@spinajs/authn-keys 0.0.0-stage → 3.0.1

package/lib/cjs/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}

package/lib/cjs/cli/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./common.js"), exports);
+__exportStar(require("./AddKey.js"), exports);
+__exportStar(require("./ListKeys.js"), exports);
+__exportStar(require("./RevokeKey.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,8CAA4B;AAC5B,gDAA8B;AAC9B,iDAA+B"}

package/lib/cjs/config/authn-keys.d.ts

@@ -0,0 +1,9 @@
+declare const authnKeys: {
+    system: {
+        dirs: {
+            cli: string[];
+        };
+    };
+};
+export default authnKeys;
+//# sourceMappingURL=authn-keys.d.ts.map

package/lib/cjs/config/authn-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authn-keys.d.ts","sourceRoot":"","sources":["../../../src/config/authn-keys.ts"],"names":[],"mappings":"AAeA,QAAA,MAAM,SAAS;IACb,MAAM;QACJ,IAAI;YACF,GAAG;;;CAGR,CAAC;eAEa,SAAS"}

package/lib/cjs/config/authn-keys.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = require("path");
+function dir(path) {
+    const inCommonJs = typeof module !== 'undefined';
+    return [
+        (0, path_1.resolve)((0, path_1.normalize)((0, path_1.join)(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), 'node_modules', '@spinajs', 'authn-keys', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+        // one up if we run from app or build folder
+        (0, path_1.resolve)((0, path_1.normalize)((0, path_1.join)(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), '../', 'node_modules', '@spinajs', 'authn-keys', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+    ];
+}
+// Only the CLI scan dir. A non-empty system.dirs.migrations would replace the orm's defaults in every app (see
+// authn-token's config); the migration and the models register through their decorators. The authn.keys defaults
+// live in the authn schema.
+const authnKeys = {
+    system: {
+        dirs: {
+            cli: [...dir('cli')],
+        },
+    },
+};
+exports.default = authnKeys;
+//# sourceMappingURL=authn-keys.js.map

package/lib/cjs/config/authn-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authn-keys.js","sourceRoot":"","sources":["../../../src/config/authn-keys.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAE7J,4CAA4C;QAC5C,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KACrK,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,iHAAiH;AACjH,4BAA4B;AAC5B,MAAM,SAAS,GAAG;IAChB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;CACF,CAAC;kBAEa,SAAS"}

package/lib/cjs/httpsig/base.d.ts

@@ -0,0 +1,8 @@
+import type { SignedRequest } from '@spinajs/authn/contracts';
+import type { SignatureInput } from './fields.js';
+export declare const lowerCaseHeaders: (headers: Readonly<Record<string, string>>) => Record<string, string>;
+/** RFC 9421 §2.5 for the covered components; null when one may not be covered or has no value. */
+export declare function signatureBase(req: SignedRequest, input: SignatureInput): string | null;
+/** RFC 9530 Content-Digest: every member is sha-256 or sha-512 and matches the body. */
+export declare function digestMatches(header: unknown, body: Uint8Array): boolean;
+//# sourceMappingURL=base.d.ts.map

package/lib/cjs/httpsig/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../src/httpsig/base.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAOlD,eAAO,MAAM,gBAAgB,YAAa,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAA4F,CAAC;AA6B/L,kGAAkG;AAClG,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAetF;AAID,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAYxE"}

