@hawcx/oauth-client 5.1.0 → 6.0.0

package/dist/management/jwt_transport.d.ts

@@ -0,0 +1,150 @@
+/**
+ * JWT-bearer transport for the Hawcx management API (Path A: private_key_jwt).
+ *
+ * Each request is authenticated with a per-request EdDSA JWT whose `aud` is
+ * the full request URL, carrying a `body_sha256` claim over the EXACT bytes
+ * sent.  This mirrors the wire contract verified end-to-end against hx_auth
+ * (see spec.md §management-api-auth / Python SDK Path A implementation).
+ *
+ * Construction:
+ *   const transport = new JwtBearerTransport({
+ *     baseUrl: 'https://api.hawcx.com',
+ *     configId: 'your-config-id',
+ *     clientId: 'your-client-id',
+ *     oidcSigningKey: pkcs8Pem,   // Ed25519 PKCS#8 PEM — same key registered in admin console
+ *     kid: 'key-id',
+ *   });
+ *
+ * The `http` constructor option accepts an injectable fetch-compatible function
+ * (same signature as the global `fetch`) for testing.
+ */
+import { type JWK } from 'jose';
+import type { KeyLike } from 'jose';
+import type { JsonObject } from '../delegation/transport';
+/**
+ * A fetch-compatible callable — accepts `(url: string, init: RequestInit)`
+ * and returns a `Promise<Response>`.  Mirrors the global `fetch` signature so
+ * the real `fetch` can be passed unchanged.
+ */
+export type HttpFetch = (url: string, init: RequestInit) => Promise<Response>;
+export interface JwtBearerTransportOptions {
+    /**
+     * Base URL of the management API, e.g. `https://api.hawcx.com`.  Must be
+     * `https:` (plain `http:` only for `localhost` / `127.0.0.1` / `[::1]`),
+     * without credentials, query or fragment.  May carry a path prefix
+     * (e.g. `https://gateway.example.com/hawcx`).  Validated at construction;
+     * an invalid value throws `DelegationRequestError`.
+     */
+    baseUrl: string;
+    /** Tenant config identifier; forwarded as `X-Config-Id`. */
+    configId: string;
+    /**
+     * Ed25519 private signing key.  Accepts:
+     *   - PKCS#8 PEM string (e.g. `"-----BEGIN PRIVATE KEY-----\n…"`)
+     *   - JWK object `{ kty:'OKP', crv:'Ed25519', d, x, kid? }`
+     *   - jose `KeyLike` / `CryptoKey` already imported
+     */
+    oidcSigningKey: string | JWK | KeyLike;
+    /** Key ID embedded in the JWT `kid` header. */
+    kid: string;
+    /** OAuth client ID; used as both `iss` and `sub` in the per-request JWT. */
+    clientId: string;
+    /**
+     * JWT time-to-live in seconds (default: 60).  The server rejects tokens
+     * older than its configured TTL; do not set this above 120.
+     */
+    jwtTtlSeconds?: number;
+    /**
+     * Per-request timeout in seconds (default: 15).  A stalled
+     * (connected-but-silent) server would otherwise hang the call forever and
+     * can exhaust connection pools server-side.  Mirrors the ECIES
+     * `DelegationTransport`'s 15s `AbortController`.
+     */
+    timeoutSeconds?: number;
+    /**
+     * Injectable fetch implementation.  Defaults to the global `fetch`
+     * (Node >= 18).  Pass a capturing fake in tests.
+     */
+    http?: HttpFetch;
+    /**
+     * OIDC issuer whose `${issuer}/.well-known/jwks.json` publishes the key that
+     * signs management responses (the same JWKS that verifies ID tokens).
+     * Defaults to `baseUrl` — in every Hawcx environment the management API and
+     * the OP share one public host (e.g. `https://api.hawcx.com`).  Set this
+     * only when they differ (e.g. local dev with separate ports).  Same URL
+     * rules as `baseUrl`.
+     */
+    issuer?: string;
+    /**
+     * Verify the `X-Response-Signature` JWS on every successful response
+     * (default: `true`).  A response with a missing or invalid signature is
+     * rejected with `DelegationResponseError`.
+     *
+     * Failures throw `ResponseSignatureInvalidError` (bad/missing signature) or
+     * `ResponseSignatureUnavailableError` (signing keys could not be fetched —
+     * the request may already have been applied server-side); both extend
+     * `DelegationResponseError` and expose a stable `code`.
