@pulse-compute/crypto 0.0.0 → 1.0.0-beta.2

package/dist/contracts.js

@@ -0,0 +1,149 @@
+export const CRYPTO_CONTRACT_VERSION = 'pulse.crypto.verification.v1';
+export const CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION = 'webcrypto.subtle.hmac-sha-256.v1';
+export const CRYPTO_GUEST_SOURCE_IMPLEMENTATION = 'pulse-hmac-as.v1';
+export const CRYPTO_ES256_CONTRACT_VERSION = 'pulse.crypto.es256-verification.v1';
+export const CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION = 'webcrypto.subtle.ecdsa-p256-sha-256.v1';
+export const CRYPTO_ES256_GUEST_LINKED_REALIZATION = 'guest-linked:pulse-es256-rustcrypto-p256';
+export const CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION = 'rustcrypto.p256-0.13.2.ecdsa-0.16.9.sha2-0.10.9.v1';
+/**
+ * Executable algorithms remain intentionally narrower than frozen future
+ * contracts. G3, not G0, owns activation of ES256.
+ */
+export const CRYPTO_ALGORITHMS = Object.freeze([
+    'HS256',
+    'ES256',
+]);
+export const CRYPTO_VERIFICATION_STATUSES = Object.freeze([
+    'valid',
+    'invalid-authenticator',
+    'invalid-key',
+    'invalid-input',
+    'realization-failure',
+]);
+export const CRYPTO_RESOURCE_LIMITS = Object.freeze({
+    hmacKeyBytesMinimum: 32,
+    hmacKeyBytesMaximum: 4 * 1024,
+    macDataBytesMaximum: 1024 * 1024,
+    hs256TagBytes: 32,
+    es256PublicKeyBytes: 64,
+    es256SignatureBytes: 64,
+    es256SigningInputBytesMaximum: 16_340,
+});
+export const CRYPTO_ES256_CONTRACT = Object.freeze({
+    version: CRYPTO_ES256_CONTRACT_VERSION,
+    status: 'executable-g3',
+    semanticOwner: '@pulse-compute/crypto',
+    algorithm: 'ES256',
+    primitive: Object.freeze({
+        kind: 'ecdsa',
+        curve: 'P-256',
+        hash: 'SHA-256',
+    }),
+    operation: 'verify',
+    request: Object.freeze({
+        function: 'crypto.signature.verify',
+        keyType: 'p256-public-key-bytes',
+        publicKeyEncoding: 'raw-x-y-big-endian',
+        publicKeyBytes: CRYPTO_RESOURCE_LIMITS.es256PublicKeyBytes,
+        dataBytesMaximum: CRYPTO_RESOURCE_LIMITS.es256SigningInputBytesMaximum,
+        signatureEncoding: 'jose-r-s-big-endian',
+        signatureBytes: CRYPTO_RESOURCE_LIMITS.es256SignatureBytes,
+        derAccepted: false,
+    }),
+    runtimeBuiltin: Object.freeze({
+        realization: 'runtime-builtin',
+        implementation: CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION,
+        eligibleTargets: Object.freeze([
+            'node-javascript',
+            'fastly-javascript',
+        ]),
+    }),
+    native: Object.freeze({
+        realization: CRYPTO_ES256_GUEST_LINKED_REALIZATION,
+        implementation: CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION,
+        eligibleTargets: Object.freeze([
+            'node-native',
+            'fastly-native',
+        ]),
+    }),
+    guest: Object.freeze({
+        unitVersion: 'pulse.guest-unit.v2',
+        unitId: 'pulse.crypto.es256.rustcrypto-p256.v1',
+        module: 'pulse_crypto_es256',
+        owner: '@pulse-compute/crypto',
+        abi: 'pulse.crypto.es256.verify.v1',
+        export: Object.freeze({
+            name: 'pulse_crypto_es256_verify',
+            parameters: Object.freeze(['i32', 'i32']),
+            results: Object.freeze(['i32']),
+        }),
+        origin: 'package-prebuilt',
+        sourceBuildDuringApplicationBuild: false,
+        memory: Object.freeze({
+            identity: 'pulse.guest-memory.invocation-frame.v2',
+            import: 'env.memory',
+            minimumPages: 32,
+            maximumPages: 32,
+            growable: false,
+        }),
+        start: 'forbidden',
+        hostCallbacks: false,
+        allocator: false,
+    }),
+    frame: Object.freeze({
+        identity: 'pulse.crypto.es256.invocation-frame.v2',
+        byteOrder: 'little-endian',
+        pointerWidthBits: 32,
+        magic: 0x32534550,
+        version: 2,
+        headerBytes: 64,
+        capacityBytes: 16_640,
+        alignmentBytes: 16,
+        signingInputBytesMaximum: 16_340,
+        publicKeyBytes: 64,
+        signatureBytes: 64,
+        rawPayloadBytesMaximum: 16_468,
+        reservedHeaderAndAlignmentBytes: 172,
+        canonicalOffsets: Object.freeze({
+            publicKey: 64,
+            signature: 128,
+            signingInput: 192,
+        }),
+        header: Object.freeze({
+            magic: 0,
+            version: 4,
+            headerLength: 8,
+            totalLength: 12,
+            algorithm: 16,
+            flags: 20,
+            signingInputOffset: 24,
+            signingInputLength: 28,
+            publicKeyOffset: 32,
+            publicKeyLength: 36,
+            signatureOffset: 40,
+            signatureLength: 44,
+            reserved0: 48,
+            reserved1: 52,
+            reserved2: 56,
+            reserved3: 60,
+        }),
+        algorithmCode: 1,
+        flags: 0,
+        reservedWordCount: 4,
+        reservedWordValue: 0,
+        callerOwned: true,
+        synchronous: true,
+        retainable: false,
+        clearCapacityAfterReturnOrTrap: true,
+    }),
+    resultStatuses: CRYPTO_VERIFICATION_STATUSES,
+    resultCodes: Object.freeze({
+        valid: 1,
+        invalidAuthenticator: 0,
+        invalidKey: -1,
+        invalidInput: -2,
+        realizationFailure: -3,
+    }),
+    automaticFallback: false,
+});
+//# sourceMappingURL=contracts.js.map

