@entifix/jwt 0.1.0-0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 r10c Technologies
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './token-service/jose-token-service.js';
+export * from './token-service/jwks.js';
+export * from './token-service/unverified-claims.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,sCAAsC,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export * from './token-service/jose-token-service.js';
+export * from './token-service/jwks.js';
+export * from './token-service/unverified-claims.js';
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './token-service/jose-token-service.js';\nexport * from './token-service/jwks.js';\nexport * from './token-service/unverified-claims.js';\n"],"names":[],"mappings":"AAAA,cAAc,wCAAwC;AACtD,cAAc,0BAA0B;AACxC,cAAc,uCAAuC"}

package/dist/token-service/jose-token-service.d.ts

@@ -0,0 +1,58 @@
+import type { TokenClaims, TokenService } from '@entifix/business';
+/** The one algorithm this service signs and accepts. See {@link verifyAccessToken}. */
+export declare const TOKEN_ALGORITHM = "RS256";
+/**
+ * Settings for signing and verifying access tokens.
+ *
+ * Asymmetric on purpose. The verification half travels to every service — and,
+ * once buyers can sign in, to the public storefront — so it must be material
+ * that cannot mint a token. A shared secret would have put the *signing* key in
+ * the least privileged, highest traffic app in the fleet, where a compromise
+ * mints `super-admin`.
+ */
+export interface JoseTokenServiceOptions {
+    /** Public key, SPKI PEM. Always required — every holder at least verifies. */
+    readonly publicKeyPem: string;
+    /**
+     * Private key, PKCS#8 PEM. Only the service that mints tokens holds one; an
+     * instance without it verifies and refuses to sign.
+     */
+    readonly privateKeyPem?: string;
+    /**
+     * The `kid` header stamped on every signed token, and the name of the key a
+     * JWKS publishes it under. Rotation is two keys sharing a verifier for a
+     * while, which is only expressible if tokens say which key signed them.
+     */
+    readonly keyId: string;
+    /** `iss` claim set on sign and required on verify. */
+    readonly issuer: string;
+    /** `aud` claim set on sign and required on verify. */
+    readonly audience: string;
+}
+/**
+ * Sign {@link TokenClaims} into a compact JWT that expires after `ttlSeconds`.
+ * Exported on its own (not only behind the Effect service) so the same signing
+ * path is testable and reusable outside an Effect runtime.
+ */
+export declare const signAccessToken: (claims: TokenClaims, options: JoseTokenServiceOptions, ttlSeconds: number) => Promise<string>;
+/**
+ * Verify a token's signature, issuer, audience and expiry, returning its
+ * claims. A **pure Promise** so it runs anywhere jose does — notably a Next
+ * middleware / edge runtime where pulling in the Effect runtime is unwanted.
+ * Rejects on any invalid token.
+ *
+ * `algorithms` is pinned to a single value and that is this file's security
+ * boundary: left unset, jose honours the algorithm named in the token's own
+ * header, so a caller could present an `HS256` token and have the public key
+ * treated as a shared secret. One accepted algorithm makes that unexpressible.
+ */
+export declare const verifyAccessToken: (token: string, options: JoseTokenServiceOptions) => Promise<TokenClaims>;
+/**
+ * A `jose`-backed {@link TokenService}. The perimeter provides it with both keys
+ * to mint access tokens from a resolved session; every downstream service
+ * provides it with the public key alone to verify them. Signing failures are
+ * infrastructure errors; a verification failure is the caller presenting a bad
+ * token — an {@link EntifixBuildError}, which the perimeter collapses to `401`.
+ */
+export declare const makeJoseTokenService: (options: JoseTokenServiceOptions) => TokenService;
+//# sourceMappingURL=jose-token-service.d.ts.map

package/dist/token-service/jose-token-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose-token-service.d.ts","sourceRoot":"","sources":["../../src/token-service/jose-token-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAWnE,uFAAuF;AACvF,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAkDD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,WAAW,EACnB,SAAS,uBAAuB,EAChC,YAAY,MAAM,KACjB,OAAO,CAAC,MAAM,CAOmB,CAAC;AAErC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,MAAM,EACb,SAAS,uBAAuB,KAC/B,OAAO,CAAC,WAAW,CAOrB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,SAAS,uBAAuB,KAC/B,YAkBD,CAAC"}

