acrylblends 0.2.0 → 0.4.0

package/plugins/acryl-router/src/core/utils/ipaddr.test.ts

@@ -0,0 +1,149 @@
+import {
+  convertIPv4BinaryToString,
+  convertIPv4ToBinary,
+  convertIPv6BinaryToString,
+  convertIPv6ToBinary,
+  distinctRemoteAddr,
+  expandIPv6,
+  INVALID_IP_ADDRESS_ERROR_CODE,
+} from './ipaddr.ts'
+
+const expectInvalidIPAddressError = (fn: () => unknown) => {
+  try {
+    fn()
+  } catch (error) {
+    expect(error).toBeInstanceOf(TypeError)
+    expect(error).toHaveProperty('code', INVALID_IP_ADDRESS_ERROR_CODE)
+    return
+  }
+  throw new Error('Expected invalid IP address error')
+}
+
+describe('expandIPv6', () => {
+  it('Should result be valid', () => {
+    expect(expandIPv6('1::1')).toBe('0001:0000:0000:0000:0000:0000:0000:0001')
+    expect(expandIPv6('::1')).toBe('0000:0000:0000:0000:0000:0000:0000:0001')
+    expect(expandIPv6('2001:2::')).toBe('2001:0002:0000:0000:0000:0000:0000:0000')
+    expect(expandIPv6('2001:2::')).toBe('2001:0002:0000:0000:0000:0000:0000:0000')
+    expect(expandIPv6('2001:0:0:db8::1')).toBe('2001:0000:0000:0db8:0000:0000:0000:0001')
+    expect(expandIPv6('::ffff:127.0.0.1')).toBe('0000:0000:0000:0000:0000:ffff:7f00:0001')
+    expect(expandIPv6('::ffff:0.0.0.1')).toBe('0000:0000:0000:0000:0000:ffff:0000:0001')
+    expect(expandIPv6('2001:db8:1:2:3:4:0.0.0.1')).toBe('2001:0db8:0001:0002:0003:0004:0000:0001')
+    expect(expandIPv6('::0.0.0.0')).toBe('0000:0000:0000:0000:0000:0000:0000:0000')
+  })
+
+  it('Should expand the unspecified address "::" to eight zero groups', () => {
+    expect(expandIPv6('::')).toBe('0000:0000:0000:0000:0000:0000:0000:0000')
+  })
+})
+describe('distinctRemoteAddr', () => {
+  it('Should result be valid', () => {
+    expect(distinctRemoteAddr('1::1')).toBe('IPv6')
+    expect(distinctRemoteAddr('::1')).toBe('IPv6')
+    expect(distinctRemoteAddr('::ffff:127.0.0.1')).toBe('IPv6')
+
+    expect(distinctRemoteAddr('192.168.2.0')).toBe('IPv4')
+    expect(distinctRemoteAddr('192.168.2.0')).toBe('IPv4')
+
+    expect(distinctRemoteAddr('example.com')).toBeUndefined()
+  })
+
+  it('Should reject invalid IPv4 addresses with octets > 255', () => {
+    expect(distinctRemoteAddr('1.2.3.256')).toBeUndefined()
+    expect(distinctRemoteAddr('1.2.3.999')).toBeUndefined()
+    expect(distinctRemoteAddr('1.2.2.355')).toBeUndefined()
+    expect(distinctRemoteAddr('256.0.0.1')).toBeUndefined()
+    expect(distinctRemoteAddr('999.999.999.999')).toBeUndefined()
+  })
+
+  it('Should accept valid IPv4 edge cases', () => {
+    expect(distinctRemoteAddr('0.0.0.0')).toBe('IPv4')
+    expect(distinctRemoteAddr('255.255.255.255')).toBe('IPv4')
+    expect(distinctRemoteAddr('1.2.3.4')).toBe('IPv4')
+  })
+})
+
+describe('convertIPv4ToBinary', () => {
+  it('Should result is valid', () => {
+    expect(convertIPv4ToBinary('0.0.0.0')).toBe(0n)
+    expect(convertIPv4ToBinary('0.0.0.1')).toBe(1n)
+
+    expect(convertIPv4ToBinary('0.0.1.0')).toBe(1n << 8n)
+  })
+
+  test.each(['1.2.3.256', '1.2.3', '1.2.3.4.5', '1..3.4', '01.2.3.4', 'a.b.c.d'])(
+    'Should throw for invalid IPv4: %s',
+    (input) => {
+      expectInvalidIPAddressError(() => convertIPv4ToBinary(input))
+    }
+  )
+})
+
+describe('convertIPv4ToString', () => {
+  // add tons of test cases here
+  test.each`
+    input        | expected
+    ${'0.0.0.0'} | ${'0.0.0.0'}
+    ${'0.0.0.1'} | ${'0.0.0.1'}
+    ${'0.0.1.0'} | ${'0.0.1.0'}
