@pulse-compute/jwt 0.0.0 → 1.0.0-beta.2

package/dist/internal/registered-claims.js

@@ -0,0 +1,84 @@
+import { jwtError } from '../errors.js';
+import { jwtOwnDataProperty } from './data.js';
+function requiredClaim(claims, name) {
+    const descriptor = Object.getOwnPropertyDescriptor(claims, name);
+    return Boolean(descriptor
+        && descriptor.enumerable
+        && Object.prototype.hasOwnProperty.call(descriptor, 'value')
+        && descriptor.value !== undefined);
+}
+function numericClaim(claims, name) {
+    const property = jwtOwnDataProperty(claims, name);
+    if (!property.valid)
+        throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: name });
+    const value = property.present ? property.value : undefined;
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+        throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: name });
+    }
+    return value;
+}
+function acceptedValues(value) {
+    return Array.isArray(value) ? value : [value];
+}
+function validateIssuer(claims, configured) {
+    if (configured === undefined)
+        return;
+    const property = jwtOwnDataProperty(claims, 'iss');
+    const issuer = property.valid && property.present ? property.value : undefined;
+    if (typeof issuer !== 'string' || !acceptedValues(configured).includes(issuer)) {
+        throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: 'issuer' });
+    }
+}
+function validateAudience(claims, configured) {
+    if (configured === undefined)
+        return;
+    const property = jwtOwnDataProperty(claims, 'aud');
+    const audience = property.valid && property.present ? property.value : undefined;
+    const tokenValues = typeof audience === 'string'
+        ? [audience]
+        : Array.isArray(audience) && audience.every((entry) => typeof entry === 'string')
+            ? audience
+            : undefined;
+    if (!tokenValues || !tokenValues.some((entry) => acceptedValues(configured).includes(entry))) {
+        throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: 'audience' });
+    }
+}
+export function validateRegisteredClaims(claims, options, currentDate) {
+    for (const name of options.requiredClaims ?? []) {
+        if (!requiredClaim(claims, name)) {
+            throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: 'required-claim', claim: name });
+        }
+    }
+    validateIssuer(claims, options.issuer);
+    validateAudience(claims, options.audience);
+    const subject = jwtOwnDataProperty(claims, 'sub');
+    if (options.subject !== undefined
+        && (!subject.valid || !subject.present || subject.value !== options.subject)) {
+        throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: 'subject' });
+    }
+    const now = currentDate.getTime() / 1000;
+    const tolerance = options.clockToleranceSeconds ?? 0;
+    const expiresAt = numericClaim(claims, 'exp');
+    const notBefore = numericClaim(claims, 'nbf');
+    const issuedAt = numericClaim(claims, 'iat');
+    if (expiresAt !== undefined && now - tolerance >= expiresAt) {
+        throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: 'expiration' });
+    }
+    if (notBefore !== undefined && now + tolerance < notBefore) {
+        throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: 'not-before' });
+    }
+    if (options.maxTokenAgeSeconds !== undefined) {
+        if (issuedAt === undefined) {
+            throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: 'issued-at' });
+        }
+        if (issuedAt > now + tolerance) {
+            throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: 'issued-at' });
+        }
+        if (now - issuedAt - tolerance > options.maxTokenAgeSeconds) {
+            throw jwtError('PULSE_JWT_CLAIMS_INVALID', { category: 'max-token-age' });
+        }
+    }
+}
+//# sourceMappingURL=registered-claims.js.map

package/dist/internal/registered-claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registered-claims.js","sourceRoot":"","sources":["../../src/internal/registered-claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAKxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,SAAS,aAAa,CACpB,MAAiB,EACjB,IAAY;IAEZ,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjE,OAAO,OAAO,CACZ,UAAU;WACP,UAAU,CAAC,UAAU;WACrB,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC;WACzD,UAAU,CAAC,KAAK,KAAK,SAAS,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,MAAiB,EACjB,IAA2B;IAE3B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK;QAAE,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAiC;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CACrB,MAAiB,EACjB,UAAkD;IAElD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO;IACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiB,EACjB,UAAkD;IAElD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO;IACrC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,WAAW,GAAG,OAAO,QAAQ,KAAK,QAAQ;QAC9C,CAAC,CAAC,CAAC,QAAQ,CAAC;QACZ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC/E,CAAC,CAAC,QAA6B;YAC/B,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiB,EACjB,OAAmC,EACnC,WAAiB;IAEjB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClD,IACE,OAAO,CAAC,OAAO,KAAK,SAAS;WAC1B,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,EAC5E,CAAC;QACD,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;QAC5D,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,SAAS,GAAG,SAAS,EAAE,CAAC;QAC3D,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,QAAQ,GAAG,GAAG,GAAG,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,GAAG,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC5D,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/internal/verifier-authority.d.ts

