acrylblends 0.4.1 → 0.5.0

package/lib/jwk.js

@@ -0,0 +1,117 @@
+import { HTTPException } from "./http-exception.js";
+import { getCookie, getSignedCookie } from "./cookie.js";
+import { t as Jwt } from "./jwt-BGJBw5AF.js";
+//#region ../../plugins/acryl-router/src/core/middleware/jwk/jwk.ts
+/**
+* JWK Auth Middleware for Acryl.
+*
+*
+* @param {object} options - The options for the JWK middleware.
+* @param {AcrylJsonWebKey[] | ((ctx: Context) => Promise<AcrylJsonWebKey[]> | AcrylJsonWebKey[])} [options.keys] - The public keys used for JWK verification, or a function that returns them.
+* @param {string | ((ctx: Context) => Promise<string> | string)} [options.jwks_uri] - If set to a URI string or a function that returns a URI string, attempt to fetch JWKs from it. The response must be a JSON object containing a `keys` array, which will be merged with the `keys` option.
+* @param {boolean} [options.allow_anon] - If set to `true`, the middleware allows requests without a token to proceed without authentication.
+* @param {string} [options.cookie] - If set, the middleware attempts to retrieve the token from a cookie with these options (optionally signed) only if no token is found in the header.
+* @param {string} [options.headerName='Authorization'] - The name of the header to look for the JWT token. Default is 'Authorization'.
+* @param {string} [options.realm] - The protection space described by the `realm` parameter of the returned `WWW-Authenticate` challenge header. Defaults to the request URL.
+* @param {AsymmetricAlgorithm[]} options.alg - An array of allowed asymmetric algorithms for JWT verification. Only tokens signed with these algorithms will be accepted.
+* @param {RequestInit} [init] - Optional init options for the `fetch` request when retrieving JWKS from a URI.
+* @param {VerifyOptions} [options.verification] - Additional options for JWK payload verification.
+* @returns {MiddlewareHandler} The middleware handler function.
+*
+* @example
+* ```ts
+* const app = new Acryl()
+*
+* app.use("/auth/*", jwk({
+*   jwks_uri: (c) => `https://${c.env.authServer}/.well-known/jwks.json`,
+*   headerName: 'x-custom-auth-header', // Optional, default is 'Authorization'
+* }))
+*
+* app.get('/auth/page', (c) => {
+*   return c.text('You are authorized')
+* })
+* ```
+*/
+const jwk = (options, init) => {
+	const verifyOpts = options.verification || {};
+	if (!options || !(options.keys || options.jwks_uri)) throw new Error("JWK auth middleware requires options for either \"keys\" or \"jwks_uri\" or both");
+	if (!crypto.subtle || !crypto.subtle.importKey) throw new Error("`crypto.subtle.importKey` is undefined. JWK auth middleware requires it.");
+	return async function jwk(ctx, next) {
+		const headerName = options.headerName || "Authorization";
+		const credentials = ctx.req.raw.headers.get(headerName);
+		let token;
+		if (credentials) {
+			const parts = credentials.split(/\s+/);
+			if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer") {
+				const errDescription = "invalid credentials structure";
+				throw new HTTPException(401, {
+					message: errDescription,
+					res: unauthorizedResponse({
+						ctx,
+						error: "invalid_request",
+						errDescription,
+						realm: options.realm
+					})
+				});
+			} else token = parts[1];
+		} else if (options.cookie) if (typeof options.cookie == "string") token = getCookie(ctx, options.cookie);
+		else if (options.cookie.secret) if (options.cookie.prefixOptions) token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key, options.cookie.prefixOptions);
+		else token = await getSignedCookie(ctx, options.cookie.secret, options.cookie.key);