package/lib/cjs/httpsig/base.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lowerCaseHeaders = void 0;
+exports.signatureBase = signatureBase;
+exports.digestMatches = digestMatches;
+const node_crypto_1 = require("node:crypto");
+const fields_js_1 = require("./fields.js");
+const DERIVED = ['@method', '@target-uri', '@authority', '@path', '@query'];
+const HEADER_NAME = /^[a-z0-9!#$%&'*+\-.^_`|~]+$/;
+// A signature never covers the headers that carry it.
+const NOT_COVERABLE = ['signature', 'signature-input'];
+const lowerCaseHeaders = (headers) => Object.fromEntries(Object.entries(headers ?? {}).map(([k, v]) => [k.toLowerCase(), v]));
+exports.lowerCaseHeaders = lowerCaseHeaders;
+function componentValue(req, headers, name) {
+    if (name.startsWith('@')) {
+        let url;
+        try {
+            url = new URL(req.targetUri);
+        }
+        catch {
+            return null;
+        }
+        switch (name) {
+            case '@method':
+                return req.method.toUpperCase();
+            case '@target-uri':
+                return req.targetUri;
+            case '@authority':
+                return url.host.toLowerCase();
+            case '@path':
+                return url.pathname || '/';
+            case '@query':
+                return url.search || '?';
+            default:
+                return null;
+        }
+    }
+    const v = headers[name];
+    return typeof v === 'string' ? v.trim() : null;
+}
+/** RFC 9421 §2.5 for the covered components; null when one may not be covered or has no value. */
+function signatureBase(req, input) {
+    const headers = (0, exports.lowerCaseHeaders)(req.headers);
+    const lines = [];
+    for (const name of input.components) {
+        if (!(DERIVED.includes(name) || (HEADER_NAME.test(name) && !NOT_COVERABLE.includes(name)))) {
+            return null;
+        }
+        const value = componentValue(req, headers, name);
+        if (value === null || /[\r\n]/.test(value)) {
+            return null;
+        }
+        lines.push(`"${name}": ${value}`);
+    }
+    lines.push(`"@signature-params": ${input.value}`);
+    return lines.join('\n');
+}
+const DIGESTS = { 'sha-256': 'sha256', 'sha-512': 'sha512' };
+/** RFC 9530 Content-Digest: every member is sha-256 or sha-512 and matches the body. */
+function digestMatches(header, body) {
+    const members = (0, fields_js_1.parseByteSequenceDictionary)(header);
+    if (!members) {
+        return false;
+    }
+    for (const [alg, digest] of members) {
+        const hash = DIGESTS[alg];
+        if (!hash || !(0, node_crypto_1.createHash)(hash).update(body).digest().equals(digest)) {
+            return false;
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=base.js.map

package/lib/cjs/httpsig/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/httpsig/base.ts"],"names":[],"mappings":";;;;;AAAA,6CAAyC;AAEzC,2CAA0D;AAG1D,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC5E,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,sDAAsD;AACtD,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;AAEhD,MAAM,gBAAgB,GAAG,CAAC,OAAyC,EAA0B,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAAlL,QAAA,gBAAgB,GAAhB,gBAAgB,CAAkK;AAE/L,SAAS,cAAc,CAAC,GAAkB,EAAE,OAA+B,EAAE,IAAY;IACvF,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,SAAS;gBACZ,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAClC,KAAK,aAAa;gBAChB,OAAO,GAAG,CAAC,SAAS,CAAC;YACvB,KAAK,YAAY;gBACf,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAChC,KAAK,OAAO;gBACV,OAAO,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC;YAC7B,KAAK,QAAQ;gBACX,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC;YAC3B;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,kGAAkG;AAClG,uBAA8B,GAAkB,EAAE,KAAqB;IACrE,MAAM,OAAO,GAAG,IAAA,QAAA,gBAAgB,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,OAAO,GAAqC,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAE/F,wFAAwF;AACxF,uBAA8B,MAAe,EAAE,IAAgB;IAC7D,MAAM,OAAO,GAAG,IAAA,uCAA2B,EAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAA,wBAAU,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/lib/cjs/httpsig/fields.d.ts

@@ -0,0 +1,17 @@
+export type ParamValue = number | string;
+export interface SignatureInput {
+    readonly label: string;
+    readonly components: readonly string[];
+    readonly params: ReadonlyMap<string, ParamValue>;
+    /** The member value as sent; it is the `@signature-params` line of the signature base. */
+    readonly value: string;
+}
+/**
+ * `Signature-Input` with exactly one member: `<label>=("<component>" …);<name>=<integer or string>…`. Component
+ * names carry no parameters; parameter values are integers or strings. Null for anything else, a second member,
+ * a duplicate parameter or component, or text that is not in canonical form.
+ */
+export declare function parseSignatureInput(header: unknown): SignatureInput | null;
+/** A dictionary whose members are all byte sequences (`Signature`, `Content-Digest`); null when not exactly that. */
+export declare function parseByteSequenceDictionary(header: unknown): Map<string, Buffer> | null;
+//# sourceMappingURL=fields.d.ts.map

