms: JwtAlgorithm[];
+    /** Static key, or a per-token resolver that picks the key by `header.kid`. */
+    key: JwtKeyMaterial | ((header: Record<string, unknown>) => JwtKeyMaterial | Promise<JwtKeyMaterial>);
+    /** Optional issuer (string or allowlist). */
+    issuer?: string | string[];
+    /** Optional audience (string or allowlist). */
+    audience?: string | string[];
+    /** Clock skew tolerance applied to `exp` / `nbf` / `iat`. Default `0`. */
+    clockSkewSeconds?: number;
+    /**
+     * Refuse-to-construct when the algorithm allowlist mixes symmetric (`HS*`)
+     * with a JWK / JWKS-shaped resolver. Default: `true`. This closes the
+     * documented confused-deputy attack class where a verifier configured for
+     * RS256 + JWK silently accepts an HS256 token signed with the public key.
+     */
+    refuseSymmetricWithJwk?: boolean;
+    /** Optional injectable clock for tests. */
+    now?: () => number;
+}
+/**
+ * Create a JWT signer locked to one algorithm + key. The returned `sign()`
+ * function refuses payloads without an `exp` claim (unless
+ * `acknowledgeNoExp: true` was set at construction outside production) and
+ * refuses payloads whose `exp - (iat | now)` exceeds `maxLifetimeSeconds`.
+ *
+ * @since 0.21.0
+ */
+export declare function createJwtSigner(opts: JwtSignerOptions): {
+    sign(payload: Record<string, unknown>): Promise<string>;
+};
+/**
+ * Create a JWT verifier locked to an explicit algorithm allowlist. Validates
+ * `exp` / `nbf` / `iat` on every call (clock skew configurable). Refuses
+ * `alg: "none"` and any token whose header `alg` is not in the allowlist;
+ * refuses-at-construction when a symmetric algorithm (`HS*`) is mixed with
+ * a JWK / JWKS-shaped key source (the documented confused-deputy attack).
+ *
+ * @since 0.21.0
+ */
+export declare function createJwtVerifier(opts: JwtVerifierOptions): {
+    verify(token: string): Promise<JwtVerified>;
+};
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,mFAAmF;AACnF,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,CAAC;AA+BZ,yEAAyE;AACzE,eAAO,MAAM,gCAAgC,QAAoB,CAAC;AAElE,mDAAmD;AACnD,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,qCAAqC;AACrC,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjE,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,YAAY,CAAC;IAClB,GAAG,EAAE,cAAc,CAAC;IACpB;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kEAAkE;IAClE,GAAG,CAAC,EAAE,YAAY,GAAG,aAAa,GAAG,MAAM,CAAC;IAC5C,uEAAuE;IACvE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,8EAA8E;IAC9E,GAAG,EAAE,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACtG,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAsKD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG;IAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CA4FnH;AA2BD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG;IAAE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;CAAE,CA4F3G"}

package/dist/jwt.js

@@ -0,0 +1,437 @@
+/**
+ * Wave 5 leftover: first-party `jwt()` sign + verify helpers with secure-by-default
+ * algorithm discipline and time-claim validation.
+ *
+ * The framework refuses `alg: "none"` outright, requires an explicit algorithm
+ * allowlist on the verifier (no implicit "any RS256" default), refuses
+ * symmetric algorithms (`HS*`) when the key source is a JWK / JWKS URL
+ * (the classic confused-deputy attack), refuses to issue tokens without an
+ * `exp` claim or with an `exp` exceeding the construction-time
+ * `maxLifetimeSeconds`, and validates `exp` / `nbf` / `iat` on every verify
+ * (with optional `iss` / `aud` checks) — none of which can be silenced in
+ * production under `secureDefaults`.
+ *
+ * Pair with the Wave 1 webhook HMAC helpers in `@daloyjs/core` for body-bound
+ * authentication, and with the Wave 5 `requireScopes()` middleware for
+ * scope-based authorization on top of a verified JWT.
