@t4h.framework/jwks 0.7.5 → 0.7.7

package/.ai/skills/framework-jwks/SKILL.md

@@ -99,9 +99,9 @@ Optional manifest fields are still present as `undefined` when omitted (`toManif
 | `rawPayload` | Yes | Payload bytes as string for non-JWT verification; for JWT path, tests pass the same string as `signature` (handler only uses `signature` on JWT path). |
 | `issuer` | No | When set, passed to `jwt.verify` as expected `iss`. Mismatch **rejects** (throws). |
 | `audience` | No | When set, passed to `jwt.verify` as expected `aud`. |
-| `kid` | Conditional | Required when `signature` is **not** a decodable JWT (non-JWT path). |
-| `algorithm` | Conditional | Non-JWT path: **enum key** on `JWKSAlgorithm` (e.g. `RS256`), not the Node crypto string. |
-| `signatureFormat` | Conditional | Non-JWT path: encoding for the signature buffer (`hex`, `base64`, etc.—`BinaryToTextEncoding`). |
+| `kid` | Non-JWT path | Key id to look up in the JWKS. Used when `signature` is **not** a decodable JWT. |
+| `algorithm` | Non-JWT path | **Enum key** on `JWKSAlgorithm` (e.g. `RS256`), not the Node crypto string. |
+| `signatureFormat` | Non-JWT path | Encoding for the signature buffer (`hex`, `base64`, etc.—`BinaryToTextEncoding`). |
 
 ---
 
@@ -119,7 +119,7 @@ Behavior (from `jwks-authorize.ts` and tests):
 2. Build `JwksClient({ jwksUri: options.url })`.
 3. `jwt.decode(signature, { complete: true })`:
    - **Decoded (JWT path)** → `validateJwt(signature, client, { issuer, audience })`.
-   - **Not decoded (non-JWT path)** → require `kid`, `algorithm`, `signatureFormat`; else **throw** with fixed messages (see below).
+   - **Not decoded (non-JWT path)** → verify the detached signature with `kid`, `algorithm` and `signatureFormat`.
 
