@fntio/infra-client 0.0.0-stage → 0.5.0

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/jwt.js

@@ -0,0 +1,156 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+import { assertStringArrayContainsString, assertStringArraysOverlap, } from "./assert.js";
+import { safeJsonParse, isJsonObject } from "./safe-json-parse.js";
+import { JwtExpiredError, JwtNotBeforeError, JwtInvalidIssuerError, JwtInvalidAudienceError, JwtInvalidScopeError, JwtParseError, ParameterValidationError, } from "./error.js";
+import { nodeWebCompat } from "#node-web-compat";
+/**
+ * Assert that the argument is a valid JWT header object.
+ * Throws an error in case it is not.
+ *
+ * @param header
+ * @returns void
+ */
+function assertJwtHeader(header) {
+    if (!isJsonObject(header)) {
+        throw new JwtParseError("JWT header is not an object");
+    }
+    if (header.alg !== undefined && typeof header.alg !== "string") {
+        throw new JwtParseError("JWT header alg claim is not a string");
+    }
+    if (header.kid !== undefined && typeof header.kid !== "string") {
+        throw new JwtParseError("JWT header kid claim is not a string");
+    }
+}
+/**
+ * Assert that the argument is a valid JWT payload object.
+ * Throws an error in case it is not.
+ *
+ * @param payload
+ * @returns void
+ */
+function assertJwtPayload(payload) {
+    if (!isJsonObject(payload)) {
+        throw new JwtParseError("JWT payload is not an object");
+    }
+    if (payload.exp !== undefined && !Number.isFinite(payload.exp)) {
+        throw new JwtParseError("JWT payload exp claim is not a number");
+    }
+    if (payload.iss !== undefined && typeof payload.iss !== "string") {
+        throw new JwtParseError("JWT payload iss claim is not a string");
+    }
+    if (payload.sub !== undefined && typeof payload.sub !== "string") {
+        throw new JwtParseError("JWT payload sub claim is not a string");
+    }
+    if (payload.aud !== undefined &&
+        typeof payload.aud !== "string" &&
+        (!Array.isArray(payload.aud) ||
+            payload.aud.some((aud) => typeof aud !== "string"))) {
+        throw new JwtParseError("JWT payload aud claim is not a string or array of strings");
+    }
+    if (payload.nbf !== undefined && !Number.isFinite(payload.nbf)) {
+        throw new JwtParseError("JWT payload nbf claim is not a number");
+    }
+    if (payload.iat !== undefined && !Number.isFinite(payload.iat)) {
+        throw new JwtParseError("JWT payload iat claim is not a number");
+    }
+    if (payload.scope !== undefined && typeof payload.scope !== "string") {
+        throw new JwtParseError("JWT payload scope claim is not a string");
+    }
+    if (payload.jti !== undefined && typeof payload.jti !== "string") {
+        throw new JwtParseError("JWT payload jti claim is not a string");
+    }
+}
+/**
+ * Sanity check, decompose and JSON parse a JWT string into its constituent, and yet unverified, parts:
+ * - header object
+ * - payload object
+ * - signature string
+ *
+ * This function does NOT verify a JWT, do not trust the returned payload and header!
+ *
+ * For most use cases, you would not want to call this function directly yourself, rather you
+ * would call verify() with the JWT, which would call this function (and others) for you.
+ *
+ * @param jwt The JWT (as string)
+ * @returns the decomposed, and yet unverified, JWT
+ */
+export function decomposeUnverifiedJwt(jwt) {
+    // Sanity checks on JWT
+    if (!jwt) {
+        throw new JwtParseError("Empty JWT");
+    }
+    if (typeof jwt !== "string") {
+        throw new JwtParseError("JWT is not a string");
+    }
+    if (!jwt.match(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)) {
+        throw new JwtParseError("JWT string does not consist of exactly 3 parts (header, payload, signature)");
+    }
+    const [headerB64, payloadB64, signatureB64] = jwt.split(".");
+    // B64 decode header and payload
+    const [headerString, payloadString] = [headerB64, payloadB64].map(nodeWebCompat.parseB64UrlString);
+    // Parse header
+    let header;
+    try {
+        header = safeJsonParse(headerString);
+    }
+    catch (err) {
+        throw new JwtParseError("Invalid JWT. Header is not a valid JSON object", err);
+    }
+    assertJwtHeader(header);
+    // parse payload
+    let payload;
+    try {
+        payload = safeJsonParse(payloadString);
+    }
+    catch (err) {
+        throw new JwtParseError("Invalid JWT. Payload is not a valid JSON object", err);
+    }
+    assertJwtPayload(payload);
+    return {
+        header,
+        headerB64,
+        payload,
+        payloadB64,
+        signatureB64,
+    };
+}
+/**
+ * Validate JWT payload fields. Throws an error in case there's any validation issue.
+ *
+ * @param payload The (JSON parsed) JWT payload
+ * @param options The options to use during validation
+ * @returns void
+ */
+export function validateJwtFields(payload, options) {
+    // Check expiry
+    if (payload.exp !== undefined) {
+        if (payload.exp + (options.graceSeconds ?? 0) < Date.now() / 1000) {
+            throw new JwtExpiredError(`Token expired at ${new Date(payload.exp * 1000).toISOString()}`, payload.exp);
+        }
+    }
+    // Check not before
+    if (payload.nbf !== undefined) {
+        if (payload.nbf - (options.graceSeconds ?? 0) > Date.now() / 1000) {
+            throw new JwtNotBeforeError(`Token can't be used before ${new Date(payload.nbf * 1000).toISOString()}`, payload.nbf);
+        }
+    }
+    // Check JWT issuer
+    if (options.issuer !== null) {
+        if (options.issuer === undefined) {
+            throw new ParameterValidationError("issuer must be provided or set to null explicitly");
+        }
+        assertStringArrayContainsString("Issuer", payload.iss, options.issuer, JwtInvalidIssuerError);
+    }
+    // Check audience
+    if (options.audience !== null) {
+        if (options.audience === undefined) {
+            throw new ParameterValidationError("audience must be provided or set to null explicitly");
+        }
+        assertStringArraysOverlap("Audience", payload.aud, options.audience, JwtInvalidAudienceError);
+    }
+    // Check scope
+    if (options.scope != null) {
+        assertStringArraysOverlap("Scope", payload.scope?.split(" "), options.scope, JwtInvalidScopeError);
+    }
+}

