@kokuin/token 0.5.0 → 0.5.1

package/lib/did.js

@@ -282,11 +282,11 @@ function hasKeyPrefix(did) {
 }
 function resolveKidOrAuth(doc, kid) {
     if (kid == null) {
-        const auth = doc.authentication;
-        if (auth == null || auth.length === 0) {
+        const firstAuth = doc.authentication?.[0];
+        if (firstAuth == null) {
             throw new Error('resolveIssuer: did:peer:4 token missing kid and doc has no authentication entries');
         }
-        return resolveKidFromDoc(doc, auth[0]);
+        return resolveKidFromDoc(doc, firstAuth);
     }
     // A kid must reference a method the subject authorized for `authentication`. Without this
     // check a key listed only under `assertionMethod` (or any other relationship) could sign

package/lib/identity.js

@@ -169,19 +169,21 @@ function isClassical(spec) {
 function chooseMethod(input) {
     if (input.didMethod != null) {
         if (input.didMethod === 'key') {
-            if (input.keys.length !== 1) {
+            const [firstKey, ...rest] = input.keys;
+            if (firstKey === undefined || rest.length > 0) {
                 throw new Error('IdentityError.InvalidMethod: did:key requires exactly one key');
             }
-            if (!isClassical(input.keys[0])) {
+            if (!isClassical(firstKey)) {
                 throw new Error('IdentityError.InvalidMethod: did:key requires a classical algorithm');
             }
-            if (input.keys[0].purpose !== 'sig') {
+            if (firstKey.purpose !== 'sig') {
                 throw new Error('IdentityError.InvalidMethod: did:key requires a signing key');
             }
         }
         return input.didMethod;
     }
-    if (input.keys.length === 1 && isClassical(input.keys[0]) && input.keys[0].purpose === 'sig') {
+    const [firstKey, ...rest] = input.keys;
+    if (firstKey !== undefined && rest.length === 0 && isClassical(firstKey) && firstKey.purpose === 'sig') {
         return 'key';
     }
     return 'peer:4';
@@ -356,6 +358,9 @@ function buildIdentity(id, longForm, doc, keys) {
     const keys = resolveKeys(input);
     if (method === 'key') {
         const [k] = keys;
+        if (k === undefined) {
+            throw new Error('createIdentity requires at least one key');
+        }
         const id = getDID(CODECS.EdDSA, k.publicKey);
         const doc = {
             '@context': [

package/lib/index.d.ts

@@ -21,5 +21,5 @@ export { decodePrivateKey, encodePrivateKey, randomPrivateKey, } from './signer.
 export { assertTimeClaimsValid, now, type TimeClaimsPayload, type TimeValidationOptions, } from './time.js';
 export { createUnsignedToken, isSignedToken, isUnsignedToken, isVerifiedToken, signToken, type VerifyTokenOptions, verifyToken, } from './token.js';
 export type * from './types.js';
-export { concatBytes, stringifyToken } from './utils.js';
+export { concatBytes, decodeSignedToken, stringifyToken } from './utils.js';
 export { getVerifier, type Verifier, type Verifiers, } from './verifier.js';

package/lib/index.js

@@ -18,5 +18,5 @@ export { capabilitySchema, signedHeaderSchema, signedPayloadSchema, supportedHea
 export { decodePrivateKey, encodePrivateKey, randomPrivateKey } from './signer.js';
 export { assertTimeClaimsValid, now } from './time.js';
 export { createUnsignedToken, isSignedToken, isUnsignedToken, isVerifiedToken, signToken, verifyToken } from './token.js';
-export { concatBytes, stringifyToken } from './utils.js';
+export { concatBytes, decodeSignedToken, stringifyToken } from './utils.js';
 export { getVerifier } from './verifier.js';