+     *
+     * **Emergency escape hatch only.**  Setting `false` makes the SDK trust any
+     * response body it receives, unauthenticated; a one-time process warning is
+     * emitted.  Do not disable in production.
+     */
+    verifyResponseSignature?: boolean;
+    /**
+     * Allowed difference in seconds between local time and the response
+     * signature's `iat` (default: 300) — same default as the ECIES transport's
+     * response timestamp skew.
+     */
+    clockSkewSeconds?: number;
+}
+/**
+ * Drop-in transport for the management API that authenticates via a per-request
+ * EdDSA JWT (`private_key_jwt`, Path A).
+ *
+ * The `send` method has the same name and signature as `DelegationTransport.send`
+ * so the factory can swap transports behind `StepUpClient` without any change to
+ * the business-method layer.
+ */
+export declare class JwtBearerTransport {
+    private readonly baseUrl;
+    private readonly configId;
+    private readonly kid;
+    private readonly clientId;
+    private readonly jwtTtlSeconds;
+    private readonly timeoutMs;
+    private readonly http;
+    /** `null` only when verification was explicitly disabled. */
+    private readonly responseVerifier;
+    /** Lazily-imported (and memoised) signing key. */
+    private keyPromise?;
+    private readonly importKeyFn;
+    constructor(options: JwtBearerTransportOptions);
+    private importKey;
+    /**
+     * Mint a per-request EdDSA JWT.
+     *
+     * @param audience - full request URL (base joined with endpoint), pinned per-call
+     * @param bodySha256 - base64url (no-padding) of SHA-256 over the exact body bytes
+     */
+    private mintJwt;
+    /**
+     * Send an authenticated POST to `endpoint` with `payload` serialised as JSON.
+     *
+     * Matches the signature of `DelegationTransport.send` so the two transports
+     * are drop-in substitutes behind `StepUpClient`.
+     *
+     * @param options.endpoint - API path relative to `baseUrl`, e.g.
+     *   `/v1/management/stepup/start-token`.  Must start with a single `/`;
+     *   anything that would resolve off the configured origin or out of its path
+     *   prefix throws `DelegationRequestError` before the request is signed.
+     * @param options.payload  - request body; serialised once and hashed; the
+     *   EXACT same bytes are sent and hashed — no double-serialisation.
+     * @param options.headers  - optional extra headers merged last (win over built-ins)
+     */
+    send<TReq extends JsonObject, TRes extends JsonObject>(options: {
+        endpoint: string;
+        payload: TReq;
+        headers?: Record<string, string>;
+    }): Promise<TRes>;
+}
+//# sourceMappingURL=jwt_transport.d.ts.map

package/dist/management/jwt_transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt_transport.d.ts","sourceRoot":"","sources":["../../src/management/jwt_transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAAmC,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAc1D;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE9E,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC;IACvC,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;OAaG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAY;IACjC,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmC;IAEpE,kDAAkD;IAClD,OAAO,CAAC,UAAU,CAAC,CAAuB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;gBAE7C,OAAO,EAAE,yBAAyB;IAgE9C,OAAO,CAAC,SAAS;IAajB;;;;;OAKG;YACW,OAAO;IAiBrB;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,IAAI,SAAS,UAAU,EAAE,IAAI,SAAS,UAAU,EAAE,OAAO,EAAE;QACpE,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,IAAI,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,IAAI,CAAC;CAgGlB"}

package/dist/management/jwt_transport.js

@@ -0,0 +1,245 @@
+"use strict";
+/**
+ * JWT-bearer transport for the Hawcx management API (Path A: private_key_jwt).
+ *
+ * Each request is authenticated with a per-request EdDSA JWT whose `aud` is
+ * the full request URL, carrying a `body_sha256` claim over the EXACT bytes
+ * sent.  This mirrors the wire contract verified end-to-end against hx_auth
+ * (see spec.md §management-api-auth / Python SDK Path A implementation).
+ *
+ * Construction:
+ *   const transport = new JwtBearerTransport({
+ *     baseUrl: 'https://api.hawcx.com',
+ *     configId: 'your-config-id',
+ *     clientId: 'your-client-id',
+ *     oidcSigningKey: pkcs8Pem,   // Ed25519 PKCS#8 PEM — same key registered in admin console
+ *     kid: 'key-id',
+ *   });
+ *
+ * The `http` constructor option accepts an injectable fetch-compatible function
+ * (same signature as the global `fetch`) for testing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtBearerTransport = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_crypto_2 = require("node:crypto");
+const jose_1 = require("jose");
+const exceptions_1 = require("../delegation/exceptions");
+const url_1 = require("../internal/url");
+const response_signature_1 = require("./response_signature");
+/** Config/URL errors surface as `DelegationRequestError`, like other request failures. */
+const urlError = (message, cause) => new exceptions_1.DelegationRequestError(message, cause === undefined ? {} : { cause });
+/** Emit the "verification disabled" warning at most once per process. */
+let responseSignatureDisabledWarned = false;
+/**
+ * Drop-in transport for the management API that authenticates via a per-request
+ * EdDSA JWT (`private_key_jwt`, Path A).