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/node-web-compat-node.js

@@ -0,0 +1,45 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Node.js implementations for the node-web-compatibility layer
+import { createPublicKey, createVerify } from "crypto";
+import { constructPublicKeyInDerFormat } from "./asn1.js";
+import { fetchJson } from "./https-node.js";
+/**
+ * Enum to map supported JWT signature algorithms with OpenSSL message digest algorithm names
+ */
+var JwtSignatureAlgorithms;
+(function (JwtSignatureAlgorithms) {
+    JwtSignatureAlgorithms["RS256"] = "RSA-SHA256";
+    JwtSignatureAlgorithms["RS384"] = "RSA-SHA384";
+    JwtSignatureAlgorithms["RS512"] = "RSA-SHA512";
+})(JwtSignatureAlgorithms || (JwtSignatureAlgorithms = {}));
+export const nodeWebCompat = {
+    fetchJson,
+    transformJwkToKeyObjectSync: (jwk) => createPublicKey({
+        key: constructPublicKeyInDerFormat(Buffer.from(jwk.n, "base64"), Buffer.from(jwk.e, "base64")),
+        format: "der",
+        type: "spki",
+    }),
+    transformJwkToKeyObjectAsync: async (jwk) => createPublicKey({
+        key: constructPublicKeyInDerFormat(Buffer.from(jwk.n, "base64"), Buffer.from(jwk.e, "base64")),
+        format: "der",
+        type: "spki",
+    }),
+    parseB64UrlString: (b64) => Buffer.from(b64, "base64").toString("utf8"),
+    verifySignatureSync: ({ alg, keyObject, jwsSigningInput, signature }) => 
+    // eslint-disable-next-line security/detect-object-injection
+    createVerify(JwtSignatureAlgorithms[alg])
+        .update(jwsSigningInput)
+        .verify(keyObject, signature, "base64"),
+    verifySignatureAsync: async ({ alg, keyObject, jwsSigningInput, signature, }) => 
+    // eslint-disable-next-line security/detect-object-injection
+    createVerify(JwtSignatureAlgorithms[alg])
+        .update(jwsSigningInput)
+        .verify(keyObject, signature, "base64"),
+    defaultFetchTimeouts: {
+        socketIdle: 500,
+        response: 1500,
+    },
+    setTimeoutUnref: (...args) => setTimeout(...args).unref(),
+};

