@pulse-compute/jwt 1.0.0-beta.4 → 1.0.0-beta.6

package/README.md

@@ -2,20 +2,20 @@
 
 <!-- pulse-package-status:start -->
 > **Support tier:** Supported provider/extension surface<br>
-> **Audience:** Applications verifying bounded JWT bearer credentials through Pulse providers.<br>
-> **Install directly:** Yes, when an application verifies JWTs.<br>
+> **Audience:** Applications verifying JWT credentials and issuing bounded HS256/ES256/RS256 worker tokens through Pulse providers.<br>
+> **Install directly:** Yes, when an application verifies or signs JWTs.<br>
 > **Supported entry points:** `@pulse-compute/jwt`<br>
-> **Stability:** The package root is the supported provider-neutral verification contract; provider and compiler integration subpaths are not application APIs.<br>
+> **Stability:** The package root supports provider-neutral verification and bounded HS256/ES256/RS256 signing; provider and compiler integration subpaths are not application APIs.<br>
 > **npm:** [`@pulse-compute/jwt`](https://www.npmjs.com/package/@pulse-compute/jwt)<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/jwt/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/jwt/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.4` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
-Bounded, provider-neutral JWT verification for Pulse handlers.
+Bounded, provider-neutral JWT verification and HS256/ES256/RS256 signing for Pulse handlers.
 
 This package and `@pulse-compute/crypto` are members of the synchronized
-`1.0.0-beta.4` release catalog.
+`1.0.0-beta.6` release catalog.
 
 Verification is implemented for HS256 in all four sealed target cells. G3 also
 activates ES256 through the crypto-owned signature seam. H4 aligns Node and
@@ -41,7 +41,7 @@ const verified = await jwt.verify(
 )
 ```
 
-ES256 accepts only inline public P-256 JWKs or static JWKS values with at most
+ES256 verification accepts only inline public P-256 JWKs or static JWKS values with at most
 16 entries. Coordinates are canonical unpadded base64url encodings of exactly
 32 bytes. Private and certificate members are rejected; `kid` selection is
 deterministic; duplicate, missing, ambiguous, and unknown selections fail
@@ -53,9 +53,78 @@ claims, captures one wall-clock instant only after authenticity, evaluates
 registered claims before an optional runtime schema, and returns a detached,
 deeply frozen result. It does not authorize application or host behavior.
 
-RS256, EdDSA, signing, remote key authority, custom crypto providers, and
+`jwt.sign(ctx, claims, { algorithm: 'HS256', key: { type: 'secret', binding: 'WORKER_KEY' }, expiresInSeconds: 45 })`
+returns a compact JWT through a request-owned effect. Select `HMAC-SHA256` in
+the crypto profile. The provider resolves a 32–4096 byte secret and captures
+one trusted clock reading; the package supplies `iat` and `exp`. Lifetimes
+are explicit positive safe integers in seconds, and expiration must fit the
+supported Date range. Applications own lifetime policy. Claims are bounded ordinary JSON; caller-supplied `iat`,
+`exp`, and `nbf` are rejected. See the package guide for exact limits and
+Native authoring requirements. Four-target signing fixtures exercise Node and
+Fastly Native/JavaScript; they are not deployed Fastly evidence.
+
+EdDSA, remote key authority, custom crypto providers, and
 automatic fallback remain unavailable. The shared G3 ES256 corpus and
 package-to-crypto composition are recorded in
 `wasm/.test-results/jwt-g3/jwt-g3-evidence.json`; the six-cell target matrix is
 recorded in `wasm/.test-results/boundary-h4/es256-six-cell-matrix.json`. The
 prior four-cell HS256 seal remains historical regression evidence.
+
+ES256 issuance selects `ES256` in both signing options and the crypto profile.
+The named secret contains a UTF-8 JSON private P-256 JWK (`kty`, `crv`, `x`,
+`y`, `d`); the private scalar must match the public point. An optional `kid`
+(up to 256 UTF-8 bytes) is copied into the protected header for key selection.
+Private keys never belong in application options or static JWKS artifacts.
+Native signing uses the revised, reproducibly built RustCrypto guest; JavaScript
+uses Web Crypto. Historical verification seals do not validate the revised
+binary. Current signing fixtures cover all four targets without claiming a
+live deployment or a new aggregate release seal.
+
+
+## RS256 issuance and verification
+
+Select `RS256` in `pulse.crypto` and in `jwt.sign` options. The named secret
+contains a UTF-8 JSON private RSA JWK with `kty: "RSA"`, `n`, `e`, `d`, `p`,
+`q`, `dp`, `dq`, and `qi`. Its total encoded size is at most 4096 bytes.
+Optional metadata is `alg: "RS256"`, `use: "sig"`, `key_ops: ["sign"]`,
+boolean `ext`, and a `kid` of at most 256 UTF-8 bytes. If signing options and
+the secret both carry `kid`, they must agree. Never put private JWKs into
+application source or verification options.
+
+Verification uses `algorithms: ['RS256']` with an inline public JWK or a
+static JWKS of at most 16 entries. Public keys require only `kty`, `n`, and
+`e`; optional `alg`, `use`, `key_ops: ['verify']`, and `kid` follow the same
+policy. Private, certificate, multi-prime (`oth`), and unknown fields are
+rejected. Duplicate `kid` values reject the set; selection is exact by `kid`
+or requires one eligible key. Failure never retries another key.
+
+Supported modulus sizes are exactly 2048, 3072, and 4096 bits, with an odd
+public exponent from 3 through 4294967295. JWK integers use minimal unsigned,
+canonical unpadded base64url. Private keys require two distinct, odd factors
+of half the modulus width with their top bit set. Crypto checks `n = p*q`,
+`d < n`, the two reduced exponents, their relation to `e`, and `q*qi mod p`.
+These checks establish consistency; key generation and primality testing
+remain outside this API.
+
+RS256 means RSASSA-PKCS1-v1_5 with SHA-256. RSA-PSS is not accepted. Signatures
+are exactly 256, 384, or 512 bytes, and original signing input is bounded to
+12288 bytes. Issued claims retain the 8192-byte bound and application-owned
+positive safe-integer lifetime. The provider owns secret lookup and clock
+capture; authenticity precedes claim validation.
