@pulse-compute/jwt 0.0.0 → 1.0.0-beta.2

package/dist/crypto-verifier.js

@@ -0,0 +1,225 @@
+import { CRYPTO_VERIFICATION_STATUSES, normalizeEs256JoseVerifyRequest, } from '@pulse-compute/crypto';
+import { isJwtError, jwtError } from './errors.js';
+import { normalizeJwtVerifyOptions, selectEs256VerificationJwk, } from './options.js';
+import { normalizeJwtVerification } from './result.js';
+import { compactJwtParts, compactJwtSignatureInput, parseVerifiedClaims, preflightCompactJwt, protectedAlgorithm, protectedHeaderString, } from './token.js';
+import { captureJwtCurrentDate } from './internal/clock.js';
+import { isJwtOrdinaryObject, jwtDataEntries, jwtDataRecord, jwtOwnDataProperty, } from './internal/data.js';
+import { validateRegisteredClaims } from './internal/registered-claims.js';
+import { registerClaimStrings, registerSensitive, validateClaimsSchema, verifierHostFunction, } from './internal/verifier-authority.js';
+function cryptoMacVerify(crypto) {
+    if (!isJwtOrdinaryObject(crypto)) {
+        throw jwtError('PULSE_JWT_TARGET_UNSUPPORTED', { category: 'crypto-verifier' });
+    }
+    const macProperty = jwtOwnDataProperty(crypto, 'mac');
+    if (!macProperty.valid || !macProperty.present || !isJwtOrdinaryObject(macProperty.value)) {
+        throw jwtError('PULSE_JWT_TARGET_UNSUPPORTED', { category: 'crypto-verifier' });
+    }
+    const verifyProperty = jwtOwnDataProperty(macProperty.value, 'verify');
+    if (!verifyProperty.valid || !verifyProperty.present || typeof verifyProperty.value !== 'function') {
+        throw jwtError('PULSE_JWT_TARGET_UNSUPPORTED', { category: 'crypto-verifier' });
+    }
+    return verifyProperty.value;
+}
+function cryptoSignatureVerify(crypto) {
+    if (!isJwtOrdinaryObject(crypto)) {
+        throw jwtError('PULSE_JWT_TARGET_UNSUPPORTED', { category: 'crypto-verifier' });
+    }
+    const signatureProperty = jwtOwnDataProperty(crypto, 'signature');
+    if (!signatureProperty.valid
+        || !signatureProperty.present
+        || !isJwtOrdinaryObject(signatureProperty.value)) {
+        throw jwtError('PULSE_JWT_TARGET_UNSUPPORTED', { category: 'crypto-verifier' });
+    }
+    const verifyProperty = jwtOwnDataProperty(signatureProperty.value, 'verify');
+    if (!verifyProperty.valid || !verifyProperty.present || typeof verifyProperty.value !== 'function') {
+        throw jwtError('PULSE_JWT_TARGET_UNSUPPORTED', { category: 'crypto-verifier' });
+    }
+    return verifyProperty.value;
+}
+function normalizedCryptoStatus(value) {
+    if (!isJwtOrdinaryObject(value))
+        return 'realization-failure';
+    const entries = jwtDataEntries(value);
+    if (!entries || entries.length !== 1 || entries[0][0] !== 'status') {
+        return 'realization-failure';
+    }
+    const status = entries[0][1];
+    return typeof status === 'string'
+        && CRYPTO_VERIFICATION_STATUSES.includes(status)
+        ? status
+        : 'realization-failure';
+}
+function assertCryptoVerified(status) {
+    if (status === 'valid')
+        return;
+    if (status === 'invalid-authenticator') {
+        throw jwtError('PULSE_JWT_SIGNATURE_INVALID');
+    }
+    if (status === 'invalid-key') {
+        throw jwtError('PULSE_JWT_KEY_INVALID', { category: 'crypto-key' });
+    }
+    if (status === 'invalid-input') {
+        throw jwtError('PULSE_JWT_MALFORMED', { category: 'crypto-input' });
+    }
+    throw jwtError('PULSE_JWT_OPERATION_FAILED', {
+        category: 'crypto-realization',
+        automaticFallback: false,
+    });
+}
+async function resolveHmacKeyBytes(key, algorithm, host) {
+    if (algorithm !== 'HS256' || key.type !== 'secret') {
+        throw jwtError('PULSE_JWT_KEY_INVALID', { category: 'algorithm-key-mismatch' });
+    }
+    const resolveSecret = verifierHostFunction(host, 'resolveSecret');
+    if (!resolveSecret) {
+        throw jwtError('PULSE_JWT_TARGET_UNSUPPORTED', { category: 'secret-authority' });
+    }
+    let resolved;
+    try {
+        resolved = await resolveSecret(key.binding);
+    }
+    catch {
+        throw jwtError('PULSE_JWT_KEY_INVALID', { category: 'secret-binding' });
+    }
+    const bytes = typeof resolved === 'string'
+        ? new TextEncoder().encode(resolved)
+        : resolved instanceof Uint8Array
+            ? new Uint8Array(resolved)
+            : undefined;
+    if (!bytes || bytes.byteLength === 0) {
+        throw jwtError('PULSE_JWT_KEY_INVALID', { category: 'secret-binding' });
+    }
+    try {
+        registerSensitive(host, resolved);
+    }
+    catch (error) {
+        bytes.fill(0);
+        throw error;
+    }
+    return bytes;
+}
+async function captureCurrentDate(host) {
+    const clock = jwtOwnDataProperty(host, 'captureWallClock');
+    if (!clock.valid
+        || (clock.present
+            && clock.value !== undefined
+            && typeof clock.value !== 'function')) {
+        throw jwtError('PULSE_JWT_CLOCK_INVALID');
+    }
