effect 4.1.0 → 4.1.1

package/dist/jose/Jwt.js

@@ -0,0 +1,293 @@
+/**
+ * Signed or encrypted compact JSON Web Tokens whose claims are encoded and
+ * decoded with a `Schema`.
+ *
+ * Verification and decryption authenticate the token first, then check the
+ * registered claims and the validation policy, and only then decode the
+ * application claims. `exp` and `nbf` are checked whenever they are present;
+ * require them with `requiredClaims`.
+ *
+ * Bound untrusted token length before verification, decryption, or unverified
+ * decoding; this module does not impose a token-size limit.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+import * as Clock from "../Clock.js";
+import * as Effect from "../Effect.js";
+import * as Schema from "../Schema.js";
+import { fail, invalidToken, millis, parseJsonObject, utf8 } from "./internal/compact.js";
+import * as JoseError from "./JoseError.js";
+import * as Jwe from "./Jwe.js";
+import * as Jws from "./Jws.js";
+/**
+ * Schema for the registered claims: string `iss`, `sub`, and `jti`, a string
+ * or string array `aud`, and finite NumericDate `exp`, `nbf`, and `iat`.
+ *
+ * @stability unstable
+ * @category schemas
+ * @since 4.1.1
+ */
+export const RegisteredClaims = /*#__PURE__*/Schema.Struct({
+  iss: /*#__PURE__*/Schema.optionalKey(Schema.String),
+  sub: /*#__PURE__*/Schema.optionalKey(Schema.String),
+  aud: /*#__PURE__*/Schema.optionalKey(/*#__PURE__*/Schema.Union([Schema.String, /*#__PURE__*/Schema.Array(Schema.String)])),
+  exp: /*#__PURE__*/Schema.optionalKey(Schema.Finite),
+  nbf: /*#__PURE__*/Schema.optionalKey(Schema.Finite),
+  iat: /*#__PURE__*/Schema.optionalKey(Schema.Finite),
+  jti: /*#__PURE__*/Schema.optionalKey(Schema.String)
+});
+const claimValidationFailed = (claim, reason) => fail(new JoseError.ClaimValidationFailed({
+  claim,
+  reason
+}));
+// Each claim is checked on its own so the failure can name it.
+const registeredClaimGuards = /*#__PURE__*/Object.entries(RegisteredClaims.fields).map(([name, field]) => [name, Schema.is(field.schema)]);
+// Durations are read before any cryptography, in seconds.
+const readPolicy = /*#__PURE__*/Effect.fnUntraced(function* (options) {
+  const clockTolerance = options?.clockTolerance === undefined ? 0 : yield* millis("clockTolerance", options.clockTolerance);
+  const maxTokenAge = options?.maxTokenAge === undefined ? undefined : yield* millis("maxTokenAge", options.maxTokenAge);
+  return {
+    ...options,
+    clockTolerance: clockTolerance / 1000,
+    maxTokenAge: maxTokenAge === undefined ? undefined : maxTokenAge / 1000
+  };
+});
+const toArray = value => typeof value === "string" ? [value] : value;
+const mediaType = value => {
+  const type = value.toLowerCase();
+  return type.includes("/") ? type : `application/${type}`;
+};
+const checkClaims = /*#__PURE__*/Effect.fnUntraced(function* (claims, header, policy) {
+  const registered = {};
+  for (const [name, isValid] of registeredClaimGuards) {
+    if (!Object.hasOwn(claims, name)) continue;
+    if (!isValid(claims[name])) return yield* claimValidationFailed(name, "invalid");
+    registered[name] = claims[name];
+  }
+  const {
+    iss,
+    sub,
+    aud,
+    exp,
+    nbf,
+    iat
+  } = registered;
+  for (const name of policy.requiredClaims ?? []) {
+    if (registered[name] === undefined) return yield* claimValidationFailed(name, "missing");
+  }
+  if (policy.issuer !== undefined) {
+    if (iss === undefined) return yield* claimValidationFailed("iss", "missing");
+    if (!toArray(policy.issuer).includes(iss)) return yield* claimValidationFailed("iss", "mismatch");
+  }
+  if (policy.subject !== undefined) {
+    if (sub === undefined) return yield* claimValidationFailed("sub", "missing");
+    if (sub !== policy.subject) return yield* claimValidationFailed("sub", "mismatch");
+  }
+  if (policy.audience !== undefined) {
+    if (aud === undefined) return yield* claimValidationFailed("aud", "missing");
+    const audiences = toArray(aud);
+    if (!toArray(policy.audience).some(audience => audiences.includes(audience))) {
+      return yield* claimValidationFailed("aud", "mismatch");
+    }
+  }
+  if (policy.typ !== undefined && (header.typ === undefined || mediaType(header.typ) !== mediaType(policy.typ))) {
+    return yield* claimValidationFailed("typ", "mismatch");
+  }
+  const now = Math.floor((yield* Clock.currentTimeMillis) / 1000);
+  const tolerance = policy.clockTolerance;
+  if (exp !== undefined && exp <= now - tolerance) return yield* claimValidationFailed("exp", "expired");
+  if (nbf !== undefined && nbf > now + tolerance) return yield* claimValidationFailed("nbf", "notYetValid");
+  if (policy.maxTokenAge !== undefined) {
+    if (iat === undefined) return yield* claimValidationFailed("iat", "missing");
+    if (iat > now + tolerance) return yield* claimValidationFailed("iat", "future");
+    if (now - iat - tolerance > policy.maxTokenAge) return yield* claimValidationFailed("iat", "tooOld");
+  }
+  return registered;
+});
+const decodeClaims = /*#__PURE__*/Effect.fnUntraced(function* (schema, payload, protectedHeader, policy) {
+  const claims = parseJsonObject(payload);
+  if (claims === undefined) return yield* invalidToken("The JWT payload is not a JSON object");
+  const registeredClaims = yield* checkClaims(claims, protectedHeader, policy);
+  return {
+    claims: yield* Schema.decodeUnknownEffect(schema)(claims),
+    registeredClaims,
+    protectedHeader
+  };
+});
+const decodeClaimsJson = /*#__PURE__*/Schema.decodeUnknownEffect(/*#__PURE__*/Schema.JsonObject.check(/*#__PURE__*/Schema.makeFilter(claims => Schema.is(RegisteredClaims)(claims))));
+const encodeClaims = /*#__PURE__*/Effect.fnUntraced(function* (schema, claims) {
+  const encoded = yield* Schema.encodeEffect(schema)(claims);
+  const json = yield* decodeClaimsJson(encoded);
+  return utf8(JSON.stringify(json));
+});