+ *
+ * The `send` method has the same name and signature as `DelegationTransport.send`
+ * so the factory can swap transports behind `StepUpClient` without any change to
+ * the business-method layer.
+ */
+class JwtBearerTransport {
+    constructor(options) {
+        // Parsed and validated once (TOB-HSDK-13): every signed request is built
+        // from this structured origin + path prefix, never by string concatenation.
+        this.baseUrl = (0, url_1.parseSecureBaseUrl)('baseUrl', options.baseUrl, urlError);
+        this.configId = options.configId;
+        this.kid = options.kid;
+        this.clientId = options.clientId;
+        this.jwtTtlSeconds = options.jwtTtlSeconds ?? 60;
+        this.timeoutMs = (options.timeoutSeconds ?? 15) * 1000;
+        this.http = options.http ?? ((...args) => fetch(...args));
+        // Response authentication (TOB-HSDK-11).  The JWKS URL is derived from the
+        // validated issuer with the same structured join as request URLs.
+        //
+        // DEFAULT ISSUER = baseUrl, i.e. JWKS = ${baseUrl}/.well-known/jwks.json,
+        // fetched without X-Config-Id.  This holds today because the OP's single
+        // global ISSUER is the management API host and its global JWKS carries the
+        // response-signing kid.  REVISIT under hawcx_core_oauth#67 (per-tenant
+        // issuer / discovery_mode cutover): if a tenant's signing kid moves to a
+        // per-tenant JWKS, this default stops containing it and every management
+        // call fails closed (ResponseSignatureUnavailable/Invalid).  Callers can
+        // already override via the `issuer` option; whoever lands #67 must update
+        // this default (e.g. derive a per-tenant issuer) and the README.
+        const issuer = options.issuer === undefined
+            ? this.baseUrl
+            : (0, url_1.parseSecureBaseUrl)('issuer', options.issuer, urlError);
+        if (options.verifyResponseSignature === false) {
+            this.responseVerifier = null;
+            if (!responseSignatureDisabledWarned) {
+                responseSignatureDisabledWarned = true;
+                process.emitWarning('[@hawcx/oauth-client] JwtBearerTransport: verifyResponseSignature is disabled — ' +
+                    'management API responses will NOT be authenticated. Use only as a temporary escape hatch.', { type: 'Warning', code: 'HAWCX_RESPONSE_SIGNATURE_DISABLED' });
+            }
+        }
+        else {
+            const clockSkewSeconds = options.clockSkewSeconds ?? 300;
+            if (!Number.isFinite(clockSkewSeconds) || clockSkewSeconds < 0) {
+                throw new exceptions_1.DelegationRequestError('clockSkewSeconds must be a non-negative number');
+            }
+            this.responseVerifier = new response_signature_1.ResponseSignatureVerifier({
+                jwksUri: (0, url_1.safeJoinUrl)(issuer, '/.well-known/jwks.json', 'JWKS URL', urlError),
+                clockSkewSeconds,
+                timeoutMs: this.timeoutMs,
+            });
+        }
+        const key = options.oidcSigningKey;
+        if (typeof key === 'string') {
+            // PKCS#8 PEM
+            this.importKeyFn = () => (0, jose_1.importPKCS8)(key, 'EdDSA');
+        }
+        else if (isJwk(key)) {
+            // Plain JWK object
+            this.importKeyFn = () => (0, jose_1.importJWK)(key, 'EdDSA');
+        }
+        else {
+            // Already a jose KeyLike / CryptoKey — wrap in a resolved promise.
+            const resolved = Promise.resolve(key);
+            this.importKeyFn = () => resolved;
+        }
+    }
+    // ── Key loading ────────────────────────────────────────────────────────────
+    importKey() {
+        if (!this.keyPromise) {
+            // Don't memoise a rejection — reset so the next call retries.
