@schemavaults/jwt 0.8.4 → 0.11.3

package/dist/jwt/custom-jwt-payload-to-user-data.d.ts

@@ -1,3 +1,10 @@
 import type { UserData } from "@schemavaults/auth-common";
 import type { CustomJWTPayload } from "./payload_data";
 export declare function customJwtPayloadToUserData(payload: CustomJWTPayload): UserData;
+/**
+ * Extracts the granted scope claim from a decoded custom-JWT payload, to be
+ * carried alongside the UserData. Returns null when the token has no scope
+ * claim (issued before scopes became first-class), which route guards treat
+ * as "no scopes granted".
+ */
+export declare function getScopeFromCustomJwtPayload(payload: CustomJWTPayload): string | null;

package/dist/jwt/custom-jwt-payload-to-user-data.js

@@ -1,3 +1,9 @@
+// Maps a decoded custom-JWT payload to the canonical UserData. The token's
+// granted `scope` is deliberately NOT folded in here — it is threaded
+// ALONGSIDE the user data (see `getScopeFromCustomJwtPayload` and the
+// `{ user, scope }` record in @schemavaults/auth-server-sdk's
+// decodeJWTsWithKeyManager) so route guards can enforce `required_scopes`
+// without polluting the user identity type.
 export function customJwtPayloadToUserData(payload) {
     return {
         uid: payload.uid,
@@ -9,4 +15,15 @@ export function customJwtPayloadToUserData(payload) {
         created_at: payload.created_at,
     };
 }
+/**
+ * Extracts the granted scope claim from a decoded custom-JWT payload, to be
+ * carried alongside the UserData. Returns null when the token has no scope
+ * claim (issued before scopes became first-class), which route guards treat
+ * as "no scopes granted".
+ */
+export function getScopeFromCustomJwtPayload(payload) {
+    return typeof payload.scope === "string" && payload.scope.length > 0
+        ? payload.scope
+        : null;
+}
 //# sourceMappingURL=custom-jwt-payload-to-user-data.js.map

package/dist/jwt/custom-jwt-payload-to-user-data.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-jwt-payload-to-user-data.js","sourceRoot":"","sources":["../../src/jwt/custom-jwt-payload-to-user-data.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,0BAA0B,CACxC,OAAyB;IAEzB,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"custom-jwt-payload-to-user-data.js","sourceRoot":"","sources":["../../src/jwt/custom-jwt-payload-to-user-data.ts"],"names":[],"mappings":"AAGA,2EAA2E;AAC3E,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,0EAA0E;AAC1E,4CAA4C;AAC5C,MAAM,UAAU,0BAA0B,CACxC,OAAyB;IAEzB,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAyB;IAEzB,OAAO,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAClE,CAAC,CAAC,OAAO,CAAC,KAAK;QACf,CAAC,CAAC,IAAI,CAAC;AACX,CAAC"}

package/dist/jwt/generate.d.ts

@@ -10,6 +10,11 @@ interface BaseGenerateJWTOptions<T extends AuthTokenTypes> {
     audience: string;
     auth_server_url: string;
     env: SchemaVaultsAppEnvironment;
+    /**
+     * Space-delimited granted OIDC scopes; set only by the OIDC surface
+     * (see payload_data.ts). Omitted on all other tokens.
+     */
+    scope?: string;
 }
 interface GenerateJWTWithAllKeysOptions<T extends AuthTokenTypes> extends BaseGenerateJWTOptions<T> {
     jwt_keys: I_JWT_Keys;

package/dist/jwt/generate.js

@@ -152,6 +152,9 @@ export async function generateJWT({ type, user, iat, client_app_id, audience, au
             env,
             sig,
             jti,
+            ...(typeof opts.scope === "string" && opts.scope.length > 0
+                ? { scope: opts.scope }
+                : {}),
         };
         const jwt = await new EncryptJWT(additionalClaims)
             .setProtectedHeader({

