@sourceregistry/node-jwt 1.3.0 → 1.4.0

package/dist/jwt/index.d.ts

@@ -0,0 +1,259 @@
+import { BinaryLike, KeyLike, KeyObject } from 'crypto';
+export declare const base64Url: {
+    encode: (input: string | Buffer) => string;
+    decode: (input: string) => string;
+};
+export interface JWTPayload {
+    /**
+     * Issuer
+     */
+    iss?: string;
+    /**
+     * Subject
+     */
+    sub?: string;
+    /**
+     * Audience
+     */
+    aud?: string | string[];
+    /**
+     * Expiration Time (as UNIX timestamp)
+     */
+    exp?: number;
+    /**
+     * Not Before (as UNIX timestamp)
+     */
+    nbf?: number;
+    /**
+     * Issued At (as UNIX timestamp)
+     */
+    iat?: number;
+    /**
+     * JWT ID
+     */
+    jti?: string;
+    /**
+     * Session ID
+     */
+    sid?: string;
+    /**
+     * Custom claims
+     */
+    [key: string]: unknown;
+}
+export interface JWTHeader {
+    alg: string;
+    typ?: string;
+    kid?: string;
+}
+export interface JWT {
+    header: JWTHeader;
+    payload: JWTPayload;
+    signature: string;
+}
+export declare const SignatureAlgorithm: {
+    readonly HS256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly HS384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly HS512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly RS256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly RS384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly RS512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly ES256K: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly PS256: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly PS384: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly PS512: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+    readonly EdDSA: {
+        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    };
+};
+export type SupportedAlgorithm = keyof typeof SignatureAlgorithm;
+export declare const SupportedAlgorithms: Array<SupportedAlgorithm>;
+/**
+ * Autodetection of algorithm for KeyObjects
+ * @param key
+ * @constructor
+ */
+export declare function AutodetectAlgorithm(key: KeyObject): SupportedAlgorithm;
+/**
+ * Decode a JWT string into its parts (without verification)
+ * @param token
+ */
+export declare const decode: (token: string) => JWT;
+/**
+ * Sign a JWT
+ * @param payload
+ * @param secret
+ * @param options
+ */
+export declare const sign: (payload: JWTPayload, secret: KeyLike, options?: {
+    alg?: SupportedAlgorithm;
+    kid?: string;
+    typ?: string;
+    /**
+     * default 'der'
+     */
+    signatureFormat?: "der" | "jose";
+}) => string;
+/**
+ * Verify and validate a JWT
+ * @param token
+ * @param secret
+ * @param options
+ */
+export declare const verify: (token: string, secret: KeyLike, options?: {
+    algorithms?: SupportedAlgorithm[];
+    issuer?: string;
+    subject?: string;
+    audience?: string | string[];
+    jwtId?: string;
+    ignoreExpiration?: boolean;
+    clockSkew?: number;
+    maxTokenAge?: number;
+    signatureFormat?: "der" | "jose";
+}) => {
+    valid: true;
+    header: JWTHeader;
+    payload: JWTPayload;
+    signature: string;
+} | {
+    valid: false;
+    error: {
+        reason: string;
+        code: string;
+    };
+};
+export declare const JWT: {
+    sign: (payload: JWTPayload, secret: KeyLike, options?: {
+        alg?: SupportedAlgorithm;
+        kid?: string;
+        typ?: string;
+        /**
+         * default 'der'
+         */
+        signatureFormat?: "der" | "jose";
+    }) => string;
+    verify: (token: string, secret: KeyLike, options?: {
+        algorithms?: SupportedAlgorithm[];
+        issuer?: string;
+        subject?: string;
+        audience?: string | string[];
+        jwtId?: string;
+        ignoreExpiration?: boolean;
+        clockSkew?: number;
+        maxTokenAge?: number;
+        signatureFormat?: "der" | "jose";
+    }) => {
+        valid: true;
+        header: JWTHeader;
+        payload: JWTPayload;
+        signature: string;
+    } | {
+        valid: false;
+        error: {
+            reason: string;
+            code: string;
+        };
+    };
+    decode: (token: string) => JWT;
+    algorithms: {
+        readonly HS256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly HS384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly HS512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly RS512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly ES256K: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly PS256: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly PS384: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly PS512: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+        readonly EdDSA: {
+            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
+            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+        };
+    };
+};

package/dist/jwt/promises.d.ts

@@ -0,0 +1,104 @@
+import { JWT as JSONWebToken, sign as signSync, verify as verifySync, JWTPayload, SupportedAlgorithm, JWTHeader } from '../';
+export { type SupportedAlgorithm, SupportedAlgorithms, SignatureAlgorithm, type JWTHeader, type JWTPayload } from '../index';
+/**
+ * Decode a JWT string into its parts (without verification)
+ * @param token
+ */
+export declare const decode: (token: string) => Promise<JSONWebToken>;
+/**
+ * Sign a JWT
+ * @see(synchronous parameters)
+ */
+export declare const sign: (...args: Parameters<typeof signSync>) => Promise<string>;
+/**
+ * Verify and validate a JWT
