@saurbit/oauth2-jwt 0.1.0

package/esm/jwks_rotator.js

@@ -0,0 +1,54 @@
+/**
+ * Manages automatic JWKS key rotation based on a configurable interval.
+ *
+ * Call {@link JwksRotator.checkAndRotateKeys} at service startup and/or on a
+ * recurring schedule (e.g. every hour) to ensure that signing keys are rotated
+ * before they expire. During rotation the previous public key remains available
+ * in the JWKS until its TTL expires, so in-flight tokens continue to verify correctly.
+ */
+export class JwksRotator {
+    /**
+     * @param options - Rotation configuration: key generator, timestamp store, and interval.
+     */
+    constructor({ keyGenerator, rotationIntervalMs, rotatorKeyStore }) {
+        Object.defineProperty(this, "keyGenerator", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "rotatorKeyStore", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "rotationIntervalMs", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.keyGenerator = keyGenerator;
+        this.rotationIntervalMs = rotationIntervalMs;
+        this.rotatorKeyStore = rotatorKeyStore;
+    }
+    /**
+     * Checks if rotation is due, and performs rotation if necessary.
+     * Should be called at service startup or on a schedule (e.g. every hour).
+     */
+    async checkAndRotateKeys() {
+        const now = Date.now();
+        const lastRotation = await this.rotatorKeyStore.getLastRotationTimestamp();
+        if (isNaN(lastRotation) || now - lastRotation >= this.rotationIntervalMs) {
+            await this.rotateKeys();
+            await this.rotatorKeyStore.setLastRotationTimestamp(now);
+        }
+        else {
+            const _nextIn = this.rotationIntervalMs - (now - lastRotation);
+        }
+    }
+    async rotateKeys() {
+        await this.keyGenerator.generateKeyPair();
+    }
+}

package/esm/methods.d.ts

@@ -0,0 +1,39 @@
+import type { JwkVerify, JwtDecode, JwtVerify } from "@saurbit/oauth2";
+/**
+ * Verifies a JWT using the provided secret or key and returns the decoded payload.
+ * Wraps [jose](https://github.com/panva/jose)'s `jwtVerify`.
+ *
+ * Pass this as the `JwtVerify` argument to `ClientSecretJwt` or `PrivateKeyJwt`
+ * from `@saurbit/oauth2`.
+ *
+ * @param jwt - The compact serialized JWT to verify.
+ * @param secretOrKey - The secret (`string` / `Uint8Array`) or `CryptoKey` for verification.
+ * @param options - Optional jose verification options (algorithms, audience, issuer, etc.).
+ * @returns The verified JWT payload.
+ * @throws If the token is invalid, expired, or the signature does not match.
+ */
+export declare const verifyJwt: JwtVerify;
+/**
+ * Decodes a JWT payload **without** verifying its signature.
+ * Wraps [jose](https://github.com/panva/jose)'s `decodeJwt`.
+ *
+ * Pass this as the `JwtDecode` argument to `ClientSecretJwt` or `PrivateKeyJwt`
+ * from `@saurbit/oauth2`.
+ *
+ * @param jwt - The compact serialized JWT to decode.
+ * @returns The decoded JWT payload (unverified).
+ */
+export declare const decodeJwt: JwtDecode;
+/**
+ * Verifies a JWT whose header embeds the public JWK (`"jwk"` header parameter).
+ * The public key is extracted from the JWT header itself and used to verify the signature.
+ * Only `ES256` algorithm tokens are accepted.
+ *
+ * Pass this as the `JwkVerify` argument to `DPoPTokenType` from `@saurbit/oauth2`.
+ *
+ * @param token - The compact serialized JWT (DPoP proof) to verify.
+ * @returns The verified JWT payload.
+ * @throws If the token is invalid, the `jwk` header is missing, or signature verification fails.
+ */
+export declare const verifyJwk: JwkVerify;
+//# sourceMappingURL=methods.d.ts.map

package/esm/methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGvE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,EAAE,SAGvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,EAAE,SAEvB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS,EAAE,SAYvB,CAAC"}

