@nifrajs/middleware 0.1.0-alpha.1

package/dist/index.js

@@ -0,0 +1,33 @@
+/**
+ * `@nifrajs/middleware` — composable, dependency-free middleware + plugins applied via `app.use()`.
+ * The hardening set (`cors`, `rateLimit`, `securityHeaders`) returns a `@nifrajs/core` `Middleware`
+ * (a hook bundle, context-agnostic). The seeded plugins (`requestId`, `logger`, `etag`, `bearer`,
+ * `apiKey`) use the `definePlugin` convention — named (idempotent dedupe), and `requestId` threads
+ * `c.requestId` into the handler context.
+ */
+export { basicAuth, } from "./basic-auth.js";
+export { bodyLimit } from "./body-limit.js";
+export { cache, MemoryResponseCache, responseCache, } from "./cache.js";
+export { cacheControl } from "./cache-control.js";
+export { combine, namedCombine } from "./combine.js";
+export { compression } from "./compression.js";
+export { cors } from "./cors.js";
+export { createCsrfToken, csrf, verifyCsrfToken, } from "./csrf.js";
+export { etag } from "./etag.js";
+export { healthcheck } from "./healthcheck.js";
+export { idempotency, MemoryIdempotencyStore, } from "./idempotency.js";
+export { ipRestriction } from "./ip-restriction.js";
+export { jwk, jwks, jwt, tryVerifyJwt, verifyJwt, } from "./jwt.js";
+export { language, pickLanguage, } from "./language.js";
+export { logger } from "./logger.js";
+export { methodOverride } from "./method-override.js";
+export { buildOpenApiDocument, openapi, } from "./openapi.js";
+export { poweredBy } from "./powered-by.js";
+export { prettyJson } from "./pretty-json.js";
+export { MemoryStore, rateLimit, } from "./rate-limit.js";
+export { requestId } from "./request-id.js";
+export { securityHeaders } from "./security-headers.js";
+export { timing } from "./timing.js";
+export { apiKey, bearer, } from "./token-auth.js";
+export { appendTrailingSlash, trimTrailingSlash, } from "./trailing-slash.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAIL,SAAS,GACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAyB,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAGL,KAAK,EACL,mBAAmB,EAGnB,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAA4B,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC3E,OAAO,EAAmB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACrE,OAAO,EAA2B,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACvE,OAAO,EAAoB,IAAI,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAEL,eAAe,EACf,IAAI,EACJ,eAAe,GAChB,MAAM,WAAW,CAAA;AAClB,OAAO,EAAoB,IAAI,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,EAA2B,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACvE,OAAO,EAKL,WAAW,EACX,sBAAsB,GAEvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAA6C,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAUL,GAAG,EACH,IAAI,EACJ,GAAG,EACH,YAAY,EAIZ,SAAS,GACV,MAAM,UAAU,CAAA;AACjB,OAAO,EAGL,QAAQ,EACR,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EAAsB,MAAM,EAAyB,MAAM,aAAa,CAAA;AAC/E,OAAO,EAA8B,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACjF,OAAO,EACL,oBAAoB,EAMpB,OAAO,GAGR,MAAM,cAAc,CAAA;AACrB,OAAO,EAAyB,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAA0B,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EACL,WAAW,EAKX,SAAS,GACV,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAyB,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,EAA+B,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACpF,OAAO,EAA8D,MAAM,EAAE,MAAM,aAAa,CAAA;AAChG,OAAO,EAIL,MAAM,EAEN,MAAM,GACP,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,mBAAmB,EAEnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAA"}

package/dist/ip-restriction.d.ts

@@ -0,0 +1,21 @@
+import type { Middleware } from "@nifrajs/core";
+import { type MaybePromise } from "./_utils.js";
+export type IpMatcher = string | ((ip: string, request: Request) => MaybePromise<boolean>);
+export interface IpRestrictionOptions {
+    readonly allow?: readonly IpMatcher[];
+    readonly deny?: readonly IpMatcher[];
+    /** Preferred extraction hook when the adapter/app knows the peer address. */
+    readonly clientIp?: (request: Request) => MaybePromise<string | null | undefined>;
+    /** Trusted proxy count for `X-Forwarded-For` extraction. Default: 0, so XFF is ignored. */
+    readonly trustedProxies?: number;
+    /** Exact trusted single-IP header, e.g. an infra-set `x-real-ip`. Not used unless configured. */
+    readonly header?: string;
+    readonly error?: string;
+}
+/**
+ * IP allow/deny middleware. It fails closed when no trustworthy client IP can be derived. Configure
+ * `clientIp`, `trustedProxies`, or a trusted single-IP `header`; unconfigured X-Forwarded-For is never
+ * trusted.
