@pulse-compute/crypto 1.0.0-beta.5 → 1.0.0-beta.6

package/README.md

@@ -7,15 +7,15 @@
 > **Supported entry points:** `@pulse-compute/crypto`<br>
 > **Stability:** The package root supports bounded verification and request-owned exact-text digests; provider, manifest/compiler and Native integration subpaths remain toolchain-only.<br>
 > **npm:** [`@pulse-compute/crypto`](https://www.npmjs.com/package/@pulse-compute/crypto)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.5/packages/crypto/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/crypto/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.5` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
 Provider-neutral verification and bounded exact-text SHA-256 for Pulse.
 
 This package and `@pulse-compute/jwt` are members of the synchronized
-`1.0.0-beta.5` release catalog.
+`1.0.0-beta.6` release catalog.
 
 ## Exact-text SHA-256
 
@@ -38,7 +38,7 @@ the invocation. The named `digestText` export has the same contract.
 Node/Fastly Native reuse the selected Crypto SHA-256 guest source. Node/Fastly
 JavaScript use selected Web Crypto. Neither falls back. This bound matches
 current S3 text capacity and leaves larger Catalog envelopes for capacity work.
-See the [exact-text digest contract](https://pulsecompute.io/v1.0.0-beta.5/packages/crypto/#exact-text-digest).
+See the [exact-text digest contract](https://pulsecompute.io/v1.0.0-beta.6/packages/crypto/#exact-text-digest).
 
 ## Verification contract
 
@@ -167,3 +167,55 @@ Large hashes use a separate lazy 2,097,184-byte Native staging frame; small
 hashes and HMAC keep the 40,992-byte frame. Primary-memory Native digest/S3
 modules have a 256 MiB Wasm maximum. Fixed-memory linked guests retain their
 separate ABI and do not establish the 2 MiB text capacity profile.
+
+
+## RS256 signature contract
+
+`crypto.signature.verify` accepts `algorithm: 'RS256'` and a
+`rsa-public-key-bytes` key. `normalizeRsaPublicKey({ n, e })` converts public
+JWK integers into that representation; `normalizeRs256JoseVerifyRequest`
+also decodes the canonical, fixed-width JOSE signature. JWT owns JWK metadata
+and selection policy. No generic public signing API is introduced.
+
+The normalized key is a little-endian 32-bit modulus byte length, the unsigned
+big-endian modulus, and a four-byte big-endian public exponent. Supported
+lengths are 256, 384, and 512 bytes; the modulus has its high bit set and is
+odd. Exponents are odd integers in `[3, 4294967295]`. Signature width equals
+modulus width, including any leading zero signature bytes. Data is at most
+12288 bytes. Verification returns the existing closed status taxonomy.
+
+The exact Native selection is `guest-linked:pulse-rs256-bearssl-i31` with
+`bearssl.0.6.rsa-i31.sha256.v1`. It shares the pinned ES256/RS256 prebuilt and
+fixed 2 MiB memory with ES256. The private signing adapter accepts normalized
+RSA/CRT bytes, validates their consistency, and checks every resulting
+signature by public exponentiation before release. The caller erases its
+16640-byte invocation frame and the borrowed 64 KiB guest stack on return.
+The Node wrapper also clears both regions on a trap; a Fastly Native trap
+aborts execution before in-Wasm cleanup can run. The guest has no retained
+key state, entropy imports, allocation, or host callbacks. PKCS#1 v1.5
+signing is deterministic and needs no nonce.
+
+BearSSL `i31` uses constant-time arithmetic rather than RSA blinding. Its
+security assumptions include constant-time integer multiplication and a
+compiler/engine that preserves the intended data-independent execution.
+This is not a formal timing proof for every Wasm engine or CPU. The pinned
+upstream source, license, archive hash, per-file hashes, compiler versions,
+and reproducible build command ship with the guest. The historical guest
+path and module name remain for compatibility; its ABI is now
+`pulse.crypto.es256-rs256.verify-and-sign.v3`.
+
+JavaScript explicitly selects `RSASSA-PKCS1-v1_5` with `SHA-256` in Web Crypto
+and independently verifies signing output. Redundant private-field import
+checks use JavaScript BigInt, which is not constant time; private
+exponentiation and blinding belong to the selected Web Crypto runtime.
+Immutable JWK strings and runtime-owned key objects cannot be explicitly
+erased by Pulse. The provider retains its existing cancellation and
+redaction boundaries.
+
+The combined prebuilt is 36378 bytes. The development corpus observed 6324
+bytes of guest stack writes within the reserved 65536 bytes. Local warmed
+4096-bit operations took roughly 43 ms to sign and 1.5 ms to verify; these
+are local Node Wasm observations, not performance guarantees or Fastly
+measurements. `crypto-rs256` regenerates the observations and tests independent
+interoperability, malformed PKCS#1 encodings, CRT corruption, frame bounds,
+and cleanup. `jwt-rs256` covers the provider and CLI paths.