+ *
+ * @since 0.21.0
+ */
+import { assertTemporalClaims, TemporalClaimError } from "./time-claims.js";
+const SYMMETRIC = new Set([
+    "HS256",
+    "HS384",
+    "HS512",
+]);
+const ASYMMETRIC = new Set([
+    "RS256",
+    "RS384",
+    "RS512",
+    "PS256",
+    "PS384",
+    "PS512",
+    "ES256",
+    "ES384",
+    "ES512",
+    "EdDSA",
+]);
+const ALL_ALGS = new Set([...SYMMETRIC, ...ASYMMETRIC]);
+/**
+ * Wave 8 — minimum byte length for an HS* HMAC secret. RFC 7518 §3.2
+ * requires HS256 keys to be at least 256 bits (32 bytes). Apply the same
+ * floor to HS384 / HS512 because shorter keys do not buy a meaningfully
+ * stronger HMAC than HS256-with-a-256-bit-key.
+ */
+const MIN_HS_KEY_BYTES = 32;
+/** Default lifetime cap when none is declared in development (`30d`). */
+export const DEFAULT_JWT_MAX_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
+/** Structured error thrown by every JWT helper. */
+export class JwtError extends Error {
+    code;
+    constructor(code, message) {
+        super(`[${code}] ${message}`);
+        this.name = "JwtError";
+        this.code = code;
+    }
+}
+function getCrypto() {
+    const c = globalThis.crypto;
+    if (!c?.subtle) {
+        throw new JwtError("no_webcrypto", "jwt(): WebCrypto SubtleCrypto API is unavailable on this runtime.");
+    }
+    return c;
+}
+function b64urlEncode(bytes) {
+    let bin = "";
+    for (let i = 0; i < bytes.length; i++)
+        bin += String.fromCharCode(bytes[i]);
+    return btoa(bin).replace(/=+$/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function b64urlDecode(input) {
+    if (!/^[A-Za-z0-9_-]*$/.test(input)) {
+        throw new JwtError("invalid_token", "JWT segment is not base64url.");
+    }
+    const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - (padded.length % 4));
+    const bin = atob(padded + pad);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+const ENC = new TextEncoder();
+const DEC = new TextDecoder();
+function isJsonObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isJsonWebKey(v) {
+    return isJsonObject(v) && typeof v.kty === "string";
+}
+function isCryptoKey(v) {
+    return (typeof v === "object" &&
+        v !== null &&
+        typeof v.type === "string" &&
+        typeof v.algorithm === "object");
+}
+function isProductionEnv(env) {
+    if (env === "production")
+        return true;
+    if (env === "development" || env === "test")
+        return false;
+    return (typeof process !== "undefined" &&
+        typeof process.env !== "undefined" &&
+        process.env.NODE_ENV === "production");
+}
+function algParams(alg) {
+    switch (alg) {
+        case "HS256":
+            return { name: "HMAC", hash: "SHA-256" };
+        case "HS384":
+            return { name: "HMAC", hash: "SHA-384" };
+        case "HS512":
+            return { name: "HMAC", hash: "SHA-512" };
+        case "RS256":
+            return { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+        case "RS384":
+            return { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" };
+        case "RS512":
+            return { name: "RSASSA-PKCS1-v1_5", hash: "SHA-512" };
+        case "PS256":
+            return { name: "RSA-PSS", hash: "SHA-256", saltLength: 32 };
+        case "PS384":
+            return { name: "RSA-PSS", hash: "SHA-384", saltLength: 48 };
+        case "PS512":
+            return { name: "RSA-PSS", hash: "SHA-512", saltLength: 64 };
+        case "ES256":
+            return { name: "ECDSA", hash: "SHA-256", namedCurve: "P-256" };
+        case "ES384":
+            return { name: "ECDSA", hash: "SHA-384", namedCurve: "P-384" };
+        case "ES512":
+            return { name: "ECDSA", hash: "SHA-512", namedCurve: "P-521" };
+        case "EdDSA":
+            return { name: "Ed25519" };
+    }
+}
+async function importKey(alg, material, usage) {
+    const params = algParams(alg);
+    const c = getCrypto();
+    if (isCryptoKey(material))
+        return material;
+    if (material instanceof Uint8Array) {
+        if (!SYMMETRIC.has(alg)) {
+            throw new JwtError("invalid_key", `jwt(): raw byte keys are only supported for HS256/HS384/HS512; got ${alg}.`);
+        }
+        // Wave 8 — refuse HS-shaped secrets shorter than 32 bytes (256 bits).
