@zintrust/core 0.4.17 → 0.4.19

package/src/security/Encryptor.js

@@ -0,0 +1,199 @@
+/**
+ * Encryptor
+ * Password hashing with dual support: PBKDF2 (default) and optional bcrypt
+ */
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import * as crypto from '../node-singletons/crypto.js';
+import { promisify } from '../node-singletons/util.js';
+function isBcryptModule(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const record = value;
+    return typeof record['hash'] === 'function' && typeof record['compare'] === 'function';
+}
+let algorithm = 'pbkdf2';
+let bcrypt;
+let loadingPromise;
+async function loadBcrypt() {
+    try {
+        const imported = await import('bcrypt');
+        const module = imported;
+        const candidate = module.default ?? module;
+        if (!isBcryptModule(candidate)) {
+            throw ErrorFactory.createConfigError('Invalid bcrypt module shape');
+        }
+        bcrypt = candidate;
+        algorithm = 'bcrypt';
+    }
+    catch (error) {
+        Logger.error('bcrypt not installed, falling back to PBKDF2', error);
+        ErrorFactory.createSecurityError('bcrypt not installed, falling back to PBKDF2', error);
+        // bcrypt not installed, will use PBKDF2
+        algorithm = 'pbkdf2';
+    }
+}
+async function ensureLoaded() {
+    if (bcrypt !== undefined)
+        return;
+    if (loadingPromise !== undefined)
+        return loadingPromise;
+    loadingPromise = loadBcrypt();
+    return loadingPromise;
+}
+/**
+ * Timing-safe string comparison
+ */
+function timingSafeEquals(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= (a.codePointAt(i) ?? 0) ^ (b.codePointAt(i) ?? 0);
+    }
+    return result === 0;
+}
+/**
+ * Hash with PBKDF2 (default)
+ */
+async function hashPbkdf2(password) {
+    const iterations = 600000; // OWASP recommended for SHA-256
+    const salt = crypto.randomBytes(32).toString('hex');
+    const keyLength = 64;
+    const digest = 'sha256';
+    const pbkdf2Fn = (() => {
+        try {
+            const maybe = crypto.pbkdf2;
+            return typeof maybe === 'function' ? maybe : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    const pbkdf2SyncFn = (() => {
+        try {
+            const maybe = crypto.pbkdf2Sync;
+            return typeof maybe === 'function' ? maybe : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    let hashHex = '';
+    if (pbkdf2Fn) {
+        const pbkdf2Async = promisify(pbkdf2Fn);
+        hashHex = (await pbkdf2Async(password, salt, iterations, keyLength, digest)).toString('hex');
+    }
+    else if (pbkdf2SyncFn) {
+        hashHex = pbkdf2SyncFn(password, salt, iterations, keyLength, digest).toString('hex');
+    }
+    else {
+        throw ErrorFactory.createSecurityError('PBKDF2 is not available in this runtime');
+    }
+    // Format: algorithm$iterations$salt$hash
+    return `pbkdf2$${iterations}$${salt}$${hashHex}`;
+}
+/**
+ * Verify PBKDF2 hash
+ */
+async function verifyPbkdf2(password, passwordHash) {
+    const parts = passwordHash.split('$');
+    const iterationsStr = parts[1];
+    const salt = parts[2];
+    const storedHash = parts[3];
+    if (iterationsStr === undefined || salt === undefined || storedHash === undefined) {
+        return false;
+    }
+    try {
+        const iterations = Number.parseInt(iterationsStr, 10);
+        const keyLength = 64;
+        const digest = 'sha256';
+        const pbkdf2Fn = (() => {
+            try {
+                const maybe = crypto.pbkdf2;
+                return typeof maybe === 'function' ? maybe : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        const pbkdf2SyncFn = (() => {
+            try {
+                const maybe = crypto.pbkdf2Sync;
+                return typeof maybe === 'function' ? maybe : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        })();
+        let computed = '';
+        if (pbkdf2Fn) {
+            const pbkdf2Async = promisify(pbkdf2Fn);
+            computed = (await pbkdf2Async(password, salt, iterations, keyLength, digest)).toString('hex');
+        }
+        else if (pbkdf2SyncFn) {
+            computed = pbkdf2SyncFn(password, salt, iterations, keyLength, digest).toString('hex');
+        }
+        else {
+            throw ErrorFactory.createSecurityError('PBKDF2 is not available in this runtime');
+        }
+        return timingSafeEquals(computed, storedHash);
+    }
+    catch (error) {
+        Logger.error('PBKDF2 verification failed', error);
+        ErrorFactory.createSecurityError('PBKDF2 verification failed', error);
+        return false;
+    }
+}
+/**
+ * Hash with bcrypt
+ */
+async function hashBcrypt(bcryptModule, password) {
+    const rounds = 12;
+    return bcryptModule.hash(password, rounds);
+}
+/**
+ * Verify bcrypt hash
+ */
+async function verifyBcrypt(bcryptModule, password, passwordHash) {
+    return bcryptModule.compare(password, passwordHash);
+}
+/**
+ * Encryptor handles password hashing and verification
+ * Refactored to Functional Object pattern
+ */
+const hash = async (password) => {
+    await ensureLoaded();
+    if (algorithm === 'bcrypt' && bcrypt !== undefined) {
+        return hashBcrypt(bcrypt, password);
+    }
+    return hashPbkdf2(password);
+};
+/**
+ * Verify password against hash
+ */
+const verify = async (password, passwordHash) => {
+    await ensureLoaded();
+    // Detect hash format
+    if (passwordHash.startsWith('$2')) {
+        // bcrypt hash format
+        if (bcrypt !== undefined) {
+            return verifyBcrypt(bcrypt, password, passwordHash);
+        }
+        throw ErrorFactory.createConfigError('bcrypt not available to verify hash');
+    }
+    // PBKDF2 hash format (algorithm$iterations$salt$hash)
+    return verifyPbkdf2(password, passwordHash);
+};
+/**
+ * Get current algorithm
+ */
+const getAlgorithm = () => {
+    return algorithm;
+};
+export const Encryptor = Object.freeze({
+    hash,
+    verify,
+    getAlgorithm,
+});