+
+Node and Fastly JavaScript use Web Crypto. Both Native providers use the
+pinned BearSSL 0.6 `i31` code in the shared signature guest. Each signer
+verifies its output before returning it. JavaScript uses BigInt to check
+redundant private key fields during import; that validation and the engine's
+key handling have no Pulse constant-time guarantee. Native uses BearSSL's
+constant-time arithmetic design; compiled Wasm timing still depends on the
+engine and CPU. See the Crypto guide for the implementation assumptions.
+
+Native RS256 and ES256 share one linked guest. The current fixed-memory
+linker rejects composition with the allocating SHA-256/HMAC guest; use a
+separate Native artifact or an explicitly selected JavaScript target for
+that combination. Fastly Native also retains one verification algorithm per
+artifact. Signing and verification with RS256 together, issuance alone,
+verification alone, and RS256/ES256 issuance composition are tested through
+the normal CLI build path. Injected Fastly hosts are portable evidence, not
+a deployed-service confirmation or an aggregate release seal.

package/as/index.as.ts

@@ -292,7 +292,7 @@ export function pulse_jwt_fastly_verify(effectIndex: i32, outerHandle: i32): i32
   const algorithmPolicy = __pulse_fastly_value(__pulse_jwt_object_field(policy, "algorithms"))
   if (
     algorithm === null ||
-    (algorithm != "HS256" && algorithm != "ES256") ||
+    (algorithm != "HS256" && algorithm != "ES256" && algorithm != "RS256") ||
     !__pulse_jwt_array_contains(algorithmPolicy, algorithm)
   ) {
     return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_ALGORITHM_NOT_ALLOWED, 212)
@@ -333,7 +333,7 @@ export function pulse_jwt_fastly_verify(effectIndex: i32, outerHandle: i32): i32
   } else {
     const kid = __pulse_jwt_string_member(protectedHeader, "kid")
     key = __pulse_fastly_jwt_resolve_es256_key(effectIndex, kid)
-    if (key === null || key.byteLength != __PULSE_JWT_ES256_PUBLIC_KEY_BYTES) {
+    if (key === null || (algorithm == "ES256" ? key.byteLength != __PULSE_JWT_ES256_PUBLIC_KEY_BYTES : key.byteLength < 8 || key.byteLength != 8 + signature.byteLength)) {
       return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_KEY_INVALID, 216)
     }
   }
@@ -386,3 +386,8 @@ export function pulse_jwt_fastly_verify(effectIndex: i32, outerHandle: i32): i32
   __pulse_fastly_jwt_record_verified()
   return output
 }
+
+export function pulse_jwt_sign(operationRef: i32, invocationRef: i32, resultRef: i32): i32 {
+  void operationRef; void invocationRef; void resultRef
+  return PULSE_JWT_VERIFY_CRYPTO_COMPOSITION_REQUIRED
+}

package/as/sign.as.ts

@@ -0,0 +1,189 @@
+// Package-owned HS256/ES256 issuance. Provider callbacks own secrets, clock and errors;
+// the selected Crypto guest owns signing. No provider SDK or JavaScript fallback.
+class __PulseJwtSignBudget { entries: i32 = 0; code: i32 = 0 }
+
+function __pulse_jwt_sign_validate(handle: i32, depth: i32, budget: __PulseJwtSignBudget): bool {
+  if (++budget.entries > 1024 || depth > 32) { budget.code = __PULSE_JWT_ERROR_LIMIT_EXCEEDED; return false }
+  const value = __pulse_fastly_value(handle)
+  if (value.kind == PULSE_VALUE_NULL || value.kind == PULSE_VALUE_BOOLEAN) return true
+  if (value.kind == PULSE_VALUE_NUMBER && isFinite(value.number)) return true
+  if (value.kind == PULSE_VALUE_STRING) {
+    if (value.text.length > 8192) { budget.code = __PULSE_JWT_ERROR_LIMIT_EXCEEDED; return false }
+    __pulse_fastly_remember_secret(value.text)
+    return true
+  }
+  if (value.kind == PULSE_VALUE_ARRAY || value.kind == PULSE_VALUE_OBJECT) {
+    for (let i = 0; i < value.values.length; i++) {
+      if (value.kind == PULSE_VALUE_OBJECT && unchecked(value.keys[i]).length > 8192) {
+        budget.code = __PULSE_JWT_ERROR_LIMIT_EXCEEDED; return false
+      }
+      if (!__pulse_jwt_sign_validate(unchecked(value.values[i]), depth + 1, budget)) return false
+    }
+    return true
+  }
+  budget.code = __PULSE_JWT_ERROR_CLAIMS_INVALID
+  return false
+}
+
+function __pulse_jwt_base64url_encode(bytes: Uint8Array): string {
+  const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_'
+  let output = ''
+  let accumulator: u32 = 0
+  let bits = 0
+  for (let i = 0; i < bytes.length; i++) {
+    accumulator = (accumulator << 8) | unchecked(bytes[i]); bits += 8
+    while (bits >= 6) { bits -= 6; output += alphabet.charAt((accumulator >> bits) & 63) }
+  }
+  if (bits > 0) output += alphabet.charAt((accumulator << (6 - bits)) & 63)
+  return output
+}
+
+function __pulse_jwt_sign_private_key(encoded: Uint8Array, policy: __PulseFastlyValue): Uint8Array | null {
+  const text = __pulse_jwt_decode_text(encoded)
+  const roundtrip = Uint8Array.wrap(String.UTF8.encode(text, false))
+  let valid = roundtrip.length == encoded.length
+  for (let i = 0; valid && i < encoded.length; i++) if (roundtrip[i] != encoded[i]) valid = false
+  __pulse_jwt_wipe(roundtrip)
+  if (!valid) return null
+  const parser = new __PulseJsonParser(text, true)
+  const handle = parser.parse()
+  if (parser.failed || handle <= 0) return null
+  const jwk = __pulse_fastly_value(handle)
+  if (jwk.kind != PULSE_VALUE_OBJECT) return null
+  const rsa = __pulse_jwt_string_member(policy, 'algorithm') == 'RS256'
+  const allowed = rsa ? ['kty', 'n', 'e', 'd', 'p', 'q', 'dp', 'dq', 'qi', 'alg', 'use', 'key_ops', 'kid', 'ext'] : ['kty', 'crv', 'x', 'y', 'd', 'alg', 'use', 'key_ops', 'kid', 'ext']
