@spinajs/authn-keys 0.0.0-stage → 3.0.1

package/lib/cjs/jwk/keys.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_ALGORITHMS = void 0;
+exports.isValidKid = isValidKid;
+exports.checkPublicJwk = checkPublicJwk;
+exports.thumbprint = thumbprint;
+exports.publicKeyObject = publicKeyObject;
+const node_crypto_1 = require("node:crypto");
+const util_1 = require("@spinajs/util");
+const base64url_js_1 = require("./base64url.js");
+const ed25519_js_1 = require("./ed25519.js");
+exports.KEY_ALGORITHMS = Object.freeze(['EdDSA', 'ES256']);
+const KID = /^[A-Za-z0-9._-]{1,64}$/;
+function isValidKid(kid) {
+    return typeof kid === 'string' && KID.test(kid);
+}
+const has32Bytes = (v) => (0, base64url_js_1.decodeB64url)(v)?.length === 32;
+function importable(jwk) {
+    try {
+        return (0, node_crypto_1.createPublicKey)({ key: { ...jwk }, format: 'jwk' });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Design §22.10, canvas C8 D5: an Ed25519 key (RFC 8037) whose `x` is a canonical point and not of small order, or a
+ * P-256 key whose `x` and `y` are 32 bytes and on the curve; never a private part. Members other than the required ones
+ * are dropped, never trusted (the algorithm comes from the key type). Null for anything else.
+ */
+function checkPublicJwk(input, allowed = exports.KEY_ALGORITHMS) {
+    if (!(0, util_1.isPlainObject)(input) || 'd' in input) {
+        return null;
+    }
+    let material = null;
+    if (input.kty === 'OKP' && input.crv === 'Ed25519' && has32Bytes(input.x)) {
+        const x = (0, base64url_js_1.decodeB64url)(input.x);
+        if ((0, ed25519_js_1.isCanonicalPoint)(x) && !(0, ed25519_js_1.isSmallOrder)(x)) {
+            const jwk = { kty: 'OKP', crv: 'Ed25519', x: input.x };
+            material = { alg: 'EdDSA', jwk };
+        }
+    }
+    else if (input.kty === 'EC' && input.crv === 'P-256' && has32Bytes(input.x) && has32Bytes(input.y)) {
+        const jwk = { kty: 'EC', crv: 'P-256', x: input.x, y: input.y };
+        material = { alg: 'ES256', jwk };
+    }
+    if (!material || !allowed.includes(material.alg) || !importable(material.jwk)) {
+        return null;
+    }
+    return material;
+}
+/** RFC 7638: the required members only, in lexicographic order, no whitespace; SHA-256, base64url. */
+function thumbprint(jwk) {
+    const json = jwk.kty === 'OKP' ? JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x }) : JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+    return (0, node_crypto_1.createHash)('sha256').update(json, 'utf8').digest('base64url');
+}
+const CACHE_LIMIT = 1024;
+const checked = new Map();
+function cacheKey(m) {
+    const jwk = m.jwk;
+    if ('d' in jwk || typeof jwk.x !== 'string') {
+        return null;
+    }
+    if (m.alg === 'EdDSA' && jwk.kty === 'OKP' && jwk.crv === 'Ed25519') {
+        return `EdDSA:${jwk.x}`;
+    }
+    if (m.alg === 'ES256' && jwk.kty === 'EC' && jwk.crv === 'P-256' && typeof jwk.y === 'string') {
+        return `ES256:${jwk.x}:${jwk.y}`;
+    }
+    return null;
+}
+/**
+ * The node:crypto key for a material that passes checkPublicJwk with its own algorithm, or null. Materials can come
+ * from a caller's key lookup, so they are checked again here (cached, as the point check costs a few modular powers).
+ */
+function publicKeyObject(material) {
+    if (!(0, util_1.isPlainObject)(material) || !(0, util_1.isPlainObject)(material.jwk)) {
+        return null;
+    }
+    const key = cacheKey(material);
+    if (key === null) {
+        return null;
+    }
+    const hit = checked.get(key);
+    if (hit) {
+        return hit;
+    }
+    const ok = checkPublicJwk(material.jwk);
+    if (!ok || ok.alg !== material.alg) {
+        return null;
+    }
+    const object = importable(ok.jwk);
+    if (!object) {
+        return null;
+    }
+    if (checked.size >= CACHE_LIMIT) {
+        checked.delete(checked.keys().next().value);
+    }
+    checked.set(key, object);
+    return object;
+}
+//# sourceMappingURL=keys.js.map