+/**
+ * Encodes claims with a schema and signs them as a compact JWT.
+ *
+ * **Details**
+ *
+ * The encoded claims must be a JSON object whose registered claims match
+ * {@link RegisteredClaims}.
+ *
+ * @see {@link verify}
+ * @see {@link encrypt} for encrypted JWTs
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const sign = (schema, claims, key, header) => Effect.flatMap(encodeClaims(schema, claims), payload => Jws.sign(payload, key, header));
+/**
+ * Verifies a compact JWT with a key, checks its claims against the policy, and
+ * decodes the claims with a schema.
+ *
+ * **Example** (Verifying a token)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer, Redacted, Schema } from "effect"
+ * import { Mac, SecureRandom, Signature } from "effect/crypto"
+ * import { Jwk, Jwt } from "effect/jose"
+ *
+ * const layer = Layer.mergeAll(Mac.layerWebCrypto, Signature.layerWebCrypto).pipe(
+ *   Layer.provide(SecureRandom.layerWebCrypto)
+ * )
+ *
+ * const Claims = Schema.Struct({ sub: Schema.String, iss: Schema.String })
+ *
+ * const claims = await Effect.runPromise(Effect.gen(function*() {
+ *   // Fixed public example material; generate application secrets securely.
+ *   const key = yield* Jwk.importSecret(
+ *     Redacted.make({ kty: "oct", k: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc" } as const),
+ *     "HS256"
+ *   )
+ *   const token = yield* Jwt.sign(Claims, { sub: "user-123", iss: "example" }, key)
+ *   const verified = yield* Jwt.verify(Claims, token, key, { issuer: "example", requiredClaims: ["sub"] })
+ *   return verified.claims
+ * }).pipe(Effect.provide(layer)))
+ * claims // => ({ sub: "user-123", iss: "example" })
+ * ```
+ *
+ * @see {@link verifyWithKeySet} for resolving the key from the `Jwks` service
+ * @see {@link decrypt} for encrypted JWTs
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const verify = /*#__PURE__*/Effect.fnUntraced(function* (schema, token, key, options) {
+  const policy = yield* readPolicy(options);
+  const verified = yield* Jws.verify(token, key);
+  return yield* decodeClaims(schema, verified.payload, verified.protectedHeader, policy);
+});
+/**
+ * Verifies a compact JWT with a public key resolved from the `Jwks` service,
+ * checks its claims against the policy, and decodes the claims with a schema.
+ *
+ * @see {@link verify} for verifying with a known key
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const verifyWithKeySet = /*#__PURE__*/Effect.fnUntraced(function* (schema, token, options) {
+  const policy = yield* readPolicy(options);
+  const verified = yield* Jws.verifyWithKeySet(token, options);
+  return {
+    ...(yield* decodeClaims(schema, verified.payload, verified.protectedHeader, policy)),
+    key: verified.key
+  };
+});
+/**
+ * Encodes claims with a schema and encrypts them as a compact `dir`/A256GCM
+ * JWT.
+ *
+ * **Details**
+ *
+ * The encoded claims must be a JSON object whose registered claims match
+ * {@link RegisteredClaims}.
+ *
+ * **Example** (Encrypting and validating application claims)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer, Redacted, Schema } from "effect"
+ * import { Aead, SecureRandom } from "effect/crypto"
+ * import { Jwk, Jwt } from "effect/jose"
+ *
+ * const layer = Aead.layerWebCrypto.pipe(Layer.provideMerge(SecureRandom.layerWebCrypto))
+ * const Claims = Schema.Struct({ sub: Schema.String })
+ *
+ * const claims = await Effect.runPromise(Effect.gen(function*() {
+ *   // Fixed public example material; generate application secrets securely.
+ *   const key = yield* Jwk.importSecret(
+ *     Redacted.make({ kty: "oct", k: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc" } as const),
+ *     "dir"
+ *   )
+ *   const token = yield* Jwt.encrypt(Claims, { sub: "user-123" }, key, { typ: "session+jwt" })
+ *   const decrypted = yield* Jwt.decrypt(Claims, token, key, { typ: "session+jwt" })
+ *   return decrypted.claims
+ * }).pipe(Effect.provide(layer)))
+ * claims // => ({ sub: "user-123" })
+ * ```
+ *
+ * @see {@link decrypt}
+ * @see {@link sign} for signed JWTs
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const encrypt = (schema, claims, key, header) => Effect.flatMap(encodeClaims(schema, claims), payload => Jwe.encrypt(payload, key, header));
+/**
+ * Decrypts a compact `dir`/A256GCM JWT, checks its claims against the policy,
+ * and decodes the claims with a schema.
+ *
+ * **Details**
+ *
+ * Accepts a key or an effectful resolver for key rotation. The same claim
+ * policy as {@link verify} is applied after authenticated decryption and
+ * before the application schema is decoded.
+ *
+ * **Gotchas**
+ *
+ * The resolver receives an unauthenticated header and must use it only for
+ * key selection.
+ *
+ * @see {@link encrypt}
+ * @see {@link verify} for signed JWTs
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export const decrypt = /*#__PURE__*/Effect.fnUntraced(function* (schema, token, key, options) {
+  const policy = yield* readPolicy(options);
+  const decrypted = yield* Jwe.decrypt(token, key);
+  return {
+    ...(yield* decodeClaims(schema, decrypted.plaintext, decrypted.protectedHeader, policy)),
+    key: decrypted.key
+  };
+});
+/**
+ * Reads the protected header and claims of a signed JWT without verifying it.
+ *
+ * **Gotchas**
+ *
+ * Nothing returned here is authenticated. Use it only to choose how to
+ * verify, never to authorize.
+ *
+ * @see {@link verify}
+ *
+ * @stability unstable
+ * @category decoding
+ * @since 4.1.1
+ */
+export const decodeUnverified = /*#__PURE__*/Effect.fnUntraced(function* (token) {
+  const parsed = yield* Jws.parse(token);
+  const claims = parseJsonObject(parsed.payload);
+  if (claims === undefined) return yield* invalidToken("The JWT payload is not a JSON object");
+  return {
+    protectedHeader: parsed.protectedHeader,
+    claims
+  };
+});
+//# sourceMappingURL=Jwt.js.map