package/dist/token-service/jose-token-service.js

@@ -0,0 +1,80 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { EntifixBuildError, EntifixConnError } from '@entifix/core';
+import { Effect } from 'effect';
+import { importPKCS8, importSPKI, jwtVerify, SignJWT } from 'jose';
+/** The one algorithm this service signs and accepts. See {@link verifyAccessToken}. */ export const TOKEN_ALGORITHM = 'RS256';
+/**
+ * Import a PEM once per options object rather than once per token.
+ *
+ * `importPKCS8`/`importSPKI` are async, but the factory below has to stay
+ * synchronously constructible — every composition root builds it inside
+ * `Layer.succeed`. Caching the *promise* satisfies both: construction returns
+ * immediately, and the parse happens once no matter how many tokens follow.
+ */ const privateKeys = new WeakMap();
+const publicKeys = new WeakMap();
+const cachedKey = (cache, options, load)=>{
+    const cached = cache.get(options);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const loading = load();
+    cache.set(options, loading);
+    return loading;
+};
+/** The private key an options object signs with, or a build error if it has none. */ const signingKey = (options)=>{
+    const { privateKeyPem } = options;
+    if (privateKeyPem === undefined) {
+        return Promise.reject(new EntifixBuildError('This token service holds no private key and cannot sign — it was configured to verify only'));
+    }
+    return cachedKey(privateKeys, options, ()=>importPKCS8(privateKeyPem, TOKEN_ALGORITHM));
+};
+/** The public key an options object verifies with. Cached apart from the private one. */ const verificationKey = (options)=>cachedKey(publicKeys, options, ()=>importSPKI(options.publicKeyPem, TOKEN_ALGORITHM));
+/**
+ * Sign {@link TokenClaims} into a compact JWT that expires after `ttlSeconds`.
+ * Exported on its own (not only behind the Effect service) so the same signing
+ * path is testable and reusable outside an Effect runtime.
+ */ export const signAccessToken = async (claims, options, ttlSeconds)=>new SignJWT(_extends({}, claims)).setProtectedHeader({
+        alg: TOKEN_ALGORITHM,
+        kid: options.keyId
+    }).setIssuedAt().setIssuer(options.issuer).setAudience(options.audience).setExpirationTime(`${ttlSeconds}s`).sign(await signingKey(options));
+/**
+ * Verify a token's signature, issuer, audience and expiry, returning its
+ * claims. A **pure Promise** so it runs anywhere jose does — notably a Next
+ * middleware / edge runtime where pulling in the Effect runtime is unwanted.
+ * Rejects on any invalid token.
+ *
+ * `algorithms` is pinned to a single value and that is this file's security
+ * boundary: left unset, jose honours the algorithm named in the token's own
+ * header, so a caller could present an `HS256` token and have the public key
+ * treated as a shared secret. One accepted algorithm makes that unexpressible.
+ */ export const verifyAccessToken = async (token, options)=>{
+    const { payload } = await jwtVerify(token, await verificationKey(options), {
+        algorithms: [
+            TOKEN_ALGORITHM
+        ],
+        issuer: options.issuer,
+        audience: options.audience
+    });
+    return payload;
+};
+/**
+ * A `jose`-backed {@link TokenService}. The perimeter provides it with both keys
+ * to mint access tokens from a resolved session; every downstream service
+ * provides it with the public key alone to verify them. Signing failures are
+ * infrastructure errors; a verification failure is the caller presenting a bad
+ * token — an {@link EntifixBuildError}, which the perimeter collapses to `401`.
+ */ export const makeJoseTokenService = (options)=>({
+        sign: (claims, ttlSeconds)=>Effect.tryPromise({
+                try: ()=>signAccessToken(claims, options, ttlSeconds),
+                // A missing private key is a misconfiguration, not a connectivity
+                // problem, and it must not be reported as one: it surfaces as the build
+                // error it already is rather than being wrapped into a retryable shape.
+                catch: (error)=>error instanceof EntifixBuildError ? error : new EntifixConnError('Access token signing failed', error)
+            }),
+        verify: (token)=>Effect.tryPromise({
+                try: ()=>verifyAccessToken(token, options),
+                catch: (error)=>new EntifixBuildError('Access token verification failed', error)
+            })
+    });
+
+//# sourceMappingURL=jose-token-service.js.map