+ */
+export declare function ipRestriction(options: IpRestrictionOptions): Middleware;
+//# sourceMappingURL=ip-restriction.d.ts.map

package/dist/ip-restriction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-restriction.d.ts","sourceRoot":"","sources":["../src/ip-restriction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1D,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;AAE1F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,YAAY,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;IACjF,2FAA2F;IAC3F,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,iGAAiG;IACjG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAyID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,UAAU,CA6BvE"}

package/dist/ip-restriction.js

@@ -0,0 +1,161 @@
+import { jsonError } from "./_utils.js";
+function parseIPv4(input) {
+    const parts = input.split(".");
+    if (parts.length !== 4)
+        return null;
+    let out = 0n;
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const n = Number(part);
+        if (n > 255)
+            return null;
+        out = (out << 8n) | BigInt(n);
+    }
+    return out;
+}
+function parseIPv6(input) {
+    if (input.includes("%"))
+        return null;
+    let source = input.toLowerCase();
+    if (source.includes(".")) {
+        const lastColon = source.lastIndexOf(":");
+        if (lastColon < 0)
+            return null;
+        const ipv4 = parseIPv4(source.slice(lastColon + 1));
+        if (ipv4 === null)
+            return null;
+        const hi = Number((ipv4 >> 16n) & 0xffffn).toString(16);
+        const lo = Number(ipv4 & 0xffffn).toString(16);
+        source = `${source.slice(0, lastColon)}:${hi}:${lo}`;
+    }
+    const halves = source.split("::");
+    if (halves.length > 2)
+        return null;
+    const left = halves[0] === "" ? [] : halves[0].split(":");
+    const right = halves.length === 1 || halves[1] === "" ? [] : halves[1].split(":");
+    const groups = [...left, ...right];
+    if (groups.some((g) => !/^[0-9a-f]{1,4}$/.test(g)))
+        return null;
+    const missing = 8 - groups.length;
+    if (halves.length === 1) {
+        if (missing !== 0)
+            return null;
+    }
+    else if (missing < 1)
+        return null;
+    const expanded = halves.length === 1
+        ? groups
+        : [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+    let out = 0n;
+    for (const group of expanded)
+        out = (out << 16n) | BigInt(Number.parseInt(group, 16));
+    return out;
+}
+function parseIp(input) {
+    const trimmed = input.trim();
+    const unbracketed = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed;
+    const v4 = parseIPv4(unbracketed);
+    if (v4 !== null)
+        return { version: 4, value: v4 };
+    const v6 = parseIPv6(unbracketed);
+    return v6 === null ? null : { version: 6, value: v6 };
+}
+function parseRange(input) {
+    const slash = input.indexOf("/");
+    const address = slash < 0 ? input : input.slice(0, slash);
+    const ip = parseIp(address);
+    if (ip === null)
+        throw new Error(`ipRestriction: invalid IP/CIDR ${JSON.stringify(input)}`);
+    const bits = ip.version === 4 ? 32 : 128;
+    const prefix = slash < 0 ? bits : /^\d+$/.test(input.slice(slash + 1)) ? Number(input.slice(slash + 1)) : -1;
+    if (!Number.isInteger(prefix) || prefix < 0 || prefix > bits) {
+        throw new Error(`ipRestriction: invalid CIDR prefix ${JSON.stringify(input)}`);
+    }
+    const full = (1n << BigInt(bits)) - 1n;
+    const mask = prefix === 0 ? 0n : full ^ ((1n << BigInt(bits - prefix)) - 1n);
+    return { version: ip.version, network: ip.value & mask, mask };
+}
+function matchRange(ip, range) {
+    return ip.version === range.version && (ip.value & range.mask) === range.network;
+}
+function xForwardedClient(req, trustedProxies) {
+    if (trustedProxies <= 0)
+        return null;
+    const xff = req.headers.get("x-forwarded-for");
+    if (xff === null)
+        return null;
+    const parts = xff.split(",");
+    return parts[parts.length - trustedProxies]?.trim() || null;
+}
+async function resolveClientIp(req, options) {
+    const custom = await options.clientIp?.(req);
+    if (custom !== undefined && custom !== null)
+        return custom;
+    const fromXff = xForwardedClient(req, options.trustedProxies ?? 0);
+    if (fromXff !== null)
+        return fromXff;
+    if (options.header !== undefined) {
+        const value = req.headers.get(options.header);
+        if (value !== null && !value.includes(","))
+            return value.trim();
+    }
+    return null;
+}
+function compile(matchers) {
+    const ranges = [];