package/lib/cjs/jwk/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/jwk/keys.ts"],"names":[],"mappings":";;;;;;;AAAA,6CAA0D;AAG1D,wCAA8C;AAC9C,iDAA8C;AAC9C,6CAA8D;AAEjD,QAAA,cAAc,GAA4B,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzF,MAAM,GAAG,GAAG,wBAAwB,CAAC;AAErC,oBAA2B,GAAY;IACrC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,IAAA,2BAAY,EAAC,CAAC,CAAC,EAAE,MAAM,KAAK,EAAE,CAAC;AAE/E,SAAS,UAAU,CAAC,GAAc;IAChC,IAAI,CAAC;QACH,OAAO,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,wBAA+B,KAAc,EAAE,OAAO,GAA4B,QAAA,cAAc;IAC9F,IAAI,CAAC,IAAA,oBAAa,EAAC,KAAK,CAAC,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,GAAuB,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,IAAA,2BAAY,EAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QACjC,IAAI,IAAA,6BAAgB,EAAC,CAAC,CAAC,IAAI,CAAC,IAAA,yBAAY,EAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAqB,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACzE,QAAQ,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,GAAG,GAAkB,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/E,QAAQ,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,sGAAsG;AACtG,oBAA2B,GAAc;IACvC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/J,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;AAE7C,SAAS,QAAQ,CAAC,CAAc;IAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAyC,CAAC;IACxD,IAAI,GAAG,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC9F,OAAO,SAAS,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,yBAAgC,QAAqB;IACnD,IAAI,CAAC,IAAA,oBAAa,EAAC,QAAQ,CAAC,IAAI,CAAC,IAAA,oBAAa,EAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/lib/cjs/jwk/signature.d.ts

@@ -0,0 +1,11 @@
+import type { KeyObject } from 'node:crypto';
+import type { KeyAlgorithm, KeyMaterial } from '@spinajs/authn/contracts';
+/** Raw signature length for both algorithms: Ed25519, and ES256 as IEEE P1363 r || s. */
+export declare const SIGNATURE_BYTES = 64;
+/** Verifies with the key's own algorithm; false for a key that fails the key checks or any other signature length. */
+export declare function verifySignature(material: KeyMaterial, data: Uint8Array, signature: Uint8Array): boolean;
+/** Raw signature: Ed25519, or ES256 over SHA-256 as IEEE P1363. */
+export declare function signRaw(alg: KeyAlgorithm, privateKey: KeyObject, data: Uint8Array): Buffer;
+/** The work of one verification under a key nobody holds, so an unknown key costs what a known one does (A02). */
+export declare function dummyVerify(alg: KeyAlgorithm, data: Uint8Array, signature: Uint8Array): false;
+//# sourceMappingURL=signature.d.ts.map

package/lib/cjs/jwk/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../../src/jwk/signature.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAI1E,yFAAyF;AACzF,eAAO,MAAM,eAAe,KAAK,CAAC;AAiBlC,sHAAsH;AACtH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAGvG;AAED,mEAAmE;AACnE,wBAAgB,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAE1F;AAOD,kHAAkH;AAClH,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,KAAK,CAG7F"}

package/lib/cjs/jwk/signature.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SIGNATURE_BYTES = void 0;
+exports.verifySignature = verifySignature;
+exports.signRaw = signRaw;
+exports.dummyVerify = dummyVerify;
+const node_crypto_1 = require("node:crypto");
+const ed25519_js_1 = require("./ed25519.js");
+const keys_js_1 = require("./keys.js");
+/** Raw signature length for both algorithms: Ed25519, and ES256 as IEEE P1363 r || s. */
+exports.SIGNATURE_BYTES = 64;
+function verifyWith(alg, key, data, signature) {
+    if (signature.length !== exports.SIGNATURE_BYTES) {
+        return false;
+    }
+    try {
+        if (alg === 'EdDSA') {
+            // ed25519-dalek's verify_strict refuses a small-order R and OpenSSL does not; canvas C8 refuses it on both sides.
+            return !(0, ed25519_js_1.isSmallOrder)(signature.subarray(0, 32)) && (0, node_crypto_1.verify)(null, data, key, signature);
+        }
+        return (0, node_crypto_1.verify)('sha256', data, { key, dsaEncoding: 'ieee-p1363' }, signature);
+    }
+    catch {
+        return false;
+    }
+}
+/** Verifies with the key's own algorithm; false for a key that fails the key checks or any other signature length. */
+function verifySignature(material, data, signature) {
+    const key = (0, keys_js_1.publicKeyObject)(material);
+    return key !== null && verifyWith(material.alg, key, data, signature);
+}
+/** Raw signature: Ed25519, or ES256 over SHA-256 as IEEE P1363. */
+function signRaw(alg, privateKey, data) {
+    return alg === 'EdDSA' ? (0, node_crypto_1.sign)(null, data, privateKey) : (0, node_crypto_1.sign)('sha256', data, { key: privateKey, dsaEncoding: 'ieee-p1363' });
+}
+const dummies = {
+    EdDSA: (0, node_crypto_1.createPublicKey)((0, node_crypto_1.generateKeyPairSync)('ed25519').privateKey),
+    ES256: (0, node_crypto_1.createPublicKey)((0, node_crypto_1.generateKeyPairSync)('ec', { namedCurve: 'P-256' }).privateKey),
+};
+/** The work of one verification under a key nobody holds, so an unknown key costs what a known one does (A02). */
+function dummyVerify(alg, data, signature) {
+    verifyWith(alg, dummies[alg], data, signature.length === exports.SIGNATURE_BYTES ? signature : Buffer.alloc(exports.SIGNATURE_BYTES, 1));
+    return false;
+}
+//# sourceMappingURL=signature.js.map