package/dist/token-service/jose-token-service.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/token-service/jose-token-service.ts"],"sourcesContent":["import type { TokenClaims, TokenService } from '@entifix/business';\nimport { EntifixBuildError, EntifixConnError } from '@entifix/core';\nimport { Effect } from 'effect';\nimport {\n  type CryptoKey,\n  importPKCS8,\n  importSPKI,\n  jwtVerify,\n  SignJWT,\n} from 'jose';\n\n/** The one algorithm this service signs and accepts. See {@link verifyAccessToken}. */\nexport const TOKEN_ALGORITHM = 'RS256';\n\n/**\n * Settings for signing and verifying access tokens.\n *\n * Asymmetric on purpose. The verification half travels to every service — and,\n * once buyers can sign in, to the public storefront — so it must be material\n * that cannot mint a token. A shared secret would have put the *signing* key in\n * the least privileged, highest traffic app in the fleet, where a compromise\n * mints `super-admin`.\n */\nexport interface JoseTokenServiceOptions {\n  /** Public key, SPKI PEM. Always required — every holder at least verifies. */\n  readonly publicKeyPem: string;\n  /**\n   * Private key, PKCS#8 PEM. Only the service that mints tokens holds one; an\n   * instance without it verifies and refuses to sign.\n   */\n  readonly privateKeyPem?: string;\n  /**\n   * The `kid` header stamped on every signed token, and the name of the key a\n   * JWKS publishes it under. Rotation is two keys sharing a verifier for a\n   * while, which is only expressible if tokens say which key signed them.\n   */\n  readonly keyId: string;\n  /** `iss` claim set on sign and required on verify. */\n  readonly issuer: string;\n  /** `aud` claim set on sign and required on verify. */\n  readonly audience: string;\n}\n\n/**\n * Import a PEM once per options object rather than once per token.\n *\n * `importPKCS8`/`importSPKI` are async, but the factory below has to stay\n * synchronously constructible — every composition root builds it inside\n * `Layer.succeed`. Caching the *promise* satisfies both: construction returns\n * immediately, and the parse happens once no matter how many tokens follow.\n */\nconst privateKeys = new WeakMap<JoseTokenServiceOptions, Promise<CryptoKey>>();\nconst publicKeys = new WeakMap<JoseTokenServiceOptions, Promise<CryptoKey>>();\n\nconst cachedKey = (\n  cache: WeakMap<JoseTokenServiceOptions, Promise<CryptoKey>>,\n  options: JoseTokenServiceOptions,\n  load: () => Promise<CryptoKey>,\n): Promise<CryptoKey> => {\n  const cached = cache.get(options);\n  if (cached !