+ * @throws { { reason: string; code: string } } if invalid
+ */
+export declare const verify: (...args: Parameters<typeof verifySync>) => Promise<{
+    header: JWTHeader;
+    payload: JWTPayload;
+    signature: string;
+}>;
+export type JWT = JSONWebToken;
+export declare const JWT: {
+    sign: (payload: JWTPayload, secret: import('crypto').KeyLike, options?: {
+        alg?: SupportedAlgorithm;
+        kid?: string;
+        typ?: string;
+        signatureFormat?: "der" | "jose";
+    } | undefined) => Promise<string>;
+    verify: (token: string, secret: import('crypto').KeyLike, options?: {
+        algorithms?: SupportedAlgorithm[];
+        issuer?: string;
+        subject?: string;
+        audience?: string | string[];
+        jwtId?: string;
+        ignoreExpiration?: boolean;
+        clockSkew?: number;
+        maxTokenAge?: number;
+        signatureFormat?: "der" | "jose";
+    } | undefined) => Promise<{
+        header: JWTHeader;
+        payload: JWTPayload;
+        signature: string;
+    }>;
+    decode: (token: string) => Promise<JSONWebToken>;
+    algorithms: {
+        readonly HS256: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly HS384: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly HS512: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly RS256: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly RS384: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly RS512: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly ES256: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly ES384: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly ES512: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly ES256K: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly PS256: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly PS384: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly PS512: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+        readonly EdDSA: {
+            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
+            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+        };
+    };
+};

package/dist/promises.cjs.js

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("./index-CSRWSLal.cjs");require("crypto");const s=e=>Promise.resolve().then(()=>o.decode(e)),n=(e,t,r={})=>Promise.resolve().then(()=>o.sign(e,t,r)),c=(e,t,r={})=>Promise.resolve().then(()=>{const i=o.verify(e,t,r);if(!i.valid)throw i.error;const{header:p,payload:g,signature:a}=i;return{header:p,payload:g,signature:a}}),v={sign:n,verify:c,decode:s,algorithms:o.SignatureAlgorithm},m=e=>Promise.resolve().then(()=>o.exportJWK(e)),l=e=>Promise.resolve().then(()=>o.importJWK(e)),K=e=>Promise.resolve().then(()=>o.toPublicJWK(e)),u=(e,t="sha256")=>Promise.resolve().then(()=>o.getJWKThumbprint(e,t)),J=(e,t)=>Promise.resolve().then(()=>o.JWKSToKeyObject(e,t)),W=e=>Promise.resolve().then(()=>o.normalizeJWKS(e)),h=e=>Promise.resolve().then(()=>o.computeX5T(e)),P={export:m,import:l,toPublic:K,thumbprint:u,computeX5T:h},S={toKeyObject:J,normalize:W};exports.SignatureAlgorithm=o.SignatureAlgorithm;exports.SupportedAlgorithms=o.SupportedAlgorithms;exports.JWK=P;exports.JWKS=S;exports.JWKSToKeyObject=J;exports.JWT=v;exports.computeX5T=h;exports.decode=s;exports.exportJWK=m;exports.getJWKThumbprint=u;exports.importJWK=l;exports.normalizeJWKS=W;exports.sign=n;exports.toPublicJWK=K;exports.verify=c;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("./index-eYY-I3Pd.cjs");require("crypto");const r=e=>Promise.resolve().then(()=>o.decode(e)),i=(...e)=>Promise.resolve().then(()=>o.sign(...e)),s=(...e)=>Promise.resolve().then(()=>{const t=o.verify(...e);if(!t.valid)throw t.error;const{header:W,payload:h,signature:p}=t;return{header:W,payload:h,signature:p}}),g={sign:i,verify:s,decode:r,algorithms:o.SignatureAlgorithm},n=e=>Promise.resolve().then(()=>o.exportJWK(e)),c=e=>Promise.resolve().then(()=>o.importJWK(e)),m=e=>Promise.resolve().then(()=>o.toPublicJWK(e)),l=(e,t="sha256")=>Promise.resolve().then(()=>o.getJWKThumbprint(e,t)),K=(e,t)=>Promise.resolve().then(()=>o.JWKSToKeyObject(e,t)),u=e=>Promise.resolve().then(()=>o.normalizeJWKS(e)),J=e=>Promise.resolve().then(()=>o.computeX5T(e)),a={export:n,import:c,toPublic:m,thumbprint:l,computeX5T:J},v={toKeyObject:K,normalize:u};exports.SignatureAlgorithm=o.SignatureAlgorithm;exports.SupportedAlgorithms=o.SupportedAlgorithms;exports.JWK=a;exports.JWKS=v;exports.JWKSToKeyObject=K;exports.JWT=g;exports.computeX5T=J;exports.decode=r;exports.exportJWK=n;exports.getJWKThumbprint=l;exports.importJWK=c;exports.normalizeJWKS=u;exports.sign=i;exports.toPublicJWK=m;exports.verify=s;
 //# sourceMappingURL=promises.cjs.js.map

package/dist/promises.