+		else if (options.cookie.prefixOptions) token = getCookie(ctx, options.cookie.key, options.cookie.prefixOptions);
+		else token = getCookie(ctx, options.cookie.key);
+		if (!token) {
+			if (options.allow_anon) return next();
+			const errDescription = "no authorization included in request";
+			throw new HTTPException(401, {
+				message: errDescription,
+				res: unauthorizedResponse({
+					ctx,
+					error: "invalid_request",
+					errDescription,
+					realm: options.realm
+				})
+			});
+		}
+		let payload;
+		let cause;
+		try {
+			const keys = typeof options.keys === "function" ? await options.keys(ctx) : options.keys;
+			const jwks_uri = typeof options.jwks_uri === "function" ? await options.jwks_uri(ctx) : options.jwks_uri;
+			payload = await Jwt.verifyWithJwks(token, {
+				keys,
+				jwks_uri,
+				verification: verifyOpts,
+				allowedAlgorithms: options.alg
+			}, init);
+		} catch (e) {
+			cause = e;
+		}
+		if (!payload) {
+			if (cause instanceof Error && cause.constructor === Error) throw cause;
+			throw new HTTPException(401, {
+				message: "Unauthorized",
+				res: unauthorizedResponse({
+					ctx,
+					error: "invalid_token",
+					statusText: "Unauthorized",
+					errDescription: "token verification failure",
+					realm: options.realm
+				}),
+				cause
+			});
+		}
+		ctx.set("jwtPayload", payload);
+		await next();
+	};
+};
+function unauthorizedResponse(opts) {
+	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
+	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
+	return new Response("Unauthorized", {
+		status: 401,
+		statusText: opts.statusText,
+		headers: { "WWW-Authenticate": `Bearer realm="${realm}",error="${opts.error}",error_description="${errDescription}"` }
+	});
+}
+//#endregion
+export { jwk };

package/lib/jwt-BGJBw5AF.js

@@ -0,0 +1,403 @@
+import { decodeBase64, decodeBase64Url, encodeBase64Url } from "./utils/encode.js";
+import { getRuntimeKey } from "./adapter.js";
+//#region ../../plugins/acryl-router/src/core/utils/jwt/jwa.ts
+/**
+* @module
+* JSON Web Algorithms (JWA)
+* https://datatracker.ietf.org/doc/html/rfc7518
+*/
+const AlgorithmTypes = {
+	HS256: "HS256",
+	HS384: "HS384",
+	HS512: "HS512",
+	RS256: "RS256",
+	RS384: "RS384",
+	RS512: "RS512",
+	PS256: "PS256",
+	PS384: "PS384",
+	PS512: "PS512",
+	ES256: "ES256",
+	ES384: "ES384",
+	ES512: "ES512",
+	EdDSA: "EdDSA"
+};
+//#endregion
+//#region ../../plugins/acryl-router/src/core/utils/jwt/types.ts
+/**
+* @module
+* Type definitions for JWT utilities.
+*/
+var JwtAlgorithmNotImplemented = class extends Error {
+	constructor(alg) {
+		super(`${alg} is not an implemented algorithm`);
+		this.name = "JwtAlgorithmNotImplemented";
+	}
+};
+var JwtAlgorithmRequired = class extends Error {
+	constructor() {
+		super("JWT verification requires \"alg\" option to be specified");
+		this.name = "JwtAlgorithmRequired";
+	}
+};
+var JwtAlgorithmMismatch = class extends Error {
+	constructor(expected, actual) {
+		super(`JWT algorithm mismatch: expected "${expected}", got "${actual}"`);
+		this.name = "JwtAlgorithmMismatch";
+	}
+};
+var JwtTokenInvalid = class extends Error {
+	constructor(token) {
+		super(`invalid JWT token: ${token}`);
+		this.name = "JwtTokenInvalid";
+	}
+};
+var JwtTokenNotBefore = class extends Error {
+	constructor(token) {
+		super(`token (${token}) is being used before it's valid`);
+		this.name = "JwtTokenNotBefore";
+	}
+};
+var JwtTokenExpired = class extends Error {
+	constructor(token) {
+		super(`token (${token}) expired`);
+		this.name = "JwtTokenExpired";
+	}
+};
+var JwtTokenIssuedAt = class extends Error {
+	constructor(currentTimestamp, iat) {
+		super(`Invalid "iat" claim, must be a valid number lower than "${currentTimestamp}" (iat: "${iat}")`);
