lacewing 1.0.0

package/dist/src/util/errors.js

@@ -0,0 +1,96 @@
+/**
+ * Typed error hierarchy.
+ *
+ * Every error carries a machine-readable `code` so operators can branch on
+ * failure modes, while messages stay generic: security-relevant rejections
+ * never echo untrusted token content (no oracle for attackers, no log
+ * injection - RFC 8725 §3.10 hygiene).
+ */
+export class JWTError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = new.target.name;
+    }
+}
+/** Token structure or signature is invalid. */
+export class JWTInvalid extends JWTError {
+    code = "JWT_INVALID";
+}
+/** Token is past `exp`, or older than the profile's `maxTokenAge`. */
+export class JWTExpired extends JWTError {
+    code = "JWT_EXPIRED";
+}
+/** A claim is present but does not satisfy the profile's rules. */
+export class JWTClaimValidationFailed extends JWTError {
+    code = "JWT_CLAIM_VALIDATION_FAILED";
+    /** Name of the offending claim (never its value). */
+    claim;
+    constructor(claim, message, options) {
+        super(message, options);
+        this.claim = claim;
+    }
+}
+/** A claim required by the profile or by Lacewing policy is absent. */
+export class MissingClaim extends JWTError {
+    code = "MISSING_CLAIM";
+    claim;
+    constructor(claim, message) {
+        super(message ?? `Required claim "${claim}" is missing`);
+        this.claim = claim;
+    }
+}
+/** Algorithm is not in the registry / profile allowlist. */
+export class AlgorithmNotAllowed extends JWTError {
+    code = "ALGORITHM_NOT_ALLOWED";
+}
+/** Key material could not be imported. */
+export class KeyImportFailed extends JWTError {
+    code = "KEY_IMPORT_FAILED";
+}
+/** Key does not match the algorithm it is being used with. */
+export class KeyTypeMismatch extends JWTError {
+    code = "KEY_TYPE_MISMATCH";
+}
+/** Key material could not be exported. */
+export class KeyExportFailed extends JWTError {
+    code = "KEY_EXPORT_FAILED";
+}
+/** HMAC secret failed the strength checks (RFC 8725 §3.5). */
+export class EntropyCheckFailed extends JWTError {
+    code = "ENTROPY_CHECK_FAILED";
+}
+/** Remote JWKS could not be fetched or parsed. */
+export class JWKSFetchFailed extends JWTError {
+    code = "JWKS_FETCH_FAILED";
+}
+/** No key in the JWKS matches the token's header. */
+export class JWKSNoMatchingKey extends JWTError {
+    code = "JWKS_NO_MATCHING_KEY";
+}
+/** Token is valid but its `jti` has been revoked (LW-rev.2). */
+export class JWTRevoked extends JWTError {
+    code = "JWT_REVOKED";
+}
+/** The revocation store errored; Lacewing fails closed (LW-rev.4). */
+export class RevocationCheckFailed extends JWTError {
+    code = "REVOCATION_CHECK_FAILED";
+}
+/** Sign-time payload hygiene scanner found sensitive data (LW-payload). */
+export class PayloadHygieneViolation extends JWTError {
+    code = "PAYLOAD_HYGIENE_VIOLATION";
+    /** Name of the offending claim (never its value). */
+    claim;
+    constructor(claim, message) {
+        super(message);
+        this.claim = claim;
+    }
+}
+/** Requested token lifetime exceeds the configured cap (LW-life.1). */
+export class MaxLifetimeExceeded extends JWTError {
+    code = "MAX_LIFETIME_EXCEEDED";
+}
+/** `Authorization` header failed strict RFC 6750 parsing (LW-http.2). */
+export class BearerParseFailed extends JWTError {
+    code = "BEARER_PARSE_FAILED";
+}
+//# sourceMappingURL=errors.js.map