package/dist/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAAuC,CAAC;AAC/E,MAAM,CAAC,MAAM,qCAAqC,GAChD,kCAA2C,CAAC;AAC9C,MAAM,CAAC,MAAM,kCAAkC,GAC7C,kBAA2B,CAAC;AAC9B,MAAM,CAAC,MAAM,6BAA6B,GACxC,oCAA6C,CAAC;AAChD,MAAM,CAAC,MAAM,2CAA2C,GACtD,wCAAiD,CAAC;AACpD,MAAM,CAAC,MAAM,qCAAqC,GAChD,0CAAmD,CAAC;AACtD,MAAM,CAAC,MAAM,wCAAwC,GACnD,oDAA6D,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,OAAO;IACP,OAAO;CACC,CAAC,CAAC;AAMZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,OAAO;IACP,uBAAuB;IACvB,aAAa;IACb,eAAe;IACf,qBAAqB;CACb,CAAC,CAAC;AAoEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,mBAAmB,EAAE,EAAE;IACvB,mBAAmB,EAAE,CAAC,GAAG,IAAI;IAC7B,mBAAmB,EAAE,IAAI,GAAG,IAAI;IAChC,aAAa,EAAE,EAAE;IACjB,mBAAmB,EAAE,EAAE;IACvB,mBAAmB,EAAE,EAAE;IACvB,6BAA6B,EAAE,MAAM;CAC7B,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,6BAA6B;IACtC,MAAM,EAAE,eAAe;IACvB,aAAa,EAAE,uBAAuB;IACtC,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,SAAS;KAChB,CAAC;IACF,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,QAAQ,EAAE,yBAAyB;QACnC,OAAO,EAAE,uBAAuB;QAChC,iBAAiB,EAAE,oBAAoB;QACvC,cAAc,EAAE,sBAAsB,CAAC,mBAAmB;QAC1D,gBAAgB,EAAE,sBAAsB,CAAC,6BAA6B;QACtE,iBAAiB,EAAE,qBAAqB;QACxC,cAAc,EAAE,sBAAsB,CAAC,mBAAmB;QAC1D,WAAW,EAAE,KAAK;KACnB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5B,WAAW,EAAE,iBAAiB;QAC9B,cAAc,EAAE,2CAA2C;QAC3D,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;YAC7B,iBAAiB;YACjB,mBAAmB;SACX,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,qCAAqC;QAClD,cAAc,EAAE,wCAAwC;QACxD,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;YAC7B,aAAa;YACb,eAAe;SACP,CAAC;KACZ,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,qBAAqB;QAClC,MAAM,EAAE,uCAAuC;QAC/C,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,GAAG,EAAE,8BAA8B;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,2BAA2B;YACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAU,CAAC;YAClD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAU,CAAC;SACzC,CAAC;QACF,MAAM,EAAE,kBAAkB;QAC1B,iCAAiC,EAAE,KAAK;QACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,wCAAwC;YAClD,MAAM,EAAE,YAAY;YACpB,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,KAAK,EAAE,WAAW;QAClB,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,wCAAwC;QAClD,SAAS,EAAE,eAAe;QAC1B,gBAAgB,EAAE,EAAE;QACpB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,EAAE;QAClB,wBAAwB,EAAE,MAAM;QAChC,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,EAAE;QAClB,sBAAsB,EAAE,MAAM;QAC9B,+BAA+B,EAAE,GAAG;QACpC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC;YAC9B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;SAClB,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,CAAC;YACf,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,EAAE;YACtB,kBAAkB,EAAE,EAAE;YACtB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd,CAAC;QACF,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,CAAC;QACR,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,KAAK;QACjB,8BAA8B,EAAE,IAAI;KACrC,CAAC;IACF,cAAc,EAAE,4BAA4B;IAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,CAAC;QACR,oBAAoB,EAAE,CAAC;QACvB,UAAU,EAAE,CAAC,CAAC;QACd,YAAY,EAAE,CAAC,CAAC;QAChB,kBAAkB,EAAE,CAAC,CAAC;KACvB,CAAC;IACF,iBAAiB,EAAE,KAAK;CAChB,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,23 @@