package/dist/jwt/generate.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../src/jwt/generate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAkB,MAAM,MAAM,CAAC;AAElD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,uBAAuB,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AASlE,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,WAAW,MAAM,qBAAqB,CAAC;AA8B9C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EACE,IAAI,EACJ,IAAI,EACJ,GAAG,EACH,aAAa,EACb,QAAQ,EACR,eAAe,EACf,GAAG,IAAI,EACe,EACxB,sBAAsB,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;IAE1D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAa,IAAI,CAAC;IAChC,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACtD,aAAa,QAAQ,oBAAoB,sBAAsB,IAAI,CACtE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,sBAAsB,CAAC;QAC/B,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;YACnE,MAAM,IAAI,SAAS,CACjB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,kBAAkB,GAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7D,IACE,OAAO,kBAAkB,KAAK,QAAQ;YACtC,CAAC,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,OAAO,EACxD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,qBAAqB,GAAW,8BAA8B,CAClE,kBAAkB,EAClB,IAAI,CAAC,GAAG,CACT,CAAC;QACF,IAAI,qBAAqB,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,2BAA2B,kBAAkB,sBAAsB,qBAAqB,+CAA+C,GAAG,GAAG,CAC9I,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAW,IAAI,CAAC,KAAK,CAAC;IACjC,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,CAAC;IAE7B,MAAM,GAAG,GAA+B,IAAI,CAAC,GAAG,CAAC;IAEjD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oCAAoC,EAAE;YACpD,KAAK,EAAE,mCAAmC,eAAe,iCAAiC;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAW,MAAM,CAAC,UAAU,EAAE,CAAC;IAExC,IAAI,WAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,mBAAmB,GACvB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,WAAW,GAAG,MAAM,mBAAmB,CAAC;QAC1C,CAAC;aAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iEAAiE,EACjE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC;YAClB,QAAQ;YACR,WAAW;YACX,SAAS;YACT,GAAG;YACH,GAAG;YACH,KAAK;YACL,IAAI;YACJ,GAAG;YACH,eAAe;YACf,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,6DAA6D,EAC7D,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,cAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,sBAAsB,GAC1B,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC/B,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,cAAc,GAAG,MAAM,sBAAsB,CAAC;QAChD,CAAC;aAAM,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;YACpC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iEAAiE,EACjE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAA8B;YAClD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;YAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,KAAK;YAC5C,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;YAChC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG;YACH,GAAG;YACH,GAAG;SACJ,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,UAAU,CAAC,gBAAgB,CAAC;aAC/C,kBAAkB,CAAC;YAClB,GAAG;YACH,GAAG;YACH,SAAS;YACT,GAAG,EAAE,GAAG,SAAS,aAAa;YAC9B,GAAG,EAAE,QAAyB;SAC/B,CAAC;aACD,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;aAC1B,SAAS,CAAC,eAAe,CAAC;aAC1B,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;aAChD,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;aACxB,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3B,MAAM,UAAU,GAAW,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAEpD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,SAAS,GAAc;YAC3B,IAAI;YACJ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG;YACH,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,GAAG;YACV,GAAG;YACH,GAAG;SACJ,CAAC;QAEF,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CACjB,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,SAA4D,CAAC;IACtE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}
+{"version":3,"file":"generate.js","sourceRoot":"","sources":["../../src/jwt/generate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAkB,MAAM,MAAM,CAAC;AAElD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,uBAAuB,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AASlE,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAmC9C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EACE,IAAI,EACJ,IAAI,EACJ,GAAG,EACH,aAAa,EACb,QAAQ,EACR,eAAe,EACf,GAAG,IAAI,EACe,EACxB,sBAAsB,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;IAE1D,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;YACxB,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;aAAM,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YAC9B,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,QAAQ,GAAa,IAAI,CAAC;IAChC,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACtD,aAAa,QAAQ,oBAAoB,sBAAsB,IAAI,CACtE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,sBAAsB,CAAC;QAC/B,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;YACnE,MAAM,IAAI,SAAS,CACjB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CACjB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,kBAAkB,GAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7D,IACE,OAAO,kBAAkB,KAAK,QAAQ;YACtC,CAAC,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,OAAO,EACxD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,qBAAqB,GAAW,8BAA8B,CAClE,kBAAkB,EAClB,IAAI,CAAC,GAAG,CACT,CAAC;QACF,IAAI,qBAAqB,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,2BAA2B,kBAAkB,sBAAsB,qBAAqB,+CAA+C,GAAG,GAAG,CAC9I,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAW,IAAI,CAAC,KAAK,CAAC;IACjC,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,CAAC;IAE7B,MAAM,GAAG,GAA+B,IAAI,CAAC,GAAG,CAAC;IAEjD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oCAAoC,EAAE;YACpD,KAAK,EAAE,mCAAmC,eAAe,iCAAiC;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,GAAG,GAAW,MAAM,CAAC,UAAU,EAAE,CAAC;IAExC,IAAI,WAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,mBAAmB,GACvB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,WAAW,GAAG,MAAM,mBAAmB,CAAC;QAC1C,CAAC;aAAM,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iEAAiE,EACjE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC;YAClB,QAAQ;YACR,WAAW;YACX,SAAS;YACT,GAAG;YACH,GAAG;YACH,KAAK;YACL,IAAI;YACJ,GAAG;YACH,eAAe;YACf,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,6DAA6D,EAC7D,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAI,cAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,sBAAsB,GAC1B,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC/B,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;YACD,cAAc,GAAG,MAAM,sBAAsB,CAAC;QAChD,CAAC;aAAM,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC;YACpC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CACX,iEAAiE,EACjE,CAAC,CACF,CAAC;QACF,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAA8B;YAClD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;YAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,KAAK;YAC5C,GAAG,EAAE,QAAQ;YACb,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;YAChC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG;YACH,GAAG;YACH,GAAG;YACH,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBACzD,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBACvB,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,UAAU,CAAC,gBAAgB,CAAC;aAC/C,kBAAkB,CAAC;YAClB,GAAG;YACH,GAAG;YACH,SAAS;YACT,GAAG,EAAE,GAAG,SAAS,aAAa;YAC9B,GAAG,EAAE,QAAyB;SAC/B,CAAC;aACD,WAAW,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;aAC1B,SAAS,CAAC,eAAe,CAAC;aAC1B,WAAW,CAAC,GAAG,CAAC;aAChB,iBAAiB,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;aAChD,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;aACxB,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3B,MAAM,UAAU,GAAW,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAEpD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,SAAS,GAAc;YAC3B,IAAI;YACJ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG;YACH,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,GAAG;YACV,GAAG;YACH,GAAG;SACJ,CAAC;QAEF,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CACjB,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,OAAO,SAA4D,CAAC;IACtE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC"}