package/lib/cjs/httpsig/fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../../../src/httpsig/fields.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACjD,0FAA0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAoCD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CA0D1E;AAWD,qHAAqH;AACrH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAkBvF"}

package/lib/cjs/httpsig/fields.js

@@ -0,0 +1,137 @@
+"use strict";
+// The RFC 8941 structured-field subset RFC 9421 signatures and RFC 9530 digests need, parsed strictly: one canonical
+// text form per value, so the signature base can use the Signature-Input text exactly as sent.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSignatureInput = parseSignatureInput;
+exports.parseByteSequenceDictionary = parseByteSequenceDictionary;
+const KEY = /^[a-z*][a-z0-9_\-.*]*$/;
+const MAX_KEY = 64;
+const INTEGER = /^-?[0-9]{1,15}$/;
+const BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+/** An sf-string at `s[i]` (which must be '"'): its value and the index after it, or null. */
+function readString(s, i) {
+    let value = '';
+    for (let j = i + 1; j < s.length; j += 1) {
+        const c = s[j];
+        if (c === '\\') {
+            const n = s[j + 1];
+            if (n !== '"' && n !== '\\') {
+                return null;
+            }
+            value += n;
+            j += 1;
+        }
+        else if (c === '"') {
+            return { value, end: j + 1 };
+        }
+        else {
+            const code = c.charCodeAt(0);
+            if (code < 0x20 || code > 0x7e) {
+                return null;
+            }
+            value += c;
+        }
+    }
+    return null;
+}
+const serializeString = (v) => `"${v.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+/** A dictionary key ending at the first '=' from `i`, or null. */
+function readKey(s, i) {
+    const eq = s.indexOf('=', i);
+    const key = eq < 0 ? '' : s.slice(i, eq);
+    return KEY.test(key) && key.length <= MAX_KEY ? { key, end: eq + 1 } : null;
+}
+/**
+ * `Signature-Input` with exactly one member: `<label>=("<component>" …);<name>=<integer or string>…`. Component
+ * names carry no parameters; parameter values are integers or strings. Null for anything else, a second member,
+ * a duplicate parameter or component, or text that is not in canonical form.
+ */
+function parseSignatureInput(header) {
+    if (typeof header !== 'string') {
+        return null;
+    }
+    const s = header.trim();
+    const key = readKey(s, 0);
+    if (!key || s[key.end] !== '(') {
+        return null;
+    }
+    const components = [];
+    let i = key.end + 1;
+    while (s[i] !== ')') {
+        if (components.length > 0) {
+            if (s[i] !== ' ') {
+                return null;
+            }
+            i += 1;
+        }
+        if (s[i] !== '"') {
+            return null;
+        }
+        const str = readString(s, i);
+        if (!str || str.value.length === 0 || components.includes(str.value)) {
+            return null;
+        }
+        components.push(str.value);
+        i = str.end;
+    }
+    i += 1;
+    const params = new Map();
+    while (i < s.length) {
+        if (s[i] !== ';') {
+            return null;
+        }
+        const name = readKey(s, i + 1);
+        if (!name || params.has(name.key)) {
+            return null;
+        }
+        i = name.end;
+        if (s[i] === '"') {
+            const str = readString(s, i);
+            if (!str) {
+                return null;
+            }
+            params.set(name.key, str.value);
+            i = str.end;
+        }
+        else {
+            const m = /^-?[0-9]+/.exec(s.slice(i));
+            if (!m || !INTEGER.test(m[0]) || (m[0].length > 1 && /^-?0/.test(m[0]))) {
+                return null;
+            }
+            params.set(name.key, Number(m[0]));
+            i += m[0].length;
+        }
+    }
+    const value = s.slice(key.end);
+    const canonical = `(${components.map(serializeString).join(' ')})${[...params].map(([k, v]) => `;${k}=${typeof v === 'number' ? v : serializeString(v)}`).join('')}`;
+    return canonical === value ? { label: key.key, components, params, value } : null;
+}
+/** RFC 8941 byte sequence in standard base64, canonical (padded, no stray bits). */
+function decodeByteSequence(text) {
+    if (!BASE64.test(text) || text.length % 4 !== 0) {
+        return null;
+    }
+    const bytes = Buffer.from(text, 'base64');
+    return bytes.toString('base64') === text ? bytes : null;
+}
+/** A dictionary whose members are all byte sequences (`Signature`, `Content-Digest`); null when not exactly that. */
+function parseByteSequenceDictionary(header) {
+    if (typeof header !== 'string') {
+        return null;
+    }
+    const out = new Map();
+    for (const member of header.split(',')) {
+        const m = member.trim();
+        const key = readKey(m, 0);
+        if (!key || out.has(key.key) || m[key.end] !== ':' || !m.endsWith(':') || m.length < key.end + 2) {
+            return null;
+        }
+        const bytes = decodeByteSequence(m.slice(key.end + 1, -1));
+        if (!bytes) {
+            return null;
+        }
+        out.set(key.key, bytes);
+    }
+    return out.size > 0 ? out : null;
+}
+//# sourceMappingURL=fields.js.map