+    const fns = [];
+    for (const matcher of matchers ?? []) {
+        if (typeof matcher === "string")
+            ranges.push(parseRange(matcher));
+        else
+            fns.push(matcher);
+    }
+    return { ranges, fns };
+}
+async function matches(ipText, ip, compiled, req) {
+    if (compiled.ranges.some((range) => matchRange(ip, range)))
+        return true;
+    for (const fn of compiled.fns)
+        if (await fn(ipText, req))
+            return true;
+    return false;
+}
+/**
+ * IP allow/deny middleware. It fails closed when no trustworthy client IP can be derived. Configure
+ * `clientIp`, `trustedProxies`, or a trusted single-IP `header`; unconfigured X-Forwarded-For is never
+ * trusted.
+ */
+export function ipRestriction(options) {
+    const trustedProxies = options.trustedProxies ?? 0;
+    if (!Number.isInteger(trustedProxies) || trustedProxies < 0) {
+        throw new Error("ipRestriction: trustedProxies must be a non-negative integer");
+    }
+    if (options.header !== undefined && options.header.trim() === "") {
+        throw new Error("ipRestriction: header must not be empty");
+    }
+    const allow = compile(options.allow);
+    const deny = compile(options.deny);
+    if (allow.ranges.length + allow.fns.length + deny.ranges.length + deny.fns.length === 0) {
+        throw new Error("ipRestriction: configure at least one allow or deny matcher");
+    }
+    const error = options.error ?? "ip_forbidden";
+    return {
+        name: "ip-restriction",
+        async onRequest(req) {
+            const ipText = await resolveClientIp(req, options);
+            if (ipText === null)
+                return jsonError(403, error);
+            const ip = parseIp(ipText);
+            if (ip === null)
+                return jsonError(403, error);
+            if (await matches(ipText, ip, deny, req))
+                return jsonError(403, error);
+            if (allow.ranges.length + allow.fns.length > 0 && !(await matches(ipText, ip, allow, req))) {
+                return jsonError(403, error);
+            }
+            return undefined;
+        },
+    };
+}
+//# sourceMappingURL=ip-restriction.js.map

package/dist/ip-restriction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-restriction.js","sourceRoot":"","sources":["../src/ip-restriction.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAqB,MAAM,aAAa,CAAA;AA2B1D,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAA;QACxB,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;IAChC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAA;QACnD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACvD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/D,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAA;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IAChC,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnC,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,KAAK,CAAC;QACjB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAA;IACxE,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,MAAM,KAAK,IAAI,QAAQ;QAAE,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IACrF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,MAAM,WAAW,GACf,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IACnF,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IACjC,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACjD,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IACjC,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAChC,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACzD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,EAAE,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC3F,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACxC,MAAM,MAAM,GACV,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/F,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAA;IACtC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAC5E,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,EAAY,EAAE,KAAY;IAC5C,OAAO,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,CAAA;AAClF,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,cAAsB;IAC5D,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAC9C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;AAC7D,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,GAAY,EACZ,OAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;IAC5C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IAC1D,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC,CAAA;IAClE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAA;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,OAAO,CAAC,QAA0C;IAIzD,MAAM,MAAM,GAAY,EAAE,CAAA;IAC1B,MAAM,GAAG,GAA4D,EAAE,CAAA;IACvE,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAA;;YAC5D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;AACxB,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,EAAY,EACZ,QAAoC,EACpC,GAAY;IAEZ,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACvE,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,GAAG;QAAE,IAAI,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;IACrE,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAA;IAE7C,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAClD,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACjD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;YAC1B,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC7C,IAAI,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACtE,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC3F,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAC9B,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/jwt.d.ts

@@ -0,0 +1,82 @@
+import { type NifraPlugin } from "@nifrajs/core";
+import { type MaybePromise } from "./_utils.js";
+export type JwtAlgorithm = "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512";
+export interface JwtHeader {
+    readonly alg: string;
+    readonly kid?: string;
+    readonly typ?: string;
+    readonly [key: string]: unknown;
+}
+export interface JwtClaims {
+    readonly iss?: string;
+    readonly sub?: string;
+    readonly aud?: string | readonly string[];
+    readonly exp?: number;
+    readonly nbf?: number;
+    readonly iat?: number;
+    readonly jti?: string;
+    readonly [claim: string]: unknown;
+}
+export interface VerifiedJwt<C extends JwtClaims = JwtClaims> {
+    readonly header: JwtHeader;
+    readonly claims: C;
+    readonly token: string;
+}
+export type VerifyJwtResult<C extends JwtClaims = JwtClaims> = {
+    readonly ok: true;
+    readonly data: VerifiedJwt<C>;
+} | {
+    readonly ok: false;
+    readonly error: Error;
+};
+export interface JwkKey {
+    readonly kty?: string;
+    readonly kid?: string;
+    readonly alg?: string;
+    readonly use?: string;
+    readonly key_ops?: readonly string[];
+    readonly [key: string]: unknown;
+}
+export type JwtVerificationKey = string | Uint8Array | CryptoKey | JwkKey;
+export type JwtKeyResolver = (header: JwtHeader, claims: JwtClaims) => MaybePromise<JwtVerificationKey | null | undefined>;
+export interface VerifyJwtOptions {
+    readonly key: JwtVerificationKey | JwtKeyResolver;
+    readonly algorithms: readonly JwtAlgorithm[];
+    readonly issuer?: string | readonly string[];
+    readonly audience?: string | readonly string[];
+    readonly clockToleranceSec?: number;
+    readonly requiredClaims?: readonly string[];
+    readonly requireExpiration?: boolean;
+    readonly maxAgeSec?: number;
+    readonly now?: () => number;
+}
+export interface JwtOptions extends VerifyJwtOptions {
+    readonly realm?: string;
+    readonly optional?: boolean;
+    /** Header carrying the token. Default `"authorization"` (`Bearer <token>`). */
+    readonly header?: string;
+    /** Optional cookie fallback carrying the raw token. */
+    readonly cookie?: string;
+}
+export type JwtPlugin<C extends JwtClaims = JwtClaims> = NifraPlugin & {
+    claims(request: Request): C | null;
+    requireClaims(request: Request): C;
+};
+export interface JwksOptions {
+    readonly url: string | URL;
+    readonly fetch?: typeof fetch;
+    readonly cacheMs?: number;
+    /**
+     * Extra time to keep using the last successful key set when refresh fails.
+     * Defaults to one cache window; set `0` to fail closed immediately on refresh errors.
+     */
+    readonly staleMs?: number;
+    readonly timeoutMs?: number;
+    readonly maxBytes?: number;
+}
+export declare function verifyJwt<C extends JwtClaims = JwtClaims>(token: string, options: VerifyJwtOptions): Promise<VerifiedJwt<C>>;
+export declare function tryVerifyJwt<C extends JwtClaims = JwtClaims>(token: string, options: VerifyJwtOptions): Promise<VerifyJwtResult<C>>;
+export declare function jwt<C extends JwtClaims = JwtClaims>(options: JwtOptions): JwtPlugin<C>;
+export declare function jwk(key: JwtVerificationKey): JwtKeyResolver;