+            this.keyPromise = this.importKeyFn().catch((err) => {
+                this.keyPromise = undefined;
+                throw err;
+            });
+        }
+        return this.keyPromise;
+    }
+    // ── JWT minting ────────────────────────────────────────────────────────────
+    /**
+     * Mint a per-request EdDSA JWT.
+     *
+     * @param audience - full request URL (base joined with endpoint), pinned per-call
+     * @param bodySha256 - base64url (no-padding) of SHA-256 over the exact body bytes
+     */
+    async mintJwt(audience, bodySha256) {
+        const key = await this.importKey();
+        const nowSec = Math.floor(Date.now() / 1000);
+        return new jose_1.SignJWT({ body_sha256: bodySha256 })
+            .setProtectedHeader({ alg: 'EdDSA', kid: this.kid, typ: 'JWT' })
+            .setIssuer(this.clientId)
+            .setSubject(this.clientId)
+            .setAudience(audience)
+            .setIssuedAt(nowSec)
+            .setExpirationTime(nowSec + this.jwtTtlSeconds)
+            .setJti((0, node_crypto_1.randomUUID)())
+            .sign(key);
+    }
+    // ── Transport ──────────────────────────────────────────────────────────────
+    /**
+     * Send an authenticated POST to `endpoint` with `payload` serialised as JSON.
+     *
+     * Matches the signature of `DelegationTransport.send` so the two transports
+     * are drop-in substitutes behind `StepUpClient`.
+     *
+     * @param options.endpoint - API path relative to `baseUrl`, e.g.
+     *   `/v1/management/stepup/start-token`.  Must start with a single `/`;
+     *   anything that would resolve off the configured origin or out of its path
+     *   prefix throws `DelegationRequestError` before the request is signed.
+     * @param options.payload  - request body; serialised once and hashed; the
+     *   EXACT same bytes are sent and hashed — no double-serialisation.
+     * @param options.headers  - optional extra headers merged last (win over built-ins)
+     */
+    async send(options) {
+        const { endpoint, payload, headers: extraHeaders = {} } = options;
+        // Canonicalise body ONCE.  The same Buffer is both hashed and sent.
+        const bodyBytes = Buffer.from(JSON.stringify(payload));
+        // SHA-256 → base64url without padding (RFC 7515 §2).
+        const hash = (0, node_crypto_2.createHash)('sha256').update(bodyBytes).digest();
+        const bodySha256 = hash.toString('base64url').replace(/=+$/, '');
+        // Join structurally and assert the result stays on the configured origin
+        // BEFORE signing: the JWT `aud` and the request target are this one value.
+        const url = (0, url_1.safeJoinUrl)(this.baseUrl, endpoint, 'endpoint', urlError);
+        let jwt;
+        try {
+            jwt = await this.mintJwt(url, bodySha256);
+        }
+        catch (err) {
+            throw new exceptions_1.DelegationRequestError('Failed to sign management request', { cause: err });
+        }
+        // Extra headers are merged first so the transport's own auth/routing
+        // headers (Authorization, X-Config-Id, X-Hawcx-Protocol-Version) cannot
+        // be accidentally overridden by the caller's header bag.
+        const requestHeaders = {
+            ...extraHeaders,
+            'Content-Type': 'application/json',
+            'Authorization': `Bearer ${jwt}`,
+            'X-Config-Id': this.configId,
+            'X-Hawcx-Protocol-Version': '2',
+        };
+        let response;
+        let responseData;
+        // Bound every request with a timeout: a connected-but-silent server would
+        // otherwise hang the call indefinitely and can exhaust connection pools.
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            response = await this.http(url, {
+                method: 'POST',
+                headers: requestHeaders,
+                body: bodyBytes,
+                signal: controller.signal,
+            });
+            responseData = Buffer.from(await response.arrayBuffer());
+        }
+        catch (err) {
+            if (err instanceof exceptions_1.DelegationRequestError)
+                throw err;
+            throw new exceptions_1.DelegationRequestError('Request to management API failed', { cause: err });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const text = responseData.toString('utf-8');
+        // Check the HTTP status BEFORE parsing JSON. A non-JSON error body (e.g. a
+        // WAF/proxy HTML 403) must still surface its status as a
+        // DelegationRequestError — not get masked as a JSON parse failure that the
+        // caller can't distinguish from a malformed 200.
+        if (response.status >= 400) {
+            let errorBody = text;
+            try {
+                const errJson = JSON.parse(text);
+                if (errJson?.detail)
+                    errorBody = String(errJson.detail);
+            }
+            catch {
+                // Non-JSON error body — keep the raw text.