package/lib/cjs/httpsig/fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.js","sourceRoot":"","sources":["../../../src/httpsig/fields.ts"],"names":[],"mappings":";AAAA,qHAAqH;AACrH,+FAA+F;;;;AAE/F,MAAM,GAAG,GAAG,wBAAwB,CAAC;AACrC,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAClC,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAYxC,6FAA6F;AAC7F,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AAEpG,kEAAkE;AAClE,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,6BAAoC,MAAe;IACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;IACd,CAAC;IACD,CAAC,IAAI,CAAC,CAAC;IACP,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;QACb,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;QACd,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACrK,OAAO,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,oFAAoF;AACpF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,qHAAqH;AACrH,qCAA4C,MAAe;IACzD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC"}

package/lib/cjs/httpsig/index.d.ts

@@ -0,0 +1,3 @@
+export * from './fields.js';
+export * from './base.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/httpsig/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/httpsig/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC"}

package/lib/cjs/httpsig/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./fields.js"), exports);
+__exportStar(require("./base.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/httpsig/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/httpsig/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B;AAC5B,4CAA0B"}

package/lib/cjs/index.d.ts

@@ -0,0 +1,13 @@
+export * from './jwk/index.js';
+export * from './challenge/index.js';
+export * from './options/index.js';
+export * from './models/index.js';
+export * from './migrations/index.js';
+export * from './registry/index.js';
+export * from './jws/index.js';
+export * from './nonce/index.js';
+export * from './strategies/index.js';
+export * from './httpsig/index.js';
+export * from './schema.js';
+export * from './bootstrap.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/lib/cjs/index.js

@@ -0,0 +1,29 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./jwk/index.js"), exports);
+__exportStar(require("./challenge/index.js"), exports);
+__exportStar(require("./options/index.js"), exports);
+__exportStar(require("./models/index.js"), exports);
+__exportStar(require("./migrations/index.js"), exports);
+__exportStar(require("./registry/index.js"), exports);
+__exportStar(require("./jws/index.js"), exports);
+__exportStar(require("./nonce/index.js"), exports);
+__exportStar(require("./strategies/index.js"), exports);
+__exportStar(require("./httpsig/index.js"), exports);
+__exportStar(require("./schema.js"), exports);
+__exportStar(require("./bootstrap.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,oDAAkC;AAClC,wDAAsC;AACtC,sDAAoC;AACpC,iDAA+B;AAC/B,mDAAiC;AACjC,wDAAsC;AACtC,qDAAmC;AACnC,8CAA4B;AAC5B,iDAA+B"}

package/lib/cjs/jwk/base64url.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Strict unpadded base64url: Node's decoder skips bad characters and stray bits, so the result is re-encoded and
+ * compared, and every value has exactly one text form (canvas C8 `decodeB64url`).
+ */
+export declare function decodeB64url(text: unknown): Buffer | null;
+export declare function encodeB64url(data: Uint8Array | string): string;
+//# sourceMappingURL=base64url.d.ts.map

package/lib/cjs/jwk/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../../src/jwk/base64url.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAOzD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAE9D"}