+		this.name = "JwtTokenIssuedAt";
+	}
+};
+var JwtTokenIssuer = class extends Error {
+	constructor(expected, iss) {
+		super(`expected issuer "${expected}", got ${iss ? `"${iss}"` : "none"} `);
+		this.name = "JwtTokenIssuer";
+	}
+};
+var JwtHeaderInvalid = class extends Error {
+	constructor(header) {
+		super(`jwt header is invalid: ${JSON.stringify(header)}`);
+		this.name = "JwtHeaderInvalid";
+	}
+};
+var JwtHeaderRequiresKid = class extends Error {
+	constructor(header) {
+		super(`required "kid" in jwt header: ${JSON.stringify(header)}`);
+		this.name = "JwtHeaderRequiresKid";
+	}
+};
+var JwtSymmetricAlgorithmNotAllowed = class extends Error {
+	constructor(alg) {
+		super(`symmetric algorithm "${alg}" is not allowed for JWK verification`);
+		this.name = "JwtSymmetricAlgorithmNotAllowed";
+	}
+};
+var JwtAlgorithmNotAllowed = class extends Error {
+	constructor(alg, allowedAlgorithms) {
+		super(`algorithm "${alg}" is not in the allowed list: [${allowedAlgorithms.join(", ")}]`);
+		this.name = "JwtAlgorithmNotAllowed";
+	}
+};
+var JwtTokenSignatureMismatched = class extends Error {
+	constructor(token) {
+		super(`token(${token}) signature mismatched`);
+		this.name = "JwtTokenSignatureMismatched";
+	}
+};
+var JwtPayloadRequiresAud = class extends Error {
+	constructor(payload) {
+		super(`required "aud" in jwt payload: ${JSON.stringify(payload)}`);
+		this.name = "JwtPayloadRequiresAud";
+	}
+};
+var JwtTokenAudience = class extends Error {
+	constructor(expected, aud) {
+		super(`expected audience "${Array.isArray(expected) ? expected.join(", ") : expected}", got "${aud}"`);
+		this.name = "JwtTokenAudience";
+	}
+};
+const CryptoKeyUsage = {
+	Encrypt: "encrypt",
+	Decrypt: "decrypt",
+	Sign: "sign",
+	Verify: "verify",
+	DeriveKey: "deriveKey",
+	DeriveBits: "deriveBits",
+	WrapKey: "wrapKey",
+	UnwrapKey: "unwrapKey"
+};
+//#endregion
+//#region ../../plugins/acryl-router/src/core/utils/jwt/utf8.ts
+/**
+* @module
+* Functions for encoding/decoding UTF8.
+*/
+const utf8Encoder = new TextEncoder();
+const utf8Decoder = new TextDecoder();
+//#endregion
+//#region ../../plugins/acryl-router/src/core/utils/jwt/jws.ts
+/**
+* @module
+* JSON Web Signature (JWS)
+* https://datatracker.ietf.org/doc/html/rfc7515
+*/
+async function signing(privateKey, alg, data) {
+	const algorithm = getKeyAlgorithm(alg);
+	const cryptoKey = await importPrivateKey(privateKey, algorithm);
+	return await crypto.subtle.sign(algorithm, cryptoKey, data);
+}
+async function verifying(publicKey, alg, signature, data) {
+	const algorithm = getKeyAlgorithm(alg);
+	const cryptoKey = await importPublicKey(publicKey, algorithm);
+	return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+}
+function pemToBinary(pem) {
+	return decodeBase64(pem.replace(/-+(BEGIN|END).*?-+/g, "").replace(/\s/g, ""));
+}
+async function importPrivateKey(key, alg) {
+	if (!crypto.subtle || !crypto.subtle.importKey) throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");
+	if (isCryptoKey(key)) {
+		if (key.type !== "private" && key.type !== "secret") throw new Error(`unexpected key type: CryptoKey.type is ${key.type}, expected private or secret`);
+		return key;
+	}
+	const usages = [CryptoKeyUsage.Sign];
+	if (typeof key === "object") return await crypto.subtle.importKey("jwk", key, alg, false, usages);
+	if (key.includes("PRIVATE")) return await crypto.subtle.importKey("pkcs8", pemToBinary(key), alg, false, usages);
+	return await crypto.subtle.importKey("raw", utf8Encoder.encode(key), alg, false, usages);
+}
+async function importPublicKey(key, alg) {
+	if (!crypto.subtle || !crypto.subtle.importKey) throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");