package/lib/token.js

@@ -125,12 +125,12 @@ function matchesVerifiableData(token, data) {
     if (data === `${b64uFromJSON(token.header)}.${b64uFromJSON(token.payload)}`) {
         return true;
     }
-    const parts = data.split('.');
-    if (parts.length !== 2) {
+    const [headerPart, payloadPart, extra] = data.split('.');
+    if (headerPart === undefined || payloadPart === undefined || extra !== undefined) {
         return false;
     }
     try {
-        return canonicalStringify(b64uToJSON(parts[0])) === canonicalStringify(token.header) && canonicalStringify(b64uToJSON(parts[1])) === canonicalStringify(token.payload);
+        return canonicalStringify(b64uToJSON(headerPart)) === canonicalStringify(token.header) && canonicalStringify(b64uToJSON(payloadPart)) === canonicalStringify(token.payload);
     } catch  {
         // invalid base64url or JSON in data
         return false;
@@ -210,6 +210,9 @@ async function verifyTokenInner(token, options = {}) {
         throw new Error('Invalid token format: expected 3 parts separated by dots');
     }
     const [encodedHeader, encodedPayload, signature] = parts;
+    if (encodedHeader === undefined || encodedPayload === undefined) {
+        throw new Error('Invalid token format: expected 3 parts separated by dots');
+    }
     const header = b64uToJSON(encodedHeader);
     if (header.typ !== 'JWT') {
         throw new Error('Invalid token header type');

package/lib/utils.d.ts

@@ -1,6 +1,10 @@
-import type { Token } from './types.js';
+import type { SignedToken, Token } from './types.js';
 export declare function concatBytes(a: Uint8Array, b: Uint8Array): Uint8Array;
 /**
  * Convert a Token object to its JWT string representation.
  */
 export declare function stringifyToken(token: Token): string;
+/**
+ * Parse a signed token string without verifying it. `data` keeps the original signed segments.
+ */
+export declare function decodeSignedToken<Payload extends Record<string, unknown> = Record<string, unknown>>(token: string): SignedToken<Payload>;

package/lib/utils.js

@@ -1,4 +1,4 @@
-import { b64uFromJSON } from '@sozai/codec';
+import { b64uFromJSON, b64uToJSON } from '@sozai/codec';
 export function concatBytes(a, b) {
     const out = new Uint8Array(a.length + b.length);
     out.set(a, 0);
@@ -17,3 +17,17 @@ export function concatBytes(a, b) {
     }
     return parts.join('.');
 }
+/**
+ * Parse a signed token string without verifying it. `data` keeps the original signed segments.
+ */ export function decodeSignedToken(token) {
+    const [header, payload, signature, ...rest] = token.split('.');
+    if (!header || !payload || !signature || rest.length > 0) {
+        throw new Error('Invalid token format: expected 3 parts separated by dots');
+    }
+    return {
+        data: `${header}.${payload}`,
+        header: b64uToJSON(header),
+        payload: b64uToJSON(payload),
+        signature
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kokuin/token",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "JWT signing and verification",
   "keywords": [
     "json",
@@ -26,17 +26,17 @@
     "lib/*"
   ],
   "dependencies": {
-    "@noble/curves": "^2.3.0",
-    "@noble/hashes": "^2.3.0",
-    "@scure/base": "^2.3.0",
-    "@sozai/codec": "^0.4.0",
-    "@sozai/otel": "^0.3.2",
-    "@sozai/schema": "^0.1.1",
-    "@kokuin/otel": "^0.3.0"
+    "@kokuin/otel": "^0.3.0",
+    "@noble/curves": "^2.4.0",
+    "@noble/hashes": "^2.4.0",
+    "@scure/base": "^2.4.0",
+    "@sozai/codec": "^0.4.2",
+    "@sozai/otel": "^0.3.3",
+    "@sozai/schema": "^0.1.6"
   },
   "devDependencies": {
-    "@opentelemetry/sdk-trace-base": "^2.10.0",
-    "@opentelemetry/sdk-trace-node": "^2.10.0",
+    "@opentelemetry/sdk-trace-base": "^2.12.0",
+    "@opentelemetry/sdk-trace-node": "^2.12.0",
     "uint8arrays": "^6.1.1"
   },
   "publishConfig": {
@@ -44,9 +44,9 @@
   },
   "scripts": {
     "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
-    "build:clean": "del lib",
-    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
-    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
+    "build:clean": "del-cli lib",
+    "build:js": "del-cli 'lib/**/*.js' && swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
+    "build:types": "del-cli 'lib/**/*.d.ts' 'lib/**/*.d.ts.map' && tsc --emitDeclarationOnly --skipLibCheck",
     "test": "pnpm run test:types && pnpm run test:unit",
     "test:types": "tsc --noEmit --skipLibCheck -p tsconfig.test.json",
     "test:unit": "vitest run"