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"promises.cjs.js","sources":["../src/jwt/promises.ts","../src/jwks/promises.ts"],"sourcesContent":["import type { KeyLike } from 'crypto';\nimport {\n    type JWT as JSONWebToken,\n    decode as decodeSync,\n    sign as signSync,\n    verify as verifySync,\n    JWTPayload,\n    type SupportedAlgorithm,\n    JWTHeader,\n    SignatureAlgorithm\n} from '../';\n\nexport { type SupportedAlgorithm, SupportedAlgorithms, SignatureAlgorithm, type JWTHeader, type JWTPayload } from '../index';\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): Promise<JSONWebToken> =>\n    Promise.resolve().then(() => decodeSync(token));\n\n/**\n * Sign a JWT\n * @param payload\n * @param secret\n * @param options\n */\nexport const sign = (\n    payload: JWTPayload,\n    secret: KeyLike,\n    options: {\n        alg?: SupportedAlgorithm;\n        kid?: string;\n        typ?: string;\n    } = {}\n): Promise<string> =>\n    Promise.resolve().then(() => signSync(payload, secret, options));\n\n/**\n * Verify and validate a JWT\n * @throws { { reason: string; code: string } } if invalid\n */\nexport const verify = (\n    token: string,\n    secret: KeyLike,\n    options: {\n        algorithms?: SupportedAlgorithm[]; // Whitelist of allowed algorithms\n        issuer?: string;\n        subject?: string;\n        audience?: string | string[];\n        jwtId?: string;\n        ignoreExpiration?: boolean;\n        clockSkew?: number; // in seconds, default 0\n        maxTokenAge?: number; // Maximum age in seconds\n    } = {}\n): Promise<{ header: JWTHeader; payload: JWTPayload; signature: string }> =>\n    Promise.resolve().then(() => {\n        const result = verifySync(token, secret, options);\n        if (!result.valid) {\n            throw result.error;\n        }\n        const { header, payload, signature } = result;\n        return { header, payload, signature };\n    });\n\nexport type JWT = JSONWebToken;\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n","import type {KeyObject} from 'crypto';\n\nimport {\n    type JWK as JWKType,\n    type JWKS as JSONWebKeySet,\n    exportJWK as exportJWKSYNC,\n    importJWK as importJWKSYNC,\n    toPublicJWK as toPublicJWKSYNC,\n    getJWKThumbprint as getJWKThumbprintSYNC,\n    JWKSToKeyObject as JWKSToKeyObjectSYNC,\n    normalizeJWKS as normalizeJWKSSYNC,\n    computeX5T as computeX5TSYNC\n} from './';\n\n/**\n * Export a KeyObject to JWK\n * @param key\n */\nexport const exportJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => exportJWKSYNC(key));\n\n/**\n * Import a JWK to KeyObject\n * @param jwk\n */\nexport const importJWK = (jwk: JWKType): Promise<KeyObject> =>\n    Promise.resolve().then(() => importJWKSYNC(jwk));\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport const toPublicJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => toPublicJWKSYNC(key));\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport const getJWKThumbprint = (\n    jwk: JWKType,\n    hashAlg: 'sha256' = 'sha256'\n): Promise<string> =>\n    Promise.resolve().then(() => getJWKThumbprintSYNC(jwk, hashAlg));\n\n/**\n * Resolve a KeyObject from a JWKS (kid-based)\n * @param jwks\n * @param kid\n * @constructor\n */\nexport const JWKSToKeyObject = (\n    jwks: JSONWebKeySet,\n    kid?: string\n): Promise<KeyObject> =>\n    Promise.resolve().then(() => JWKSToKeyObjectSYNC(jwks, kid));\n\n/**\n * Normalize JWKS (auto-generate missing kid values)\n * @param jwks\n */\nexport const normalizeJWKS = (\n    jwks: JSONWebKeySet\n): Promise<JSONWebKeySet> =>\n    Promise.resolve().then(() => normalizeJWKSSYNC(jwks));\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport const computeX5T = (jwk: JWKType) => Promise.resolve().then(() => computeX5TSYNC(jwk))\n\n//namespaced exports\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n    computeX5T: computeX5T,\n};\n\n//namespaced exports\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS,\n};\n"],"names":["decode","token","decodeSync","sign","payload","secret","options","signSync","verify","result","verifySync","header","signature","JWT","SignatureAlgorithm","exportJWK","key","exportJWKSYNC","importJWK","jwk","importJWKSYNC","toPublicJWK","toPublicJWKSYNC","getJWKThumbprint","hashAlg","getJWKThumbprintSYNC","JWKSToKeyObject","jwks","kid","JWKSToKeyObjectSYNC","normalizeJWKS","normalizeJWKSSYNC","computeX5T","computeX5TSYNC","JWK","JWKS"],"mappings":"0IAkBO,MAAMA,EAAUC,GACnB,QAAQ,QAAA,EAAU,KAAK,IAAMC,EAAAA,OAAWD,CAAK,CAAC,EAQrCE,EAAO,CAChBC,EACAC,EACAC,EAII,CAAA,IAEJ,QAAQ,QAAA,EAAU,KAAK,IAAMC,EAAAA,KAASH,EAASC,EAAQC,CAAO,CAAC,EAMtDE,EAAS,CAClBP,EACAI,EACAC,EASI,CAAA,IAEJ,QAAQ,UAAU,KAAK,IAAM,CACzB,MAAMG,EAASC,EAAAA,OAAWT,EAAOI,EAAQC,CAAO,EAChD,GAAI,CAACG,EAAO,MACR,MAAMA,EAAO,MAEjB,KAAM,CAAE,OAAAE,EAAQ,QAAAP,EAAS,UAAAQ,CAAA,EAAcH,EACvC,MAAO,CAAE,OAAAE,EAAQ,QAAAP,EAAS,UAAAQ,CAAA,CAC9B,CAAC,EAKQC,EAAM,CACf,KAAAV,EACA,OAAAK,EACA,OAAAR,EACA,WAAYc,EAAAA,kBAChB,ECvDaC,EAAaC,GACtB,QAAQ,QAAA,EAAU,KAAK,IAAMC,EAAAA,UAAcD,CAAG,CAAC,EAMtCE,EAAaC,GACtB,QAAQ,QAAA,EAAU,KAAK,IAAMC,EAAAA,UAAcD,CAAG,CAAC,EAMtCE,EAAeL,GACxB,QAAQ,QAAA,EAAU,KAAK,IAAMM,EAAAA,YAAgBN,CAAG,CAAC,EAOxCO,EAAmB,CAC5BJ,EACAK,EAAoB,WAEpB,QAAQ,QAAA,EAAU,KAAK,IAAMC,mBAAqBN,EAAKK,CAAO,CAAC,EAQtDE,EAAkB,CAC3BC,EACAC,IAEA,QAAQ,UAAU,KAAK,IAAMC,EAAAA,gBAAoBF,EAAMC,CAAG,CAAC,EAMlDE,EACTH,GAEA,QAAQ,QAAA,EAAU,KAAK,IAAMI,EAAAA,cAAkBJ,CAAI,CAAC,EAM3CK,EAAcb,GAAiB,QAAQ,QAAA,EAAU,KAAK,IAAMc,EAAAA,WAAed,CAAG,CAAC,EAG/Ee,EAAM,CACf,OAAQnB,EACR,OAAQG,EACR,SAAUG,EACV,WAAYE,EACZ,WAAAS,CACJ,EAGaG,EAAO,CAChB,YAAaT,EACb,UAAWI,CACf"}
