@fresho/router 0.5.0 → 0.6.0

package/dist/jwt-ikNuUBcp.mjs

@@ -0,0 +1,373 @@
+//#region src/auth/basic.ts
+/**
+* Parses Basic authentication credentials from an Authorization header value.
+*
+* @param authHeader - The full Authorization header value (e.g., 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=')
+* @returns The parsed credentials, or null if parsing fails
+*
+* @example
+* ```typescript
+* const header = request.headers.get('Authorization');
+* const credentials = parseBasicAuth(header);
+* if (credentials) {
+*   // Verify credentials
+*   const isValid = await verifyPassword(credentials.username, credentials.password);
+* }
+* ```
+*/
+function parseBasicAuth(authHeader) {
+	if (!authHeader?.startsWith("Basic ")) return null;
+	try {
+		const encoded = authHeader.slice(6);
+		const decoded = atob(encoded);
+		const colonIndex = decoded.indexOf(":");
+		if (colonIndex === -1) return null;
+		return {
+			username: decoded.substring(0, colonIndex),
+			password: decoded.substring(colonIndex + 1)
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Encodes credentials into a Basic authentication header value.
+*
+* @param username - The username
+* @param password - The password
+* @returns The Authorization header value (e.g., 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=')
+*
+* @example
+* ```typescript
+* const authHeader = encodeBasicAuth('admin', 'secret');
+* fetch('/api/endpoint', {
+*   headers: { Authorization: authHeader }
+* });
+* ```
+*/
+function encodeBasicAuth(username, password) {
+	return `Basic ${btoa(`${username}:${password}`)}`;
+}
+/**
+* Extracts the raw base64-encoded credentials from an Authorization header.
+*
+* @param authHeader - The full Authorization header value
+* @returns The base64 string, or null if not a Basic auth header
+*/
+function extractBasicAuthToken(authHeader) {
+	if (!authHeader?.startsWith("Basic ")) return null;
+	return authHeader.slice(6);
+}
+
+//#endregion
+//#region src/auth/jwt.ts
+const ALGORITHMS = {
+	HS256: {
+		name: "HMAC",
+		hash: "SHA-256"
+	},
+	HS384: {
+		name: "HMAC",
+		hash: "SHA-384"
+	},
+	HS512: {
+		name: "HMAC",
+		hash: "SHA-512"
+	},
+	RS256: {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	},
+	RS384: {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-384"
+	},
+	RS512: {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-512"
+	},
+	PS256: {
+		name: "RSA-PSS",
+		hash: "SHA-256",
+		saltLength: 32
+	},
+	PS384: {
+		name: "RSA-PSS",
+		hash: "SHA-384",
+		saltLength: 48
+	},
+	PS512: {
+		name: "RSA-PSS",
+		hash: "SHA-512",
+		saltLength: 64
+	},
+	ES256: {
+		name: "ECDSA",
+		hash: "SHA-256",
+		namedCurve: "P-256"
+	},
+	ES384: {
+		name: "ECDSA",
+		hash: "SHA-384",
+		namedCurve: "P-384"
+	}
+};
+/** Checks that a CryptoKey was created for exactly this algorithm. */
+function keyMatches(key, spec) {
+	const alg = key.algorithm;
+	if (alg.name !== spec.name) return false;
+	if (spec.name === "ECDSA") return alg.namedCurve === spec.namedCurve;
+	if (spec.name !== "HMAC" && (alg.modulusLength ?? 0) < 2048) return false;
+	return alg.hash?.name === spec.hash;
+}
+/** Checks that a JWK may be used to verify this algorithm. */
+function jwkMatches(jwk, alg) {
+	const spec = ALGORITHMS[alg];
+	if (jwk.alg !== void 0 && jwk.alg !== alg) return false;
+	if (jwk.use !== void 0 && jwk.use !== "sig") return false;
+	if (spec.name === "ECDSA") return jwk.kty === "EC" && jwk.crv === spec.namedCurve;
+	return spec.name !== "HMAC" && jwk.kty === "RSA";
+}
+/** Resolves the CryptoKey for a token, rejecting keys that don't fit its algorithm. */
+async function resolveKey(secret, alg, kid, usage) {
+	const spec = ALGORITHMS[alg];
+	let key;
+	if (secret instanceof Jwks) {
+		if (spec.name === "HMAC") throw new Error(`Key does not match algorithm: ${alg}`);
+		key = await secret.getKey(alg, kid);
+	} else if (secret instanceof CryptoKey) key = secret;
+	else {
+		if (spec.name !== "HMAC") throw new Error(`Key does not match algorithm: ${alg}`);
+		const keyData = typeof secret === "string" ? new TextEncoder().encode(secret) : secret;
+		key = await crypto.subtle.importKey("raw", keyData, spec, false, [usage]);
+	}
+	if (!keyMatches(key, spec)) throw new Error(`Key does not match algorithm: ${alg}`);
+	return key;
+}
+/** Decodes a base64url string to bytes. */
+function base64urlDecode(data) {
+	if (!/^[A-Za-z0-9_-]*$/.test(data)) throw new Error("Invalid JWT format");
+	return Uint8Array.from(atob(data.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0));
+}
+/** Decodes a base64url JSON segment, without echoing its content in errors. */
+function decodeSegment(data) {
+	let value;
+	try {
+		value = JSON.parse(new TextDecoder().decode(base64urlDecode(data)));
+	} catch {}
+	if (typeof value !== "object" || value === null) throw new Error("Invalid JWT format");
+	return value;
+}
+/** Returns true if `actual` (a claim value) contains any of `expected`. */
+function claimMatches(actual, expected) {
+	const values = Array.isArray(actual) ? actual : [actual];
+	return [expected].flat().some((e) => values.includes(e));
+}
+/**
+* Parses a duration string (e.g., '1h', '7d', '30m') to seconds.
+*/
+function parseDuration(duration) {
+	if (typeof duration === "number") return duration;
+	const match = duration.match(/^(\d+)\s*(s|m|h|d|w)$/i);
+	if (!match) throw new Error(`Invalid duration format: ${duration}. Use formats like '1h', '7d', '30m', '60s'.`);
+	const value = parseInt(match[1], 10);
+	const unit = match[2].toLowerCase();
+	switch (unit) {
+		case "s": return value;
+		case "m": return value * 60;
+		case "h": return value * 60 * 60;
+		case "d": return value * 60 * 60 * 24;
+		case "w": return value * 60 * 60 * 24 * 7;
+		default: throw new Error(`Unknown duration unit: ${unit}`);
+	}
+}
+/**
+* Base64url encodes a string or Uint8Array.
+*/
+function base64urlEncode(data) {
+	const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
+	const binary = String.fromCharCode(...bytes);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/**
+* Signs a JWT token using Web Crypto API.
+*
+* Uses only Web Crypto API, compatible with Cloudflare Workers, Deno, and browsers.
+*
+* @param payload - The JWT payload (custom claims)
+* @param secret - The signing secret (string, bytes, or private/HMAC CryptoKey)
+* @param options - Optional signing options (algorithm, expiresIn, issuer, etc.)