package/lib/cjs/jwk/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../../src/jwk/signature.ts"],"names":[],"mappings":";;;;;;AAAA,6CAAiF;AAGjF,6CAA4C;AAC5C,uCAA4C;AAE5C,yFAAyF;AAC5E,QAAA,eAAe,GAAG,EAAE,CAAC;AAElC,SAAS,UAAU,CAAC,GAAiB,EAAE,GAAc,EAAE,IAAgB,EAAE,SAAqB;IAC5F,IAAI,SAAS,CAAC,MAAM,KAAK,QAAA,eAAe,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,kHAAkH;YAClH,OAAO,CAAC,IAAA,yBAAY,EAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAA,oBAAM,EAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAA,oBAAM,EAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,sHAAsH;AACtH,yBAAgC,QAAqB,EAAE,IAAgB,EAAE,SAAqB;IAC5F,MAAM,GAAG,GAAG,IAAA,yBAAe,EAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AACxE,CAAC;AAED,mEAAmE;AACnE,iBAAwB,GAAiB,EAAE,UAAqB,EAAE,IAAgB;IAChF,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,IAAA,kBAAI,EAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,kBAAI,EAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/H,CAAC;AAED,MAAM,OAAO,GAAoC;IAC/C,KAAK,EAAE,IAAA,6BAAe,EAAC,IAAA,iCAAmB,EAAC,SAAS,CAAC,CAAC,UAAU,CAAC;IACjE,KAAK,EAAE,IAAA,6BAAe,EAAC,IAAA,iCAAmB,EAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC;CACtF,CAAC;AAEF,kHAAkH;AAClH,qBAA4B,GAAiB,EAAE,IAAgB,EAAE,SAAqB;IACpF,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,KAAK,QAAA,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAA,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;IACzH,OAAO,KAAK,CAAC;AACf,CAAC"}

package/lib/cjs/jws/index.d.ts

@@ -0,0 +1,4 @@
+export * from './json.js';
+export * from './verifier.js';
+export * from './signer.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/jws/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC"}

package/lib/cjs/jws/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./json.js"), exports);
+__exportStar(require("./verifier.js"), exports);
+__exportStar(require("./signer.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/jws/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/jws/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,gDAA8B;AAC9B,8CAA4B"}

package/lib/cjs/jws/json.d.ts

@@ -0,0 +1,11 @@
+import { isPlainObject } from '@spinajs/util';
+/**
+ * JSON as serde_json reads it, so this verifier agrees with the canvas C8 Rust one: refuses invalid UTF-8, lone
+ * surrogates (escaped or not, keys included, also under a duplicate key), nesting deeper than 127, numbers beyond f64,
+ * and top-level `uintKeys` whose number is not written as a plain integer. A duplicate key keeps its last value
+ * (RFC 7515 §4 allows that, and both C8 verifiers do it). Undefined when refused; never throws.
+ */
+export declare function parseStrictJson(bytes: Uint8Array, uintKeys?: readonly string[]): unknown;
+/** @deprecated Use `isPlainObject` from `@spinajs/util`. */
+export declare const isJsonObject: typeof isPlainObject;
+//# sourceMappingURL=json.d.ts.map

package/lib/cjs/jws/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../src/jws/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAY9C;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAgD5F;AAED,4DAA4D;AAC5D,eAAO,MAAM,YAAY,sBAAgB,CAAC"}