+import { CRYPTO_ALGORITHMS, CRYPTO_CONTRACT_VERSION, CRYPTO_ES256_CONTRACT, CRYPTO_ES256_CONTRACT_VERSION, CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_ES256_GUEST_LINKED_REALIZATION, CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_GUEST_SOURCE_IMPLEMENTATION, CRYPTO_RESOURCE_LIMITS, CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_VERIFICATION_STATUSES, type CryptoAlgorithm, type CryptoVerificationResult, type CryptoVerificationStatus, type Es256JoseVerifyInput, type HmacKeyBytes, type HmacVerificationKey, type MacAlgorithm, type MacVerifyRequest, type P256PublicKeyBytes, type P256PublicKeyCoordinates, type SignatureAlgorithm, type SignatureVerifyRequest } from './contracts.js';
+import { normalizeEs256JoseVerifyRequest, normalizeP256PublicKeyCoordinates } from './internal/verification.js';
+export { CRYPTO_ALGORITHMS, CRYPTO_CONTRACT_VERSION, CRYPTO_ES256_CONTRACT, CRYPTO_ES256_CONTRACT_VERSION, CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_ES256_GUEST_LINKED_REALIZATION, CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_GUEST_SOURCE_IMPLEMENTATION, CRYPTO_RESOURCE_LIMITS, CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_VERIFICATION_STATUSES, };
+export type { CryptoAlgorithm, CryptoVerificationResult, CryptoVerificationStatus, Es256JoseVerifyInput, HmacKeyBytes, HmacVerificationKey, MacAlgorithm, MacVerifyRequest, P256PublicKeyBytes, P256PublicKeyCoordinates, SignatureAlgorithm, SignatureVerifyRequest, };
+export { normalizeEs256JoseVerifyRequest, normalizeP256PublicKeyCoordinates, };
+export declare function verifyMac(request: MacVerifyRequest): Promise<CryptoVerificationResult>;
+export declare function verifySignature(request: SignatureVerifyRequest): Promise<CryptoVerificationResult>;
+export declare const mac: Readonly<{
+    verify: typeof verifyMac;
+}>;
+export declare const signature: Readonly<{
+    verify: typeof verifySignature;
+}>;
+export declare const crypto: Readonly<{
+    mac: Readonly<{
+        verify: typeof verifyMac;
+    }>;
+    signature: Readonly<{
+        verify: typeof verifySignature;
+    }>;
+}>;
+export default crypto;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,EAC5B,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,+BAA+B,EAE/B,iCAAiC,EAGlC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAC7B,CAAC;AACF,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,GACvB,CAAC;AAEF,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,CAAC;AAEF,wBAAsB,SAAS,CAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,wBAAwB,CAAC,CAcnC;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAenC;AAED,eAAO,MAAM,GAAG;;EAEd,CAAC;AAEH,eAAO,MAAM,SAAS;;EAEpB,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;EAGjB,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist/index.js