+* @returns The signed JWT token string
+*
+* @example
+* ```typescript
+* // Basic usage (HS256 by default)
+* const token = await jwtSign(
+*   { uid: 'user-123', role: 'admin' },
+*   'your-secret-key',
+*   { expiresIn: '1h' }
+* );
+*
+* // With HS512 algorithm
+* const token = await jwtSign(
+*   { uid: 'user-123' },
+*   process.env.JWT_SECRET,
+*   { algorithm: 'HS512', expiresIn: '7d' }
+* );
+* ```
+*/
+async function jwtSign(payload, secret, options = {}) {
+	const algorithm = options.algorithm || "HS256";
+	const spec = ALGORITHMS[algorithm];
+	if (!spec) throw new Error(`Unknown algorithm: ${algorithm}`);
+	const now = options.issuedAt ? options.issuedAt instanceof Date ? Math.floor(options.issuedAt.getTime() / 1e3) : options.issuedAt : Math.floor(Date.now() / 1e3);
+	const finalPayload = {
+		...payload,
+		iat: now
+	};
+	if (options.expiresIn !== void 0) finalPayload.exp = now + parseDuration(options.expiresIn);
+	if (options.notBefore !== void 0) finalPayload.nbf = now + parseDuration(options.notBefore);
+	if (options.issuer !== void 0) finalPayload.iss = options.issuer;
+	if (options.audience !== void 0) finalPayload.aud = options.audience;
+	if (options.subject !== void 0) finalPayload.sub = options.subject;
+	const header = {
+		alg: algorithm,
+		typ: "JWT",
+		...options.keyId !== void 0 && { kid: options.keyId }
+	};
+	const data = `${base64urlEncode(JSON.stringify(header))}.${base64urlEncode(JSON.stringify(finalPayload))}`;
+	if (secret instanceof Jwks) throw new Error("Cannot sign with a JWKS");
+	const key = await resolveKey(secret, algorithm, void 0, "sign");
+	const signatureBuffer = await crypto.subtle.sign(spec, key, new TextEncoder().encode(data));
+	return `${data}.${base64urlEncode(new Uint8Array(signatureBuffer))}`;
+}
+/**
+* Verifies a JWT token using Web Crypto API.
+*
+* Uses only Web Crypto API, compatible with Cloudflare Workers, Deno, and browsers.
+*
+* @param token - The JWT token string to verify
+* @param secret - The verification key (string, bytes, CryptoKey, or JWKS)
+* @param options - Optional verification options
+* @returns The decoded JWT payload
+* @throws Error if the token is invalid, expired, or not yet valid
+*
+* @example
+* ```typescript
+* import { jwtVerify } from '@fresho/router/auth';
+*
+* try {
+*   const payload = await jwtVerify(token, 'your-secret-key');
+*   console.log(payload.sub); // user ID
+* } catch (error) {
+*   console.error('Invalid token:', error.message);
+* }
+*
+* // With specific algorithms
+* const payload = await jwtVerify(token, secret, { algorithms: ['HS512'] });
+* ```
+*/
+async function jwtVerify(token, secret, options = {}) {
+	const symmetric = !(secret instanceof Jwks) && !(secret instanceof CryptoKey && secret.algorithm.name !== "HMAC");
+	const algorithms = options.algorithms || [symmetric ? "HS256" : "RS256"];
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new Error("Invalid JWT format");
+	const [headerB64, payloadB64, signatureB64] = parts;
+	const header = decodeSegment(headerB64);
+	if (!algorithms.includes(header.alg) || !Object.hasOwn(ALGORITHMS, header.alg)) throw new Error(`Unsupported algorithm: ${header.alg}`);
+	const alg = header.alg;
+	if (header.kid !== void 0 && typeof header.kid !== "string") throw new Error("Invalid JWT format");
+	if (header.crit !== void 0) throw new Error("Unsupported critical header");
+	const kid = header.kid;
+	const key = await resolveKey(secret, alg, kid, "verify");
+	const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);
+	if (!await crypto.subtle.verify(ALGORITHMS[alg], key, base64urlDecode(signatureB64), data)) throw new Error("Invalid signature");
+	const payload = decodeSegment(payloadB64);
+	const now = Date.now() / 1e3;
+	const tolerance = options.clockTolerance ?? 0;
+	if (payload.exp !== void 0 && !(typeof payload.exp === "number" && payload.exp + tolerance >= now)) throw new Error("Token expired");
+	if (payload.nbf !== void 0 && !(typeof payload.nbf === "number" && payload.nbf - tolerance <= now)) throw new Error("Token not yet valid");
+	if (options.issuer !== void 0 && (typeof payload.iss !== "string" || !claimMatches(payload.iss, options.issuer))) throw new Error("Invalid issuer");
+	if (options.audience !== void 0 && !claimMatches(payload.aud, options.audience)) throw new Error("Invalid audience");
+	return payload;
+}
+/** How long fetched keys are trusted before the set is reloaded. */
+const JWKS_MAX_AGE_MS = 600 * 1e3;
+/** Minimum time between fetch attempts, successful or not. */
+const JWKS_COOLDOWN_MS = 30 * 1e3;
+/** Abort a JWKS fetch that takes longer than this. */
+const JWKS_TIMEOUT_MS = 5 * 1e3;
+/** A remote JSON Web Key Set, fetched lazily and cached. Create with {@link createJwks}. */
+var Jwks = class {
+	keys = [];
+	fetchedAt = Number.NEGATIVE_INFINITY;
+	attemptedAt = Number.NEGATIVE_INFINITY;
+	pending;
+	constructor(url) {
+		this.url = url;
+	}
+	/** Returns the verification key for `alg` and `kid`, reloading when stale or the kid is unknown. */
+	async getKey(alg, kid) {
+		if (Date.now() - this.fetchedAt > JWKS_MAX_AGE_MS) await this.refresh();
+		let candidates = this.match(alg, kid);
+		if (candidates.length === 0) {
+			await this.refresh();
+			candidates = this.match(alg, kid);
+		}
+		if (candidates.length !== 1) throw new Error("No matching key in JWKS");
+		return crypto.subtle.importKey("jwk", candidates[0], ALGORITHMS[alg], false, ["verify"]);
+	}
+	match(alg, kid) {
+		return this.keys.filter((k) => (kid === void 0 || k.kid === kid) && jwkMatches(k, alg));
+	}
+	/** Joins an in-flight load or starts one at most once per cooldown; keeps old keys on failure. */
+	async refresh() {
+		if (!this.pending) {
+			if (Date.now() - this.attemptedAt < JWKS_COOLDOWN_MS) return;
+			this.attemptedAt = Date.now();
+			this.pending = this.load().finally(() => {
+				this.pending = void 0;
+			});
+		}
+		try {
+			await this.pending;
+		} catch (error) {
+			if (this.keys.length === 0) throw error;
+		}
+	}
+	async load() {
+		const response = await fetch(this.url, {
+			headers: { Accept: "application/json" },
+			signal: AbortSignal.timeout(JWKS_TIMEOUT_MS)
+		});
+		if (!response.ok) throw new Error(`JWKS fetch failed: ${response.status}`);
+		const body = await response.json().catch(() => ({}));
+		const keys = Array.isArray(body.keys) ? body.keys.filter((k) => typeof k === "object" && k !== null) : [];
+		if (keys.length === 0) throw new Error("JWKS response has no keys");
+		this.keys = keys;
+		this.fetchedAt = Date.now();
+	}
+};
+/**
+* Creates a cached remote key set for verifying tokens from an OAuth/OIDC provider.