package/dist/contracts.d.ts

@@ -6,13 +6,12 @@ export declare const CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION: "webcrypto.sub
 export declare const CRYPTO_ES256_GUEST_LINKED_REALIZATION: "guest-linked:pulse-es256-rustcrypto-p256";
 export declare const CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION: "rustcrypto.p256-0.13.2.ecdsa-0.16.9.sha2-0.10.9.v1";
 /**
- * Executable algorithms remain intentionally narrower than frozen future
- * contracts. G3, not G0, owns activation of ES256.
+ * Executable verification algorithms. Signature keys remain algorithm-bound.
  */
-export declare const CRYPTO_ALGORITHMS: readonly ["HS256", "ES256"];
+export declare const CRYPTO_ALGORITHMS: readonly ["HS256", "ES256", "RS256"];
 export type CryptoAlgorithm = typeof CRYPTO_ALGORITHMS[number];
 export type MacAlgorithm = 'HS256';
-export type SignatureAlgorithm = 'ES256';
+export type SignatureAlgorithm = 'ES256' | 'RS256';
 export declare const CRYPTO_VERIFICATION_STATUSES: readonly ["valid", "invalid-authenticator", "invalid-key", "invalid-input", "realization-failure"];
 export type CryptoVerificationStatus = typeof CRYPTO_VERIFICATION_STATUSES[number];
 export type CryptoVerificationResult = {
@@ -50,14 +49,18 @@ export interface P256PublicKeyBytes {
     /** Exactly 64 bytes: 32-byte big-endian x followed by 32-byte big-endian y. */
     readonly bytes: Uint8Array;
 }
-export interface SignatureVerifyRequest {
-    readonly algorithm: SignatureAlgorithm;
-    readonly key: P256PublicKeyBytes;
+export type SignatureVerifyRequest = Readonly<{
     /** Exact original signing bytes; never a reserialized JWT representation. */
-    readonly data: Uint8Array;
-    /** Exactly 64 bytes: 32-byte big-endian r followed by 32-byte big-endian s. */
-    readonly signature: Uint8Array;
-}
+    data: Uint8Array;
+    /** JOSE P-256 r||s, or one RSA modulus-width octet string. */
+    signature: Uint8Array;
+}> & (Readonly<{
+    algorithm: 'ES256';
+    key: P256PublicKeyBytes;
+}> | Readonly<{
+    algorithm: 'RS256';
+    key: RsaPublicKeyBytes;
+}>);
 /**
  * Crypto-owned adapter input for the one JOSE representation accepted by the
  * JWT composition. JWT has already validated the public JWK policy; crypto
@@ -83,6 +86,9 @@ export declare const CRYPTO_RESOURCE_LIMITS: Readonly<{
     readonly es256PublicKeyBytes: 64;
     readonly es256SignatureBytes: 64;
     readonly es256SigningInputBytesMaximum: 16340;
+    readonly rs256ModulusBytes: readonly [256, 384, 512];
+    readonly rs256PublicExponentMaximum: 4294967295;
+    readonly rs256SigningInputBytesMaximum: 12288;
 }>;
 export declare const CRYPTO_ES256_CONTRACT: Readonly<{
     readonly version: "pulse.crypto.es256-verification.v1";
@@ -120,7 +126,7 @@ export declare const CRYPTO_ES256_CONTRACT: Readonly<{
         unitId: "pulse.crypto.es256.rustcrypto-p256.v1";
         module: "pulse_crypto_es256";
         owner: "@pulse-compute/crypto";
-        abi: "pulse.crypto.es256.verify.v1";
+        abi: "pulse.crypto.es256-rs256.verify-and-sign.v3";
         export: Readonly<{
             name: "pulse_crypto_es256_verify";
             parameters: readonly ["i32", "i32"];
@@ -195,4 +201,20 @@ export declare const CRYPTO_ES256_CONTRACT: Readonly<{
     }>;
     readonly automaticFallback: false;
 }>;
+export interface RsaPublicKeyBytes {
+    readonly type: 'rsa-public-key-bytes';
+    /** LE32 modulus byte length, big-endian modulus, four-byte public exponent. */
+    readonly bytes: Uint8Array;
+}
+export interface Rs256JoseVerifyInput {
+    readonly key: Readonly<{
+        n: string;
+        e: string;
+    }>;
+    readonly data: Uint8Array;
+    readonly signature: string;
+}
+export declare const CRYPTO_RS256_GUEST_LINKED_REALIZATION: "guest-linked:pulse-rs256-bearssl-i31";
+export declare const CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION: "bearssl.0.6.rsa-i31.sha256.v1";
+export declare const CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION: "webcrypto.subtle.rsassa-pkcs1-v1_5-sha-256.v1";
 //# sourceMappingURL=contracts.d.ts.map

package/dist/contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,EAAG,8BAAuC,CAAC;AAC/E,eAAO,MAAM,qCAAqC,EAChD,kCAA2C,CAAC;AAC9C,eAAO,MAAM,kCAAkC,EAC7C,kBAA2B,CAAC;AAC9B,eAAO,MAAM,6BAA6B,EACxC,oCAA6C,CAAC;AAChD,eAAO,MAAM,2CAA2C,EACtD,wCAAiD,CAAC;AACpD,eAAO,MAAM,qCAAqC,EAChD,0CAAmD,CAAC;AACtD,eAAO,MAAM,wCAAwC,EACnD,oDAA6D,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,6BAGnB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC;AACnC,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEzC,eAAO,MAAM,4BAA4B,oGAM9B,CAAC;AAEZ,MAAM,MAAM,wBAAwB,GAClC,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;AAE9C,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,sBAAsB;;;;;;;;EAQxB,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoHvB,CAAC"}
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,EAAG,8BAAuC,CAAC;AAC/E,eAAO,MAAM,qCAAqC,EAChD,kCAA2C,CAAC;AAC9C,eAAO,MAAM,kCAAkC,EAC7C,kBAA2B,CAAC;AAC9B,eAAO,MAAM,6BAA6B,EACxC,oCAA6C,CAAC;AAChD,eAAO,MAAM,2CAA2C,EACtD,wCAAiD,CAAC;AACpD,eAAO,MAAM,qCAAqC,EAChD,0CAAmD,CAAC;AACtD,eAAO,MAAM,wCAAwC,EACnD,oDAA6D,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,iBAAiB,sCAInB,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC;AACnC,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnD,eAAO,MAAM,4BAA4B,oGAM9B,CAAC;AAEZ,MAAM,MAAM,wBAAwB,GAClC,OAAO,4BAA4B,CAAC,MAAM,CAAC,CAAC;AAE9C,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAClC;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC5C,6EAA6E;IAC7E,IAAI,EAAE,UAAU,CAAC;IACjB,8DAA8D;IAC9D,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC,GAAG,CAAC,QAAQ,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,CAAC,GAC3D,QAAQ,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAAC,CAAC;AAE9D;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;EAWxB,CAAC;AAEZ,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoHvB,CAAC;AAEZ,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AACD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACD,eAAO,MAAM,qCAAqC,EAAG,sCAA+C,CAAC;AACrG,eAAO,MAAM,wCAAwC,EAAG,+BAAwC,CAAC;AACjG,eAAO,MAAM,2CAA2C,EAAG,+CAAwD,CAAC"}