package/dist/jose/Jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwt.js","names":[],"sources":["../../src/jose/Jwt.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;AAeA,OAAO,KAAK,KAAK,MAAM,aAAa;AAKpC,OAAO,KAAK,MAAM,MAAM,cAAc;AAEtC,OAAO,KAAK,MAAM,MAAM,cAAc;AACtC,SAAS,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,QAAQ,uBAAuB;AACzF,OAAO,KAAK,SAAS,MAAM,gBAAgB;AAC3C,OAAO,KAAK,GAAG,MAAM,UAAU;AAG/B,OAAO,KAAK,GAAG,MAAM,UAAU;AAE/B;;;;;;;;AAQA,OAAO,MAAM,gBAAgB,gBAAG,MAAM,CAAC,MAAM,CAAC;EAC5C,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,cAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,eAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;EACnF,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;EACtC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM;CACtC,CAAC;AAuGF,MAAM,qBAAqB,GAAG,CAC5B,KAA+C,EAC/C,MAAiD,KAC9C,IAAI,CAAC,IAAI,SAAS,CAAC,qBAAqB,CAAC;EAAE,KAAK;EAAE;AAAM,CAAE,CAAC,CAAC;AAEjE;AACA,MAAM,qBAAqB,gBAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,KACtF,CAAC,IAA8B,EAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAU,CACnE;AAOD;AACA,MAAM,UAAU,gBAAG,MAAM,CAAC,UAAU,CAAC,WACnC,OAAkC;EAElC,MAAM,cAAc,GAAG,OAAO,EAAE,cAAc,KAAK,SAAS,GACxD,CAAC,GACD,OAAO,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC;EAC3D,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,KAAK,SAAS,GAAG,SAAS,GAAG,OAAO,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC;EACtH,OAAO;IACL,GAAG,OAAO;IACV,cAAc,EAAE,cAAc,GAAG,IAAI;IACrC,WAAW,EAAE,WAAW,KAAK,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG;GACpE;AACH,CAAC,CAAC;AAEF,MAAM,OAAO,GAAI,KAAqC,IACpD,OAAO,KAAK,KAAK,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK;AAE7C,MAAM,SAAS,GAAI,KAAa,IAAY;EAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,EAAE;EAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,eAAe,IAAI,EAAE;AAC1D,CAAC;AAED,MAAM,WAAW,gBAAG,MAAM,CAAC,UAAU,CAAC,WACpC,MAA6C,EAC7C,MAA6C,EAC7C,MAAc;EAEd,MAAM,UAAU,GAA4B,EAAE;EAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,qBAAqB,EAAE;IACnD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;IAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,OAAO,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;IAChF,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;EACjC;EACA,MAAM;IAAE,GAAG;IAAE,GAAG;IAAE,GAAG;IAAE,GAAG;IAAE,GAAG;IAAE;EAAG,CAAE,GAAG,UAA8B;EAEvE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,OAAO,OAAO,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC;EAC1F;EACA,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC;IAC5E,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC;EACnG;EACA,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE;IAChC,IAAI,GAAG,KAAK,SAAS,EAAE,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC;IAC5E,IAAI,GAAG,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC;EACpF;EACA,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE;IACjC,IAAI,GAAG,KAAK,SAAS,EAAE,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC;IAC5E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAE,QAAQ,IAAK,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE;MAC9E,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC;IACxD;EACF;EACA,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,KAAK,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;IAC7G,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,UAAU,CAAC;EACxD;EAEA,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC;EAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc;EACvC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,GAAG,GAAG,SAAS,EAAE,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC;EACtG,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,GAAG,GAAG,SAAS,EAAE,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,aAAa,CAAC;EACzG,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE;IACpC,IAAI,GAAG,KAAK,SAAS,EAAE,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC;IAC5E,IAAI,GAAG,GAAG,GAAG,GAAG,SAAS,EAAE,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC;IAC/E,IAAI,GAAG,GAAG,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,OAAO,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC;EACtG;EACA,OAAO,UAA8B;AACvC,CAAC,CAAC;AAEF,MAAM,YAAY,gBAAG,MAAM,CAAC,UAAU,CAAC,WAIrC,MAAS,EACT,OAAmB,EACnB,eAAkB,EAClB,MAAc;EAEd,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC;EACvC,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,OAAO,YAAY,CAAC,sCAAsC,CAAC;EAC5F,MAAM,gBAAgB,GAAG,OAAO,WAAW,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC;EAC5E,OAAO;IACL,MAAM,EAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACzD,gBAAgB;IAChB;GACD;AACH,CAAC,CAAC;AAEF,MAAM,gBAAgB,gBAAG,MAAM,CAAC,mBAAmB,cACjD,MAAM,CAAC,UAAU,CAAC,KAAK,cAAC,MAAM,CAAC,UAAU,CAAE,MAAM,IAAK,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAC5F;AAED,MAAM,YAAY,gBAAG,MAAM,CAAC,UAAU,CAAC,WACrC,MAAS,EACT,MAAiB;EAEjB,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;EAC1D,MAAM,IAAI,GAAG,OAAO,gBAAgB,CAAC,OAAO,CAAC;EAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;AAeA,OAAO,MAAM,IAAI,GAAG,CAKlB,MAAS,EACT,MAAiB,EACjB,GAAM,EACN,MAAuB,KAEvB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAG,OAAO,IAAK,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AAE3F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,OAAO,MAAM,MAAM,gBASf,MAAM,CAAC,UAAU,CAAC,WACpB,MAAS,EACT,KAAyC,EACzC,GAAM,EACN,OAAuB;EAEvB,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC,OAAO,CAAC;EACzC,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;EAC9C,OAAO,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;AACxF,CAAC,CAAC;AAEF;;;;;;;;;;AAUA,OAAO,MAAM,gBAAgB,gBAQzB,MAAM,CAAC,UAAU,CAAC,WACpB,MAAS,EACT,KAAyC,EACzC,OAAgC;EAMhC,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC,OAAO,CAAC;EACzC,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC;EAC5D,OAAO;IACL,IAAI,OAAO,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACpF,GAAG,EAAE,QAAQ,CAAC;GACf;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,OAAO,MAAM,OAAO,GAAG,CAIrB,MAAS,EACT,MAAiB,EACjB,GAAqB,EACrB,MAAuB,KAEvB,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAG,OAAO,IAAK,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;;;;AAsBA,OAAO,MAAM,OAAO,gBAAG,MAAM,CAAC,UAAU,CAAC,WACvC,MAAS,EACT,KAAyC,EACzC,GAAgG,EAChG,OAAuB;EAEvB,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC,OAAO,CAAC;EACzC,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;EAChD,OAAO;IACL,IAAI,OAAO,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACxF,GAAG,EAAE,SAAS,CAAC;GAChB;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;;;AAcA,OAAO,MAAM,gBAAgB,gBAAG,MAAM,CAAC,UAAU,CAAC,WAChD,KAAyC;EAEzC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;EACtC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC;EAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,OAAO,OAAO,YAAY,CAAC,sCAAsC,CAAC;EAC5F,OAAO;IAAE,eAAe,EAAE,MAAM,CAAC,eAAe;IAAE;EAAM,CAAE;AAC5D,CAAC,CAAC","ignoreList":[]}

