@pulse-compute/jwt 0.0.0 → 1.0.0-beta.1

package/dist/token.js

@@ -0,0 +1,323 @@
+import { jwtError } from './errors.js';
+import { isJwtOrdinaryObject, jwtDataEntries, jwtDenseArrayValues, jwtOwnDataProperty, } from './internal/data.js';
+const MAX_TOKEN_BYTES = 16 * 1024;
+const MAX_HEADER_BYTES = 4 * 1024;
+const MAX_CLAIMS_BYTES = 16 * 1024;
+const MAX_JSON_DEPTH = 32;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+function utf8Bytes(value) {
+    return new TextEncoder().encode(value).byteLength;
+}
+function decodeBase64url(segment, category) {
+    if (!canonicalBase64url(segment)) {
+        throw jwtError('PULSE_JWT_MALFORMED', { category });
+    }
+    const padded = segment.replace(/-/g, '+').replace(/_/g, '/')
+        + '='.repeat((4 - segment.length % 4) % 4);
+    let binary;
+    try {
+        binary = atob(padded);
+    }
+    catch {
+        throw jwtError('PULSE_JWT_MALFORMED', { category });
+    }
+    const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    let canonical = '';
+    for (const byte of bytes)
+        canonical += String.fromCharCode(byte);
+    canonical = btoa(canonical).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/u, '');
+    if (canonical !== segment)
+        throw jwtError('PULSE_JWT_MALFORMED', { category });
+    return bytes;
+}
+function canonicalBase64url(segment) {
+    if (!segment
+        || !BASE64URL.test(segment)
+        || segment.includes('=')
+        || segment.length % 4 === 1)
+        return false;
+    const remainder = segment.length % 4;
+    if (remainder === 0)
+        return true;
+    const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+    const last = alphabet.indexOf(segment[segment.length - 1]);
+    return last >= 0
+        && (remainder === 2 ? (last & 15) === 0 : (last & 3) === 0);
+}
+function decodeUtf8(bytes, category) {
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw jwtError('PULSE_JWT_MALFORMED', { category });
+    }
+}
+class JsonShapeParser {
+    #text;
+    #index = 0;
+    constructor(text) {
+        this.#text = text;
+    }
+    parse() {
+        this.#value(0);
+        this.#space();
+        if (this.#index !== this.#text.length)
+            this.#fail();
+    }
+    #fail() {
+        throw jwtError('PULSE_JWT_MALFORMED', { category: 'json' });
+    }
+    #space() {
+        while (this.#index < this.#text.length && /[\t\n\r ]/.test(this.#text[this.#index]))
+            this.#index += 1;
+    }
+    #value(depth) {
+        if (depth > MAX_JSON_DEPTH) {
+            throw jwtError('PULSE_JWT_LIMIT_EXCEEDED', {
+                category: 'json-depth',
+                limit: MAX_JSON_DEPTH,
+                actual: depth,
+            });
+        }
+        this.#space();
+        const character = this.#text[this.#index];
+        if (character === '{')
+            return this.#object(depth);
+        if (character === '[')
+            return this.#array(depth);
+        if (character === '"') {
+            this.#string();
+            return;
+        }
+        const rest = this.#text.slice(this.#index);
+        const number = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(rest);
+        if (number) {
+            this.#index += number[0].length;
+            return;
+        }
+        for (const literal of ['true', 'false', 'null']) {
+            if (rest.startsWith(literal)) {
+                this.#index += literal.length;
+                return;
+            }
+        }
+        this.#fail();
+    }
+    #string() {
+        const start = this.#index;
+        this.#index += 1;
+        while (this.#index < this.#text.length) {
+            const character = this.#text[this.#index];
+            if (character === '"') {
+                this.#index += 1;
+                try {
+                    return JSON.parse(this.#text.slice(start, this.#index));
+                }
+                catch {
+                    this.#fail();
+                }
+            }
+            if (character === '\\') {
+                this.#index += 1;
+                const escaped = this.#text[this.#index];
+                if (escaped === 'u') {
+                    if (!/^[0-9A-Fa-f]{4}$/.test(this.#text.slice(this.#index + 1, this.#index + 5)))
+                        this.#fail();
+                    this.#index += 5;
+                    continue;
+                }
+                if (!'"\\/bfnrt'.includes(escaped || ''))
+                    this.#fail();
+                this.#index += 1;
+                continue;
+            }
+            if (character === undefined || character.charCodeAt(0) < 0x20)
+                this.#fail();
+            this.#index += 1;
+        }
+        this.#fail();
+    }
+    #object(depth) {
+        this.#index += 1;
+        this.#space();
+        const names = new Set();
+        if (this.#text[this.#index] === '}') {
+            this.#index += 1;
+            return;
+        }
+        while (this.#index < this.#text.length) {
+            this.#space();