+*
+* Create it once (e.g. at module scope) and pass it as the secret. Keys are selected by the
+* token's `kid` and must match its algorithm; an unknown `kid` triggers a rate-limited reload.
+*
+* @example
+* ```typescript
+* const jwks = createJwks('https://example.auth0.com/.well-known/jwks.json');
+* const payload = await jwtVerify(token, jwks, {
+*   algorithms: ['RS256'],
+*   issuer: 'https://example.auth0.com/',
+*   audience: 'https://api.example.com',
+* });
+* ```
+*/
+function createJwks(url) {
+	return new Jwks(String(url));
+}
+
+//#endregion
+export { extractBasicAuthToken as a, encodeBasicAuth as i, jwtSign as n, parseBasicAuth as o, jwtVerify as r, createJwks as t };
+//# sourceMappingURL=jwt-ikNuUBcp.mjs.map

package/dist/jwt-ikNuUBcp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-ikNuUBcp.mjs","names":["ALGORITHMS: Record<JwtAlgorithm, AlgorithmSpec>","key: CryptoKey","value: unknown","finalPayload: JwtPayload","kid: string | undefined","url: string"],"sources":["../src/auth/basic.ts","../src/auth/jwt.ts"],"sourcesContent":["/**\n * @fileoverview Basic HTTP authentication utilities.\n *\n * Provides functions for parsing and encoding Basic authentication credentials.\n *\n * @example\n * ```typescript\n * import { parseBasicAuth, encodeBasicAuth } from '@fresho/router/auth';\n *\n * // Parse credentials from Authorization header\n * const credentials = parseBasicAuth('Basic dXNlcm5hbWU6cGFzc3dvcmQ=');\n * if (credentials) {\n *   console.log(credentials.username); // 'username'\n *   console.log(credentials.password); // 'password'\n * }\n *\n * // Create an Authorization header value\n * const header = encodeBasicAuth('username', 'password');\n * // 'Basic dXNlcm5hbWU6cGFzc3dvcmQ='\n * ```\n */\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/** Parsed Basic authentication credentials. */\nexport interface BasicCredentials {\n  /** The username from the credentials. */\n  username: string;\n  /** The password from the credentials. */\n  password: string;\n}\n\n// =============================================================================\n// Public API\n// =============================================================================\n\n/**\n * Parses Basic authentication credentials from an Authorization header value.\n *\n * @param authHeader - The full Authorization header value (e.g., 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=')\n * @returns The parsed credentials, or null if parsing fails\n *\n * @example\n * ```typescript\n * const header = request.headers.get('Authorization');\n * const credentials = parseBasicAuth(header);\n * if (credentials) {\n *   // Verify credentials\n *   const isValid = await verifyPassword(credentials.username, credentials.password);\n * }\n * ```\n */\nexport function parseBasicAuth(authHeader: string | null): BasicCredentials | null {\n  if (!authHeader?.startsWith('Basic ')) {\n    return null;\n  }\n\n  try {\n    const encoded = authHeader.slice(6);\n    const decoded = atob(encoded);\n    const colonIndex = decoded.indexOf(':');\n\n    if (colonIndex === -1) {\n      return null;\n    }\n\n    return {\n      username: decoded.substring(0, colonIndex),\n      password: decoded.substring(colonIndex + 1),\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Encodes credentials into a Basic authentication header value.\n *\n * @param username - The username\n * @param password - The password\n * @returns The Authorization header value (e.g., 'Basic dXNlcm5hbWU6cGFzc3dvcmQ=')\n *\n * @example\n * ```typescript\n * const authHeader = encodeBasicAuth('admin', 'secret');\n * fetch('/api/endpoint', {\n *   headers: { Authorization: authHeader }\n * });\n * ```\n */\nexport function encodeBasicAuth(username: string, password: string): string {\n  return `Basic ${btoa(`${username}:${password}`)}`;\n}\n\n/**\n * Extracts the raw base64-encoded credentials from an Authorization header.\n *\n * @param authHeader - The full Authorization header value\n * @returns The base64 string, or null if not a Basic auth header\n */\nexport function extractBasicAuthToken(authHeader: string | null): string | null {\n  if (!authHeader?.startsWith('Basic ')) {\n    return null;\n  }\n  return authHeader.slice(6);\n}\n","/**\n * @fileoverview JWT signing and verification utilities.\n *\n * Provides functions for creating and validating JSON Web Tokens using\n * the Web Crypto API. Compatible with Cloudflare Workers, Deno, and browsers.\n *\n * @example\n * ```typescript\n * import { jwtSign, jwtVerify } from '@fresho/router/auth';\n *\n * // Sign a token\n * const token = await jwtSign(\n *   { uid: 'user-123', role: 'admin' },\n *   'your-secret-key',\n *   { expiresIn: '1h' }\n * );\n *\n * // Verify a token\n * const payload = await jwtVerify(token, 'your-secret-key');\n * console.log(payload.uid); // 'user-123'\n * ```\n */\n\n// =============================================================================\n// Types\n// =============================================================================\n\n/** JWT payload type. */\nexport interface JwtPayload {\n  /** Subject (user ID). */\n  sub?: string;\n  /** Issued at timestamp. */\n  iat?: number;\n  /** Expiration timestamp. */\n  exp?: number;\n  /** Not before timestamp. */\n  nbf?: number;\n  /** Issuer. */\n  iss?: string;\n  /** Audience. */\n  aud?: string | string[];\n  /** Additional claims. */\n  [key: string]: unknown;\n}\n\n/** Supported algorithms for JWT signing/verification. */\nexport type JwtAlgorithm =\n  | 'HS256'\n  | 'HS384'\n  | 'HS512'\n  | 'RS256'\n  | 'RS384'\n  | 'RS512'\n  | 'PS256'\n  | 'PS384'\n  | 'PS512'\n  | 'ES256'\n  | 'ES384';\n\n/**\n * JWT secret value: an HMAC secret, a CryptoKey (HMAC, or RSA/EC public or private key),\n * or a remote key set from {@link createJwks}.