package/lib/cjs/jws/json.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isJsonObject = void 0;
+exports.parseStrictJson = parseStrictJson;
+const util_1 = require("@spinajs/util");
+const LONE_SURROGATE = /\p{Surrogate}/u;
+// serde_json refuses the 128th nested array or object (its recursion limit); canvas C8 refuses it on both sides.
+const MAX_DEPTH = 127;
+// On text JSON.parse accepted, these are exactly its strings, brackets and numbers (literals are skipped).
+const TOKENS = /"[^"\\]*(?:\\.[^"\\]*)*"|[[\]{}]|-?[0-9][0-9.eE+-]*/g;
+const KEY_FOLLOWS = /\s*:/y;
+const UINT_TEXT = /^(0|[1-9][0-9]*)$/;
+const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+/**
+ * JSON as serde_json reads it, so this verifier agrees with the canvas C8 Rust one: refuses invalid UTF-8, lone
+ * surrogates (escaped or not, keys included, also under a duplicate key), nesting deeper than 127, numbers beyond f64,
+ * and top-level `uintKeys` whose number is not written as a plain integer. A duplicate key keeps its last value
+ * (RFC 7515 §4 allows that, and both C8 verifiers do it). Undefined when refused; never throws.
+ */
+function parseStrictJson(bytes, uintKeys = []) {
+    try {
+        const text = decoder.decode(bytes);
+        const value = JSON.parse(text);
+        // The number text of each top-level key, the last occurrence winning as in JSON.parse; read from the tokens
+        // because the reviver's source text needs Node 21+.
+        const numberText = new Map();
+        const topLevelObject = text.trimStart().startsWith('{');
+        let depth = 0;
+        let key = null;
+        for (const m of text.matchAll(TOKENS)) {
+            const token = m[0];
+            const pending = key;
+            key = null;
+            if (token === '[' || token === '{') {
+                depth += 1;
+                if (depth > MAX_DEPTH) {
+                    return undefined;
+                }
+            }
+            else if (token === ']' || token === '}') {
+                depth -= 1;
+            }
+            else if (token.startsWith('"')) {
+                const s = JSON.parse(token);
+                if (LONE_SURROGATE.test(s)) {
+                    return undefined;
+                }
+                if (topLevelObject && depth === 1) {
+                    KEY_FOLLOWS.lastIndex = m.index + token.length;
+                    if (KEY_FOLLOWS.test(text)) {
+                        key = s;
+                    }
+                }
+            }
+            else if (!Number.isFinite(Number(token))) {
+                return undefined;
+            }
+            else if (pending !== null) {
+                numberText.set(pending, token);
+            }
+        }
+        for (const k of uintKeys) {
+            const t = numberText.get(k);
+            if (t !== undefined && !UINT_TEXT.test(t)) {
+                return undefined;
+            }
+        }
+        return value;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** @deprecated Use `isPlainObject` from `@spinajs/util`. */
+exports.isJsonObject = util_1.isPlainObject;
+//# sourceMappingURL=json.js.map

package/lib/cjs/jws/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../../src/jws/json.ts"],"names":[],"mappings":";;;;AAAA,wCAA8C;AAE9C,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,iHAAiH;AACjH,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,2GAA2G;AAC3G,MAAM,MAAM,GAAG,sDAAsD,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,SAAS,GAAG,mBAAmB,CAAC;AAEtC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,yBAAgC,KAAiB,EAAE,QAAQ,GAAsB,EAAE;IACjF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,4GAA4G;QAC5G,oDAAoD;QACpD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,OAAO,GAAG,GAAG,CAAC;YACpB,GAAG,GAAG,IAAI,CAAC;YACX,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBACnC,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;oBACtB,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBAC1C,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;iBAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAW,CAAC;gBACtC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3B,OAAO,SAAS,CAAC;gBACnB,CAAC;gBACD,IAAI,cAAc,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAClC,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC,KAAM,GAAG,KAAK,CAAC,MAAM,CAAC;oBAChD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC3B,GAAG,GAAG,CAAC,CAAC;oBACV,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC3C,OAAO,SAAS,CAAC;YACnB,CAAC;iBAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4DAA4D;AAC/C,QAAA,YAAY,GAAG,oBAAa,CAAC"}

package/lib/cjs/jws/signer.d.ts

@@ -0,0 +1,25 @@
+import { JwsSigner } from '@spinajs/authn/contracts';
+import type { JwsClaims, JwsKey, JwsSignOptions } from '@spinajs/authn/contracts';
+/** A private signing JWK: Ed25519 (RFC 8037) or P-256, with its `kid`. */
+export interface PrivateJwk {
+    readonly kty: string;
+    readonly crv: string;
+    readonly kid: string;
+    readonly x: string;
+    readonly y?: string;
+    readonly d: string;
+}
+/**
+ * JwsSigner over private JWKs the app loads (from a secret reference) and passes in; the first key, or `current`,
+ * signs by default. Header and claims are written exactly as canvas C8 does, so EdDSA tickets come out byte for byte.
+ */
+export declare class LocalJwsSigner extends JwsSigner {
+    private readonly keys;
+    private readonly current;
+    constructor(privateJwks: readonly PrivateJwk[], opts?: {
+        readonly current?: string;
+    });
+    sign<C extends JwsClaims>(claims: C, opts: JwsSignOptions): Promise<string>;
+    publicKeys(): Promise<readonly JwsKey[]>;
+}
+//# sourceMappingURL=signer.d.ts.map