+    return captureJwtCurrentDate(typeof clock.value === 'function'
+        ? clock.value
+        : undefined);
+}
+export async function verifyJwtWithCrypto(input, host, crypto) {
+    try {
+        const inputRecord = jwtDataRecord(input);
+        if (!inputRecord || !isJwtOrdinaryObject(host)) {
+            throw jwtError('PULSE_JWT_OPERATION_FAILED', { category: 'verifier-input' });
+        }
+        const token = inputRecord.get('token');
+        const inputOptions = inputRecord.get('options');
+        if (typeof token === 'string')
+            registerSensitive(host, token);
+        const preflight = preflightCompactJwt(token);
+        const options = normalizeJwtVerifyOptions(inputOptions);
+        const algorithm = protectedAlgorithm(preflight.protectedHeader);
+        if (algorithm === 'none' || !options.algorithms.includes(algorithm)) {
+            throw jwtError('PULSE_JWT_ALGORITHM_NOT_ALLOWED', { category: 'protected-algorithm' });
+        }
+        const selectedAlgorithm = algorithm;
+        const kid = protectedHeaderString(preflight.protectedHeader, 'kid');
+        const typ = protectedHeaderString(preflight.protectedHeader, 'typ');
+        if (options.typ !== undefined && typ !== options.typ) {
+            throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: 'protected-type' });
+        }
+        let cryptoResult;
+        if (selectedAlgorithm === 'HS256') {
+            const verifyMac = cryptoMacVerify(crypto);
+            const keyBytes = await resolveHmacKeyBytes(options.key, selectedAlgorithm, host);
+            const compact = compactJwtSignatureInput(token);
+            try {
+                try {
+                    cryptoResult = await verifyMac(Object.freeze({
+                        algorithm: 'HS256',
+                        key: Object.freeze({
+                            type: 'hmac-key-bytes',
+                            bytes: keyBytes,
+                        }),
+                        data: compact.signingInput,
+                        tag: compact.signature,
+                    }));
+                }
+                catch {
+                    throw jwtError('PULSE_JWT_OPERATION_FAILED', {
+                        category: 'crypto-verification',
+                        automaticFallback: false,
+                    });
+                }
+            }
+            finally {
+                keyBytes.fill(0);
+            }
+        }
+        else if (selectedAlgorithm === 'ES256') {
+            const verifySignature = cryptoSignatureVerify(crypto);
+            const selectedJwk = selectEs256VerificationJwk(options.key, kid);
+            const compact = compactJwtParts(token);
+            const normalized = normalizeEs256JoseVerifyRequest({
+                key: {
+                    x: selectedJwk.x,
+                    y: selectedJwk.y,
+                },
+                data: compact.signingInput,
+                signature: compact.signatureSegment,
+            });
+            if (!normalized.ok) {
+                assertCryptoVerified(normalized.result.status);
+                throw jwtError('PULSE_JWT_OPERATION_FAILED', {
+                    category: 'crypto-normalization',
+                });
+            }
+            try {
+                try {
+                    cryptoResult = await verifySignature(normalized.request);
+                }
+                catch {
+                    throw jwtError('PULSE_JWT_OPERATION_FAILED', {
+                        category: 'crypto-verification',
+                        automaticFallback: false,
+                    });
+                }
+            }
+            finally {
+                normalized.request.key.bytes.fill(0);
+            }
+        }
+        else {
+            throw jwtError('PULSE_JWT_ALGORITHM_NOT_ALLOWED', {
+                category: 'protected-algorithm',
+            });
+        }
+        assertCryptoVerified(normalizedCryptoStatus(cryptoResult));
+        const claims = parseVerifiedClaims(preflight);
+        registerClaimStrings(host, claims);
+        const currentDate = await captureCurrentDate(host);
+        validateRegisteredClaims(claims, options, currentDate);
+        const normalizedClaims = await validateClaimsSchema(claims, options.claimsSchema, host);
+        if (normalizedClaims !== claims)
+            registerClaimStrings(host, normalizedClaims);
+        return normalizeJwtVerification({
+            claims: normalizedClaims,
+            protectedHeader: {
+                alg: selectedAlgorithm,
+                ...(kid === undefined ? {} : { kid }),
+                ...(typ === undefined ? {} : { typ }),
+            },
+        });
+    }
+    catch (error) {
+        if (isJwtError(error))
+            throw error;
+        throw jwtError('PULSE_JWT_OPERATION_FAILED', { category: 'crypto-verifier' });
+    }
+}
+//# sourceMappingURL=crypto-verifier.js.map

