@entifix/jwt 0.9.0 → 0.10.0

package/dist/token-service/jose-token-service.d.ts

@@ -1,4 +1,4 @@
-import type { TokenClaims, TokenService } from '@entifix/business';
+import { type TokenClaims, type TokenService } from '@entifix/business';
 /** The one algorithm this service signs and accepts. See {@link verifyAccessToken}. */
 export declare const TOKEN_ALGORITHM = "RS256";
 /**
@@ -50,9 +50,9 @@ export declare const verifyAccessToken: (token: string, options: JoseTokenServic
 /**
  * A `jose`-backed {@link TokenService}. The perimeter provides it with both keys
  * to mint access tokens from a resolved session; every downstream service
- * provides it with the public key alone to verify them. Signing failures are
- * infrastructure errors; a verification failure is the caller presenting a bad
- * token — an {@link EntifixBuildError}, which the perimeter collapses to `401`.
+ * provides it with the public key alone to verify them. A signing failure is
+ * `Internal`; a verification failure is the caller presenting a bad
+ * token — an `InvalidToken` or an `ExpiredToken`, both `unauthenticated`, so a `401`.
  */
 export declare const makeJoseTokenService: (options: JoseTokenServiceOptions) => TokenService;
 //# sourceMappingURL=jose-token-service.d.ts.map

package/dist/token-service/jose-token-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jose-token-service.d.ts","sourceRoot":"","sources":["../../src/token-service/jose-token-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAWnE,uFAAuF;AACvF,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAkDD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,WAAW,EACnB,SAAS,uBAAuB,EAChC,YAAY,MAAM,KACjB,OAAO,CAAC,MAAM,CAOmB,CAAC;AAErC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,MAAM,EACb,SAAS,uBAAuB,KAC/B,OAAO,CAAC,WAAW,CAOrB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,SAAS,uBAAuB,KAC/B,YAkBD,CAAC"}
+{"version":3,"file":"jose-token-service.d.ts","sourceRoot":"","sources":["../../src/token-service/jose-token-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAW3B,uFAAuF;AACvF,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAkDD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,QAAQ,WAAW,EACnB,SAAS,uBAAuB,EAChC,YAAY,MAAM,KACjB,OAAO,CAAC,MAAM,CAOmB,CAAC;AAErC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,MAAM,EACb,SAAS,uBAAuB,KAC/B,OAAO,CAAC,WAAW,CAOrB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,SAAS,uBAAuB,KAC/B,YAaD,CAAC"}

package/dist/token-service/jose-token-service.js

@@ -1,5 +1,6 @@
 import { _ as _extends } from "@swc/helpers/_/_extends";
-import { EntifixBuildError, EntifixConnError } from '@entifix/core';
+import { tokenFailureFrom } from '@entifix/business';
+import { Internal } from '@entifix/core';
 import { Effect } from 'effect';
 import { importPKCS8, importSPKI, jwtVerify, SignJWT } from 'jose';
 /** The one algorithm this service signs and accepts. See {@link verifyAccessToken}. */ export const TOKEN_ALGORITHM = 'RS256';
@@ -21,10 +22,12 @@ const cachedKey = (cache, options, load)=>{
     cache.set(options, loading);
     return loading;
 };
-/** The private key an options object signs with, or a build error if it has none. */ const signingKey = (options)=>{
+/** The private key an options object signs with, or `Internal` if it has none. */ const signingKey = (options)=>{
     const { privateKeyPem } = options;
     if (privateKeyPem === undefined) {
-        return Promise.reject(new EntifixBuildError('This token service holds no private key and cannot sign — it was configured to verify only'));
+        return Promise.reject(// A misconfiguration, not a connectivity problem: a verify-only
+        // service asked to sign is a composition bug, never worth a retry.