package/lib/cjs/jwk/base64url.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeB64url = decodeB64url;
+exports.encodeB64url = encodeB64url;
+const util_1 = require("@spinajs/util");
+const ALPHABET = /^[A-Za-z0-9_-]*$/;
+/**
+ * Strict unpadded base64url: Node's decoder skips bad characters and stray bits, so the result is re-encoded and
+ * compared, and every value has exactly one text form (canvas C8 `decodeB64url`).
+ */
+function decodeB64url(text) {
+    const [ok, encoded] = (0, util_1._try_check_arg)((0, util_1._is_string)((0, util_1._reg_match)(ALPHABET), (0, util_1._custom)((s) => s.length % 4 !== 1)))(text, 'text');
+    if (!ok) {
+        return null;
+    }
+    const bytes = Buffer.from(encoded, 'base64url');
+    return bytes.toString('base64url') === encoded ? bytes : null;
+}
+function encodeB64url(data) {
+    return (typeof data === 'string' ? Buffer.from(data, 'utf8') : Buffer.from(data)).toString('base64url');
+}
+//# sourceMappingURL=base64url.js.map

package/lib/cjs/jwk/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../../src/jwk/base64url.ts"],"names":[],"mappings":";;;;AAAA,wCAAgF;AAEhF,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC;;;GAGG;AACH,sBAA6B,IAAa;IACxC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,QAAQ,CAAC,EAAE,IAAA,cAAO,EAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjI,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAiB,EAAE,WAAW,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,sBAA6B,IAAyB;IACpD,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1G,CAAC"}

package/lib/cjs/jwk/ed25519.d.ts

@@ -0,0 +1,9 @@
+/**
+ * RFC 8032 §5.1.3 decoding: y < p, x² = (y² − 1) / (d y² + 1) has a root, and x = 0 has no sign bit. The root itself
+ * is not needed, so the sqrt(−1) correction reduces to accepting v x² = −u as well as v x² = u.
+ */
+export declare function isCanonicalPoint(bytes: Uint8Array): boolean;
+/** Canonical encodings of the 8 points of order 1, 2, 4 and 8 (canvas C8 `SMALL_ORDER`, checked complete there). */
+export declare const SMALL_ORDER: readonly string[];
+export declare function isSmallOrder(bytes: Uint8Array): boolean;
+//# sourceMappingURL=ed25519.d.ts.map

package/lib/cjs/jwk/ed25519.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.d.ts","sourceRoot":"","sources":["../../../src/jwk/ed25519.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAiB3D;AAED,oHAAoH;AACpH,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAojB,CAAC;AAE9lB,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAEvD"}

package/lib/cjs/jwk/ed25519.js

@@ -0,0 +1,47 @@
+"use strict";
+// Ed25519 point checks that node:crypto skips: `createPublicKey` takes any 32 bytes, and `verify` (cofactorless)
+// accepts forgeries under small-order keys. Ported from canvas C8 (`contracts/ts/plane-api/src/ed25519.ts`).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SMALL_ORDER = void 0;
+exports.isCanonicalPoint = isCanonicalPoint;
+exports.isSmallOrder = isSmallOrder;
+const P = 2n ** 255n - 19n;
+const mod = (a) => ((a % P) + P) % P;
+function pow(base, exp) {
+    let result = 1n;
+    for (let b = mod(base), e = exp; e > 0n; b = (b * b) % P, e >>= 1n) {
+        if (e & 1n) {
+            result = (result * b) % P;
+        }
+    }
+    return result;
+}
+const D = mod(-121665n * pow(121666n, P - 2n));
+/**
+ * RFC 8032 §5.1.3 decoding: y < p, x² = (y² − 1) / (d y² + 1) has a root, and x = 0 has no sign bit. The root itself
+ * is not needed, so the sqrt(−1) correction reduces to accepting v x² = −u as well as v x² = u.
+ */
+function isCanonicalPoint(bytes) {
+    if (bytes.length !== 32) {
+        return false;
+    }
+    const n = BigInt(`0x${Buffer.from(bytes).reverse().toString('hex')}`);
+    const y = n & ((1n << 255n) - 1n);
+    if (y >= P) {
+        return false;
+    }
+    const u = mod(y * y - 1n);
+    const v = mod(D * y * y + 1n);
+    const x = mod(u * pow(v, 3n) * pow(u * pow(v, 7n), (P - 5n) / 8n));
+    const vxx = mod(v * x * x);
+    if (vxx !== u && vxx !== mod(-u)) {
+        return false;
+    }
+    return !(u === 0n && n >> 255n === 1n);
+}
+/** Canonical encodings of the 8 points of order 1, 2, 4 and 8 (canvas C8 `SMALL_ORDER`, checked complete there). */
+exports.SMALL_ORDER = Object.freeze(['0100000000000000000000000000000000000000000000000000000000000000', 'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f', '0000000000000000000000000000000000000000000000000000000000000000', '0000000000000000000000000000000000000000000000000000000000000080', '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05', '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85', 'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a', 'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa']);
+function isSmallOrder(bytes) {
+    return bytes.length === 32 && exports.SMALL_ORDER.includes(Buffer.from(bytes).toString('hex'));
+}
+//# sourceMappingURL=ed25519.js.map