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/node-web-compat-web.js

@@ -0,0 +1,75 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Web implementations for the node-web-compatibility layer
+import { FetchError, NotSupportedError, JwtInvalidSignatureAlgorithmError, } from "./error.js";
+import { validateHttpsJsonResponse } from "./https-common.js";
+import { safeJsonParse } from "./safe-json-parse.js";
+/**
+ * Enum to map supported JWT signature algorithms with WebCrypto message digest algorithm names
+ */
+var JwtSignatureAlgorithmsWebCrypto;
+(function (JwtSignatureAlgorithmsWebCrypto) {
+    JwtSignatureAlgorithmsWebCrypto["RS256"] = "SHA-256";
+    JwtSignatureAlgorithmsWebCrypto["RS384"] = "SHA-384";
+    JwtSignatureAlgorithmsWebCrypto["RS512"] = "SHA-512";
+})(JwtSignatureAlgorithmsWebCrypto || (JwtSignatureAlgorithmsWebCrypto = {}));
+export const nodeWebCompat = {
+    fetchJson: async (uri, requestOptions, data) => {
+        const responseTimeout = Number(requestOptions?.["responseTimeout"]);
+        if (responseTimeout) {
+            const abort = new AbortController();
+            setTimeout(() => 
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            abort.abort(new FetchError(uri, `Response time-out (after ${responseTimeout} ms.)`)), responseTimeout);
+            requestOptions = { signal: abort.signal, ...requestOptions };
+        }
+        const response = await fetch(uri, { ...requestOptions, body: data });
+        validateHttpsJsonResponse(uri, response.status, response.headers.get("content-type") ?? undefined);
+        return response.text().then((text) => safeJsonParse(text));
+    },
+    defaultFetchTimeouts: {
+        response: 3000,
+    },
+    transformJwkToKeyObjectSync: () => {
+        throw new NotSupportedError("Synchronously transforming a JWK into a key object is not supported in the browser");
+    },
+    transformJwkToKeyObjectAsync: (jwk, jwtHeaderAlg) => {
+        const alg = jwk.alg ?? jwtHeaderAlg;
+        if (!alg) {
+            throw new JwtInvalidSignatureAlgorithmError("Missing alg on both JWK and JWT header", alg);
+        }
+        return crypto.subtle.importKey("jwk", jwk, {
+            name: "RSASSA-PKCS1-v1_5",
+            // eslint-disable-next-line security/detect-object-injection
+            hash: JwtSignatureAlgorithmsWebCrypto[alg],
+        }, false, ["verify"]);
+    },
+    verifySignatureSync: () => {
+        throw new NotSupportedError("Synchronously verifying a JWT signature is not supported in the browser");
+    },
+    verifySignatureAsync: ({ jwsSigningInput, keyObject, signature }) => crypto.subtle.verify({
+        name: "RSASSA-PKCS1-v1_5",
+    }, keyObject, bufferFromBase64url(signature), new TextEncoder().encode(jwsSigningInput)),
+    parseB64UrlString: (b64) => new TextDecoder().decode(bufferFromBase64url(b64)),
+    setTimeoutUnref: setTimeout.bind(undefined),
+};
+const bufferFromBase64url = (function () {
+    const map = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"
+        .split("")
+        .reduce((acc, char, index) => Object.assign(acc, { [char.charCodeAt(0)]: index }), {});
+    return function (base64url) {
+        const paddingLength = base64url.match(/^.+?(=?=?)$/)[1].length;
+        let first, second, third, fourth;
+        return base64url.match(/.{1,4}/g).reduce((acc, chunk, index) => {
+            first = map[chunk.charCodeAt(0)];
+            second = map[chunk.charCodeAt(1)];
+            third = map[chunk.charCodeAt(2)];
+            fourth = map[chunk.charCodeAt(3)];
+            acc[3 * index] = (first << 2) | (second >> 4);
+            acc[3 * index + 1] = ((second & 0b1111) << 4) | (third >> 2);
+            acc[3 * index + 2] = ((third & 0b11) << 6) | fourth;
+            return acc;
+        }, new Uint8Array((base64url.length * 3) / 4 - paddingLength));
+    };
+})();