@@ -0,0 +1,52 @@
+import { CRYPTO_ALGORITHMS, CRYPTO_CONTRACT_VERSION, CRYPTO_ES256_CONTRACT, CRYPTO_ES256_CONTRACT_VERSION, CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_ES256_GUEST_LINKED_REALIZATION, CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_GUEST_SOURCE_IMPLEMENTATION, CRYPTO_RESOURCE_LIMITS, CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_VERIFICATION_STATUSES, } from './contracts.js';
+import { verifyEs256, verifyHs256 } from './internal/realization.js';
+import { normalizeEs256JoseVerifyRequest, normalizeMacVerifyRequest, normalizeP256PublicKeyCoordinates, normalizeSignatureVerifyRequest, normalizeVerificationResult, } from './internal/verification.js';
+export { CRYPTO_ALGORITHMS, CRYPTO_CONTRACT_VERSION, CRYPTO_ES256_CONTRACT, CRYPTO_ES256_CONTRACT_VERSION, CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_ES256_GUEST_LINKED_REALIZATION, CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_GUEST_SOURCE_IMPLEMENTATION, CRYPTO_RESOURCE_LIMITS, CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_VERIFICATION_STATUSES, };
+export { normalizeEs256JoseVerifyRequest, normalizeP256PublicKeyCoordinates, };
+export async function verifyMac(request) {
+    let normalized;
+    try {
+        normalized = normalizeMacVerifyRequest(request);
+    }
+    catch {
+        return normalizeVerificationResult({ status: 'invalid-input' });
+    }
+    if (!normalized.ok)
+        return normalized.result;
+    try {
+        return normalizeVerificationResult(await verifyHs256(normalized.request));
+    }
+    catch {
+        return normalizeVerificationResult(undefined);
+    }
+}
+export async function verifySignature(request) {
+    let normalized;
+    try {
+        normalized = normalizeSignatureVerifyRequest(request);
+    }
+    catch {
+        return normalizeVerificationResult({ status: 'invalid-input' });
+    }
+    if (!normalized.ok)
+        return normalized.result;
+    try {
+        return normalizeVerificationResult(await verifyEs256(normalized.request));
+    }
+    catch {
+        normalized.request.key.bytes.fill(0);
+        return normalizeVerificationResult(undefined);
+    }
+}
+export const mac = Object.freeze({
+    verify: verifyMac,
+});
+export const signature = Object.freeze({
+    verify: verifySignature,
+});
+export const crypto = Object.freeze({
+    mac,
+    signature,
+});
+export default crypto;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAa7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAC7B,CAAC;AAgBF,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAyB;IAEzB,IAAI,UAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,IAAI,UAA8D,CAAC;IACnE,IAAI,CAAC;QACH,UAAU,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,GAAG;IACH,SAAS;CACV,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist/internal/data.d.ts