package/lib/cjs/jws/signer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../../src/jws/signer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAQlF,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;CACpB;AAgCD;;;GAGG;AACH,qBAAa,cAAe,SAAQ,SAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IACtD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC,YAAY,WAAW,EAAE,SAAS,UAAU,EAAE,EAAE,IAAI,GAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,EAavF;IAEK,IAAI,CAAC,CAAC,SAAS,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBhF;IAEK,UAAU,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAE7C;CACF"}

package/lib/cjs/jws/signer.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalJwsSigner = void 0;
+const node_crypto_1 = require("node:crypto");
+const contracts_1 = require("@spinajs/authn/contracts");
+const util_1 = require("@spinajs/util");
+const exceptions_1 = require("@spinajs/exceptions");
+const base64url_js_1 = require("../jwk/base64url.js");
+const keys_js_1 = require("../jwk/keys.js");
+const signature_js_1 = require("../jwk/signature.js");
+const json_js_1 = require("./json.js");
+function signingKey(jwk) {
+    const where = `signing key ${JSON.stringify(jwk?.kid)}`;
+    if (!(0, keys_js_1.isValidKid)(jwk?.kid)) {
+        throw new exceptions_1.InvalidArgument(`${where}: kid must be 1-64 of [A-Za-z0-9._-]`);
+    }
+    const material = (0, keys_js_1.checkPublicJwk)(jwk.kty === 'EC' ? { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y } : { kty: jwk.kty, crv: jwk.crv, x: jwk.x });
+    if (!material) {
+        throw new exceptions_1.InvalidArgument(`${where}: not a valid Ed25519 or P-256 key`);
+    }
+    if ((0, base64url_js_1.decodeB64url)(jwk.d)?.length !== 32) {
+        throw new exceptions_1.InvalidArgument(`${where}: d must be 32 bytes of base64url`);
+    }
+    let privateKey;
+    try {
+        privateKey = (0, node_crypto_1.createPrivateKey)({ key: { ...material.jwk, d: jwk.d }, format: 'jwk' });
+    }
+    catch {
+        throw new exceptions_1.InvalidArgument(`${where}: the private key does not load`);
+    }
+    const derived = (0, node_crypto_1.createPublicKey)(privateKey).export({ format: 'jwk' });
+    if (derived.x !== material.jwk.x || (material.jwk.kty === 'EC' && derived.y !== material.jwk.y)) {
+        throw new exceptions_1.InvalidArgument(`${where}: the public part does not match d`);
+    }
+    return { publicKey: Object.freeze({ ...material, kid: jwk.kid }), privateKey };
+}
+/**
+ * JwsSigner over private JWKs the app loads (from a secret reference) and passes in; the first key, or `current`,
+ * signs by default. Header and claims are written exactly as canvas C8 does, so EdDSA tickets come out byte for byte.
+ */
+class LocalJwsSigner extends contracts_1.JwsSigner {
+    constructor(privateJwks, opts = {}) {
+        super();
+        this.keys = new Map();
+        for (const jwk of privateJwks) {
+            if (this.keys.has(jwk.kid)) {
+                throw new exceptions_1.InvalidArgument(`signing key ${JSON.stringify(jwk.kid)} appears twice`);
+            }
+            this.keys.set(jwk.kid, signingKey(jwk));
+        }
+        const current = opts.current ?? privateJwks[0]?.kid;
+        if (current === undefined || !this.keys.has(current)) {
+            throw new exceptions_1.InvalidArgument(`no signing key ${JSON.stringify(current)}`);
+        }
+        this.current = current;
+    }
+    async sign(claims, opts) {
+        const kid = opts.kid ?? this.current;
+        const key = this.keys.get(kid);
+        if (!key) {
+            throw new exceptions_1.InvalidArgument(`no signing key ${JSON.stringify(kid)}`);
+        }
+        const [hasTyp] = (0, util_1._try_check_arg)((0, util_1._is_string)((0, util_1._non_empty)()))(opts.typ, 'opts.typ');
+        if (!hasTyp) {
+            throw new exceptions_1.InvalidArgument('a JWS needs a typ');
+        }
+        if (typeof claims.iss !== 'string' || typeof claims.aud !== 'string' || !(0, util_1.isNonNegativeInt)(claims.iat) || !(0, util_1.isNonNegativeInt)(claims.exp) || claims.exp <= claims.iat) {
+            throw new exceptions_1.InvalidArgument('claims need string iss and aud, and integer iat < exp in Unix seconds');
+        }
+        const header = JSON.stringify({ alg: key.publicKey.alg, kid, typ: opts.typ });
+        const payload = JSON.stringify(claims);
+        if ((0, json_js_1.parseStrictJson)(Buffer.from(payload, 'utf8'), ['iat', 'exp']) === undefined) {
+            throw new exceptions_1.InvalidArgument('claims must be JSON a strict verifier reads (no lone surrogates, no nesting deeper than 127)');
+        }
+        const input = `${(0, base64url_js_1.encodeB64url)(header)}.${(0, base64url_js_1.encodeB64url)(payload)}`;
+        return `${input}.${(0, base64url_js_1.encodeB64url)((0, signature_js_1.signRaw)(key.publicKey.alg, key.privateKey, Buffer.from(input, 'ascii')))}`;
+    }
+    async publicKeys() {
+        return Object.freeze([...this.keys.values()].map((k) => k.publicKey));
+    }
+}
+exports.LocalJwsSigner = LocalJwsSigner;
+//# sourceMappingURL=signer.js.map