+  for (let i = 0; i < jwk.keys.length; i++) if (allowed.indexOf(jwk.keys[i]) < 0) return null
+  if (rsa ? __pulse_jwt_string_member(jwk, 'kty') != 'RSA' : (__pulse_jwt_string_member(jwk, 'kty') != 'EC' || __pulse_jwt_string_member(jwk, 'crv') != 'P-256')) return null
+  if (__pulse_jwt_has_field(jwk, 'alg') && __pulse_jwt_string_member(jwk, 'alg') != (rsa ? 'RS256' : 'ES256')) return null
+  if (__pulse_jwt_has_field(jwk, 'use') && __pulse_jwt_string_member(jwk, 'use') != 'sig') return null
+  if (__pulse_jwt_has_field(jwk, 'ext') && __pulse_fastly_value(__pulse_jwt_object_field(jwk, 'ext')).kind != PULSE_VALUE_BOOLEAN) return null
+  if (__pulse_jwt_has_field(jwk, 'key_ops')) {
+    const ops = __pulse_fastly_value(__pulse_jwt_object_field(jwk, 'key_ops'))
+    if (ops.kind != PULSE_VALUE_ARRAY || ops.values.length != 1 || !__pulse_jwt_array_contains(ops, 'sign')) return null
+  }
+  if (__pulse_jwt_has_field(jwk, 'kid')) {
+    const kid = __pulse_jwt_string_member(jwk, 'kid')
+    if (kid === null || kid.length == 0 || kid.indexOf(String.fromCharCode(0)) >= 0 || String.UTF8.byteLength(kid) > 256) return null
+    if (__pulse_jwt_has_field(policy, 'kid') && __pulse_jwt_string_member(policy, 'kid') != kid) return null
+  }
+  if (rsa) return __pulse_jwt_rsa_private_bytes(jwk)
+  const names = ['x', 'y', 'd']
+  const output = new Uint8Array(96)
+  for (let i = 0; i < 3; i++) {
+    const value = __pulse_jwt_string_member(jwk, names[i])
+    if (value === null || value.length != 43) { __pulse_jwt_wipe(output); return null }
+    __pulse_fastly_remember_secret(value)
+    const decoded = __pulse_jwt_base64url_decode(value)
+    if (decoded === null) { __pulse_jwt_wipe(output); return null }
+    if (decoded.length != 32) { __pulse_jwt_wipe(decoded); __pulse_jwt_wipe(output); return null }
+    memory.copy(output.dataStart + i * 32, decoded.dataStart, 32)
+    __pulse_jwt_wipe(decoded)
+  }
+  return output
+}
+
+export function pulse_jwt_fastly_sign(effectIndex: i32, outerHandle: i32): i32 {
+  const outer = __pulse_fastly_value(outerHandle)
+  const policy = __pulse_fastly_value(__pulse_jwt_object_field(outer, 'payload'))
+  const invocation = __pulse_fastly_value(__pulse_jwt_object_field(outer, 'invocation'))
+  const claimsHandle = __pulse_jwt_object_field(invocation, 'claims')
+  const claims = __pulse_fastly_value(claimsHandle)
+  const lifetime = __pulse_jwt_numeric_claim(policy, 'expiresInSeconds')
+  const algorithm = __pulse_jwt_string_member(policy, 'algorithm')
+  const kid = __pulse_jwt_string_member(policy, 'kid')
+  if (__pulse_jwt_has_field(policy, 'kid') && (kid === null || kid.length == 0 || kid.indexOf(String.fromCharCode(0)) >= 0 || String.UTF8.byteLength(kid) > 256)) {
+    return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_KEY_INVALID, 249)
+  }
+  if ((algorithm != 'HS256' && algorithm != 'ES256' && algorithm != 'RS256') || !isFinite(lifetime)
+    || Math.floor(lifetime) != lifetime || lifetime < 1 || lifetime > 9007199254740991.0) {
+    return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_OPERATION_FAILED, 240)
+  }
+  if (claims.kind != PULSE_VALUE_OBJECT || __pulse_jwt_has_field(claims, 'iat')
+    || __pulse_jwt_has_field(claims, 'exp') || __pulse_jwt_has_field(claims, 'nbf')) {
+    return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_CLAIMS_INVALID, 241)
+  }
+  const budget = new __PulseJwtSignBudget()
+  if (!__pulse_jwt_sign_validate(claimsHandle, 0, budget)) return __pulse_jwt_fail(effectIndex, budget.code, 242)
+  if (String.UTF8.byteLength(__pulse_fastly_json(claimsHandle, 0)) > 8192) {
+    return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_LIMIT_EXCEEDED, 243)
+  }
+  let key = __pulse_fastly_jwt_resolve_secret(effectIndex)
+  if (key.length < 32 || key.length > 4096) {
+    __pulse_jwt_wipe(key)
+    return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_KEY_INVALID, 244)
+  }
+  if (algorithm != 'HS256') {
+    const decoded = __pulse_jwt_sign_private_key(key, policy)
+    __pulse_jwt_wipe(key)
+    if (decoded === null) return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_KEY_INVALID, 249)
+    key = decoded
+  }
+  const captured = __pulse_fastly_jwt_capture_clock(effectIndex)
+  const now = Math.floor(captured)
+  if (!isFinite(captured) || captured < 0 || captured > 8640000000000.0) {
+    __pulse_jwt_wipe(key)
+    return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_CLOCK_INVALID, 245)
+  }
+  if (now > 8640000000000.0 - lifetime) {
+    __pulse_jwt_wipe(key)
+    return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_OPERATION_FAILED, 248)
+  }
+  const issued = host_value_object()
+  for (let i = 0; i < claims.keys.length; i++) {
+    host_value_object_set(issued, __pulse_fastly_string_value(unchecked(claims.keys[i])), unchecked(claims.values[i]))
+  }
+  host_value_object_set(issued, __pulse_fastly_string_value('iat'), host_value_number(now))
+  host_value_object_set(issued, __pulse_fastly_string_value('exp'), host_value_number(now + lifetime))
+  const text = __pulse_fastly_json(issued, 0)
+  if (String.UTF8.byteLength(text) > 8192) {
+    __pulse_jwt_wipe(key)
+    return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_LIMIT_EXCEEDED, 246)
+  }
+  __pulse_fastly_remember_secret(text)
+  const header = host_value_object()
+  host_value_object_set(header, __pulse_fastly_string_value('alg'), __pulse_fastly_string_value(algorithm!))