package/dist/src/util/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/util/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,OAAgB,QAAS,SAAQ,KAAK;IAG3C,YAAY,OAAe,EAAE,OAA6B;QACzD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;IAC7B,CAAC;CACD;AAED,+CAA+C;AAC/C,MAAM,OAAO,UAAW,SAAQ,QAAQ;IAC9B,IAAI,GAAG,aAAa,CAAC;CAC9B;AAED,sEAAsE;AACtE,MAAM,OAAO,UAAW,SAAQ,QAAQ;IAC9B,IAAI,GAAG,aAAa,CAAC;CAC9B;AAED,mEAAmE;AACnE,MAAM,OAAO,wBAAyB,SAAQ,QAAQ;IAC5C,IAAI,GAAG,6BAA6B,CAAC;IAC9C,qDAAqD;IAC5C,KAAK,CAAS;IAEvB,YAAY,KAAa,EAAE,OAAe,EAAE,OAA6B;QACxE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AAED,uEAAuE;AACvE,MAAM,OAAO,YAAa,SAAQ,QAAQ;IAChC,IAAI,GAAG,eAAe,CAAC;IACvB,KAAK,CAAS;IAEvB,YAAY,KAAa,EAAE,OAAgB;QAC1C,KAAK,CAAC,OAAO,IAAI,mBAAmB,KAAK,cAAc,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AAED,4DAA4D;AAC5D,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IACvC,IAAI,GAAG,uBAAuB,CAAC;CACxC;AAED,0CAA0C;AAC1C,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IACnC,IAAI,GAAG,mBAAmB,CAAC;CACpC;AAED,8DAA8D;AAC9D,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IACnC,IAAI,GAAG,mBAAmB,CAAC;CACpC;AAED,0CAA0C;AAC1C,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IACnC,IAAI,GAAG,mBAAmB,CAAC;CACpC;AAED,8DAA8D;AAC9D,MAAM,OAAO,kBAAmB,SAAQ,QAAQ;IACtC,IAAI,GAAG,sBAAsB,CAAC;CACvC;AAED,kDAAkD;AAClD,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IACnC,IAAI,GAAG,mBAAmB,CAAC;CACpC;AAED,qDAAqD;AACrD,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IACrC,IAAI,GAAG,sBAAsB,CAAC;CACvC;AAED,gEAAgE;AAChE,MAAM,OAAO,UAAW,SAAQ,QAAQ;IAC9B,IAAI,GAAG,aAAa,CAAC;CAC9B;AAED,sEAAsE;AACtE,MAAM,OAAO,qBAAsB,SAAQ,QAAQ;IACzC,IAAI,GAAG,yBAAyB,CAAC;CAC1C;AAED,2EAA2E;AAC3E,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IAC3C,IAAI,GAAG,2BAA2B,CAAC;IAC5C,qDAAqD;IAC5C,KAAK,CAAS;IAEvB,YAAY,KAAa,EAAE,OAAe;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AAED,uEAAuE;AACvE,MAAM,OAAO,mBAAoB,SAAQ,QAAQ;IACvC,IAAI,GAAG,uBAAuB,CAAC;CACxC;AAED,yEAAyE;AACzE,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IACrC,IAAI,GAAG,qBAAqB,CAAC;CACtC"}

package/dist/src/util/unsafe-decode.js

@@ -0,0 +1,45 @@
+/**
+ * DANGER: decode-without-verify, for debugging and inspection only.
+ */
+import { JWTInvalid } from "./errors.js";
+import { decodeBase64url } from "../lib/base64url.js";
+import { decodeUTF8 } from "../lib/utf8.js";
+import { parseJsonObject } from "../lib/json.js";
+const MAX_TOKEN_LENGTH = 16384;
+function parseSegment(segment, what) {
+    return parseJsonObject(decodeUTF8(decodeBase64url(segment)), what);
+}
+/**
+ * DANGER: Decodes a JWT **without verifying the signature** and without
+ * validating a single claim - expired, forged and `alg: none` tokens all
+ * decode successfully. The returned {@link UntrustedJwt} is type-branded
+ * and incompatible with `VerifiedJwt`, so it cannot flow into
+ * authentication logic. Never base an auth decision on it.
+ *
+ * Legitimate uses: inspecting expired tokens while debugging, examining
+ * token structure without the key, observability of token contents.
+ * Since the token is unverified, fields the types mark mandatory may be
+ * absent at runtime.
+ *
+ * Throws only on malformed structure (base64url / UTF-8 / JSON) - never
+ * because a signature is missing or wrong.
+ */
+export function unsafeDecode(token) {
+    if (typeof token !== "string" || token.length === 0) {
+        throw new JWTInvalid("Token must be a non-empty string");
+    }
+    if (token.length > MAX_TOKEN_LENGTH) {
+        throw new JWTInvalid("Token exceeds the maximum length");
+    }
+    const segments = token.split(".");
+    if (segments.length !== 3) {
+        throw new JWTInvalid("Token must have exactly three segments");
+    }
+    const [rawHeader, rawPayload] = segments;
+    // Deliberately no allowlist, typ, or kid checks here - this is a raw
+    // view of untrusted data, and the brand says exactly that.
+    const header = parseSegment(rawHeader, "header");
+    const payload = parseSegment(rawPayload, "payload");
+    return { header, payload };
+}
+//# sourceMappingURL=unsafe-decode.js.map