+        // RFC 7518 §3.2 requires HS256 keys to be "of the same size as the hash
+        // output (for instance, 256 bits for HS256)" — anything shorter is a
+        // known-weak HMAC key that turns the signature into the bottleneck.
+        if (material.byteLength < MIN_HS_KEY_BYTES) {
+            throw new JwtError("weak_hs_secret", `jwt(): ${alg} secret must be at least ${MIN_HS_KEY_BYTES} bytes (RFC 7518 §3.2); got ${material.byteLength}.`);
+        }
+        return c.subtle.importKey("raw", material, { name: "HMAC", hash: params.hash }, false, [usage]);
+    }
+    if (isJsonWebKey(material)) {
+        const importAlgorithm = params.name === "HMAC"
+            ? { name: "HMAC", hash: params.hash }
+            : params.name === "ECDSA"
+                ? { name: "ECDSA", namedCurve: params.namedCurve }
+                : params.name === "RSA-PSS"
+                    ? { name: "RSA-PSS", hash: params.hash }
+                    : params.name === "RSASSA-PKCS1-v1_5"
+                        ? { name: "RSASSA-PKCS1-v1_5", hash: params.hash }
+                        : { name: "Ed25519" };
+        return c.subtle.importKey("jwk", material, importAlgorithm, false, [usage]);
+    }
+    throw new JwtError("invalid_key", "jwt(): unsupported key material.");
+}
+function buildSignAlgorithm(alg) {
+    const params = algParams(alg);
+    if (params.name === "RSA-PSS")
+        return { name: "RSA-PSS", saltLength: params.saltLength };
+    if (params.name === "ECDSA")
+        return { name: "ECDSA", hash: params.hash };
+    if (params.name === "Ed25519")
+        return { name: "Ed25519" };
+    return { name: params.name };
+}
+/**
+ * Create a JWT signer locked to one algorithm + key. The returned `sign()`
+ * function refuses payloads without an `exp` claim (unless
+ * `acknowledgeNoExp: true` was set at construction outside production) and
+ * refuses payloads whose `exp - (iat | now)` exceeds `maxLifetimeSeconds`.
+ *
+ * @since 0.21.0
+ */
+export function createJwtSigner(opts) {
+    if (!opts || typeof opts !== "object") {
+        throw new JwtError("invalid_options", "jwt(): signer options object is required.");
+    }
+    const { alg } = opts;
+    if (alg === "none") {
+        throw new JwtError("alg_none_refused", 'jwt(): alg "none" is refused.');
+    }
+    if (!ALL_ALGS.has(alg)) {
+        throw new JwtError("invalid_alg", `jwt(): unknown algorithm "${String(alg)}". Allowed: ${[...ALL_ALGS].sort().join(", ")}.`);
+    }
+    if (SYMMETRIC.has(alg) &&
+        opts.key instanceof Uint8Array &&
+        opts.key.byteLength < MIN_HS_KEY_BYTES) {
+        throw new JwtError("weak_hs_secret", `jwt(): ${alg} secret must be at least ${MIN_HS_KEY_BYTES} bytes (RFC 7518 §3.2); got ${opts.key.byteLength}.`);
+    }
+    if (typeof opts.maxLifetimeSeconds !== "number" || !Number.isFinite(opts.maxLifetimeSeconds) || opts.maxLifetimeSeconds <= 0) {
+        throw new JwtError("missing_max_lifetime", "jwt(): maxLifetimeSeconds is required and must be a positive number — a token that never expires is wrong in every threat model.");
+    }
+    if (opts.acknowledgeNoExp === true && isProductionEnv(opts.env) && opts.secureDefaults !== false) {
+        throw new JwtError("ack_no_exp_refused_in_production", "jwt(): acknowledgeNoExp: true is refused in production under secureDefaults — every issued JWT must carry an exp claim.");
+    }
+    const resolved = (async () => {