== undefined) {\n    return cached;\n  }\n  const loading = load();\n  cache.set(options, loading);\n  return loading;\n};\n\n/** The private key an options object signs with, or a build error if it has none. */\nconst signingKey = (options: JoseTokenServiceOptions): Promise<CryptoKey> => {\n  const { privateKeyPem } = options;\n  if (privateKeyPem === undefined) {\n    return Promise.reject(\n      new EntifixBuildError(\n        'This token service holds no private key and cannot sign — it was configured to verify only',\n      ),\n    );\n  }\n  return cachedKey(privateKeys, options, () =>\n    importPKCS8(privateKeyPem, TOKEN_ALGORITHM),\n  );\n};\n\n/** The public key an options object verifies with. Cached apart from the private one. */\nconst verificationKey = (\n  options: JoseTokenServiceOptions,\n): Promise<CryptoKey> =>\n  cachedKey(publicKeys, options, () =>\n    importSPKI(options.publicKeyPem, TOKEN_ALGORITHM),\n  );\n\n/**\n * Sign {@link TokenClaims} into a compact JWT that expires after `ttlSeconds`.\n * Exported on its own (not only behind the Effect service) so the same signing\n * path is testable and reusable outside an Effect runtime.\n */\nexport const signAccessToken = async (\n  claims: TokenClaims,\n  options: JoseTokenServiceOptions,\n  ttlSeconds: number,\n): Promise<string> =>\n  new SignJWT({ ...claims })\n    .setProtectedHeader({ alg: TOKEN_ALGORITHM, kid: options.keyId })\n    .setIssuedAt()\n    .setIssuer(options.issuer)\n    .setAudience(options.audience)\n    .setExpirationTime(`${ttlSeconds}s`)\n    .sign(await signingKey(options));\n\n/**\n * Verify a token's signature, issuer, audience and expiry, returning its\n * claims. A **pure Promise** so it runs anywhere jose does — notably a Next\n * middleware / edge runtime where pulling in the Effect runtime is unwanted.\n * Rejects on any invalid token.\n *\n * `algorithms` is pinned to a single value and that is this file's security\n * boundary: left unset, jose honours the algorithm named in the token's own\n * header, so a caller could present an `HS256` token and have the public key\n * treated as a shared secret. One accepted algorithm makes that unexpressible.\n */\nexport const verifyAccessToken = async (\n  token: string,\n  options: JoseTokenServiceOptions,\n): Promise<TokenClaims> => {\n  const { payload } = await jwtVerify(token, await verificationKey(options), {\n    algorithms: [TOKEN_ALGORITHM],\n    issuer: options.issuer,\n    audience: options.audience,\n  });\n  return payload as unknown as TokenClaims;\n};\n\n/**\n * A `jose`-backed {@link TokenService}. The perimeter provides it with both keys\n * to mint access tokens from a resolved session; every downstream service\n * provides it with the public key alone to verify them. Signing failures are\n * infrastructure errors; a verification failure is the caller presenting a bad\n * token — an {@link EntifixBuildError}, which the perimeter collapses to `401`.