package/esm/methods.js

@@ -0,0 +1,52 @@
+import { decodeJwt as joseDecodeJwt, importJWK, jwtVerify } from "jose";
+/**
+ * Verifies a JWT using the provided secret or key and returns the decoded payload.
+ * Wraps [jose](https://github.com/panva/jose)'s `jwtVerify`.
+ *
+ * Pass this as the `JwtVerify` argument to `ClientSecretJwt` or `PrivateKeyJwt`
+ * from `@saurbit/oauth2`.
+ *
+ * @param jwt - The compact serialized JWT to verify.
+ * @param secretOrKey - The secret (`string` / `Uint8Array`) or `CryptoKey` for verification.
+ * @param options - Optional jose verification options (algorithms, audience, issuer, etc.).
+ * @returns The verified JWT payload.
+ * @throws If the token is invalid, expired, or the signature does not match.
+ */
+export const verifyJwt = async (jwt, secretOrKey, options) => {
+    const { payload } = await jwtVerify(jwt, secretOrKey, options);
+    return payload;
+};
+/**
+ * Decodes a JWT payload **without** verifying its signature.
+ * Wraps [jose](https://github.com/panva/jose)'s `decodeJwt`.
+ *
+ * Pass this as the `JwtDecode` argument to `ClientSecretJwt` or `PrivateKeyJwt`
+ * from `@saurbit/oauth2`.
+ *
+ * @param jwt - The compact serialized JWT to decode.
+ * @returns The decoded JWT payload (unverified).
+ */
+export const decodeJwt = (jwt) => {
+    return joseDecodeJwt(jwt);
+};
+/**
+ * Verifies a JWT whose header embeds the public JWK (`"jwk"` header parameter).
+ * The public key is extracted from the JWT header itself and used to verify the signature.
+ * Only `ES256` algorithm tokens are accepted.
+ *
+ * Pass this as the `JwkVerify` argument to `DPoPTokenType` from `@saurbit/oauth2`.
+ *
+ * @param token - The compact serialized JWT (DPoP proof) to verify.
+ * @returns The verified JWT payload.
+ * @throws If the token is invalid, the `jwk` header is missing, or signature verification fails.
+ */
+export const verifyJwk = async (token) => {
+    const { payload } = await jwtVerify(token, (header) => {
+        if (!header.jwk)
+            throw new Error("Missing JWK");
+        return importJWK(header.jwk, header.alg);
+    }, {
+        algorithms: ["ES256"],
+    });
+    return payload;
+};

package/esm/mod.d.ts

@@ -0,0 +1,6 @@
+export { JoseJwksAuthority } from "./jose_jwks_authority.js";
+export { createInMemoryKeyStore, InMemoryKeyStore } from "./jwks_key_store.js";
+export { JwksRotator, type JwksRotatorOptions } from "./jwks_rotator.js";
+export { decodeJwt, verifyJwk, verifyJwt } from "./methods.js";
+export type { JwksKeyStore, JwksRotationTimestampStore, JwtAuthority, JwtSigner, JwtVerifier, KeyGenerator, RawKey, RSA, } from "./types.js";
+//# sourceMappingURL=mod.d.ts.map

package/esm/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE/D,YAAY,EACV,YAAY,EACZ,0BAA0B,EAC1B,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,GAAG,GACJ,MAAM,YAAY,CAAC"}

package/esm/mod.js

@@ -0,0 +1,4 @@
+export { JoseJwksAuthority } from "./jose_jwks_authority.js";
+export { createInMemoryKeyStore, InMemoryKeyStore } from "./jwks_key_store.js";
+export { JwksRotator } from "./jwks_rotator.js";
+export { decodeJwt, verifyJwk, verifyJwt } from "./methods.js";