package/dist/crypto-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-verifier.js","sourceRoot":"","sources":["../src/crypto-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAKhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAI3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,wBAAwB,EAAwB,MAAM,aAAa,CAAC;AAC7E,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GAGrB,MAAM,kCAAkC,CAAC;AAuB1C,SAAS,eAAe,CACtB,MAAyB;IAEzB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,OAAO,cAAc,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACnG,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,cAAc,CAAC,KAA2B,CAAC;AACpD,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAyB;IAEzB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,IACE,CAAC,iBAAiB,CAAC,KAAK;WACrB,CAAC,iBAAiB,CAAC,OAAO;WAC1B,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAChD,CAAC;QACD,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7E,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,OAAO,cAAc,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACnG,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,cAAc,CAAC,KAAiC,CAAC;AAC1D,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ;WAC3B,4BAAkD,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvE,CAAC,CAAC,MAAkC;QACpC,CAAC,CAAC,qBAAqB,CAAC;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAgC;IAC5D,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO;IAC/B,IAAI,MAAM,KAAK,uBAAuB,EAAE,CAAC;QACvC,MAAM,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,CAAC,4BAA4B,EAAE;QAC3C,QAAQ,EAAE,oBAAoB;QAC9B,iBAAiB,EAAE,KAAK;KACzB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAuB,EACvB,SAAuB,EACvB,IAA2B;IAE3B,IAAI,SAAS,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAoC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ;QACxC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACpC,CAAC,CAAC,QAAQ,YAAY,UAAU;YAC9B,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;YAC1B,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC;QACH,iBAAiB,CAAC,IAAI,EAAE,QAA+B,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA2B;IAE3B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC3D,IACE,CAAC,KAAK,CAAC,KAAK;WACT,CACD,KAAK,CAAC,OAAO;eACV,KAAK,CAAC,KAAK,KAAK,SAAS;eACzB,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU,CACrC,EACD,CAAC;QACD,MAAM,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,qBAAqB,CAC1B,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;QAC/B,CAAC,CAAC,KAAK,CAAC,KAAkD;QAC1D,CAAC,CAAC,SAAS,CACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA6B,EAC7B,IAA2B,EAC3B,MAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAE9D,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAA2B,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,yBAAyB,CAAC,YAAiD,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAChE,IAAI,SAAS,KAAK,MAAM,IAAI,CAAE,OAAO,CAAC,UAAgC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3F,MAAM,QAAQ,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,iBAAiB,GAAG,SAAyB,CAAC;QACpD,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YACrD,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,YAAqB,CAAC;QAC1B,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAe,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;wBAC3C,SAAS,EAAE,OAAO;wBAClB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;4BACjB,IAAI,EAAE,gBAAgB;4BACtB,KAAK,EAAE,QAAQ;yBAChB,CAAC;wBACF,IAAI,EAAE,OAAO,CAAC,YAAY;wBAC1B,GAAG,EAAE,OAAO,CAAC,SAAS;qBACvB,CAAC,CAAC,CAAC;gBACN,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,QAAQ,CAAC,4BAA4B,EAAE;wBAC3C,QAAQ,EAAE,qBAAqB;wBAC/B,iBAAiB,EAAE,KAAK;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YACzC,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,WAAW,GAAG,0BAA0B,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAe,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,+BAA+B,CAAC;gBACjD,GAAG,EAAE;oBACH,CAAC,EAAE,WAAW,CAAC,CAAW;oBAC1B,CAAC,EAAE,WAAW,CAAC,CAAW;iBAC3B;gBACD,IAAI,EAAE,OAAO,CAAC,YAAY;gBAC1B,SAAS,EAAE,OAAO,CAAC,gBAAgB;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,oBAAoB,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/C,MAAM,QAAQ,CAAC,4BAA4B,EAAE;oBAC3C,QAAQ,EAAE,sBAAsB;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC3D,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,QAAQ,CAAC,4BAA4B,EAAE;wBAC3C,QAAQ,EAAE,qBAAqB;wBAC/B,iBAAiB,EAAE,KAAK;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,iCAAiC,EAAE;gBAChD,QAAQ,EAAE,qBAAqB;aAChC,CAAC,CAAC;QACL,CAAC;QACD,oBAAoB,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC9C,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACnD,wBAAwB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CACjD,MAAM,EACN,OAAO,CAAC,YAAY,EACpB,IAAI,CACL,CAAC;QACF,IAAI,gBAAgB,KAAK,MAAM;YAAE,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC9E,OAAO,wBAAwB,CAAS;YACtC,MAAM,EAAE,gBAAgB;YACxB,eAAe,EAAE;gBACf,GAAG,EAAE,iBAAiB;gBACtB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;gBACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;aACtC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACnC,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,14 @@
+export declare const JWT_ERROR_CODES: readonly ["PULSE_JWT_BEARER_INVALID", "PULSE_JWT_TOKEN_REQUIRED", "PULSE_JWT_MALFORMED", "PULSE_JWT_LIMIT_EXCEEDED", "PULSE_JWT_ALGORITHM_NOT_ALLOWED", "PULSE_JWT_KEY_INVALID", "PULSE_JWT_SIGNATURE_INVALID", "PULSE_JWT_CLAIMS_INVALID", "PULSE_JWT_CLAIMS_SCHEMA_INVALID", "PULSE_JWT_CLOCK_UNAVAILABLE", "PULSE_JWT_CLOCK_INVALID", "PULSE_JWT_TARGET_UNSUPPORTED", "PULSE_JWT_OPERATION_FAILED"];
+export type JwtErrorCode = typeof JWT_ERROR_CODES[number];
+export type JwtErrorDetailValue = string | number | boolean | null | readonly JwtErrorDetailValue[] | Readonly<{
+    readonly [name: string]: JwtErrorDetailValue;
+}>;
+export declare class JwtError extends Error {
+    readonly code: JwtErrorCode;
+    readonly detail: Readonly<Record<string, JwtErrorDetailValue>>;
+    static [Symbol.hasInstance](value: unknown): boolean;
+    constructor(code: JwtErrorCode, detail?: Readonly<Record<string, JwtErrorDetailValue>>);
+}
+export declare function jwtError(code: JwtErrorCode, detail?: Readonly<Record<string, JwtErrorDetailValue>>): JwtError;
+export declare function isJwtError(value: unknown): value is JwtError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,wYAcjB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;AAE1D,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,mBAAmB,EAAE,GAC9B,QAAQ,CAAC;IAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAAA;CAAE,CAAC,CAAC;AA4B/D,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAE/D,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;gBASlD,IAAI,EAAE,YAAY,EAClB,MAAM,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAM;CAQ7D;AAED,wBAAgB,QAAQ,CACtB,IAAI,EAAE,YAAY,EAClB,MAAM,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAM,GACzD,QAAQ,CAEV;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D"}