 ### JWT path (`validateJwt`)
 
@@ -137,13 +137,7 @@ authorizer.update(options.rawPayload)
 authorizer.verify(signingKey, options.signature, signatureFormat)
 ```
 
-Throws if any required field is missing:
-
-| Missing | Error message |
-|---------|----------------|
-| `kid` | `KID is required for payload verification` |
-| `algorithm` | `Algorithm is required for payload verification` |
-| `signatureFormat` | `Signature format is required for payload verification` |
+A missing `kid`, `algorithm` or `signatureFormat` throws (`jwks-authorize.ts`).
 
 `algorithm` must be a **key** of `JWKSAlgorithm`:
 
@@ -210,7 +204,6 @@ If `signature` accidentally looks like a JWT to `jwt.decode`, the JWT path runs
 | Valid RS256 JWT, matching JWKS key | `true` |
 | JWT wrong alg (e.g. HS256), no `kid`, undecodable token | `false` |
 | Expired JWT, issuer mismatch, signature mismatch | **Rejected** (throw from `jwt.verify`) |
-| Non-JWT missing `kid` / `algorithm` / `signatureFormat` | **Throw** (configuration error) |
 | Non-JWT verify fails | `false` |
 
 Design callers so manifest context is complete **before** the handler runs; missing non-JWT fields are programmer errors, not silent denials.
@@ -271,6 +264,4 @@ For workflow orchestration and claims use **framework-core**; for the `TestWorkf
 2. Build `JWKSAuthorizationContext` with `url`, `signature`, `rawPayload` at minimum.
 3. Attach `new JWKSAuthorization(context)` to `Workflow` and/or `App` `authorization` option.
 4. JWT: ensure RS256 + `kid`; optional `issuer` / `audience`.
-5. Non-JWT: set `kid`, `algorithm` (`JWKSAlgorithm` key), `signatureFormat`.
-6. Expect `false` for deny, throws for misconfiguration or JWT verify failures (expired, wrong iss).
-7. Do not reference APIs absent from `src/` and tests.
+5. Expect `false` for deny, throws for misconfiguration or JWT verify failures (expired, wrong iss).

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @t4h.framework/jwks
 
+## 0.7.7
+
+### Patch Changes
+
+- [#243](https://github.com/tech4humans-brasil/framework/pull/243) [`0ffd663`](https://github.com/tech4humans-brasil/framework/commit/0ffd663ce8369edd7b54206cb3216568ad1de471) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The README examples read each value from `environments`, an `EnvDesign` in `src/constants/environments.ts`, and pass each credential as a `Secret`. They no longer use `process.env`, the raw `env` from the core or a literal in a `Secret` field. The jwks README describes the real context fields (`signature`, `rawPayload`) and says that a token that `jwt.verify` rejects throws.
+
+- [#240](https://github.com/tech4humans-brasil/framework/pull/240) [`0606115`](https://github.com/tech4humans-brasil/framework/commit/0606115e2e0baa994e9f0ed3559ee54ecac88e44) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - The skills do not repeat a rule that a lint rule, `tsc` or a runtime error already enforces. Each such rule is now one line that names the gate. The examples that broke a gate (`process.env`, `as any`, an inline secret, an `EnvDesign` in a workflow file, `ref.output` before `wait()`) are correct now.
+
+- [#228](https://github.com/tech4humans-brasil/framework/pull/228) [`d29e1ab`](https://github.com/tech4humans-brasil/framework/commit/d29e1ab29a039b13c3e4b075472bd615566ae75e) Thanks [@gusteycamargo](https://github.com/gusteycamargo)! - Uses exact types and `unknown` in place of `any`, and checks external data with guards.
+  - harness: the fix-issues prompt lists each sensor as `- checkTypes: PASS`. Before, it printed `- 0: [object Object]`.
+  - hmac: an algorithm name such as `constructor` throws `Unsupported algorithm`.
+  - oidc: a discovery response with no `introspection_endpoint`, or a null introspection body, throws a clear error.
+  - `HttpRequestActivity.toOutput` takes `HttpRequestActivityOutput` in place of `any`.
+
+## 0.7.6
+
 ## 0.7.5
 
 ## 0.7.4

package/README.md

@@ -18,21 +18,22 @@ Requires `@t4h.framework/core` (same major line as this package).
 
 Subclass of [`Authorization`](https://github.com/tech4humans-brasil/framework/tree/main/packages/core) from core. `toManifest()` points the runtime at `@t4h.framework/jwks/authorize` and passes a `JWKSAuthorizationContext`.
 
-Construct it with a full `JWKSAuthorizationContext` (including `url` and `value`). How you obtain `value`—headers, query, env, or runtime injection—is up to your app and deployment pipeline; this package does not read HTTP or env by itself.
+Construct it with a full `JWKSAuthorizationContext`. `url`, `signature` and `rawPayload` are required. Your app or deployment pipeline supplies `signature` and `rawPayload`, for example from a request header or by runtime injection. This package does not read HTTP or env.
 
 ## Context: `JWKSAuthorizationContext`
 
 | Field | Required | Description |
 |-------|----------|-------------|
 | `url` | Yes | JWKS document URL (`jwks-rsa` `jwksUri`). |
-| `value` | Yes | Credential to verify (Bearer token, raw payload, etc., depending on your app). Empty string yields `false`. |
-| `issuer` | No | If set, passed to JWT verification as expected `iss`. |
-| `audience` | No | If set, passed to JWT verification as expected `aud`. |
-| `kid` | Conditional | Required when `value` is **not** a decodable JWT (see below). |
-| `algorithm` | Conditional | Same as `kid` for non-JWT `value`. |
-| `signatureFormat` | Conditional | Same as `kid` for non-JWT `value` (encoding for the signature buffer, e.g. `hex` or `base64`). |
+| `signature` | Yes | Credential to verify: a JWT, or a detached signature for the non-JWT path. An empty string gives `false`. |
+| `rawPayload` | Yes | The signed payload for the non-JWT path. The JWT path does not use it; pass an empty string. |
+| `issuer` | No | JWT path: the expected `iss`. |
+| `audience` | No | JWT path: the expected `aud`. |
+| `kid` | Non-JWT path | Key id to find in the JWKS. Required when `signature` is **not** a JWT that decodes. |
+| `algorithm` | Non-JWT path | A key of `JWKSAlgorithm` (`RS256`, `PS256`, `ES256`, …). |
+| `signatureFormat` | Non-JWT path | Encoding of `signature` (`hex`, `base64`, …). |
 
-There is no built-in OIDC discovery (`JWKS_ISSUER`), no environment-variable mapping in this package, and no `credentialSource` helper—you choose where `value` comes from in your application or hosting layer.
+There is no OIDC discovery (`JWKS_ISSUER`), no environment-variable mapping in this package, and no `credentialSource` helper. Your application or hosting layer gives `signature` and `rawPayload`.
 
 ## Runtime handler (`jwks/authorize`)
 
@@ -42,21 +43,22 @@ The default export is an async function:
 (options: JWKSAuthorizationContext) => Promise<boolean>
 ```
 