\n */\nexport type JwtSecret = string | BufferSource | CryptoKey | Jwks;\n\n/** Options for signing a JWT. */\nexport interface SignJwtOptions {\n  /** Signing algorithm (default: 'HS256'). */\n  algorithm?: JwtAlgorithm;\n  /** Expiration time (e.g., '1h', '7d', '30m', or seconds as number). */\n  expiresIn?: string | number;\n  /** Not before time (e.g., '5m', or seconds as number). */\n  notBefore?: string | number;\n  /** Issuer claim. */\n  issuer?: string;\n  /** Audience claim. */\n  audience?: string | string[];\n  /** Subject claim. */\n  subject?: string;\n  /** Key ID header (`kid`), used by verifiers to pick a key from a JWKS. */\n  keyId?: string;\n  /** Custom issued-at timestamp (defaults to now). */\n  issuedAt?: number | Date;\n}\n\n/** Options for verifying a JWT. */\nexport interface VerifyJwtOptions {\n  /** Allowed algorithms (default: ['HS256'] for HMAC secrets, ['RS256'] otherwise). */\n  algorithms?: JwtAlgorithm[];\n  /** Required issuer (`iss`); any of the given values is accepted. */\n  issuer?: string | string[];\n  /** Required audience (`aud`); the token must contain at least one of the given values. */\n  audience?: string | string[];\n  /** Seconds of clock skew allowed when checking `exp` and `nbf` (default: 0). */\n  clockTolerance?: number;\n}\n\n// =============================================================================\n// Internal Helpers\n// =============================================================================\n\n/** Web Crypto parameters for each JWT algorithm, used for key import, signing and verifying. */\ninterface AlgorithmSpec {\n  name: 'HMAC' | 'RSASSA-PKCS1-v1_5' | 'RSA-PSS' | 'ECDSA';\n  hash: string;\n  saltLength?: number;\n  namedCurve?: string;\n}\n\nconst ALGORITHMS: Record<JwtAlgorithm, AlgorithmSpec> = {\n  HS256: { name: 'HMAC', hash: 'SHA-256' },\n  HS384: { name: 'HMAC', hash: 'SHA-384' },\n  HS512: { name: 'HMAC', hash: 'SHA-512' },\n  RS256: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },\n  RS384: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-384' },\n  RS512: { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-512' },\n  PS256: { name: 'RSA-PSS', hash: 'SHA-256', saltLength: 32 },\n  PS384: { name: 'RSA-PSS', hash: 'SHA-384', saltLength: 48 },\n  PS512: { name: 'RSA-PSS', hash: 'SHA-512', saltLength: 64 },\n  ES256: { name: 'ECDSA', hash: 'SHA-256', namedCurve: 'P-256' },\n  ES384: { name: 'ECDSA', hash: 'SHA-384', namedCurve: 'P-384' },\n};\n\n/** Checks that a CryptoKey was created for exactly this algorithm. */\nfunction keyMatches(key: CryptoKey, spec: AlgorithmSpec): boolean {\n  const alg = key.algorithm as KeyAlgorithm & {\n    hash?: { name: string };\n    namedCurve?: string;\n    modulusLength?: number;\n  };\n  if (alg.name !== spec.name) return false;\n  if (spec.name === 'ECDSA') return alg.namedCurve === spec.namedCurve;\n  // Web Crypto accepts RSA keys too weak for signatures (RFC 7518 §3.3 requires 2048 bits).\n  if (spec.name !== 'HMAC' && (alg.modulusLength ?? 0) < 2048) return false;\n  return alg.hash?.name === spec.hash;\n}\n\n/** Checks that a JWK may be used to verify this algorithm. */\nfunction jwkMatches(jwk: JsonWebKey & { kid?: string }, alg: JwtAlgorithm): boolean {\n  const spec = ALGORITHMS[alg];\n  if (jwk.alg !== undefined && jwk.alg !== alg) return false;\n  if (jwk.use !== undefined && jwk.use !== 'sig') return false;\n  if (spec.name === 'ECDSA') return jwk.kty === 'EC' && jwk.crv === spec.namedCurve;\n  return spec.name !== 'HMAC' && jwk.kty === 'RSA';\n}\n\n/** Resolves the CryptoKey for a token, rejecting keys that don't fit its algorithm. */\nasync function resolveKey(\n  secret: JwtSecret,\n  alg: JwtAlgorithm,\n  kid: string | undefined,\n  usage: 'sign' | 'verify',\n): Promise<CryptoKey> {\n  const spec = ALGORITHMS[alg];\n  let key: CryptoKey;\n  if (secret instanceof Jwks) {\n    if (spec.name === 'HMAC') throw new Error(`Key does not match algorithm: ${alg}`);\n    key = await secret.getKey(alg, kid);\n  } else if (secret instanceof CryptoKey) {\n    key = secret;\n  } else {\n    if (spec.name !== 'HMAC') throw new Error(`Key does not match algorithm: ${alg}`);\n    const keyData = typeof secret === 'string' ? new TextEncoder().encode(secret) : secret;\n    key = await crypto.subtle.importKey('raw', keyData, spec, false, [usage]);\n  }\n  if (!keyMatches(key, spec)) throw new Error(`Key does not match algorithm: ${alg}`);\n  return key;\n}\n\n/** Decodes a base64url string to bytes. */\nfunction base64urlDecode(data: string): Uint8Array<ArrayBuffer> {\n  // Strict alphabet so each token has one encoding; atob alone tolerates padding and whitespace.\n  if (!