@@ -0,0 +1,10 @@
+export interface OwnDataProperty {
+    readonly present: boolean;
+    readonly valid: boolean;
+    readonly value?: unknown;
+}
+export declare function isOrdinaryObject(value: unknown): value is Readonly<Record<string, unknown>>;
+export declare function ownDataProperty(value: object, name: string): OwnDataProperty;
+export declare function exactDataProperties(value: object, required: ReadonlySet<string>): boolean;
+export declare function copyBytes(value: unknown): Uint8Array<ArrayBuffer> | undefined;
+//# sourceMappingURL=data.d.ts.map

package/dist/internal/data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/internal/data.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAI3F;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,eAAe,CAc5E;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,GAC5B,OAAO,CAaT;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAK7E"}

package/dist/internal/data.js

@@ -0,0 +1,41 @@
+export function isOrdinaryObject(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+export function ownDataProperty(value, name) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+    if (!descriptor)
+        return Object.freeze({ present: false, valid: true });
+    if (!descriptor.enumerable
+        || !Object.prototype.hasOwnProperty.call(descriptor, 'value')) {
+        return Object.freeze({ present: true, valid: false });
+    }
+    return Object.freeze({
+        present: true,
+        valid: true,
+        value: descriptor.value,
+    });
+}
+export function exactDataProperties(value, required) {
+    const keys = Reflect.ownKeys(value);
+    if (keys.some((key) => typeof key !== 'string')
+        || keys.length !== required.size) {
+        return false;
+    }
+    for (const name of required) {
+        const property = ownDataProperty(value, name);
+        if (!property.present || !property.valid)
+            return false;
+    }
+    return true;
+}
+export function copyBytes(value) {
+    if (!(value instanceof Uint8Array))
+        return undefined;
+    const output = new Uint8Array(value.byteLength);
+    Uint8Array.prototype.set.call(output, value);
+    return output;
+}
+//# sourceMappingURL=data.js.map

package/dist/internal/data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.js","sourceRoot":"","sources":["../../src/internal/data.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAY;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,IACE,CAAC,UAAU,CAAC,UAAU;WACnB,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAC7D,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,UAAU,CAAC,KAAK;KACxB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,QAA6B;IAE7B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,IACE,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;WACxC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,EAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChD,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/internal/realization.d.ts

@@ -0,0 +1,11 @@
+import type { CryptoVerificationResult } from '../contracts.js';
+import { type NormalizedMacVerifyRequest, type NormalizedSignatureVerifyRequest } from './verification.js';
+export type Hs256SubtleCrypto = Pick<SubtleCrypto, 'importKey' | 'verify'>;
+export type Es256SubtleCrypto = Pick<SubtleCrypto, 'importKey' | 'verify'>;
+export declare function verifyHs256WithSubtle(request: NormalizedMacVerifyRequest, subtle: Hs256SubtleCrypto | undefined): Promise<CryptoVerificationResult>;
+/** Execute the already-selected JavaScript runtime-builtin realization. */
+export declare function verifyHs256(request: NormalizedMacVerifyRequest): Promise<CryptoVerificationResult>;
+export declare function verifyEs256WithSubtle(request: NormalizedSignatureVerifyRequest, subtle: Es256SubtleCrypto | undefined): Promise<CryptoVerificationResult>;
+/** Execute the already-selected JavaScript runtime-builtin realization. */
+export declare function verifyEs256(request: NormalizedSignatureVerifyRequest): Promise<CryptoVerificationResult>;
+//# sourceMappingURL=realization.d.ts.map

package/dist/internal/realization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realization.d.ts","sourceRoot":"","sources":["../../src/internal/realization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,EACtC,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,QAAQ,CAAC,CAAC;AAC3E,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,QAAQ,CAAC,CAAC;AA8D3E,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,0BAA0B,EACnC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACpC,OAAO,CAAC,wBAAwB,CAAC,CAyCnC;AAED,2EAA2E;AAC3E,wBAAsB,WAAW,CAC/B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,wBAAwB,CAAC,CAEnC;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,gCAAgC,EACzC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACpC,OAAO,CAAC,wBAAwB,CAAC,CAoDnC;AAED,2EAA2E;AAC3E,wBAAsB,WAAW,CAC/B,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,wBAAwB,CAAC,CAEnC"}