+	if (isCryptoKey(key)) {
+		if (key.type === "public" || key.type === "secret") return key;
+		key = await exportPublicJwkFrom(key);
+	}
+	if (typeof key === "string" && key.includes("PRIVATE")) key = await exportPublicJwkFrom(await crypto.subtle.importKey("pkcs8", pemToBinary(key), alg, true, [CryptoKeyUsage.Sign]));
+	const usages = [CryptoKeyUsage.Verify];
+	if (typeof key === "object") return await crypto.subtle.importKey("jwk", key, alg, false, usages);
+	if (key.includes("PUBLIC")) return await crypto.subtle.importKey("spki", pemToBinary(key), alg, false, usages);
+	return await crypto.subtle.importKey("raw", utf8Encoder.encode(key), alg, false, usages);
+}
+async function exportPublicJwkFrom(privateKey) {
+	if (privateKey.type !== "private") throw new Error(`unexpected key type: ${privateKey.type}`);
+	if (!privateKey.extractable) throw new Error("unexpected private key is unextractable");
+	const jwk = await crypto.subtle.exportKey("jwk", privateKey);
+	const { kty } = jwk;
+	const { alg, e, n } = jwk;
+	const { crv, x, y } = jwk;
+	return {
+		kty,
+		alg,
+		e,
+		n,
+		crv,
+		x,
+		y,
+		key_ops: [CryptoKeyUsage.Verify]
+	};
+}
+function getKeyAlgorithm(name) {
+	switch (name) {
+		case "HS256": return {
+			name: "HMAC",
+			hash: { name: "SHA-256" }
+		};
+		case "HS384": return {
+			name: "HMAC",
+			hash: { name: "SHA-384" }
+		};
+		case "HS512": return {
+			name: "HMAC",
+			hash: { name: "SHA-512" }
+		};
+		case "RS256": return {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: { name: "SHA-256" }
+		};
+		case "RS384": return {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: { name: "SHA-384" }
+		};
+		case "RS512": return {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: { name: "SHA-512" }
+		};
+		case "PS256": return {
+			name: "RSA-PSS",
+			hash: { name: "SHA-256" },
+			saltLength: 32
+		};
+		case "PS384": return {
+			name: "RSA-PSS",
+			hash: { name: "SHA-384" },
+			saltLength: 48
+		};
+		case "PS512": return {
+			name: "RSA-PSS",
+			hash: { name: "SHA-512" },
+			saltLength: 64
+		};
+		case "ES256": return {
+			name: "ECDSA",
+			hash: { name: "SHA-256" },
+			namedCurve: "P-256"
+		};
+		case "ES384": return {
+			name: "ECDSA",
+			hash: { name: "SHA-384" },
+			namedCurve: "P-384"
+		};
+		case "ES512": return {
+			name: "ECDSA",
+			hash: { name: "SHA-512" },
+			namedCurve: "P-521"
+		};
+		case "EdDSA": return {
+			name: "Ed25519",
+			namedCurve: "Ed25519"
+		};
+		default: throw new JwtAlgorithmNotImplemented(name);
+	}
+}
+function isCryptoKey(key) {
+	if (getRuntimeKey() === "node" && !!crypto.webcrypto) return key instanceof crypto.webcrypto.CryptoKey;
+	return key instanceof CryptoKey;
+}
+//#endregion
+//#region ../../plugins/acryl-router/src/core/utils/jwt/jwt.ts
+/**
+* @module
+* JSON Web Token (JWT)
+* https://datatracker.ietf.org/doc/html/rfc7519
+*/
+const encodeJwtPart = (part) => encodeBase64Url(utf8Encoder.encode(JSON.stringify(part)).buffer).replace(/=/g, "");
+const encodeSignaturePart = (buf) => encodeBase64Url(buf).replace(/=/g, "");
+const decodeJwtPart = (part) => JSON.parse(utf8Decoder.decode(decodeBase64Url(part)));
+function isTokenHeader(obj) {
+	if (typeof obj === "object" && obj !== null) {
+		const objWithAlg = obj;
+		return "alg" in objWithAlg && Object.values(AlgorithmTypes).includes(objWithAlg.alg) && (!("typ" in objWithAlg) || objWithAlg.typ === "JWT");
+	}
+	return false;
+}
+const sign = async (payload, privateKey, alg = "HS256") => {
+	const encodedPayload = encodeJwtPart(payload);
+	let encodedHeader;
+	if (typeof privateKey === "object" && "alg" in privateKey) {
+		alg = privateKey.alg;
+		encodedHeader = encodeJwtPart({
+			alg,
+			typ: "JWT",