package/dist/src/util/unsafe-decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafe-decode.js","sourceRoot":"","sources":["../../../src/util/unsafe-decode.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGjD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,SAAS,YAAY,CAAC,OAAe,EAAE,IAAY;IAClD,OAAO,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,QAAoC,CAAC;IACrE,qEAAqE;IACrE,2DAA2D;IAC3D,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAyB,CAAC;IACzE,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,SAAS,CAA0B,CAAC;IAC7E,OAAO,EAAE,MAAM,EAAE,OAAO,EAAkB,CAAC;AAC5C,CAAC"}

package/dist/types/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Lacewing - an opinionated JWT library where RFC 8725 (JWT Best Current
+ * Practices) is the default behavior, not an optional configuration.
+ *
+ * This barrel is the public API. Internals under `src/lib/` are policy
+ * machinery and stay private; legacy interop algorithms live behind the
+ * explicit `lacewing/legacy/*` imports.
+ */
+export { defineProfile, type ProfileOptions } from "./src/jwt/profile.js";
+export { jwtVerify } from "./src/jwt/verify.js";
+export { SignJWT, type SignJwtOptions } from "./src/jwt/sign.js";
+export { EncryptJWT, type EncryptJwtOptions } from "./src/jwt/encrypt.js";
+export { jwtDecrypt } from "./src/jwt/decrypt.js";
+export { defineDecryptionProfile, type DecryptionProfileOptions, } from "./src/jwt/decryption_profile.js";
+export { generateEncryptionKeyPair, generateEncryptionSecret, generateDirectKey, importEncryptionKey, type EncryptionKeyMaterial, type GenerateEncryptionKeyPairOptions, } from "./src/key/encryption.js";
+export { accessTokenProfile, refreshTokenProfile, newAccessToken, newRefreshToken, ACCESS_TOKEN_TYP, REFRESH_TOKEN_TYP, type TokenProfileOptions, } from "./src/cookbook/access-refresh.js";
+export { importKey, type KeyMaterial } from "./src/key/import.js";
+export { generateKeyPair, generateSecret, type GenerateKeyPairOptions, } from "./src/key/generate.js";
+export { exportKeyJWK, exportKeyPEM } from "./src/key/export.js";
+export { createLocalJWKSet } from "./src/jwks/local.js";
+export { createRemoteJWKSet, type RemoteJWKSetOptions } from "./src/jwks/remote.js";
+export { buildRevocationContext } from "./src/revocation/store.js";
+export { MemoryRevocationStore } from "./src/revocation/memory.js";
+export { buildTokenCookie, setTokenCookie, clearTokenCookie, readTokenCookie, type TokenCookieOptions, } from "./src/http/cookies.js";
+export { parseBearer } from "./src/http/bearer.js";
+export { unsafeDecode } from "./src/util/unsafe-decode.js";
+export { JWTError, JWTInvalid, JWTExpired, JWTClaimValidationFailed, MissingClaim, AlgorithmNotAllowed, KeyImportFailed, KeyExportFailed, KeyTypeMismatch, EntropyCheckFailed, JWKSFetchFailed, JWKSNoMatchingKey, JWTRevoked, RevocationCheckFailed, PayloadHygieneViolation, MaxLifetimeExceeded, BearerParseFailed, } from "./src/util/errors.js";
+export { toSeconds, type ClaimsPolicy, type DecryptedJwt, type DurationSeconds, type ExpectedDecryptionProfile, type ExpectedJwtProfile, type JweHeader, type JwtHeader, type LacewingEncryptionKey, type JwtPayLoad, type JWKSConfig, type KeySource, type LacewingKey, type RemoteJWKS, type ResolvedVerificationKey, type RevocationStore, type StaticJWK, type StaticJWKS, type TokenRevocationContext, type UntrustedJwt, type ValidAlg, type ValidateClaim, type VerifiedJwt, } from "./src/types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,aAAa,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGjE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACN,uBAAuB,EACvB,KAAK,wBAAwB,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACN,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gCAAgC,GACrC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,mBAAmB,GACxB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EACN,eAAe,EACf,cAAc,EACd,KAAK,sBAAsB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGnE,OAAO,EACN,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,KAAK,kBAAkB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG3D,OAAO,EACN,QAAQ,EACR,UAAU,EACV,UAAU,EACV,wBAAwB,EACxB,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,UAAU,EACV,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACN,SAAS,EACT,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,WAAW,GAChB,MAAM,gBAAgB,CAAC"}