+            }
+            throw new exceptions_1.DelegationRequestError(`Management API returned ${response.status}`, {
+                statusCode: response.status,
+                responseBody: errorBody,
+            });
+        }
+        // Authenticate every response we are about to return as success — any
+        // status below 400, i.e. every 2xx (and any stray 1xx/3xx, which the
+        // server never sends signed and so fail closed).  Error responses (>= 400)
+        // are unsigned by design and were rejected above.  The hash covers the raw
+        // bytes from `arrayBuffer()`, not `text`: UTF-8 decoding replaces invalid
+        // sequences and would let distinct byte strings hash the same.
+        if (this.responseVerifier !== null) {
+            await this.responseVerifier.verify(response.headers.get(response_signature_1.RESPONSE_SIGNATURE_HEADER), responseData);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch (err) {
+            throw new exceptions_1.DelegationResponseError('Failed to parse management API response', { cause: err });
+        }
+        return parsed;
+    }
+}
+exports.JwtBearerTransport = JwtBearerTransport;
+// ── helpers ──────────────────────────────────────────────────────────────────
+/** Narrow check: is this value a plain JWK object (has `kty` string)? */
+function isJwk(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.kty === 'string');
+}
+//# sourceMappingURL=jwt_transport.js.map

package/dist/management/jwt_transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt_transport.js","sourceRoot":"","sources":["../../src/management/jwt_transport.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;AAEH,6CAAyC;AACzC,6CAAyC;AACzC,+BAAiE;AAEjE,yDAA2F;AAE3F,yCAA4G;AAC5G,6DAA4F;AAE5F,0FAA0F;AAC1F,MAAM,QAAQ,GAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACnD,IAAI,mCAAsB,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAE5E,yEAAyE;AACzE,IAAI,+BAA+B,GAAG,KAAK,CAAC;AAmF5C;;;;;;;GAOG;AACH,MAAa,kBAAkB;IAe7B,YAAY,OAAkC;QAC5C,yEAAyE;QACzE,4EAA4E;QAC5E,IAAI,CAAC,OAAO,GAAG,IAAA,wBAAkB,EAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,kEAAkE;QAClE,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS;YACzC,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,IAAA,wBAAkB,EAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,uBAAuB,KAAK,KAAK,EAAE,CAAC;YAC9C,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,IAAI,CAAC,+BAA+B,EAAE,CAAC;gBACrC,+BAA+B,GAAG,IAAI,CAAC;gBACvC,OAAO,CAAC,WAAW,CACjB,kFAAkF;oBAChF,2FAA2F,EAC7F,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,mCAAsB,CAAC,gDAAgD,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,gBAAgB,GAAG,IAAI,8CAAyB,CAAC;gBACpD,OAAO,EAAE,IAAA,iBAAW,EAAC,MAAM,EAAE,wBAAwB,EAAE,UAAU,EAAE,QAAQ,CAAC;gBAC5E,gBAAgB;gBAChB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;QACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,aAAa;YACb,IAAI,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC,IAAA,kBAAW,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,mBAAmB;YACnB,IAAI,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC,IAAA,gBAAS,EAAC,GAAU,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAkB,CAAC,CAAC;YACrD,IAAI,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC;QACpC,CAAC;IACH,CAAC;IAED,8EAA8E;IAEtE,SAAS;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,8DAA8D;YAC9D,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAC1D,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;gBAC5B,MAAM,GAAG,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,8EAA8E;IAE9E;;;;;OAKG;IACK,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,UAAkB;QACxD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE7C,OAAO,IAAI,cAAO,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAC5C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aAC/D,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;aACxB,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;aACzB,WAAW,CAAC,QAAQ,CAAC;aACrB,WAAW,CAAC,MAAM,CAAC;aACnB,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC;aAC9C,MAAM,CAAC,IAAA,wBAAU,GAAE,CAAC;aACpB,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,8EAA8E;IAE9E;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,IAAI,CAAmD,OAI5D;QACC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QAElE,oEAAoE;QACpE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAEvD,qDAAqD;QACrD,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAEjE,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,GAAG,GAAG,IAAA,iBAAW,EAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAEtE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,mCAAsB,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,cAAc,GAA2B;YAC7C,GAAG,YAAY;YACf,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU,GAAG,EAAE;YAChC,aAAa,EAAE,IAAI,CAAC,QAAQ;YAC5B,0BAA0B,EAAE,GAAG;SAChC,CAAC;QAEF,IAAI,QAAkB,CAAC;QACvB,IAAI,YAAoB,CAAC;QAEzB,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC9B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,cAAc;gBACvB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mCAAsB;gBAAE,MAAM,GAAG,CAAC;YACrD,MAAM,IAAI,mCAAsB,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE5C,2EAA2E;QAC3E,yDAAyD;QACzD,2EAA2E;QAC3E,iDAAiD;QACjD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3B,IAAI,SAAS,GAAW,IAAI,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;gBAC5D,IAAI,OAAO,EAAE,MAAM;oBAAE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;YACD,MAAM,IAAI,mCAAsB,CAAC,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE;gBAC7E,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC3B,YAAY,EAAE,SAAS;aACxB,CAAC,CAAC;QACL,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAChC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,8CAAyB,CAAC,EAC/C,YAAY,CACb,CAAC;QACJ,CAAC;QAED,IAAI,MAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAS,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oCAAuB,CAAC,yCAAyC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AArOD,gDAqOC;AAED,gFAAgF;AAEhF,yEAAyE;AACzE,SAAS,KAAK,CAAC,KAAc;IAC3B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAAiC,CAAC,GAAG,KAAK,QAAQ,CAC3D,CAAC;AACJ,CAAC"}

package/dist/management/response_signature.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Verification of the management API's `X-Response-Signature` (TOB-HSDK-11).