package/lib/cjs/jws/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../../src/jws/signer.ts"],"names":[],"mappings":";;;AAAA,6CAAgE;AAEhE,wDAAqD;AAErD,wCAAyF;AACzF,oDAAsD;AACtD,sDAAiE;AACjE,4CAA4D;AAC5D,sDAA8C;AAC9C,uCAA4C;AAiB5C,SAAS,UAAU,CAAC,GAAe;IACjC,MAAM,KAAK,GAAG,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;IACxD,IAAI,CAAC,IAAA,oBAAU,EAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,4BAAe,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,wBAAc,EAAC,GAAG,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAClJ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,4BAAe,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAA,2BAAY,EAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,4BAAe,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,UAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,UAAU,GAAG,IAAA,8BAAgB,EAAC,EAAE,GAAG,EAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,4BAAe,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,6BAAe,EAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,4BAAe,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAW,EAAE,UAAU,EAAE,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,oBAA4B,SAAQ,qBAAS;IAI3C,YAAY,WAAkC,EAAE,IAAI,GAAkC,EAAE;QACtF,KAAK,EAAE,CAAC;QAJO,SAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QAKpD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,4BAAe,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;QACpD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,4BAAe,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CAAsB,MAAS,EAAE,IAAoB;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,4BAAe,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,4BAAe,CAAC,mBAAmB,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAA,uBAAgB,EAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAA,uBAAgB,EAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACnK,MAAM,IAAI,4BAAe,CAAC,uEAAuE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAA,yBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAChF,MAAM,IAAI,4BAAe,CAAC,8FAA8F,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,IAAA,2BAAY,EAAC,MAAM,CAAC,IAAI,IAAA,2BAAY,EAAC,OAAO,CAAC,EAAE,CAAC;QACjE,OAAO,GAAG,KAAK,IAAI,IAAA,2BAAY,EAAC,IAAA,sBAAO,EAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7G,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxE,CAAC;CACF"}

package/lib/cjs/jws/verifier.d.ts

@@ -0,0 +1,10 @@
+import { JwsVerifier } from '@spinajs/authn/contracts';
+import type { JwsClaims, JwsKey, JwsVerification, JwsVerifyOptions } from '@spinajs/authn/contracts';
+/**
+ * Compact JWS under the canvas C8 D4 rules (lane notes D3): the first failing check gives the code. The signature is
+ * checked with the key's own algorithm; a key that fails the key checks counts as unknown.
+ */
+export declare class StrictJwsVerifier extends JwsVerifier {
+    verify<C extends JwsClaims, K extends JwsKey = JwsKey>(token: string, opts: JwsVerifyOptions<C, K>): Promise<JwsVerification<C, K>>;
+}
+//# sourceMappingURL=verifier.d.ts.map

package/lib/cjs/jws/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../../src/jws/verifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAA2B,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAgB,MAAM,0BAA0B,CAAC;AAW5I;;;GAGG;AACH,qBACa,iBAAkB,SAAQ,WAAW;IAC1C,MAAM,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CA2DxI;CACF"}