package/dist/jwt/generate_id_token.d.ts

@@ -0,0 +1,43 @@
+import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
+import type { UserData } from "@schemavaults/auth-common";
+import type { I_JWT_Keys } from "./jwt_keys";
+/**
+ * OIDC id_token lifetime in seconds. Deliberately short-lived: the
+ * id_token is an identity assertion consumed by the RP at login time,
+ * not an access credential.
+ */
+export declare const ID_TOKEN_EXPIRY: 3600;
+export interface GenerateIdTokenOptions {
+    user: UserData;
+    /** The OIDC client_id (= platform app_id) — becomes the `aud` claim. */
+    client_id: string;
+    /** Echoed verbatim as the `nonce` claim when present (OIDC Core §2). */
+    nonce?: string | null;
+    /**
+     * Granted OIDC scopes; `email`/`email_verified` claims are only
+     * included when the `email` scope was granted.
+     */
+    scopes: readonly string[];
+    /**
+     * Keyset whose RS256 signing key signs the id_token. Its public
+     * verification half must be published at the OIDC jwks_uri under the
+     * kid `<keyset_id>-verification`.
+     */
+    jwt_keys: I_JWT_Keys;
+    environment: SchemaVaultsAppEnvironment;
+    auth_server_url?: string;
+}
+export interface GeneratedIdToken {
+    id_token: string;
+    /** Seconds until expiry (= ID_TOKEN_EXPIRY). */
+    expires_in: number;
+}
+/**
+ * Mints an OIDC Core §2 id_token: a plain RS256-signed JWS (NOT the
+ * platform's encrypted JWE access-token format) that any relying party
+ * can verify against the public JWKS. The `kid` header follows the
+ * platform convention (`<keyset_id>-verification`) so it matches the
+ * keys served by the jwks_uri.
+ */
+export declare function generateIdToken({ user, client_id, nonce, scopes, jwt_keys, environment, auth_server_url, }: GenerateIdTokenOptions): Promise<GeneratedIdToken>;
+export default generateIdToken;

package/dist/jwt/generate_id_token.js

@@ -0,0 +1,63 @@
+import { SignJWT } from "jose";
+import { getAuthServerUrl, } from "@schemavaults/app-definitions";
+import signAndVerifyAlg from "./sign_verify_alg";
+import isValidUuid from "../utils/isValidUuid";
+/**
+ * OIDC id_token lifetime in seconds. Deliberately short-lived: the
+ * id_token is an identity assertion consumed by the RP at login time,
+ * not an access credential.
+ */
+export const ID_TOKEN_EXPIRY = 3600;
+/**
+ * Mints an OIDC Core §2 id_token: a plain RS256-signed JWS (NOT the
+ * platform's encrypted JWE access-token format) that any relying party
+ * can verify against the public JWKS. The `kid` header follows the
+ * platform convention (`<keyset_id>-verification`) so it matches the
+ * keys served by the jwks_uri.
+ */
+export async function generateIdToken({ user, client_id, nonce, scopes, jwt_keys, environment, auth_server_url = getAuthServerUrl(environment), }) {
+    if (typeof user?.uid !== "string" || user.uid.length === 0) {
+        throw new TypeError("generateIdToken requires a user with a uid!");
+    }
+    if (typeof client_id !== "string" || client_id.length === 0) {
+        throw new TypeError("generateIdToken requires a client_id!");
+    }
+    if (typeof auth_server_url !== "string" || auth_server_url.length === 0) {
+        throw new TypeError("Failed to resolve auth server URL to be used as the id_token 'iss' claim!");
+    }
+    const keyset_id = jwt_keys.keyset_id;
+    if (typeof keyset_id !== "string" || !isValidUuid(keyset_id)) {
+        throw new TypeError("Invalid keyset ID on the provided JWT keys!");
+    }
+    const signing_key_promise = jwt_keys.signing_key;
+    if (!signing_key_promise) {
+        throw new Error("Failed to load private signing key from the provided JWT keys!");
+    }
+    const signing_key = await signing_key_promise;
+    const claims = {};
+    if (typeof nonce === "string" && nonce.length > 0) {
+        claims.nonce = nonce;
+    }
+    if (scopes.includes("email")) {
+        claims.email = user.email;
+        claims.email_verified = user.email_verified ?? false;
+    }
+    const id_token = await new SignJWT(claims)
+        .setProtectedHeader({
+        alg: signAndVerifyAlg,
+        typ: "JWT",
+        kid: `${keyset_id}-verification`,
+    })
+        .setIssuer(auth_server_url)
+        .setSubject(user.uid)
+        .setAudience(client_id)
+        // jose defaults to the current unix time in SECONDS; do not pass
+        // Date.now() here (milliseconds) like sign.ts does for the internal
+        // `sig` JWS — OIDC RP libraries validate iat/exp as seconds.
+        .setIssuedAt()
+        .setExpirationTime(`${ID_TOKEN_EXPIRY}s`)
+        .sign(signing_key);
+    return { id_token, expires_in: ID_TOKEN_EXPIRY };
+}
+export default generateIdToken;
+//# sourceMappingURL=generate_id_token.js.map

package/dist/jwt/generate_id_token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate_id_token.js","sourceRoot":"","sources":["../../src/jwt/generate_id_token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAkB,MAAM,MAAM,CAAC;AAC/C,OAAO,EACL,gBAAgB,GAEjB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,gBAAgB,MAAM,mBAAmB,CAAC;AACjD,OAAO,WAAW,MAAM,qBAAqB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAa,CAAC;AA6B7C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,IAAI,EACJ,SAAS,EACT,KAAK,EACL,MAAM,EACN,QAAQ,EACR,WAAW,EACX,eAAe,GAAG,gBAAgB,CAAC,WAAW,CAAC,GACxB;IACvB,IAAI,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAW,QAAQ,CAAC,SAAS,CAAC;IAC7C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,mBAAmB,GAA8B,QAAQ,CAAC,WAAW,CAAC;IAC5E,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAc,MAAM,mBAAmB,CAAC;IAEzD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC1B,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,CAAC;IAED,MAAM,QAAQ,GAAW,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;SAC/C,kBAAkB,CAAC;QAClB,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,GAAG,SAAS,eAAe;KACjC,CAAC;SACD,SAAS,CAAC,eAAe,CAAC;SAC1B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;SACpB,WAAW,CAAC,SAAS,CAAC;QACvB,iEAAiE;QACjE,oEAAoE;QACpE,6DAA6D;SAC5D,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,eAAe,GAAG,CAAC;SACxC,IAAI,CAAC,WAAW,CAAC,CAAC;IAErB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AACnD,CAAC;AAED,eAAe,eAAe,CAAC"}