package/dist/jose/index.d.ts

@@ -0,0 +1,51 @@
+/**
+ * JOSE keys, key sets, signatures, encryption, and schema-typed JSON Web Tokens.
+ *
+ * `Jwk` imports and exports JSON Web Keys; `Jwks` resolves keys from JSON Web
+ * Key Sets. `Jws`, `Jwe`, and `Jwt` handle JSON Web Signatures, JSON Web
+ * Encryption, and JSON Web Tokens respectively.
+ *
+ * The supported profile is compact serialization with HS256/384/512,
+ * RS256/384/512, PS256/384/512, ES256/384/512 (P-256/P-384/P-521), and EdDSA
+ * (Ed25519) signatures, and `dir`/A256GCM encryption.
+ * Other algorithms and JSON serializations are outside this profile.
+ * `Jwk` also generates symmetric keys, computes JWK thumbprints, and imports
+ * and exports SPKI and PKCS#8 keys in DER or PEM form.
+ *
+ * Apply an application-specific token-length limit before verification,
+ * decryption, or unverified decoding.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as JoseError from "./JoseError.ts";
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as Jwe from "./Jwe.ts";
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as Jwk from "./Jwk.ts";
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as Jwks from "./Jwks.ts";
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as Jws from "./Jws.ts";
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as Jwt from "./Jwt.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/jose/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/jose/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH;;;GAGG;AACH,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAE3C;;;GAGG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAE/B;;;GAGG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAE/B;;;GAGG;AACH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAEjC;;;GAGG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAE/B;;;GAGG;AACH,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA"}