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/node-web-compat.js

@@ -0,0 +1,10 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// To make this library work in both Node.js and Web, some functions require specific code,
+// e.g. in Node.js we can use the "crypto" module, whereas in Web we need to use SubtleCrypto.
+// This file contains an interface that the specific Node.js and Web implementations must implement.
+//
+// At runtime, either the Node.js or Web implementation is actually loaded. This works because the
+// package.json specifies "#node-web-compat" as a subpath import, with conditions pointing to the right implementation (for Node.js or Web)
+export {};

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/package.json

@@ -0,0 +1 @@
+{"name":"aws-jwt-verify","version":"4.0.1","type":"module","imports":{"#node-web-compat":{"browser":"./node-web-compat-web.js","default":"./node-web-compat-node.js"}}}

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/safe-json-parse.js

@@ -0,0 +1,29 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Utility to parse JSON safely
+/**
+ * Check if a piece of JSON is a JSON object, and not e.g. a mere string or null
+ *
+ * @param j - the JSON
+ */
+export function isJsonObject(j) {
+    // It is not enough to check that `typeof j === "object"`
+    // because in JS `typeof null` is also "object", and so is `typeof []`.
+    // So we need to check that j is an object, and not null, and not an array
+    return typeof j === "object" && !Array.isArray(j) && j !== null;
+}
+/**
+ * Parse a string as JSON, while removing __proto__ and constructor, so JS prototype pollution is prevented
+ *
+ * @param s - the string to JSON parse
+ */
+export function safeJsonParse(s) {
+    return JSON.parse(s, (_, value) => {
+        if (typeof value === "object" && !Array.isArray(value) && value !== null) {
+            delete value.__proto__;
+            delete value.constructor;
+        }
+        return value;
+    });
+}

package/assets/api/vendor_modules/aws-jwt-verify/dist/esm/typing-util.js

@@ -0,0 +1,5 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+//
+// Utilities for creating special TypeScript types
+export {};