package/dist/jwt/index.d.ts

@@ -2,9 +2,11 @@ export { decodeJWT } from "./decode";
 export { getExpiryTime, getExpiryDurationString } from "./expiry";
 export { JWT_Factory } from "./jwt-factory";
 export type { CustomJWTPayload } from "./payload_data";
-export { customJwtPayloadToUserData } from "./custom-jwt-payload-to-user-data";
-export { JWT_Keys, generateNewJwtKeySet, generateJwtSigningKeyPair, generateJwtContentEncryptionKeyPair, to_public_jwks, importAsymmetricJWK, jsonSerializedJwtKeySchema, PEMFormat, ContentEncryptionKeyPairFactory, SigningKeyPairFactory, } from "./jwt_keys";
+export { customJwtPayloadToUserData, getScopeFromCustomJwtPayload, } from "./custom-jwt-payload-to-user-data";
+export { JWT_Keys, generateNewJwtKeySet, generateJwtSigningKeyPair, generateJwtContentEncryptionKeyPair, to_public_jwks, to_public_verification_jwks, importAsymmetricJWK, jsonSerializedJwtKeySchema, PEMFormat, ContentEncryptionKeyPairFactory, SigningKeyPairFactory, } from "./jwt_keys";
 export type * from "./jwt_keys";
+export { generateIdToken, ID_TOKEN_EXPIRY } from "./generate_id_token";
+export type { GenerateIdTokenOptions, GeneratedIdToken, } from "./generate_id_token";
 export { getKeysetIdFromToken } from "./get_keyset_id_from_token";
 export { default as getAudienceFromToken } from "./get_audience_from_token";
 export { refreshTokenExpiry, accessTokenExpiry } from "./expiry";

package/dist/jwt/index.js

@@ -2,8 +2,9 @@
 export { decodeJWT } from "./decode";
 export { getExpiryTime, getExpiryDurationString } from "./expiry";
 export { JWT_Factory } from "./jwt-factory";
-export { customJwtPayloadToUserData } from "./custom-jwt-payload-to-user-data";
-export { JWT_Keys, generateNewJwtKeySet, generateJwtSigningKeyPair, generateJwtContentEncryptionKeyPair, to_public_jwks, importAsymmetricJWK, jsonSerializedJwtKeySchema, PEMFormat, ContentEncryptionKeyPairFactory, SigningKeyPairFactory, } from "./jwt_keys";
+export { customJwtPayloadToUserData, getScopeFromCustomJwtPayload, } from "./custom-jwt-payload-to-user-data";
+export { JWT_Keys, generateNewJwtKeySet, generateJwtSigningKeyPair, generateJwtContentEncryptionKeyPair, to_public_jwks, to_public_verification_jwks, importAsymmetricJWK, jsonSerializedJwtKeySchema, PEMFormat, ContentEncryptionKeyPairFactory, SigningKeyPairFactory, } from "./jwt_keys";
+export { generateIdToken, ID_TOKEN_EXPIRY } from "./generate_id_token";
 export { getKeysetIdFromToken } from "./get_keyset_id_from_token";
 export { default as getAudienceFromToken } from "./get_audience_from_token";
 export { refreshTokenExpiry, accessTokenExpiry } from "./expiry";

package/dist/jwt/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/jwt/index.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAE/E,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,yBAAyB,EACzB,mCAAmC,EACnC,cAAc,EACd,mBAAmB,EACnB,0BAA0B,EAC1B,SAAS,EACT,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAEjE,4DAA4D;AAC5D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAGnE,kBAAkB;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/jwt/index.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,yBAAyB,EACzB,mCAAmC,EACnC,cAAc,EACd,2BAA2B,EAC3B,mBAAmB,EACnB,0BAA0B,EAC1B,SAAS,EACT,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAMvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAEjE,4DAA4D;AAC5D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAGnE,kBAAkB;AAClB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/jwt/jwt-factory.d.ts

@@ -23,8 +23,12 @@ export declare class JWT_Factory {
     private get uid();
     private static get iat();
     private generate;
-    refresh(): Promise<RefreshToken>;
-    access(audience: string): Promise<AccessToken>;
+    refresh(opts?: {
+        scope?: string;
+    }): Promise<RefreshToken>;
+    access(audience: string, opts?: {
+        scope?: string;
+    }): Promise<AccessToken>;
     private multipleAccessTokens;
     /**
      *

package/dist/jwt/jwt-factory.js

@@ -53,7 +53,7 @@ export class JWT_Factory {
     static get iat() {
         return Date.now();
     }
-    async generate(type, aud) {
+    async generate(type, aud, opts) {
         // Make sure the token type is valid
         if (type !== "refresh" && type !== "access") {
             throw new Error("Invalid token type");
@@ -90,15 +90,16 @@ export class JWT_Factory {
             auth_server_url: this.auth_server_url,
             jwt_keys: this.jwt_keys,
             env: this.environment,
+            ...(opts?.scope ? { scope: opts.scope } : {}),
         };
         const jwt = await generateJWT(generateTokenOptions);
         return jwt;
     }
-    async refresh() {
-        return await this.generate("refresh", this.auth_server_url);
+    async refresh(opts) {
+        return await this.generate("refresh", this.auth_server_url, opts);
     }
-    async access(audience) {
-        return await this.generate("access", audience);
+    async access(audience, opts) {
+        return await this.generate("access", audience, opts);
     }
     async multipleAccessTokens(audiences) {
         const accessTokens = {};