@@ -0,0 +1,24 @@
+import type { JwtClaims, JwtVerifyOptions } from '../options.js';
+import type { JwtWallClockCapture } from './clock.js';
+export interface JwtVerifierInput {
+    readonly token: string | undefined;
+    readonly options: JwtVerifyOptions;
+}
+export interface JwtClaimsSchemaErrorDetail {
+    readonly path?: string;
+    readonly expected?: string;
+    readonly actualKind?: string;
+}
+export interface JwtVerifierHost {
+    readonly captureWallClock?: JwtWallClockCapture;
+    readonly resolveSecret?: (binding: string) => string | Uint8Array | undefined | PromiseLike<string | Uint8Array | undefined>;
+    readonly validateClaims?: (schemaId: string, claims: JwtClaims, context: Readonly<{
+        source: 'jwt-claims';
+    }>) => unknown | PromiseLike<unknown>;
+    readonly registerSensitiveValue?: (value: string | Uint8Array) => void;
+}
+export declare function verifierHostFunction(host: JwtVerifierHost, name: keyof JwtVerifierHost): Function | undefined;
+export declare function registerSensitive(host: JwtVerifierHost, value: string | Uint8Array): void;
+export declare function registerClaimStrings(host: JwtVerifierHost, value: unknown, depth?: number): void;
+export declare function validateClaimsSchema(claims: JwtClaims, schemaId: string | undefined, host: JwtVerifierHost): Promise<unknown>;
+//# sourceMappingURL=verifier-authority.d.ts.map

package/dist/internal/verifier-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier-authority.d.ts","sourceRoot":"","sources":["../../src/internal/verifier-authority.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EACjB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAQtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,OAAO,EAAE,MAAM,KACZ,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC;IACpF,QAAQ,CAAC,cAAc,CAAC,EAAE,CACxB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,QAAQ,CAAC;QAAE,MAAM,EAAE,YAAY,CAAA;KAAE,CAAC,KACxC,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,CAAC;CACxE;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,MAAM,eAAe,GAC1B,QAAQ,GAAG,SAAS,CAUtB;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,MAAM,GAAG,UAAU,GACzB,IAAI,CAQN;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,OAAO,EACd,KAAK,SAAI,GACR,IAAI,CAmBN;AAyCD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/internal/verifier-authority.js