+        const key = await importKey(alg, opts.key, "sign");
+        return {
+            alg,
+            key,
+            maxLifetimeSeconds: opts.maxLifetimeSeconds,
+            allowNoExp: opts.acknowledgeNoExp === true,
+            header: opts.header && isJsonObject(opts.header) ? { ...opts.header } : {},
+        };
+    })();
+    return {
+        async sign(payload) {
+            if (!isJsonObject(payload)) {
+                throw new JwtError("invalid_payload", "jwt().sign(): payload must be a plain object.");
+            }
+            const r = await resolved;
+            const now = Math.floor(Date.now() / 1000);
+            const iat = typeof payload.iat === "number" ? payload.iat : now;
+            const expRaw = payload.exp;
+            if (expRaw === undefined) {
+                if (!r.allowNoExp) {
+                    throw new JwtError("missing_exp", "jwt().sign(): payload is missing the exp claim. Set payload.exp = unix seconds, or construct the signer with acknowledgeNoExp: true outside production.");
+                }
+            }
+            else {
+                if (typeof expRaw !== "number" || !Number.isFinite(expRaw)) {
+                    throw new JwtError("invalid_exp", "jwt().sign(): payload.exp must be a finite number of seconds since the Unix epoch.");
+                }
+                const lifetime = expRaw - iat;
+                if (lifetime > r.maxLifetimeSeconds) {
+                    throw new JwtError("exp_exceeds_max_lifetime", `jwt().sign(): payload.exp - iat (${lifetime}s) exceeds maxLifetimeSeconds (${r.maxLifetimeSeconds}s).`);
+                }
+                if (lifetime <= 0) {
+                    throw new JwtError("exp_in_past", "jwt().sign(): payload.exp must be strictly greater than iat.");
+                }
+            }
+            const header = { ...r.header, alg: r.alg, typ: "JWT" };
+            const headerB64 = b64urlEncode(ENC.encode(JSON.stringify(header)));
+            const payloadB64 = b64urlEncode(ENC.encode(JSON.stringify(payload)));
+            const signingInput = `${headerB64}.${payloadB64}`;
+            const sig = new Uint8Array(await getCrypto().subtle.sign(buildSignAlgorithm(r.alg), r.key, ENC.encode(signingInput)));
+            return `${signingInput}.${b64urlEncode(sig)}`;
+        },
+    };
+}
+function looksLikeJwkSource(key) {
+    if (typeof key === "function")
+        return true; // resolver — assume JWKS
+    return isJsonWebKey(key);
+}
+function normalizeStringSet(value) {
+    if (value === undefined)
+        return null;
+    const arr = typeof value === "string" ? [value] : value;
+    if (!Array.isArray(arr) || arr.length === 0) {
+        throw new JwtError("invalid_string_set", "jwt(): issuer/audience option must be a non-empty string or string[].");
+    }
+    for (const v of arr) {
+        if (typeof v !== "string" || v.length === 0) {
+            throw new JwtError("invalid_string_set", "jwt(): issuer/audience entries must be non-empty strings.");
+        }
+    }
+    return new Set(arr);
+}
+/**
+ * Create a JWT verifier locked to an explicit algorithm allowlist. Validates
+ * `exp` / `nbf` / `iat` on every call (clock skew configurable). Refuses
+ * `alg: "none"` and any token whose header `alg` is not in the allowlist;
+ * refuses-at-construction when a symmetric algorithm (`HS*`) is mixed with
+ * a JWK / JWKS-shaped key source (the documented confused-deputy attack).