package/assets/api/vendor_modules/aws-jwt-verify/error.d.ts

@@ -0,0 +1,108 @@
+import { JwtHeader, JwtPayload } from "./jwt-model.js";
+/**
+ * Base Error for all other errors in this file
+ */
+export declare abstract class JwtBaseError extends Error {
+}
+/**
+ * Interface for an error that is raised because an actual value does not match with the expected value
+ */
+interface AssertionError extends JwtBaseError {
+    failedAssertion: {
+        actual: unknown;
+        expected?: string | Readonly<string[]>;
+    };
+}
+/**
+ * Constructor interface for AssertionError
+ */
+export interface AssertionErrorConstructor {
+    new (msg: string, actual: unknown, expected?: string | Readonly<string[]>): AssertionError;
+}
+/**
+ * An error that is raised because an actual value does not match with the expected value
+ */
+export declare class FailedAssertionError extends JwtBaseError {
+    failedAssertion: {
+        actual: unknown;
+        expected?: string | Readonly<string[]>;
+    };
+    constructor(msg: string, actual: unknown, expected?: string | Readonly<string[]>);
+}
+/**
+ * JWT errors
+ */
+export declare class JwtParseError extends JwtBaseError {
+    constructor(msg: string, error?: unknown);
+}
+export declare class ParameterValidationError extends JwtBaseError {
+}
+export declare class JwtInvalidSignatureError extends JwtBaseError {
+}
+export declare class JwtInvalidSignatureAlgorithmError extends FailedAssertionError {
+}
+interface RawJwt {
+    header: JwtHeader;
+    payload: JwtPayload;
+}
+export declare abstract class JwtInvalidClaimError extends FailedAssertionError {
+    rawJwt?: RawJwt;
+    withRawJwt<T extends JwtInvalidClaimError>(this: T, { header, payload }: RawJwt): T;
+}
+export declare class JwtInvalidIssuerError extends JwtInvalidClaimError {
+}
+export declare class JwtInvalidAudienceError extends JwtInvalidClaimError {
+}
+export declare class JwtInvalidScopeError extends JwtInvalidClaimError {
+}
+export declare class JwtExpiredError extends JwtInvalidClaimError {
+}
+export declare class JwtNotBeforeError extends JwtInvalidClaimError {
+}
+/**
+ * Amazon Cognito specific erros
+ */
+export declare class CognitoJwtInvalidGroupError extends JwtInvalidClaimError {
+}
+export declare class CognitoJwtInvalidTokenUseError extends JwtInvalidClaimError {
+}
+export declare class CognitoJwtInvalidClientIdError extends JwtInvalidClaimError {
+}
+/**
+ * ASN.1 errors
+ */
+export declare class Asn1DecodingError extends JwtBaseError {
+}
+/**
+ * JWK errors
+ */
+export declare class JwksValidationError extends JwtBaseError {
+}
+export declare class JwkValidationError extends JwtBaseError {
+}
+export declare class JwtWithoutValidKidError extends JwtBaseError {
+}
+export declare class KidNotFoundInJwksError extends JwtBaseError {
+}
+export declare class WaitPeriodNotYetEndedJwkError extends JwtBaseError {
+}
+export declare class JwksNotAvailableInCacheError extends JwtBaseError {
+}
+export declare class JwkInvalidUseError extends FailedAssertionError {
+}
+export declare class JwkInvalidKtyError extends FailedAssertionError {
+}
+/**
+ * HTTPS fetch errors
+ */
+export declare class FetchError extends JwtBaseError {
+    constructor(uri: string, msg: unknown);
+}
+export declare class NonRetryableFetchError extends FetchError {
+}
+/**
+ * Web compatibility errors
+ */
+export declare class NotSupportedError extends JwtBaseError {
+}
+export {};

package/assets/api/vendor_modules/aws-jwt-verify/https-common.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Sanity check a HTTPS response where we expect to get JSON data back
+ *
+ * @param uri the uri that was being requested
+ * @param statusCode the HTTP status code, should be 200
+ * @param contentType the value of the "Content-Type" header in the response, should start with "application/json"
+ * @returns void - throws an error if the status code or content type aren't as expected
+ */
+export declare function validateHttpsJsonResponse(uri: string, statusCode?: number, contentType?: string): void;

package/assets/api/vendor_modules/aws-jwt-verify/https-node.d.ts

@@ -0,0 +1,20 @@
+/// <reference types="node" />
+import { RequestOptions } from "http";
+import { Json } from "./safe-json-parse.js";
+/**
+ * Interface for Request Options, that adds one additional option to the Node.js standard RequestOptions,
+ * "responseTimeout", with which a timeout can be set within which the response must be received.
+ * (Note the "timeout" in the Node.js standard RequestOptions, concerns something else: the socket idle timeout)
+ */
+type FetchRequestOptions = RequestOptions & {
+    responseTimeout?: number;
+};
+/**
+ * Execute a HTTPS request
+ * @param uri - The URI
+ * @param requestOptions - The RequestOptions to use
+ * @param data - Data to send to the URI (e.g. POST data)
+ * @returns - The response as parsed JSON
+ */
+export declare function fetchJson<ResultType extends Json>(uri: string, requestOptions?: FetchRequestOptions, data?: Uint8Array): Promise<ResultType>;
+export {};