package/dist/errors.js

@@ -0,0 +1,65 @@
+export const JWT_ERROR_CODES = Object.freeze([
+    'PULSE_JWT_BEARER_INVALID',
+    'PULSE_JWT_TOKEN_REQUIRED',
+    'PULSE_JWT_MALFORMED',
+    'PULSE_JWT_LIMIT_EXCEEDED',
+    'PULSE_JWT_ALGORITHM_NOT_ALLOWED',
+    'PULSE_JWT_KEY_INVALID',
+    'PULSE_JWT_SIGNATURE_INVALID',
+    'PULSE_JWT_CLAIMS_INVALID',
+    'PULSE_JWT_CLAIMS_SCHEMA_INVALID',
+    'PULSE_JWT_CLOCK_UNAVAILABLE',
+    'PULSE_JWT_CLOCK_INVALID',
+    'PULSE_JWT_TARGET_UNSUPPORTED',
+    'PULSE_JWT_OPERATION_FAILED',
+]);
+const MESSAGES = Object.freeze({
+    PULSE_JWT_BEARER_INVALID: 'The Authorization header is not a valid Bearer credential.',
+    PULSE_JWT_TOKEN_REQUIRED: 'JWT verification requires a Bearer token.',
+    PULSE_JWT_MALFORMED: 'The compact JWT is malformed.',
+    PULSE_JWT_LIMIT_EXCEEDED: 'The JWT exceeds a bounded resource limit.',
+    PULSE_JWT_ALGORITHM_NOT_ALLOWED: 'The JWT protected algorithm is not allowed.',
+    PULSE_JWT_KEY_INVALID: 'The JWT verification key is invalid or ambiguous.',
+    PULSE_JWT_SIGNATURE_INVALID: 'The JWT signature is invalid.',
+    PULSE_JWT_CLAIMS_INVALID: 'The JWT registered claims are invalid.',
+    PULSE_JWT_CLAIMS_SCHEMA_INVALID: 'The verified JWT claims do not match the selected schema.',
+    PULSE_JWT_CLOCK_UNAVAILABLE: 'Trusted wall-clock time is unavailable.',
+    PULSE_JWT_CLOCK_INVALID: 'The supplied wall-clock instant is invalid.',
+    PULSE_JWT_TARGET_UNSUPPORTED: 'The selected target cannot realize this JWT verification.',
+    PULSE_JWT_OPERATION_FAILED: 'JWT verification failed.',
+});
+function cloneDetail(value) {
+    if (Array.isArray(value))
+        return Object.freeze(value.map(cloneDetail));
+    if (value && typeof value === 'object') {
+        return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, child]) => [key, cloneDetail(child)])));
+    }
+    return value;
+}
+export class JwtError extends Error {
+    code;
+    detail;
+    static [Symbol.hasInstance](value) {
+        if (Function.prototype[Symbol.hasInstance].call(this, value))
+            return true;
+        if (!(value instanceof Error))
+            return false;
+        const code = Object.getOwnPropertyDescriptor(value, 'code')?.value;
+        return typeof code === 'string'
+            && JWT_ERROR_CODES.includes(code);
+    }
+    constructor(code, detail = {}) {
+        super(MESSAGES[code]);
+        this.name = 'JwtError';
+        this.code = code;
+        this.detail = cloneDetail(detail);
+        Object.freeze(this.detail);
+    }
+}
+export function jwtError(code, detail = {}) {
+    return new JwtError(code, detail);
+}
+export function isJwtError(value) {
+    return value instanceof JwtError;