+ *
+ * @since 0.21.0
+ */
+export function createJwtVerifier(opts) {
+    if (!opts || typeof opts !== "object") {
+        throw new JwtError("invalid_options", "jwt(): verifier options object is required.");
+    }
+    if (!Array.isArray(opts.algorithms) || opts.algorithms.length === 0) {
+        throw new JwtError("missing_algorithms", "jwt(): verifier requires an explicit, non-empty algorithms allowlist — no implicit defaults.");
+    }
+    const allow = new Set();
+    for (const alg of opts.algorithms) {
+        if (alg === "none") {
+            throw new JwtError("alg_none_refused", 'jwt(): alg "none" cannot appear in the allowlist.');
+        }
+        if (!ALL_ALGS.has(alg)) {
+            throw new JwtError("invalid_alg", `jwt(): unknown algorithm "${String(alg)}" in allowlist.`);
+        }
+        allow.add(alg);
+    }
+    const hasSym = [...allow].some((a) => SYMMETRIC.has(a));
+    if (hasSym &&
+        opts.key instanceof Uint8Array &&
+        opts.key.byteLength < MIN_HS_KEY_BYTES) {
+        throw new JwtError("weak_hs_secret", `jwt(): HS* secret must be at least ${MIN_HS_KEY_BYTES} bytes (RFC 7518 §3.2); got ${opts.key.byteLength}.`);
+    }
+    if (hasSym &&
+        opts.refuseSymmetricWithJwk !== false &&
+        looksLikeJwkSource(opts.key)) {
+        throw new JwtError("sym_with_jwk_refused", "jwt(): symmetric algorithms (HS*) mixed with a JWK / JWKS key source are refused — this is the documented JWKS confused-deputy attack. Use asymmetric algorithms (RS/PS/ES/EdDSA), or pass refuseSymmetricWithJwk: false to override (not recommended).");
+    }
+    if (opts.clockSkewSeconds !== undefined) {
+        if (typeof opts.clockSkewSeconds !== "number" || !Number.isFinite(opts.clockSkewSeconds) || opts.clockSkewSeconds < 0) {
+            throw new JwtError("invalid_clock_skew", "jwt(): clockSkewSeconds must be a non-negative finite number.");
+        }
+    }
+    const issuers = normalizeStringSet(opts.issuer);
+    const audiences = normalizeStringSet(opts.audience);
+    const keyCache = new Map();
+    async function resolveKey(header) {
+        const algRaw = header.alg;
+        if (typeof algRaw !== "string" || !allow.has(algRaw)) {
+            throw new JwtError("alg_not_allowed", `jwt(): token alg "${String(algRaw)}" is not in the allowlist.`);
+        }
+        const alg = algRaw;
+        const material = typeof opts.key === "function" ? await opts.key(header) : opts.key;
+        if (typeof opts.key !== "function") {
+            const cacheKey = alg;
+            const cached = keyCache.get(cacheKey);
+            if (cached)
+                return cached;
+            const imported = await importKey(alg, material, "verify");
+            keyCache.set(cacheKey, imported);
+            return imported;
+        }
+        return importKey(alg, material, "verify");
+    }
+    const resolved = {
+        algorithms: allow,
+        resolveKey,
+        issuers,
+        audiences,
+        clockSkewSeconds: opts.clockSkewSeconds ?? 0,
+        now: opts.now ?? (() => Math.floor(Date.now() / 1000)),
+    };
+    return {
+        async verify(token) {
+            return verifyInternal(token, resolved);
+        },
+    };
+}
+async function verifyInternal(token, r) {
+    if (typeof token !== "string" || token.length === 0) {
+        throw new JwtError("invalid_token", "jwt(): token must be a non-empty string.");
+    }
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+        throw new JwtError("invalid_token", "jwt(): token must have three dot-separated segments.");
+    }
+    const [headerB64, payloadB64, sigB64] = parts;
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(DEC.decode(b64urlDecode(headerB64)));
+    }
+    catch (err) {
+        if (err instanceof JwtError)
+            throw err;
+        throw new JwtError("invalid_token", "jwt(): header is not valid JSON.");
+    }
+    try {
+        payload = JSON.parse(DEC.decode(b64urlDecode(payloadB64)));
+    }
+    catch (err) {
+        if (err instanceof JwtError)
+            throw err;
+        throw new JwtError("invalid_token", "jwt(): payload is not valid JSON.");
+    }
+    if (!isJsonObject(header) || !isJsonObject(payload)) {
+        throw new JwtError("invalid_token", "jwt(): header and payload must be JSON objects.");
+    }
+    const algRaw = header.alg;
+    if (algRaw === "none") {
+        throw new JwtError("alg_none_refused", 'jwt(): token alg "none" is refused.');
+    }
+    if (typeof algRaw !== "string" || !r.algorithms.has(algRaw)) {
+        throw new JwtError("alg_not_allowed", `jwt(): token alg "${String(algRaw)}" is not in the allowlist.`);
+    }
+    const alg = algRaw;
+    const key = await r.resolveKey(header);
+    const sig = b64urlDecode(sigB64);
+    const signingInput = ENC.encode(`${headerB64}.${payloadB64}`);
+    let ok;
+    try {
+        ok = await getCrypto().subtle.verify(buildSignAlgorithm(alg), key, sig, signingInput);
+    }
+    catch {
+        throw new JwtError("invalid_signature", "jwt(): signature verification threw.");
+    }
+    if (!ok) {
+        throw new JwtError("invalid_signature", "jwt(): signature verification failed.");