+  host_value_object_set(header, __pulse_fastly_string_value('typ'), __pulse_fastly_string_value('JWT'))
+  if (kid !== null) host_value_object_set(header, __pulse_fastly_string_value('kid'), __pulse_fastly_string_value(kid))
+  const input = __pulse_jwt_base64url_encode(Uint8Array.wrap(String.UTF8.encode(__pulse_fastly_json(header, 0), false))) + '.' + __pulse_jwt_base64url_encode(Uint8Array.wrap(String.UTF8.encode(text, false)))
+  const data = Uint8Array.wrap(String.UTF8.encode(input, false))
+  const tag = new Uint8Array(algorithm == 'RS256' ? i32(load<u32>(key.dataStart)) : algorithm == 'ES256' ? 64 : 32)
+  const status = __pulse_fastly_jwt_crypto_sign(algorithm!, key, data, tag)
+  __pulse_jwt_wipe(key); __pulse_jwt_wipe(data)
+  if (status == -1) { __pulse_jwt_wipe(tag); return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_KEY_INVALID, 249) }
+  if (status != 1) { __pulse_jwt_wipe(tag); return __pulse_jwt_fail(effectIndex, __PULSE_JWT_ERROR_OPERATION_FAILED, 247) }
+  const signature = __pulse_jwt_base64url_encode(tag)
+  __pulse_jwt_wipe(tag)
+  const token = input + '.' + signature
+  __pulse_fastly_remember_secret(signature); __pulse_fastly_remember_secret(token)
+  return __pulse_fastly_string_value(token)
+}
+
+
+function __pulse_jwt_rsa_integer(jwk: __PulseFastlyValue, name: string, maximum: i32): Uint8Array | null {
+  const value = __pulse_jwt_string_member(jwk, name)
+  if (value === null || value.length > (maximum * 4 + 2) / 3) return null
+  __pulse_fastly_remember_secret(value)
+  const decoded = __pulse_jwt_base64url_decode(value)
+  if (decoded === null) return null
+  if (decoded.length == 0 || decoded.length > maximum || decoded[0] == 0) { __pulse_jwt_wipe(decoded); return null }
+  return decoded
+}
+function __pulse_jwt_rsa_private_bytes(jwk: __PulseFastlyValue): Uint8Array | null {
+  const n = __pulse_jwt_rsa_integer(jwk, 'n', 512)
+  if (n === null) return null
+  const k = n.length
+  if ((k != 256 && k != 384 && k != 512) || n[0] < 128 || (n[k-1] & 1) == 0) { __pulse_jwt_wipe(n); return null }
+  const output = new Uint8Array(8 + k * 9 / 2)
+  store<u32>(output.dataStart, k)
+  memory.copy(output.dataStart + 4, n.dataStart, k); __pulse_jwt_wipe(n)
+  const names = ['e', 'd', 'p', 'q', 'dp', 'dq', 'qi']
+  let offset = 4 + k
+  for (let i = 0; i < names.length; i++) {
+    const width = i == 0 ? 4 : i == 1 ? k : k / 2
+    const bytes = __pulse_jwt_rsa_integer(jwk, names[i], width)
+    if (bytes === null) { __pulse_jwt_wipe(output); return null }
+    memory.copy(output.dataStart + offset + width - bytes.length, bytes.dataStart, bytes.length)
+    offset += width; __pulse_jwt_wipe(bytes)
+  }
+  return output
+}

package/dist/crypto-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto-verifier.d.ts","sourceRoot":"","sources":["../src/crypto-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAE7B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,cAAc,CAAC;AACtB,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAiB7E,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,kCAAkC,CAAC;AAE1C,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEtD,MAAM,WAAW,qBAAsB,SAAQ,eAAe;CAAG;AAEjE,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,gBAAgB,KACtB,wBAAwB,GAAG,WAAW,CAAC,wBAAwB,CAAC,CAAC;AAEtE,MAAM,MAAM,wBAAwB,GAAG,CACrC,OAAO,EAAE,sBAAsB,KAC5B,wBAAwB,GAAG,WAAW,CAAC,wBAAwB,CAAC,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;KACrC,CAAC,CAAC;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;KAC3C,CAAC,CAAC;CACJ;AA8HD,wBAAsB,mBAAmB,CAAC,MAAM,GAAG,SAAS,EAC1D,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,EAC3B,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CA2GlC"}
+{"version":3,"file":"crypto-verifier.d.ts","sourceRoot":"","sources":["../src/crypto-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,wBAAwB,EAE7B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAIL,KAAK,SAAS,EAEf,MAAM,cAAc,CAAC;AACtB,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAiB7E,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,kCAAkC,CAAC;AAE1C,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEtD,MAAM,WAAW,qBAAsB,SAAQ,eAAe;CAAG;AAEjE,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,gBAAgB,KACtB,wBAAwB,GAAG,WAAW,CAAC,wBAAwB,CAAC,CAAC;AAEtE,MAAM,MAAM,wBAAwB,GAAG,CACrC,OAAO,EAAE,sBAAsB,KAC5B,wBAAwB,GAAG,WAAW,CAAC,wBAAwB,CAAC,CAAC;AAEtE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;KACrC,CAAC,CAAC;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;KAC3C,CAAC,CAAC;CACJ;AA8HD,wBAAsB,mBAAmB,CAAC,MAAM,GAAG,SAAS,EAC1D,KAAK,EAAE,sBAAsB,EAC7B,IAAI,EAAE,qBAAqB,EAC3B,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CA8GlC"}

package/dist/crypto-verifier.js

@@ -1,6 +1,6 @@
-import { CRYPTO_VERIFICATION_STATUSES, normalizeEs256JoseVerifyRequest, } from '@pulse-compute/crypto';
+import { CRYPTO_VERIFICATION_STATUSES, normalizeEs256JoseVerifyRequest, normalizeRs256JoseVerifyRequest, } from '@pulse-compute/crypto';
 import { isJwtError, jwtError } from './errors.js';
-import { normalizeJwtVerifyOptions, selectEs256VerificationJwk, } from './options.js';
+import { normalizeJwtVerifyOptions, selectSignatureVerificationJwk, } from './options.js';
 import { normalizeJwtVerification } from './result.js';
 import { compactJwtParts, compactJwtSignatureInput, parseVerifiedClaims, preflightCompactJwt, protectedAlgorithm, protectedHeaderString, } from './token.js';
 import { captureJwtCurrentDate } from './internal/clock.js';
@@ -161,11 +161,14 @@ export async function verifyJwtWithCrypto(input, host, crypto) {
                 keyBytes.fill(0);
             }
         }
-        else if (selectedAlgorithm === 'ES256') {
+        else if (selectedAlgorithm === 'ES256' || selectedAlgorithm === 'RS256') {
             const verifySignature = cryptoSignatureVerify(crypto);
-            const selectedJwk = selectEs256VerificationJwk(options.key, kid);
+            const selectedJwk = selectSignatureVerificationJwk(options.key, kid, selectedAlgorithm);
             const compact = compactJwtParts(token);