+        new Internal());
     }
     return cachedKey(privateKeys, options, ()=>importPKCS8(privateKeyPem, TOKEN_ALGORITHM));
 };
@@ -60,20 +63,19 @@ const cachedKey = (cache, options, load)=>{
 /**
  * A `jose`-backed {@link TokenService}. The perimeter provides it with both keys
  * to mint access tokens from a resolved session; every downstream service
- * provides it with the public key alone to verify them. Signing failures are
- * infrastructure errors; a verification failure is the caller presenting a bad
- * token — an {@link EntifixBuildError}, which the perimeter collapses to `401`.
+ * provides it with the public key alone to verify them. A signing failure is
+ * `Internal`; a verification failure is the caller presenting a bad
+ * token — an `InvalidToken` or an `ExpiredToken`, both `unauthenticated`, so a `401`.
  */ export const makeJoseTokenService = (options)=>({
         sign: (claims, ttlSeconds)=>Effect.tryPromise({
                 try: ()=>signAccessToken(claims, options, ttlSeconds),
-                // A missing private key is a misconfiguration, not a connectivity
-                // problem, and it must not be reported as one: it surfaces as the build
-                // error it already is rather than being wrapped into a retryable shape.
-                catch: (error)=>error instanceof EntifixBuildError ? error : new EntifixConnError('Access token signing failed', error)
+                // Signing is local: no key, a key that will not import, a claim set
+                // jose refuses — every one is this process's bug, never a dependency's.
+                catch: ()=>new Internal()
             }),
         verify: (token)=>Effect.tryPromise({
                 try: ()=>verifyAccessToken(token, options),
-                catch: (error)=>new EntifixBuildError('Access token verification failed', error)
+                catch: (error)=>tokenFailureFrom(error)
             })
     });
 

package/dist/token-service/jose-token-service.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/token-service/jose-token-service.ts"],"sourcesContent":["import type { TokenClaims, TokenService } from '@entifix/business';\nimport { EntifixBuildError, EntifixConnError } from '@entifix/core';\nimport { Effect } from 'effect';\nimport {\n  type CryptoKey,\n  importPKCS8,\n  importSPKI,\n  jwtVerify,\n  SignJWT,\n} from 'jose';\n\n/** The one algorithm this service signs and accepts. See {@link verifyAccessToken}. */\nexport const TOKEN_ALGORITHM = 'RS256';\n\n/**\n * Settings for signing and verifying access tokens.\n *\n * Asymmetric on purpose. The verification half travels to every service — and,\n * once buyers can sign in, to the public storefront — so it must be material\n * that cannot mint a token. A shared secret would have put the *signing* key in\n * the least privileged, highest traffic app in the fleet, where a compromise\n * mints `super-admin`.\n */\nexport interface JoseTokenServiceOptions {\n  /** Public key, SPKI PEM. Always required — every holder at least verifies. */\n  readonly publicKeyPem: string;\n  /**\n   * Private key, PKCS#8 PEM. Only the service that mints tokens holds one; an\n   * instance without it verifies and refuses to sign.