+  `('convertIPv4ToString($input) === $expected', ({ input, expected }) => {
+    expect(convertIPv4BinaryToString(convertIPv4ToBinary(input))).toBe(expected)
+  })
+})
+
+describe('convertIPv6ToBinary', () => {
+  it('Should result is valid', () => {
+    expect(convertIPv6ToBinary('::0')).toBe(0n)
+    expect(convertIPv6ToBinary('::1')).toBe(1n)
+
+    expect(convertIPv6ToBinary('::f')).toBe(15n)
+    expect(convertIPv6ToBinary('1234::5678')).toBe(24196103360772296748952112894165669496n)
+    expect(convertIPv6ToBinary('::ffff:127.0.0.1')).toBe(281472812449793n)
+    expect(convertIPv6ToBinary('fe80::1%eth0')).toBe(convertIPv6ToBinary('fe80::1'))
+  })
+
+  test.each([
+    '1::2::3',
+    '1:2:3:4:5:6:7:8:9',
+    '1:2:3:4:5:6:7',
+    '12345::',
+    'gggg::',
+    '::ffff:127.0.0.256',
+    '1234:::5678',
+    '2001:db8::1%eth0',
+    '::ffff:127.0.0.1%eth0',
+    '1:2:3%eth0',
+    'gggg%eth0',
+    'fe80::1%',
+  ])('Should throw for invalid IPv6: %s', (input) => {
+    expectInvalidIPAddressError(() => convertIPv6ToBinary(input))
+  })
+})
+
+describe('convertIPv6ToString', () => {
+  // add tons of test cases here
+  test.each`
+    input                                        | expected
+    ${'::1'}                                     | ${'::1'}
+    ${'1::'}                                     | ${'1::'}
+    ${'1234::5678'}                              | ${'1234::5678'}
+    ${'2001:2::'}                                | ${'2001:2::'}
+    ${'2001::db8:0:0:0:0:1'}                     | ${'2001:0:db8::1'}
+    ${'1234:5678:9abc:def0:1234:5678:9abc:def0'} | ${'1234:5678:9abc:def0:1234:5678:9abc:def0'}
+    ${'::ffff:127.0.0.1'}                        | ${'::ffff:127.0.0.1'}
+    ${'fe80::1%eth0'}                            | ${'fe80::1'}
+    ${'1:0:2:3:4:5:6:7'}                         | ${'1:0:2:3:4:5:6:7'}
+    ${'0:1:2:3:4:5:6:7'}                         | ${'0:1:2:3:4:5:6:7'}
+    ${'1:2:3:4:5:6:7:0'}                         | ${'1:2:3:4:5:6:7:0'}
+    ${'1:0:0:2:3:4:5:6'}                         | ${'1::2:3:4:5:6'}
+  `('convertIPv6ToString($input) === $expected', ({ input, expected }) => {
+    expect(convertIPv6BinaryToString(convertIPv6ToBinary(input))).toBe(expected)
+  })
+
+  it('Should compress the unspecified address (all zero groups) to "::"', () => {
+    expect(convertIPv6BinaryToString(0n)).toBe('::')
+    expect(convertIPv6BinaryToString(convertIPv6ToBinary('::'))).toBe('::')
+    // The output must round-trip back to the same binary value.
+    expect(convertIPv6ToBinary(convertIPv6BinaryToString(0n))).toBe(0n)
+  })
+})

package/plugins/acryl-router/src/core/utils/ipaddr.ts

@@ -0,0 +1,374 @@
+/**
+ * Utils for IP Addresses
+ * @module
+ */
+
+import type { AddressType } from '../helper/conninfo/index.ts'
+
+/**
+ * Expand IPv6 Address
+ * @param ipV6 Shorten IPv6 Address
+ * @return expanded IPv6 Address
+ */
+export const expandIPv6 = (ipV6: string): string => {
+  const sections = ipV6.split(':')
+  const lastSection = sections.at(-1) as string
+  if (IPV4_REGEX.test(lastSection)) {
+    const octets = lastSection.split('.').map(Number)
+    sections.splice(
+      -1,
+      1,
+      ((octets[0] << 8) | octets[1]).toString(16),
+      ((octets[2] << 8) | octets[3]).toString(16)
+    )
+  }
+  for (let i = 0; i < sections.length; i++) {
+    const node = sections[i]
+    if (node !== '') {
+      sections[i] = node.padStart(4, '0')
+    } else {
+      // Keep a single empty slot for `::` zero expansion.