package/dist/contracts.js

@@ -6,12 +6,12 @@ export const CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION = 'webcrypto.subtle.ecd
 export const CRYPTO_ES256_GUEST_LINKED_REALIZATION = 'guest-linked:pulse-es256-rustcrypto-p256';
 export const CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION = 'rustcrypto.p256-0.13.2.ecdsa-0.16.9.sha2-0.10.9.v1';
 /**
- * Executable algorithms remain intentionally narrower than frozen future
- * contracts. G3, not G0, owns activation of ES256.
+ * Executable verification algorithms. Signature keys remain algorithm-bound.
  */
 export const CRYPTO_ALGORITHMS = Object.freeze([
     'HS256',
     'ES256',
+    'RS256',
 ]);
 export const CRYPTO_VERIFICATION_STATUSES = Object.freeze([
     'valid',
@@ -28,6 +28,9 @@ export const CRYPTO_RESOURCE_LIMITS = Object.freeze({
     es256PublicKeyBytes: 64,
     es256SignatureBytes: 64,
     es256SigningInputBytesMaximum: 16_340,
+    rs256ModulusBytes: Object.freeze([256, 384, 512]),
+    rs256PublicExponentMaximum: 0xffffffff,
+    rs256SigningInputBytesMaximum: 12_288,
 });
 export const CRYPTO_ES256_CONTRACT = Object.freeze({
     version: CRYPTO_ES256_CONTRACT_VERSION,
@@ -71,7 +74,7 @@ export const CRYPTO_ES256_CONTRACT = Object.freeze({
         unitId: 'pulse.crypto.es256.rustcrypto-p256.v1',
         module: 'pulse_crypto_es256',
         owner: '@pulse-compute/crypto',
-        abi: 'pulse.crypto.es256.verify.v1',
+        abi: 'pulse.crypto.es256-rs256.verify-and-sign.v3',
         export: Object.freeze({
             name: 'pulse_crypto_es256_verify',
             parameters: Object.freeze(['i32', 'i32']),
@@ -146,4 +149,7 @@ export const CRYPTO_ES256_CONTRACT = Object.freeze({
     }),
     automaticFallback: false,
 });
+export const CRYPTO_RS256_GUEST_LINKED_REALIZATION = 'guest-linked:pulse-rs256-bearssl-i31';
+export const CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION = 'bearssl.0.6.rsa-i31.sha256.v1';
+export const CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION = 'webcrypto.subtle.rsassa-pkcs1-v1_5-sha-256.v1';
 //# sourceMappingURL=contracts.js.map