/^[A-Za-z0-9_-]*$/.test(data)) throw new Error('Invalid JWT format');\n  return Uint8Array.from(atob(data.replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0));\n}\n\n/** Decodes a base64url JSON segment, without echoing its content in errors. */\nfunction decodeSegment(data: string): any {\n  let value: unknown;\n  try {\n    value = JSON.parse(new TextDecoder().decode(base64urlDecode(data)));\n  } catch {}\n  if (typeof value !== 'object' || value === null) throw new Error('Invalid JWT format');\n  return value;\n}\n\n/** Returns true if `actual` (a claim value) contains any of `expected`. */\nfunction claimMatches(actual: unknown, expected: string | string[]): boolean {\n  const values = Array.isArray(actual) ? actual : [actual];\n  return [expected].flat().some((e) => values.includes(e));\n}\n\n/**\n * Parses a duration string (e.g., '1h', '7d', '30m') to seconds.\n */\nfunction parseDuration(duration: string | number): number {\n  if (typeof duration === 'number') return duration;\n\n  const match = duration.match(/^(\\d+)\\s*(s|m|h|d|w)$/i);\n  if (!match) {\n    throw new Error(\n      `Invalid duration format: ${duration}. Use formats like '1h', '7d', '30m', '60s'.`,\n    );\n  }\n\n  const value = parseInt(match[1], 10);\n  const unit = match[2].toLowerCase();\n\n  switch (unit) {\n    case 's':\n      return value;\n    case 'm':\n      return value * 60;\n    case 'h':\n      return value * 60 * 60;\n    case 'd':\n      return value * 60 * 60 * 24;\n    case 'w':\n      return value * 60 * 60 * 24 * 7;\n    default:\n      throw new Error(`Unknown duration unit: ${unit}`);\n  }\n}\n\n/**\n * Base64url encodes a string or Uint8Array.\n */\nfunction base64urlEncode(data: string | Uint8Array): string {\n  const bytes = typeof data === 'string' ? new TextEncoder().encode(data) : data;\n  const binary = String.fromCharCode(...bytes);\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\n// =============================================================================\n// Public API\n// =============================================================================\n\n/**\n * Signs a JWT token using Web Crypto API.\n *\n * Uses only Web Crypto API, compatible with Cloudflare Workers, Deno, and browsers.\n *\n * @param payload - The JWT payload (custom claims)\n * @param secret - The signing secret (string, bytes, or private/HMAC CryptoKey)\n * @param options - Optional signing options (algorithm, expiresIn, issuer, etc.)\n * @returns The signed JWT token string\n *\n * @example\n * ```typescript\n * // Basic usage (HS256 by default)\n * const token = await jwtSign(\n *   { uid: 'user-123', role: 'admin' },\n *   'your-secret-key',\n *   { expiresIn: '1h' }\n * );\n *\n * // With HS512 algorithm\n * const token = await jwtSign(\n *   { uid: 'user-123' },\n *   process.env.JWT_SECRET,\n *   { algorithm: 'HS512', expiresIn: '7d' }\n * );\n * ```\n */\nexport async function jwtSign(\n  payload: Record<string, unknown>,\n  secret: JwtSecret,\n  options: SignJwtOptions = {},\n): Promise<string> {\n  const algorithm = options.algorithm || 'HS256';\n  const spec = ALGORITHMS[algorithm];\n  if (!spec) throw new Error(`Unknown algorithm: ${algorithm}`);\n\n  const now = options.issuedAt\n    ? options.issuedAt instanceof Date\n      ? Math.floor(options.issuedAt.getTime() / 1000)\n      : options.issuedAt\n    : Math.floor(Date.now() / 1000);\n\n  // Build the final payload with registered claims.\n  const finalPayload: JwtPayload = {\n    ...payload,\n    iat: now,\n  };\n\n  if (options.expiresIn !== undefined) {\n    finalPayload.exp = now + parseDuration(options.expiresIn);\n  }\n\n  if (options.notBefore !== undefined) {\n    finalPayload.nbf = now + parseDuration(options.notBefore);\n  }\n\n  if (options.issuer !== undefined) {\n    finalPayload.iss = options.issuer;\n  }\n\n  if (options.audience !== undefined) {\n    finalPayload.aud = options.audience;\n  }\n\n  if (options.subject !== undefined) {\n    finalPayload.sub = options.subject;\n  }\n\n  // Create header.\n  const header = {\n    alg: algorithm,\n    typ: 'JWT',\n    ...(options.keyId !== undefined && { kid: options.keyId }),\n  };\n\n  // Encode header and payload.\n  const headerB64 = base64urlEncode(JSON.stringify(header));\n  const payloadB64 = base64urlEncode(JSON.stringify(finalPayload));\n  const data = `${headerB64}.${payloadB64}`;\n\n  if (secret instanceof Jwks) throw new Error('Cannot sign with a JWKS');\n  const key = await resolveKey(secret, algorithm, undefined, 'sign');\n  const signatureBuffer = await crypto.subtle.sign(spec, key, new TextEncoder().encode(data));\n\n  const signatureB64 = base64urlEncode(new Uint8Array(signatureBuffer));\n\n  return `${data}.${signatureB64}`;\n}\n\n/**\n * Verifies a JWT token using Web Crypto API.\n *\n * Uses only Web Crypto API, compatible with Cloudflare Workers, Deno, and browsers.\n *\n * @param token - The JWT token string to verify\n * @param secret - The verification key (string, bytes, CryptoKey, or JWKS)\n * @param options - Optional verification options\n * @returns The decoded JWT payload\n * @throws Error if the token is invalid, expired, or not yet valid\n *\n * @example\n * ```typescript\n * import { jwtVerify } from '@fresho/router/auth';\n *\n * try {\n *   const payload = await jwtVerify(token, 'your-secret-key');\n *   console.log(payload.sub); // user ID\n * } catch (error) {\n *   console.error('Invalid token:', error.message);\n * }\n *\n * // With specific algorithms\n * const payload = await jwtVerify(token, secret, { algorithms: ['HS512'] });\n * ```\n */\nexport async function jwtVerify(\n  token: string,\n  secret: JwtSecret,\n  options: VerifyJwtOptions = {},\n): Promise<JwtPayload> {\n  const symmetric =\n    !