+ *
+ * Every successful jwt-mode (Path A) management response from hx_auth carries
+ * `X-Response-Signature`: a compact JWS signed with the shared OAuth signing
+ * key that the OP publishes at `${issuer}/.well-known/jwks.json` — the same
+ * JWKS that verifies ID tokens.  Its payload is exactly
+ *
+ *   { "body_sha256": base64url(sha256(<exact response body bytes>)), "iat": <unix s> }
+ *
+ * Verifying it restores the response authentication the legacy ECIES
+ * transport always had (signature + timestamp skew on every response).
+ *
+ * Checks, all fail-closed:
+ *  - the header is present and is a compact JWS whose protected header names
+ *    a `kid`;
+ *  - `alg` is one of ES256 / ES384 / ES512 (the server's KMS key is an EC key
+ *    and the alg follows its curve).  `none`, HS*, RS*, EdDSA are rejected —
+ *    this forecloses alg-substitution / key-confusion;
+ *  - the signature verifies against the issuer JWKS (jose `RemoteJWKSet`:
+ *    cached, and refetched once when the `kid` is unknown — key rotation);
+ *  - `iat` is present and within ±clockSkewSeconds of local time;
+ *  - the payload is a response signature, not some other token minted with
+ *    the same key (TOB-HSDK-9 type confusion): `body_sha256` is required and
+ *    `aud`, `sub`, `nonce` must be absent — an ID token always carries
+ *    `aud`/`sub`;
+ *  - `body_sha256` equals base64url(sha256(raw body bytes)), compared in
+ *    constant time.  The hash is taken over the raw bytes as received, before
+ *    any decoding or JSON parsing.
+ *
+ * Failures are split so callers can react correctly:
+ *  - {@link ResponseSignatureInvalidError} (`code: 'response_signature_invalid'`)
+ *    — missing/empty header or a signature that does not verify;
+ *  - {@link ResponseSignatureUnavailableError}
+ *    (`code: 'response_signature_unavailable'`) — the signing keys could not
+ *    be obtained (JWKS fetch failed / timed out / non-200 / malformed, or the
+ *    kid is unknown while jose's refetch cooldown suppresses a refetch).  The
+ *    request may already have been applied server-side.
+ * Both subclass `DelegationResponseError` and carry fixed, non-leaky messages.
+ *
+ * Not part of the public API (not re-exported from the package index).
+ */
+/** Response-signature header name (HTTP headers are case-insensitive). */
+export declare const RESPONSE_SIGNATURE_HEADER = "X-Response-Signature";
+export interface ResponseSignatureVerifierOptions {
+    /** Absolute, already-validated JWKS URL (`${issuer}/.well-known/jwks.json`). */
+    jwksUri: string;
+    /** Allowed |now − iat| in seconds. */
+    clockSkewSeconds: number;
+    /** Bound on each JWKS fetch, in ms. */
+    timeoutMs: number;
+}
+export declare class ResponseSignatureVerifier {
+    private readonly jwks;
+    private readonly clockSkewSeconds;
+    constructor(options: ResponseSignatureVerifierOptions);
+    /**
+     * Verify `signature` (the header value, or null when absent) over the EXACT
+     * response body bytes.  Resolves on success; throws
+     * {@link ResponseSignatureInvalidError} or
+     * {@link ResponseSignatureUnavailableError} otherwise.