package/dist/internal/realization.js

@@ -0,0 +1,140 @@
+import { verificationResult, } from './verification.js';
+const BASE64URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+const P256_FIELD = 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffffn;
+const P256_B = 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604bn;
+function fixedWidthBase64url(bytes) {
+    let output = '';
+    for (let index = 0; index < bytes.byteLength; index += 3) {
+        const first = bytes[index];
+        const second = bytes[index + 1];
+        const third = bytes[index + 2];
+        output += BASE64URL_ALPHABET[first >>> 2];
+        output += BASE64URL_ALPHABET[((first & 0x03) << 4) | ((second ?? 0) >>> 4)];
+        if (index + 1 < bytes.byteLength) {
+            output += BASE64URL_ALPHABET[((second & 0x0f) << 2) | ((third ?? 0) >>> 6)];
+        }
+        if (index + 2 < bytes.byteLength) {
+            output += BASE64URL_ALPHABET[third & 0x3f];
+        }
+    }
+    return output;
+}
+function bigEndianInteger(bytes) {
+    let output = 0n;
+    for (const byte of bytes)
+        output = (output << 8n) | BigInt(byte);
+    return output;
+}
+function validP256Point(bytes) {
+    const x = bigEndianInteger(bytes.subarray(0, 32));
+    const y = bigEndianInteger(bytes.subarray(32, 64));
+    if (x >= P256_FIELD || y >= P256_FIELD)
+        return false;
+    const left = (y * y) % P256_FIELD;
+    const right = ((((x * x) % P256_FIELD) * x)
+        - (3n * x)
+        + P256_B) % P256_FIELD;
+    return left === (right < 0n ? right + P256_FIELD : right);
+}
+function selectedRuntimeBuiltin() {
+    try {
+        const subtle = globalThis.crypto?.subtle;
+        if (!subtle
+            || typeof subtle.importKey !== 'function'
+            || typeof subtle.verify !== 'function') {
+            return undefined;
+        }
+        return subtle;
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function verifyHs256WithSubtle(request, subtle) {
+    if (!subtle) {
+        request.key.bytes.fill(0);
+        return verificationResult('realization-failure');
+    }
+    let key;
+    try {
+        key = await subtle.importKey('raw', request.key.bytes.buffer, {
+            name: 'HMAC',
+            hash: { name: 'SHA-256' },
+            length: request.key.bytes.byteLength * 8,
+        }, false, ['verify']);
+    }
+    catch {
+        request.key.bytes.fill(0);
+        return verificationResult('invalid-key');
+    }
+    // Keep the normalized key storage live until the selected runtime has
+    // completed its final use, then erase it on every verification outcome.
+    try {
+        const valid = await subtle.verify({ name: 'HMAC' }, key, request.tag.buffer, request.data.buffer);
+        if (valid === true)
+            return verificationResult('valid');
+        if (valid === false)
+            return verificationResult('invalid-authenticator');
+        return verificationResult('realization-failure');
+    }
+    catch {
+        return verificationResult('realization-failure');
+    }
+    finally {
+        request.key.bytes.fill(0);
+    }
+}
+/** Execute the already-selected JavaScript runtime-builtin realization. */
+export async function verifyHs256(request) {
+    return verifyHs256WithSubtle(request, selectedRuntimeBuiltin());
+}
+export async function verifyEs256WithSubtle(request, subtle) {
+    if (!subtle) {
+        request.key.bytes.fill(0);
+        return verificationResult('realization-failure');
+    }
+    if (!validP256Point(request.key.bytes)) {
+        request.key.bytes.fill(0);
+        return verificationResult('invalid-key');
+    }
+    const jwk = {
+        kty: 'EC',
+        crv: 'P-256',
+        x: fixedWidthBase64url(request.key.bytes.subarray(0, 32)),
+        y: fixedWidthBase64url(request.key.bytes.subarray(32, 64)),
+        ext: true,
+        key_ops: ['verify'],
+    };
+    let key;
+    try {
+        key = await subtle.importKey('jwk', jwk, {
+            name: 'ECDSA',
+            namedCurve: 'P-256',
+        }, false, ['verify']);
+    }
+    catch {
+        return verificationResult('invalid-key');
+    }
+    finally {
+        request.key.bytes.fill(0);
+    }
+    try {
+        const valid = await subtle.verify({
+            name: 'ECDSA',
+            hash: { name: 'SHA-256' },
+        }, key, request.signature.buffer, request.data.buffer);
+        if (valid === true)
+            return verificationResult('valid');
+        if (valid === false)
+            return verificationResult('invalid-authenticator');
+        return verificationResult('realization-failure');
+    }
+    catch {
+        return verificationResult('realization-failure');
+    }
+}
+/** Execute the already-selected JavaScript runtime-builtin realization. */
+export async function verifyEs256(request) {
+    return verifyEs256WithSubtle(request, selectedRuntimeBuiltin());
+}
+//# sourceMappingURL=realization.js.map