package/dist/contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAAuC,CAAC;AAC/E,MAAM,CAAC,MAAM,qCAAqC,GAChD,kCAA2C,CAAC;AAC9C,MAAM,CAAC,MAAM,kCAAkC,GAC7C,kBAA2B,CAAC;AAC9B,MAAM,CAAC,MAAM,6BAA6B,GACxC,oCAA6C,CAAC;AAChD,MAAM,CAAC,MAAM,2CAA2C,GACtD,wCAAiD,CAAC;AACpD,MAAM,CAAC,MAAM,qCAAqC,GAChD,0CAAmD,CAAC;AACtD,MAAM,CAAC,MAAM,wCAAwC,GACnD,oDAA6D,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,OAAO;IACP,OAAO;CACC,CAAC,CAAC;AAMZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,OAAO;IACP,uBAAuB;IACvB,aAAa;IACb,eAAe;IACf,qBAAqB;CACb,CAAC,CAAC;AAoEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,mBAAmB,EAAE,EAAE;IACvB,mBAAmB,EAAE,CAAC,GAAG,IAAI;IAC7B,mBAAmB,EAAE,IAAI,GAAG,IAAI;IAChC,aAAa,EAAE,EAAE;IACjB,mBAAmB,EAAE,EAAE;IACvB,mBAAmB,EAAE,EAAE;IACvB,6BAA6B,EAAE,MAAM;CAC7B,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,6BAA6B;IACtC,MAAM,EAAE,eAAe;IACvB,aAAa,EAAE,uBAAuB;IACtC,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,SAAS;KAChB,CAAC;IACF,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,QAAQ,EAAE,yBAAyB;QACnC,OAAO,EAAE,uBAAuB;QAChC,iBAAiB,EAAE,oBAAoB;QACvC,cAAc,EAAE,sBAAsB,CAAC,mBAAmB;QAC1D,gBAAgB,EAAE,sBAAsB,CAAC,6BAA6B;QACtE,iBAAiB,EAAE,qBAAqB;QACxC,cAAc,EAAE,sBAAsB,CAAC,mBAAmB;QAC1D,WAAW,EAAE,KAAK;KACnB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5B,WAAW,EAAE,iBAAiB;QAC9B,cAAc,EAAE,2CAA2C;QAC3D,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;YAC7B,iBAAiB;YACjB,mBAAmB;SACX,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,qCAAqC;QAClD,cAAc,EAAE,wCAAwC;QACxD,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;YAC7B,aAAa;YACb,eAAe;SACP,CAAC;KACZ,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,qBAAqB;QAClC,MAAM,EAAE,uCAAuC;QAC/C,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,GAAG,EAAE,8BAA8B;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,2BAA2B;YACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAU,CAAC;YAClD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAU,CAAC;SACzC,CAAC;QACF,MAAM,EAAE,kBAAkB;QAC1B,iCAAiC,EAAE,KAAK;QACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,wCAAwC;YAClD,MAAM,EAAE,YAAY;YACpB,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,KAAK,EAAE,WAAW;QAClB,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,wCAAwC;QAClD,SAAS,EAAE,eAAe;QAC1B,gBAAgB,EAAE,EAAE;QACpB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,EAAE;QAClB,wBAAwB,EAAE,MAAM;QAChC,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,EAAE;QAClB,sBAAsB,EAAE,MAAM;QAC9B,+BAA+B,EAAE,GAAG;QACpC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC;YAC9B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;SAClB,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,CAAC;YACf,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,EAAE;YACtB,kBAAkB,EAAE,EAAE;YACtB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd,CAAC;QACF,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,CAAC;QACR,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,KAAK;QACjB,8BAA8B,EAAE,IAAI;KACrC,CAAC;IACF,cAAc,EAAE,4BAA4B;IAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,CAAC;QACR,oBAAoB,EAAE,CAAC;QACvB,UAAU,EAAE,CAAC,CAAC;QACd,YAAY,EAAE,CAAC,CAAC;QAChB,kBAAkB,EAAE,CAAC,CAAC;KACvB,CAAC;IACF,iBAAiB,EAAE,KAAK;CAChB,CAAC,CAAC"}
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,8BAAuC,CAAC;AAC/E,MAAM,CAAC,MAAM,qCAAqC,GAChD,kCAA2C,CAAC;AAC9C,MAAM,CAAC,MAAM,kCAAkC,GAC7C,kBAA2B,CAAC;AAC9B,MAAM,CAAC,MAAM,6BAA6B,GACxC,oCAA6C,CAAC;AAChD,MAAM,CAAC,MAAM,2CAA2C,GACtD,wCAAiD,CAAC;AACpD,MAAM,CAAC,MAAM,qCAAqC,GAChD,0CAAmD,CAAC;AACtD,MAAM,CAAC,MAAM,wCAAwC,GACnD,oDAA6D,CAAC;AAEhE;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,OAAO;IACP,OAAO;IACP,OAAO;CACC,CAAC,CAAC;AAMZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,OAAO;IACP,uBAAuB;IACvB,aAAa;IACb,eAAe;IACf,qBAAqB;CACb,CAAC,CAAC;AAmEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,mBAAmB,EAAE,EAAE;IACvB,mBAAmB,EAAE,CAAC,GAAG,IAAI;IAC7B,mBAAmB,EAAE,IAAI,GAAG,IAAI;IAChC,aAAa,EAAE,EAAE;IACjB,mBAAmB,EAAE,EAAE;IACvB,mBAAmB,EAAE,EAAE;IACvB,6BAA6B,EAAE,MAAM;IACrC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;IAC1D,0BAA0B,EAAE,UAAU;IACtC,6BAA6B,EAAE,MAAM;CAC7B,CAAC,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,6BAA6B;IACtC,MAAM,EAAE,eAAe;IACvB,aAAa,EAAE,uBAAuB;IACtC,SAAS,EAAE,OAAO;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,SAAS;KAChB,CAAC;IACF,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,QAAQ,EAAE,yBAAyB;QACnC,OAAO,EAAE,uBAAuB;QAChC,iBAAiB,EAAE,oBAAoB;QACvC,cAAc,EAAE,sBAAsB,CAAC,mBAAmB;QAC1D,gBAAgB,EAAE,sBAAsB,CAAC,6BAA6B;QACtE,iBAAiB,EAAE,qBAAqB;QACxC,cAAc,EAAE,sBAAsB,CAAC,mBAAmB;QAC1D,WAAW,EAAE,KAAK;KACnB,CAAC;IACF,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC;QAC5B,WAAW,EAAE,iBAAiB;QAC9B,cAAc,EAAE,2CAA2C;QAC3D,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;YAC7B,iBAAiB;YACjB,mBAAmB;SACX,CAAC;KACZ,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,qCAAqC;QAClD,cAAc,EAAE,wCAAwC;QACxD,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC;YAC7B,aAAa;YACb,eAAe;SACP,CAAC;KACZ,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,qBAAqB;QAClC,MAAM,EAAE,uCAAuC;QAC/C,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,GAAG,EAAE,6CAA6C;QAClD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,2BAA2B;YACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAU,CAAC;YAClD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAU,CAAC;SACzC,CAAC;QACF,MAAM,EAAE,kBAAkB;QAC1B,iCAAiC,EAAE,KAAK;QACxC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,QAAQ,EAAE,wCAAwC;YAClD,MAAM,EAAE,YAAY;YACpB,YAAY,EAAE,EAAE;YAChB,YAAY,EAAE,EAAE;YAChB,QAAQ,EAAE,KAAK;SAChB,CAAC;QACF,KAAK,EAAE,WAAW;QAClB,aAAa,EAAE,KAAK;QACpB,SAAS,EAAE,KAAK;KACjB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,wCAAwC;QAClD,SAAS,EAAE,eAAe;QAC1B,gBAAgB,EAAE,EAAE;QACpB,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,EAAE;QAClB,wBAAwB,EAAE,MAAM;QAChC,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,EAAE;QAClB,sBAAsB,EAAE,MAAM;QAC9B,+BAA+B,EAAE,GAAG;QACpC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC;YAC9B,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,GAAG;YACd,YAAY,EAAE,GAAG;SAClB,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,CAAC;YACf,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,KAAK,EAAE,EAAE;YACT,kBAAkB,EAAE,EAAE;YACtB,kBAAkB,EAAE,EAAE;YACtB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,eAAe,EAAE,EAAE;YACnB,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd,CAAC;QACF,aAAa,EAAE,CAAC;QAChB,KAAK,EAAE,CAAC;QACR,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,UAAU,EAAE,KAAK;QACjB,8BAA8B,EAAE,IAAI;KACrC,CAAC;IACF,cAAc,EAAE,4BAA4B;IAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,KAAK,EAAE,CAAC;QACR,oBAAoB,EAAE,CAAC;QACvB,UAAU,EAAE,CAAC,CAAC;QACd,YAAY,EAAE,CAAC,CAAC;QAChB,kBAAkB,EAAE,CAAC,CAAC;KACvB,CAAC;IACF,iBAAiB,EAAE,KAAK;CAChB,CAAC,CAAC;AAYZ,MAAM,CAAC,MAAM,qCAAqC,GAAG,sCAA+C,CAAC;AACrG,MAAM,CAAC,MAAM,wCAAwC,GAAG,+BAAwC,CAAC;AACjG,MAAM,CAAC,MAAM,2CAA2C,GAAG,+CAAwD,CAAC"}