@@ -0,0 +1,101 @@
+import { jwtError } from '../errors.js';
+import { isJwtOrdinaryObject, jwtDataEntries, jwtDenseArrayValues, jwtOwnDataProperty, } from './data.js';
+export function verifierHostFunction(host, name) {
+    const property = jwtOwnDataProperty(host, name);
+    if (!property.valid) {
+        throw jwtError('PULSE_JWT_OPERATION_FAILED', { category: 'verifier-host' });
+    }
+    if (!property.present || property.value === undefined)
+        return undefined;
+    if (typeof property.value !== 'function') {
+        throw jwtError('PULSE_JWT_OPERATION_FAILED', { category: 'verifier-host' });
+    }
+    return property.value;
+}
+export function registerSensitive(host, value) {
+    const register = verifierHostFunction(host, 'registerSensitiveValue');
+    if (!register)
+        return;
+    try {
+        register(value);
+    }
+    catch {
+        throw jwtError('PULSE_JWT_OPERATION_FAILED', { category: 'redaction-registration' });
+    }
+}
+export function registerClaimStrings(host, value, depth = 0) {
+    if (depth > 32)
+        return;
+    if (typeof value === 'string') {
+        if (value.length > 0)
+            registerSensitive(host, value);
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    if (Array.isArray(value)) {
+        const entries = jwtDenseArrayValues(value);
+        if (!entries)
+            throw jwtError('PULSE_JWT_OPERATION_FAILED', { category: 'claim-redaction' });
+        for (const entry of entries)
+            registerClaimStrings(host, entry, depth + 1);
+        return;
+    }
+    if (!isJwtOrdinaryObject(value)) {
+        throw jwtError('PULSE_JWT_OPERATION_FAILED', { category: 'claim-redaction' });
+    }
+    const entries = jwtDataEntries(value);
+    if (!entries)
+        throw jwtError('PULSE_JWT_OPERATION_FAILED', { category: 'claim-redaction' });
+    for (const [, entry] of entries)
+        registerClaimStrings(host, entry, depth + 1);
+}
+function schemaErrorDetail(schemaId, error) {
+    const detail = error && typeof error === 'object'
+        ? (Object.getOwnPropertyDescriptor(error, 'detail')?.value
+            ?? Object.getOwnPropertyDescriptor(error, 'details')?.value)
+        : undefined;
+    const record = detail && typeof detail === 'object' && !Array.isArray(detail)
+        ? detail
+        : {};
+    const output = {
+        schemaId,
+        source: 'jwt-claims',
+    };
+    const code = error && typeof error === 'object'
+        ? Object.getOwnPropertyDescriptor(error, 'code')?.value
+        : undefined;
+    if (typeof code === 'string' && /^PULSE_[A-Z0-9_]{1,96}$/.test(code))
+        output.schemaCode = code;
+    const path = Object.getOwnPropertyDescriptor(record, 'path')?.value;
+    if (typeof path === 'string' && /^[A-Za-z0-9_$.[\]-]{1,256}$/.test(path)) {
+        output.path = path;
+    }
+    const jsonKinds = new Set([
+        'array', 'boolean', 'integer', 'null', 'number', 'object', 'string',
+    ]);
+    const expected = Object.getOwnPropertyDescriptor(record, 'expected')?.value;
+    if (typeof expected === 'string' && jsonKinds.has(expected)) {
+        output.expected = expected;
+    }
+    const actualKind = Object.getOwnPropertyDescriptor(record, 'actualKind')?.value;
+    if (typeof actualKind === 'string' && jsonKinds.has(actualKind)) {
+        output.actualKind = actualKind;
+    }
+    return Object.freeze(output);
+}
+export async function validateClaimsSchema(claims, schemaId, host) {
+    if (schemaId === undefined)
+        return claims;
+    const validateClaims = verifierHostFunction(host, 'validateClaims');
+    if (!validateClaims) {
+        throw jwtError('PULSE_JWT_TARGET_UNSUPPORTED', { category: 'claims-schema' });
+    }
+    try {
+        return await validateClaims(schemaId, claims, Object.freeze({ source: 'jwt-claims' }));
+    }
+    catch (error) {
+        throw jwtError('PULSE_JWT_CLAIMS_SCHEMA_INVALID', schemaErrorDetail(schemaId, error));
+    }
+}
+//# sourceMappingURL=verifier-authority.js.map

package/dist/internal/verifier-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier-authority.js","sourceRoot":"","sources":["../../src/internal/verifier-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAMxC,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AA0BnB,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,IAA2B;IAE3B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxE,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACzC,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAqB,EACrB,KAA0B;IAE1B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,CAAC;QACH,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAqB,EACrB,KAAc,EACd,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO;IACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5F,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,OAAO;QAAE,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAgB,EAChB,KAAc;IAEd,MAAM,MAAM,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC/C,CAAC,CAAC,CACE,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,KAAK;eACpD,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,KAAK,CAC5D;QACH,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3E,CAAC,CAAC,MAA2C;QAC7C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAA2B;QACrC,QAAQ;QACR,MAAM,EAAE,YAAY;KACrB,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC7C,CAAC,CAAC,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK;QACvD,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;IAC/F,MAAM,IAAI,GAAG,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC;IACpE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;KACpE,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC;IAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7B,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC;IAChF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAiB,EACjB,QAA4B,EAC5B,IAAqB;IAErB,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC1C,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACpE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,cAAc,CACzB,QAAQ,EACR,MAAM,EACN,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CACxC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,CAAC,iCAAiC,EAAE,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}