-- Returns `false` if `value` is missing or verification fails.
+- Returns `false` if `signature` is empty.
 - Returns `true` if verification succeeds.
 
 ### JWT path
 
-If `value` decodes as a JWT (`jsonwebtoken` `decode` with `complete: true` succeeds), verification uses `validateJwt` ([source](https://github.com/tech4humans-brasil/framework/blob/main/packages/jwks/src/helpers/validateJwt.ts)):
+If `signature` decodes as a JWT (`jsonwebtoken` `decode` with `complete: true` succeeds), the handler verifies it with `validateJwt` ([source](https://github.com/tech4humans-brasil/framework/blob/main/packages/jwks/src/helpers/validateJwt.ts)):
 
-- Algorithm **RS256** only (`alg` in the header must be `RS256`).
-- Header must include `kid` (used to fetch the signing key from JWKS).
-- `exp` is enforced (token must not be expired).
-- Optional `issuer` and `audience` from the context are applied when present.
+- The algorithm must be **RS256**. A different `alg` in the header gives `false`.
+- The header must have a `kid`, which selects the signing key in the JWKS. No `kid` gives `false`.
+- `exp` is enforced.
+- `issuer` and `audience` from the context apply when you set them.
+- An expired token, an `issuer` or `audience` mismatch, or a bad signature makes `jwt.verify` throw, so the handler throws.
 
 ### Non-JWT path
 
-If `value` is not treated as a JWT by the decoder, the handler expects `kid`, `algorithm`, and `signatureFormat` on the context. If any of these are missing, it **throws** with a clear error. It loads the public key from JWKS by `kid` and verifies using Node’s `crypto.createVerify`.
+If `signature` does not decode as a JWT, the handler needs `kid`, `algorithm` and `signatureFormat` on the context. If one of them is missing, it **throws**. It gets the public key from the JWKS by `kid`, and verifies `signature` over `rawPayload` with Node `crypto.createVerify`. A signature that does not match gives `false`.
 
 ## Example
 
@@ -65,7 +67,8 @@ import { JWKSAuthorization } from '@t4h.framework/jwks'
 