+      while (sections[i + 1] === '') {
+        sections.splice(i + 1, 1)
+      }
+      sections[i] = new Array(8 - sections.length + 1).fill('0000').join(':')
+    }
+  }
+  return sections.join(':')
+}
+
+const IPV4_OCTET_PART = '(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])'
+const IPV4_REGEX = new RegExp(`^(?:${IPV4_OCTET_PART}\\.){3}${IPV4_OCTET_PART}$`)
+export const INVALID_IP_ADDRESS_ERROR_CODE = 'ERR_INVALID_IP_ADDRESS'
+export type InvalidIPAddressError = TypeError & {
+  code: typeof INVALID_IP_ADDRESS_ERROR_CODE
+}
+const CHAR_CODE_0 = 48
+const CHAR_CODE_9 = 57
+const CHAR_CODE_A = 65
+const CHAR_CODE_F = 70
+const CHAR_CODE_a = 97
+const CHAR_CODE_f = 102
+const CHAR_CODE_DOT = 46
+const CHAR_CODE_COLON = 58
+const CHAR_CODE_PERCENT = 37
+
+/**
+ * Distinct Remote Addr
+ * @param remoteAddr Remote Addr
+ */
+export const distinctRemoteAddr = (remoteAddr: string): AddressType => {
+  if (IPV4_REGEX.test(remoteAddr)) {
+    return 'IPv4'
+  }
+  if (remoteAddr.includes(':')) {
+    // Domain can't include `:`
+    return 'IPv6'
+  }
+}
+
+const createInvalidIPAddressError = (message: string): InvalidIPAddressError => {
+  const error = new TypeError(message) as InvalidIPAddressError
+  error.code = INVALID_IP_ADDRESS_ERROR_CODE
+  return error
+}
+
+const throwInvalidIPv4Address = (ipv4: string): never => {
+  throw createInvalidIPAddressError(`Invalid IPv4 address: ${ipv4}`)
+}
+
+const throwInvalidIPv6Address = (ipv6: string): never => {
+  throw createInvalidIPAddressError(`Invalid IPv6 address: ${ipv6}`)
+}
+
+const parseIPv4ToBinary = (
+  ipv4: string,
+  start: number,
+  end: number,
+  onInvalid: () => never
+): bigint => {
+  let result = 0n
+  let octets = 0
+  let octet = 0
+  let digits = 0
+  let firstDigit = 0
+
+  for (let i = start; i <= end; i++) {
+    const code = i < end ? ipv4.charCodeAt(i) : CHAR_CODE_DOT
+    if (code >= CHAR_CODE_0 && code <= CHAR_CODE_9) {
+      if (digits === 0) {
+        firstDigit = code
+      } else if (firstDigit === CHAR_CODE_0) {
+        onInvalid()
+      }
+      octet = octet * 10 + code - CHAR_CODE_0
+      if (octet > 255) {
+        onInvalid()
+      }
+      digits++
+      continue
+    }
+
+    if (code !== CHAR_CODE_DOT || digits === 0 || octets === 4) {
+      onInvalid()
+    }
+
+    result = (result << 8n) + BigInt(octet)
+    octets++
+    octet = 0
+    digits = 0
+  }
+
+  if (octets !== 4) {
+    onInvalid()
+  }
+
+  return result
+}
+
+const parseIPv6HexCode = (code: number): number => {
+  if (code >= CHAR_CODE_0 && code <= CHAR_CODE_9) {
+    return code - CHAR_CODE_0
+  }
+  if (code >= CHAR_CODE_A && code <= CHAR_CODE_F) {
+    return code - CHAR_CODE_A + 10
+  }
+  if (code >= CHAR_CODE_a && code <= CHAR_CODE_f) {
+    return code - CHAR_CODE_a + 10
+  }
+  return -1
+}
+
+const isIPv6LinkLocal = (ipv6binary: bigint): boolean => ipv6binary >> 118n === 0x3fan
+
+/**
+ * Convert IPv4 to Uint8Array
+ * @param ipv4 IPv4 Address
+ * @returns BigInt
+ */
+export const convertIPv4ToBinary = (ipv4: string): bigint => {
+  return parseIPv4ToBinary(ipv4, 0, ipv4.length, () => throwInvalidIPv4Address(ipv4))
+}
+
+/**
+ * Convert IPv6 to Uint8Array
+ * @param ipv6 IPv6 Address
+ * @returns BigInt
+ */
+export const convertIPv6ToBinary = (ipv6: string): bigint => {
+  const length = ipv6.length