package/assets/api/vendor_modules/aws-jwt-verify/https.d.ts

@@ -0,0 +1,35 @@
+/// <reference types="node" />
+import { Json } from "./safe-json-parse.js";
+/**
+ * Execute a HTTPS request
+ * @param uri - The URI
+ * @param requestOptions - The RequestOptions to use (depending on the runtime context, either Node.js RequestOptions or Web Fetch init)
+ * @param data - Data to send to the URI (e.g. POST data)
+ * @returns - The response as parsed JSON
+ */
+export declare const fetchJson: <ResultType extends Json>(uri: string, requestOptions?: Record<string, unknown> | undefined, data?: Uint8Array | undefined) => Promise<ResultType>;
+type FetchRequestOptions = Record<string, unknown>;
+/** Interface for JS objects that can be used with the SimpleJsonFetcher */
+export interface JsonFetcher<ResultType extends Json = Json> {
+    fetch: (uri: string, requestOptions?: FetchRequestOptions, data?: Buffer) => Promise<ResultType>;
+}
+/**
+ * HTTPS Fetcher for URIs with JSON body
+ *
+ * @param defaultRequestOptions - The default RequestOptions to use on individual HTTPS requests
+ */
+export declare class SimpleJsonFetcher implements JsonFetcher {
+    defaultRequestOptions: FetchRequestOptions;
+    constructor(props?: {
+        defaultRequestOptions?: FetchRequestOptions;
+    });
+    /**
+     * Execute a HTTPS request (with 1 immediate retry in case of errors)
+     * @param uri - The URI
+     * @param requestOptions - The RequestOptions to use
+     * @param data - Data to send to the URI (e.g. POST data)
+     * @returns - The response as parsed JSON
+     */
+    fetch<ResultType extends Json>(uri: string, requestOptions?: FetchRequestOptions, data?: Uint8Array): Promise<ResultType>;
+}
+export {};

package/assets/api/vendor_modules/aws-jwt-verify/index.d.ts

@@ -0,0 +1,2 @@
+export { JwtRsaVerifier } from "./jwt-rsa.js";
+export { CognitoJwtVerifier } from "./cognito-verifier.js";

package/assets/api/vendor_modules/aws-jwt-verify/jwk.d.ts

@@ -0,0 +1,76 @@
+import { JsonFetcher } from "./https.js";
+import { JwtHeader, JwtPayload } from "./jwt-model.js";
+import { Json, JsonObject } from "./safe-json-parse.js";
+interface DecomposedJwt {
+    header: JwtHeader;
+    payload: JwtPayload;
+}
+declare const optionalJwkFieldNames: readonly ["use", "alg", "kid", "n", "e"];
+declare const mandatoryJwkFieldNames: readonly ["kty"];
+type OptionalJwkFieldNames = typeof optionalJwkFieldNames[number];
+type MandatoryJwkFieldNames = typeof mandatoryJwkFieldNames[number];
+type OptionalJwkFields = {
+    [key in OptionalJwkFieldNames]?: string;
+};
+type MandatoryJwkFields = {
+    [key in MandatoryJwkFieldNames]: string;
+};
+export type Jwk = OptionalJwkFields & MandatoryJwkFields & JsonObject;
+export type RsaSignatureJwk = Jwk & {
+    use: "sig";
+    kty: "RSA";
+    n: string;
+    e: string;
+};
+export type JwkWithKid = Jwk & {
+    kid: string;
+};
+export declare function findJwkInJwks(jwks: Jwks, kid: string): JwkWithKid | undefined;
+interface JwksFields {
+    keys: readonly Jwk[];
+}
+export type Jwks = JwksFields & JsonObject;
+export interface JwksCache {
+    getJwk(jwksUri: string, decomposedJwt: DecomposedJwt): Promise<JwkWithKid>;
+    getCachedJwk(jwksUri: string, decomposedJwt: DecomposedJwt): JwkWithKid;
+    addJwks(jwksUri: string, jwks: Jwks): void;
+    getJwks(jwksUri: string): Promise<Jwks>;
+}
+export declare function fetchJwks(jwksUri: string): Promise<Jwks>;
+export declare function fetchJwk(jwksUri: string, decomposedJwt: DecomposedJwt): Promise<JwkWithKid>;
+export declare function assertIsJwks(jwks: Json): asserts jwks is Jwks;
+export declare function assertIsRsaSignatureJwk(jwk: Jwk): asserts jwk is RsaSignatureJwk;
+export declare function assertIsJwk(jwk: Json): asserts jwk is Jwk;
+export declare function isJwks(jwks: Json): jwks is Jwks;
+export declare function isJwk(jwk: Json): jwk is Jwk;
+export interface PenaltyBox {
+    wait: (jwksUri: string, kid: string) => Promise<void>;
+    registerFailedAttempt: (jwksUri: string, kid: string) => void;
+    registerSuccessfulAttempt: (jwksUri: string, kid: string) => void;
+}
+export declare class SimplePenaltyBox implements PenaltyBox {
+    waitSeconds: number;
+    private waitingUris;
+    constructor(props?: {
+        waitSeconds?: number;
+    });
+    wait(jwksUri: string): Promise<void>;
+    release(jwksUri: string): void;
+    registerFailedAttempt(jwksUri: string): void;
+    registerSuccessfulAttempt(jwksUri: string): void;
+}
+export declare class SimpleJwksCache implements JwksCache {
+    fetcher: JsonFetcher;
+    penaltyBox: PenaltyBox;
+    private jwksCache;
+    private fetchingJwks;
+    constructor(props?: {
+        penaltyBox?: PenaltyBox;
+        fetcher?: JsonFetcher;
+    });
+    addJwks(jwksUri: string, jwks: Jwks): void;
+    getJwks(jwksUri: string): Promise<Jwks>;
+    getCachedJwk(jwksUri: string, decomposedJwt: DecomposedJwt): JwkWithKid;
+    getJwk(jwksUri: string, decomposedJwt: DecomposedJwt): Promise<JwkWithKid>;
+}
+export {};