+export declare function jwks(options: JwksOptions): JwtKeyResolver;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAGL,KAAK,YAAY,EAKlB,MAAM,aAAa,CAAA;AAEpB,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAA;AAEpF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAChC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IACvD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,CAAA;AAEjD,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAChC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAA;AACzE,MAAM,MAAM,cAAc,GAAG,CAC3B,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,SAAS,KACd,YAAY,CAAC,kBAAkB,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;AAExD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,kBAAkB,GAAG,cAAc,CAAA;IACjD,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAA;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;IAC9C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,UAAW,SAAQ,gBAAgB;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI,WAAW,GAAG;IACrE,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,GAAG,IAAI,CAAA;IAClC,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,CAAA;CACnC,CAAA;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAyID,wBAAsB,SAAS,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAC7D,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CA+BzB;AAMD,wBAAsB,YAAY,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAChE,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAM7B;AAqBD,wBAAgB,GAAG,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,EAAE,OAAO,EAAE,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CA4BtF;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,kBAAkB,GAAG,cAAc,CAO3D;AA0DD,wBAAgB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,cAAc,CA6CzD"}

package/dist/jwt.js

@@ -0,0 +1,327 @@
+import { definePlugin } from "@nifrajs/core";
+import { base64UrlDecode, jsonError, parseCookies, quotedHeaderValue, secretBytes, utf8Bytes, } from "./_utils.js";
+const HASH = {
+    HS256: "SHA-256",
+    HS384: "SHA-384",
+    HS512: "SHA-512",
+    RS256: "SHA-256",
+    RS384: "SHA-384",
+    RS512: "SHA-512",
+};
+const HMAC_ALGS = new Set(["HS256", "HS384", "HS512"]);
+const RSA_ALGS = new Set(["RS256", "RS384", "RS512"]);
+const JSON_DECODER = new TextDecoder("utf-8", { fatal: true });
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function jwtError(message) {
+    return new Error(`jwt: ${message}`);
+}
+function decodeJsonSegment(segment) {
+    const bytes = base64UrlDecode(segment);
+    if (bytes === null)
+        throw jwtError("invalid base64url segment");
+    try {
+        return JSON.parse(JSON_DECODER.decode(bytes));
+    }
+    catch {
+        throw jwtError("invalid JSON segment");
+    }
+}
+function validateAlgorithms(algorithms) {
+    if (algorithms.length === 0)
+        throw new Error("jwt: algorithms must not be empty");
+    return new Set(algorithms);
+}
+function nonNegativeSeconds(value, name) {
+    if (value === undefined)
+        return 0;
+    if (!Number.isFinite(value) || value < 0)
+        throw jwtError(`${name} must be non-negative`);
+    return value;
+}
+function validateJwkForAlg(key, alg, kid) {
+    if (key.alg !== undefined && key.alg !== alg)
+        return false;
+    if (key.use !== undefined && key.use !== "sig")
+        return false;
+    if (key.key_ops !== undefined && !key.key_ops.includes("verify"))
+        return false;
+    if (kid !== undefined && key.kid !== undefined && key.kid !== kid)
+        return false;
+    if (HMAC_ALGS.has(alg))
+        return key.kty === "oct";
+    if (RSA_ALGS.has(alg))
+        return key.kty === "RSA";
+    return false;
+}
+async function importKey(key, alg, kid) {
+    const hash = HASH[alg];
+    if (key instanceof CryptoKey)
+        return key;
+    if (typeof key === "string" || key instanceof Uint8Array) {
+        if (!HMAC_ALGS.has(alg))
+            throw jwtError("symmetric key cannot verify an RSA token");
+        return crypto.subtle.importKey("raw", secretBytes(key, "jwt"), { name: "HMAC", hash }, false, [
+            "verify",
+        ]);
+    }
+    if (!validateJwkForAlg(key, alg, kid))
+        throw jwtError("JWK is not usable for this token");
+    const importJwk = crypto.subtle.importKey;
+    return importJwk.call(crypto.subtle, "jwk", key, RSA_ALGS.has(alg) ? { name: "RSASSA-PKCS1-v1_5", hash } : { name: "HMAC", hash }, false, ["verify"]);
+}
+function verifyAlgorithm(alg, allowed) {
+    if (alg === "none")
+        throw jwtError("alg none is not allowed");
+    if (!allowed.has(alg))
+        throw jwtError("algorithm is not allowed");
+    return alg;
+}
+function includesString(expected, actual) {
+    return expected === undefined
+        ? true
+        : typeof expected === "string"
+            ? expected === actual
+            : expected.includes(actual);
+}
+function validateClaims(claims, options) {
+    const now = options.now?.() ?? Math.floor(Date.now() / 1000);
+    if (!Number.isFinite(now))
+        throw jwtError("now must be finite");
+    const tolerance = nonNegativeSeconds(options.clockToleranceSec, "clockToleranceSec");