+  const sections: number[] = []
+  let hasZoneId = false
+  let compressAt = -1
+  let index = 0
+
+  if (length === 0) {
+    throwInvalidIPv6Address(ipv6)
+  }
+
+  while (index < length) {
+    if (sections.length > 8) {
+      throwInvalidIPv6Address(ipv6)
+    }
+
+    let code = ipv6.charCodeAt(index)
+
+    if (code === CHAR_CODE_PERCENT) {
+      if (index + 1 === length) {
+        throwInvalidIPv6Address(ipv6)
+      }
+      hasZoneId = true
+      break
+    }
+
+    if (code === CHAR_CODE_COLON) {
+      if (index + 1 < length && ipv6.charCodeAt(index + 1) === CHAR_CODE_COLON) {
+        if (compressAt !== -1) {
+          throwInvalidIPv6Address(ipv6)
+        }
+        compressAt = sections.length
+        index += 2
+        continue
+      }
+      throwInvalidIPv6Address(ipv6)
+    }
+
+    let value = 0
+    let digits = 0
+    const sectionStart = index
+
+    while (index < length) {
+      code = ipv6.charCodeAt(index)
+      const hex = parseIPv6HexCode(code)
+      if (hex === -1) {
+        break
+      }
+      if (digits === 4) {
+        throwInvalidIPv6Address(ipv6)
+      }
+      value = (value << 4) | hex
+      digits++
+      index++
+    }
+
+    if (index < length && ipv6.charCodeAt(index) === CHAR_CODE_DOT) {
+      let ipv4End = length
+      for (let i = index; i < length; i++) {
+        if (ipv6.charCodeAt(i) === CHAR_CODE_PERCENT) {
+          if (i + 1 === length) {
+            throwInvalidIPv6Address(ipv6)
+          }
+          hasZoneId = true
+          ipv4End = i
+          break
+        }
+      }
+      const ipv4 = parseIPv4ToBinary(ipv6, sectionStart, ipv4End, () =>
+        throwInvalidIPv6Address(ipv6)
+      )
+      sections.push(Number((ipv4 >> 16n) & 0xffffn), Number(ipv4 & 0xffffn))
+      index = length
+      break
+    }
+
+    if (digits === 0) {
+      throwInvalidIPv6Address(ipv6)
+    }
+
+    sections.push(value)
+
+    if (index === length) {
+      break
+    }
+
+    code = ipv6.charCodeAt(index)
+    if (code === CHAR_CODE_PERCENT) {
+      if (index + 1 === length) {
+        throwInvalidIPv6Address(ipv6)
+      }
+      hasZoneId = true
+      break
+    }
+
+    if (code !== CHAR_CODE_COLON) {
+      throwInvalidIPv6Address(ipv6)
+    }
+
+    if (index + 1 < length && ipv6.charCodeAt(index + 1) === CHAR_CODE_COLON) {
+      if (compressAt !== -1) {
+        throwInvalidIPv6Address(ipv6)
+      }
+      compressAt = sections.length
+      index += 2
+      continue
+    }
+
+    index++
+    if (index === length) {
+      throwInvalidIPv6Address(ipv6)
+    }
+  }
+
+  if (compressAt === -1 ? sections.length !== 8 : sections.length >= 8) {
+    throwInvalidIPv6Address(ipv6)
+  }
+
+  let result = 0n
+  const zeros = compressAt === -1 ? 0 : 8 - sections.length
+  const firstSectionEnd = compressAt === -1 ? sections.length : compressAt
+  for (let i = 0; i < firstSectionEnd; i++) {
+    result <<= 16n
+    result += BigInt(sections[i])
+  }
+  for (let i = 0; i < zeros; i++) {
+    result <<= 16n
+  }
+  for (let i = firstSectionEnd; i < sections.length; i++) {
+    result <<= 16n
+    result += BigInt(sections[i])
+  }
+  if (hasZoneId && !isIPv6LinkLocal(result)) {
+    throwInvalidIPv6Address(ipv6)
+  }
+  return result
+}
+
+/**
+ * Convert a binary representation of an IPv4 address to a string.