-            const normalized = normalizeEs256JoseVerifyRequest({
+            const normalized = selectedAlgorithm === 'RS256' ? normalizeRs256JoseVerifyRequest({
+                key: { n: selectedJwk.n, e: selectedJwk.e },
+                data: compact.signingInput, signature: compact.signatureSegment,
+            }) : normalizeEs256JoseVerifyRequest({
                 key: {
                     x: selectedJwk.x,
                     y: selectedJwk.y,

package/dist/crypto-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto-verifier.js","sourceRoot":"","sources":["../src/crypto-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,GAKhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAI3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,wBAAwB,EAAwB,MAAM,aAAa,CAAC;AAC7E,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GAGrB,MAAM,kCAAkC,CAAC;AAuB1C,SAAS,eAAe,CACtB,MAAyB;IAEzB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,OAAO,cAAc,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACnG,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,cAAc,CAAC,KAA2B,CAAC;AACpD,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAyB;IAEzB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,IACE,CAAC,iBAAiB,CAAC,KAAK;WACrB,CAAC,iBAAiB,CAAC,OAAO;WAC1B,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAChD,CAAC;QACD,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7E,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,OAAO,cAAc,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACnG,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,cAAc,CAAC,KAAiC,CAAC;AAC1D,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ;WAC3B,4BAAkD,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvE,CAAC,CAAC,MAAkC;QACpC,CAAC,CAAC,qBAAqB,CAAC;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAgC;IAC5D,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO;IAC/B,IAAI,MAAM,KAAK,uBAAuB,EAAE,CAAC;QACvC,MAAM,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,CAAC,4BAA4B,EAAE;QAC3C,QAAQ,EAAE,oBAAoB;QAC9B,iBAAiB,EAAE,KAAK;KACzB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAuB,EACvB,SAAuB,EACvB,IAA2B;IAE3B,IAAI,SAAS,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAoC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ;QACxC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACpC,CAAC,CAAC,QAAQ,YAAY,UAAU;YAC9B,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;YAC1B,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC;QACH,iBAAiB,CAAC,IAAI,EAAE,QAA+B,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA2B;IAE3B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC3D,IACE,CAAC,KAAK,CAAC,KAAK;WACT,CACD,KAAK,CAAC,OAAO;eACV,KAAK,CAAC,KAAK,KAAK,SAAS;eACzB,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU,CACrC,EACD,CAAC;QACD,MAAM,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,qBAAqB,CAC1B,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;QAC/B,CAAC,CAAC,KAAK,CAAC,KAAkD;QAC1D,CAAC,CAAC,SAAS,CACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA6B,EAC7B,IAA2B,EAC3B,MAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAE9D,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAA2B,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,yBAAyB,CAAC,YAAiD,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAChE,IAAI,SAAS,KAAK,MAAM,IAAI,CAAE,OAAO,CAAC,UAAgC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3F,MAAM,QAAQ,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,iBAAiB,GAAG,SAAyB,CAAC;QACpD,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YACrD,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,YAAqB,CAAC;QAC1B,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAe,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;wBAC3C,SAAS,EAAE,OAAO;wBAClB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;4BACjB,IAAI,EAAE,gBAAgB;4BACtB,KAAK,EAAE,QAAQ;yBAChB,CAAC;wBACF,IAAI,EAAE,OAAO,CAAC,YAAY;wBAC1B,GAAG,EAAE,OAAO,CAAC,SAAS;qBACvB,CAAC,CAAC,CAAC;gBACN,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,QAAQ,CAAC,4BAA4B,EAAE;wBAC3C,QAAQ,EAAE,qBAAqB;wBAC/B,iBAAiB,EAAE,KAAK;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YACzC,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,WAAW,GAAG,0BAA0B,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAe,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,+BAA+B,CAAC;gBACjD,GAAG,EAAE;oBACH,CAAC,EAAE,WAAW,CAAC,CAAW;oBAC1B,CAAC,EAAE,WAAW,CAAC,CAAW;iBAC3B;gBACD,IAAI,EAAE,OAAO,CAAC,YAAY;gBAC1B,SAAS,EAAE,OAAO,CAAC,gBAAgB;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,oBAAoB,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/C,MAAM,QAAQ,CAAC,4BAA4B,EAAE;oBAC3C,QAAQ,EAAE,sBAAsB;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC3D,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,QAAQ,CAAC,4BAA4B,EAAE;wBAC3C,QAAQ,EAAE,qBAAqB;wBAC/B,iBAAiB,EAAE,KAAK;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,iCAAiC,EAAE;gBAChD,QAAQ,EAAE,qBAAqB;aAChC,CAAC,CAAC;QACL,CAAC;QACD,oBAAoB,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC9C,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACnD,wBAAwB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CACjD,MAAM,EACN,OAAO,CAAC,YAAY,EACpB,IAAI,CACL,CAAC;QACF,IAAI,gBAAgB,KAAK,MAAM;YAAE,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC9E,OAAO,wBAAwB,CAAS;YACtC,MAAM,EAAE,gBAAgB;YACxB,eAAe,EAAE;gBACf,GAAG,EAAE,iBAAiB;gBACtB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;gBACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;aACtC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACnC,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}