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,0BAA0B;IAC1B,0BAA0B;IAC1B,qBAAqB;IACrB,0BAA0B;IAC1B,iCAAiC;IACjC,uBAAuB;IACvB,6BAA6B;IAC7B,0BAA0B;IAC1B,iCAAiC;IACjC,6BAA6B;IAC7B,yBAAyB;IACzB,8BAA8B;IAC9B,4BAA4B;CACpB,CAAC,CAAC;AAYZ,MAAM,QAAQ,GAA2C,MAAM,CAAC,MAAM,CAAC;IACrE,wBAAwB,EAAE,4DAA4D;IACtF,wBAAwB,EAAE,2CAA2C;IACrE,mBAAmB,EAAE,+BAA+B;IACpD,wBAAwB,EAAE,2CAA2C;IACrE,+BAA+B,EAAE,6CAA6C;IAC9E,qBAAqB,EAAE,mDAAmD;IAC1E,2BAA2B,EAAE,+BAA+B;IAC5D,wBAAwB,EAAE,wCAAwC;IAClE,+BAA+B,EAAE,2DAA2D;IAC5F,2BAA2B,EAAE,yCAAyC;IACtE,uBAAuB,EAAE,6CAA6C;IACtE,4BAA4B,EAAE,2DAA2D;IACzF,0BAA0B,EAAE,0BAA0B;CACvD,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,KAA0B;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACvE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CACrC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CACvE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAe;IACnB,MAAM,CAAgD;IAE/D,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAc;QACxC,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;QACnE,OAAO,OAAO,IAAI,KAAK,QAAQ;eACzB,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,YACE,IAAkB,EAClB,SAAwD,EAAE;QAE1D,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAkD,CAAC;QACnF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,QAAQ,CACtB,IAAkB,EAClB,SAAwD,EAAE;IAE1D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,QAAQ,CAAC;AACnC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+import type { PulseContext, PulseParallelEffect } from '@pulse-compute/runtime';
+import { bearer } from './bearer.js';
+import { JwtError, JWT_ERROR_CODES } from './errors.js';
+import { type JwtClaims, type JwtVerifyOptions } from './options.js';
+import { type JwtVerification } from './result.js';
+export { bearer, JwtError, JWT_ERROR_CODES };
+export type { JwtErrorCode, JwtErrorDetailValue, } from './errors.js';
+export type { JwtAlgorithm, JwtClaims, JwtJsonPrimitive, JwtJsonValue, JwtPublicJwk, JwtVerificationKey, JwtVerifyOptions, } from './options.js';
+export type { DeepReadonly, JwtProtectedHeader, JwtVerification, } from './result.js';
+export declare function verify<Claims>(ctx: PulseContext, token: string | undefined, options: JwtVerifyOptions & {
+    readonly claimsSchema: string;
+}): PulseParallelEffect<JwtVerification<Claims>>;
+export declare function verify(ctx: PulseContext, token: string | undefined, options: JwtVerifyOptions): PulseParallelEffect<JwtVerification<JwtClaims>>;
+export declare const jwt: Readonly<{
+    bearer: typeof bearer;
+    verify: typeof verify;
+}>;
+export default jwt;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AAC7C,YAAY,EACV,YAAY,EACZ,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,wBAAgB,MAAM,CAAC,MAAM,EAC3B,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,gBAAgB,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5D,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,wBAAgB,MAAM,CACpB,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,gBAAgB,GACxB,mBAAmB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;AAmBnD,eAAO,MAAM,GAAG;;;EAGd,CAAC;AAEH,eAAe,GAAG,CAAC"}