+ * @param ipV4 binary IPv4 Address
+ * @return IPv4 Address in string
+ */
+export const convertIPv4BinaryToString = (ipV4: bigint): string => {
+  const sections = []
+  for (let i = 0; i < 4; i++) {
+    sections.push((ipV4 >> BigInt(8 * (3 - i))) & 0xffn)
+  }
+  return sections.join('.')
+}
+
+/**
+ * Check if a binary IPv6 address is an IPv4-mapped IPv6 address (::ffff:x.x.x.x)
+ * @param ipv6binary binary IPv6 Address
+ * @return true if the address is an IPv4-mapped IPv6 address
+ */
+export const isIPv4MappedIPv6 = (ipv6binary: bigint): boolean => ipv6binary >> 32n === 0xffffn
+
+/**
+ * Extract the IPv4 portion from an IPv4-mapped IPv6 address
+ * @param ipv6binary binary IPv4-mapped IPv6 Address
+ * @return binary IPv4 Address
+ */
+export const convertIPv4MappedIPv6ToIPv4 = (ipv6binary: bigint): bigint => ipv6binary & 0xffffffffn
+
+/**
+ * Convert a binary representation of an IPv6 address to a string.
+ * @param ipV6 binary IPv6 Address
+ * @return normalized IPv6 Address in string
+ */
+export const convertIPv6BinaryToString = (ipV6: bigint): string => {
+  if (ipV6 === 0n) {
+    // The unspecified address compresses every group, which the generic
+    // logic below would render as a single ":". Handle it explicitly.
+    return '::'
+  }
+
+  if (isIPv4MappedIPv6(ipV6)) {
+    return `::ffff:${convertIPv4BinaryToString(convertIPv4MappedIPv6ToIPv4(ipV6))}`
+  }
+
+  const sections = []
+  for (let i = 0; i < 8; i++) {
+    sections.push(((ipV6 >> BigInt(16 * (7 - i))) & 0xffffn).toString(16))
+  }
+
+  let currentZeroStart = -1
+  let maxZeroStart = -1
+  let maxZeroEnd = -1
+  for (let i = 0; i < 8; i++) {
+    if (sections[i] === '0') {
+      if (currentZeroStart === -1) {
+        currentZeroStart = i
+      }
+    } else {
+      if (currentZeroStart > -1) {
+        if (i - currentZeroStart > maxZeroEnd - maxZeroStart) {
+          maxZeroStart = currentZeroStart
+          maxZeroEnd = i
+        }
+        currentZeroStart = -1
+      }
+    }
+  }
+  if (currentZeroStart > -1) {
+    if (8 - currentZeroStart > maxZeroEnd - maxZeroStart) {
+      maxZeroStart = currentZeroStart
+      maxZeroEnd = 8
+    }
+  }
+  // RFC 5952 4.2.2: compress only zero runs of at least two 16-bit fields.
+  if (maxZeroStart !== -1 && maxZeroEnd - maxZeroStart > 1) {
+    sections.splice(maxZeroStart, maxZeroEnd - maxZeroStart, ':')
+  }
+
+  return sections.join(':').replace(/:{2,}/g, '::')
+}

package/plugins/acryl-router/src/core/utils/jwt/index.ts

@@ -0,0 +1,7 @@
+/**
+ * @module
+ * JWT utility.