+{"version":3,"file":"crypto-verifier.js","sourceRoot":"","sources":["../src/crypto-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,+BAA+B,GAKhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAI/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,wBAAwB,EAAwB,MAAM,aAAa,CAAC;AAC7E,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,GAGrB,MAAM,kCAAkC,CAAC;AAuB1C,SAAS,eAAe,CACtB,MAAyB;IAEzB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,OAAO,cAAc,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACnG,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,cAAc,CAAC,KAA2B,CAAC;AACpD,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAyB;IAEzB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClE,IACE,CAAC,iBAAiB,CAAC,KAAK;WACrB,CAAC,iBAAiB,CAAC,OAAO;WAC1B,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAChD,CAAC;QACD,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,cAAc,GAAG,kBAAkB,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7E,IAAI,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,OAAO,cAAc,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACnG,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,cAAc,CAAC,KAAiC,CAAC;AAC1D,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC9D,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,OAAO,MAAM,KAAK,QAAQ;WAC3B,4BAAkD,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvE,CAAC,CAAC,MAAkC;QACpC,CAAC,CAAC,qBAAqB,CAAC;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAgC;IAC5D,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO;IAC/B,IAAI,MAAM,KAAK,uBAAuB,EAAE,CAAC;QACvC,MAAM,QAAQ,CAAC,6BAA6B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,MAAM,QAAQ,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,QAAQ,CAAC,4BAA4B,EAAE;QAC3C,QAAQ,EAAE,oBAAoB;QAC9B,iBAAiB,EAAE,KAAK;KACzB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAuB,EACvB,SAAuB,EACvB,IAA2B;IAE3B,IAAI,SAAS,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,QAAQ,CAAC,8BAA8B,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,OAAO,CAAoC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ;QACxC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACpC,CAAC,CAAC,QAAQ,YAAY,UAAU;YAC9B,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;YAC1B,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,CAAC,uBAAuB,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC;QACH,iBAAiB,CAAC,IAAI,EAAE,QAA+B,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAA2B;IAE3B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC3D,IACE,CAAC,KAAK,CAAC,KAAK;WACT,CACD,KAAK,CAAC,OAAO;eACV,KAAK,CAAC,KAAK,KAAK,SAAS;eACzB,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU,CACrC,EACD,CAAC;QACD,MAAM,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,qBAAqB,CAC1B,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;QAC/B,CAAC,CAAC,KAAK,CAAC,KAAkD;QAC1D,CAAC,CAAC,SAAS,CACd,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA6B,EAC7B,IAA2B,EAC3B,MAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAE9D,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAA2B,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,yBAAyB,CAAC,YAAiD,CAAC,CAAC;QAC7F,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAChE,IAAI,SAAS,KAAK,MAAM,IAAI,CAAE,OAAO,CAAC,UAAgC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3F,MAAM,QAAQ,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,iBAAiB,GAAG,SAAyB,CAAC;QACpD,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACpE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YACrD,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,YAAqB,CAAC;QAC1B,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAe,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;wBAC3C,SAAS,EAAE,OAAO;wBAClB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;4BACjB,IAAI,EAAE,gBAAgB;4BACtB,KAAK,EAAE,QAAQ;yBAChB,CAAC;wBACF,IAAI,EAAE,OAAO,CAAC,YAAY;wBAC1B,GAAG,EAAE,OAAO,CAAC,SAAS;qBACvB,CAAC,CAAC,CAAC;gBACN,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,QAAQ,CAAC,4BAA4B,EAAE;wBAC3C,QAAQ,EAAE,qBAAqB;wBAC/B,iBAAiB,EAAE,KAAK;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,iBAAiB,KAAK,OAAO,IAAI,iBAAiB,KAAK,OAAO,EAAE,CAAC;YAC1E,MAAM,eAAe,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,WAAW,GAAG,8BAA8B,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,eAAe,CAAC,KAAe,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,+BAA+B,CAAC;gBACjF,GAAG,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,CAAW,EAAE,CAAC,EAAE,WAAW,CAAC,CAAW,EAAE;gBAC/D,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,gBAAgB;aAChE,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC;gBACnC,GAAG,EAAE;oBACH,CAAC,EAAE,WAAW,CAAC,CAAW;oBAC1B,CAAC,EAAE,WAAW,CAAC,CAAW;iBAC3B;gBACD,IAAI,EAAE,OAAO,CAAC,YAAY;gBAC1B,SAAS,EAAE,OAAO,CAAC,gBAAgB;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,oBAAoB,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/C,MAAM,QAAQ,CAAC,4BAA4B,EAAE;oBAC3C,QAAQ,EAAE,sBAAsB;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC;oBACH,YAAY,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC3D,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,QAAQ,CAAC,4BAA4B,EAAE;wBAC3C,QAAQ,EAAE,qBAAqB;wBAC/B,iBAAiB,EAAE,KAAK;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,CAAC,iCAAiC,EAAE;gBAChD,QAAQ,EAAE,qBAAqB;aAChC,CAAC,CAAC;QACL,CAAC;QACD,oBAAoB,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC9C,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACnD,wBAAwB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CACjD,MAAM,EACN,OAAO,CAAC,YAAY,EACpB,IAAI,CACL,CAAC;QACF,IAAI,gBAAgB,KAAK,MAAM;YAAE,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAC9E,OAAO,wBAAwB,CAAS;YACtC,MAAM,EAAE,gBAAgB;YACxB,eAAe,EAAE;gBACf,GAAG,EAAE,iBAAiB;gBACtB,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;gBACrC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;aACtC;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACnC,MAAM,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -3,6 +3,8 @@ import { bearer } from './bearer.js';
 import { JwtError, JWT_ERROR_CODES } from './errors.js';
 import { type JwtClaims, type JwtVerifyOptions } from './options.js';
 import { type JwtVerification } from './result.js';
+import { type JwtSignOptions } from './sign.js';
+export type { JwtSignOptions } from './sign.js';
 export { bearer, JwtError, JWT_ERROR_CODES };
 export type { JwtErrorCode, JwtErrorDetailValue, } from './errors.js';