\n */\nexport const makeJoseTokenService = (\n  options: JoseTokenServiceOptions,\n): TokenService => ({\n  sign: (claims, ttlSeconds) =>\n    Effect.tryPromise({\n      try: () => signAccessToken(claims, options, ttlSeconds),\n      // A missing private key is a misconfiguration, not a connectivity\n      // problem, and it must not be reported as one: it surfaces as the build\n      // error it already is rather than being wrapped into a retryable shape.\n      catch: error =>\n        error instanceof EntifixBuildError\n          ? error\n          : new EntifixConnError('Access token signing failed', error),\n    }),\n  verify: token =>\n    Effect.tryPromise({\n      try: () => verifyAccessToken(token, options),\n      catch: error =>\n        new EntifixBuildError('Access token verification failed', error),\n    }),\n});\n"],"names":["EntifixBuildError","EntifixConnError","Effect","importPKCS8","importSPKI","jwtVerify","SignJWT","TOKEN_ALGORITHM","privateKeys","WeakMap","publicKeys","cachedKey","cache","options","load","cached","get","undefined","loading","set","signingKey","privateKeyPem","Promise","reject","verificationKey","publicKeyPem","signAccessToken","claims","ttlSeconds","setProtectedHeader","alg","kid","keyId","setIssuedAt","setIssuer","issuer","setAudience","audience","setExpirationTime","sign","verifyAccessToken","token","payload","algorithms","makeJoseTokenService","tryPromise","try","catch","error","verify"],"mappings":";AACA,SAASA,iBAAiB,EAAEC,gBAAgB,QAAQ,gBAAgB;AACpE,SAASC,MAAM,QAAQ,SAAS;AAChC,SAEEC,WAAW,EACXC,UAAU,EACVC,SAAS,EACTC,OAAO,QACF,OAAO;AAEd,qFAAqF,GACrF,OAAO,MAAMC,kBAAkB,QAAQ;AA+BvC;;;;;;;CAOC,GACD,MAAMC,cAAc,IAAIC;AACxB,MAAMC,aAAa,IAAID;AAEvB,MAAME,YAAY,CAChBC,OACAC,SACAC;IAEA,MAAMC,SAASH,MAAMI,GAAG,CAACH;IACzB,IAAIE,WAAWE,WAAW;QACxB,OAAOF;IACT;IACA,MAAMG,UAAUJ;IAChBF,MAAMO,GAAG,CAACN,SAASK;IACnB,OAAOA;AACT;AAEA,mFAAmF,GACnF,MAAME,aAAa,CAACP;IAClB,MAAM,EAAEQ,aAAa,EAAE,GAAGR;IAC1B,IAAIQ,kBAAkBJ,WAAW;QAC/B,OAAOK,QAAQC,MAAM,CACnB,IAAIvB,kBACF;IAGN;IACA,OAAOW,UAAUH,aAAaK,SAAS,IACrCV,YAAYkB,eAAed;AAE/B;AAEA,uFAAuF,GACvF,MAAMiB,kBAAkB,CACtBX,UAEAF,UAAUD,YAAYG,SAAS,IAC7BT,WAAWS,QAAQY,YAAY,EAAElB;AAGrC;;;;CAIC,GACD,OAAO,MAAMmB,kBAAkB,OAC7BC,QACAd,SACAe,aAEA,IAAItB,QAAQ,aAAKqB,SACdE,kBAAkB,CAAC;QAAEC,KAAKvB;QAAiBwB,KAAKlB,QAAQmB,KAAK;IAAC,GAC9DC,WAAW,GACXC,SAAS,CAACrB,QAAQsB,MAAM,EACxBC,WAAW,CAACvB,QAAQwB,QAAQ,EAC5BC,iBAAiB,CAAC,GAAGV,WAAW,CAAC,CAAC,EAClCW,IAAI,CAAC,MAAMnB,WAAWP,UAAU;AAErC;;;;;;;;;;CAUC,GACD,OAAO,MAAM2B,oBAAoB,OAC/BC,OACA5B;IAEA,MAAM,EAAE6B,OAAO,EAAE,GAAG,MAAMrC,UAAUoC,OAAO,MAAMjB,gBAAgBX,UAAU;QACzE8B,YAAY;YAACpC;SAAgB;QAC7B4B,QAAQtB,QAAQsB,MAAM;QACtBE,UAAUxB,QAAQwB,QAAQ;IAC5B;IACA,OAAOK;AACT,EAAE;AAEF;;;;;;CAMC,GACD,OAAO,MAAME,uBAAuB,CAClC/B,UACkB,CAAA;QAClB0B,MAAM,CAACZ,QAAQC,aACb1B,OAAO2C,UAAU,CAAC;gBAChBC,KAAK,IAAMpB,gBAAgBC,QAAQd,SAASe;gBAC5C,kEAAkE;gBAClE,wEAAwE;gBACxE,wEAAwE;gBACxEmB,OAAOC,CAAAA,QACLA,iBAAiBhD,oBACbgD,QACA,IAAI/C,iBAAiB,+BAA+B+C;YAC5D;QACFC,QAAQR,CAAAA,QACNvC,OAAO2C,UAAU,CAAC;gBAChBC,KAAK,IAAMN,kBAAkBC,OAAO5B;gBACpCkC,OAAOC,CAAAA,QACL,IAAIhD,kBAAkB,oCAAoCgD;YAC9D;IACJ,CAAA,EAAG"}