+{"version":3,"file":"promises.cjs.js","sources":["../src/jwt/promises.ts","../src/jwks/promises.ts"],"sourcesContent":["import {\n    type JWT as JSONWebToken,\n    decode as decodeSync,\n    sign as signSync,\n    verify as verifySync,\n    JWTPayload,\n    type SupportedAlgorithm,\n    JWTHeader,\n    SignatureAlgorithm\n} from '../';\n\nexport {\n    type SupportedAlgorithm, SupportedAlgorithms, SignatureAlgorithm, type JWTHeader, type JWTPayload\n} from '../index';\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): Promise<JSONWebToken> =>\n    Promise.resolve().then(() => decodeSync(token));\n\n/**\n * Sign a JWT\n * @see(synchronous parameters)\n */\nexport const sign = (...args: Parameters<typeof signSync>): Promise<string> =>\n    Promise.resolve().then(() => signSync(...args));\n\n/**\n * Verify and validate a JWT\n * @throws { { reason: string; code: string } } if invalid\n */\nexport const verify = (...args: Parameters<typeof verifySync>): Promise<{\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string\n}> =>\n    Promise.resolve().then(() => {\n        const result = verifySync(...args);\n        if (!result.valid) {\n            throw result.error;\n        }\n        const {header, payload, signature} = result;\n        return {header, payload, signature};\n    });\n\nexport type JWT = JSONWebToken;\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n","import type {KeyObject} from 'crypto';\n\nimport {\n    type JWK as JWKType,\n    type JWKS as JSONWebKeySet,\n    exportJWK as exportJWKSYNC,\n    importJWK as importJWKSYNC,\n    toPublicJWK as toPublicJWKSYNC,\n    getJWKThumbprint as getJWKThumbprintSYNC,\n    JWKSToKeyObject as JWKSToKeyObjectSYNC,\n    normalizeJWKS as normalizeJWKSSYNC,\n    computeX5T as computeX5TSYNC\n} from './';\n\n/**\n * Export a KeyObject to JWK\n * @param key\n */\nexport const exportJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => exportJWKSYNC(key));\n\n/**\n * Import a JWK to KeyObject\n * @param jwk\n */\nexport const importJWK = (jwk: JWKType): Promise<KeyObject> =>\n    Promise.resolve().then(() => importJWKSYNC(jwk));\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport const toPublicJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => toPublicJWKSYNC(key));\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport const getJWKThumbprint = (\n    jwk: JWKType,\n    hashAlg: 'sha256' = 'sha256'\n): Promise<string> =>\n    Promise.resolve().then(() => getJWKThumbprintSYNC(jwk, hashAlg));\n\n/**\n * Resolve a KeyObject from a JWKS (kid-based)\n * @param jwks\n * @param kid\n * @constructor\n */\nexport const JWKSToKeyObject = (\n    jwks: JSONWebKeySet,\n    kid?: string\n): Promise<KeyObject> =>\n    Promise.resolve().then(() => JWKSToKeyObjectSYNC(jwks, kid));\n\n/**\n * Normalize JWKS (auto-generate missing kid values)\n * @param jwks\n */\nexport const normalizeJWKS = (\n    jwks: JSONWebKeySet\n): Promise<JSONWebKeySet> =>\n    Promise.resolve().then(() => normalizeJWKSSYNC(jwks));\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport const computeX5T = (jwk: JWKType) => Promise.resolve().then(() => computeX5TSYNC(jwk))\n\n//namespaced exports\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n    computeX5T: computeX5T,\n};\n\n//namespaced exports\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS,\n};\n"],"names":["decode","token","decodeSync","sign","args","signSync","verify","result","verifySync","header","payload","signature","JWT","SignatureAlgorithm","exportJWK","key","exportJWKSYNC","importJWK","jwk","importJWKSYNC","toPublicJWK","toPublicJWKSYNC","getJWKThumbprint","hashAlg","getJWKThumbprintSYNC","JWKSToKeyObject","jwks","kid","JWKSToKeyObjectSYNC","normalizeJWKS","normalizeJWKSSYNC","computeX5T","computeX5TSYNC","JWK","JWKS"],"mappings":"0IAmBO,MAAMA,EAAUC,GACnB,QAAQ,QAAA,EAAU,KAAK,IAAMC,EAAAA,OAAWD,CAAK,CAAC,EAMrCE,EAAO,IAAIC,IACpB,QAAQ,QAAA,EAAU,KAAK,IAAMC,OAAS,GAAGD,CAAI,CAAC,EAMrCE,EAAS,IAAIF,IAKtB,QAAQ,QAAA,EAAU,KAAK,IAAM,CACzB,MAAMG,EAASC,SAAW,GAAGJ,CAAI,EACjC,GAAI,CAACG,EAAO,MACR,MAAMA,EAAO,MAEjB,KAAM,CAAC,OAAAE,EAAQ,QAAAC,EAAS,UAAAC,CAAA,EAAaJ,EACrC,MAAO,CAAC,OAAAE,EAAQ,QAAAC,EAAS,UAAAC,CAAA,CAC7B,CAAC,EAKQC,EAAM,CACf,KAAAT,EACA,OAAAG,EACA,OAAAN,EACA,WAAYa,EAAAA,kBAChB,ECrCaC,EAAaC,GACtB,QAAQ,QAAA,EAAU,KAAK,IAAMC,EAAAA,UAAcD,CAAG,CAAC,EAMtCE,EAAaC,GACtB,QAAQ,QAAA,EAAU,KAAK,IAAMC,EAAAA,UAAcD,CAAG,CAAC,EAMtCE,EAAeL,GACxB,QAAQ,QAAA,EAAU,KAAK,IAAMM,EAAAA,YAAgBN,CAAG,CAAC,EAOxCO,EAAmB,CAC5BJ,EACAK,EAAoB,WAEpB,QAAQ,QAAA,EAAU,KAAK,IAAMC,mBAAqBN,EAAKK,CAAO,CAAC,EAQtDE,EAAkB,CAC3BC,EACAC,IAEA,QAAQ,UAAU,KAAK,IAAMC,EAAAA,gBAAoBF,EAAMC,CAAG,CAAC,EAMlDE,EACTH,GAEA,QAAQ,QAAA,EAAU,KAAK,IAAMI,EAAAA,cAAkBJ,CAAI,CAAC,EAM3CK,EAAcb,GAAiB,QAAQ,QAAA,EAAU,KAAK,IAAMc,EAAAA,WAAed,CAAG,CAAC,EAG/Ee,EAAM,CACf,OAAQnB,EACR,OAAQG,EACR,SAAUG,EACV,WAAYE,EACZ,WAAAS,CACJ,EAGaG,EAAO,CAChB,YAAaT,EACb,UAAWI,CACf"}

package/dist/promises.es.js

@@ -1,42 +1,42 @@
-import { S as m, d as c, s as a, v as l, e as h, i as p, t as K, g as J, h as W, n as v, c as u } from "./index-DyXdSqEc.js";
-import { a as q } from "./index-DyXdSqEc.js";
+import { S as n, d as i, s as m, v as c, e as a, i as l, t as h, g as p, h as K, n as J, c as W } from "./index-BmAAEOLC.js";
+import { a as w } from "./index-BmAAEOLC.js";
 import "crypto";
-const P = (e) => Promise.resolve().then(() => c(e)), g = (e, o, t = {}) => Promise.resolve().then(() => a(e, o, t)), $ = (e, o, t = {}) => Promise.resolve().then(() => {
-  const s = l(e, o, t);
-  if (!s.valid)
-    throw s.error;
-  const { header: r, payload: n, signature: i } = s;
-  return { header: r, payload: n, signature: i };
-}), O = {
-  sign: g,
-  verify: $,
-  decode: P,
-  algorithms: m
-}, b = (e) => Promise.resolve().then(() => h(e)), d = (e) => Promise.resolve().then(() => p(e)), S = (e) => Promise.resolve().then(() => K(e)), T = (e, o = "sha256") => Promise.resolve().then(() => J(e, o)), y = (e, o) => Promise.resolve().then(() => W(e, o)), f = (e) => Promise.resolve().then(() => v(e)), x = (e) => Promise.resolve().then(() => u(e)), A = {
-  export: b,
-  import: d,
-  toPublic: S,
-  thumbprint: T,
-  computeX5T: x
-}, X = {
-  toKeyObject: y,
-  normalize: f
+const v = (e) => Promise.resolve().then(() => i(e)), u = (...e) => Promise.resolve().then(() => m(...e)), P = (...e) => Promise.resolve().then(() => {