package/dist/index.d.ts

@@ -1,3 +1,6 @@
+export { normalizeRsaPublicKey, normalizeRs256JoseVerifyRequest } from './internal/rsa.js';
+export type { RsaPublicKeyBytes, Rs256JoseVerifyInput } from './contracts.js';
+export { CRYPTO_RS256_GUEST_LINKED_REALIZATION, CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION } from './contracts.js';
 import { CRYPTO_ALGORITHMS, CRYPTO_CONTRACT_VERSION, CRYPTO_ES256_CONTRACT, CRYPTO_ES256_CONTRACT_VERSION, CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_ES256_GUEST_LINKED_REALIZATION, CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_GUEST_SOURCE_IMPLEMENTATION, CRYPTO_RESOURCE_LIMITS, CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_VERIFICATION_STATUSES, type CryptoAlgorithm, type CryptoVerificationResult, type CryptoVerificationStatus, type Es256JoseVerifyInput, type HmacKeyBytes, type HmacVerificationKey, type MacAlgorithm, type MacVerifyRequest, type P256PublicKeyBytes, type P256PublicKeyCoordinates, type SignatureAlgorithm, type SignatureVerifyRequest } from './contracts.js';
 import { normalizeEs256JoseVerifyRequest, normalizeP256PublicKeyCoordinates } from './internal/verification.js';
 export { CRYPTO_ALGORITHMS, CRYPTO_CONTRACT_VERSION, CRYPTO_ES256_CONTRACT, CRYPTO_ES256_CONTRACT_VERSION, CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_ES256_GUEST_LINKED_REALIZATION, CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_GUEST_SOURCE_IMPLEMENTATION, CRYPTO_RESOURCE_LIMITS, CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_VERIFICATION_STATUSES, };

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,EAC5B,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,+BAA+B,EAE/B,iCAAiC,EAGlC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAC7B,CAAC;AACF,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,GACvB,CAAC;AAEF,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,CAAC;AAEF,wBAAsB,SAAS,CAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,wBAAwB,CAAC,CAcnC;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAenC;AAED,eAAO,MAAM,GAAG;;EAEd,CAAC;AAEH,eAAO,MAAM,SAAS;;EAEpB,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,eAAO,MAAM,MAAM;;;;;;;;EAIjB,CAAC;AAEH,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAC3F,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,qCAAqC,EAAE,wCAAwC,EAAE,2CAA2C,EAAE,MAAM,gBAAgB,CAAC;AAC9J,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,EAC5B,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,+BAA+B,EAE/B,iCAAiC,EAGlC,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAC7B,CAAC;AACF,YAAY,EACV,eAAe,EACf,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,GACvB,CAAC;AAEF,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,CAAC;AAEF,wBAAsB,SAAS,CAC7B,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,wBAAwB,CAAC,CAcnC;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAuBnC;AAED,eAAO,MAAM,GAAG;;EAEd,CAAC;AAEH,eAAO,MAAM,SAAS;;EAEpB,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,eAAO,MAAM,MAAM;;;;;;;;EAIjB,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist/index.js

@@ -1,3 +1,7 @@
+import { normalizeRs256Request, verifyRs256 } from './internal/rsa.js';
+import { ownDataProperty } from './internal/data.js';
+export { normalizeRsaPublicKey, normalizeRs256JoseVerifyRequest } from './internal/rsa.js';
+export { CRYPTO_RS256_GUEST_LINKED_REALIZATION, CRYPTO_RS256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION } from './contracts.js';
 import { CRYPTO_ALGORITHMS, CRYPTO_CONTRACT_VERSION, CRYPTO_ES256_CONTRACT, CRYPTO_ES256_CONTRACT_VERSION, CRYPTO_ES256_GUEST_LINKED_IMPLEMENTATION, CRYPTO_ES256_GUEST_LINKED_REALIZATION, CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_GUEST_SOURCE_IMPLEMENTATION, CRYPTO_RESOURCE_LIMITS, CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION, CRYPTO_VERIFICATION_STATUSES, } from './contracts.js';
 import { verifyEs256, verifyHs256 } from './internal/realization.js';
 import { normalizeEs256JoseVerifyRequest, normalizeMacVerifyRequest, normalizeP256PublicKeyCoordinates, normalizeSignatureVerifyRequest, normalizeVerificationResult, } from './internal/verification.js';
@@ -21,6 +25,19 @@ export async function verifyMac(request) {
     }
 }
 export async function verifySignature(request) {
+    let rsa = false;
+    try {
+        rsa = ownDataProperty(request, 'algorithm').value === 'RS256';
+    }
+    catch {
+        return normalizeVerificationResult({ status: 'invalid-input' });
+    }
+    if (rsa) {
+        const normalized = normalizeRs256Request(request);
+        if (!normalized.ok)
+            return normalized.result;
+        return normalizeVerificationResult(await verifyRs256(normalized.request));
+    }
     let normalized;
     try {
         normalized = normalizeSignatureVerifyRequest(request);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAa7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAC7B,CAAC;AAgBF,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAyB;IAEzB,IAAI,UAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,IAAI,UAA8D,CAAC;IACnE,IAAI,CAAC;QACH,UAAU,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAyB,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,UAAU;IACV,GAAG;IACH,SAAS;CACV,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AAE3F,OAAO,EAAE,qCAAqC,EAAE,wCAAwC,EAAE,2CAA2C,EAAE,MAAM,gBAAgB,CAAC;AAC9J,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAa7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,6BAA6B,EAC7B,wCAAwC,EACxC,qCAAqC,EACrC,2CAA2C,EAC3C,kCAAkC,EAClC,sBAAsB,EACtB,qCAAqC,EACrC,4BAA4B,GAC7B,CAAC;AAgBF,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,GAClC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAyB;IAEzB,IAAI,UAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC;IAAC,CAAC;IACtE,MAAM,CAAC;QAAC,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAAC,CAAC;IAC1E,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,MAAM,CAAC;QAC7C,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,UAA8D,CAAC;IACnE,IAAI,CAAC;QACH,UAAU,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,MAAM,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,eAAe;CACxB,CAAC,CAAC;AAEH,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAyB,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,UAAU;IACV,GAAG;IACH,SAAS;CACV,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist/internal/rsa.d.ts