+    const requireExpiration = options.requireExpiration !== false;
+    if (requireExpiration && typeof claims.exp !== "number")
+        throw jwtError("exp is required");
+    if (claims.exp !== undefined && (!Number.isFinite(claims.exp) || claims.exp <= now - tolerance)) {
+        throw jwtError("token expired");
+    }
+    if (claims.nbf !== undefined && (!Number.isFinite(claims.nbf) || claims.nbf > now + tolerance)) {
+        throw jwtError("token is not active yet");
+    }
+    if (claims.iat !== undefined && (!Number.isFinite(claims.iat) || claims.iat > now + tolerance)) {
+        throw jwtError("iat is in the future");
+    }
+    if (options.maxAgeSec !== undefined) {
+        nonNegativeSeconds(options.maxAgeSec, "maxAgeSec");
+        if (typeof claims.iat !== "number" || !Number.isFinite(claims.iat))
+            throw jwtError("iat is required");
+        if (now - claims.iat > options.maxAgeSec + tolerance)
+            throw jwtError("token is too old");
+    }
+    if (options.issuer !== undefined) {
+        if (typeof claims.iss !== "string" || !includesString(options.issuer, claims.iss)) {
+            throw jwtError("issuer mismatch");
+        }
+    }
+    if (options.audience !== undefined) {
+        const got = claims.aud;
+        const gotList = typeof got === "string" ? [got] : Array.isArray(got) ? got : [];
+        const expected = typeof options.audience === "string" ? [options.audience] : options.audience;
+        if (!gotList.some((aud) => expected.includes(aud)))
+            throw jwtError("audience mismatch");
+    }
+    for (const claim of options.requiredClaims ?? []) {
+        if (!(claim in claims))
+            throw jwtError(`claim ${claim} is required`);
+    }
+}
+export async function verifyJwt(token, options) {
+    const allowed = validateAlgorithms(options.algorithms);
+    const parts = token.split(".");
+    if (parts.length !== 3 || parts.some((p) => p === ""))
+        throw jwtError("expected three segments");
+    const headerRaw = decodeJsonSegment(parts[0]);
+    const claimsRaw = decodeJsonSegment(parts[1]);
+    if (!isObject(headerRaw) || typeof headerRaw.alg !== "string")
+        throw jwtError("invalid header");
+    if (headerRaw.crit !== undefined)
+        throw jwtError("crit headers are not supported");
+    if (!isObject(claimsRaw))
+        throw jwtError("invalid claims");
+    const header = headerRaw;
+    const claims = claimsRaw;
+    const alg = verifyAlgorithm(header.alg, allowed);
+    const resolved = typeof options.key === "function" ? await options.key(header, claims) : options.key;
+    if (resolved === null || resolved === undefined)
+        throw jwtError("key not found");
+    const signature = base64UrlDecode(parts[2]);
+    if (signature === null)
+        throw jwtError("invalid signature encoding");
+    const key = await importKey(resolved, alg, header.kid);
+    const ok = await crypto.subtle.verify(HMAC_ALGS.has(alg) ? { name: "HMAC" } : { name: "RSASSA-PKCS1-v1_5" }, key, signature, utf8Bytes(`${parts[0]}.${parts[1]}`));
+    if (!ok)
+        throw jwtError("signature mismatch");
+    validateClaims(claims, options);
+    return { header, claims, token };
+}
+function toError(error) {
+    return error instanceof Error ? error : jwtError("verification failed");
+}
+export async function tryVerifyJwt(token, options) {
+    try {
+        return { ok: true, data: await verifyJwt(token, options) };
+    }
+    catch (error) {
+        return { ok: false, error: toError(error) };
+    }
+}
+function tokenFromRequest(req, header, cookie) {
+    const headerValue = req.headers.get(header);
+    if (headerValue !== null) {
+        if (header === "authorization") {
+            return headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() || null : null;
+        }
+        return headerValue.trim() || null;
+    }
+    return cookie === undefined ? null : (parseCookies(req.headers.get("cookie"))[cookie] ?? null);
+}
+function challenge(realm) {
+    return `Bearer realm="${quotedHeaderValue(realm)}"`;
+}
+function reject(realm) {
+    return jsonError(401, "unauthorized", { "www-authenticate": challenge(realm) });
+}
+export function jwt(options) {
+    validateAlgorithms(options.algorithms);
+    const realm = options.realm ?? "api";
+    const optional = options.optional === true;
+    const header = (options.header ?? "authorization").toLowerCase();
+    const store = new WeakMap();
+    const plugin = definePlugin("jwt", (app) => app.beforeHandle(async (c) => {
+        const token = tokenFromRequest(c.req, header, options.cookie);