 const authorization = new JWKSAuthorization({
   url: 'https://auth.example.com/.well-known/jwks.json',
-  value: '<token-or-payload-from-runtime>',
+  signature: '<credential-from-runtime>',
+  rawPayload: '',
   audience: 'https://api.example.com',
 })
 ```

package/dist/helpers/validateJwt.js

@@ -9,7 +9,7 @@ export async function validateJwt(token, client, options) {
         return false;
     const key = await client.getSigningKey(decoded.header.kid);
     const publicKey = key.getPublicKey();
-    const isValid = await jwt.verify(token, publicKey, {
+    const isValid = jwt.verify(token, publicKey, {
         algorithms: ['RS256'],
         ignoreExpiration: false,
         issuer: options?.issuer,

package/dist/helpers/validateJwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateJwt.js","sourceRoot":"","sources":["../../src/helpers/validateJwt.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAA;AAQ9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,MAAkB,EAClB,OAA4B;IAE5B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAErD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IAEhD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAE1D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;IAEpC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;QACjD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,gBAAgB,EAAE,KAAK;QACvB,MAAM,EAAE,OAAO,EAAE,MAAM;QACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;KAC5B,CAAC,CAAA;IAEF,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAA;AACpC,CAAC"}
+{"version":3,"file":"validateJwt.js","sourceRoot":"","sources":["../../src/helpers/validateJwt.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAA;AAQ9B,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,MAAkB,EAClB,OAA4B;IAE5B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAErD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IAEhD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAE1D,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;IAEpC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;QAC3C,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,gBAAgB,EAAE,KAAK;QACvB,MAAM,EAAE,OAAO,EAAE,MAAM;QACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;KAC5B,CAAC,CAAA;IAEF,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAA;AACpC,CAAC"}

package/dist/jwks-callback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwks-callback.d.ts","sourceRoot":"","sources":["../src/jwks-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EAClC,MAAM,qBAAqB,CAAA;AAyG5B,wBAA8B,YAAY,CACxC,IAAI,EAAE,4BAA4B,GAAG,6BAA6B,EAClE,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,GACvC,OAAO,CAAC,OAAO,CAAC,CAIlB"}
+{"version":3,"file":"jwks-callback.d.ts","sourceRoot":"","sources":["../src/jwks-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,EAClC,KAAK,4BAA4B,EAClC,MAAM,qBAAqB,CAAA;AA+G5B,wBAA8B,YAAY,CACxC,IAAI,EAAE,4BAA4B,GAAG,6BAA6B,EAClE,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,GACvC,OAAO,CAAC,OAAO,CAAC,CAIlB"}

package/dist/jwks-callback.js

@@ -1,14 +1,18 @@
 import { AsyncActivityCallback, } from '@t4h.framework/core';
 import jwks from './jwks-authorize.js';
+function toEpochMilliseconds(timestamp) {
+    if (!/^\d+$/.test(timestamp))
+        return Date.parse(timestamp);
+    const isAlreadyInMilliseconds = timestamp.length >= 13;
+    if (isAlreadyInMilliseconds)
+        return Number(timestamp);
+    return Number(timestamp) * 1000;
+}
 function isWithinTolerance(timestamp, toleranceInSeconds) {
     const value = timestamp.trim();
     if (!value)
         return false;
-    const signedAt = /^\d+$/.test(value)
-        ? value.length >= 13
-            ? Number(value)
-            : Number(value) * 1000
-        : Date.parse(value);
+    const signedAt = toEpochMilliseconds(value);
     if (Number.isNaN(signedAt))
         return false;
     return Math.abs(Date.now() - signedAt) / 1000 <= toleranceInSeconds;

package/dist/jwks-callback.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwks-callback.js","sourceRoot":"","sources":["../src/jwks-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,IAAI,MAAM,qBAAqB,CAAA;AAEtC,SAAS,iBAAiB,CAAC,SAAiB,EAAE,kBAA0B;IACtE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAE9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE;YAClB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI;QACxB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAErB,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAExC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAA;AACrE,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAsC,EACtC,KAAyB,EACzB,MAA0B;IAE1B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,OAAO,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAkC,EAClC,QAAwC;IAExC,MAAM,KAAK,GAAG,qBAAqB,CAAC,cAAc,CAChD,QAAQ,CAAC,OAAO,EAChB,IAAI,CAAC,MAAM,CACZ,CAAA;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAAmC,EACnC,QAAwC;IAExC,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAA;IAE5B,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEvE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe;QACpC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC;QAChE,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAEpD,IACE,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,