@@ -0,0 +1,58 @@
+import type { CryptoVerificationResult, RsaPublicKeyBytes, Rs256JoseVerifyInput } from '../contracts.js';
+export declare const RSA_MODULUS_BYTES: readonly number[];
+export declare const RSA_DATA_BYTES_MAXIMUM: 12288;
+export declare function encodeRsaInteger(bytes: Uint8Array): string;
+export declare function decodeRsaInteger(value: unknown, maximum: number): Uint8Array<ArrayBuffer>;
+/** Normalized wire, independent of JWK policy: LE32(k), n[k], e[4], then
+ * d[k], p/q/dp/dq/qi[k/2] when private. Metadata is owned by JWT. */
+export declare function rsaKeyBytes(components: Readonly<Record<string, unknown>>, privateKey?: boolean): Uint8Array<ArrayBuffer>;
+export declare function rsaWireJwk(bytes: Uint8Array, privateKey?: boolean): Record<string, string>;
+export declare function normalizeRsaPublicKey(value: Readonly<{
+    n: string;
+    e: string;
+}>): {
+    ok: false;
+    result: CryptoVerificationResult;
+} | {
+    ok: true;
+    key: {
+        type: "rsa-public-key-bytes";
+        bytes: Uint8Array<ArrayBuffer>;
+    };
+};
+export declare function normalizeRs256Request(value: unknown): {
+    ok: false;
+    result: CryptoVerificationResult;
+} | {
+    ok: true;
+    request: {
+        algorithm: "RS256";
+        key: {
+            type: "rsa-public-key-bytes";
+            bytes: Uint8Array<ArrayBuffer>;
+        };
+        data: Uint8Array<ArrayBuffer>;
+        signature: Uint8Array<ArrayBuffer>;
+    };
+};
+export declare function normalizeRs256JoseVerifyRequest(value: Rs256JoseVerifyInput): {
+    ok: false;
+    result: CryptoVerificationResult;
+} | {
+    ok: true;
+    request: {
+        algorithm: "RS256";
+        key: {
+            type: "rsa-public-key-bytes";
+            bytes: Uint8Array<ArrayBuffer>;
+        };
+        data: Uint8Array<ArrayBuffer>;
+        signature: Uint8Array<ArrayBuffer>;
+    };
+};
+export declare function verifyRs256(request: {
+    key: RsaPublicKeyBytes;
+    data: Uint8Array<ArrayBuffer>;
+    signature: Uint8Array<ArrayBuffer>;
+}): Promise<CryptoVerificationResult>;
+//# sourceMappingURL=rsa.d.ts.map

package/dist/internal/rsa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsa.d.ts","sourceRoot":"","sources":["../../src/internal/rsa.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAGzG,eAAO,MAAM,iBAAiB,EAA+C,SAAS,MAAM,EAAE,CAAC;AAC/F,eAAO,MAAM,sBAAsB,OAAuD,CAAC;AAG3F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAM1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CASzF;AAED;qEACqE;AACrE,wBAAgB,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,UAAU,UAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAwBtH;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,UAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxF;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;;YAjEwB,wBAAwB;;;;;;;EAuE9H;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO;;YAzEmD,wBAAwB;;;;;;;;;;;;EA4F9H;AAED,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,oBAAoB;;YA9F4B,wBAAwB;;;;;;;;;;;;EA2G9H;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE;IAAE,GAAG,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAa3K"}