package/dist/token-service/jwks.d.ts

@@ -0,0 +1,17 @@
+import { type JSONWebKeySet } from 'jose';
+/**
+ * The service's public signing key as a JWK Set, ready to serve at
+ * `/.well-known/jwks.json`.
+ *
+ * Services in this fleet do **not** need it: each resolves `jwt.publicKey` from
+ * config-service at boot and verifies locally, so no verification depends on
+ * the minting service being reachable. The endpoint exists for the consumers
+ * that cannot do that — a browser or edge runtime holding no fleet
+ * configuration — and because publishing a key set is the interoperable shape
+ * every OIDC client already knows how to consume.
+ *
+ * Serving it unauthenticated is the point: a public key is public, and
+ * withholding it protects nothing while breaking every standard client.
+ */
+export declare const publicJwks: (publicKeyPem: string, keyId: string) => Promise<JSONWebKeySet>;
+//# sourceMappingURL=jwks.d.ts.map

package/dist/token-service/jwks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../../src/token-service/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,aAAa,EAAE,MAAM,MAAM,CAAC;AAIjE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,GACrB,cAAc,MAAM,EACpB,OAAO,MAAM,KACZ,OAAO,CAAC,aAAa,CAevB,CAAC"}

package/dist/token-service/jwks.js

@@ -0,0 +1,33 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { exportJWK, importSPKI } from 'jose';
+import { TOKEN_ALGORITHM } from './jose-token-service.js';
+/**
+ * The service's public signing key as a JWK Set, ready to serve at
+ * `/.well-known/jwks.json`.
+ *
+ * Services in this fleet do **not** need it: each resolves `jwt.publicKey` from
+ * config-service at boot and verifies locally, so no verification depends on
+ * the minting service being reachable. The endpoint exists for the consumers
+ * that cannot do that — a browser or edge runtime holding no fleet
+ * configuration — and because publishing a key set is the interoperable shape
+ * every OIDC client already knows how to consume.
+ *
+ * Serving it unauthenticated is the point: a public key is public, and
+ * withholding it protects nothing while breaking every standard client.
+ */ export const publicJwks = async (publicKeyPem, keyId)=>{
+    const key = await importSPKI(publicKeyPem, TOKEN_ALGORITHM);
+    return {
+        keys: [
+            _extends({}, await exportJWK(key), {
+                kid: keyId,
+                // `use` and `alg` are advisory, and they are what stop a client from
+                // trying this key for encryption or for an algorithm it was never
+                // issued for.
+                use: 'sig',
+                alg: TOKEN_ALGORITHM
+            })
+        ]
+    };
+};
+
+//# sourceMappingURL=jwks.js.map

package/dist/token-service/jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/token-service/jwks.ts"],"sourcesContent":["import { exportJWK, importSPKI, type JSONWebKeySet } from 'jose';\n\nimport { TOKEN_ALGORITHM } from './jose-token-service.js';\n\n/**\n * The service's public signing key as a JWK Set, ready to serve at\n * `/.well-known/jwks.json`.\n *\n * Services in this fleet do **not** need it: each resolves `jwt.publicKey` from\n * config-service at boot and verifies locally, so no verification depends on\n * the minting service being reachable. The endpoint exists for the consumers\n * that cannot do that — a browser or edge runtime holding no fleet\n * configuration — and because publishing a key set is the interoperable shape\n * every OIDC client already knows how to consume.\n *\n * Serving it unauthenticated is the point: a public key is public, and\n * withholding it protects nothing while breaking every standard client.\n */\nexport const publicJwks = async (\n  publicKeyPem: string,\n  keyId: string,\n): Promise<JSONWebKeySet> => {\n  const key = await importSPKI(publicKeyPem, TOKEN_ALGORITHM);\n  return {\n    keys: [\n      {\n        ...(await exportJWK(key)),\n        kid: keyId,\n        // `use` and `alg` are advisory, and they are what stop a client from\n        // trying this key for encryption or for an algorithm it was never\n        // issued for.\n        use: 'sig',\n        alg: TOKEN_ALGORITHM,\n      },\n    ],\n  };\n};\n"],"names":["exportJWK","importSPKI","TOKEN_ALGORITHM","publicJwks","publicKeyPem","keyId","key","keys","kid","use","alg"],"mappings":";AAAA,SAASA,SAAS,EAAEC,UAAU,QAA4B,OAAO;AAEjE,SAASC,eAAe,QAAQ,0BAA0B;AAE1D;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,aAAa,OACxBC,cACAC;IAEA,MAAMC,MAAM,MAAML,WAAWG,cAAcF;IAC3C,OAAO;QACLK,MAAM;YACJ,aACM,MAAMP,UAAUM;gBACpBE,KAAKH;gBACL,qEAAqE;gBACrE,kEAAkE;gBAClE,cAAc;gBACdI,KAAK;gBACLC,KAAKR;;SAER;IACH;AACF,EAAE"}