package/lib/cjs/jwk/ed25519.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ed25519.js","sourceRoot":"","sources":["../../../src/jwk/ed25519.ts"],"names":[],"mappings":";AAAA,iHAAiH;AACjH,6GAA6G;;;;;AAE7G,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,GAAG,CAAC;AAE3B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAErD,SAAS,GAAG,CAAC,IAAY,EAAE,GAAW;IACpC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACnE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACX,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAE/C;;;GAGG;AACH,0BAAiC,KAAiB;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,oHAAoH;AACvG,QAAA,WAAW,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,kEAAkE,EAAE,kEAAkE,EAAE,kEAAkE,EAAE,kEAAkE,EAAE,kEAAkE,EAAE,kEAAkE,EAAE,kEAAkE,EAAE,kEAAkE,CAAC,CAAC,CAAC;AAE9lB,sBAA6B,KAAiB;IAC5C,OAAO,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,QAAA,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzF,CAAC"}

package/lib/cjs/jwk/index.d.ts

@@ -0,0 +1,5 @@
+export * from './base64url.js';
+export * from './ed25519.js';
+export * from './keys.js';
+export * from './signature.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/jwk/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/jwk/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC"}

package/lib/cjs/jwk/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./base64url.js"), exports);
+__exportStar(require("./ed25519.js"), exports);
+__exportStar(require("./keys.js"), exports);
+__exportStar(require("./signature.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/jwk/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jwk/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,+CAA6B;AAC7B,4CAA0B;AAC1B,iDAA+B"}

package/lib/cjs/jwk/keys.d.ts

@@ -0,0 +1,18 @@
+import type { KeyObject } from 'node:crypto';
+import type { KeyAlgorithm, KeyMaterial, PublicJwk } from '@spinajs/authn/contracts';
+export declare const KEY_ALGORITHMS: readonly KeyAlgorithm[];
+export declare function isValidKid(kid: unknown): kid is string;
+/**
+ * Design §22.10, canvas C8 D5: an Ed25519 key (RFC 8037) whose `x` is a canonical point and not of small order, or a
+ * P-256 key whose `x` and `y` are 32 bytes and on the curve; never a private part. Members other than the required ones
+ * are dropped, never trusted (the algorithm comes from the key type). Null for anything else.
+ */
+export declare function checkPublicJwk(input: unknown, allowed?: readonly KeyAlgorithm[]): KeyMaterial | null;
+/** RFC 7638: the required members only, in lexicographic order, no whitespace; SHA-256, base64url. */
+export declare function thumbprint(jwk: PublicJwk): string;
+/**
+ * The node:crypto key for a material that passes checkPublicJwk with its own algorithm, or null. Materials can come
+ * from a caller's key lookup, so they are checked again here (cached, as the point check costs a few modular powers).
+ */
+export declare function publicKeyObject(material: KeyMaterial): KeyObject | null;
+//# sourceMappingURL=keys.d.ts.map

package/lib/cjs/jwk/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/jwk/keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAoB,YAAY,EAAE,WAAW,EAAiB,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAKtH,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAAsC,CAAC;AAIzF,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAEtD;AAYD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,SAAS,YAAY,EAAmB,GAAG,WAAW,GAAG,IAAI,CAmBpH;AAED,sGAAsG;AACtG,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAGjD;AAmBD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,IAAI,CAyBvE"}