package/dist/jwt/jwt-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-factory.js","sourceRoot":"","sources":["../../src/jwt/jwt-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAOL,oBAAoB,EAEpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EAGX,gCAAgC,EAChC,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAA2B,WAAW,EAAE,MAAM,YAAY,CAAC;AAWlE,wDAAwD;AACxD,0FAA0F;AAC1F,yFAAyF;AACzF,MAAM,OAAO,WAAW;IACtB;;;OAGG;IACc,aAAa,CAAQ;IACrB,IAAI,CAAW;IACf,WAAW,CAA6B;IACxC,eAAe,CAAS;IACxB,QAAQ,CAAa;IACrB,kBAAkB,CAA4B;IAE/D,YAAmB,IAA+B;QAChD,iBAAiB;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEtB,oBAAoB;QACpB,MAAM,oBAAoB,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAE/C,WAAW;QACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,yDAAyD;QACzD,MAAM,sBAAsB,GAAG,gCAAgC,CAAC,SAAS,CACvE,IAAI,CAAC,WAAgD,CACtD,CAAC;QACF,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,qEAAqE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC;QAE/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;QACJ,CAAC;aAAM,IACL,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAC5B,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,KAAK,QAAQ;YACxB,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAC/C,EACD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,0GAA0G,CAC3G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAElD,IAAI,CAAC,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IAED,IAAY,GAAG;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,kDAAkD,OAAO,IAAI,CAAC,GAAG,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACvB,CAAC;IAEO,MAAM,KAAK,GAAG;QACpB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,IAAO,EACP,GAAW;QAEX,oCAAoC;QACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,GAAG,GAAW,WAAW,CAAC,GAAG,CAAC;QAEpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,yDAAyD;YACzD,IAAI,GAAG,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC7D,8CAA8C;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,kBAAkB,GAAG,MAAM,oBAAoB,CACnD,CAAC,EACD,IAAI,CAAC,WAAW,CACjB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAoC;YAC5D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI;YACJ,GAAG;YACH,QAAQ,EAAE,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,QAAQ,EAAE,IAAI,CAAC,QAA6B;YAC5C,GAAG,EAAE,IAAI,CAAC,WAAgD;SAC3D,CAAC;QAEF,MAAM,GAAG,GAAc,MAAM,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAE/D,OAAO,GAAsD,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC9D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,QAAgB;QAClC,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,SAAmB;QAEnB,MAAM,YAAY,GAAgC,EAAE,CAAC;QAErD,MAAM,mBAAmB,GAAG,SAAS,CAAC,GAAG,CACvC,CAAC,QAAgB,EAAwB,EAAE;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,CACF,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChE,gBAAgB,CAAC,OAAO,CAAC,CAAC,YAAY,EAAQ,EAAE;YAC9C,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,cAAc,CACzB,SAA6B,EAC7B,cAAwB;QAExB,MAAM,aAAa,GAAU,IAAI,CAAC,aAAa,CAAC;QAChD,IAAI,sBAAgC,CAAC;QAErC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAC/B,sBAAsB,GAAG,CAAC,SAAS,CAAoB,CAAC;aACrD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,sBAAsB,GAAG,SAAS,CAAC;QACrC,CAAC;;YACC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QAEJ,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;aACvE,IAAI,sBAAsB,CAAC,MAAM,GAAG,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAE3E,IAAI,CAAC;YACH,MAAM,mBAAmB,GACvB,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YAE9D,MAAM,qBAAqB,GAAwB;gBACjD,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,iCAAiC;gBAC1C,aAAa;gBACb,MAAM,EAAE;oBACN,OAAO,EAAE,MAAM,mBAAmB;oBAClC,MAAM,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,CAAC;iBAChE;gBACD,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;YACF,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"jwt-factory.js","sourceRoot":"","sources":["../../src/jwt/jwt-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAOL,oBAAoB,EAEpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,WAAW,EAGX,gCAAgC,EAChC,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAA2B,WAAW,EAAE,MAAM,YAAY,CAAC;AAWlE,wDAAwD;AACxD,0FAA0F;AAC1F,yFAAyF;AACzF,MAAM,OAAO,WAAW;IACtB;;;OAGG;IACc,aAAa,CAAQ;IACrB,IAAI,CAAW;IACf,WAAW,CAA6B;IACxC,eAAe,CAAS;IACxB,QAAQ,CAAa;IACrB,kBAAkB,CAA4B;IAE/D,YAAmB,IAA+B;QAChD,iBAAiB;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEtB,oBAAoB;QACpB,MAAM,oBAAoB,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAE/C,WAAW;QACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAE9B,yDAAyD;QACzD,MAAM,sBAAsB,GAAG,gCAAgC,CAAC,SAAS,CACvE,IAAI,CAAC,WAAgD,CACtD,CAAC;QACF,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,qEAAqE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC;QAE/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;QACJ,CAAC;aAAM,IACL,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAC5B,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,KAAK,QAAQ;YACxB,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAC/C,EACD,CAAC;YACD,MAAM,IAAI,SAAS,CACjB,0GAA0G,CAC3G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAElD,IAAI,CAAC,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5D,CAAC;IAED,IAAY,GAAG;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,kDAAkD,OAAO,IAAI,CAAC,GAAG,EAAE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACvB,CAAC;IAEO,MAAM,KAAK,GAAG;QACpB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,IAAO,EACP,GAAW,EACX,IAAyB;QAEzB,oCAAoC;QACpC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,GAAG,GAAW,WAAW,CAAC,GAAG,CAAC;QAEpC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,yDAAyD;YACzD,IAAI,GAAG,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAC7D,8CAA8C;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,kBAAkB,GAAG,MAAM,oBAAoB,CACnD,CAAC,EACD,IAAI,CAAC,WAAW,CACjB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAoC;YAC5D,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI;YACJ,GAAG;YACH,QAAQ,EAAE,GAAG;YACb,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,QAAQ,EAAE,IAAI,CAAC,QAA6B;YAC5C,GAAG,EAAE,IAAI,CAAC,WAAgD;YAC1D,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC;QAEF,MAAM,GAAG,GAAc,MAAM,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAE/D,OAAO,GAAsD,CAAC;IAChE,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,IAAyB;QAC5C,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAEM,KAAK,CAAC,MAAM,CACjB,QAAgB,EAChB,IAAyB;QAEzB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,SAAmB;QAEnB,MAAM,YAAY,GAAgC,EAAE,CAAC;QAErD,MAAM,mBAAmB,GAAG,SAAS,CAAC,GAAG,CACvC,CAAC,QAAgB,EAAwB,EAAE;YACzC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,CACF,CAAC;QACF,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChE,gBAAgB,CAAC,OAAO,CAAC,CAAC,YAAY,EAAQ,EAAE;YAC9C,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,cAAc,CACzB,SAA6B,EAC7B,cAAwB;QAExB,MAAM,aAAa,GAAU,IAAI,CAAC,aAAa,CAAC;QAChD,IAAI,sBAAgC,CAAC;QAErC,IAAI,OAAO,SAAS,KAAK,QAAQ;YAC/B,sBAAsB,GAAG,CAAC,SAAS,CAAoB,CAAC;aACrD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,sBAAsB,GAAG,SAAS,CAAC;QACrC,CAAC;;YACC,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QAEJ,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;aACvE,IAAI,sBAAsB,CAAC,MAAM,GAAG,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAE3E,IAAI,CAAC;YACH,MAAM,mBAAmB,GACvB,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YAE9D,MAAM,qBAAqB,GAAwB;gBACjD,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,iCAAiC;gBAC1C,aAAa;gBACb,MAAM,EAAE;oBACN,OAAO,EAAE,MAAM,mBAAmB;oBAClC,MAAM,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,sBAAsB,CAAC;iBAChE;gBACD,QAAQ,EAAE,IAAI,CAAC,IAAI;aACpB,CAAC;YACF,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;CACF"}