(secret instanceof Jwks) && !(secret instanceof CryptoKey && secret.algorithm.name !== 'HMAC');\n  const algorithms = options.algorithms || [symmetric ? 'HS256' : 'RS256'];\n\n  const parts = token.split('.');\n  if (parts.length !== 3) {\n    throw new Error('Invalid JWT format');\n  }\n\n  const [headerB64, payloadB64, signatureB64] = parts;\n\n  // Decode header; the allowed list, not the token, decides which algorithms are acceptable.\n  const header = decodeSegment(headerB64);\n  if (!algorithms.includes(header.alg) || !Object.hasOwn(ALGORITHMS, header.alg)) {\n    throw new Error(`Unsupported algorithm: ${header.alg}`);\n  }\n  const alg = header.alg as JwtAlgorithm;\n  if (header.kid !== undefined && typeof header.kid !== 'string') {\n    throw new Error('Invalid JWT format');\n  }\n  // No extensions are supported, so any critical one must be rejected (RFC 7515 §4.1.11).\n  if (header.crit !== undefined) {\n    throw new Error('Unsupported critical header');\n  }\n  const kid: string | undefined = header.kid;\n\n  const key = await resolveKey(secret, alg, kid, 'verify');\n  const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\n  const valid = await crypto.subtle.verify(\n    ALGORITHMS[alg],\n    key,\n    base64urlDecode(signatureB64),\n    data,\n  );\n\n  if (!valid) {\n    throw new Error('Invalid signature');\n  }\n\n  const payload = decodeSegment(payloadB64);\n\n  const now = Date.now() / 1000;\n  const tolerance = options.clockTolerance ?? 0;\n  if (\n    payload.exp !== undefined &&\n    !(typeof payload.exp === 'number' && payload.exp + tolerance >= now)\n  ) {\n    throw new Error('Token expired');\n  }\n  if (\n    payload.nbf !== undefined &&\n    !(typeof payload.nbf === 'number' && payload.nbf - tolerance <= now)\n  ) {\n    throw new Error('Token not yet valid');\n  }\n\n  if (\n    options.issuer !== undefined &&\n    (typeof payload.iss !== 'string' || !claimMatches(payload.iss, options.issuer))\n  ) {\n    throw new Error('Invalid issuer');\n  }\n\n  if (options.audience !== undefined && !claimMatches(payload.aud, options.audience)) {\n    throw new Error('Invalid audience');\n  }\n\n  return payload as JwtPayload;\n}\n\n// =============================================================================\n// Remote JWKS\n// =============================================================================\n\n/** How long fetched keys are trusted before the set is reloaded. */\nconst JWKS_MAX_AGE_MS = 10 * 60 * 1000;\n\n/** Minimum time between fetch attempts, successful or not. */\nconst JWKS_COOLDOWN_MS = 30 * 1000;\n\n/** Abort a JWKS fetch that takes longer than this. */\nconst JWKS_TIMEOUT_MS = 5 * 1000;\n\n/** A remote JSON Web Key Set, fetched lazily and cached. Create with {@link createJwks}. */\nexport class Jwks {\n  private keys: (JsonWebKey & { kid?: string })[] = [];\n  private fetchedAt = Number.NEGATIVE_INFINITY;\n  private attemptedAt = Number.NEGATIVE_INFINITY;\n  private pending?: Promise<void>;\n\n  constructor(readonly url: string) {}\n\n  /** Returns the verification key for `alg` and `kid`, reloading when stale or the kid is unknown. */\n  async getKey(alg: JwtAlgorithm, kid: string | undefined): Promise<CryptoKey> {\n    if (Date.now() - this.fetchedAt > JWKS_MAX_AGE_MS) await this.refresh();\n    let candidates = this.match(alg, kid);\n    if (candidates.length === 0) {\n      await this.refresh();\n      candidates = this.match(alg, kid);\n    }\n    // Without a kid the choice must be unambiguous.\n    if (candidates.length !== 1) throw new Error('No matching key in JWKS');\n    return crypto.subtle.importKey('jwk', candidates[0], ALGORITHMS[alg], false, ['verify']);\n  }\n\n  private match(alg: JwtAlgorithm, kid: string | undefined) {\n    return this.keys.filter((k) => (kid === undefined || k.kid === kid) && jwkMatches(k, alg));\n  }\n\n  /** Joins an in-flight load or starts one at most once per cooldown; keeps old keys on failure. */\n  private async refresh(): Promise<void> {\n    if (!this.pending) {\n      if (Date.now() - this.attemptedAt < JWKS_COOLDOWN_MS) return;\n      this.attemptedAt = Date.now();\n      this.pending = this.load().finally(() => {\n        this.pending = undefined;\n      });\n    }\n    try {\n      await this.pending;\n    } catch (error) {\n      if (this.keys.length === 0) throw error;\n    }\n  }\n\n  private async load(): Promise<void> {\n    const response = await fetch(this.url, {\n      headers: { Accept: 'application/json' },\n      signal: AbortSignal.timeout(JWKS_TIMEOUT_MS),\n    });\n    if (!response.ok) throw new Error(`JWKS fetch failed: ${response.status}`);\n    const body = (await response.json().catch(() => ({}))) as { keys?: unknown };\n    const keys = Array.isArray(body.keys)\n      ? body.keys.filter((k) => typeof k === 'object' && k !== null)\n      : [];\n    if (keys.length === 0) throw new Error('JWKS response has no keys');\n    this.keys = keys;\n    this.fetchedAt = Date.now();\n  }\n}\n\n/**\n * Creates a cached remote key set for verifying tokens from an OAuth/OIDC provider.