+    }
+    const now = r.now();
+    try {
+        assertTemporalClaims(payload, {
+            now,
+            clockSkewSeconds: r.clockSkewSeconds,
+        });
+    }
+    catch (err) {
+        if (err instanceof TemporalClaimError) {
+            throw new JwtError(err.code, `jwt(): ${err.message}`);
+        }
+        throw err;
+    }
+    if (r.issuers) {
+        const iss = payload.iss;
+        if (typeof iss !== "string" || !r.issuers.has(iss)) {
+            throw new JwtError("invalid_issuer", "jwt(): payload.iss does not match the expected issuer(s).");
+        }
+    }
+    if (r.audiences) {
+        const aud = payload.aud;
+        if (typeof aud === "string") {
+            if (!r.audiences.has(aud)) {
+                throw new JwtError("invalid_audience", "jwt(): payload.aud does not match the expected audience(s).");
+            }
+        }
+        else if (Array.isArray(aud)) {
+            const matched = aud.some((a) => typeof a === "string" && r.audiences.has(a));
+            if (!matched) {
+                throw new JwtError("invalid_audience", "jwt(): payload.aud does not match the expected audience(s).");
+            }
+        }
+        else {
+            throw new JwtError("invalid_audience", "jwt(): payload.aud is missing or not a string / string[].");
+        }
+    }
+    return { header, payload };
+}
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAkB5E,MAAM,SAAS,GAA8B,IAAI,GAAG,CAAC;IACnD,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,UAAU,GAA8B,IAAI,GAAG,CAAC;IACpD,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC;AAE7E;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,yEAAyE;AACzE,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAElE,mDAAmD;AACnD,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAS;IACtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AA0ED,SAAS,SAAS;IAChB,MAAM,CAAC,GAAwB,UAA6C,CAAC,MAAM,CAAC;IACpF,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAChB,cAAc,EACd,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,SAAS,YAAY,CAAC,CAAU;IAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,CAAU;IAC9B,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,OAAQ,CAAuB,CAAC,GAAG,KAAK,QAAQ,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,CACL,OAAO,CAAC,KAAK,QAAQ;QACrB,CAAC,KAAK,IAAI;QACV,OAAQ,CAAwB,CAAC,IAAI,KAAK,QAAQ;QAClD,OAAQ,CAA6B,CAAC,SAAS,KAAK,QAAQ,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,IAAI,GAAG,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,CACL,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,OAAO,CAAC,GAAG,KAAK,WAAW;QAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAiB;IAClC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3C,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3C,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC3C,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxD,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxD,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxD,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC9D,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC9D,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC9D,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACjE,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACjE,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QACjE,KAAK,OAAO;YACV,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAiB,EACjB,QAAwB,EACxB,KAAwB;IAExB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,WAAW,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,IAAI,QAAQ,YAAY,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAChB,aAAa,EACb,sEAAsE,GAAG,GAAG,CAC7E,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,QAAQ,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,UAAU,GAAG,4BAA4B,gBAAgB,+BAA+B,QAAQ,CAAC,UAAU,GAAG,CAC/G,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,MAAM,CAAC,SAAS,CACvB,KAAK,EACL,QAAwB,EACxB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAK,EAAE,EACpC,KAAK,EACL,CAAC,KAAK,CAAC,CACR,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,MAAM,eAAe,GACnB,MAAM,CAAC,IAAI,KAAK,MAAM;YACpB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAK,EAAE;YACtC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;gBACzB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAW,EAAE;gBACnD,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAK,EAAE;oBACzC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,mBAAmB;wBACrC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAK,EAAE;wBACnD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAiB;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAW,EAAE,CAAC;IAC1F,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAK,EAAE,CAAC;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,IAAK,GAAe,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAChB,aAAa,EACb,6BAA6B,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,IACE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QAClB,IAAI,CAAC,GAAG,YAAY,UAAU;QAC9B,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,gBAAgB,EACtC,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,UAAU,GAAG,4BAA4B,gBAAgB,+BAA+B,