package/dist/jwt/jwt_keys/index.d.ts

@@ -6,6 +6,7 @@ export { ContentEncryptionKeyPairFactory } from "./ContentEncryptionKeyPairFacto
 export { SigningKeyPairFactory } from "./SigningKeyPairFactory";
 export { generateNewJwtKeySet, generateJwtContentEncryptionKeyPair, generateJwtSigningKeyPair, } from "./generate_new_jwt_keyset";
 export { to_public_jwks } from "./to_public_jwks";
+export { to_public_verification_jwks } from "./to_public_verification_jwks";
 export type { JWK } from "./JWK";
 export type { JWKS } from "./JWKS";
 export { importAsymmetricJWK } from "./importAsymmetricJWK";

package/dist/jwt/jwt_keys/index.js

@@ -6,6 +6,7 @@ export { ContentEncryptionKeyPairFactory } from "./ContentEncryptionKeyPairFacto
 export { SigningKeyPairFactory } from "./SigningKeyPairFactory";
 export { generateNewJwtKeySet, generateJwtContentEncryptionKeyPair, generateJwtSigningKeyPair, } from "./generate_new_jwt_keyset";
 export { to_public_jwks } from "./to_public_jwks";
+export { to_public_verification_jwks } from "./to_public_verification_jwks";
 export { importAsymmetricJWK } from "./importAsymmetricJWK";
 export { PEMFormat } from "./pem-format";
 //# sourceMappingURL=index.js.map

package/dist/jwt/jwt_keys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jwt/jwt_keys/index.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,sEAAsE;AAEtE,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,OAAO,EAAE,MAAM,YAAY,CAAC;AAG3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EACL,oBAAoB,EACpB,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAIlD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jwt/jwt_keys/index.ts"],"names":[],"mappings":"AAAA,oBAAoB;AACpB,sEAAsE;AAEtE,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,OAAO,EAAE,MAAM,YAAY,CAAC;AAG3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EACL,oBAAoB,EACpB,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAI5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC"}

package/dist/jwt/jwt_keys/to_public_verification_jwks.d.ts

@@ -0,0 +1,17 @@
+import type { I_JWT_Keys } from "../../jwt/jwt_keys";
+import { type JWK } from "jose";
+/**
+ * Builds a PUBLIC JWKS document containing ONLY the RS256 verification
+ * (public) keys of the given keysets — the shape a spec-compliant OIDC
+ * `jwks_uri` must serve.
+ *
+ * Deliberately separate from `to_public_jwks`, which also exports each
+ * keyset's private RSA DECRYPTION key: that document exists for the
+ * access-gated per-audience JWKS exchange with trusted resource servers
+ * (which must decrypt the platform's JWE tokens) and must never be
+ * served on a public endpoint.
+ */
+export declare function to_public_verification_jwks(active_keysets: I_JWT_Keys | readonly I_JWT_Keys[]): Promise<{
+    keys: readonly JWK[];
+}>;
+export default to_public_verification_jwks;