package/dist/jose/index.js

@@ -0,0 +1,52 @@
+/**
+ * JOSE keys, key sets, signatures, encryption, and schema-typed JSON Web Tokens.
+ *
+ * `Jwk` imports and exports JSON Web Keys; `Jwks` resolves keys from JSON Web
+ * Key Sets. `Jws`, `Jwe`, and `Jwt` handle JSON Web Signatures, JSON Web
+ * Encryption, and JSON Web Tokens respectively.
+ *
+ * The supported profile is compact serialization with HS256/384/512,
+ * RS256/384/512, PS256/384/512, ES256/384/512 (P-256/P-384/P-521), and EdDSA
+ * (Ed25519) signatures, and `dir`/A256GCM encryption.
+ * Other algorithms and JSON serializations are outside this profile.
+ * `Jwk` also generates symmetric keys, computes JWK thumbprints, and imports
+ * and exports SPKI and PKCS#8 keys in DER or PEM form.
+ *
+ * Apply an application-specific token-length limit before verification,
+ * decryption, or unverified decoding.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+// @barrel
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as JoseError from "./JoseError.js";
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as Jwe from "./Jwe.js";
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as Jwk from "./Jwk.js";
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as Jwks from "./Jwks.js";
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as Jws from "./Jws.js";
+/**
+ * @stability unstable
+ * @since 4.1.1
+ */
+export * as Jwt from "./Jwt.js";
+//# sourceMappingURL=index.js.map

package/dist/jose/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/jose/index.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;AAqBA;AAEA;;;;AAIA,OAAO,KAAK,SAAS,MAAM,gBAAgB;AAE3C;;;;AAIA,OAAO,KAAK,GAAG,MAAM,UAAU;AAE/B;;;;AAIA,OAAO,KAAK,GAAG,MAAM,UAAU;AAE/B;;;;AAIA,OAAO,KAAK,IAAI,MAAM,WAAW;AAEjC;;;;AAIA,OAAO,KAAK,GAAG,MAAM,UAAU;AAE/B;;;;AAIA,OAAO,KAAK,GAAG,MAAM,UAAU","ignoreList":[]}

package/dist/jose/internal/compact.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=compact.d.ts.map

package/dist/jose/internal/compact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compact.d.ts","sourceRoot":"","sources":["../../../src/jose/internal/compact.ts"],"names":[],"mappings":""}

package/dist/jose/internal/compact.js

@@ -0,0 +1,179 @@
+import * as Duration from "../../Duration.js";
+import * as Effect from "../../Effect.js";
+import * as Base64Url from "../../encoding/Base64Url.js";
+import * as Option from "../../Option.js";
+import * as Redacted from "../../Redacted.js";
+import * as Result from "../../Result.js";
+import * as Schema from "../../Schema.js";
+import * as JoseError from "../JoseError.js";
+/** @internal */
+export const fail = reason => Effect.fail(new JoseError.JoseError({
+  reason
+}));
+/** @internal */
+export const invalidToken = description => fail(new JoseError.InvalidToken({
+  description
+}));
+/** @internal */
+export const invalidKey = (description, cause) => fail(new JoseError.InvalidKey({
+  description,
+  cause
+}));
+/** @internal */
+export const invalidArgument = (description, cause) => fail(new JoseError.InvalidArgument({
+  description,
+  cause
+}));
+/**
+ * Maps a failure of an operation on secret material, such as signing or
+ * private-key import, to a fixed description. Backend messages and causes may
+ * describe the secret, so they are dropped.
+ *
+ * @internal
+ */
+export const cryptoFailure = description => _ => new JoseError.JoseError({
+  reason: new JoseError.InvalidKey({
+    description
+  })
+});
+/**
+ * Maps a public-key import failure, keeping the backend diagnostic.
+ *
+ * @internal
+ */
+export const publicKeyFailure = error => new JoseError.JoseError({
+  reason: new JoseError.InvalidKey({
+    description: error.message,
+    cause: error
+  })
+});
+/**
+ * Schema fields that keep private and symmetric key members out of a public
+ * JWK.
+ *
+ * @internal
+ */
+export const noPrivateMembers = {
+  d: /*#__PURE__*/Schema.optionalKey(Schema.Never),
+  p: /*#__PURE__*/Schema.optionalKey(Schema.Never),
+  q: /*#__PURE__*/Schema.optionalKey(Schema.Never),
+  dp: /*#__PURE__*/Schema.optionalKey(Schema.Never),
+  dq: /*#__PURE__*/Schema.optionalKey(Schema.Never),
+  qi: /*#__PURE__*/Schema.optionalKey(Schema.Never),
+  oth: /*#__PURE__*/Schema.optionalKey(Schema.Never),
+  k: /*#__PURE__*/Schema.optionalKey(Schema.Never)