package/dist/internal/rsa.js

@@ -0,0 +1,185 @@
+import { CRYPTO_RESOURCE_LIMITS } from '../contracts.js';
+import { exactDataProperties, isOrdinaryObject, ownDataProperty, copyBytes } from './data.js';
+export const RSA_MODULUS_BYTES = CRYPTO_RESOURCE_LIMITS.rs256ModulusBytes;
+export const RSA_DATA_BYTES_MAXIMUM = CRYPTO_RESOURCE_LIMITS.rs256SigningInputBytesMaximum;
+const fail = (status) => ({ ok: false, result: { status } });
+export function encodeRsaInteger(bytes) {
+    let start = 0;
+    while (start + 1 < bytes.length && bytes[start] === 0)
+        start++;
+    let binary = '';
+    for (const byte of bytes.subarray(start))
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export function decodeRsaInteger(value, maximum) {
+    if (typeof value !== 'string' || value.length > Math.ceil(maximum * 4 / 3)
+        || !/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)
+        throw new TypeError('Invalid RSA integer.');
+    const bytes = Uint8Array.from(atob(value.replace(/-/g, '+').replace(/_/g, '/')
+        + '='.repeat((4 - value.length % 4) % 4)), char => char.charCodeAt(0));
+    if (!bytes.length || bytes.length > maximum || bytes[0] === 0 || encodeRsaInteger(bytes) !== value) {
+        bytes.fill(0);
+        throw new TypeError('Invalid RSA integer.');
+    }
+    return bytes;
+}
+/** Normalized wire, independent of JWK policy: LE32(k), n[k], e[4], then
+ * d[k], p/q/dp/dq/qi[k/2] when private. Metadata is owned by JWT. */
+export function rsaKeyBytes(components, privateKey = false) {
+    const decoded = [];
+    let output;
+    try {
+        const n = decodeRsaInteger(components.n, 512);
+        decoded.push(n);
+        const k = n.length;
+        if (!RSA_MODULUS_BYTES.includes(k) || n[0] < 128 || !(n[k - 1] & 1))
+            throw new TypeError();
+        const e = decodeRsaInteger(components.e, 4);
+        decoded.push(e);
+        let exponent = 0;
+        for (const byte of e)
+            exponent = exponent * 256 + byte;
+        if (exponent < 3 || exponent % 2 !== 1)
+            throw new TypeError();
+        output = new Uint8Array(privateKey ? 8 + k * 9 / 2 : 8 + k);
+        new DataView(output.buffer).setUint32(0, k, true);
+        output.set(n, 4);
+        output.set(e, 8 + k - e.length);
+        let offset = 8 + k;
+        if (privateKey)
+            for (const name of ['d', 'p', 'q', 'dp', 'dq', 'qi']) {
+                const width = name === 'd' ? k : k / 2;
+                const bytes = decodeRsaInteger(components[name], width);
+                decoded.push(bytes);
+                if ((name === 'p' || name === 'q') && (bytes.length !== width || bytes[0] < 128 || !(bytes[width - 1] & 1)))
+                    throw new TypeError();
+                output.set(bytes, offset + width - bytes.length);
+                offset += width;
+            }
+        return output;
+    }
+    catch {
+        output?.fill(0);
+        throw new TypeError('Invalid RSA key components.');
+    }
+    finally {
+        for (const bytes of decoded)
+            bytes.fill(0);
+    }
+}
+export function rsaWireJwk(bytes, privateKey = false) {
+    if (!(bytes instanceof Uint8Array) || bytes.length < 8)
+        throw new TypeError('Invalid RSA key.');
+    const k = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0, true);
+    if (!RSA_MODULUS_BYTES.includes(k) || bytes.length !== (privateKey ? 8 + k * 9 / 2 : 8 + k)
+        || bytes[4] < 128 || !(bytes[k + 3] & 1))
+        throw new TypeError('Invalid RSA key.');
+    const exponent = new DataView(bytes.buffer, bytes.byteOffset + 4 + k, 4).getUint32(0);
+    if (exponent < 3 || exponent % 2 !== 1)
+        throw new TypeError('Invalid RSA exponent.');
+    const jwk = { kty: 'RSA', n: encodeRsaInteger(bytes.subarray(4, 4 + k)), e: encodeRsaInteger(bytes.subarray(4 + k, 8 + k)) };
+    let offset = 8 + k;
+    if (privateKey)
+        for (const name of ['d', 'p', 'q', 'dp', 'dq', 'qi']) {
+            const width = name === 'd' ? k : k / 2;
+            jwk[name] = encodeRsaInteger(bytes.subarray(offset, offset + width));
+            offset += width;
+        }
+    return jwk;
+}
+export function normalizeRsaPublicKey(value) {
+    try {
+        if (!isOrdinaryObject(value) || !exactDataProperties(value, new Set(['n', 'e'])))
+            return fail('invalid-key');
+        const bytes = rsaKeyBytes({ n: ownDataProperty(value, 'n').value, e: ownDataProperty(value, 'e').value });
+        return { ok: true, key: { type: 'rsa-public-key-bytes', bytes } };
+    }
+    catch {
+        return fail('invalid-key');
+    }
+}
+export function normalizeRs256Request(value) {
+    try {
+        if (!isOrdinaryObject(value) || !exactDataProperties(value, new Set(['algorithm', 'key', 'data', 'signature']))
+            || ownDataProperty(value, 'algorithm').value !== 'RS256')
+            return fail('invalid-input');
+        const key = ownDataProperty(value, 'key').value;
+        if (!isOrdinaryObject(key) || !exactDataProperties(key, new Set(['type', 'bytes']))
+            || ownDataProperty(key, 'type').value !== 'rsa-public-key-bytes')
+            return fail('invalid-key');
+        const inputKey = ownDataProperty(key, 'bytes').value;
+        if (!(inputKey instanceof Uint8Array) || inputKey.length > 520)
+            return fail('invalid-key');
+        const bytes = copyBytes(inputKey);
+        if (!bytes || bytes.length > 520)
+            return fail('invalid-key');
+        try {
+            rsaWireJwk(bytes);
+        }
+        catch {
+            return fail('invalid-key');
+        }
+        const inputData = ownDataProperty(value, 'data').value, inputSignature = ownDataProperty(value, 'signature').value;
+        if (!(inputData instanceof Uint8Array) || inputData.length > RSA_DATA_BYTES_MAXIMUM
+            || !(inputSignature instanceof Uint8Array) || inputSignature.length !== bytes.length - 8)
+            return fail('invalid-input');
+        const data = copyBytes(inputData), signature = copyBytes(inputSignature);
+        if (!data || data.length > RSA_DATA_BYTES_MAXIMUM || !signature || signature.length !== bytes.length - 8)
+            return fail('invalid-input');
+        return { ok: true, request: { algorithm: 'RS256', key: { type: 'rsa-public-key-bytes', bytes }, data, signature } };
+    }
+    catch {
+        return fail('invalid-input');
+    }
+}
+export function normalizeRs256JoseVerifyRequest(value) {
+    try {
+        if (!isOrdinaryObject(value) || !exactDataProperties(value, new Set(['key', 'data', 'signature'])))
+            return fail('invalid-input');
+        const key = normalizeRsaPublicKey(ownDataProperty(value, 'key').value);
+        if (!key.ok)
+            return key;
+        const text = ownDataProperty(value, 'signature').value;
+        if (typeof text !== 'string' || text.length > 683 || !/^[A-Za-z0-9_-]+$/.test(text) || text.length % 4 === 1)
+            return fail('invalid-input');
+        // Signatures are fixed-width octet strings; leading zero bytes are valid.
+        const binary = atob(text.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - text.length % 4) % 4));
+        if (btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '') !== text)
+            return fail('invalid-input');
+        return normalizeRs256Request({ algorithm: 'RS256', key: key.key, data: ownDataProperty(value, 'data').value,
+            signature: Uint8Array.from(binary, char => char.charCodeAt(0)) });
+    }
+    catch {
+        return fail('invalid-input');
+    }
+}
+export async function verifyRs256(request) {
+    let subtle;
+    try {
+        subtle = globalThis.crypto?.subtle;
+    }
+    catch {
+        return { status: 'realization-failure' };
+    }
+    if (!subtle)
+        return { status: 'realization-failure' };
+    let key;
+    try {
+        key = await subtle.importKey('jwk', rsaWireJwk(request.key.bytes), { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['verify']);
+    }
+    catch {
+        return { status: 'invalid-key' };
+    }
+    finally {
+        request.key.bytes.fill(0);
+    }
+    try {
+        const valid = await subtle.verify('RSASSA-PKCS1-v1_5', key, request.signature, request.data);
+        return { status: valid === true ? 'valid' : valid === false ? 'invalid-authenticator' : 'realization-failure' };
+    }
+    catch {
+        return { status: 'realization-failure' };
+    }
+}
+//# sourceMappingURL=rsa.js.map