\n   */\n  readonly privateKeyPem?: string;\n  /**\n   * The `kid` header stamped on every signed token, and the name of the key a\n   * JWKS publishes it under. Rotation is two keys sharing a verifier for a\n   * while, which is only expressible if tokens say which key signed them.\n   */\n  readonly keyId: string;\n  /** `iss` claim set on sign and required on verify. */\n  readonly issuer: string;\n  /** `aud` claim set on sign and required on verify. */\n  readonly audience: string;\n}\n\n/**\n * Import a PEM once per options object rather than once per token.\n *\n * `importPKCS8`/`importSPKI` are async, but the factory below has to stay\n * synchronously constructible — every composition root builds it inside\n * `Layer.succeed`. Caching the *promise* satisfies both: construction returns\n * immediately, and the parse happens once no matter how many tokens follow.\n */\nconst privateKeys = new WeakMap<JoseTokenServiceOptions, Promise<CryptoKey>>();\nconst publicKeys = new WeakMap<JoseTokenServiceOptions, Promise<CryptoKey>>();\n\nconst cachedKey = (\n  cache: WeakMap<JoseTokenServiceOptions, Promise<CryptoKey>>,\n  options: JoseTokenServiceOptions,\n  load: () => Promise<CryptoKey>,\n): Promise<CryptoKey> => {\n  const cached = cache.get(options);\n  if (cached !== undefined) {\n    return cached;\n  }\n  const loading = load();\n  cache.set(options, loading);\n  return loading;\n};\n\n/** The private key an options object signs with, or a build error if it has none. */\nconst signingKey = (options: JoseTokenServiceOptions): Promise<CryptoKey> => {\n  const { privateKeyPem } = options;\n  if (privateKeyPem === undefined) {\n    return Promise.reject(\n      new EntifixBuildError(\n        'This token service holds no private key and cannot sign — it was configured to verify only',\n      ),\n    );\n  }\n  return cachedKey(privateKeys, options, () =>\n    importPKCS8(privateKeyPem, TOKEN_ALGORITHM),\n  );\n};\n\n/** The public key an options object verifies with. Cached apart from the private one. */\nconst verificationKey = (\n  options: JoseTokenServiceOptions,\n): Promise<CryptoKey> =>\n  cachedKey(publicKeys, options, () =>\n    importSPKI(options.publicKeyPem, TOKEN_ALGORITHM),\n  );\n\n/**\n * Sign {@link TokenClaims} into a compact JWT that expires after `ttlSeconds`.\n * Exported on its own (not only behind the Effect service) so the same signing\n * path is testable and reusable outside an Effect runtime.\n */\nexport const signAccessToken = async (\n  claims: TokenClaims,\n  options: JoseTokenServiceOptions,\n  ttlSeconds: number,\n): Promise<string> =>\n  new SignJWT({ ...claims })\n    .setProtectedHeader({ alg: TOKEN_ALGORITHM, kid: options.keyId })\n    .setIssuedAt()\n    .setIssuer(options.issuer)\n    .setAudience(options.audience)\n    .setExpirationTime(`${ttlSeconds}s`)\n    .sign(await signingKey(options));\n\n/**\n * Verify a token's signature, issuer, audience and expiry, returning its\n * claims. A **pure Promise** so it runs anywhere jose does — notably a Next\n * middleware / edge runtime where pulling in the Effect runtime is unwanted.\n * Rejects on any invalid token.