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAC/G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;QAC7H,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,kIAAkI,CACnI,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QACjG,MAAM,IAAI,QAAQ,CAChB,kCAAkC,EAClC,yHAAyH,CAC1H,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAA4B,CAAC,KAAK,IAAI,EAAE;QACpD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,GAAG;YACH,GAAG;YACH,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,UAAU,EAAE,IAAI,CAAC,gBAAgB,KAAK,IAAI;YAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;SAC3E,CAAC;IACJ,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAgC;YACzC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAChE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;YAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;oBAClB,MAAM,IAAI,QAAQ,CAChB,aAAa,EACb,yJAAyJ,CAC1J,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,oFAAoF,CAAC,CAAC;gBAC1H,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,GAAG,GAAG,CAAC;gBAC9B,IAAI,QAAQ,GAAG,CAAC,CAAC,kBAAkB,EAAE,CAAC;oBACpC,MAAM,IAAI,QAAQ,CAChB,0BAA0B,EAC1B,oCAAoC,QAAQ,kCAAkC,CAAC,CAAC,kBAAkB,KAAK,CACxG,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;oBAClB,MAAM,IAAI,QAAQ,CAChB,aAAa,EACb,8DAA8D,CAC/D,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACnE,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACrE,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;YAClD,MAAM,GAAG,GAAG,IAAI,UAAU,CACxB,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAiB,CAAC,CAC1G,CAAC;YACF,OAAO,GAAG,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA8B;IACxD,IAAI,OAAO,GAAG,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IACrE,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAoC;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,QAAQ,CAChB,oBAAoB,EACpB,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,QAAQ,CAChB,oBAAoB,EACpB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,QAAQ,CAChB,oBAAoB,EACpB,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,IAAK,GAAe,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,mDAAmD,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAChB,aAAa,EACb,6BAA6B,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAC1D,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IACE,MAAM;QACN,IAAI,CAAC,GAAG,YAAY,UAAU;QAC9B,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,gBAAgB,EACtC,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,sCAAsC,gBAAgB,+BAA+B,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAC5G,CAAC;IACJ,CAAC;IACD,IACE,MAAM;QACN,IAAI,CAAC,sBAAsB,KAAK,KAAK;QACrC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAC5B,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,yPAAyP,CAC1P,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACtH,MAAM,IAAI,QAAQ,CAChB,oBAAoB,EACpB,+DAA+D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,KAAK,UAAU,UAAU,CAAC,MAA+B;QACvD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;QAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAsB,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,QAAQ,CAChB,iBAAiB,EACjB,qBAAqB,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAsB,CAAC;QACnC,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACrE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,GAAG,CAAC;YACrB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1D,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAqB;QACjC,UAAU,EAAE,KAAK;QACjB,UAAU;QACV,OAAO;QACP,SAAS;QACT,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,CAAC;QAC5C,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;KACvD,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,OAAO,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,CAAmB;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAC1E,IAAI,MAA+B,CAAC;IACpC,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAA4B,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ;YAAE,MAAM,GAAG,CAAC;QACvC,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAA4B,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ;YAAE,MAAM,GAAG,CAAC;QACvC,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,iDAAiD,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;IAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,MAAsB,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,QAAQ,CAChB,iBAAiB,EACjB,qBAAqB,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAsB,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC;IAC9D,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAmB,EAAE,YAA4B,CAAC,CAAC;IACxH,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,sCAAsC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,oBAAoB,CAAC,OAA0D,EAAE;YAC/E,GAAG;YACH,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;SACrC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,2DAA2D,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,6DAA6D,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,6DAA6D,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,2DAA2D,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC"}

package/dist/load-shedding.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Wave 4 leftover: `loadShedding()` primitive.