package/dist/internal/rsa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsa.js","sourceRoot":"","sources":["../../src/internal/rsa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE9F,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,iBAAsC,CAAC;AAC/F,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,6BAA6B,CAAC;AAC3F,MAAM,IAAI,GAAG,CAAC,MAAuC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,EAAE,MAAM,EAA8B,EAAE,CAAC,CAAC;AAEnI,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,CAAC;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,OAAe;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;WACrE,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC5G,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;UAC1E,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACnG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,WAAW,CAAC,UAA6C,EAAE,UAAU,GAAG,KAAK;IAC3F,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAC3F,MAAM,CAAC,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,QAAQ,GAAG,CAAC,CAAC;QAAC,KAAK,MAAM,IAAI,IAAI,CAAC;YAAE,QAAQ,GAAG,QAAQ,GAAG,GAAG,GAAG,IAAI,CAAC;QACzE,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,EAAE,CAAC;QAC9D,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,UAAU;YAAE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7E,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,SAAS,EAAE,CAAC;gBACnI,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC;YACpE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACtE,CAAC;YAAS,CAAC;QAAC,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB,EAAE,UAAU,GAAG,KAAK;IAC9D,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAChG,MAAM,CAAC,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5F,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;WACtF,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtF,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACrF,MAAM,GAAG,GAA2B,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrJ,IAAI,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU;QAAE,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACvC,GAAG,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC;QACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAyC;IAC7E,IAAI,CAAC;QACH,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7G,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1G,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,sBAA+B,EAAE,KAAK,EAAE,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;IAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC;QACH,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;eAC1G,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QACzF,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC;QAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;eAC9E,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,sBAAsB;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC;QACrD,IAAI,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7D,IAAI,CAAC;YAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;QAChE,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,cAAc,GAAG,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC;QACnH,IAAI,CAAC,CAAC,SAAS,YAAY,UAAU,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,sBAAsB;eAC9E,CAAC,CAAC,cAAc,YAAY,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QACzH,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,sBAAsB,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QACvI,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,OAAgB,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,sBAA+B,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IACjJ,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAA2B;IACzE,IAAI,CAAC;QACH,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QACjI,MAAM,GAAG,GAAG,qBAAqB,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAiC,CAAC,CAAC;QACnG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC;QACxB,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC;QACvD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3I,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QACnH,OAAO,qBAAqB,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK;YACzG,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsG;IACtI,IAAI,MAAgC,CAAC;IACrC,IAAI,CAAC;QAAC,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAAC,CAAC;IAC/F,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QAAC,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAAC,CAAC;IAC9I,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,CAAC;YACnC,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC;IAClH,CAAC;IACD,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAAC,CAAC;AACrD,CAAC"}

package/dist/internal/verification.d.ts

@@ -55,10 +55,10 @@ export declare function redactMacVerifyRequest(request: MacVerifyRequest | Norma
     tag: '[redacted]';
 }>;
 export declare function redactSignatureVerifyRequest(request: SignatureVerifyRequest | NormalizedSignatureVerifyRequest): Readonly<{
-    algorithm: 'ES256';
+    algorithm: 'ES256' | 'RS256';
     key: Readonly<{
-        type: 'p256-public-key-bytes';
-        compatibleAlgorithms: readonly ['ES256'];
+        type: 'p256-public-key-bytes' | 'rsa-public-key-bytes';
+        compatibleAlgorithms: readonly ('ES256' | 'RS256')[];
         identity: '[redacted]';
     }>;
     data: '[redacted]';

package/dist/internal/verification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/internal/verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AA6BzB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAChC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;KACzC,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;CAC9C,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C,CAAC;AAEN,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;QACvC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;KACzC,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CAC7C;AAED,MAAM,MAAM,mCAAmC,GAC3C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,gCAAgC,CAAC;CACpD,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C,CAAC;AAEN,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,GAAG,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC;CACvD,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C,CAAC;AAEN,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,wBAAwB,GAC/B,wBAAwB,CAE1B;AAmFD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,GACb,6BAA6B,CAgD/B;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,mCAAmC,CA6CrC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,oBAAoB,GAC1B,mCAAmC,CAqCrC;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,wBAAwB,GAC9B,0BAA0B,CAmC5B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,wBAAwB,CAY1B;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,gBAAgB,GAAG,0BAA0B,GACrD,QAAQ,CAAC;IACV,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,QAAQ,CAAC;QACZ,IAAI,EAAE,gBAAgB,CAAC;QACvB,oBAAoB,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,QAAQ,EAAE,YAAY,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,YAAY,CAAC;CACnB,CAAC,CAWD;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,sBAAsB,GAAG,gCAAgC,GACjE,QAAQ,CAAC;IACV,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,QAAQ,CAAC;QACZ,IAAI,EAAE,uBAAuB,CAAC;QAC9B,oBAAoB,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,QAAQ,EAAE,YAAY,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,YAAY,CAAC;CACzB,CAAC,CAWD"}
+{"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/internal/verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AA6BzB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAChC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;KACzC,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CACvC;AAED,MAAM,MAAM,6BAA6B,GACrC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,0BAA0B,CAAC;CAC9C,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C,CAAC;AAEN,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;QACvC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;KACzC,CAAC;IACF,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;CAC7C;AAED,MAAM,MAAM,mCAAmC,GAC3C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,gCAAgC,CAAC;CACpD,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C,CAAC;AAEN,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,GAAG,EAAE,gCAAgC,CAAC,KAAK,CAAC,CAAC;CACvD,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C,CAAC;AAEN,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,wBAAwB,GAC/B,wBAAwB,CAE1B;AAmFD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,GACb,6BAA6B,CAgD/B;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,mCAAmC,CA6CrC;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,oBAAoB,GAC1B,mCAAmC,CAqCrC;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,wBAAwB,GAC9B,0BAA0B,CAmC5B;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,wBAAwB,CAY1B;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,gBAAgB,GAAG,0BAA0B,GACrD,QAAQ,CAAC;IACV,SAAS,EAAE,OAAO,CAAC;IACnB,GAAG,EAAE,QAAQ,CAAC;QACZ,IAAI,EAAE,gBAAgB,CAAC;QACvB,oBAAoB,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,QAAQ,EAAE,YAAY,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,YAAY,CAAC;CACnB,CAAC,CAWD;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,sBAAsB,GAAG,gCAAgC,GACjE,QAAQ,CAAC;IACV,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC;IAC7B,GAAG,EAAE,QAAQ,CAAC;QACZ,IAAI,EAAE,uBAAuB,GAAG,sBAAsB,CAAC;QACvD,oBAAoB,EAAE,SAAS,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;QACrD,QAAQ,EAAE,YAAY,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,YAAY,CAAC;CACzB,CAAC,CAWD"}

package/dist/internal/verification.js

@@ -262,8 +262,8 @@ export function redactSignatureVerifyRequest(request) {
     return Object.freeze({
         algorithm: request.algorithm,
         key: Object.freeze({
-            type: 'p256-public-key-bytes',
-            compatibleAlgorithms: Object.freeze(['ES256']),
+            type: request.key.type,
+            compatibleAlgorithms: Object.freeze([request.algorithm]),
             identity: '[redacted]',
         }),
         data: '[redacted]',