+			kid: privateKey.kid
+		});
+	} else encodedHeader = encodeJwtPart({
+		alg,
+		typ: "JWT"
+	});
+	const partialToken = `${encodedHeader}.${encodedPayload}`;
+	const signaturePart = await signing(privateKey, alg, utf8Encoder.encode(partialToken));
+	return `${partialToken}.${encodeSignaturePart(signaturePart)}`;
+};
+const verify = async (token, publicKey, algOrOptions) => {
+	if (!algOrOptions) throw new JwtAlgorithmRequired();
+	const { alg, iss, nbf = true, exp = true, iat = true, aud } = typeof algOrOptions === "string" ? { alg: algOrOptions } : algOrOptions;
+	if (!alg) throw new JwtAlgorithmRequired();
+	const tokenParts = token.split(".");
+	if (tokenParts.length !== 3) throw new JwtTokenInvalid(token);
+	const { header, payload } = decode(token);
+	if (!isTokenHeader(header)) throw new JwtHeaderInvalid(header);
+	if (header.alg !== alg) throw new JwtAlgorithmMismatch(alg, header.alg);
+	const now = Math.floor(Date.now() / 1e3);
+	if (nbf && payload.nbf !== void 0) {
+		if (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > now) throw new JwtTokenNotBefore(token);
+	}
+	if (exp && payload.exp !== void 0) {
+		if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= now) throw new JwtTokenExpired(token);
+	}
+	if (iat && payload.iat !== void 0) {
+		if (typeof payload.iat !== "number" || !Number.isFinite(payload.iat) || now < payload.iat) throw new JwtTokenIssuedAt(now, payload.iat);
+	}
+	if (iss) {
+		if (!payload.iss) throw new JwtTokenIssuer(iss, null);
+		if (typeof iss === "string" && payload.iss !== iss) throw new JwtTokenIssuer(iss, payload.iss);
+		if (iss instanceof RegExp && !iss.test(payload.iss)) throw new JwtTokenIssuer(iss, payload.iss);
+	}
+	if (aud) {
+		if (!payload.aud) throw new JwtPayloadRequiresAud(payload);
+		if (!(Array.isArray(payload.aud) ? payload.aud : [payload.aud]).some((payloadAud) => aud instanceof RegExp ? aud.test(payloadAud) : typeof aud === "string" ? payloadAud === aud : Array.isArray(aud) && aud.includes(payloadAud))) throw new JwtTokenAudience(aud, payload.aud);
+	}
+	const headerPayload = token.substring(0, token.lastIndexOf("."));
+	let signature;
+	try {
+		signature = decodeBase64Url(tokenParts[2]);
+	} catch {
+		throw new JwtTokenInvalid(token);
+	}
+	if (!await verifying(publicKey, alg, signature, utf8Encoder.encode(headerPayload))) throw new JwtTokenSignatureMismatched(token);
+	return payload;
+};
+const symmetricAlgorithms = [
+	AlgorithmTypes.HS256,
+	AlgorithmTypes.HS384,
+	AlgorithmTypes.HS512
+];
+const verifyWithJwks = async (token, options, init) => {
+	const verifyOpts = options.verification || {};
+	const header = decodeHeader(token);
+	if (!isTokenHeader(header)) throw new JwtHeaderInvalid(header);
+	if (!header.kid) throw new JwtHeaderRequiresKid(header);
+	if (symmetricAlgorithms.includes(header.alg)) throw new JwtSymmetricAlgorithmNotAllowed(header.alg);
+	if (!options.allowedAlgorithms.includes(header.alg)) throw new JwtAlgorithmNotAllowed(header.alg, options.allowedAlgorithms);
+	let verifyKeys = options.keys ? [...options.keys] : void 0;
+	if (options.jwks_uri) {
+		const response = await fetch(options.jwks_uri, init);
+		if (!response.ok) throw new Error(`failed to fetch JWKS from ${options.jwks_uri}`);
+		const data = await response.json();
+		if (!data.keys) throw new Error("invalid JWKS response. \"keys\" field is missing");
+		if (!Array.isArray(data.keys)) throw new Error("invalid JWKS response. \"keys\" field is not an array");
+		verifyKeys ??= [];
+		verifyKeys.push(...data.keys);
+	} else if (!verifyKeys) throw new Error("verifyWithJwks requires options for either \"keys\" or \"jwks_uri\" or both");
+	const matchingKey = verifyKeys.find((key) => key.kid === header.kid);