+  const o = c(...e);
+  if (!o.valid)
+    throw o.error;
+  const { header: t, payload: s, signature: r } = o;
+  return { header: t, payload: s, signature: r };
+}), j = {
+  sign: u,
+  verify: P,
+  decode: v,
+  algorithms: n
+}, g = (e) => Promise.resolve().then(() => a(e)), $ = (e) => Promise.resolve().then(() => l(e)), b = (e) => Promise.resolve().then(() => h(e)), d = (e, o = "sha256") => Promise.resolve().then(() => p(e, o)), S = (e, o) => Promise.resolve().then(() => K(e, o)), T = (e) => Promise.resolve().then(() => J(e)), y = (e) => Promise.resolve().then(() => W(e)), z = {
+  export: g,
+  import: $,
+  toPublic: b,
+  thumbprint: d,
+  computeX5T: y
+}, O = {
+  toKeyObject: S,
+  normalize: T
 };
 export {
-  A as JWK,
-  X as JWKS,
-  y as JWKSToKeyObject,
-  O as JWT,
-  m as SignatureAlgorithm,
-  q as SupportedAlgorithms,
-  x as computeX5T,
-  P as decode,
-  b as exportJWK,
-  T as getJWKThumbprint,
-  d as importJWK,
-  f as normalizeJWKS,
-  g as sign,
-  S as toPublicJWK,
-  $ as verify
+  z as JWK,
+  O as JWKS,
+  S as JWKSToKeyObject,
+  j as JWT,
+  n as SignatureAlgorithm,
+  w as SupportedAlgorithms,
+  y as computeX5T,
+  v as decode,
+  g as exportJWK,
+  d as getJWKThumbprint,
+  $ as importJWK,
+  T as normalizeJWKS,
+  u as sign,
+  b as toPublicJWK,
+  P as verify
 };
 //# sourceMappingURL=promises.es.js.map

package/dist/promises.es.js.map

@@ -1 +1 @@
-{"version":3,"file":"promises.es.js","sources":["../src/jwt/promises.ts","../src/jwks/promises.ts"],"sourcesContent":["import type { KeyLike } from 'crypto';\nimport {\n    type JWT as JSONWebToken,\n    decode as decodeSync,\n    sign as signSync,\n    verify as verifySync,\n    JWTPayload,\n    type SupportedAlgorithm,\n    JWTHeader,\n    SignatureAlgorithm\n} from '../';\n\nexport { type SupportedAlgorithm, SupportedAlgorithms, SignatureAlgorithm, type JWTHeader, type JWTPayload } from '../index';\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): Promise<JSONWebToken> =>\n    Promise.resolve().then(() => decodeSync(token));\n\n/**\n * Sign a JWT\n * @param payload\n * @param secret\n * @param options\n */\nexport const sign = (\n    payload: JWTPayload,\n    secret: KeyLike,\n    options: {\n        alg?: SupportedAlgorithm;\n        kid?: string;\n        typ?: string;\n    } = {}\n): Promise<string> =>\n    Promise.resolve().then(() => signSync(payload, secret, options));\n\n/**\n * Verify and validate a JWT\n * @throws { { reason: string; code: string } } if invalid\n */\nexport const verify = (\n    token: string,\n    secret: KeyLike,\n    options: {\n        algorithms?: SupportedAlgorithm[]; // Whitelist of allowed algorithms\n        issuer?: string;\n        subject?: string;\n        audience?: string | string[];\n        jwtId?: string;\n        ignoreExpiration?: boolean;\n        clockSkew?: number; // in seconds, default 0\n        maxTokenAge?: number; // Maximum age in seconds\n    } = {}\n): Promise<{ header: JWTHeader; payload: JWTPayload; signature: string }> =>\n    Promise.resolve().then(() => {\n        const result = verifySync(token, secret, options);\n        if (!result.valid) {\n            throw result.error;\n        }\n        const { header, payload, signature } = result;\n        return { header, payload, signature };\n    });\n\nexport type JWT = JSONWebToken;\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n","import type {KeyObject} from 'crypto';\n\nimport {\n    type JWK as JWKType,\n    type JWKS as JSONWebKeySet,\n    exportJWK as exportJWKSYNC,\n    importJWK as importJWKSYNC,\n    toPublicJWK as toPublicJWKSYNC,\n    getJWKThumbprint as getJWKThumbprintSYNC,\n    JWKSToKeyObject as JWKSToKeyObjectSYNC,\n    normalizeJWKS as normalizeJWKSSYNC,\n    computeX5T as computeX5TSYNC\n} from './';\n\n/**\n * Export a KeyObject to JWK\n * @param key\n */\nexport const exportJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => exportJWKSYNC(key));\n\n/**\n * Import a JWK to KeyObject\n * @param jwk\n */\nexport const importJWK = (jwk: JWKType): Promise<KeyObject> =>\n    Promise.resolve().then(() => importJWKSYNC(jwk));\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport const toPublicJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => toPublicJWKSYNC(key));\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport const getJWKThumbprint = (\n    jwk: JWKType,\n    hashAlg: 'sha256' = 'sha256'\n): Promise<string> =>\n    Promise.resolve().then(() => getJWKThumbprintSYNC(jwk, hashAlg));\n\n/**\n * Resolve a KeyObject from a JWKS (kid-based)\n * @param jwks\n * @param kid\n * @constructor\n */\nexport const JWKSToKeyObject = (\n    jwks: JSONWebKeySet,\n    kid?: string\n): Promise<KeyObject> =>\n    Promise.resolve().then(() => JWKSToKeyObjectSYNC(jwks, kid));\n\n/**\n * Normalize JWKS (auto-generate missing kid values)\n * @param jwks\n */\nexport const normalizeJWKS = (\n    jwks: JSONWebKeySet\n): Promise<JSONWebKeySet> =>\n    Promise.resolve().then(() => normalizeJWKSSYNC(jwks));\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport const computeX5T = (jwk: JWKType) => Promise.resolve().then(() => computeX5TSYNC(jwk))\n\n//namespaced exports\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n    computeX5T: computeX5T,\n};\n\n//namespaced