+ *
+ * Lightweight Node-process pressure monitor that returns `Hooks` for
+ * `app.use(...)`. When any of the configured thresholds is exceeded,
+ * every incoming request is short-circuited with `503 Service Unavailable`
+ * carrying a `Retry-After` header. First-party answer to
+ * `@fastify/under-pressure`. Defaults are off for heap/RSS thresholds
+ * (deployment-specific) and conservative for everything else (event-loop
+ * delay at 1 s, event-loop utilization at 0.98). The monitor samples at
+ * `sampleIntervalMs` (default 1 s). Graceful no-op on runtimes without
+ * `node:perf_hooks` (Workers / Edge / Fastly Compute).
+ *
+ * @since 0.20.0
+ */
+import type { Hooks } from "./types.js";
+/** Configuration accepted by {@link loadShedding}. Every field is optional. */
+export interface LoadSheddingOptions {
+    /** Max tolerated event-loop delay (ms). Default `1000`. `0` disables. */
+    maxEventLoopDelayMs?: number;
+    /** Max tolerated `heapUsed` bytes. Off by default. */
+    maxHeapUsedBytes?: number;
+    /** Max tolerated `rss` bytes. Off by default. */
+    maxRssBytes?: number;
+    /** Max tolerated event-loop utilization (`[0, 1]`). Default `0.98`. `0` disables. */
+    maxEventLoopUtilization?: number;
+    /** Sampling interval (ms). Default `1000`; clamped to at least `100`. */
+    sampleIntervalMs?: number;
+    /** `Retry-After` seconds on the shedded `503`. Default `10`. */
+    retryAfterSeconds?: number;
+    /** Optional custom check; truthy return value becomes a shed reason. */
+    healthCheck?: () => string | undefined | Promise<string | undefined>;
+    /** Interval for `healthCheck` (ms). Defaults to `sampleIntervalMs`. */
+    healthCheckIntervalMs?: number;
+}
+/**
+ * Snapshot returned by the internal pressure sampler. Exposed for tests.
+ *
+ * @internal
+ */
+export interface LoadSheddingSnapshot {
+    eventLoopDelayMs: number;
+    heapUsedBytes: number;
+    rssBytes: number;
+    eventLoopUtilization: number;
+    reason?: string;
+}
+/**
+ * Build a Hooks bundle that refuses requests with `503` when the configured
+ * process-pressure thresholds are exceeded.
+ *
+ * @example
+ * ```ts
+ * import { App, loadShedding } from "@daloyjs/core";
+ *
+ * const app = new App();
+ * app.use(loadShedding({
+ *   maxEventLoopDelayMs: 500,
+ *   maxHeapUsedBytes: 1.5 * 1024 ** 3,
+ *   retryAfterSeconds: 5,
+ * }));
+ * ```
+ */
+export declare function loadShedding(opts?: LoadSheddingOptions): Hooks;
+/**
+ * Read-only accessor for tests + observability plugins that want to know
+ * what the latest pressure sample looked like. Returns `undefined` if the
+ * given hooks object was not produced by {@link loadShedding}.
+ *
+ * @internal
+ */
+export declare const LOAD_SHEDDING_MARKER: unique symbol;
+//# sourceMappingURL=load-shedding.d.ts.map

package/dist/load-shedding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-shedding.d.ts","sourceRoot":"","sources":["../src/load-shedding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGxC,+EAA+E;AAC/E,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrE,uEAAuE;IACvE,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IAAG,gBAAgB,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAAE;AAiB3J;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,KAAK,CAkIlE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,OAAO,MAEzC,CAAC"}