CAAC,iBAAiB,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,kBAAkB,CAAC;QAE5D,OAAO,KAAK,CAAA;IAEd,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC;SAChD,UAAU,CAAC,aAAa,EAAE,SAAS,IAAI,EAAE,CAAC;SAC1C,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAEzC,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,SAAS;YACT,UAAU;YACV,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC;YACzD,SAAS,EAAE,iBAAiB,CAC1B,OAAO,EACP,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,eAAe,CACrB;YACD,eAAe,EACb,iBAAiB,CACf,OAAO,EACP,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,qBAAqB,CAC3B,IAAI,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CACxC,IAAkE,EAClE,QAAwC;IAExC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAExE,OAAO,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAClC,CAAC"}
+{"version":3,"file":"jwks-callback.js","sourceRoot":"","sources":["../src/jwks-callback.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,IAAI,MAAM,qBAAqB,CAAA;AAEtC,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAE1D,MAAM,uBAAuB,GAAG,SAAS,CAAC,MAAM,IAAI,EAAE,CAAA;IAEtD,IAAI,uBAAuB;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAA;IAErD,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB,EAAE,kBAA0B;IACtE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAE9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAE3C,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAExC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAA;AACrE,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAsC,EACtC,KAAyB,EACzB,MAA0B;IAE1B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAErC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAE7B,OAAO,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AACzD,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAkC,EAClC,QAAwC;IAExC,MAAM,KAAK,GAAG,qBAAqB,CAAC,cAAc,CAChD,QAAQ,CAAC,OAAO,EAChB,IAAI,CAAC,MAAM,CACZ,CAAA;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,IAAmC,EACnC,QAAwC;IAExC,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAA;IAE5B,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAEvE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe;QACpC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC;QAChE,CAAC,CAAC,SAAS,CAAA;IAEb,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAEpD,IACE,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,CAAC,iBAAiB,CAAC,SAAS,IAAI,EAAE,EAAE,IAAI,CAAC,kBAAkB,CAAC;QAE5D,OAAO,KAAK,CAAA;IAEd,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC;SAChD,UAAU,CAAC,aAAa,EAAE,SAAS,IAAI,EAAE,CAAC;SAC1C,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;IAEzC,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC;YAChB,GAAG,EAAE,IAAI,CAAC,OAAO;YACjB,SAAS;YACT,UAAU;YACV,GAAG,EAAE,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC;YACzD,SAAS,EAAE,iBAAiB,CAC1B,OAAO,EACP,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,eAAe,CACrB;YACD,eAAe,EACb,iBAAiB,CACf,OAAO,EACP,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,qBAAqB,CAC3B,IAAI,KAAK;SACb,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,YAAY,CACxC,IAAkE,EAClE,QAAwC;IAExC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAExE,OAAO,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;AAClC,CAAC"}

package/dist/models/JWKSAuthorization.d.ts

@@ -8,7 +8,7 @@ export type JWKSAuthorizationContext = {
     audience?: string;
     kid?: string;
     algorithm?: string;
-    signatureFormat?: BinaryToTextEncoding | string;
+    signatureFormat?: BinaryToTextEncoding | (string & {});
 };
 export type JWKSAuthorizationManifest = AuthorizationManifest<JWKSAuthorizationContext>;
 export declare class JWKSAuthorization extends Authorization<JWKSAuthorizationContext> {

package/dist/models/JWKSAuthorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JWKSAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/JWKSAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAAA;CAChD,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAe/C"}
+{"version":3,"file":"JWKSAuthorization.d.ts","sourceRoot":"","sources":["../../src/models/JWKSAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE/E,MAAM,MAAM,wBAAwB,GAAG;IACrC,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;CACvD,CAAA;AAED,MAAM,MAAM,yBAAyB,GACnC,qBAAqB,CAAC,wBAAwB,CAAC,CAAA;AAEjD,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,wBAAwB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,wBAAwB;IAIvD,UAAU,IAAI,yBAAyB;CAe/C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h.framework/jwks",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "JWKS module for the T4H Framework authorization",
   "homepage": "https://github.com/tech4humans-brasil/framework/tree/main/packages/jwks",
   "bugs": "https://github.com/tech4humans-brasil/framework/issues",
@@ -36,12 +36,14 @@
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
     "check-types": "tsc --noEmit",
+    "check-package": "publint --strict && attw --pack . --profile esm-only",
+    "lint": "eslint . --max-warnings 0",
     "prepublishOnly": "yarn build",
     "test": "vitest run",
     "test:watch": "vitest"
   },
   "devDependencies": {
-    "@t4h.framework/core": "^0.18.0",
+    "@t4h.framework/core": "^0.20.0",
     "@types/jsonwebtoken": "^9",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"