+};
+/** @internal */
+export const hasPrivateMembers = jwk => Object.keys(noPrivateMembers).some(name => Object.hasOwn(jwk, name));
+/** @internal */
+export const utf8 = text => new TextEncoder().encode(text);
+/** @internal */
+export const reveal = token => Redacted.isRedacted(token) ? Redacted.value(token) : token;
+/**
+ * Checks unpadded base64url, including the unused bits in the final character.
+ *
+ * @internal
+ */
+export const isCanonicalSegment = segment => {
+  if (/[^A-Za-z0-9_-]/.test(segment)) return false;
+  const remainder = segment.length % 4;
+  const last = segment.charAt(segment.length - 1);
+  return remainder === 0 || (remainder === 2 ? "AQgw".includes(last) : remainder === 3 && "AEIMQUYcgkosw048".includes(last));
+};
+/**
+ * Decodes canonical unpadded base64url.
+ *
+ * @internal
+ */
+export const decodeSegment = segment => {
+  if (!isCanonicalSegment(segment)) return undefined;
+  const decoded = Base64Url.decode(segment);
+  return Result.isSuccess(decoded) ? decoded.success : undefined;
+};
+/** @internal */
+export const parseJsonObject = bytes => {
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", {
+      fatal: true
+    }).decode(bytes));
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : undefined;
+  } catch {
+    return undefined;
+  }
+};
+/**
+ * Splits a compact serialization into exactly `count` segments.
+ *
+ * @internal
+ */
+export const split = (token, count) => {
+  const parts = reveal(token).split(".");
+  return parts.length === count ? Effect.succeed(parts) : invalidToken(`A compact serialization must have ${count} segments`);
+};
+/**
+ * Decodes a protected header. Parameters in `unsupported` change how the
+ * token is processed, so they are rejected rather than ignored.
+ *
+ * @internal
+ */
+export const decodeHeader = (segment, decode, unsupported) => {
+  const bytes = decodeSegment(segment);
+  const json = bytes === undefined ? undefined : parseJsonObject(bytes);
+  if (json === undefined) return invalidToken("The protected header is not a base64url JSON object");
+  for (const name of unsupported) {
+    if (Object.hasOwn(json, name)) return invalidToken(`The ${name} header parameter is not supported`);
+  }
+  return Option.match(decode(json), {
+    onNone: () => invalidToken("The protected header has unsupported or malformed parameters"),
+    onSome: Effect.succeed
+  });
+};
+/**
+ * Base64url-encodes a protected header. Fixed parameters come first and
+ * cannot be overridden by additional parameters.
+ *
+ * @internal
+ */
+export const encodeHeader = (fixed, kid, header, unsupported) => {
+  for (const name of unsupported) {
+    if (header !== undefined && Object.hasOwn(header, name)) {
+      return invalidArgument(`The ${name} header parameter is not supported`);
+    }
+  }
+  const {
+    kid: headerKid,
+    ...rest
+  } = header ?? {};
+  const value = {
+    ...fixed,
+    kid: headerKid ?? kid,
+    ...rest,
+    ...fixed
+  };
+  try {
+    return Effect.succeed(Base64Url.encode(JSON.stringify(value)));
+  } catch {
+    return invalidArgument("The protected header is not JSON serializable");
+  }
+};
+/**
+ * Reads a finite, non-negative duration in milliseconds.
+ *
+ * @internal
+ */
+export const millis = (name, input) => {
+  const value = hasInvalidComponent(input) ? Option.none() : Option.map(Duration.fromInput(input), Duration.toMillis);
+  return Option.isSome(value) && Number.isFinite(value.value) && value.value >= 0 ? Effect.succeed(value.value) : invalidArgument(`${name} must be a finite, non-negative duration`);
+};
+// `Duration` reads NaN as zero in every input form, and components that are
+// not finite or overflow on conversion add up to NaN. Either would silently
+// disable a bound.
+const hasInvalidComponent = input => {
+  if (typeof input === "number") return Number.isNaN(input);
+  if (typeof input !== "object" || Duration.isDuration(input)) return false;
+  if (Array.isArray(input)) return input.some(component => !Number.isFinite(component));
+  return Object.entries(input).some(([unit, component]) => typeof component === "number" && (!Number.isFinite(component) || !Number.isFinite(Duration.toMillis({
+    [unit]: component
+  }))));
+};
+//# sourceMappingURL=compact.js.map