+            if (this.#text[this.#index] !== '"')
+                this.#fail();
+            const name = this.#string();
+            if (names.has(name))
+                throw jwtError('PULSE_JWT_MALFORMED', { category: 'duplicate-json-member' });
+            names.add(name);
+            this.#space();
+            if (this.#text[this.#index] !== ':')
+                this.#fail();
+            this.#index += 1;
+            this.#value(depth + 1);
+            this.#space();
+            const delimiter = this.#text[this.#index];
+            this.#index += 1;
+            if (delimiter === '}')
+                return;
+            if (delimiter !== ',')
+                this.#fail();
+        }
+        this.#fail();
+    }
+    #array(depth) {
+        this.#index += 1;
+        this.#space();
+        if (this.#text[this.#index] === ']') {
+            this.#index += 1;
+            return;
+        }
+        while (this.#index < this.#text.length) {
+            this.#value(depth + 1);
+            this.#space();
+            const delimiter = this.#text[this.#index];
+            this.#index += 1;
+            if (delimiter === ']')
+                return;
+            if (delimiter !== ',')
+                this.#fail();
+        }
+        this.#fail();
+    }
+}
+function parseObject(text, category) {
+    try {
+        new JsonShapeParser(text).parse();
+        const value = JSON.parse(text);
+        if (!isJwtOrdinaryObject(value)) {
+            throw jwtError('PULSE_JWT_MALFORMED', { category });
+        }
+        validateJsonValue(value, category, 0);
+        return value;
+    }
+    catch (error) {
+        if (error && typeof error === 'object' && 'code' in error)
+            throw error;
+        throw jwtError('PULSE_JWT_MALFORMED', { category });
+    }
+}
+function validateJsonValue(value, category, depth) {
+    if (depth > MAX_JSON_DEPTH) {
+        throw jwtError('PULSE_JWT_LIMIT_EXCEEDED', {
+            category: 'json-depth',
+            limit: MAX_JSON_DEPTH,
+            actual: depth,
+        });
+    }
+    if (value === null
+        || typeof value === 'string'
+        || typeof value === 'boolean')
+        return;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw jwtError('PULSE_JWT_MALFORMED', { category });
+        return;
+    }
+    const children = Array.isArray(value)
+        ? jwtDenseArrayValues(value)
+        : isJwtOrdinaryObject(value)
+            ? jwtDataEntries(value)?.map((entry) => entry[1])
+            : undefined;
+    if (!children)
+        throw jwtError('PULSE_JWT_MALFORMED', { category });
+    for (const child of children)
+        validateJsonValue(child, category, depth + 1);
+}
+export function preflightCompactJwt(token) {
+    if (token === undefined || token === '')
+        throw jwtError('PULSE_JWT_TOKEN_REQUIRED');
+    if (typeof token !== 'string')
+        throw jwtError('PULSE_JWT_MALFORMED', { category: 'compact-token' });
+    const tokenBytes = utf8Bytes(token);
+    if (tokenBytes > MAX_TOKEN_BYTES) {
+        throw jwtError('PULSE_JWT_LIMIT_EXCEEDED', {
+            category: 'compact-token',
+            limit: MAX_TOKEN_BYTES,
+            actual: tokenBytes,
+        });
+    }
+    const segments = token.split('.');
+    if (segments.length !== 3 || segments.some((segment) => !segment || !BASE64URL.test(segment))) {
+        throw jwtError('PULSE_JWT_MALFORMED', { category: 'compact-token' });
+    }
+    const headerBytes = decodeBase64url(segments[0], 'protected-header');
+    if (headerBytes.byteLength > MAX_HEADER_BYTES) {
+        throw jwtError('PULSE_JWT_LIMIT_EXCEEDED', {
+            category: 'protected-header',
+            limit: MAX_HEADER_BYTES,
+            actual: headerBytes.byteLength,
+        });
+    }
+    const claimsBytes = decodeBase64url(segments[1], 'claims');
+    if (claimsBytes.byteLength > MAX_CLAIMS_BYTES) {
+        throw jwtError('PULSE_JWT_LIMIT_EXCEEDED', {
+            category: 'claims',
+            limit: MAX_CLAIMS_BYTES,
+            actual: claimsBytes.byteLength,
+        });
+    }
+    if (!canonicalBase64url(segments[2])) {
+        throw jwtError('PULSE_JWT_MALFORMED', { category: 'signature' });
+    }
+    const protectedHeader = parseObject(decodeUtf8(headerBytes, 'protected-header'), 'protected-header');
+    const claimsText = decodeUtf8(claimsBytes, 'claims');
+    return Object.freeze({ protectedHeader, claimsText });
+}
+export function protectedAlgorithm(header) {
+    for (const name of ['crit', 'b64']) {
+        const unsupported = jwtOwnDataProperty(header, name);
+        if (!unsupported.valid) {
+            throw jwtError('PULSE_JWT_MALFORMED', { category: 'protected-header' });
+        }
+        if (unsupported.present) {
+            throw jwtError('PULSE_JWT_MALFORMED', { category: 'protected-extension' });
+        }
+    }
+    const property = jwtOwnDataProperty(header, 'alg');
+    const algorithm = property.valid && property.present ? property.value : undefined;