package/lib/cjs/jws/verifier.js

@@ -0,0 +1,86 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StrictJwsVerifier = void 0;
+const di_1 = require("@spinajs/di");
+const contracts_1 = require("@spinajs/authn/contracts");
+const util_1 = require("@spinajs/util");
+const base64url_js_1 = require("../jwk/base64url.js");
+const keys_js_1 = require("../jwk/keys.js");
+const signature_js_1 = require("../jwk/signature.js");
+const json_js_1 = require("./json.js");
+const HEADER_MEMBERS = ['alg', 'kid', 'typ'];
+const fail = (code) => ({ ok: false, code });
+/**
+ * Compact JWS under the canvas C8 D4 rules (lane notes D3): the first failing check gives the code. The signature is
+ * checked with the key's own algorithm; a key that fails the key checks counts as unknown.
+ */
+let StrictJwsVerifier = class StrictJwsVerifier extends contracts_1.JwsVerifier {
+    async verify(token, opts) {
+        if (typeof token !== 'string') {
+            return fail('malformed');
+        }
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return fail('malformed');
+        }
+        const [headerText, payloadText, signatureText] = parts;
+        const headerBytes = (0, base64url_js_1.decodeB64url)(headerText);
+        const payloadBytes = (0, base64url_js_1.decodeB64url)(payloadText);
+        const signature = (0, base64url_js_1.decodeB64url)(signatureText);
+        if (!headerBytes || !payloadBytes || signature?.length !== signature_js_1.SIGNATURE_BYTES) {
+            return fail('malformed');
+        }
+        const h = (0, json_js_1.parseStrictJson)(headerBytes);
+        if (!(0, util_1.isPlainObject)(h) || Object.keys(h).length !== HEADER_MEMBERS.length || !HEADER_MEMBERS.every((m) => typeof h[m] === 'string')) {
+            return fail('bad_header');
+        }
+        const header = Object.freeze({ alg: h.alg, kid: h.kid, typ: h.typ });
+        if (!opts.algorithms.includes(header.alg) || header.typ !== opts.typ) {
+            return fail('bad_header');
+        }
+        const key = await opts.keys(header.kid);
+        if (!key || key.alg !== header.alg || (0, keys_js_1.publicKeyObject)(key) === null) {
+            return fail('unknown_key');
+        }
+        if (!(0, signature_js_1.verifySignature)(key, Buffer.from(`${headerText}.${payloadText}`, 'ascii'), signature)) {
+            return fail('bad_signature');
+        }
+        const payload = (0, json_js_1.parseStrictJson)(payloadBytes, ['iat', 'exp']);
+        if (!(0, util_1.isPlainObject)(payload)) {
+            return fail('invalid_claims');
+        }
+        const { iss, aud, iat, exp } = payload;
+        if (typeof iss !== 'string' || typeof aud !== 'string' || !(0, util_1.isNonNegativeInt)(iat) || !(0, util_1.isNonNegativeInt)(exp) || exp <= iat || exp - iat > opts.maxLifetimeSeconds) {
+            return fail('invalid_claims');
+        }
+        const claims = opts.claims(payload);
+        if (claims === null) {
+            return fail('invalid_claims');
+        }
+        if (typeof opts.issuer === 'function' ? !opts.issuer(iss, key) : iss !== opts.issuer) {
+            return fail('wrong_issuer');
+        }
+        if (aud !== opts.audience) {
+            return fail('wrong_audience');
+        }
+        const nowS = Math.floor(opts.now.getTime() / 1000);
+        if (nowS >= exp + opts.skewSeconds) {
+            return fail('expired');
+        }
+        if (iat > nowS + opts.skewSeconds) {
+            return fail('not_yet_valid');
+        }
+        return { ok: true, header, claims, key };
+    }
+};
+exports.StrictJwsVerifier = StrictJwsVerifier;
+exports.StrictJwsVerifier = StrictJwsVerifier = __decorate([
+    (0, di_1.Injectable)(contracts_1.JwsVerifier)
+], StrictJwsVerifier);
+//# sourceMappingURL=verifier.js.map