package/dist/jose/internal/compact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compact.js","names":[],"sources":["../../../src/jose/internal/compact.ts"],"sourcesContent":[null],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,mBAAmB;AAC7C,OAAO,KAAK,MAAM,MAAM,iBAAiB;AACzC,OAAO,KAAK,SAAS,MAAM,6BAA6B;AACxD,OAAO,KAAK,MAAM,MAAM,iBAAiB;AACzC,OAAO,KAAK,QAAQ,MAAM,mBAAmB;AAC7C,OAAO,KAAK,MAAM,MAAM,iBAAiB;AACzC,OAAO,KAAK,MAAM,MAAM,iBAAiB;AACzC,OAAO,KAAK,SAAS,MAAM,iBAAiB;AAE5C;AACA,OAAO,MAAM,IAAI,GAAI,MAAiC,IACpD,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC;EAAE;AAAM,CAAE,CAAC,CAAC;AAElD;AACA,OAAO,MAAM,YAAY,GAAI,WAAmB,IAAK,IAAI,CAAC,IAAI,SAAS,CAAC,YAAY,CAAC;EAAE;AAAW,CAAE,CAAC,CAAC;AAEtG;AACA,OAAO,MAAM,UAAU,GAAG,CAAC,WAAmB,EAAE,KAAe,KAC7D,IAAI,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC;EAAE,WAAW;EAAE;AAAK,CAAE,CAAC,CAAC;AAExD;AACA,OAAO,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,KAAe,KAClE,IAAI,CAAC,IAAI,SAAS,CAAC,eAAe,CAAC;EAAE,WAAW;EAAE;AAAK,CAAE,CAAC,CAAC;AAE7D;;;;;;;AAOA,OAAO,MAAM,aAAa,GAAI,WAAmB,IAAM,CAA0B,IAC/E,IAAI,SAAS,CAAC,SAAS,CAAC;EAAE,MAAM,EAAE,IAAI,SAAS,CAAC,UAAU,CAAC;IAAE;EAAW,CAAE;AAAC,CAAE,CAAC;AAEhF;;;;;AAKA,OAAO,MAAM,gBAAgB,GAAI,KAA8B,IAC7D,IAAI,SAAS,CAAC,SAAS,CAAC;EAAE,MAAM,EAAE,IAAI,SAAS,CAAC,UAAU,CAAC;IAAE,WAAW,EAAE,KAAK,CAAC,OAAO;IAAE,KAAK,EAAE;EAAK,CAAE;AAAC,CAAE,CAAC;AAE7G;;;;;;AAMA,OAAO,MAAM,gBAAgB,GAAG;EAC9B,CAAC,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;EACnC,CAAC,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;EACnC,CAAC,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;EACnC,EAAE,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;EACpC,EAAE,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;EACpC,EAAE,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;EACpC,GAAG,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;EACrC,CAAC,eAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK;CACnC;AAED;AACA,OAAO,MAAM,iBAAiB,GAAI,GAAW,IAC3C,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAE,IAAI,IAAK,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAExE;AACA,OAAO,MAAM,IAAI,GAAI,IAAY,IAAiB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;AAEhF;AACA,OAAO,MAAM,MAAM,GAAI,KAAyC,IAC9D,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK;AAE5D;;;;;AAKA,OAAO,MAAM,kBAAkB,GAAI,OAAe,IAAa;EAC7D,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK;EAChD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;EACpC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;EAC/C,OAAO,SAAS,KAAK,CAAC,KACnB,SAAS,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,KAAK,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC;AAED;;;;;AAKA,OAAO,MAAM,aAAa,GAAI,OAAe,IAA4B;EACvE,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,OAAO,SAAS;EAClD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;EACzC,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS;AAChE,CAAC;AAED;AACA,OAAO,MAAM,eAAe,GAAI,KAAiB,IAAuD;EACtG,IAAI;IACF,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE;MAAE,KAAK,EAAE;IAAI,CAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1F,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GACvE,KAA8C,GAC9C,SAAS;EACf,CAAC,CAAC,MAAM;IACN,OAAO,SAAS;EAClB;AACF,CAAC;AAED;;;;;AAKA,OAAO,MAAM,KAAK,GAAG,CACnB,KAAyC,EACzC,KAAa,KACgD;EAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;EACtC,OAAO,KAAK,CAAC,MAAM,KAAK,KAAK,GACzB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GACrB,YAAY,CAAC,qCAAqC,KAAK,WAAW,CAAC;AACzE,CAAC;AAED;;;;;;AAMA,OAAO,MAAM,YAAY,GAAG,CAC1B,OAAe,EACf,MAA4C,EAC5C,WAAkC,KACO;EACzC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC;EACpC,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,GAAG,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC;EACrE,IAAI,IAAI,KAAK,SAAS,EAAE,OAAO,YAAY,CAAC,qDAAqD,CAAC;EAClG,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE;IAC9B,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,YAAY,CAAC,OAAO,IAAI,oCAAoC,CAAC;EACrG;EACA,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;IAChC,MAAM,EAAE,MAAM,YAAY,CAAC,8DAA8D,CAAC;IAC1F,MAAM,EAAE,MAAM,CAAC;GAChB,CAAC;AACJ,CAAC;AAED;;;;;;AAMA,OAAO,MAAM,YAAY,GAAG,CAC1B,KAAuC,EACvC,GAAuB,EACvB,MAAyD,EACzD,WAAkC,KACY;EAC9C,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE;IAC9B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;MACvD,OAAO,eAAe,CAAC,OAAO,IAAI,oCAAoC,CAAC;IACzE;EACF;EACA,MAAM;IAAE,GAAG,EAAE,SAAS;IAAE,GAAG;EAAI,CAAE,GAAG,MAAM,IAAI,EAAE;EAChD,MAAM,KAAK,GAAG;IAAE,GAAG,KAAK;IAAE,GAAG,EAAE,SAAS,IAAI,GAAG;IAAE,GAAG,IAAI;IAAE,GAAG;EAAK,CAAE;EACpE,IAAI;IACF,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;EAChE,CAAC,CAAC,MAAM;IACN,OAAO,eAAe,CAAC,+CAA+C,CAAC;EACzE;AACF,CAAC;AAED;;;;;AAKA,OAAO,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAqB,KAAgD;EACxG,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;EACnH,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,GAC3E,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAC3B,eAAe,CAAC,GAAG,IAAI,0CAA0C,CAAC;AACxE,CAAC;AAED;AACA;AACA;AACA,MAAM,mBAAmB,GAAI,KAAqB,IAAa;EAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;EACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK;EACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC,IAAI,CAAE,SAAS,IAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;EACvF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,KAClD,OAAO,SAAS,KAAK,QAAQ,KAC5B,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAAE,CAAC,IAAI,GAAG;EAAS,CAAE,CAAC,CAAC,CAAC,CAC5F;AACH,CAAC","ignoreList":[]}