package/src/security/Hash.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Hash
+ * bcrypt-based password hashing utility.
+ *
+ * Uses bcryptjs to avoid native module issues in edge runtimes.
+ */
+export declare const Hash: Readonly<{
+    isValidHash(hash: string): boolean;
+    hash(plaintext: string): Promise<string>;
+    hashWithRounds(plaintext: string, rounds: number): Promise<string>;
+    verify(plaintext: string, hashed: string): Promise<boolean>;
+}>;
+export default Hash;
+//# sourceMappingURL=Hash.d.ts.map

package/src/security/Hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Hash.d.ts","sourceRoot":"","sources":["../../../src/security/Hash.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA+BH,eAAO,MAAM,IAAI;sBACG,MAAM,GAAG,OAAO;oBAIZ,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;8BAcd,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;sBAmBhD,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;EAWjE,CAAC;AAEH,eAAe,IAAI,CAAC"}

package/src/security/Hash.js

@@ -0,0 +1,76 @@
+/**
+ * Hash
+ * bcrypt-based password hashing utility.
+ *
+ * Uses bcryptjs to avoid native module issues in edge runtimes.
+ */
+import { Logger } from '../config/logger.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+const BCRYPT_HASH_RE = /^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/;
+let bcryptModule = null;
+const loadBcrypt = async () => {
+    if (bcryptModule !== null)
+        return bcryptModule;
+    try {
+        const mod = (await import('bcryptjs'));
+        const resolved = (mod.default ?? mod);
+        if (typeof resolved?.hash !== 'function' || typeof resolved?.compare !== 'function') {
+            throw ErrorFactory.createConfigError('Invalid bcryptjs module shape');
+        }
+        bcryptModule = resolved;
+        return resolved;
+    }
+    catch (error) {
+        throw ErrorFactory.createConfigError('bcryptjs module unavailable', error);
+    }
+};
+export const Hash = Object.freeze({
+    isValidHash(hash) {
+        return BCRYPT_HASH_RE.test(hash);
+    },
+    async hash(plaintext) {
+        try {
+            const bcrypt = await loadBcrypt();
+            return await bcrypt.hash(plaintext, 12);
+        }
+        catch (error) {
+            Logger.error('Password hashing failed', error);
+            const err = error;
+            if (err?.name === 'ConfigError' || err?.code === 'CONFIG_ERROR') {
+                throw ErrorFactory.createConfigError('Password hashing failed', error);
+            }
+            throw ErrorFactory.createSecurityError('Password hashing failed', error);
+        }
+    },
+    async hashWithRounds(plaintext, rounds) {
+        const normalizedRounds = Number.isFinite(rounds) ? Math.trunc(rounds) : 0;
+        if (normalizedRounds <= 0) {
+            throw ErrorFactory.createConfigError('Invalid bcrypt rounds', { rounds });
+        }
+        try {
+            const bcrypt = await loadBcrypt();
+            return await bcrypt.hash(plaintext, normalizedRounds);
+        }
+        catch (error) {
+            Logger.error('Password hashing failed', error);
+            const err = error;
+            if (err?.name === 'ConfigError' || err?.code === 'CONFIG_ERROR') {
+                throw ErrorFactory.createConfigError('Password hashing failed', error);
+            }
+            throw ErrorFactory.createSecurityError('Password hashing failed', error);
+        }
+    },
+    async verify(plaintext, hashed) {
+        if (!Hash.isValidHash(hashed))
+            return false;
+        try {
+            const bcrypt = await loadBcrypt();
+            return await bcrypt.compare(plaintext, hashed);
+        }
+        catch (error) {
+            Logger.error('Password verify failed', error);
+            return false;
+        }
+    },
+});
+export default Hash;