 export type { JwtAlgorithm, JwtClaims, JwtJsonPrimitive, JwtJsonValue, JwtPublicJwk, JwtVerificationKey, JwtVerifyOptions, } from './options.js';
@@ -11,9 +13,11 @@ export declare function verify<Claims>(ctx: PulseContext, token: string | undefi
     readonly claimsSchema: string;
 }): PulseParallelEffect<JwtVerification<Claims>>;
 export declare function verify(ctx: PulseContext, token: string | undefined, options: JwtVerifyOptions): PulseParallelEffect<JwtVerification<JwtClaims>>;
+export declare function sign(ctx: PulseContext, claims: JwtClaims, options: JwtSignOptions): PulseParallelEffect<string>;
 export declare const jwt: Readonly<{
     bearer: typeof bearer;
     verify: typeof verify;
+    sign: typeof sign;
 }>;
 export default jwt;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AAC7C,YAAY,EACV,YAAY,EACZ,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,wBAAgB,MAAM,CAAC,MAAM,EAC3B,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,gBAAgB,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5D,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,wBAAgB,MAAM,CACpB,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,gBAAgB,GACxB,mBAAmB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;AAmBnD,eAAO,MAAM,GAAG;;;EAGd,CAAC;AAEH,eAAe,GAAG,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAA0E,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AACxH,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AAC7C,YAAY,EACV,YAAY,EACZ,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB,wBAAgB,MAAM,CAAC,MAAM,EAC3B,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,gBAAgB,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5D,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,wBAAgB,MAAM,CACpB,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,gBAAgB,GACxB,mBAAmB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;AAmBnD,wBAAgB,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAM/G;AAED,eAAO,MAAM,GAAG;;;;EAId,CAAC;AAEH,eAAe,GAAG,CAAC"}

package/dist/index.js

@@ -4,6 +4,7 @@ import { normalizeJwtVerifyOptions, } from './options.js';
 import { normalizeJwtVerification, } from './result.js';
 import { preflightCompactJwt } from './token.js';
 import { pulseJwtRuntime } from './internal/package-runtime.js';
+import { normalizeJwtSignClaims, normalizeJwtSignOptions, normalizeJwtSignature } from './sign.js';
 export { bearer, JwtError, JWT_ERROR_CODES };
 export function verify(ctx, token, options) {
     preflightCompactJwt(token);
@@ -13,9 +14,17 @@ export function verify(ctx, token, options) {
         options: normalized,
     }, (value) => normalizeJwtVerification(value));
 }
+export function sign(ctx, claims, options) {
+    const normalized = normalizeJwtSignOptions(options);
+    return pulseJwtRuntime.effect(ctx, 'sign', {
+        claims: normalizeJwtSignClaims(claims),
+        options: normalized,
+    }, value => normalizeJwtSignature(value, normalized));
+}
 export const jwt = Object.freeze({
     bearer,
     verify,
+    sign,
 });
 export default jwt;
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,yBAAyB,GAG1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,GAEzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AA8B7C,MAAM,UAAU,MAAM,CACpB,GAAiB,EACjB,KAAyB,EACzB,OAAyB;IAEzB,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,eAAe,CAAC,MAAM,CAC3B,GAAG,EACH,QAAQ,EACR;QACE,KAAK,EAAE,KAAe;QACtB,OAAO,EAAE,UAAU;KACpB,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,eAAe,GAAG,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,yBAAyB,GAG1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,GAEzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,qBAAqB,EAAuB,MAAM,WAAW,CAAC;AAGxH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;AA8B7C,MAAM,UAAU,MAAM,CACpB,GAAiB,EACjB,KAAyB,EACzB,OAAyB;IAEzB,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,eAAe,CAAC,MAAM,CAC3B,GAAG,EACH,QAAQ,EACR;QACE,KAAK,EAAE,KAAe;QACtB,OAAO,EAAE,UAAU;KACpB,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAiB,EAAE,MAAiB,EAAE,OAAuB;IAChF,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE;QACzC,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC;QACtC,OAAO,EAAE,UAAU;KACpB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM;IACN,MAAM;IACN,IAAI;CACL,CAAC,CAAC;AAEH,eAAe,GAAG,CAAC"}

package/dist/internal/package-runtime.d.ts

@@ -1,5 +1,10 @@
 import packageRuntime from '@pulse-compute/runtime/package';
 export declare const pulseJwtRuntime: packageRuntime.PulsePackageRuntime<{
+    readonly sign: {
+        readonly kind: "jwt.sign";
+        readonly capability: "jwt.sign";
+        readonly result: "string";
+    };
     readonly verify: {
         readonly kind: "jwt.verify";
         readonly capability: "jwt.verify";

package/dist/internal/package-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package-runtime.d.ts","sourceRoot":"","sources":["../../src/internal/package-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,gCAAgC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;EAWjB,CAAC"}
+{"version":3,"file":"package-runtime.d.ts","sourceRoot":"","sources":["../../src/internal/package-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,gCAAgC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;;;;;;EAYjB,CAAC"}

package/dist/internal/package-runtime.js

@@ -4,6 +4,7 @@ export const pulseJwtRuntime = packageRuntime.createPackageRuntime({
     contractId: 'pulse.jwt',
     providerKind: 'jwt',
     operations: {
+        sign: { kind: 'jwt.sign', capability: 'jwt.sign', result: 'string' },
         verify: {
             kind: 'jwt.verify',
             capability: 'jwt.verify',

package/dist/internal/package-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"package-runtime.js","sourceRoot":"","sources":["../../src/internal/package-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,gCAAgC,CAAC;AAE5D,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAC,oBAAoB,CAAC;IACjE,OAAO,EAAE,oBAAoB;IAC7B,UAAU,EAAE,WAAW;IACvB,YAAY,EAAE,KAAK;IACnB,UAAU,EAAE;QACV,MAAM,EAAE;YACN,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,kBAAkB;SAC3B;KACF;CACO,CAAC,CAAC"}