\n *\n * `algorithms` is pinned to a single value and that is this file's security\n * boundary: left unset, jose honours the algorithm named in the token's own\n * header, so a caller could present an `HS256` token and have the public key\n * treated as a shared secret. One accepted algorithm makes that unexpressible.\n */\nexport const verifyAccessToken = async (\n  token: string,\n  options: JoseTokenServiceOptions,\n): Promise<TokenClaims> => {\n  const { payload } = await jwtVerify(token, await verificationKey(options), {\n    algorithms: [TOKEN_ALGORITHM],\n    issuer: options.issuer,\n    audience: options.audience,\n  });\n  return payload as unknown as TokenClaims;\n};\n\n/**\n * A `jose`-backed {@link TokenService}. The perimeter provides it with both keys\n * to mint access tokens from a resolved session; every downstream service\n * provides it with the public key alone to verify them. Signing failures are\n * infrastructure errors; a verification failure is the caller presenting a bad\n * token — an {@link EntifixBuildError}, which the perimeter collapses to `401`.\n */\nexport const makeJoseTokenService = (\n  options: JoseTokenServiceOptions,\n): TokenService => ({\n  sign: (claims, ttlSeconds) =>\n    Effect.tryPromise({\n      try: () => signAccessToken(claims, options, ttlSeconds),\n      // A missing private key is a misconfiguration, not a connectivity\n      // problem, and it must not be reported as one: it surfaces as the build\n      // error it already is rather than being wrapped into a retryable shape.\n      catch: error =>\n        error instanceof EntifixBuildError\n          ? error\n          : new EntifixConnError('Access token signing failed', error),\n    }),\n  verify: token =>\n    Effect.tryPromise({\n      try: () => verifyAccessToken(token, options),\n      catch: error =>\n        new EntifixBuildError('Access token verification failed', error),\n    }),\n});\n"],"names":["EntifixBuildError","EntifixConnError","Effect","importPKCS8","importSPKI","jwtVerify","SignJWT","TOKEN_ALGORITHM","privateKeys","WeakMap","publicKeys","cachedKey","cache","options","load","cached","get","undefined","loading","set","signingKey","privateKeyPem","Promise","reject","verificationKey","publicKeyPem","signAccessToken","claims","ttlSeconds","setProtectedHeader","alg","kid","keyId","setIssuedAt","setIssuer","issuer","setAudience","audience","setExpirationTime","sign","verifyAccessToken","token","payload","algorithms","makeJoseTokenService","tryPromise","try","catch","error","verify"],"mappings":";AACA,SAASA,iBAAiB,EAAEC,gBAAgB,QAAQ,gBAAgB;AACpE,SAASC,MAAM,QAAQ,SAAS;AAChC,SAEEC,WAAW,EACXC,UAAU,EACVC,SAAS,EACTC,OAAO,QACF,OAAO;AAEd,qFAAqF,GACrF,OAAO,MAAMC,kBAAkB,QAAQ;AA+BvC;;;;;;;CAOC,GACD,MAAMC,cAAc,IAAIC;AACxB,MAAMC,aAAa,IAAID;AAEvB,MAAME,YAAY,CAChBC,OACAC,SACAC;IAEA,MAAMC,SAASH,MAAMI,GAAG,CAACH;IACzB,IAAIE,WAAWE,WAAW;QACxB,OAAOF;IACT;IACA,MAAMG,UAAUJ;IAChBF,MAAMO,GAAG,CAACN,SAASK;IACnB,OAAOA;AACT;AAEA,mFAAmF,GACnF,MAAME,aAAa,CAACP;IAClB,MAAM,EAAEQ,aAAa,EAAE,GAAGR;IAC1B,IAAIQ,kBAAkBJ,WAAW;QAC/B,OAAOK,QAAQC,MAAM,CACnB,IAAIvB,kBACF;IAGN;IACA,OAAOW,UAAUH,aAAaK,SAAS,IACrCV,YAAYkB,eAAed;AAE/B;AAEA,uFAAuF,GACvF,MAAMiB,kBAAkB,CACtBX,UAEAF,UAAUD,YAAYG,SAAS,IAC7BT,WAAWS,QAAQY,YAAY,EAAElB;AAGrC;;;;CAIC,GACD,OAAO,MAAMmB,kBAAkB,OAC7BC,QACAd,SACAe,aAEA,IAAItB,QAAQ,aAAKqB,SACdE,kBAAkB,CAAC;QAAEC,KAAKvB;QAAiBwB,KAAKlB,QAAQmB,KAAK;IAAC,GAC9DC,WAAW,GACXC,SAAS,CAACrB,QAAQsB,MAAM,EACxBC,WAAW,CAACvB,QAAQwB,QAAQ,EAC5BC,iBAAiB,CAAC,GAAGV,WAAW,CAAC,CAAC,EAClCW,IAAI,CAAC,MAAMnB,WAAWP,UAAU;AAErC;;;;;;;;;;CAUC,GACD,OAAO,MAAM2B,oBAAoB,OAC/BC,OACA5B;IAEA,MAAM,EAAE6B,OAAO,EAAE,GAAG,MAAMrC,UAAUoC,OAAO,MAAMjB,gBAAgBX,UAAU;QACzE8B,YAAY;YAACpC;SAAgB;QAC7B4B,QAAQtB,QAAQsB,MAAM;QACtBE,UAAUxB,QAAQwB,QAAQ;IAC5B;IACA,OAAOK;AACT,EAAE;AAEF;;;;;;CAMC,GACD,OAAO,MAAME,uBAAuB,CAClC/B,UACkB,CAAA;QAClB0B,MAAM,CAACZ,QAAQC,aACb1B,OAAO2C,UAAU,CAAC;gBAChBC,KAAK,IAAMpB,gBAAgBC,QAAQd,SAASe;gBAC5C,kEAAkE;gBAClE,wEAAwE;gBACxE,wEAAwE;gBACxEmB,OAAOC,CAAAA,QACLA,iBAAiBhD,oBACbgD,QACA,IAAI/C,iBAAiB,+BAA+B+C;YAC5D;QACFC,QAAQR,CAAAA,QACNvC,OAAO2C,UAAU,CAAC;gBAChBC,KAAK,IAAMN,kBAAkBC,OAAO5B;gBACpCkC,OAAOC,CAAAA,QACL,IAAIhD,kBAAkB,oCAAoCgD;YAC9D;IACJ,CAAA,EAAG"}
+{"version":3,"sources":["../../src/token-service/jose-token-service.ts"],"sourcesContent":["import {\n  type TokenClaims,\n  tokenFailureFrom,\n  type TokenService,\n} from '@entifix/business';\nimport { Internal } from '@entifix/core';\nimport { Effect } from 'effect';\nimport {\n  type CryptoKey,\n  importPKCS8,\n  importSPKI,\n  jwtVerify,\n  SignJWT,\n} from 'jose';\n\n/** The one algorithm this service signs and accepts. See {@link verifyAccessToken}. */\nexport const TOKEN_ALGORITHM = 'RS256';\n\n/**\n * Settings for signing and verifying access tokens.\n *\n * Asymmetric on purpose. The verification half travels to every service — and,\n * once buyers can sign in, to the public storefront — so it must be material\n * that cannot mint a token. A shared secret would have put the *signing* key in\n * the least privileged, highest traffic app in the fleet, where a compromise\n * mints `super-admin`.\n */\nexport interface JoseTokenServiceOptions {\n  /** Public key, SPKI PEM. Always required — every holder at least verifies. */\n  readonly publicKeyPem: string;\n  /**\n   * Private key, PKCS#8 PEM. Only the service that mints tokens holds one; an\n   * instance without it verifies and refuses to sign.\n   */\n  readonly privateKeyPem?: string;\n  /**\n   * The `kid` header stamped on every signed token, and the name of the key a\n   * JWKS publishes it under. Rotation is two keys sharing a verifier for a\n   * while, which is only expressible if tokens say which key signed them.\n   */\n  readonly keyId: string;\n  /** `iss` claim set on sign and required on verify. */\n  readonly issuer: string;\n  /** `aud` claim set on sign and required on verify. */\n  readonly audience: string;\n}\n\n/**\n * Import a PEM once per options object rather than once per token.\n *\n * `importPKCS8`/`importSPKI` are async, but the factory below has to stay\n * synchronously constructible — every composition root builds it inside\n * `Layer.succeed`. Caching the *promise* satisfies both: construction returns\n * immediately, and the parse happens once no matter how many tokens follow.\n */\nconst privateKeys = new WeakMap<JoseTokenServiceOptions, Promise<CryptoKey>>();\nconst publicKeys = new WeakMap<JoseTokenServiceOptions, Promise<CryptoKey>>();\n\nconst cachedKey = (\n  cache: WeakMap<JoseTokenServiceOptions, Promise<CryptoKey>>,\n  options: JoseTokenServiceOptions,\n  load: () => Promise<CryptoKey>,\n): Promise<CryptoKey> => {\n  const cached = cache.get(options);\n  if (cached !