package/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/esm/types.d.ts

@@ -0,0 +1,179 @@
+import type { JWTPayload } from "jose";
+/**
+ * Represents an RSA public or private key in JSON Web Key (JWK) format.
+ *
+ * When used as a public key only `kty`, `e`, and `n` are present.
+ * The private key fields (`d`, `p`, `q`, `dp`, `dq`, `qi`) are included on private keys.
+ *
+ * @see {@link https://www.rfc-editor.org/rfc/rfc7517} JSON Web Key (JWK)
+ */
+export interface RSA {
+    /** Key type. Always `"RSA"` for RSA keys. */
+    kty: "RSA";
+    /** RSA public exponent, Base64URL-encoded. */
+    e: string;
+    /** RSA modulus, Base64URL-encoded. */
+    n: string;
+    /** RSA private exponent, Base64URL-encoded. Present only on private keys. */
+    d?: string | undefined;
+    /** First prime factor, Base64URL-encoded. Present only on private keys. */
+    p?: string | undefined;
+    /** Second prime factor, Base64URL-encoded. Present only on private keys. */
+    q?: string | undefined;
+    /** First factor CRT exponent, Base64URL-encoded. Present only on private keys. */
+    dp?: string | undefined;
+    /** Second factor CRT exponent, Base64URL-encoded. Present only on private keys. */
+    dq?: string | undefined;
+    /** First CRT coefficient, Base64URL-encoded. Present only on private keys. */
+    qi?: string | undefined;
+}
+/**
+ * Represents a public key as exposed in a JSON Web Key Set (JWKS).
+ * This is the format returned by the JWKS endpoint and used by JWT verifiers
+ * to validate token signatures.
+ *
+ * @see {@link https://www.rfc-editor.org/rfc/rfc7517} JSON Web Key (JWK)
+ */
+export interface RawKey {
+    /** The algorithm intended for use with this key (e.g. `"RS256"`). */
+    alg: string;
+    /** Key type (e.g. `"RSA"`). */
+    kty: string;
+    /** Intended use of the key: signature (`"sig"`), encryption (`"enc"`), or description (`"desc"`). */
+    use: "sig" | "enc" | "desc";
+    /** Key ID - a unique identifier used to match a JWT `kid` header to the correct public key. */
+    kid: string;
+    /** RSA public exponent, Base64URL-encoded. Together with `n`, forms the RSA public key. */
+    e: string;
+    /** RSA modulus, Base64URL-encoded. Together with `e`, forms the RSA public key. */
+    n: string;
+}
+/**
+ * Persists the timestamp of the last JWKS key rotation.
+ * Used by {@link JwksRotator} to determine when the next rotation is due.
+ *
+ * Implement this interface backed by a persistent or distributed store
+ * (e.g. Redis, database) when running multiple service instances.
+ */
+export interface JwksRotationTimestampStore {
+    /**
+     * Retrieves the Unix timestamp (in milliseconds) of the last key rotation.
+     * @returns The timestamp of the last rotation, or `0` if no rotation has occurred.
+     */
+    getLastRotationTimestamp(): Promise<number>;
+    /**
+     * Persists the Unix timestamp (in milliseconds) of the most recent key rotation.
+     * @param rotationTimestamp - The timestamp to store.
+     */
+    setLastRotationTimestamp(rotationTimestamp: number): Promise<void>;
+}
+/**
+ * Persists the active signing key pair and the set of valid public keys
+ * that are exposed via the JWKS endpoint.
+ *
+ * Implement this interface backed by a persistent or distributed store
+ * (e.g. Redis, database) when running multiple service instances.
+ * The built-in {@link InMemoryKeyStore} is suitable for single-process deployments.
+ */
+export interface JwksKeyStore {
+    /**
+     * Stores the current active private key and its corresponding public key.
+     * The public key will be kept for the duration of the TTL for JWKS purposes.
+     */
+    storeKeyPair(kid: string, privateKey: object, publicKey: object, ttl: number): void | Promise<void>;
+    /**
+     * Retrieves the current private key used for signing.
+     */
+    getPrivateKey(): Promise<object | undefined>;
+    /**
+     * Retrieves all valid public keys that have not expired.
+     * These are used for exposing in JWKS.
+     */
+    getPublicKeys(): Promise<object[]>;
+}
+/**
+ * Generates a new signing key pair and stores it in the associated {@link JwksKeyStore}.
+ * Used by {@link JwksRotator} to perform key rotation.
+ */
+export interface KeyGenerator {
+    /**
+     * Generates a new key pair and persists it to the key store.
+     */
+    generateKeyPair(): Promise<void>;
+}
+/**
+ * An object capable of signing a JWT payload and returning the compact serialized token.