+        if (token === null)
+            return optional ? undefined : reject(realm);
+        try {
+            const verified = await verifyJwt(token, options);
+            store.set(c.req, verified.claims);
+            return undefined;
+        }
+        catch {
+            return optional ? undefined : reject(realm);
+        }
+    }));
+    return Object.assign(plugin, {
+        claims: (request) => store.get(request) ?? null,
+        requireClaims: (request) => {
+            const claims = store.get(request);
+            if (claims === undefined)
+                throw reject(realm);
+            return claims;
+        },
+    });
+}
+export function jwk(key) {
+    return (header) => {
+        if (typeof key === "object" && !(key instanceof Uint8Array) && !(key instanceof CryptoKey)) {
+            if (header.kid !== undefined && key.kid !== undefined && key.kid !== header.kid)
+                return null;
+        }
+        return key;
+    };
+}
+function validateJwksUrl(url) {
+    const local = url.hostname === "localhost" ||
+        url.hostname === "127.0.0.1" ||
+        url.hostname === "::1" ||
+        url.hostname === "[::1]";
+    if (url.protocol !== "https:" && !local) {
+        throw new Error("jwks: url must be https unless it targets localhost");
+    }
+}
+async function readTextBounded(res, maxBytes) {
+    const declared = res.headers.get("content-length");
+    if (declared !== null && /^(?:0|[1-9]\d*)$/.test(declared) && Number(declared) > maxBytes) {
+        throw new Error("jwks: response too large");
+    }
+    const body = res.body;
+    if (body === null)
+        return "";
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let total = 0;
+    let text = "";
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                return text + decoder.decode();
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                throw new Error("jwks: response too large");
+            }
+            text += decoder.decode(value, { stream: true });
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && err.message === "jwks: response too large")
+            throw err;
+        throw new Error("jwks: response read failed");
+    }
+}
+async function fetchJwks(options) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), options.timeoutMs);
+    try {
+        const res = await options.fetch(options.url, { signal: ctrl.signal });
+        if (!res.ok)
+            throw new Error(`jwks: fetch failed with ${res.status}`);
+        const text = await readTextBounded(res, options.maxBytes);
+        const parsed = JSON.parse(text);
+        if (!isObject(parsed) || !Array.isArray(parsed.keys))
+            throw new Error("jwks: invalid set");
+        return parsed.keys.filter(isObject);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function jwks(options) {
+    const url = new URL(String(options.url));
+    validateJwksUrl(url);
+    const fetcher = options.fetch ?? fetch;
+    const cacheMs = options.cacheMs ?? 300_000;
+    const staleMs = options.staleMs ?? cacheMs;
+    const timeoutMs = options.timeoutMs ?? 5_000;
+    const maxBytes = options.maxBytes ?? 65_536;
+    if (!Number.isFinite(cacheMs) || cacheMs < 0)
+        throw new Error("jwks: cacheMs must be non-negative");
+    if (!Number.isFinite(staleMs) || staleMs < 0)
+        throw new Error("jwks: staleMs must be non-negative");
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+        throw new Error("jwks: timeoutMs must be positive");
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error("jwks: maxBytes must be positive");
+    }
+    let cached = [];
+    let cachedAt = 0;
+    let pending;
+    const load = async () => {
+        const now = Date.now();
+        if (cached.length > 0 && now - cachedAt < cacheMs)
+            return cached;
+        pending ??= fetchJwks({ url, fetch: fetcher, timeoutMs, maxBytes }).finally(() => {
+            pending = undefined;
+        });
+        try {
+            cached = await pending;
+            cachedAt = Date.now();
+            return cached;
+        }
+        catch (error) {
+            if (cached.length > 0 && staleMs > 0 && Date.now() - cachedAt < cacheMs + staleMs) {
+                return cached;
+            }
+            throw error;
+        }
+    };
+    return async (header) => {
+        if (typeof header.kid !== "string" || header.kid === "")
+            return null;
+        const keys = await load();
+        const alg = header.alg;
+        return keys.find((key) => key.kid === header.kid && validateJwkForAlg(key, alg, header.kid));
+    };
+}
+//# sourceMappingURL=jwt.js.map