package/dist/token-service/unverified-claims.d.ts

@@ -0,0 +1,18 @@
+import type { TokenClaims } from '@entifix/business';
+/**
+ * Read a token's claims **without checking its signature**.
+ *
+ * ⚠️ This proves nothing. A caller can forge any claims it likes. Use it only
+ * for presentation — deciding which nav entries to render, say — where being
+ * wrong costs a menu item and every request behind that item is still refused
+ * by the service's `requirePermission`. Never branch on it for access.
+ *
+ * It exists so a Next server component can shape a menu without either calling
+ * a service on every render or copying `jwt.secret` out of config-service into
+ * the app runtime. Anything that must be *true* goes to
+ * {@link verifyAccessToken} or to the owning service.
+ *
+ * Returns `undefined` for anything that is not a well-formed JWT payload.
+ */
+export declare const unverifiedClaims: (token: string) => TokenClaims | undefined;
+//# sourceMappingURL=unverified-claims.d.ts.map

package/dist/token-service/unverified-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unverified-claims.d.ts","sourceRoot":"","sources":["../../src/token-service/unverified-claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAiBrD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,WAAW,GAAG,SAa9D,CAAC"}

package/dist/token-service/unverified-claims.js

@@ -0,0 +1,38 @@
+/**
+ * Base64url → JSON. `atob` + `TextDecoder` rather than `Buffer` so the same
+ * function runs in Node, the browser and the edge runtime unchanged.
+ */ const decodeSegment = (segment)=>{
+    const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64.padEnd(base64.length + (4 - base64.length % 4) % 4, '=');
+    const binary = atob(padded);
+    const bytes = Uint8Array.from(binary, (character)=>character.charCodeAt(0));
+    return JSON.parse(new TextDecoder().decode(bytes));
+};
+/**
+ * Read a token's claims **without checking its signature**.
+ *
+ * ⚠️ This proves nothing. A caller can forge any claims it likes. Use it only
+ * for presentation — deciding which nav entries to render, say — where being
+ * wrong costs a menu item and every request behind that item is still refused
+ * by the service's `requirePermission`. Never branch on it for access.
+ *
+ * It exists so a Next server component can shape a menu without either calling
+ * a service on every render or copying `jwt.secret` out of config-service into
+ * the app runtime. Anything that must be *true* goes to
+ * {@link verifyAccessToken} or to the owning service.
+ *
+ * Returns `undefined` for anything that is not a well-formed JWT payload.
+ */ export const unverifiedClaims = (token)=>{
+    const [, payloadSegment, signature] = token.split('.');
+    if (payloadSegment === undefined || signature === undefined) {
+        return undefined;
+    }
+    try {
+        const payload = decodeSegment(payloadSegment);
+        return typeof payload === 'object' && payload !== null ? payload : undefined;
+    } catch (unused) {
+        return undefined;
+    }
+};
+
+//# sourceMappingURL=unverified-claims.js.map