== undefined) {\n    return cached;\n  }\n  const loading = load();\n  cache.set(options, loading);\n  return loading;\n};\n\n/** The private key an options object signs with, or `Internal` if it has none. */\nconst signingKey = (options: JoseTokenServiceOptions): Promise<CryptoKey> => {\n  const { privateKeyPem } = options;\n  if (privateKeyPem === undefined) {\n    return Promise.reject(\n      // A misconfiguration, not a connectivity problem: a verify-only\n      // service asked to sign is a composition bug, never worth a retry.\n      new Internal(),\n    );\n  }\n  return cachedKey(privateKeys, options, () =>\n    importPKCS8(privateKeyPem, TOKEN_ALGORITHM),\n  );\n};\n\n/** The public key an options object verifies with. Cached apart from the private one. */\nconst verificationKey = (\n  options: JoseTokenServiceOptions,\n): Promise<CryptoKey> =>\n  cachedKey(publicKeys, options, () =>\n    importSPKI(options.publicKeyPem, TOKEN_ALGORITHM),\n  );\n\n/**\n * Sign {@link TokenClaims} into a compact JWT that expires after `ttlSeconds`.\n * Exported on its own (not only behind the Effect service) so the same signing\n * path is testable and reusable outside an Effect runtime.\n */\nexport const signAccessToken = async (\n  claims: TokenClaims,\n  options: JoseTokenServiceOptions,\n  ttlSeconds: number,\n): Promise<string> =>\n  new SignJWT({ ...claims })\n    .setProtectedHeader({ alg: TOKEN_ALGORITHM, kid: options.keyId })\n    .setIssuedAt()\n    .setIssuer(options.issuer)\n    .setAudience(options.audience)\n    .setExpirationTime(`${ttlSeconds}s`)\n    .sign(await signingKey(options));\n\n/**\n * Verify a token's signature, issuer, audience and expiry, returning its\n * claims. A **pure Promise** so it runs anywhere jose does — notably a Next\n * middleware / edge runtime where pulling in the Effect runtime is unwanted.\n * Rejects on any invalid token.\n *\n * `algorithms` is pinned to a single value and that is this file's security\n * boundary: left unset, jose honours the algorithm named in the token's own\n * header, so a caller could present an `HS256` token and have the public key\n * treated as a shared secret. One accepted algorithm makes that unexpressible.\n */\nexport const verifyAccessToken = async (\n  token: string,\n  options: JoseTokenServiceOptions,\n): Promise<TokenClaims> => {\n  const { payload } = await jwtVerify(token, await verificationKey(options), {\n    algorithms: [TOKEN_ALGORITHM],\n    issuer: options.issuer,\n    audience: options.audience,\n  });\n  return payload as unknown as TokenClaims;\n};\n\n/**\n * A `jose`-backed {@link TokenService}. The perimeter provides it with both keys\n * to mint access tokens from a resolved session; every downstream service\n * provides it with the public key alone to verify them. A signing failure is\n * `Internal`; a verification failure is the caller presenting a bad\n * token — an `InvalidToken` or an `ExpiredToken`, both `unauthenticated`, so a `401`.\n */\nexport const makeJoseTokenService = (\n  options: JoseTokenServiceOptions,\n): TokenService => ({\n  sign: (claims, ttlSeconds) =>\n    Effect.tryPromise({\n      try: () => signAccessToken(claims, options, ttlSeconds),\n      // Signing is local: no key, a key that will not import, a claim set\n      // jose refuses — every one is this process's bug, never a dependency's.