package/src/security/JwtManager.d.ts

@@ -0,0 +1,45 @@
+/**
+ * JWT Manager
+ * JSON Web Token generation, verification, and claims management
+ * Uses native Node.js crypto module (zero external dependencies)
+ */
+import type { AuthorizationHeader } from './JwtSessions';
+export type JwtAlgorithm = 'HS256' | 'HS512' | 'RS256';
+export interface JwtPayload {
+    sub?: string;
+    iss?: string;
+    aud?: string;
+    exp?: number;
+    iat?: number;
+    nbf?: number;
+    jti?: string;
+    [key: string]: unknown;
+}
+export interface JwtOptions {
+    algorithm?: JwtAlgorithm;
+    expiresIn?: number;
+    issuer?: string;
+    audience?: string;
+    subject?: string;
+    jwtId?: string;
+}
+export interface IJwtManager {
+    setHmacSecret(secret: string): void;
+    setRsaKeys(privateKey: string, publicKey: string): void;
+    sign(payload: JwtPayload, options?: JwtOptions): string;
+    verify(token: string, algorithm?: JwtAlgorithm): JwtPayload;
+    decode(token: string): JwtPayload;
+    signRsa(message: string): string;
+    generateJwtId(): string;
+}
+export interface JwtManagerType {
+    create(): IJwtManager;
+    signAccessToken: (payload: JwtPayload, expiresIn?: number) => Promise<string>;
+    logout: (authHeader: AuthorizationHeader) => Promise<void>;
+    logoutAll: (sub: string) => Promise<void>;
+}
+/**
+ * JwtManager namespace - sealed for immutability
+ */
+export declare const JwtManager: JwtManagerType;
+//# sourceMappingURL=JwtManager.d.ts.map

package/src/security/JwtManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtManager.d.ts","sourceRoot":"","sources":["../../../src/security/JwtManager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACxD,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;IAClC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,aAAa,IAAI,MAAM,CAAC;CACzB;AAQD,MAAM,WAAW,cAAc;IAC7B,MAAM,IAAI,WAAW,CAAC;IACtB,eAAe,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,MAAM,EAAE,CAAC,UAAU,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAyFD;;GAEG;AACH,eAAO,MAAM,UAAU,EAAE,cAKvB,CAAC"}