package/dist/index.js

@@ -0,0 +1,21 @@
+import { bearer } from './bearer.js';
+import { JwtError, JWT_ERROR_CODES } from './errors.js';
+import { normalizeJwtVerifyOptions, } from './options.js';
+import { normalizeJwtVerification, } from './result.js';
+import { preflightCompactJwt } from './token.js';
+import { pulseJwtRuntime } from './internal/package-runtime.js';
+export { bearer, JwtError, JWT_ERROR_CODES };
+export function verify(ctx, token, options) {
+    preflightCompactJwt(token);
+    const normalized = normalizeJwtVerifyOptions(options);
+    return pulseJwtRuntime.effect(ctx, 'verify', {
+        token: token,
+        options: normalized,
+    }, (value) => normalizeJwtVerification(value));
+}
+export const jwt = Object.freeze({
+    bearer,
+    verify,
+});
+export default jwt;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,yBAAyB,GAG1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,GAEzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AA8B7C,MAAM,UAAU,MAAM,CACpB,GAAiB,EACjB,KAAyB,EACzB,OAAyB;IAEzB,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,eAAe,CAAC,MAAM,CAC3B,GAAG,EACH,QAAQ,EACR;QACE,KAAK,EAAE,KAAe;QACtB,OAAO,EAAE,UAAU;KACpB,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,eAAe,GAAG,CAAC"}

package/dist/internal/clock.d.ts

@@ -0,0 +1,7 @@
+export interface JwtCapturedWallClock {
+    readonly unixEpochSeconds: number;
+    readonly trusted: boolean;
+}
+export type JwtWallClockCapture = () => JwtCapturedWallClock | PromiseLike<JwtCapturedWallClock>;
+export declare function captureJwtCurrentDate(capture: JwtWallClockCapture | undefined): Promise<Date>;
+//# sourceMappingURL=clock.d.ts.map

package/dist/internal/clock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.d.ts","sourceRoot":"","sources":["../../src/internal/clock.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAC7B,MAAM,oBAAoB,GAAG,WAAW,CAAC,oBAAoB,CAAC,CAAC;AAIjE,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,mBAAmB,GAAG,SAAS,GACvC,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/internal/clock.js