+    if (typeof algorithm !== 'string') {
+        throw jwtError('PULSE_JWT_ALGORITHM_NOT_ALLOWED', { category: 'protected-algorithm' });
+    }
+    return algorithm;
+}
+export function protectedHeaderString(header, name) {
+    const property = jwtOwnDataProperty(header, name);
+    if (!property.valid) {
+        throw jwtError('PULSE_JWT_MALFORMED', { category: `protected-${name}` });
+    }
+    if (!property.present || property.value === undefined)
+        return undefined;
+    if (typeof property.value !== 'string') {
+        throw jwtError('PULSE_JWT_MALFORMED', { category: `protected-${name}` });
+    }
+    return property.value;
+}
+export function parseVerifiedClaims(preflight) {
+    return parseObject(preflight.claimsText, 'claims');
+}
+export function compactJwtSignatureInput(token) {
+    const compact = compactJwtParts(token);
+    return Object.freeze({
+        signingInput: compact.signingInput,
+        signature: decodeBase64url(compact.signatureSegment, 'signature'),
+    });
+}
+export function compactJwtParts(token) {
+    const segments = token.split('.');
+    if (segments.length !== 3) {
+        throw jwtError('PULSE_JWT_MALFORMED', { category: 'compact-token' });
+    }
+    return Object.freeze({
+        signingInput: new TextEncoder().encode(`${segments[0]}.${segments[1]}`),
+        signatureSegment: segments[2],
+    });
+}
+//# sourceMappingURL=token.js.map

package/dist/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC;AAClC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAiBrC,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CACtB,OAAe,EACf,QAAqD;IAErD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;UACxD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,SAAS,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjE,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,IAAI,SAAS,KAAK,OAAO;QAAE,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,IACE,CAAC,OAAO;WACL,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;WACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;WACrB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,QAAQ,GAAG,kEAAkE,CAAC;IACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,IAAI,IAAI,CAAC;WACX,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB,EAAE,QAAuC;IAC5E,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,MAAM,eAAe;IACV,KAAK,CAAS;IACvB,MAAM,GAAG,CAAC,CAAC;IAEX,YAAY,IAAY;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;IAED,KAAK;QACH,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAAE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;YAC3B,MAAM,QAAQ,CAAC,0BAA0B,EAAE;gBACzC,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,cAAc;gBACrB,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,SAAS,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChC,OAAO;QACT,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;gBAC9B,OAAO;YACT,CAAC;QACH,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,OAAO;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;gBACjB,IAAI,CAAC;oBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAW,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;YACD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;gBACjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACxC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;oBACpB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;wBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC/F,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;oBACjB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;oBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC5E,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAClG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAClD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO;YAC9B,IAAI,SAAS,KAAK,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QACjB,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;YACjB,IAAI,SAAS,KAAK,GAAG;gBAAE,OAAO;YAC9B,IAAI,SAAS,KAAK,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;CACF;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,QAAuC;IAEvC,IAAI,CAAC;QACH,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACtC,OAAO,KAA+C,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK;YAAE,MAAM,KAAK,CAAC;QACvE,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,QAAuC,EACvC,KAAa;IAEb,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;QAC3B,MAAM,QAAQ,CAAC,0BAA0B,EAAE;YACzC,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IACD,IACE,KAAK,KAAK,IAAI;WACX,OAAO,KAAK,KAAK,QAAQ;WACzB,OAAO,KAAK,KAAK,SAAS;QAC7B,OAAO;IACT,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAC5B,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC1B,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,QAAQ;QAAE,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,QAAQ;QAAE,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;QAAE,MAAM,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IACpF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IACpG,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