+	if (!matchingKey) throw new JwtTokenInvalid(token);
+	if (matchingKey.alg && matchingKey.alg !== header.alg) throw new JwtAlgorithmMismatch(matchingKey.alg, header.alg);
+	return await verify(token, matchingKey, {
+		alg: header.alg,
+		...verifyOpts
+	});
+};
+const decode = (token) => {
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new JwtTokenInvalid(token);
+	try {
+		return {
+			header: decodeJwtPart(parts[0]),
+			payload: decodeJwtPart(parts[1])
+		};
+	} catch {
+		throw new JwtTokenInvalid(token);
+	}
+};
+const decodeHeader = (token) => {
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new JwtTokenInvalid(token);
+	try {
+		return decodeJwtPart(parts[0]);
+	} catch {
+		throw new JwtTokenInvalid(token);
+	}
+};
+//#endregion
+//#region ../../plugins/acryl-router/src/core/utils/jwt/index.ts
+/**
+* @module
+* JWT utility.
+*/
+const Jwt = {
+	sign,
+	verify,
+	decode,
+	verifyWithJwks
+};
+//#endregion
+export { AlgorithmTypes as n, Jwt as t };

package/lib/jwt-Dg493Tai.d.ts

@@ -0,0 +1,51 @@
+import { _ as JsonWebKey, i as CryptoKey } from "./types-CwrQjlaM.js";
+
+//#region ../../plugins/acryl-router/src/core/utils/jwt/jwa.d.ts
+/**
+ * @module
+ * JSON Web Algorithms (JWA)
+ * https://datatracker.ietf.org/doc/html/rfc7518
+ */
+declare const AlgorithmTypes: {
+  readonly HS256: "HS256";
+  readonly HS384: "HS384";
+  readonly HS512: "HS512";
+  readonly RS256: "RS256";
+  readonly RS384: "RS384";
+  readonly RS512: "RS512";
+  readonly PS256: "PS256";
+  readonly PS384: "PS384";
+  readonly PS512: "PS512";
+  readonly ES256: "ES256";
+  readonly ES384: "ES384";
+  readonly ES512: "ES512";
+  readonly EdDSA: "EdDSA";
+};
+type AlgorithmTypes = (typeof AlgorithmTypes)[keyof typeof AlgorithmTypes];
+type SignatureAlgorithm = keyof typeof AlgorithmTypes;
+type AsymmetricAlgorithm = 'RS256' | 'RS384' | 'RS512' | 'PS256' | 'PS384' | 'PS512' | 'ES256' | 'ES384' | 'ES512' | 'EdDSA';
+//#endregion
+//#region ../../plugins/acryl-router/src/core/utils/jwt/jws.d.ts
+interface AcrylJsonWebKey extends JsonWebKey {
+  kid?: string;
+}
+type SignatureKey = string | AcrylJsonWebKey | CryptoKey;
+//#endregion
+//#region ../../plugins/acryl-router/src/core/utils/jwt/jwt.d.ts
+interface TokenHeader {
+  alg: SignatureAlgorithm;
+  typ?: 'JWT';
+  kid?: string;
+}
+type VerifyOptions = {
+  /** The expected issuer used for verifying the token */iss?: string | RegExp; /** Verify the `nbf` claim (default: `true`) */
+  nbf?: boolean; /** Verify the `exp` claim (default: `true`) */
+  exp?: boolean; /** Verify the `iat` claim (default: `true`) */
+  iat?: boolean; /** Acceptable audience(s) for the token */
+  aud?: string | string[] | RegExp;
+};
+type VerifyOptionsWithAlg = {
+  /** The algorithm used for decoding the token */alg: SignatureAlgorithm;
+} & VerifyOptions;
+//#endregion
+export { SignatureKey as a, SignatureAlgorithm as c, AcrylJsonWebKey as i, VerifyOptions as n, AlgorithmTypes as o, VerifyOptionsWithAlg as r, AsymmetricAlgorithm as s, TokenHeader as t };

package/lib/jwt.d.ts

@@ -0,0 +1,72 @@
+import { I as MiddlewareHandler } from "./context-Bm7rI-oK.js";
+import { n as BufferSource } from "./types-CwrQjlaM.js";
+import { i as CookiePrefixOptions } from "./cookie-ClMaKDQf.js";
+import { a as SignatureKey, c as SignatureAlgorithm, i as AcrylJsonWebKey, n as VerifyOptions, o as AlgorithmTypes, r as VerifyOptionsWithAlg, s as AsymmetricAlgorithm, t as TokenHeader } from "./jwt-Dg493Tai.js";
+import { t as JWTPayload } from "./types-DR95J00T.js";
+
+//#region ../../plugins/acryl-router/src/core/middleware/jwt/jwt.d.ts
+type JwtVariables<T = any> = {
+  jwtPayload: T;
+};
+/**
+ * JWT Auth Middleware for Acryl.