+ *
+ * Implement this interface to plug in a custom JWT signing strategy.
+ */
+export interface JwtSigner {
+    /**
+     * Signs the given payload as a JWT.
+     * @param payload - The JWT payload to sign.
+     * @returns An object containing the signed compact JWT string and the `kid` of the key used for signing.
+     */
+    sign(payload: JWTPayload): Promise<{
+        token: string;
+        kid: string;
+    }>;
+}
+/**
+ * An object capable of verifying a JWT and returning its typed payload.
+ *
+ * Implement this interface to plug in a custom JWT verification strategy
+ * (e.g. backed by a JWKS endpoint, a local key store, or a third-party library).
+ */
+export interface JwtVerifier {
+    /**
+     * Verifies the given JWT and returns its decoded payload.
+     *
+     * @template P - The expected shape of the JWT payload. Defaults to {@link JWTPayload}.
+     * @param token - The compact serialized JWT string to verify.
+     * @returns The verified and decoded payload.
+     * @throws If the token is invalid, expired, or cannot be verified.
+     */
+    verify<P extends JWTPayload = JWTPayload>(token: string): Promise<P>;
+}
+/**
+ * A full JWT authority combining signing, verification, and JWKS key management.
+ *
+ * A `JwtAuthority` is responsible for:
+ * - Signing JWT payloads with the current private key ({@link JwtSigner.sign})
+ * - Verifying JWTs against the matching public key ({@link JwtVerifier.verify})
+ * - Exposing the JWKS (set of public keys) for external consumers
+ * - Generating new key pairs on demand or via a scheduled {@link JwksRotator}
+ *
+ * Use {@link JoseJwksAuthority} as the ready-made implementation backed by [jose](https://github.com/panva/jose).
+ */
+export interface JwtAuthority extends JwtVerifier, JwtSigner {
+    /**
+     * Retrieves all currently valid public keys from the key store.
+     * @returns An object whose `keys` array contains the public keys in JWK format.
+     */
+    getPublicKeys(): Promise<{
+        keys: RawKey[];
+    }>;
+    /**
+     * Get current kid for observability/debugging
+     */
+    getCurrentKid(): Promise<string | undefined>;
+    /**
+     * Helper for JWKS endpoint
+     */
+    getJwksEndpointResponse(): Promise<{
+        keys: RawKey[];
+    }>;
+    /**
+     * Retrieves the public key corresponding to the given `kid` from the key store.
+     * @param kid - The key ID to look up.
+     * @returns The RSA public key if found, or `undefined` if not found or not an RSA key.
+     */
+    getPublicKey(kid: string): Promise<RSA | undefined>;
+    /**
+     * Generates a new RSA key pair and stores it in the key store.
+     * The new key becomes the active signing key; the previous public key
+     * remains available in the JWKS until its TTL expires.
+     */
+    generateKeyPair(): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/esm/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,WAAW,GAAG;IAClB,6CAA6C;IAC7C,GAAG,EAAE,KAAK,CAAC;IACX,8CAA8C;IAC9C,CAAC,EAAE,MAAM,CAAC;IACV,sCAAsC;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,6EAA6E;IAC7E,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,2EAA2E;IAC3E,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,4EAA4E;IAC5E,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,kFAAkF;IAClF,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,mFAAmF;IACnF,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,8EAA8E;IAC9E,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,qGAAqG;IACrG,GAAG,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC5B,+FAA+F;IAC/F,GAAG,EAAE,MAAM,CAAC;IAEZ,2FAA2F;IAC3F,CAAC,EAAE,MAAM,CAAC;IACV,mFAAmF;IACnF,CAAC,EAAE,MAAM,CAAC;CACX;AAED;;;;;;GAMG;AACH,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,wBAAwB,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,YAAY,CACV,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACpC;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpE;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;;OAOG;IACH,MAAM,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACtE;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,YAAa,SAAQ,WAAW,EAAE,SAAS;IAC1D;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAE7C;;OAEG;IACH,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE7C;;OAEG;IACH,uBAAuB,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAEvD;;;;OAIG;IACH,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;IAEpD;;;;OAIG;IACH,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC"}