exports\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS,\n};\n"],"names":["decode","token","decodeSync","sign","payload","secret","options","signSync","verify","result","verifySync","header","signature","JWT","SignatureAlgorithm","exportJWK","key","exportJWKSYNC","importJWK","jwk","importJWKSYNC","toPublicJWK","toPublicJWKSYNC","getJWKThumbprint","hashAlg","getJWKThumbprintSYNC","JWKSToKeyObject","jwks","kid","JWKSToKeyObjectSYNC","normalizeJWKS","normalizeJWKSSYNC","computeX5T","computeX5TSYNC","JWK","JWKS"],"mappings":";;;AAkBO,MAAMA,IAAS,CAACC,MACnB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAWD,CAAK,CAAC,GAQrCE,IAAO,CAChBC,GACAC,GACAC,IAII,CAAA,MAEJ,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAASH,GAASC,GAAQC,CAAO,CAAC,GAMtDE,IAAS,CAClBP,GACAI,GACAC,IASI,CAAA,MAEJ,QAAQ,UAAU,KAAK,MAAM;AACzB,QAAMG,IAASC,EAAWT,GAAOI,GAAQC,CAAO;AAChD,MAAI,CAACG,EAAO;AACR,UAAMA,EAAO;AAEjB,QAAM,EAAE,QAAAE,GAAQ,SAAAP,GAAS,WAAAQ,EAAA,IAAcH;AACvC,SAAO,EAAE,QAAAE,GAAQ,SAAAP,GAAS,WAAAQ,EAAA;AAC9B,CAAC,GAKQC,IAAM;AAAA,EACf,MAAAV;AAAA,EACA,QAAAK;AAAA,EACA,QAAAR;AAAA,EACA,YAAYc;AAChB,GCvDaC,IAAY,CAACC,MACtB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAcD,CAAG,CAAC,GAMtCE,IAAY,CAACC,MACtB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAcD,CAAG,CAAC,GAMtCE,IAAc,CAACL,MACxB,QAAQ,QAAA,EAAU,KAAK,MAAMM,EAAgBN,CAAG,CAAC,GAOxCO,IAAmB,CAC5BJ,GACAK,IAAoB,aAEpB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAqBN,GAAKK,CAAO,CAAC,GAQtDE,IAAkB,CAC3BC,GACAC,MAEA,QAAQ,UAAU,KAAK,MAAMC,EAAoBF,GAAMC,CAAG,CAAC,GAMlDE,IAAgB,CACzBH,MAEA,QAAQ,QAAA,EAAU,KAAK,MAAMI,EAAkBJ,CAAI,CAAC,GAM3CK,IAAa,CAACb,MAAiB,QAAQ,QAAA,EAAU,KAAK,MAAMc,EAAed,CAAG,CAAC,GAG/Ee,IAAM;AAAA,EACf,QAAQnB;AAAA,EACR,QAAQG;AAAA,EACR,UAAUG;AAAA,EACV,YAAYE;AAAA,EACZ,YAAAS;AACJ,GAGaG,IAAO;AAAA,EAChB,aAAaT;AAAA,EACb,WAAWI;AACf;"}
+{"version":3,"file":"promises.es.js","sources":["../src/jwt/promises.ts","../src/jwks/promises.ts"],"sourcesContent":["import {\n    type JWT as JSONWebToken,\n    decode as decodeSync,\n    sign as signSync,\n    verify as verifySync,\n    JWTPayload,\n    type SupportedAlgorithm,\n    JWTHeader,\n    SignatureAlgorithm\n} from '../';\n\nexport {\n    type SupportedAlgorithm, SupportedAlgorithms, SignatureAlgorithm, type JWTHeader, type JWTPayload\n} from '../index';\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): Promise<JSONWebToken> =>\n    Promise.resolve().then(() => decodeSync(token));\n\n/**\n * Sign a JWT\n * @see(synchronous parameters)\n */\nexport const sign = (...args: Parameters<typeof signSync>): Promise<string> =>\n    Promise.resolve().then(() => signSync(...args));\n\n/**\n * Verify and validate a JWT\n * @throws { { reason: string; code: string } } if invalid\n */\nexport const verify = (...args: Parameters<typeof verifySync>): Promise<{\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string\n}> =>\n    Promise.resolve().then(() => {\n        const result = verifySync(...args);\n        if (!result.valid) {\n            throw result.error;\n        }\n        const {header, payload, signature} = result;\n        return {header, payload, signature};\n    });\n\nexport type JWT = JSONWebToken;\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n","import type {KeyObject} from 'crypto';\n\nimport {\n    type JWK as JWKType,\n    type JWKS as JSONWebKeySet,\n    exportJWK as exportJWKSYNC,\n    importJWK as importJWKSYNC,\n    toPublicJWK as toPublicJWKSYNC,\n    getJWKThumbprint as getJWKThumbprintSYNC,\n    JWKSToKeyObject as JWKSToKeyObjectSYNC,\n    normalizeJWKS as normalizeJWKSSYNC,\n    computeX5T as computeX5TSYNC\n} from './';\n\n/**\n * Export a KeyObject to JWK\n * @param key\n */\nexport const exportJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => exportJWKSYNC(key));\n\n/**\n * Import a JWK to KeyObject\n * @param jwk\n */\nexport const importJWK = (jwk: JWKType): Promise<KeyObject> =>\n    Promise.resolve().then(() => importJWKSYNC(jwk));\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport const toPublicJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => toPublicJWKSYNC(key));\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport const getJWKThumbprint = (\n    jwk: JWKType,\n    hashAlg: 'sha256' = 'sha256'\n): Promise<string> =>\n    Promise.resolve().then(() => getJWKThumbprintSYNC(jwk, hashAlg));\n\n/**\n * Resolve a KeyObject from a JWKS (kid-based)\n * @param jwks\n * @param kid\n * @constructor\n */\nexport const JWKSToKeyObject = (\n    jwks: JSONWebKeySet,\n    kid?: string\n): Promise<KeyObject> =>\n    Promise.resolve().then(() => JWKSToKeyObjectSYNC(jwks, kid));\n\n/**\n * Normalize JWKS (auto-generate missing kid values)\n * @param jwks\n */\nexport const normalizeJWKS = (\n    jwks: JSONWebKeySet\n): Promise<JSONWebKeySet> =>\n    Promise.resolve().then(() => normalizeJWKSSYNC(jwks));\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport const computeX5T = (jwk: JWKType) => Promise.resolve().then(() => computeX5TSYNC(jwk))\n\n//namespaced exports\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n    computeX5T: computeX5T,\n};\n\n//namespaced