+     */
+    verify(signature: string | null, body: Uint8Array): Promise<void>;
+}
+//# sourceMappingURL=response_signature.d.ts.map

package/dist/management/response_signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response_signature.d.ts","sourceRoot":"","sources":["../../src/management/response_signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AASH,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAoBhE,MAAM,WAAW,gCAAgC;IAC/C,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;IAChB,sCAAsC;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAwC;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;gBAE9B,OAAO,EAAE,gCAAgC;IAUrD;;;;;OAKG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAgGxE"}

package/dist/management/response_signature.js

@@ -0,0 +1,170 @@
+"use strict";
+/**
+ * Verification of the management API's `X-Response-Signature` (TOB-HSDK-11).
+ *
+ * Every successful jwt-mode (Path A) management response from hx_auth carries
+ * `X-Response-Signature`: a compact JWS signed with the shared OAuth signing
+ * key that the OP publishes at `${issuer}/.well-known/jwks.json` — the same
+ * JWKS that verifies ID tokens.  Its payload is exactly
+ *
+ *   { "body_sha256": base64url(sha256(<exact response body bytes>)), "iat": <unix s> }
+ *
+ * Verifying it restores the response authentication the legacy ECIES
+ * transport always had (signature + timestamp skew on every response).
+ *
+ * Checks, all fail-closed:
+ *  - the header is present and is a compact JWS whose protected header names
+ *    a `kid`;
+ *  - `alg` is one of ES256 / ES384 / ES512 (the server's KMS key is an EC key
+ *    and the alg follows its curve).  `none`, HS*, RS*, EdDSA are rejected —
+ *    this forecloses alg-substitution / key-confusion;
+ *  - the signature verifies against the issuer JWKS (jose `RemoteJWKSet`:
+ *    cached, and refetched once when the `kid` is unknown — key rotation);
+ *  - `iat` is present and within ±clockSkewSeconds of local time;
+ *  - the payload is a response signature, not some other token minted with
+ *    the same key (TOB-HSDK-9 type confusion): `body_sha256` is required and
+ *    `aud`, `sub`, `nonce` must be absent — an ID token always carries
+ *    `aud`/`sub`;
+ *  - `body_sha256` equals base64url(sha256(raw body bytes)), compared in
+ *    constant time.  The hash is taken over the raw bytes as received, before
+ *    any decoding or JSON parsing.
+ *
+ * Failures are split so callers can react correctly:
+ *  - {@link ResponseSignatureInvalidError} (`code: 'response_signature_invalid'`)
+ *    — missing/empty header or a signature that does not verify;
+ *  - {@link ResponseSignatureUnavailableError}
+ *    (`code: 'response_signature_unavailable'`) — the signing keys could not
+ *    be obtained (JWKS fetch failed / timed out / non-200 / malformed, or the
+ *    kid is unknown while jose's refetch cooldown suppresses a refetch).  The
+ *    request may already have been applied server-side.
+ * Both subclass `DelegationResponseError` and carry fixed, non-leaky messages.
+ *
+ * Not part of the public API (not re-exported from the package index).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResponseSignatureVerifier = exports.RESPONSE_SIGNATURE_HEADER = void 0;
+const node_crypto_1 = require("node:crypto");
+const jose_1 = require("jose");
+const exceptions_1 = require("../delegation/exceptions");
+/** Response-signature header name (HTTP headers are case-insensitive). */
+exports.RESPONSE_SIGNATURE_HEADER = 'X-Response-Signature';
+/** EC algorithms the server's KMS signing key can produce — nothing else. */
+const ALLOWED_ALGS = Object.freeze(['ES256', 'ES384', 'ES512']);
+/**
+ * Claims that mark a token as something other than a response signature.
+ * Deliberately `aud` is forbidden rather than repurposed: request binding
+ * (anti-replay within the iat window) is designed server-side in
+ * hawcx/hx_auth#278 as dedicated custom claims (`req_jti` / `htm` / `htu` /
+ * `cid`), explicitly NOT `aud` — keep this list as is.
+ */
+const FORBIDDEN_CLAIMS = Object.freeze(['aud', 'sub', 'nonce']);
+/** Generic, non-leaky messages; detail (if any) is attached as `cause`. */
+const MSG_MISSING = 'Management API response is missing its signature';
+const MSG_INVALID = 'Management API response signature verification failed';
+const MSG_UNAVAILABLE = 'Management API response signature could not be verified: signing keys unavailable';
+class ResponseSignatureVerifier {
+    constructor(options) {
+        // jose handles caching (10 min max age), concurrent-fetch coalescing, and a
+        // single refetch on an unknown `kid` (rate-limited by its 30s cooldown) —
+        // the same machinery HawcxOAuth uses for ID-token verification.