@@ -0,0 +1,34 @@
+import { jwtError } from '../errors.js';
+import { isJwtOrdinaryObject, jwtOwnDataProperty, } from './data.js';
+const MAX_DATE_SECONDS = 8_640_000_000_000;
+export async function captureJwtCurrentDate(capture) {
+    if (typeof capture !== 'function')
+        throw jwtError('PULSE_JWT_CLOCK_UNAVAILABLE');
+    let clock;
+    try {
+        clock = await capture();
+    }
+    catch {
+        throw jwtError('PULSE_JWT_CLOCK_UNAVAILABLE');
+    }
+    if (!isJwtOrdinaryObject(clock))
+        throw jwtError('PULSE_JWT_CLOCK_INVALID');
+    const trusted = jwtOwnDataProperty(clock, 'trusted');
+    const instant = jwtOwnDataProperty(clock, 'unixEpochSeconds');
+    if (!trusted.valid || !instant.valid)
+        throw jwtError('PULSE_JWT_CLOCK_INVALID');
+    if (!trusted.present || trusted.value !== true)
+        throw jwtError('PULSE_JWT_CLOCK_UNAVAILABLE');
+    const seconds = instant.present ? instant.value : undefined;
+    if (typeof seconds !== 'number'
+        || !Number.isFinite(seconds)
+        || seconds < 0
+        || seconds > MAX_DATE_SECONDS) {
+        throw jwtError('PULSE_JWT_CLOCK_INVALID');
+    }
+    const date = new Date(seconds * 1000);
+    if (!Number.isFinite(date.getTime()))
+        throw jwtError('PULSE_JWT_CLOCK_INVALID');
+    return date;
+}
+//# sourceMappingURL=clock.js.map

package/dist/internal/clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.js","sourceRoot":"","sources":["../../src/internal/clock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAUnB,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAwC;IAExC,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,MAAM,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IACjF,IAAI,KAA2B,CAAC;IAChC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAAE,MAAM,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,MAAM,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAChF,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;QAAE,MAAM,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IAC9F,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IACE,OAAO,OAAO,KAAK,QAAQ;WACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;WACzB,OAAO,GAAG,CAAC;WACX,OAAO,GAAG,gBAAgB,EAC7B,CAAC;QACD,MAAM,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,MAAM,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/internal/data.d.ts

@@ -0,0 +1,12 @@
+export interface JwtOwnDataProperty {
+    readonly present: boolean;
+    readonly valid: boolean;
+    readonly value?: unknown;
+}
+export declare function isJwtOrdinaryObject(value: unknown): value is Readonly<Record<string, unknown>>;
+export declare function jwtOwnDataProperty(value: object, name: string): JwtOwnDataProperty;
+export declare function jwtDataEntries(value: object): readonly (readonly [string, unknown])[] | undefined;
+export declare function jwtDataRecord(value: unknown): ReadonlyMap<string, unknown> | undefined;
+export declare function jwtDenseArrayValues(value: unknown): readonly unknown[] | undefined;
+export declare function defineJwtDataProperty(target: object, name: string, value: unknown): void;
+//# sourceMappingURL=data.d.ts.map

package/dist/internal/data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.d.ts","sourceRoot":"","sources":["../../src/internal/data.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQ5C;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,kBAAkB,CAkBpB;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,GACZ,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,SAAS,CAarD;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,GACb,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAI1C;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,SAAS,OAAO,EAAE,GAAG,SAAS,CAmBhC;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,GACb,IAAI,CAON"}