package/dist/jwt/jwt_keys/to_public_verification_jwks.js

@@ -0,0 +1,53 @@
+import { exportJWK } from "jose";
+import getAlgorithmForKey from "./getAlgorithmForKey";
+/**
+ * Builds a PUBLIC JWKS document containing ONLY the RS256 verification
+ * (public) keys of the given keysets — the shape a spec-compliant OIDC
+ * `jwks_uri` must serve.
+ *
+ * Deliberately separate from `to_public_jwks`, which also exports each
+ * keyset's private RSA DECRYPTION key: that document exists for the
+ * access-gated per-audience JWKS exchange with trusted resource servers
+ * (which must decrypt the platform's JWE tokens) and must never be
+ * served on a public endpoint.
+ */
+export async function to_public_verification_jwks(active_keysets) {
+    const keysets = Array.isArray(active_keysets)
+        ? active_keysets
+        : [active_keysets];
+    const output_jwks = [];
+    for (const keyset of keysets) {
+        const keyset_id = keyset.keyset_id;
+        if (keyset.keyset_expiry && keyset.keyset_expiry < Date.now()) {
+            // don't use any keys from this expired keyset
+            continue;
+        }
+        const keys_in_set = keyset.listSerializedKeys();
+        for (const key of keys_in_set) {
+            if (key.key_type !== "verification") {
+                continue;
+            }
+            if (key.privacy_level !== "public") {
+                throw new Error(`Verification key in keyset '${keyset_id}' is not marked public!`);
+            }
+            if (key.keyset_id !== keyset_id) {
+                throw new Error(`Keyset '${keyset_id}' contains a key that is not part of it!`);
+            }
+            const jose_activated_key = await keyset.verification_key;
+            const jwk = await exportJWK(jose_activated_key);
+            output_jwks.push({
+                ...jwk,
+                kid: `${keyset_id}-verification`,
+                alg: getAlgorithmForKey(key),
+                use: "sig",
+            });
+        }
+    }
+    const keys = output_jwks;
+    if (keys.length === 0) {
+        console.warn("[to_public_verification_jwks] Output 'keys' array is empty!");
+    }
+    return { keys };
+}
+export default to_public_verification_jwks;
+//# sourceMappingURL=to_public_verification_jwks.js.map

package/dist/jwt/jwt_keys/to_public_verification_jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"to_public_verification_jwks.js","sourceRoot":"","sources":["../../../src/jwt/jwt_keys/to_public_verification_jwks.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAY,MAAM,MAAM,CAAC;AAC3C,OAAO,kBAAkB,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,cAAkD;IAElD,MAAM,OAAO,GAA0B,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;QAClE,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAErB,MAAM,WAAW,GAAU,EAAE,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAW,MAAM,CAAC,SAAS,CAAC;QAE3C,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9D,8CAA8C;YAC9C,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GACf,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,yBAAyB,CAClE,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,0CAA0C,CAC/D,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAc,MAAM,MAAM,CAAC,gBAAgB,CAAC;YACpE,MAAM,GAAG,GAAQ,MAAM,SAAS,CAAC,kBAAkB,CAAC,CAAC;YACrD,WAAW,CAAC,IAAI,CAAC;gBACf,GAAG,GAAG;gBACN,GAAG,EAAE,GAAG,SAAS,eAAe;gBAChC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC;gBAC5B,GAAG,EAAE,KAAK;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAmB,WAAW,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,eAAe,2BAA2B,CAAC"}

package/dist/jwt/payload_data.d.ts

@@ -2,6 +2,7 @@ import type { z as zod } from "zod";
 import { type SchemaVaultsAppEnvironment } from "@schemavaults/app-definitions";
 export declare function createJwtPayloadSchema(z: typeof zod, environment?: SchemaVaultsAppEnvironment): zod.ZodEffects<zod.ZodEffects<zod.ZodObject<{
     sub: zod.ZodString;
+    sig: zod.ZodString;
     uid: zod.ZodString;
     email: zod.ZodString;
     email_verified: zod.ZodBoolean;
@@ -10,13 +11,14 @@ export declare function createJwtPayloadSchema(z: typeof zod, environment?: Sche
     admin: zod.ZodBoolean;
     disabled: zod.ZodBoolean;
     created_at: zod.ZodEffects<zod.ZodNumber, number, number>;
-    sig: zod.ZodString;
     iss: zod.ZodString;
     env: zod.ZodEnum<["development", "staging", "test", "production"]>;
     jti: zod.ZodOptional<zod.ZodString>;
     iat: zod.ZodNumber;
+    scope: zod.ZodOptional<zod.ZodString>;
 }, "strict", zod.ZodTypeAny, {
     sub: string;
+    sig: string;
     uid: string;
     email: string;
     email_verified: boolean;
@@ -25,13 +27,14 @@ export declare function createJwtPayloadSchema(z: typeof zod, environment?: Sche
     admin: boolean;
     disabled: boolean;
     created_at: number;
-    sig: string;
     iss: string;
     env: "development" | "staging" | "test" | "production";
     iat: number;
     jti?: string | undefined;
+    scope?: string | undefined;
 }, {
     sub: string;
+    sig: string;
     uid: string;
     email: string;
     email_verified: boolean;
@@ -40,13 +43,14 @@ export declare function createJwtPayloadSchema(z: typeof zod, environment?: Sche
     admin: boolean;
     disabled: boolean;
     created_at: number;
-    sig: string;
     iss: string;
     env: "development" | "staging" | "test" | "production";
     iat: number;
     jti?: string | undefined;
+    scope?: string | undefined;
 }>, {
     sub: string;
+    sig: string;
     uid: string;
     email: string;
     email_verified: boolean;
@@ -55,13 +59,14 @@ export declare function createJwtPayloadSchema(z: typeof zod, environment?: Sche
     admin: boolean;
     disabled: boolean;
     created_at: number;
-    sig: string;
     iss: string;
     env: "development" | "staging" | "test" | "production";
     iat: number;
     jti?: string | undefined;
+    scope?: string | undefined;
 }, {
     sub: string;
+    sig: string;
     uid: string;
     email: string;
     email_verified: boolean;
@@ -70,13 +75,14 @@ export declare function createJwtPayloadSchema(z: typeof zod, environment?: Sche
     admin: boolean;
     disabled: boolean;
     created_at: number;
-    sig: string;
     iss: string;
     env: "development" | "staging" | "test" | "production";
     iat: number;
     jti?: string | undefined;
+    scope?: string | undefined;
 }>, {
     sub: string;
+    sig: string;
     uid: string;
     email: string;
     email_verified: boolean;
@@ -85,13 +91,14 @@ export declare function createJwtPayloadSchema(z: typeof zod, environment?: Sche
     admin: boolean;
     disabled: boolean;
     created_at: number;
-    sig: string;
     iss: string;
     env: "development" | "staging" | "test" | "production";
     iat: number;
     jti?: string | undefined;
+    scope?: string | undefined;
 }, {
     sub: string;
+    sig: string;
     uid: string;
     email: string;
     email_verified: boolean;
@@ -100,10 +107,10 @@ export declare function createJwtPayloadSchema(z: typeof zod, environment?: Sche
     admin: boolean;
     disabled: boolean;
     created_at: number;
-    sig: string;
     iss: string;
     env: "development" | "staging" | "test" | "production";
     iat: number;
     jti?: string | undefined;
+    scope?: string | undefined;
 }>;
 export type CustomJWTPayload = zod.infer<ReturnType<typeof createJwtPayloadSchema>>;