package/dist/types/src/cookbook/access-refresh.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Cookbook: access tokens vs refresh tokens (LW-kind.1).
+ *
+ * The single most common token-confusion bug is letting a refresh token buy
+ * access to an API (or letting a stolen access token mint new sessions). RFC
+ * 8725 §3.12 says the validation rules for different kinds of JWT must be
+ * mutually exclusive; Lacewing makes that concrete by shipping the two
+ * profiles rather than leaving them as an exercise.
+ *
+ * The separation is enforced on three axes at once:
+ *
+ *  | | access | refresh |
+ *  |---|---|---|
+ *  | `typ` | `at+jwt` | `rt+jwt` |
+ *  | audience | the API | the auth server's token endpoint |
+ *  | lifetime | minutes (default 10m) | days (default 30d) |
+ *  | key source | usually a public JWKS | usually a private, server-only key |
+ *  | revocation | optional | **strongly recommended** |
+ *
+ * `typ` alone is load-bearing: even with identical keys, claims and audience,
+ * each profile refuses the other's tokens. The rest is defense in depth.
+ *
+ * @example
+ * ```ts
+ * import { accessTokenProfile, refreshTokenProfile, newAccessToken } from "lacewing";
+ *
+ * const api = accessTokenProfile({
+ *   issuer: "https://auth.example.com",
+ *   audience: "https://api.example.com",
+ *   algorithms: ["EdDSA"],
+ *   keys: { jwksUri: "https://auth.example.com/jwks" },
+ * });
+ *
+ * const token = await newAccessToken()
+ *   .issuer("https://auth.example.com")
+ *   .audience("https://api.example.com")
+ *   .subject("user-42")
+ *   .expiresIn("10m")
+ *   .sign(privateKey);
+ * ```
+ */
+import { type ProfileOptions } from "../jwt/profile.js";
+import { SignJWT } from "../jwt/sign.js";
+import type { ExpectedJwtProfile } from "../types.js";
+/** The `typ` of an OAuth 2.0 JWT access token (RFC 9068). */
+export declare const ACCESS_TOKEN_TYP = "at+jwt";
+/** The `typ` Lacewing uses for refresh tokens - anything but the access `typ`. */
+export declare const REFRESH_TOKEN_TYP = "rt+jwt";
+/**
+ * Everything a cookbook profile needs except the `typ`, which is fixed by the
+ * factory. `maxTokenAge` becomes optional here - each kind has a sane default.
+ */
+export type TokenProfileOptions = Omit<ProfileOptions, "typ" | "maxTokenAge"> & {
+    /** Defaults to 10m for access tokens, 30d for refresh tokens. */
+    maxTokenAge?: number | string;
+};
+/**
+ * An access-token profile: short-lived, audience-scoped to your API, and
+ * pinned to `typ: "at+jwt"`. Verifies tokens presented by clients.
+ */
+export declare function accessTokenProfile(options: TokenProfileOptions): ExpectedJwtProfile;
+/**
+ * A refresh-token profile: long-lived, audience-scoped to the *auth server*
+ * (never the API), and pinned to `typ: "rt+jwt"`. Pass a `revocation` store -
+ * a long-lived token you cannot revoke is a long-lived incident.
+ */
+export declare function refreshTokenProfile(options: TokenProfileOptions): ExpectedJwtProfile;
+/** A {@link SignJWT} builder pre-set to the access-token `typ` and a 1h cap. */
+export declare function newAccessToken(): SignJWT;
+/**
+ * A {@link SignJWT} builder pre-set to the refresh-token `typ`. The cap is
+ * raised to 90d because that is the point of a refresh token - but the
+ * lifetime you actually pass to `.expiresIn()` should be as short as your UX
+ * tolerates, and the token should be revocable.
+ */
+export declare function newRefreshToken(): SignJWT;
+//# sourceMappingURL=access-refresh.d.ts.map

package/dist/types/src/cookbook/access-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-refresh.d.ts","sourceRoot":"","sources":["../../../../src/cookbook/access-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAK1C;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,aAAa,CAAC,GAAG;IAC/E,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,CAMnF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,CAMpF;AAED,gFAAgF;AAChF,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC"}