\n *\n * Create it once (e.g. at module scope) and pass it as the secret. Keys are selected by the\n * token's `kid` and must match its algorithm; an unknown `kid` triggers a rate-limited reload.\n *\n * @example\n * ```typescript\n * const jwks = createJwks('https://example.auth0.com/.well-known/jwks.json');\n * const payload = await jwtVerify(token, jwks, {\n *   algorithms: ['RS256'],\n *   issuer: 'https://example.auth0.com/',\n *   audience: 'https://api.example.com',\n * });\n * ```\n */\nexport function createJwks(url: string | URL): Jwks {\n  return new Jwks(String(url));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsDA,SAAgB,eAAe,YAAoD;AACjF,KAAI,CAAC,YAAY,WAAW,SAAS,CACnC,QAAO;AAGT,KAAI;EACF,MAAM,UAAU,WAAW,MAAM,EAAE;EACnC,MAAM,UAAU,KAAK,QAAQ;EAC7B,MAAM,aAAa,QAAQ,QAAQ,IAAI;AAEvC,MAAI,eAAe,GACjB,QAAO;AAGT,SAAO;GACL,UAAU,QAAQ,UAAU,GAAG,WAAW;GAC1C,UAAU,QAAQ,UAAU,aAAa,EAAE;GAC5C;SACK;AACN,SAAO;;;;;;;;;;;;;;;;;;AAmBX,SAAgB,gBAAgB,UAAkB,UAA0B;AAC1E,QAAO,SAAS,KAAK,GAAG,SAAS,GAAG,WAAW;;;;;;;;AASjD,SAAgB,sBAAsB,YAA0C;AAC9E,KAAI,CAAC,YAAY,WAAW,SAAS,CACnC,QAAO;AAET,QAAO,WAAW,MAAM,EAAE;;;;;ACG5B,MAAMA,aAAkD;CACtD,OAAO;EAAE,MAAM;EAAQ,MAAM;EAAW;CACxC,OAAO;EAAE,MAAM;EAAQ,MAAM;EAAW;CACxC,OAAO;EAAE,MAAM;EAAQ,MAAM;EAAW;CACxC,OAAO;EAAE,MAAM;EAAqB,MAAM;EAAW;CACrD,OAAO;EAAE,MAAM;EAAqB,MAAM;EAAW;CACrD,OAAO;EAAE,MAAM;EAAqB,MAAM;EAAW;CACrD,OAAO;EAAE,MAAM;EAAW,MAAM;EAAW,YAAY;EAAI;CAC3D,OAAO;EAAE,MAAM;EAAW,MAAM;EAAW,YAAY;EAAI;CAC3D,OAAO;EAAE,MAAM;EAAW,MAAM;EAAW,YAAY;EAAI;CAC3D,OAAO;EAAE,MAAM;EAAS,MAAM;EAAW,YAAY;EAAS;CAC9D,OAAO;EAAE,MAAM;EAAS,MAAM;EAAW,YAAY;EAAS;CAC/D;;AAGD,SAAS,WAAW,KAAgB,MAA8B;CAChE,MAAM,MAAM,IAAI;AAKhB,KAAI,IAAI,SAAS,KAAK,KAAM,QAAO;AACnC,KAAI,KAAK,SAAS,QAAS,QAAO,IAAI,eAAe,KAAK;AAE1D,KAAI,KAAK,SAAS,WAAW,IAAI,iBAAiB,KAAK,KAAM,QAAO;AACpE,QAAO,IAAI,MAAM,SAAS,KAAK;;;AAIjC,SAAS,WAAW,KAAoC,KAA4B;CAClF,MAAM,OAAO,WAAW;AACxB,KAAI,IAAI,QAAQ,UAAa,IAAI,QAAQ,IAAK,QAAO;AACrD,KAAI,IAAI,QAAQ,UAAa,IAAI,QAAQ,MAAO,QAAO;AACvD,KAAI,KAAK,SAAS,QAAS,QAAO,IAAI,QAAQ,QAAQ,IAAI,QAAQ,KAAK;AACvE,QAAO,KAAK,SAAS,UAAU,IAAI,QAAQ;;;AAI7C,eAAe,WACb,QACA,KACA,KACA,OACoB;CACpB,MAAM,OAAO,WAAW;CACxB,IAAIC;AACJ,KAAI,kBAAkB,MAAM;AAC1B,MAAI,KAAK,SAAS,OAAQ,OAAM,IAAI,MAAM,iCAAiC,MAAM;AACjF,QAAM,MAAM,OAAO,OAAO,KAAK,IAAI;YAC1B,kBAAkB,UAC3B,OAAM;MACD;AACL,MAAI,KAAK,SAAS,OAAQ,OAAM,IAAI,MAAM,iCAAiC,MAAM;EACjF,MAAM,UAAU,OAAO,WAAW,WAAW,IAAI,aAAa,CAAC,OAAO,OAAO,GAAG;AAChF,QAAM,MAAM,OAAO,OAAO,UAAU,OAAO,SAAS,MAAM,OAAO,CAAC,MAAM,CAAC;;AAE3E,KAAI,CAAC,WAAW,KAAK,KAAK,CAAE,OAAM,IAAI,MAAM,iCAAiC,MAAM;AACnF,QAAO;;;AAIT,SAAS,gBAAgB,MAAuC;AAE9D,KAAI,CAAC,mBAAmB,KAAK,KAAK,CAAE,OAAM,IAAI,MAAM,qBAAqB;AACzE,QAAO,WAAW,KAAK,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC;;;AAIlG,SAAS,cAAc,MAAmB;CACxC,IAAIC;AACJ,KAAI;AACF,UAAQ,KAAK,MAAM,IAAI,aAAa,CAAC,OAAO,gBAAgB,KAAK,CAAC,CAAC;SAC7D;AACR,KAAI,OAAO,UAAU,YAAY,UAAU,KAAM,OAAM,IAAI,MAAM,qBAAqB;AACtF,QAAO;;;AAIT,SAAS,aAAa,QAAiB,UAAsC;CAC3E,MAAM,SAAS,MAAM,QAAQ,OAAO,GAAG,SAAS,CAAC,OAAO;AACxD,QAAO,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,MAAM,OAAO,SAAS,EAAE,CAAC;;;;;AAM1D,SAAS,cAAc,UAAmC;AACxD,KAAI,OAAO,aAAa,SAAU,QAAO;CAEzC,MAAM,QAAQ,SAAS,MAAM,yBAAyB;AACtD,KAAI,CAAC,MACH,OAAM,IAAI,MACR,4BAA4B,SAAS,8CACtC;CAGH,MAAM,QAAQ,SAAS,MAAM,IAAI,GAAG;CACpC,MAAM,OAAO,MAAM,GAAG,aAAa;AAEnC,SAAQ,MAAR;EACE,KAAK,IACH,QAAO;EACT,KAAK,IACH,QAAO,QAAQ;EACjB,KAAK,IACH,QAAO,QAAQ,KAAK;EACtB,KAAK,IACH,QAAO,QAAQ,KAAK,KAAK;EAC3B,KAAK,IACH,QAAO,QAAQ,KAAK,KAAK,KAAK;EAChC,QACE,OAAM,IAAI,MAAM,0BAA0B,OAAO;;;;;;AAOvD,SAAS,gBAAgB,MAAmC;CAC1D,MAAM,QAAQ,OAAO,SAAS,WAAW,IAAI,aAAa,CAAC,OAAO,KAAK,GAAG;CAC1E,MAAM,SAAS,OAAO,aAAa,GAAG,MAAM;AAC5C,QAAO,KAAK,OAAO,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkChF,eAAsB,QACpB,SACA,QACA,UAA0B,EAAE,EACX;CACjB,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,OAAO,WAAW;AACxB,KAAI,CAAC,KAAM,OAAM,IAAI,MAAM,sBAAsB,YAAY;CAE7D,MAAM,MAAM,QAAQ,WAChB,QAAQ,oBAAoB,OAC1B,KAAK,MAAM,QAAQ,SAAS,SAAS,GAAG,IAAK,GAC7C,QAAQ,WACV,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;CAGjC,MAAMC,eAA2B;EAC/B,GAAG;EACH,KAAK;EACN;AAED,KAAI,QAAQ,cAAc,OACxB,cAAa,MAAM,MAAM,cAAc,QAAQ,UAAU;AAG3D,KAAI,QAAQ,cAAc,OACxB,cAAa,MAAM,MAAM,cAAc,QAAQ,UAAU;AAG3D,KAAI,QAAQ,WAAW,OACrB,cAAa,MAAM,QAAQ;AAG7B,KAAI,QAAQ,aAAa,OACvB,cAAa,MAAM,QAAQ;AAG7B,KAAI,QAAQ,YAAY,OACtB,cAAa,MAAM,QAAQ;CAI7B,MAAM,SAAS;EACb,KAAK;EACL,KAAK;EACL,GAAI,QAAQ,UAAU,UAAa,EAAE,KAAK,QAAQ,OAAO;EAC1D;CAKD,MAAM,OAAO,GAFK,gBAAgB,KAAK,UAAU,OAAO,CAAC,CAE/B,GADP,gBAAgB,KAAK,UAAU,aAAa,CAAC;AAGhE,KAAI,kBAAkB,KAAM,OAAM,IAAI,MAAM,0BAA0B;CACtE,MAAM,MAAM,MAAM,WAAW,QAAQ,WAAW,QAAW,OAAO;CAClE,MAAM,kBAAkB,MAAM,OAAO,OAAO,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,KAAK,CAAC;AAI3F,QAAO,GAAG,KAAK,GAFM,gBAAgB,IAAI,WAAW,gBAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BvE,eAAsB,UACpB,OACA,QACA,UAA4B,EAAE,EACT;CACrB,MAAM,YACJ,EAAE,kBAAkB,SAAS,EAAE,kBAAkB,aAAa,OAAO,UAAU,SAAS;CAC1F,MAAM,aAAa,QAAQ,cAAc,CAAC,YAAY,UAAU,QAAQ;CAExE,MAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,KAAI,MAAM,WAAW,EACnB,OAAM,IAAI,MAAM,qBAAqB;CAGvC,MAAM,CAAC,WAAW,YAAY,gBAAgB;CAG9C,MAAM,SAAS,cAAc,UAAU;AACvC,KAAI,CAAC,WAAW,SAAS,OAAO,IAAI,IAAI,CAAC,OAAO,OAAO,YAAY,OAAO,IAAI,CAC5E,OAAM,IAAI,MAAM,0BAA0B,OAAO,MAAM;CAEzD,MAAM,MAAM,OAAO;AACnB,KAAI,OAAO,QAAQ,UAAa,OAAO,OAAO,QAAQ,SACpD,OAAM,IAAI,MAAM,qBAAqB;AAGvC,KAAI,OAAO,SAAS,OAClB,OAAM,IAAI,MAAM,8BAA8B;CAEhD,MAAMC,MAA0B,OAAO;CAEvC,MAAM,MAAM,MAAM,WAAW,QAAQ,KAAK,KAAK,SAAS;CACxD,MAAM,OAAO,IAAI,aAAa,CAAC,OAAO,GAAG,UAAU,GAAG,aAAa;AAQnE,KAAI,CAPU,MAAM,OAAO,OAAO,OAChC,WAAW,MACX,KACA,gBAAgB,aAAa,EAC7B,KACD,CAGC,OAAM,IAAI,MAAM,oBAAoB;CAGtC,MAAM,UAAU,cAAc,WAAW;CAEzC,MAAM,MAAM,KAAK,KAAK,GAAG;CACzB,MAAM,YAAY,QAAQ,kBAAkB;AAC5C,KACE,QAAQ,QAAQ,UAChB,EAAE,OAAO,QAAQ,QAAQ,YAAY,QAAQ,MAAM,aAAa,KAEhE,OAAM,IAAI,MAAM,gBAAgB;AAElC,KACE,QAAQ,QAAQ,UAChB,EAAE,OAAO,QAAQ,QAAQ,YAAY,QAAQ,MAAM,aAAa,KAEhE,OAAM,IAAI,MAAM,sBAAsB;AAGxC,KACE,QAAQ,WAAW,WAClB,OAAO,QAAQ,QAAQ,YAAY,CAAC,aAAa,QAAQ,KAAK,QAAQ,OAAO,EAE9E,OAAM,IAAI,MAAM,iBAAiB;AAGnC,KAAI,QAAQ,aAAa,UAAa,CAAC,aAAa,QAAQ,KAAK,QAAQ,SAAS,CAChF,OAAM,IAAI,MAAM,mBAAmB;AAGrC,QAAO;;;AAQT,MAAM,kBAAkB,MAAU;;AAGlC,MAAM,mBAAmB,KAAK;;AAG9B,MAAM,kBAAkB,IAAI;;AAG5B,IAAa,OAAb,MAAkB;CAChB,AAAQ,OAA0C,EAAE;CACpD,AAAQ,YAAY,OAAO;CAC3B,AAAQ,cAAc,OAAO;CAC7B,AAAQ;CAER,YAAY,AAASC,KAAa;EAAb;;;CAGrB,MAAM,OAAO,KAAmB,KAA6C;AAC3E,MAAI,KAAK,KAAK,GAAG,KAAK,YAAY,gBAAiB,OAAM,KAAK,SAAS;EACvE,IAAI,aAAa,KAAK,MAAM,KAAK,IAAI;AACrC,MAAI,WAAW,WAAW,GAAG;AAC3B,SAAM,KAAK,SAAS;AACpB,gBAAa,KAAK,MAAM,KAAK,IAAI;;AAGnC,MAAI,WAAW,WAAW,EAAG,OAAM,IAAI,MAAM,0BAA0B;AACvE,SAAO,OAAO,OAAO,UAAU,OAAO,WAAW,IAAI,WAAW,MAAM,OAAO,CAAC,SAAS,CAAC;;CAG1F,AAAQ,MAAM,KAAmB,KAAyB;AACxD,SAAO,KAAK,KAAK,QAAQ,OAAO,QAAQ,UAAa,EAAE,QAAQ,QAAQ,WAAW,GAAG,IAAI,CAAC;;;CAI5F,MAAc,UAAyB;AACrC,MAAI,CAAC,KAAK,SAAS;AACjB,OAAI,KAAK,KAAK,GAAG,KAAK,cAAc,iBAAkB;AACtD,QAAK,cAAc,KAAK,KAAK;AAC7B,QAAK,UAAU,KAAK,MAAM,CAAC,cAAc;AACvC,SAAK,UAAU;KACf;;AAEJ,MAAI;AACF,SAAM,KAAK;WACJ,OAAO;AACd,OAAI,KAAK,KAAK,WAAW,EAAG,OAAM;;;CAItC,MAAc,OAAsB;EAClC,MAAM,WAAW,MAAM,MAAM,KAAK,KAAK;GACrC,SAAS,EAAE,QAAQ,oBAAoB;GACvC,QAAQ,YAAY,QAAQ,gBAAgB;GAC7C,CAAC;AACF,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,sBAAsB,SAAS,SAAS;EAC1E,MAAM,OAAQ,MAAM,SAAS,MAAM,CAAC,aAAa,EAAE,EAAE;EACrD,MAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,GACjC,KAAK,KAAK,QAAQ,MAAM,OAAO,MAAM,YAAY,MAAM,KAAK,GAC5D,EAAE;AACN,MAAI,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACnE,OAAK,OAAO;AACZ,OAAK,YAAY,KAAK,KAAK;;;;;;;;;;;;;;;;;;;AAoB/B,SAAgB,WAAW,KAAyB;AAClD,QAAO,IAAI,KAAK,OAAO,IAAI,CAAC"}

package/dist/mcp/index.d.mts

@@ -0,0 +1,63 @@
+import { h as RouterRoutes, p as Router, t as Middleware } from "../middleware-zRMBpTLe.mjs";
+
+//#region src/mcp/index.d.ts
+
+/** OAuth 2.0 protected resource settings (RFC 9728). */
+interface McpOAuthOptions {
+  /** Issuer URLs of the authorization servers that issue tokens for this server. */
+  authorizationServers: string[];
+  /** Scopes advertised to clients. */
+  scopes?: string[];
+}
+/** MCP server options. */
+interface McpOptions {
+  /** Server name reported to clients. */
+  name: string;
+  /** Server version reported to clients. */
+  version: string;
+  /** Instructions for agents on how to use the tools. */
+  instructions?: string;
+  /** Advertise OAuth: 401s gain a `resource_metadata` challenge and metadata is served. */
+  oauth?: McpOAuthOptions;
+  /** Allow an endpoint without middleware: it is open, or already guarded by parent routers. */
+  public?: boolean;
+}
+/**
+ * Creates an MCP endpoint exposing routes as tools.
+ *
+ * Mount the result in a router (e.g. `mcp: mcp({ users }, options, auth)`). Tool names come from
+ * `route.operationId` or the method and path (`get_users`, `delete_users_by_id`), descriptions
+ * from `route.description`, and flat inputs from the route's path params and query/body schemas.
+ *
+ * Middleware passed after `options` guards the endpoint itself, and is required unless
+ * `options.public` is set; put auth there so unauthenticated
+ * clients get an HTTP 401 (with an OAuth challenge when `oauth` is set). Context it adds reaches
+ * handlers. Middleware on the given routers runs on every tool call, with the caller's headers
+ * forwarded; middleware on their parents elsewhere in the app does not.
+ *
+ * With `oauth`, metadata is served at `<endpoint>/.well-known/oauth-protected-resource` and
+ * referenced from the 401 challenge. Mount {@link oauthProtectedResource} at the origin root as
+ * well for clients that probe `/.well-known/oauth-protected-resource/<endpoint>` first.
+ *
+ * @param routes - A router, or a record of routers mounted under their keys
+ * @param options - Server info and optional OAuth settings
+ * @param middleware - Middleware for the MCP endpoint
+ */
+declare function mcp(routes: Router<RouterRoutes> | Record<string, Router<RouterRoutes>>, options: McpOptions, ...middleware: Middleware[]): Router<RouterRoutes>;
+/**
+ * Creates RFC 9728 protected resource metadata routes to mount as `'.well-known'` at the origin
+ * root, serving `/.well-known/oauth-protected-resource` and
+ * `/.well-known/oauth-protected-resource/<resource>` for single-segment resource paths like `/mcp`.
+ *
+ * @example
+ * ```typescript
+ * router({
+ *   mcp: mcp({ users }, { name: 'api', version: '1.0.0', oauth }, jwtAuth({ ... })),
+ *   '.well-known': oauthProtectedResource(oauth),
+ * });
+ * ```
+ */
+declare function oauthProtectedResource(oauth: McpOAuthOptions): Router<RouterRoutes>;
+//#endregion
+export { McpOAuthOptions, McpOptions, mcp, oauthProtectedResource };
+//# sourceMappingURL=index.d.mts.map

package/dist/mcp/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/mcp/index.ts"],"sourcesContent":[],"mappings":";;;;;UA4CiB,eAAA;;;;;;;UAQA,UAAA;;;;;;;;UAQP;;;;;;;;;;;;;;;;;;;;;;;;;iBAgRM,GAAA,SACN,OAAO,gBAAgB,eAAe,OAAO,yBAC5C,2BACM,eACd,OAAO;;;;;;;;;;;;;;iBAyDM,sBAAA,QAA8B,kBAAkB,OAAO"}