+{"version":3,"file":"package-runtime.js","sourceRoot":"","sources":["../../src/internal/package-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,gCAAgC,CAAC;AAE5D,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAC,oBAAoB,CAAC;IACjE,OAAO,EAAE,oBAAoB;IAC7B,UAAU,EAAE,WAAW;IACvB,YAAY,EAAE,KAAK;IACnB,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;QACpE,MAAM,EAAE;YACN,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,kBAAkB;SAC3B;KACF;CACO,CAAC,CAAC"}

package/dist/options.d.ts

@@ -110,4 +110,5 @@ export declare const JWT_ES256_KEY_NORMALIZATION_CONTRACT: Readonly<{
 export declare function normalizeJwtVerifyOptions(value: JwtVerifyOptions): NormalizedJwtVerifyOptions;
 export declare function isJwkCompatibleWithAlgorithm(jwk: JwtPublicJwk, algorithm: JwtAlgorithm): boolean;
 export declare function selectEs256VerificationJwk(key: JwtVerificationKey, kid: string | undefined): JwtPublicJwk;
+export declare function selectSignatureVerificationJwk(key: JwtVerificationKey, kid: string | undefined, algorithm: 'ES256' | 'RS256'): JwtPublicJwk;
 //# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,cAAc,+CAA+D,CAAC;AAC3F,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAChE,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,SAAS,YAAY,EAAE,GACvB;IAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAAA;CAAE,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAeD;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgDtC,CAAC;AA8PZ,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,0BAA0B,CAiD7F;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,YAAY,GACtB,OAAO,CAET;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,YAAY,CA0Cd"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,cAAc,+CAA+D,CAAC;AAC3F,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;AAChE,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,SAAS,YAAY,EAAE,GACvB;IAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAAA;CAAE,CAAC;AAE9C,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;CAC5B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;CACxC,CAAC;AAEN,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAeD;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgDtC,CAAC;AAgQZ,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,0BAA0B,CAiD7F;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,YAAY,GACtB,OAAO,CAET;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAEzG;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,GAC7E,YAAY,CA0Cd"}

package/dist/options.js

@@ -1,3 +1,4 @@
+import { normalizeRsaPublicKey } from '@pulse-compute/crypto';
 import { normalizeP256PublicKeyCoordinates } from '@pulse-compute/crypto';
 import { jwtError } from './errors.js';
 import { jwtDataRecord, jwtDenseArrayValues, } from './internal/data.js';
@@ -173,9 +174,8 @@ function normalizePublicJwk(value) {
         throw jwtError('PULSE_JWT_KEY_INVALID', { category: 'key' });
     const declaredType = record.get('kty');
     if ([...record.keys()].some((key) => PRIVATE_JWK_MEMBERS.includes(key))
-        || [...record.keys()].some((key) => (declaredType === 'EC'
-            ? !ES256_JWK_MEMBERS.has(key)
-            : !JWK_MEMBERS.has(key)))) {
+        || [...record.keys()].some((key) => (declaredType === 'RSA' ? !new Set(['kty', 'n', 'e', 'alg', 'use', 'key_ops', 'kid']).has(key)
+            : declaredType === 'EC' ? !ES256_JWK_MEMBERS.has(key) : !JWK_MEMBERS.has(key)))) {
         throw jwtError('PULSE_JWT_KEY_INVALID', { category: 'key' });
     }
     const kty = nonEmptyString(record.get('kty'), 'key');
@@ -206,8 +206,13 @@ function normalizePublicJwk(value) {
         throw jwtError('PULSE_JWT_KEY_INVALID', { category: 'key' });
     }
     if (kty === 'RSA') {
-        nonEmptyString(output.n, 'key');
-        nonEmptyString(output.e, 'key');
+        if (typeof output.kid === 'string' && new TextEncoder().encode(output.kid).length > 256)
+            throw jwtError('PULSE_JWT_KEY_INVALID', { category: 'key-kid' });
+        const n = nonEmptyString(output.n, 'key'), e = nonEmptyString(output.e, 'key');
+        const normalized = normalizeRsaPublicKey({ n, e });
+        if (!normalized.ok || output.alg !== undefined && output.alg !== 'RS256')
+            throw jwtError('PULSE_JWT_KEY_INVALID', { category: 'key-rsa' });
+        normalized.key.bytes.fill(0);
     }
     else if (kty === 'EC') {
         if (output.crv !== 'P-256')
@@ -341,13 +346,16 @@ export function isJwkCompatibleWithAlgorithm(jwk, algorithm) {
     return compatibleAlgorithm(jwk, algorithm);
 }
 export function selectEs256VerificationJwk(key, kid) {
+    return selectSignatureVerificationJwk(key, kid, 'ES256');
+}
+export function selectSignatureVerificationJwk(key, kid, algorithm) {
     if (key.type === 'secret') {
         throw jwtError('PULSE_JWT_KEY_INVALID', {
             category: 'algorithm-key-mismatch',
         });
     }
     if (key.type === 'jwk') {
-        if (!compatibleAlgorithm(key.key, 'ES256')) {
+        if (!compatibleAlgorithm(key.key, algorithm)) {
             throw jwtError('PULSE_JWT_KEY_INVALID', {
                 category: 'algorithm-key-mismatch',
             });
@@ -364,14 +372,14 @@ export function selectEs256VerificationJwk(key, kid) {
                 category: selected.length === 0 ? 'unknown-kid' : 'duplicate-kid',
             });
         }
-        if (!compatibleAlgorithm(selected[0], 'ES256')) {
+        if (!compatibleAlgorithm(selected[0], algorithm)) {
             throw jwtError('PULSE_JWT_KEY_INVALID', {
                 category: 'algorithm-key-mismatch',
             });
         }
         return selected[0];
     }
-    const eligible = key.keys.filter((entry) => (compatibleAlgorithm(entry, 'ES256')));
+    const eligible = key.keys.filter((entry) => (compatibleAlgorithm(entry, algorithm)));
     if (eligible.length !== 1) {
         throw jwtError('PULSE_JWT_KEY_INVALID', {
             category: eligible.length === 0 ? 'missing-kid' : 'ambiguous-key',