package/dist/internal/realization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"realization.js","sourceRoot":"","sources":["../../src/internal/realization.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,GAGnB,MAAM,mBAAmB,CAAC;AAK3B,MAAM,kBAAkB,GACtB,kEAAkE,CAAC;AACrE,MAAM,UAAU,GACd,mEAAmE,CAAC;AACtE,MAAM,MAAM,GACV,mEAAmE,CAAC;AAEtE,SAAS,mBAAmB,CAAC,KAAiB;IAC5C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,kBAAkB,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,kBAAkB,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,KAAiB;IACvC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC;IAClC,MAAM,KAAK,GAAG,CACZ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;UAC1B,CAAC,EAAE,GAAG,CAAC,CAAC;UACR,MAAM,CACT,GAAG,UAAU,CAAC;IACf,OAAO,IAAI,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;QACzC,IACE,CAAC,MAAM;eACJ,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU;eACtC,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,EACtC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAmC,EACnC,MAAqC;IAErC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAC1B,KAAK,EACL,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EACxB;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC;SACzC,EACD,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,EAChB,GAAG,EACH,OAAO,CAAC,GAAG,CAAC,MAAM,EAClB,OAAO,CAAC,IAAI,CAAC,MAAM,CACpB,CAAC;QACF,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACxE,OAAO,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAmC;IAEnC,OAAO,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAyC,EACzC,MAAqC;IAErC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,OAAO,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,GAAG,GAAG;QACV,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,OAAO;QACZ,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1D,GAAG,EAAE,IAAI;QACT,OAAO,EAAE,CAAC,QAAQ,CAAC;KACC,CAAC;IACvB,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAC1B,KAAK,EACL,GAAG,EACH;YACE,IAAI,EAAE,OAAO;YACb,UAAU,EAAE,OAAO;SACpB,EACD,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAC/B;YACE,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,EACD,GAAG,EACH,OAAO,CAAC,SAAS,CAAC,MAAM,EACxB,OAAO,CAAC,IAAI,CAAC,MAAM,CACpB,CAAC;QACF,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;QACxE,OAAO,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAyC;IAEzC,OAAO,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAClE,CAAC"}