package/src/security/JwtManager.js

@@ -0,0 +1,276 @@
+/**
+ * JWT Manager
+ * JSON Web Token generation, verification, and claims management
+ * Uses native Node.js crypto module (zero external dependencies)
+ */
+import { securityConfig } from '../config/security.js';
+import { ErrorFactory } from '../exceptions/ZintrustError.js';
+import { createHmac, createSign, createVerify, randomBytes } from '../node-singletons/crypto.js';
+import { JwtSessions } from './JwtSessions.js';
+const createJwt = () => {
+    const algorithm = securityConfig.jwt.algorithm;
+    const secret = securityConfig.jwt.secret;
+    const jwt = JwtManager.create();
+    if (algorithm === 'HS256' || algorithm === 'HS512') {
+        jwt.setHmacSecret(secret);
+    }
+    return jwt;
+};
+const logout = async (authHeader) => {
+    await JwtSessions.logout(authHeader);
+};
+const logoutAll = async (sub) => {
+    await JwtSessions.logoutAll(sub);
+};
+const signAccessToken = async (payload, expiresIn) => {
+    const algorithm = securityConfig.jwt.algorithm;
+    const jwt = createJwt();
+    let token;
+    // JwtManager currently supports HMAC secrets directly for HS algorithms.
+    // For other algorithms, verify will still reject mismatched tokens.
+    if (algorithm !== 'HS256' && algorithm !== 'HS512') {
+        token = jwt.sign(payload, {
+            algorithm,
+            issuer: securityConfig.jwt.issuer,
+            audience: securityConfig.jwt.audience,
+            jwtId: jwt.generateJwtId(),
+        });
+    }
+    else {
+        token = jwt.sign(payload, {
+            algorithm,
+            expiresIn: expiresIn ?? securityConfig.jwt.expiresIn,
+            issuer: securityConfig.jwt.issuer,
+            audience: securityConfig.jwt.audience,
+            subject: typeof payload.sub === 'string' ? payload.sub : undefined,
+            jwtId: jwt.generateJwtId(),
+        });
+    }
+    await JwtSessions.register(token);
+    return token;
+};
+/**
+ * Create a new JWT manager instance
+ */
+const create = () => {
+    const state = {
+        hmacSecret: null,
+        rsaPrivateKey: null,
+        rsaPublicKey: null,
+    };
+    return {
+        setHmacSecret(secret) {
+            state.hmacSecret = secret;
+        },
+        setRsaKeys(privateKey, publicKey) {
+            state.rsaPrivateKey = privateKey;
+            state.rsaPublicKey = publicKey;
+        },
+        sign(payload, options = {}) {
+            return signToken(state, payload, options);
+        },
+        verify(token, algorithm = 'HS256') {
+            return verifyToken(state, token, algorithm);
+        },
+        decode(token) {
+            return decodeToken(token);
+        },
+        signRsa(message) {
+            return signRsa(message, state.rsaPrivateKey);
+        },
+        generateJwtId() {
+            return randomBytes(16).toString('hex');
+        },
+    };
+};
+/**
+ * JwtManager namespace - sealed for immutability
+ */
+export const JwtManager = Object.freeze({
+    create,
+    signAccessToken,
+    logout,
+    logoutAll,
+});
+/**
+ * Sign JWT token
+ */
+function signToken(state, payload, options) {
+    const algorithm = options.algorithm ?? 'HS256';
+    const now = Math.floor(Date.now() / 1000);
+    const claims = buildClaims(payload, options, now);
+    const header = { alg: algorithm, typ: 'JWT' };
+    const encodedHeader = base64Encode(JSON.stringify(header));
+    const encodedPayload = base64Encode(JSON.stringify(claims));
+    const message = `${encodedHeader}.${encodedPayload}`;
+    const signature = generateSignature(message, algorithm, state.hmacSecret, state.rsaPrivateKey);
+    return `${message}.${signature}`;
+}
+/**
+ * Verify JWT token
+ */
+function verifyToken(state, token, algorithm) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw ErrorFactory.createSecurityError('Invalid token format');
+    }
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    try {
+        const header = JSON.parse(base64Decode(encodedHeader));
+        if (header['alg'] !== algorithm) {
+            throw ErrorFactory.createSecurityError(`Algorithm mismatch: expected ${algorithm}, got ${header['alg']}`);
+        }
+        const message = `${encodedHeader}.${encodedPayload}`;
+        const isValid = verifySignature(message, encodedSignature, algorithm, state.hmacSecret, state.rsaPublicKey);
+        if (!isValid) {
+            throw ErrorFactory.createSecurityError('Invalid signature');
+        }
+        const payload = JSON.parse(base64Decode(encodedPayload));
+        verifyClaims(payload);
+        return payload;
+    }
+    catch (error) {
+        throw ErrorFactory.createSecurityError(`Token verification failed: ${error.message}`);
+    }
+}
+/**
+ * Decode JWT token without verification
+ */
+function decodeToken(token) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        throw ErrorFactory.createSecurityError('Invalid token format');
+    }
+    try {
+        const payload = JSON.parse(base64Decode(parts[1]));
+        return payload;
+    }
+    catch (error) {
+        throw ErrorFactory.createSecurityError(`Invalid token payload: ${error.message}`);
+    }
+}
+/**