+ */
+
+import { decode, sign, verify, verifyWithJwks } from './jwt.ts'
+export const Jwt = { sign, verify, decode, verifyWithJwks }

package/plugins/acryl-router/src/core/utils/jwt/jwa.test.ts

@@ -0,0 +1,86 @@
+import { AlgorithmTypes } from './jwa.ts'
+import type { AsymmetricAlgorithm, SymmetricAlgorithm, SignatureAlgorithm } from './jwa.ts'
+
+describe('Types', () => {
+  it('AlgorithmTypes', () => {
+    expect('HS256' as AlgorithmTypes).toBe(AlgorithmTypes.HS256)
+    expect('HS384' as AlgorithmTypes).toBe(AlgorithmTypes.HS384)
+    expect('HS512' as AlgorithmTypes).toBe(AlgorithmTypes.HS512)
+    expect('RS256' as AlgorithmTypes).toBe(AlgorithmTypes.RS256)
+    expect('RS384' as AlgorithmTypes).toBe(AlgorithmTypes.RS384)
+    expect('RS512' as AlgorithmTypes).toBe(AlgorithmTypes.RS512)
+    expect('PS256' as AlgorithmTypes).toBe(AlgorithmTypes.PS256)
+    expect('PS384' as AlgorithmTypes).toBe(AlgorithmTypes.PS384)
+    expect('PS512' as AlgorithmTypes).toBe(AlgorithmTypes.PS512)
+    expect('ES256' as AlgorithmTypes).toBe(AlgorithmTypes.ES256)
+    expect('ES384' as AlgorithmTypes).toBe(AlgorithmTypes.ES384)
+    expect('ES512' as AlgorithmTypes).toBe(AlgorithmTypes.ES512)
+    expect('EdDSA' as AlgorithmTypes).toBe(AlgorithmTypes.EdDSA)
+
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    expect(undefined as AlgorithmTypes).toBe(undefined)
+    expect('' as AlgorithmTypes).toBe('')
+  })
+
+  it('SymmetricAlgorithm type should only include HMAC algorithms', () => {
+    // These should be valid SymmetricAlgorithm values
+    const hs256: SymmetricAlgorithm = 'HS256'
+    const hs384: SymmetricAlgorithm = 'HS384'
+    const hs512: SymmetricAlgorithm = 'HS512'
+
+    expect(hs256).toBe('HS256')
+    expect(hs384).toBe('HS384')
+    expect(hs512).toBe('HS512')
+
+    // Type-level test: these would cause compile errors if uncommented
+    // const rs256: SymmetricAlgorithm = 'RS256' // Error: Type '"RS256"' is not assignable to type 'SymmetricAlgorithm'
+  })
+
+  it('AsymmetricAlgorithm type should only include asymmetric algorithms', () => {
+    // These should be valid AsymmetricAlgorithm values
+    const asymmetricAlgs: AsymmetricAlgorithm[] = [
+      'RS256',
+      'RS384',
+      'RS512',
+      'PS256',
+      'PS384',
+      'PS512',
+      'ES256',
+      'ES384',
+      'ES512',
+      'EdDSA',
+    ]
+
+    expect(asymmetricAlgs).toHaveLength(10)
+
+    // Verify all asymmetric algorithms are included
+    expect(asymmetricAlgs).toContain('RS256')
+    expect(asymmetricAlgs).toContain('ES256')
+    expect(asymmetricAlgs).toContain('EdDSA')
+
+    // Type-level test: these would cause compile errors if uncommented
+    // const hs256: AsymmetricAlgorithm = 'HS256' // Error: Type '"HS256"' is not assignable to type 'AsymmetricAlgorithm'
+  })
+
+  it('SignatureAlgorithm type should include all algorithms', () => {
+    // SignatureAlgorithm should include both symmetric and asymmetric algorithms
+    const allAlgs: SignatureAlgorithm[] = [
+      'HS256',
+      'HS384',
+      'HS512',
+      'RS256',
+      'RS384',
+      'RS512',
+      'PS256',
+      'PS384',
+      'PS512',
+      'ES256',
+      'ES384',
+      'ES512',
+      'EdDSA',
+    ]
+
+    expect(allAlgs).toHaveLength(13)
+  })
+})

package/plugins/acryl-router/src/core/utils/jwt/jwa.ts

@@ -0,0 +1,38 @@
+/**
+ * @module
+ * JSON Web Algorithms (JWA)
+ * https://datatracker.ietf.org/doc/html/rfc7518
+ */
+
+export const AlgorithmTypes = {
+  HS256: 'HS256',
+  HS384: 'HS384',
+  HS512: 'HS512',
+  RS256: 'RS256',
+  RS384: 'RS384',
+  RS512: 'RS512',
+  PS256: 'PS256',
+  PS384: 'PS384',
+  PS512: 'PS512',
+  ES256: 'ES256',
+  ES384: 'ES384',
+  ES512: 'ES512',
+  EdDSA: 'EdDSA',
+} as const
+export type AlgorithmTypes = (typeof AlgorithmTypes)[keyof typeof AlgorithmTypes]
+
+export type SignatureAlgorithm = keyof typeof AlgorithmTypes
+
+export type SymmetricAlgorithm = 'HS256' | 'HS384' | 'HS512'
+
+export type AsymmetricAlgorithm =
+  | 'RS256'
+  | 'RS384'
+  | 'RS512'
+  | 'PS256'
+  | 'PS384'
+  | 'PS512'
+  | 'ES256'
+  | 'ES384'
+  | 'ES512'
+  | 'EdDSA'