+ *
+ *
+ * @param {object} options - The options for the JWT middleware.
+ * @param {SignatureKey} options.secret - A value of your secret key.
+ * @param {string} [options.cookie] - If this value is set, then the value is retrieved from the cookie header using that value as a key, which is then validated as a token.
+ * @param {SignatureAlgorithm} options.alg - An algorithm type that is used for verifying (required). Available types are `HS256` | `HS384` | `HS512` | `RS256` | `RS384` | `RS512` | `PS256` | `PS384` | `PS512` | `ES256` | `ES384` | `ES512` | `EdDSA`.
+ * @param {string} [options.headerName='Authorization'] - The name of the header to look for the JWT token. Default is 'Authorization'.
+ * @param {string} [options.realm] - The protection space described by the `realm` parameter of the returned `WWW-Authenticate` challenge header. Defaults to the request URL.
+ * @param {VerifyOptions} [options.verification] - Additional options for JWT payload verification.
+ * @returns {MiddlewareHandler} The middleware handler function.
+ *
+ * @example
+ * ```ts
+ * const app = new Acryl()
+ *
+ * app.use(
+ *   '/auth/*',
+ *   jwt({
+ *     secret: process.env.JWT_SECRET, // never a literal in source
+ *     alg: 'HS256',
+ *     headerName: 'x-custom-auth-header', // Optional, default is 'Authorization'
+ *   })
+ * )
+ *
+ * app.get('/auth/page', (c) => {
+ *   return c.text('You are authorized')
+ * })
+ * ```
+ */
+declare const jwt: (options: {
+  secret: SignatureKey;
+  cookie?: string | {
+    key: string;
+    secret?: string | BufferSource;
+    prefixOptions?: CookiePrefixOptions;
+  };
+  alg: SignatureAlgorithm;
+  headerName?: string;
+  realm?: string;
+  verification?: VerifyOptions;
+}) => MiddlewareHandler;
+declare const verifyWithJwks: (token: string, options: {
+  keys?: AcrylJsonWebKey[];
+  jwks_uri?: string;
+  verification?: VerifyOptions;
+  allowedAlgorithms: readonly AsymmetricAlgorithm[];
+}, init?: RequestInit) => Promise<JWTPayload>;
+declare const verify: (token: string, publicKey: SignatureKey, algOrOptions: SignatureAlgorithm | VerifyOptionsWithAlg) => Promise<JWTPayload>;
+declare const decode: (token: string) => {
+  header: TokenHeader;
+  payload: JWTPayload;
+};
+declare const sign: (payload: JWTPayload, privateKey: SignatureKey, alg?: SignatureAlgorithm) => Promise<string>;
+//#endregion
+//#region ../../plugins/acryl-router/src/core/middleware/jwt/index.d.ts
+declare module '../../context.ts' {
+  interface ContextVariableMap extends JwtVariables<unknown> {}
+}
+//#endregion
+export { AlgorithmTypes, type JwtVariables, decode, jwt, sign, verify, verifyWithJwks };