exports\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS,\n};\n"],"names":["decode","token","decodeSync","sign","args","signSync","verify","result","verifySync","header","payload","signature","JWT","SignatureAlgorithm","exportJWK","key","exportJWKSYNC","importJWK","jwk","importJWKSYNC","toPublicJWK","toPublicJWKSYNC","getJWKThumbprint","hashAlg","getJWKThumbprintSYNC","JWKSToKeyObject","jwks","kid","JWKSToKeyObjectSYNC","normalizeJWKS","normalizeJWKSSYNC","computeX5T","computeX5TSYNC","JWK","JWKS"],"mappings":";;;AAmBO,MAAMA,IAAS,CAACC,MACnB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAWD,CAAK,CAAC,GAMrCE,IAAO,IAAIC,MACpB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAS,GAAGD,CAAI,CAAC,GAMrCE,IAAS,IAAIF,MAKtB,QAAQ,QAAA,EAAU,KAAK,MAAM;AACzB,QAAMG,IAASC,EAAW,GAAGJ,CAAI;AACjC,MAAI,CAACG,EAAO;AACR,UAAMA,EAAO;AAEjB,QAAM,EAAC,QAAAE,GAAQ,SAAAC,GAAS,WAAAC,EAAA,IAAaJ;AACrC,SAAO,EAAC,QAAAE,GAAQ,SAAAC,GAAS,WAAAC,EAAA;AAC7B,CAAC,GAKQC,IAAM;AAAA,EACf,MAAAT;AAAA,EACA,QAAAG;AAAA,EACA,QAAAN;AAAA,EACA,YAAYa;AAChB,GCrCaC,IAAY,CAACC,MACtB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAcD,CAAG,CAAC,GAMtCE,IAAY,CAACC,MACtB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAcD,CAAG,CAAC,GAMtCE,IAAc,CAACL,MACxB,QAAQ,QAAA,EAAU,KAAK,MAAMM,EAAgBN,CAAG,CAAC,GAOxCO,IAAmB,CAC5BJ,GACAK,IAAoB,aAEpB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAqBN,GAAKK,CAAO,CAAC,GAQtDE,IAAkB,CAC3BC,GACAC,MAEA,QAAQ,UAAU,KAAK,MAAMC,EAAoBF,GAAMC,CAAG,CAAC,GAMlDE,IAAgB,CACzBH,MAEA,QAAQ,QAAA,EAAU,KAAK,MAAMI,EAAkBJ,CAAI,CAAC,GAM3CK,IAAa,CAACb,MAAiB,QAAQ,QAAA,EAAU,KAAK,MAAMc,EAAed,CAAG,CAAC,GAG/Ee,IAAM;AAAA,EACf,QAAQnB;AAAA,EACR,QAAQG;AAAA,EACR,UAAUG;AAAA,EACV,YAAYE;AAAA,EACZ,YAAAS;AACJ,GAGaG,IAAO;AAAA,EAChB,aAAaT;AAAA,EACb,WAAWI;AACf;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/node-jwt",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "A lightweight, zero-dependency TypeScript library for creating, verifying and decoding JSON Web Tokens (JWT).",
   "main": "./dist/index.cjs.js",
   "module": "./dist/index.es.js",

package/dist/index-CSRWSLal.cjs

@@ -1,2 +0,0 @@
-"use strict";const a=require("crypto"),d={encode:e=>Buffer.from(e).toString("base64url"),decode:e=>Buffer.from(e,"base64url").toString()},y=(e,r)=>e.length!==r.length?!1:a.timingSafeEqual(Buffer.from(e),Buffer.from(r)),f={HS256:{sign:(e,r)=>a.createHmac("sha256",r).update(e).digest("base64url"),verify:(e,r,t)=>{const i=a.createHmac("sha256",r).update(e).digest("base64url");return y(i,t)}},HS384:{sign:(e,r)=>a.createHmac("sha384",r).update(e).digest("base64url"),verify:(e,r,t)=>{const i=a.createHmac("sha384",r).update(e).digest("base64url");return y(i,t)}},HS512:{sign:(e,r)=>a.createHmac("sha512",r).update(e).digest("base64url"),verify:(e,r,t)=>{const i=a.createHmac("sha512",r).update(e).digest("base64url");return y(i,t)}},RS256:{sign:(e,r)=>a.createSign("RSA-SHA256").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA256").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},RS384:{sign:(e,r)=>a.createSign("RSA-SHA384").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA384").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},RS512:{sign:(e,r)=>a.createSign("RSA-SHA512").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA512").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},ES256:{sign:(e,r)=>a.createSign("SHA256").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("SHA256").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},ES384:{sign:(e,r)=>a.createSign("SHA384").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("SHA384").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},ES512:{sign:(e,r)=>a.createSign("SHA512").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("SHA512").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},ES256K:{sign:(e,r)=>a.createSign("SHA256").update(e).end().sign(r).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("SHA256").update(e).end().verify(r,Buffer.from(t,"base64url"))}catch{return!1}}},PS256:{sign:(e,r)=>a.createSign("RSA-SHA256").update(e).end().sign({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:32}).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA256").update(e).end().verify({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:32},Buffer.from(t,"base64url"))}catch{return!1}}},PS384:{sign:(e,r)=>a.createSign("RSA-SHA384").update(e).end().sign({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:48}).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA384").update(e).end().verify({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:48},Buffer.from(t,"base64url"))}catch{return!1}}},PS512:{sign:(e,r)=>a.createSign("RSA-SHA512").update(e).end().sign({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:64}).toString("base64url"),verify:(e,r,t)=>{try{return a.createVerify("RSA-SHA512").update(e).end().verify({key:r,padding:a.constants.RSA_PKCS1_PSS_PADDING,saltLength:64},Buffer.from(t,"base64url"))}catch{return!1}}},EdDSA:{sign:(e,r)=>a.sign(null,typeof e=="string"?Buffer.from(e,"utf8"):e,r).toString("base64url"),verify:(e,r,t)=>{try{return a.verify(null,typeof e=="string"?Buffer.from(e,"utf8"):e,r,Buffer.from(t,"base64url"))}catch{return!1}}}},H=Object.keys(f);function A(e){if(e.type==="secret")return"HS256";if(e.type!=="private")throw new Error("Only private or symmetric keys can be used to sign JWTs");const r=e.asymmetricKeyType,t=e.asymmetricKeyDetails;switch(r){case"rsa":return"RS256";case"rsa-pss":{const i=t?.hashAlgorithm??"sha256";switch(i){case"sha256":return"PS256";case"sha384":return"PS384";case"sha512":return"PS512";default:throw new Error(`Unsupported RSA-PSS hash algorithm: ${i}`)}}case"ec":{const i=t?.namedCurve;switch(i){case"P-256":case"prime256v1":return"ES256";case"P-384":case"secp384r1":return"ES384";case"P-521":case"secp521r1":return"ES512";case"secp256k1":return"ES256K";default:throw new Error(`Unsupported EC curve: ${i}`)}}case"ed25519":return"EdDSA";default:throw new Error(`Unsupported asymmetric key type: ${r}`)}}function D(e){if(typeof e=="object"&&"type"in e)return e;try{return a.createPrivateKey(e)}catch{const r=typeof e=="string"?Buffer.from(e,"utf8"):Buffer.isBuffer(e)?e:(()=>{throw new Error("Unsupported key type")})();return a.createSecretKey(r)}}const p=e=>{const r=e.split(".");if(r.length!