package/dist/options.d.ts

@@ -0,0 +1,113 @@
+export declare const JWT_ALGORITHMS: readonly ["HS256", "RS256", "ES256", "EdDSA"];
+export type JwtAlgorithm = typeof JWT_ALGORITHMS[number];
+export type JwtJsonPrimitive = string | number | boolean | null;
+export type JwtJsonValue = JwtJsonPrimitive | readonly JwtJsonValue[] | {
+    readonly [name: string]: JwtJsonValue;
+};
+export interface JwtClaims {
+    readonly [name: string]: JwtJsonValue;
+}
+export interface JwtPublicJwk {
+    readonly kty: string;
+    readonly use?: string;
+    readonly key_ops?: readonly string[];
+    readonly alg?: string;
+    readonly kid?: string;
+    readonly ext?: boolean;
+    readonly n?: string;
+    readonly e?: string;
+    readonly crv?: string;
+    readonly x?: string;
+    readonly y?: string;
+    readonly x5c?: readonly string[];
+    readonly x5t?: string;
+    readonly 'x5t#S256'?: string;
+}
+export type JwtVerificationKey = {
+    readonly type: 'secret';
+    readonly binding: string;
+} | {
+    readonly type: 'jwk';
+    readonly key: JwtPublicJwk;
+} | {
+    readonly type: 'jwks';
+    readonly keys: readonly JwtPublicJwk[];
+};
+export interface JwtVerifyOptions {
+    readonly algorithms: readonly JwtAlgorithm[];
+    readonly key: JwtVerificationKey;
+    readonly issuer?: string | readonly string[];
+    readonly audience?: string | readonly string[];
+    readonly subject?: string;
+    readonly typ?: string;
+    readonly clockToleranceSeconds?: number;
+    readonly maxTokenAgeSeconds?: number;
+    readonly requiredClaims?: readonly string[];
+    readonly claimsSchema?: string;
+}
+export interface NormalizedJwtVerifyOptions {
+    readonly algorithms: readonly JwtAlgorithm[];
+    readonly key: JwtVerificationKey;
+    readonly issuer?: string | readonly string[];
+    readonly audience?: string | readonly string[];
+    readonly subject?: string;
+    readonly typ?: string;
+    readonly clockToleranceSeconds?: number;
+    readonly maxTokenAgeSeconds?: number;
+    readonly requiredClaims?: readonly string[];
+    readonly claimsSchema?: string;
+}
+/**
+ * G0 contract freeze only. G3 owns making these rules executable.
+ *
+ * JWT owns public JWK/JWKS shape and deterministic key selection. The
+ * crypto-owned adapter owns coordinate/signature decoding into fixed bytes.
+ */
+export declare const JWT_ES256_KEY_NORMALIZATION_CONTRACT: Readonly<{
+    readonly version: "pulse.jwt.es256-key-normalization.v1";
+    readonly status: "executable-g3";
+    readonly algorithm: "ES256";
+    readonly inlineJwk: Readonly<{
+        requiredMembers: readonly ["kty", "crv", "x", "y"];
+        optionalMembers: readonly ["alg", "use", "key_ops", "kid"];
+        exactValues: Readonly<{
+            kty: "EC";
+            crv: "P-256";
+            alg: "absent-or-ES256";
+            use: "absent-or-sig";
+            key_ops: "absent-or-exactly-verify";
+        }>;
+        coordinateEncoding: "canonical-unpadded-base64url";
+        coordinateBytes: 32;
+        privateMembersRejected: true;
+        unknownMembersRejected: true;
+        certificateMembersRejected: true;
+    }>;
+    readonly jwks: Readonly<{
+        kind: "bounded-static-inline";
+        entriesMaximum: 16;
+        remoteDiscovery: false;
+        fetch: false;
+        cache: false;
+        refresh: false;
+        duplicateKid: "reject-entire-set";
+        selection: "kid-exact-or-single-eligible-key";
+        selectedKeyFailure: "terminal-no-retry";
+    }>;
+    readonly cryptoAdapter: Readonly<{
+        publicKeyType: "p256-public-key-bytes";
+        publicKeyEncoding: "x-y-big-endian";
+        publicKeyBytes: 64;
+        signatureEncoding: "jose-r-s-big-endian";
+        signatureBytes: 64;
+        derAccepted: false;
+        highS: "accepted-if-otherwise-valid";
+    }>;
+    readonly exactSigningInput: true;
+    readonly claimsBeforeAuthenticity: false;
+    readonly automaticFallback: false;
+}>;
+export declare function normalizeJwtVerifyOptions(value: JwtVerifyOptions): NormalizedJwtVerifyOptions;
+export declare function isJwkCompatibleWithAlgorithm(jwk: JwtPublicJwk, algorithm: JwtAlgorithm): boolean;
+export declare function selectEs256VerificationJwk(key: JwtVerificationKey, kid: string | undefined): JwtPublicJwk;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,cAAc,+CAA+D,CAAC;AAC3F,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAChE,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,SAAS,YAAY,EAAE,GACvB;IAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAAA;CAAE,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAeD;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgDtC,CAAC;AA8PZ,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,0BAA0B,CAiD7F;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,YAAY,GACtB,OAAO,CAET;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,YAAY,CA0Cd"}