+        this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(options.jwksUri), {
+            timeoutDuration: options.timeoutMs,
+        });
+        this.clockSkewSeconds = options.clockSkewSeconds;
+    }
+    /**
+     * Verify `signature` (the header value, or null when absent) over the EXACT
+     * response body bytes.  Resolves on success; throws
+     * {@link ResponseSignatureInvalidError} or
+     * {@link ResponseSignatureUnavailableError} otherwise.
+     */
+    async verify(signature, body) {
+        if (!signature) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_MISSING);
+        }
+        // Set by the key resolver when the keys could not be obtained, as opposed
+        // to a signature that was checked and found bad.
+        let keysUnavailable = false;
+        let payloadBytes;
+        try {
+            const result = await (0, jose_1.compactVerify)(signature, async (protectedHeader, token) => {
+                if (typeof protectedHeader.kid !== 'string' || protectedHeader.kid.length === 0) {
+                    throw new Error('response signature has no kid');
+                }
+                // If jose may refetch on a miss (not cooling down), a miss means the
+                // kid is absent from a freshly fetched JWKS → invalid.  If the
+                // cooldown suppresses the refetch, the kid may simply be newer than
+                // our cache (rotation) → unavailable.
+                const canRefetch = !this.jwks.coolingDown;
+                try {
+                    return await this.jwks(protectedHeader, token);
+                }
+                catch (err) {
+                    if (err instanceof jose_1.errors.JWKSNoMatchingKey) {
+                        keysUnavailable = !canRefetch;
+                    }
+                    else if (!(err instanceof jose_1.errors.JWKSMultipleMatchingKeys)) {
+                        // Fetch failure, timeout, non-200, malformed JWKS, network error.
+                        keysUnavailable = true;
+                    }
+                    throw err;
+                }
+            }, { algorithms: [...ALLOWED_ALGS] });
+            payloadBytes = result.payload;
+        }
+        catch (err) {
+            if (keysUnavailable) {
+                throw new exceptions_1.ResponseSignatureUnavailableError(MSG_UNAVAILABLE, { cause: err });
+            }
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, { cause: err });
+        }
+        let claims;
+        try {
+            const parsed = JSON.parse(Buffer.from(payloadBytes).toString('utf-8'));
+            if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                throw new Error('payload is not a JSON object');
+            }
+            claims = parsed;
+        }
+        catch (err) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, { cause: err });
+        }
+        // Type-confusion guard (TOB-HSDK-9): only a response signature qualifies.
+        for (const claim of FORBIDDEN_CLAIMS) {
+            if (Object.prototype.hasOwnProperty.call(claims, claim)) {
+                throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                    cause: new Error(`unexpected '${claim}' claim in response signature`),
+                });
+            }
+        }
+        const claimedHash = claims['body_sha256'];
+        if (typeof claimedHash !== 'string' || claimedHash.length === 0) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error("response signature has no 'body_sha256' claim"),
+            });
+        }
+        // Freshness: `iat` required, within the configured skew either way.
+        const iat = claims['iat'];
+        if (typeof iat !== 'number' || !Number.isFinite(iat)) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error("response signature has no numeric 'iat' claim"),
+            });
+        }
+        const nowSec = Date.now() / 1000;
+        if (iat > nowSec + this.clockSkewSeconds || iat < nowSec - this.clockSkewSeconds) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error(`response signature 'iat' outside allowed skew (${this.clockSkewSeconds}s)`),
+            });
+        }
+        // Body binding: base64url(sha256(raw bytes)), no padding, constant-time.
+        const actual = Buffer.from((0, node_crypto_1.createHash)('sha256').update(body).digest('base64url').replace(/=+$/, ''), 'utf-8');
+        const claimed = Buffer.from(claimedHash, 'utf-8');
+        if (actual.length !== claimed.length || !(0, node_crypto_1.timingSafeEqual)(actual, claimed)) {
+            throw new exceptions_1.ResponseSignatureInvalidError(MSG_INVALID, {
+                cause: new Error('response body does not match the signed body_sha256'),
+            });
+        }
+    }
+}
+exports.ResponseSignatureVerifier = ResponseSignatureVerifier;
+//# sourceMappingURL=response_signature.js.map