==3)throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');const[t,i,s]=r;if(!t||!i||!s)throw new Error("Invalid JWT: empty part detected");try{const n=JSON.parse(d.decode(t)),c=JSON.parse(d.decode(i));return{header:n,payload:c,signature:s}}catch(n){throw new Error(`Invalid JWT: malformed header or payload (${n.message})`)}},b=(e,r,t={})=>{const i=D(r),s=t.alg??A(i),n=t.typ??"JWT";if(!(s in f))throw new Error(`Unsupported algorithm: ${s}`);const c={alg:s,typ:n};t.kid&&(c.kid=t.kid);const u=d.encode(JSON.stringify(c)),S=d.encode(JSON.stringify(e)),v=`${u}.${S}`,l=f[s].sign(v,r);return`${u}.${S}.${l}`},I=(e,r,t={})=>{let i;try{i=p(e)}catch(o){return{valid:!1,error:{reason:o.message,code:"INVALID_TOKEN"}}}const{header:s,payload:n,signature:c}=i,u=s.alg;if(!(u in f))return{valid:!1,error:{reason:`Unsupported or unknown algorithm: ${s.alg}`,code:"INVALID_ALGORITHM"}};if(t.algorithms&&t.algorithms.length>0&&!t.algorithms.includes(u))return{valid:!1,error:{reason:`Algorithm "${u}" is not in the allowed algorithms list`,code:"ALGORITHM_NOT_ALLOWED"}};if(s.typ!==void 0&&s.typ!=="JWT")return{valid:!1,error:{reason:`Invalid token type: expected 'JWT', got '${s.typ}'`,code:"INVALID_TYPE"}};const S=`${d.encode(JSON.stringify(s))}.${d.encode(JSON.stringify(n))}`;if(!f[u].verify(S,r,c))return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}};const l=Math.floor(Date.now()/1e3),g=t.clockSkew??0;if(!t.ignoreExpiration&&n.exp!==void 0&&l>n.exp+g)return{valid:!1,error:{reason:"Token expired",code:"TOKEN_EXPIRED"}};if(n.nbf!==void 0&&l+g<n.nbf)return{valid:!1,error:{reason:"Token not yet valid",code:"TOKEN_NOT_ACTIVE"}};if(n.iat!==void 0&&l+g<n.iat)return{valid:!1,error:{reason:"Token issued in the future",code:"TOKEN_FUTURE_ISSUED"}};if(t.maxTokenAge!==void 0&&n.iat!==void 0){const o=l-n.iat;if(o>t.maxTokenAge)return{valid:!1,error:{reason:`Token age (${o}s) exceeds maximum allowed age (${t.maxTokenAge}s)`,code:"TOKEN_TOO_OLD"}}}if(t.issuer!==void 0){if(n.iss===void 0)return{valid:!1,error:{reason:'Token missing required issuer claim ("iss")',code:"MISSING_ISSUER"}};if(t.issuer!==n.iss)return{valid:!1,error:{reason:`Invalid token issuer: expected "${t.issuer}", got "${n.iss}"`,code:"INVALID_ISSUER"}}}if(t.subject!==void 0){if(n.sub===void 0)return{valid:!1,error:{reason:'Token missing required subject claim ("sub")',code:"MISSING_SUBJECT"}};if(t.subject!==n.sub)return{valid:!1,error:{reason:`Invalid token subject: expected "${t.subject}", got "${n.sub}"`,code:"INVALID_SUBJECT"}}}if(t.audience!==void 0){const o=n.aud;if(o===void 0)return{valid:!1,error:{reason:'Token missing required audience claim ("aud")',code:"MISSING_AUDIENCE"}};const _=Array.isArray(t.audience)?t.audience:[t.audience],N=Array.isArray(o)?o:[o];if(!_.some(W=>N.includes(W)))return{valid:!1,error:{reason:"Audience claim mismatch",code:"INVALID_AUDIENCE"}}}if(t.jwtId!==void 0){if(n.jti===void 0)return{valid:!1,error:{reason:'Token missing required JWT ID claim ("jti")',code:"MISSING_JTI"}};if(t.jwtId!==n.jti)return{valid:!1,error:{reason:`Invalid JWT ID: expected "${t.jwtId}", got "${n.jti}"`,code:"INVALID_JTI"}}}return{valid:!0,header:s,payload:n,signature:c}},R={sign:b,verify:I,decode:p,algorithms:f};function E(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");return e.export({format:"jwk"})}function h(e){if(!e||typeof e!="object")throw new Error("Invalid JWK");switch(e.kty){case"oct":{if(!("k"in e)||typeof e.k!="string")throw new Error('Invalid oct JWK: missing "k"');return a.createSecretKey(Buffer.from(e.k,"base64url"))}case"RSA":case"EC":case"OKP":return"d"in e&&typeof e.d=="string"?a.createPrivateKey({format:"jwk",key:e}):a.createPublicKey({format:"jwk",key:e});default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}}function K(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");const t=(e.type==="private"?a.createPublicKey(e):e).export({format:"jwk"});return delete t.d,delete t.p,delete t.q,delete t.dp,delete t.dq,delete t.qi,t}function m(e,r="sha256"){if(!e||typeof e!="object")throw new Error("Invalid JWK");let t;switch(e.kty){case"RSA":t={e:e.e,kty:e.kty,n:e.n};break;case"EC":t={crv:e.crv,kty:e.kty,x:e.x,y:e.y};break;case"OKP":t={crv:e.crv,kty:e.kty,x:e.x};break;case"oct":t={k:e.k,kty:e.kty};break;default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}const i=JSON.stringify(Object.keys(t).sort().reduce((s,n)=>(s[n]=t[n],s),{}));return a.createHash(r).update(i).digest("base64url")}function T(e){if(e.x5c?.length)return a.createHash("sha1").update(Buffer.from(e.x5c[0],"base64")).digest("base64url")}const x={export:E,import:h,toPublic:K,thumbprint:m};function J(e,r){if(!e||!Array.isArray(e.keys))throw new Error("Invalid JWKS");let t;if(r&&(t=e.keys.find(i=>i.kid===r)),!t&&e.keys.length===1&&(t=e.keys[0]),!t)throw new Error("Key not found in JWKS");return h(t)}function P(e){return{keys:e.keys.map(r=>({...r,kid:r.kid??m(r),x5t:r.x5t??T(r)}))}}const O={toKeyObject:J,normalize:P};exports.AutodetectAlgorithm=A;exports.JWK=x;exports.JWKS=O;exports.JWKSToKeyObject=J;exports.JWT=R;exports.SignatureAlgorithm=f;exports.SupportedAlgorithms=H;exports.base64Url=d;exports.computeX5T=T;exports.decode=p;exports.exportJWK=E;exports.getJWKThumbprint=m;exports.importJWK=h;exports.normalizeJWKS=P;exports.sign=b;exports.toPublicJWK=K;exports.verify=I;
-//# sourceMappingURL=index-CSRWSLal.cjs.map