package/dist/jwt/payload_data.js

@@ -22,6 +22,12 @@ export function createJwtPayloadSchema(z, environment = getAppEnvironment()) {
         env: schemaVaultsAppEnvironmentSchema,
         jti: z.string().uuid().optional(),
         iat: z.number().nonnegative(), // unix seconds (jose's setIssuedAt output)
+        // Space-delimited granted scopes (RFC 6749 §3.3). Set on every
+        // access/refresh token issued since scopes became first-class;
+        // kept optional so tokens issued before then remain decodable
+        // until they expire. /api/oidc/userinfo filters its claims by it
+        // and route guards enforce `required_scopes` against it.
+        scope: z.string().max(256).optional(),
     })
         .required({
         uid: true,

package/dist/jwt/payload_data.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload_data.js","sourceRoot":"","sources":["../../src/jwt/payload_data.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,iBAAiB,EAEjB,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,0BAA0B;AAC1B,MAAM,UAAU,sBAAsB,CACpC,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,CAAC;SACL,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACzB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC3B,GAAG,EAAE,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,6FAA6F;QACxI,GAAG,EAAE,WAAW,EAAE,qFAAqF;QACvG,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM;QAC3B,oCAAoC;QACpC,CAAC,aAAa,EAAW,EAAE;YACzB,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,CAAmB,CAAC;QACzD,CAAC,EACD,yCAAyC,CAC1C;QACD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,gCAAgC;QACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,2CAA2C;KAC3E,CAAC;SACD,QAAQ,CAAC;QACR,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,IAAI;QACX,cAAc,EAAE,IAAI;QACpB,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;QAChB,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;KACV,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;QACtB,OAAO,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG,CAAC;IAC7C,CAAC,EAAE,sCAAsC,CAAC;SACzC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;QACtB,IAAI,WAAW,CAAC,GAAG,KAAK,YAAY,IAAI,WAAW,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACtE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,8DAA8D,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"payload_data.js","sourceRoot":"","sources":["../../src/jwt/payload_data.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,iBAAiB,EAEjB,gCAAgC,GACjC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,0BAA0B;AAC1B,MAAM,UAAU,sBAAsB,CACpC,CAAa,EACb,cAA0C,iBAAiB,EAAE;IAE7D,OAAO,CAAC;SACL,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACzB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;QAC3B,GAAG,EAAE,oBAAoB,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,6FAA6F;QACxI,GAAG,EAAE,WAAW,EAAE,qFAAqF;QACvG,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM;QAC3B,oCAAoC;QACpC,CAAC,aAAa,EAAW,EAAE;YACzB,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE,CAAmB,CAAC;QACzD,CAAC,EACD,yCAAyC,CAC1C;QACD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,gCAAgC;QACrC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,2CAA2C;QAC1E,+DAA+D;QAC/D,+DAA+D;QAC/D,8DAA8D;QAC9D,iEAAiE;QACjE,yDAAyD;QACzD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,QAAQ,CAAC;QACR,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,IAAI;QACX,cAAc,EAAE,IAAI;QACpB,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI;QAChB,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,IAAI;KACV,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;QACtB,OAAO,WAAW,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG,CAAC;IAC7C,CAAC,EAAE,sCAAsC,CAAC;SACzC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE;QACtB,IAAI,WAAW,CAAC,GAAG,KAAK,YAAY,IAAI,WAAW,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACtE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,8DAA8D,CAAC,CAAC;AACvE,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@schemavaults/jwt",
   "description": "Utility functions for authentication and authorization for use from the auth server or a resource server",
-  "version": "0.8.4",
+  "version": "0.11.3",
   "license": "UNLICENSED",
   "private": false,
   "repository": {
@@ -16,8 +16,8 @@
   "dependencies": {
     "zod": "3.25.8",
     "jose": "6.1.3",
-    "@schemavaults/auth-common": "0.16.1",
-    "@schemavaults/app-definitions": "0.10.0"
+    "@schemavaults/auth-common": "0.22.3",
+    "@schemavaults/app-definitions": "0.11.4"
   },
   "scripts": {
     "build": "tsc --project tsconfig.json && tsc-alias --project tsconfig.json",
@@ -30,9 +30,9 @@
     "typecheck": "tsc --project tsconfig.json --noEmit"
   },
   "devDependencies": {
-    "typescript": "5.9.3",
+    "typescript": "6.0.3",
     "bun-types": "1.3.14",
-    "tsc-alias": "1.8.16",
+    "tsc-alias": "1.9.0",
     "eslint": "9.39.1",
     "@eslint/js": "9.39.1",
     "globals": "16.5.0",