package/dist/internal/verification.d.ts

@@ -0,0 +1,67 @@
+import { type CryptoVerificationResult, type CryptoVerificationStatus, type Es256JoseVerifyInput, type MacVerifyRequest, type P256PublicKeyCoordinates, type SignatureVerifyRequest } from '../contracts.js';
+export interface NormalizedMacVerifyRequest {
+    readonly algorithm: 'HS256';
+    readonly key: {
+        readonly type: 'hmac-key-bytes';
+        readonly bytes: Uint8Array<ArrayBuffer>;
+    };
+    readonly data: Uint8Array<ArrayBuffer>;
+    readonly tag: Uint8Array<ArrayBuffer>;
+}
+export type MacVerifyRequestNormalization = {
+    readonly ok: true;
+    readonly request: NormalizedMacVerifyRequest;
+} | {
+    readonly ok: false;
+    readonly result: CryptoVerificationResult;
+};
+export interface NormalizedSignatureVerifyRequest {
+    readonly algorithm: 'ES256';
+    readonly key: {
+        readonly type: 'p256-public-key-bytes';
+        readonly bytes: Uint8Array<ArrayBuffer>;
+    };
+    readonly data: Uint8Array<ArrayBuffer>;
+    readonly signature: Uint8Array<ArrayBuffer>;
+}
+export type SignatureVerifyRequestNormalization = {
+    readonly ok: true;
+    readonly request: NormalizedSignatureVerifyRequest;
+} | {
+    readonly ok: false;
+    readonly result: CryptoVerificationResult;
+};
+export type P256PublicKeyNormalization = {
+    readonly ok: true;
+    readonly key: NormalizedSignatureVerifyRequest['key'];
+} | {
+    readonly ok: false;
+    readonly result: CryptoVerificationResult;
+};
+export declare function verificationResult(status: CryptoVerificationStatus): CryptoVerificationResult;
+export declare function normalizeMacVerifyRequest(value: unknown): MacVerifyRequestNormalization;
+export declare function normalizeSignatureVerifyRequest(value: unknown): SignatureVerifyRequestNormalization;
+export declare function normalizeEs256JoseVerifyRequest(value: Es256JoseVerifyInput): SignatureVerifyRequestNormalization;
+export declare function normalizeP256PublicKeyCoordinates(value: P256PublicKeyCoordinates): P256PublicKeyNormalization;
+export declare function normalizeVerificationResult(value: unknown): CryptoVerificationResult;
+export declare function redactMacVerifyRequest(request: MacVerifyRequest | NormalizedMacVerifyRequest): Readonly<{
+    algorithm: 'HS256';
+    key: Readonly<{
+        type: 'hmac-key-bytes';
+        compatibleAlgorithms: readonly ['HS256'];
+        identity: '[redacted]';
+    }>;
+    data: '[redacted]';
+    tag: '[redacted]';
+}>;
+export declare function redactSignatureVerifyRequest(request: SignatureVerifyRequest | NormalizedSignatureVerifyRequest): Readonly<{
+    algorithm: 'ES256';
+    key: Readonly<{
+        type: 'p256-public-key-bytes';
+        compatibleAlgorithms: readonly ['ES256'];
+        identity: '[redacted]';
+    }>;
+    data: '[redacted]';
+    signature: '[redacted]';
+}>;
+//# sourceMappingURL=verification.d.ts.map

package/dist/internal/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/internal/verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AA6BzB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAChC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;KACzC,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;CAC9C,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C,CAAC;AAEN,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;QACvC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;KACzC,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CAC7C;AAED,MAAM,MAAM,mCAAmC,GAC3C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,gCAAgC,CAAC;CACpD,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C,CAAC;AAEN,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,GAAG,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC;CACvD,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C,CAAC;AAEN,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,wBAAwB,GAC/B,wBAAwB,CAE1B;AAmFD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,GACb,6BAA6B,CAgD/B;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,mCAAmC,CA6CrC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,oBAAoB,GAC1B,mCAAmC,CAqCrC;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,wBAAwB,GAC9B,0BAA0B,CAmC5B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,wBAAwB,CAY1B;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,gBAAgB,GAAG,0BAA0B,GACrD,QAAQ,CAAC;IACV,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,QAAQ,CAAC;QACZ,IAAI,EAAE,gBAAgB,CAAC;QACvB,oBAAoB,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,QAAQ,EAAE,YAAY,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,YAAY,CAAC;CACnB,CAAC,CAWD;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,sBAAsB,GAAG,gCAAgC,GACjE,QAAQ,CAAC;IACV,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,QAAQ,CAAC;QACZ,IAAI,EAAE,uBAAuB,CAAC;QAC9B,oBAAoB,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,QAAQ,EAAE,YAAY,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,YAAY,CAAC;CACzB,CAAC,CAWD"}