\n      catch: () => new Internal(),\n    }),\n  verify: token =>\n    Effect.tryPromise({\n      try: () => verifyAccessToken(token, options),\n      catch: error => tokenFailureFrom(error),\n    }),\n});\n"],"names":["tokenFailureFrom","Internal","Effect","importPKCS8","importSPKI","jwtVerify","SignJWT","TOKEN_ALGORITHM","privateKeys","WeakMap","publicKeys","cachedKey","cache","options","load","cached","get","undefined","loading","set","signingKey","privateKeyPem","Promise","reject","verificationKey","publicKeyPem","signAccessToken","claims","ttlSeconds","setProtectedHeader","alg","kid","keyId","setIssuedAt","setIssuer","issuer","setAudience","audience","setExpirationTime","sign","verifyAccessToken","token","payload","algorithms","makeJoseTokenService","tryPromise","try","catch","verify","error"],"mappings":";AAAA,SAEEA,gBAAgB,QAEX,oBAAoB;AAC3B,SAASC,QAAQ,QAAQ,gBAAgB;AACzC,SAASC,MAAM,QAAQ,SAAS;AAChC,SAEEC,WAAW,EACXC,UAAU,EACVC,SAAS,EACTC,OAAO,QACF,OAAO;AAEd,qFAAqF,GACrF,OAAO,MAAMC,kBAAkB,QAAQ;AA+BvC;;;;;;;CAOC,GACD,MAAMC,cAAc,IAAIC;AACxB,MAAMC,aAAa,IAAID;AAEvB,MAAME,YAAY,CAChBC,OACAC,SACAC;IAEA,MAAMC,SAASH,MAAMI,GAAG,CAACH;IACzB,IAAIE,WAAWE,WAAW;QACxB,OAAOF;IACT;IACA,MAAMG,UAAUJ;IAChBF,MAAMO,GAAG,CAACN,SAASK;IACnB,OAAOA;AACT;AAEA,gFAAgF,GAChF,MAAME,aAAa,CAACP;IAClB,MAAM,EAAEQ,aAAa,EAAE,GAAGR;IAC1B,IAAIQ,kBAAkBJ,WAAW;QAC/B,OAAOK,QAAQC,MAAM,CACnB,gEAAgE;QAChE,mEAAmE;QACnE,IAAItB;IAER;IACA,OAAOU,UAAUH,aAAaK,SAAS,IACrCV,YAAYkB,eAAed;AAE/B;AAEA,uFAAuF,GACvF,MAAMiB,kBAAkB,CACtBX,UAEAF,UAAUD,YAAYG,SAAS,IAC7BT,WAAWS,QAAQY,YAAY,EAAElB;AAGrC;;;;CAIC,GACD,OAAO,MAAMmB,kBAAkB,OAC7BC,QACAd,SACAe,aAEA,IAAItB,QAAQ,aAAKqB,SACdE,kBAAkB,CAAC;QAAEC,KAAKvB;QAAiBwB,KAAKlB,QAAQmB,KAAK;IAAC,GAC9DC,WAAW,GACXC,SAAS,CAACrB,QAAQsB,MAAM,EACxBC,WAAW,CAACvB,QAAQwB,QAAQ,EAC5BC,iBAAiB,CAAC,GAAGV,WAAW,CAAC,CAAC,EAClCW,IAAI,CAAC,MAAMnB,WAAWP,UAAU;AAErC;;;;;;;;;;CAUC,GACD,OAAO,MAAM2B,oBAAoB,OAC/BC,OACA5B;IAEA,MAAM,EAAE6B,OAAO,EAAE,GAAG,MAAMrC,UAAUoC,OAAO,MAAMjB,gBAAgBX,UAAU;QACzE8B,YAAY;YAACpC;SAAgB;QAC7B4B,QAAQtB,QAAQsB,MAAM;QACtBE,UAAUxB,QAAQwB,QAAQ;IAC5B;IACA,OAAOK;AACT,EAAE;AAEF;;;;;;CAMC,GACD,OAAO,MAAME,uBAAuB,CAClC/B,UACkB,CAAA;QAClB0B,MAAM,CAACZ,QAAQC,aACb1B,OAAO2C,UAAU,CAAC;gBAChBC,KAAK,IAAMpB,gBAAgBC,QAAQd,SAASe;gBAC5C,oEAAoE;gBACpE,wEAAwE;gBACxEmB,OAAO,IAAM,IAAI9C;YACnB;QACF+C,QAAQP,CAAAA,QACNvC,OAAO2C,UAAU,CAAC;gBAChBC,KAAK,IAAMN,kBAAkBC,OAAO5B;gBACpCkC,OAAOE,CAAAA,QAASjD,iBAAiBiD;YACnC;IACJ,CAAA,EAAG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entifix/jwt",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "RS256 access tokens on jose: sign, verify with the algorithm pinned, and publish the JWKS.",
   "license": "MIT",
   "repository": {
@@ -52,14 +52,14 @@
   "dependencies": {
     "@swc/helpers": "0.5.23",
     "jose": "6.2.12",
-    "@entifix/business": "0.9.0",
-    "@entifix/core": "0.9.0"
+    "@entifix/business": "0.10.0",
+    "@entifix/core": "0.10.0"
   },
   "devDependencies": {
-    "effect": "4.0.5",
-    "@entifix/testing-unit": "0.9.0"
+    "effect": "4.0.6",
+    "@entifix/testing-unit": "0.10.0"
   },
   "peerDependencies": {
-    "effect": "^4.0.5"
+    "effect": "^4.0.6"
   }
 }