package/esm/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@saurbit/oauth2-jwt",
+  "version": "0.1.0",
+  "description": "JWT utilities for @saurbit/oauth2 (jose-based)",
+  "keywords": [
+    "oauth2",
+    "jwt",
+    "jose",
+    "jwks",
+    "oidc"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/saurbit/saurbit.git"
+  },
+  "license": "MIT",
+  "main": "./script/mod.js",
+  "module": "./esm/mod.js",
+  "exports": {
+    ".": {
+      "import": "./esm/mod.js",
+      "require": "./script/mod.js"
+    }
+  },
+  "scripts": {},
+  "dependencies": {
+    "jose": "^6.2.2"
+  },
+  "peerDependencies": {
+    "@saurbit/oauth2": "^0.1.0"
+  },
+  "_generatedBy": "dnt@dev"
+}

package/script/jose_jwks_authority.d.ts

@@ -0,0 +1,90 @@
+import { JWTPayload } from "jose";
+import { JwksKeyStore, JwtAuthority, RawKey, RSA } from "./types.js";
+/**
+ * JWT authority backed by [jose](https://github.com/panva/jose).
+ *
+ * Manages RS256 signing key pairs, signs and verifies JWTs, and returns the
+ * JWKS endpoint payload. Keys are stored in a {@link JwksKeyStore} and are
+ * generated automatically on first use.
+ *
+ * @example
+ * ```ts
+ * import { createInMemoryKeyStore, JoseJwksAuthority } from "@saurbit/oauth2-jwt";
+ *
+ * const store = createInMemoryKeyStore();
+ * const authority = new JoseJwksAuthority(store, 86400); // keys valid for 24 h
+ *
+ * const { token } = await authority.sign({ sub: "user-123", exp: Math.floor(Date.now() / 1000) + 3600 });
+ * const payload = await authority.verify(token);
+ * ```
+ */
+export declare class JoseJwksAuthority implements JwtAuthority {
+    #private;
+    /**
+     * @param store The key store used to manage JWKS keys.
+     * @param ttl Time-to-live for the keys in seconds.
+     */
+    constructor(store: JwksKeyStore, ttl?: number);
+    /**
+     * Retrieves the current set of public keys from the key store.
+     * @returns An object containing the array of public keys.
+     */
+    getPublicKeys(): Promise<{
+        keys: RawKey[];
+    }>;
+    /**
+     * Get current kid for observability/debugging
+     */
+    getCurrentKid(): Promise<string | undefined>;
+    /**
+     * Helps implement the JWKS endpoint by returning the current set of public keys in the expected format.
+     * @returns The current set of public keys in the JWKS format.
+     */
+    getJwksEndpointResponse(): Promise<{
+        keys: RawKey[];
+    }>;
+    /**
+     * Retrieves the public key corresponding to the given "kid" from the JWKS.
+     * @param kid The key ID of the desired public key.
+     * @returns The RSA public key if found, otherwise undefined.
+     */
+    getPublicKey(kid: string): Promise<RSA | undefined>;
+    /**
+     * Generates a new RSA key pair, stores it in the key store with the appropriate metadata
+     * (kid, alg, use), and ensures that the public key is available for JWKS exposure.
+     */
+    generateKeyPair(): Promise<void>;
+    /**
+     * Signs the given payload as a JWT using the current private key.
+     * The "kid" of the signing key is included in the JWT header to allow verifiers
+     * to select the correct public key from the JWKS for verification.
+     * This method ensures that the JWT is signed with a valid key and that
+     * the corresponding public key is available in the JWKS for future verification.
+     * @param payload The payload to be signed as a JWT.
+     * @returns An object containing the signed JWT and the key ID used for signing.
+     */
+    sign(payload: JWTPayload): Promise<{
+        token: string;
+        kid: string;
+    }>;
+    /**
+     * Verifies the given JWT using the appropriate public key from the JWKS based on the "kid" in the JWT header.
+     * It performs additional checks to ensure the integrity and expected structure of the JWT,
+     * such as validating the algorithm and ensuring no unexpected JWK is present in the header.
+     * @param token
+     * @returns
+     */
+    verify<P extends JWTPayload = JWTPayload>(token: string): Promise<P>;
+    /**
+     * Signs multiple payloads with the same private key, returning an array of tokens and their corresponding kids.
+     * This is useful for batch operations where multiple JWTs need to be issued at once,
+     * ensuring they all use the same key and can be verified against the same public key in the JWKS.
+     * @param payloads The array of payloads to be signed as JWTs.
+     * @returns An array of objects containing the signed JWTs and their corresponding key IDs.
+     */
+    signMany(payloads: JWTPayload[]): Promise<{
+        token: string;
+        kid: string;
+    }[]>;
+}
+//# sourceMappingURL=jose_jwks_authority.d.ts.map

package/script/jose_jwks_authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose_jwks_authority.d.ts","sourceRoot":"","sources":["../src/jose_jwks_authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,UAAU,EAGX,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AA0BrE;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,iBAAkB,YAAW,YAAY;;IAOpD;;;OAGG;gBACS,KAAK,EAAE,YAAY,EAAE,GAAG,GAAE,MAAc;IAsCpD;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IASlD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAKlD;;;OAGG;IACH,uBAAuB,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAItD;;;;OAIG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAQzD;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC;;;;;;;;OAQG;IACG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAoBxE;;;;;;OAMG;IACG,MAAM,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IA+B1E;;;;;;OAMG;IACG,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAyBlF"}