package/dist/token-service/unverified-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/token-service/unverified-claims.ts"],"sourcesContent":["import type { TokenClaims } from '@entifix/business';\n\n/**\n * Base64url → JSON. `atob` + `TextDecoder` rather than `Buffer` so the same\n * function runs in Node, the browser and the edge runtime unchanged.\n */\nconst decodeSegment = (segment: string): unknown => {\n  const base64 = segment.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = base64.padEnd(\n    base64.length + ((4 - (base64.length % 4)) % 4),\n    '=',\n  );\n  const binary = atob(padded);\n  const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));\n  return JSON.parse(new TextDecoder().decode(bytes));\n};\n\n/**\n * Read a token's claims **without checking its signature**.\n *\n * ⚠️ This proves nothing. A caller can forge any claims it likes. Use it only\n * for presentation — deciding which nav entries to render, say — where being\n * wrong costs a menu item and every request behind that item is still refused\n * by the service's `requirePermission`. Never branch on it for access.\n *\n * It exists so a Next server component can shape a menu without either calling\n * a service on every render or copying `jwt.secret` out of config-service into\n * the app runtime. Anything that must be *true* goes to\n * {@link verifyAccessToken} or to the owning service.\n *\n * Returns `undefined` for anything that is not a well-formed JWT payload.\n */\nexport const unverifiedClaims = (token: string): TokenClaims | undefined => {\n  const [, payloadSegment, signature] = token.split('.');\n  if (payloadSegment === undefined || signature === undefined) {\n    return undefined;\n  }\n  try {\n    const payload = decodeSegment(payloadSegment);\n    return typeof payload === 'object' && payload !== null\n      ? (payload as TokenClaims)\n      : undefined;\n  } catch {\n    return undefined;\n  }\n};\n"],"names":["decodeSegment","segment","base64","replace","padded","padEnd","length","binary","atob","bytes","Uint8Array","from","character","charCodeAt","JSON","parse","TextDecoder","decode","unverifiedClaims","token","payloadSegment","signature","split","undefined","payload"],"mappings":"AAEA;;;CAGC,GACD,MAAMA,gBAAgB,CAACC;IACrB,MAAMC,SAASD,QAAQE,OAAO,CAAC,MAAM,KAAKA,OAAO,CAAC,MAAM;IACxD,MAAMC,SAASF,OAAOG,MAAM,CAC1BH,OAAOI,MAAM,GAAI,AAAC,CAAA,IAAKJ,OAAOI,MAAM,GAAG,CAAC,IAAK,GAC7C;IAEF,MAAMC,SAASC,KAAKJ;IACpB,MAAMK,QAAQC,WAAWC,IAAI,CAACJ,QAAQK,CAAAA,YAAaA,UAAUC,UAAU,CAAC;IACxE,OAAOC,KAAKC,KAAK,CAAC,IAAIC,cAAcC,MAAM,CAACR;AAC7C;AAEA;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMS,mBAAmB,CAACC;IAC/B,MAAM,GAAGC,gBAAgBC,UAAU,GAAGF,MAAMG,KAAK,CAAC;IAClD,IAAIF,mBAAmBG,aAAaF,cAAcE,WAAW;QAC3D,OAAOA;IACT;IACA,IAAI;QACF,MAAMC,UAAUxB,cAAcoB;QAC9B,OAAO,OAAOI,YAAY,YAAYA,YAAY,OAC7CA,UACDD;IACN,EAAE,eAAM;QACN,OAAOA;IACT;AACF,EAAE"}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@entifix/jwt",
+  "version": "0.1.0-0",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/r10c-technologies/entifix.git",
+    "directory": "packages/ts/jwt-client"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "@entifix/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!**/*.tsbuildinfo",
+    "LICENSE"
+  ],
+  "nx": {
+    "tags": [
+      "layer:entifix",
+      "scope:shared",
+      "entifix:client",
+      "tier:2"
+    ],
+    "sourceRoot": "packages/ts/jwt-client/src",
+    "targets": {
+      "build": {
+        "executor": "@nx/js:swc",
+        "outputs": [
+          "{options.outputPath}"
+        ],
+        "options": {
+          "outputPath": "packages/ts/jwt-client/dist",
+          "main": "packages/ts/jwt-client/src/index.ts",
+          "tsConfig": "packages/ts/jwt-client/tsconfig.lib.json",
+          "skipTypeCheck": true,
+          "stripLeadingPaths": true
+        }
+      }
+    }
+  },
+  "dependencies": {
+    "@swc/helpers": "0.5.23",
+    "jose": "6.2.8",
+    "@entifix/business": "0.1.0-0",
+    "@entifix/core": "0.1.0-0"
+  },
+  "devDependencies": {
+    "effect": "3.22.1",
+    "@entifix/testing-unit": "0.1.0-0"
+  },
+  "peerDependencies": {
+    "effect": ">=3.22 <4"
+  }
+}