package/dist/internal/data.js

@@ -0,0 +1,86 @@
+export function isJwtOrdinaryObject(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    try {
+        const prototype = Object.getPrototypeOf(value);
+        return prototype === Object.prototype || prototype === null;
+    }
+    catch {
+        return false;
+    }
+}
+export function jwtOwnDataProperty(value, name) {
+    try {
+        const descriptor = Object.getOwnPropertyDescriptor(value, name);
+        if (!descriptor)
+            return Object.freeze({ present: false, valid: true });
+        if (!descriptor.enumerable
+            || !Object.prototype.hasOwnProperty.call(descriptor, 'value')) {
+            return Object.freeze({ present: true, valid: false });
+        }
+        return Object.freeze({
+            present: true,
+            valid: true,
+            value: descriptor.value,
+        });
+    }
+    catch {
+        return Object.freeze({ present: true, valid: false });
+    }
+}
+export function jwtDataEntries(value) {
+    try {
+        const entries = [];
+        for (const key of Reflect.ownKeys(value)) {
+            if (typeof key !== 'string')
+                return undefined;
+            const property = jwtOwnDataProperty(value, key);
+            if (!property.present || !property.valid)
+                return undefined;
+            entries.push(Object.freeze([key, property.value]));
+        }
+        return Object.freeze(entries);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function jwtDataRecord(value) {
+    if (!isJwtOrdinaryObject(value))
+        return undefined;
+    const entries = jwtDataEntries(value);
+    return entries ? new Map(entries) : undefined;
+}
+export function jwtDenseArrayValues(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    try {
+        for (const key of Reflect.ownKeys(value)) {
+            if (key === 'length')
+                continue;
+            if (typeof key !== 'string' || !/^(?:0|[1-9]\d*)$/.test(key)) {
+                return undefined;
+            }
+        }
+        const output = [];
+        for (let index = 0; index < value.length; index += 1) {
+            const property = jwtOwnDataProperty(value, String(index));
+            if (!property.present || !property.valid)
+                return undefined;
+            output.push(property.value);
+        }
+        return Object.freeze(output);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function defineJwtDataProperty(target, name, value) {
+    Object.defineProperty(target, name, {
+        configurable: true,
+        enumerable: true,
+        value,
+        writable: true,
+    });
+}
+//# sourceMappingURL=data.js.map

package/dist/internal/data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data.js","sourceRoot":"","sources":["../../src/internal/data.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,IACE,CAAC,UAAU,CAAC,UAAU;eACnB,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAC7D,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,UAAU,CAAC,KAAK;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,OAAO,GAAmC,EAAE,CAAC;QACnD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC9C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAU,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc;IAEd,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7D,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,IAAY,EACZ,KAAc;IAEd,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE;QAClC,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,KAAK;QACL,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC"}

package/dist/internal/package-runtime.d.ts

@@ -0,0 +1,9 @@
+import packageRuntime from '@pulse-compute/runtime/package';
+export declare const pulseJwtRuntime: packageRuntime.PulsePackageRuntime<{
+    readonly verify: {
+        readonly kind: "jwt.verify";
+        readonly capability: "jwt.verify";
+        readonly result: "jwt-verification";
+    };
+}>;
+//# sourceMappingURL=package-runtime.d.ts.map

package/dist/internal/package-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-runtime.d.ts","sourceRoot":"","sources":["../../src/internal/package-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,gCAAgC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;EAWjB,CAAC"}

package/dist/internal/package-runtime.js

@@ -0,0 +1,14 @@
+import packageRuntime from '@pulse-compute/runtime/package';
+export const pulseJwtRuntime = packageRuntime.createPackageRuntime({
+    package: '@pulse-compute/jwt',
+    contractId: 'pulse.jwt',
+    providerKind: 'jwt',
+    operations: {
+        verify: {
+            kind: 'jwt.verify',
+            capability: 'jwt.verify',
+            result: 'jwt-verification',
+        },
+    },
+});
+//# sourceMappingURL=package-runtime.js.map

package/dist/internal/package-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-runtime.js","sourceRoot":"","sources":["../../src/internal/package-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,gCAAgC,CAAC;AAE5D,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAC,oBAAoB,CAAC;IACjE,OAAO,EAAE,oBAAoB;IAC7B,UAAU,EAAE,WAAW;IACvB,YAAY,EAAE,KAAK;IACnB,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,kBAAkB;SAC3B;KACF;CACO,CAAC,CAAC"}

package/dist/internal/registered-claims.d.ts

@@ -0,0 +1,3 @@
+import type { JwtClaims, NormalizedJwtVerifyOptions } from '../options.js';
+export declare function validateRegisteredClaims(claims: JwtClaims, options: NormalizedJwtVerifyOptions, currentDate: Date): void;
+//# sourceMappingURL=registered-claims.d.ts.map

package/dist/internal/registered-claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registered-claims.d.ts","sourceRoot":"","sources":["../../src/internal/registered-claims.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EACT,0BAA0B,EAC3B,MAAM,eAAe,CAAC;AA+DvB,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,0BAA0B,EACnC,WAAW,EAAE,IAAI,GAChB,IAAI,CAuCN"}