package/dist/types/src/http/bearer.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Strict `Authorization: Bearer` parsing (RFC 6750 §2.1, LW-http.2).
+ *
+ * Deliberately unsupported: tokens in query strings (they leak through
+ * logs and the Referer header), multiple tokens, alternate casings and
+ * whitespace tricks. One header, one scheme, one token.
+ */
+/**
+ * Extract the bearer token from an `Authorization` header. Accepts a
+ * `Headers` object, anything with a `.headers` (e.g. `Request`), or the
+ * raw header value. Throws {@link BearerParseFailed} on anything that
+ * isn't exactly one well-formed `Bearer <token>`.
+ *
+ * Note: when multiple `Authorization` headers were sent, `Headers`
+ * joins them with `", "` - which this parser rejects, by design.
+ */
+export declare function parseBearer(source: Headers | {
+    headers: Headers;
+} | string | null | undefined): string;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/types/src/http/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../../../src/http/bearer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAC1B,MAAM,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAChE,MAAM,CAsBR"}

package/dist/types/src/http/cookies.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Cookie transport helpers (LW-http.1).
+ *
+ * The paved road for browser token storage: `HttpOnly; Secure; SameSite`
+ * are always emitted and cannot be configured away - weaker cookies are
+ * unrepresentable. `localStorage`/`sessionStorage` are script-readable
+ * and therefore one XSS away from token theft; don't put tokens there.
+ *
+ * Framework-agnostic: works on WHATWG `Headers` (and anything exposing
+ * them, e.g. `Request`/`Response`).
+ */
+export interface TokenCookieOptions {
+    /** Cookie name (default `__Host-token`, the most locked-down prefix). */
+    name?: string;
+    /** `None` is not an option - cross-site token cookies are how CSRF happens. */
+    sameSite?: "Strict" | "Lax";
+    /** Default `/` (mandatory for `__Host-` names). */
+    path?: string;
+    /** Cookie lifetime; omit for a session cookie. */
+    maxAgeSeconds?: number;
+    /** Not allowed with `__Host-` names. */
+    domain?: string;
+}
+/** Build a hardened `Set-Cookie` value. Prefer {@link setTokenCookie}. */
+export declare function buildTokenCookie(token: string, options?: TokenCookieOptions): string;
+/** Append a hardened token cookie to a response's headers. */
+export declare function setTokenCookie(headers: Headers, token: string, options?: TokenCookieOptions): void;
+/** Expire a previously set token cookie. */
+export declare function clearTokenCookie(headers: Headers, options?: Pick<TokenCookieOptions, "name" | "path" | "domain">): void;
+/**
+ * Read a token cookie from a request. Accepts a `Headers` object,
+ * anything with a `.headers` (e.g. `Request`), or the raw `Cookie`
+ * header string. Returns `undefined` when absent or malformed.
+ */
+export declare function readTokenCookie(source: Headers | {
+    headers: Headers;
+} | string | null | undefined, name?: string): string | undefined;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/types/src/http/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../../src/http/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,kBAAkB;IAClC,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC5B,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,MAAM,CAwCxF;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC9B,IAAI,CAEN;AAED,4CAA4C;AAC5C,wBAAgB,gBAAgB,CAC/B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAM,GAChE,IAAI,CAKN;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC9B,MAAM,EAAE,OAAO,GAAG;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EAClE,IAAI,GAAE,MAA4B,GAChC,MAAM,GAAG,SAAS,CAoBpB"}

package/dist/types/src/jwks/local.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Static (local) JWK Sets.
+ *
+ * Selection is registry-driven: entries whose `kty`/`alg`/`crv` fall
+ * outside what the token's (already allowlisted) algorithm requires are
+ * never candidates. `kid` values arriving here have already been
+ * sanitized by header validation (§3.10).
+ */
+import type { JwtHeader, KeySource, ResolvedVerificationKey, StaticJWK, StaticJWKS } from "../types.js";
+/** Shared selection + import used by both local and remote sets. */
+export declare function resolveFromJwks(keys: readonly StaticJWK[], header: JwtHeader): Promise<ResolvedVerificationKey>;
+/** Validate the developer-supplied JWKS document shape (config error -> TypeError). */
+export declare function validateJwksShape(jwks: unknown): StaticJWK[];
+/** Create a {@link KeySource} backed by a static JWKS document. */
+export declare function createLocalJWKSet(jwks: StaticJWKS): KeySource;
+//# sourceMappingURL=local.d.ts.map