package/lib/cjs/jws/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../../src/jws/verifier.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oCAAyC;AACzC,wDAAuD;AAEvD,wCAAgE;AAChE,sDAAmD;AACnD,4CAAiD;AACjD,sDAAuE;AACvE,uCAA4C;AAE5C,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAE7C,MAAM,IAAI,GAAG,CAAC,IAAkB,EAAuD,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhH;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,uBAAW;IAChD,KAAK,CAAC,MAAM,CAAiD,KAAa,EAAE,IAA4B;QACtG,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC;QACvD,MAAM,WAAW,GAAG,IAAA,2BAAY,EAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAA,2BAAY,EAAC,WAAW,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAA,2BAAY,EAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE,MAAM,KAAK,8BAAe,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,CAAC,GAAG,IAAA,yBAAe,EAAC,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,IAAA,oBAAa,EAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACnI,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAc,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAa,EAAE,GAAG,EAAE,CAAC,CAAC,GAAa,EAAE,CAAC,CAAC;QACpH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,IAAA,yBAAe,EAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,IAAA,8BAAe,EAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,WAAW,EAAE,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,yBAAe,EAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAA,oBAAa,EAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAA,uBAAgB,EAAC,GAAG,CAAC,IAAI,CAAC,IAAA,uBAAgB,EAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChK,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACrF,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACnD,IAAI,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC3C,CAAC;CACF,CAAA;;4BA7DY,iBAAiB;IAD7B,IAAA,eAAU,EAAC,uBAAW,CAAC;GACX,iBAAiB,CA6D7B"}

package/lib/cjs/migrations/AuthnKeys_2026_10_02_00_00_00.d.ts

@@ -0,0 +1,7 @@
+import { OrmDriver, OrmMigration } from '@spinajs/orm';
+/** Design §22.16 `authn_key`, plus an owner index for GET /user/keys. */
+export declare class AuthnKeys_2026_10_02_00_00_00 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    down(connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=AuthnKeys_2026_10_02_00_00_00.d.ts.map

package/lib/cjs/migrations/AuthnKeys_2026_10_02_00_00_00.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnKeys_2026_10_02_00_00_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/AuthnKeys_2026_10_02_00_00_00.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAElE,yEAAyE;AACzE,qBACa,6BAA8B,SAAQ,YAAY;IAChD,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBpD;IAEY,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtD;CACF"}

package/lib/cjs/migrations/AuthnKeys_2026_10_02_00_00_00.js

@@ -0,0 +1,40 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnKeys_2026_10_02_00_00_00 = void 0;
+const orm_1 = require("@spinajs/orm");
+/** Design §22.16 `authn_key`, plus an owner index for GET /user/keys. */
+let AuthnKeys_2026_10_02_00_00_00 = class AuthnKeys_2026_10_02_00_00_00 extends orm_1.OrmMigration {
+    async up(connection) {
+        await connection.schema().createTable('authn_key', (table) => {
+            table.string('kid', 64).primaryKey();
+            table.string('owner_type', 16).notNull();
+            table.string('owner_id', 64).notNull();
+            table.string('alg', 16).notNull();
+            table.text('jwk').notNull();
+            table.string('thumbprint', 64).notNull();
+            table.text('scope');
+            table.string('name', 128);
+            table.dateTime('expires_at');
+            table.dateTime('revoked_at');
+            table.dateTime('last_used_at');
+            table.string('created_by', 100);
+            table.dateTime('created_at').notNull();
+        });
+        await connection.index().unique().table('authn_key').name('authn_key_thumb').columns(['thumbprint']);
+        await connection.index().table('authn_key').name('authn_key_owner').columns(['owner_type', 'owner_id']);
+    }
+    async down(connection) {
+        await connection.schema().dropTable('authn_key');
+    }
+};
+exports.AuthnKeys_2026_10_02_00_00_00 = AuthnKeys_2026_10_02_00_00_00;
+exports.AuthnKeys_2026_10_02_00_00_00 = AuthnKeys_2026_10_02_00_00_00 = __decorate([
+    (0, orm_1.Migration)('default')
+], AuthnKeys_2026_10_02_00_00_00);
+//# sourceMappingURL=AuthnKeys_2026_10_02_00_00_00.js.map

package/lib/cjs/migrations/AuthnKeys_2026_10_02_00_00_00.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnKeys_2026_10_02_00_00_00.js","sourceRoot":"","sources":["../../../src/migrations/AuthnKeys_2026_10_02_00_00_00.ts"],"names":[],"mappings":";;;;;;;;;AAAA,sCAAkE;AAElE,yEAAyE;AAElE,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,kBAAY;IACtD,KAAK,CAAC,EAAE,CAAC,UAAqB;QACnC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;YAC3D,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;YACrC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACzC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACvC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5B,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC1B,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7B,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC7B,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAC/B,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAChC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACrG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAC1G,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,UAAqB;QACrC,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;;wCAxBY,6BAA6B;IADzC,IAAA,eAAS,EAAC,SAAS,CAAC;GACR,6BAA6B,CAwBzC"}

package/lib/cjs/migrations/index.d.ts

@@ -0,0 +1,2 @@
+export * from './AuthnKeys_2026_10_02_00_00_00.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC"}