+ * Base64 URL encoding
+ */
+function base64Encode(data) {
+    const buffer = typeof data === 'string' ? Buffer.from(data, 'utf8') : data;
+    return buffer.toString('base64').replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
+}
+/**
+ * Base64 URL decoding to Buffer
+ */
+function base64DecodeBuffer(data) {
+    const padded = data + '==='.slice((data.length + 3) % 4);
+    const base64 = padded.replaceAll('-', '+').replaceAll('_', '/');
+    return Buffer.from(base64, 'base64');
+}
+/**
+ * Base64 URL decoding to string
+ */
+function base64Decode(data) {
+    return base64DecodeBuffer(data).toString('utf8');
+}
+/**
+ * Timing safe string comparison
+ */
+function timingSafeEquals(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= (a.codePointAt(i) ?? 0) ^ (b.codePointAt(i) ?? 0);
+    }
+    return result === 0;
+}
+/**
+ * Sign message using HMAC
+ */
+function signHmac(message, algorithm, secret) {
+    if (secret === null) {
+        throw ErrorFactory.createSecurityError('HMAC secret not configured');
+    }
+    const digestAlgorithm = algorithm === 'HS256' ? 'sha256' : 'sha512';
+    const signature = createHmac(digestAlgorithm, secret).update(message).digest();
+    return base64Encode(signature);
+}
+/**
+ * Sign message using RSA
+ */
+function signRsa(message, privateKey) {
+    if (privateKey === null) {
+        throw ErrorFactory.createSecurityError('RSA private key not configured');
+    }
+    const sign = createSign('RSA-SHA256');
+    sign.update(message);
+    const signature = sign.sign(privateKey);
+    return base64Encode(signature);
+}
+/**
+ * Generate signature based on algorithm
+ */
+function generateSignature(message, algorithm, hmacSecret, rsaPrivateKey) {
+    if (algorithm.startsWith('HS')) {
+        return signHmac(message, algorithm, hmacSecret);
+    }
+    if (algorithm === 'RS256') {
+        return signRsa(message, rsaPrivateKey);
+    }
+    throw ErrorFactory.createSecurityError(`Unsupported algorithm: ${algorithm}`);
+}
+/**
+ * Verify signature based on algorithm
+ */
+function verifySignature(message, encodedSignature, algorithm, hmacSecret, rsaPublicKey) {
+    if (algorithm.startsWith('HS')) {
+        const expectedSignature = signHmac(message, algorithm, hmacSecret);
+        return timingSafeEquals(encodedSignature, expectedSignature);
+    }
+    else if (algorithm === 'RS256') {
+        if (rsaPublicKey === null) {
+            throw ErrorFactory.createSecurityError('RSA public key not configured');
+        }
+        const verify = createVerify('RSA-SHA256'); // NOSONAR LCHECK
+        verify.update(message);
+        const signature = base64DecodeBuffer(encodedSignature);
+        return verify.verify(rsaPublicKey, signature);
+    }
+    return false;
+}
+/**
+ * Build JWT claims
+ */
+function buildClaims(payload, options, now) {
+    const claims = {
+        ...payload,
+        iat: now,
+    };
+    if (options.expiresIn !== undefined && options.expiresIn !== null) {
+        claims.exp = now + options.expiresIn;
+    }
+    if (options.issuer !== undefined && options.issuer !== null) {
+        claims.iss = options.issuer;
+    }
+    if (options.audience !== undefined && options.audience !== null) {
+        claims.aud = options.audience;
+    }
+    if (options.subject !== undefined && options.subject !== null) {
+        claims.sub = options.subject;
+    }
+    if (options.jwtId !== undefined && options.jwtId !== null) {
+        claims.jti = options.jwtId;
+    }
+    return claims;
+}
+/**
+ * Verify JWT claims (expiration, not before)
+ */
+function verifyClaims(payload) {
+    const now = Math.floor(Date.now() / 1000);
+    if (payload.exp !== undefined && payload.exp !== null && payload.exp <= now) {
+        throw ErrorFactory.createSecurityError('Token expired');
+    }
+    if (payload.nbf !== undefined && payload.nbf !== null && payload.nbf > now) {
+        throw ErrorFactory.createSecurityError('Token not yet valid');
+    }
+}

package/src/security/JwtSessions.d.ts

@@ -0,0 +1,12 @@
+export type JwtSessionsDriverName = 'database' | 'memory' | 'redis' | 'kv' | 'kv-remote';
+export type AuthorizationHeader = string | string[] | undefined;
+export declare const JwtSessions: Readonly<{
+    register(token: string): Promise<void>;
+    isActive(token: string): Promise<boolean>;
+    logout(header: AuthorizationHeader): Promise<string | null>;
+    logoutAll(sub: string): Promise<void>;
+    getDriver(): JwtSessionsDriverName;
+    _resetForTests(): void;
+}>;
+export default JwtSessions;
+//# sourceMappingURL=JwtSessions.d.ts.map

package/src/security/JwtSessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtSessions.d.ts","sourceRoot":"","sources":["../../../src/security/JwtSessions.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,WAAW,CAAC;AAEzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;AAqnBhE,eAAO,MAAM,WAAW;oBACA,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;oBAKtB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;mBAM1B,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;mBAU5C,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;iBAQ9B,qBAAqB;sBAIhB,IAAI;EAItB,CAAC;AAEH,eAAe,WAAW,CAAC"}