package/assets/api/vendor_modules/aws-jwt-verify/jwt-model.d.ts

@@ -0,0 +1,78 @@
+import { JsonObject } from "./safe-json-parse.js";
+export declare const supportedSignatureAlgorithms: readonly ["RS256", "RS384", "RS512"];
+export type SupportedSignatureAlgorithm = typeof supportedSignatureAlgorithms[number];
+interface JwtHeaderStandardFields {
+    alg?: SupportedSignatureAlgorithm | string;
+    kid?: string;
+}
+export type JwtHeader = JwtHeaderStandardFields & JsonObject;
+interface JwtPayloadStandardFields {
+    exp?: number;
+    iss?: string;
+    sub?: string;
+    aud?: string | string[];
+    nbf?: number;
+    iat?: number;
+    scope?: string;
+    jti?: string;
+}
+export type JwtPayload = JwtPayloadStandardFields & JsonObject;
+export interface Jwt {
+    header: JwtHeader;
+    payload: JwtPayload;
+}
+export type CognitoIdOrAccessTokenPayload<IssuerConfig, VerifyProps> = VerifyProps extends {
+    tokenUse: null;
+} ? CognitoJwtPayload : VerifyProps extends {
+    tokenUse: "id";
+} ? CognitoIdTokenPayload : VerifyProps extends {
+    tokenUse: "access";
+} ? CognitoAccessTokenPayload : IssuerConfig extends {
+    tokenUse: "id";
+} ? CognitoIdTokenPayload : IssuerConfig extends {
+    tokenUse: "access";
+} ? CognitoAccessTokenPayload : CognitoJwtPayload;
+interface CognitoJwtFields {
+    token_use: "access" | "id";
+    "cognito:groups"?: string[];
+    sub: string;
+    iss: string;
+    exp: number;
+    iat: number;
+    auth_time: number;
+    jti: string;
+    origin_jti: string;
+}
+export type CognitoJwtPayload = CognitoJwtFields & JsonObject;
+interface CognitoIdTokenFields extends CognitoJwtFields {
+    token_use: "id";
+    aud: string;
+    at_hash: string;
+    "cognito:username": string;
+    email_verified: boolean;
+    phone_number_verified: boolean;
+    identities: {
+        userId: string;
+        providerName: string;
+        providerType: string;
+        issuer: null;
+        primary: string;
+        dateCreated: string;
+    }[];
+    "cognito:roles": string[];
+    "cognito:preferred_role": string;
+}
+export type CognitoIdTokenPayload = CognitoIdTokenFields & JsonObject;
+interface CognitoAccessTokenFields extends CognitoJwtFields {
+    token_use: "access";
+    client_id: string;
+    version: number;
+    username: string;
+    scope: string;
+}
+export type CognitoAccessTokenPayload = CognitoAccessTokenFields & JsonObject;
+export interface CognitoJwt {
+    header: JwtHeader;
+    payload: CognitoAccessTokenPayload | CognitoIdTokenPayload;
+}
+export {};