package/dist/net/Host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Host.d.ts","sourceRoot":"","sources":["../../src/net/Host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,KAAK,GAAG,MAAM,aAAa,CAAA;AACvC,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AACpC,OAAO,KAAK,IAAI,MAAM,YAAY,CAAA;AAClC,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAA;AAEhD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C,QAAA,MAAM,MAAM,EAAG,kBAA2B,CAAA;AAE1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAA;AAE7E;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,CAAA;AAEjD;;;;;;;;GAQG;AACH,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,iBAAiB,GAAG,UAAU,CAAA;AAEnF;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,UAAU,CAAC,cAAc,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAS,SAAQ,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,WAAW;IAC/E,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,MAAM,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAA;AA6C7D;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,MAAO,OAAO,KAAG,CAAC,IAAI,UAC2C,CAAA;AAE1F;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,MAAO,OAAO,KAAG,CAAC,IAAI,IAC0C,CAAA;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,MAAO,OAAO,KAAG,CAAC,IAAI,QAAkC,CAAA;AAE/E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,oBAAoB,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,eAAe,CAKxG,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,UAAW,MAAM,KAAG,UAA4D,CAAA;AAEvH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,UAAW,eAAe,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,eAAe,CACpF,CAAA;AAE7B;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,UAAW,eAAe,KAAG,UACpB,CAAA;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAQ5F,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UAAW,MAAM,KAAG,IAAgD,CAAA;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,UAAW,SAAS,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CACZ,CAAA;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,UAAW,SAAS,KAAG,IAA+C,CAAA;AAEtG;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,SAAU,IAAI,KAAG,MAAqE,CAAA;AAE7G;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,OAA6B,CAAA;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,UACM,CAAA;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,SAAU,UAAU,KAAG,UACsC,CAAA;AA6BpF;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,SAAU,IAAI,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,eAAe,CAIrG,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,SAAU,IAAI,QAAQ,MAAM,KAAG,QAAmD,CAAA;AAE7G;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,kBAAkB,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,eAAe,CAsBpG,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,UAAW,MAAM,KAAG,QAAwD,CAAA;AAEjH;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,eAAe,CAQ1G,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,UAAW,aAAa,KAAG,QAAuD,CAAA;AAEtH;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,SAAU,QAAQ,KAAG,MAG/C,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,qBAAqB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AAEjG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,UAiB7C,CAAA"}
+{"version":3,"file":"Host.d.ts","sourceRoot":"","sources":["../../src/net/Host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,KAAK,GAAG,MAAM,aAAa,CAAA;AACvC,OAAO,KAAK,KAAK,KAAK,MAAM,aAAa,CAAA;AACzC,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AACpC,OAAO,KAAK,IAAI,MAAM,YAAY,CAAA;AAClC,OAAO,KAAK,WAAW,MAAM,mBAAmB,CAAA;AAEhD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C,QAAA,MAAM,MAAM,EAAG,kBAA2B,CAAA;AAE1C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAA;AAE7E;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,CAAA;AAEjD;;;;;;;;GAQG;AACH,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,iBAAiB,GAAG,UAAU,CAAA;AAEnF;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,UAAU,CAAC,cAAc,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAS,SAAQ,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,WAAW;IAC/E,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,MAAM,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAA;AAwC7D;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,MAAO,OAAO,KAAG,CAAC,IAAI,UAC2C,CAAA;AAE1F;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,MAAO,OAAO,KAAG,CAAC,IAAI,IAC0C,CAAA;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,MAAO,OAAO,KAAG,CAAC,IAAI,QAAkC,CAAA;AAE/E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,oBAAoB,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,eAAe,CAKxG,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,UAAW,MAAM,KAAG,UAA4D,CAAA;AAEvH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,UAAW,eAAe,KAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,eAAe,CACpF,CAAA;AAE7B;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,UAAW,eAAe,KAAG,UACpB,CAAA;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CAQ5F,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UAAW,MAAM,KAAG,IAAgD,CAAA;AAErG;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,UAAW,SAAS,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,eAAe,CACZ,CAAA;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,UAAW,SAAS,KAAG,IAA+C,CAAA;AAEtG;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,SAAU,IAAI,KAAG,MAAqE,CAAA;AAE7G;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,OAA6B,CAAA;AAEjF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,SAAU,UAAU,KAAG,UACM,CAAA;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,SAAU,UAAU,KAAG,UACsC,CAAA;AA6BpF;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ,SAAU,IAAI,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,eAAe,CAIrG,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,SAAU,IAAI,QAAQ,MAAM,KAAG,QAAmD,CAAA;AAE7G;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,kBAAkB,UAAW,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,eAAe,CAsBpG,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,UAAW,MAAM,KAAG,QAAwD,CAAA;AAEjH;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,UAAW,aAAa,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,eAAe,CAQ1G,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,UAAW,aAAa,KAAG,QAAuD,CAAA;AAEtH;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,SAAU,QAAQ,KAAG,MAG/C,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,qBAAqB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AAEjG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,UAiB7C,CAAA"}

package/dist/net/Host.js

@@ -9,7 +9,8 @@ const hostError = (input, message) => Result.fail(new NetAddress.NetAddressError
   input,
   message
 }));
-const asciiNameCharacter = /^[a-z0-9_.-]$/i;
+const asciiName = /^[a-z0-9_.-]*$/i;
+const nonAscii = /[\u0080-\uffff]/g;
 const labelPattern = /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/;
 const numericLabel = /^(?:\d+|0x[0-9a-f]*)$/;
 const validateDomainName = name => {
@@ -31,15 +32,9 @@ const validateDomainName = name => {
   return undefined;
 };
 const toAsciiDomainName = input => {
-  let ascii = true;
-  for (const character of input) {
-    if (character.charCodeAt(0) < 0x80) {
-      if (!asciiNameCharacter.test(character)) return undefined;
-    } else {
-      ascii = false;
-    }
-  }
-  if (ascii) return input.toLowerCase();
+  if (asciiName.test(input)) return input.toLowerCase();
+  // Check the composed form, so that `=\u0338` is read as `≠`
+  if (!asciiName.test(input.normalize("NFC").replace(nonAscii, ""))) return undefined;
   try {
     return new URL(`http://${input}`).hostname;
   } catch {