,0BAA0B,EAAE;YACzC,QAAQ,EAAE,eAAe;YACzB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACrE,IAAI,WAAW,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAC9C,MAAM,QAAQ,CAAC,0BAA0B,EAAE;YACzC,QAAQ,EAAE,kBAAkB;YAC5B,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,WAAW,CAAC,UAAU;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,WAAW,CAAC,UAAU,GAAG,gBAAgB,EAAE,CAAC;QAC9C,MAAM,QAAQ,CAAC,0BAA0B,EAAE;YACzC,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,WAAW,CAAC,UAAU;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,eAAe,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,EAAE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA8C;IAC/E,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAA8C,EAC9C,IAAmB;IAEnB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAuB;IACzD,OAAO,WAAW,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAc,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE,WAAW,CAAC;KAClE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,16 +1,74 @@
 {
   "name": "@pulse-compute/jwt",
-  "version": "0.0.0",
-  "description": "Inert bootstrap placeholder for @pulse-compute/jwt.",
+  "version": "1.0.0-beta.1",
   "license": "Apache-2.0",
+  "engines": {
+    "node": "^22.14.0 || ^24.0.0"
+  },
+  "description": "Provider-neutral JWT verification for Pulse handlers.",
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./provider": {
+      "types": "./dist/provider.d.ts",
+      "import": "./dist/provider.js",
+      "default": "./dist/provider.js"
+    },
+    "./pulsewasm/manifest": {
+      "require": "./pulsewasm.manifest.cjs",
+      "default": "./pulsewasm.manifest.cjs"
+    },
+    "./pulsewasm/compiler": {
+      "require": "./pulsewasm.compiler.cjs",
+      "default": "./pulsewasm.compiler.cjs"
+    },
+    "./pulsewasm-native": "./pulsewasm.native.cjs"
+  },
   "files": [
+    "dist",
     "README.md",
+    "pulse.package.json",
+    "pulsewasm.manifest.cjs",
+    "pulsewasm.compiler.cjs",
+    "pulsewasm.native.cjs",
+    "as",
+    "conformance",
     "LICENSE",
     "NOTICE"
   ],
   "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org/",
-    "tag": "bootstrap"
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pulse-compute/pulse.git",
+    "directory": "packages/jwt"
+  },
+  "bugs": {
+    "url": "https://github.com/pulse-compute/pulse/issues"
+  },
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.1/packages/jwt/",
+  "pulse": {
+    "contract": "./pulse.package.json"
+  },
+  "pulsewasm": {
+    "manifest": "./pulsewasm.manifest.cjs"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@pulse-compute/crypto": "1.0.0-beta.1",
+    "@pulse-compute/runtime": "1.0.0-beta.1",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.1"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "test": "corepack pnpm --dir ../.. exec vitest run packages/jwt/test",
+    "test:types": "tsc -p tsconfig.types.json --noEmit"
   }
-}
+}

package/pulse.package.json

@@ -0,0 +1,75 @@
+{
+  "version": "pulse.package-contract.v1",
+  "kind": "pulse.package-contract",
+  "contractId": "pulse.jwt",
+  "npmPackage": "@pulse-compute/jwt",
+  "description": "Bounded, provider-neutral JWT verification.",
+  "authoring": {
+    "namespace": "jwt",
+    "import": "@pulse-compute/jwt",
+    "symbols": [
+      "bearer",
+      "verify"
+    ]
+  },
+  "ownership": {
+    "profileFragment": "jwt",
+    "helperImports": [],
+    "reExportImports": []
+  },
+  "composition": {
+    "status": "reserved",
+    "helperSymbol": "jwt",
+    "profileToken": "opaque-direct-use",
+    "reasonCode": "PULSE_PACKAGE_COMPOSITION_HELPER_NOT_REALIZED"
+  },
+  "targets": {
+    "native": {
+      "status": "provider-dependent",
+      "realization": "canonical-package-lowering",
+      "lowerableSubpath": "@pulse-compute/jwt",
+      "providerRequirements": [
+        "jwt.verify",
+        "jwt.verify.hs256",
+        "jwt.verify.es256",
+        "secret.get",
+        "time.wall-clock"
+      ],
+      "reasonCode": "PULSE_JWT_TARGET_CAPABILITY_REQUIRED"
+    },
+    "javascript": {
+      "status": "provider-dependent",
+      "realization": "javascript-package-runtime",
+      "entry": "./dist/index.js",
+      "providerRequirements": [
+        "jwt.verify",
+        "jwt.verify.hs256",
+        "jwt.verify.es256",
+        "secret.get",
+        "time.wall-clock"
+      ],
+      "reasonCode": "PULSE_JWT_PROVIDER_CAPABILITY_REQUIRED"
+    }
+  },
+  "lowering": {
+    "manifest": "./pulsewasm.manifest.cjs",
+    "trust": "first-party",
+    "canonicalOperationVersion": "pulse.canonical-package-operation.v1",
+    "bundleVersion": "pulse.package-lowering-bundle.v1",
+    "providerRequirementVersion": "pulse.provider-requirement-record.v1"
+  },
+  "conformance": {
+    "status": "target-overlap",
+    "fixtureRoots": [
+      "./conformance"
+    ],
+    "semanticCases": [
+      "jwt.bearer",
+      "jwt.verify"
+    ]
+  },
+  "docs": {
+    "readme": "./README.md",
+    "contract": "./pulse.package.json"
+  }
+}