package/dist/types/src/jwks/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../../../src/jwks/local.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,OAAO,KAAK,EACX,SAAS,EACT,SAAS,EACT,uBAAuB,EACvB,SAAS,EACT,UAAU,EACV,MAAM,aAAa,CAAC;AAYrB,oEAAoE;AACpE,wBAAsB,eAAe,CACpC,IAAI,EAAE,SAAS,SAAS,EAAE,EAC1B,MAAM,EAAE,SAAS,GACf,OAAO,CAAC,uBAAuB,CAAC,CA+BlC;AAED,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,SAAS,EAAE,CAsB5D;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,CAO7D"}

package/dist/types/src/jwks/remote.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Remote JWK Sets with caching and rotation.
+ *
+ * - HTTPS-only URLs; redirects are never followed
+ * - caches with a configurable TTL and honors `Cache-Control: max-age`
+ * - cooldown between refetches (no attacker-driven fetch storms)
+ * - refetches once on unknown `kid` (key rotation), then fails closed
+ * - response size is capped; entries outside the registry are dropped
+ */
+import type { KeySource } from "../types.js";
+export interface RemoteJWKSetOptions {
+    /** Cache lifetime when the response has no usable Cache-Control (default 300s). */
+    cacheTtlSeconds?: number;
+    /** Minimum interval between fetch attempts (default 30s). */
+    cooldownSeconds?: number;
+    /** Fetch timeout (default 5000ms). */
+    timeoutMs?: number;
+    /** Fetch implementation override - intended for tests. */
+    fetch?: typeof fetch;
+}
+/** Create a {@link KeySource} that fetches and caches a remote JWKS. */
+export declare function createRemoteJWKSet(url: URL | string, options?: RemoteJWKSetOptions): KeySource;
+//# sourceMappingURL=remote.d.ts.map

package/dist/types/src/jwks/remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../../../src/jwks/remote.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAEX,SAAS,EAGT,MAAM,aAAa,CAAC;AAQrB,MAAM,WAAW,mBAAmB;IACnC,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACrB;AASD,wEAAwE;AACxE,wBAAgB,kBAAkB,CACjC,GAAG,EAAE,GAAG,GAAG,MAAM,EACjB,OAAO,GAAE,mBAAwB,GAC/B,SAAS,CA8FX"}

package/dist/types/src/jwt/decrypt.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The one and only decryption path (the JWE analogue of `jwtVerify`).
+ *
+ * Order of operations, fail-fast, all-or-nothing:
+ *   1. structural parse (5 segments, length cap, strict base64url/UTF-8/JSON)
+ *   2. header validation (alg + enc allowlists, typ, kid hygiene, forbidden
+ *      params - including `zip`, the JWE decompression-bomb vector)
+ *   3. decryption with the profile's key, restricted to the allowlisted alg+enc
+ *   4. claims validation
+ *   5. revocation check - last, so unauthenticated input can never drive the
+ *      store (LW-rev.3)
+ *
+ * A JWS (three segments) handed here is rejected at step 1, and a JWE handed to
+ * `jwtVerify` is rejected there in turn - the two formats never cross over.
+ */
+import { type DecryptedJwt, type ExpectedDecryptionProfile } from "../types.js";
+/**
+ * Decrypt and validate a compact JWE against a profile. The returned
+ * {@link DecryptedJwt} is the only way to obtain one - there is no backdoor,
+ * and it is a distinct type from a `VerifiedJwt` (the signed-token proof).
+ */
+export declare function jwtDecrypt(token: string, profile: ExpectedDecryptionProfile): Promise<DecryptedJwt>;
+//# sourceMappingURL=decrypt.d.ts.map

package/dist/types/src/jwt/decrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../../src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAG9B,MAAM,aAAa,CAAC;AAgDrB;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GAChC,OAAO,CAAC,YAAY,CAAC,CA4DvB"}

package/dist/types/src/jwt/decryption_profile.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Decryption profiles - the JWE analogue of `defineProfile`. A profile is the
+ * only argument shape `jwtDecrypt` accepts, which makes `typ`, issuer,
+ * audience, the two algorithm allowlists, and the decrypting key structurally
+ * mandatory. The key belongs to the profile, which belongs to an issuer.
+ */
+import { type ExpectedDecryptionProfile, type LacewingEncryptionKey, type RevocationStore, type ValidateClaim } from "../types.js";
+export interface DecryptionProfileOptions {
+    /** Expected token type, e.g. `"at+jwt"`. */
+    typ: string;
+    /** The one issuer this profile trusts. */
+    issuer: string;
+    /** The audience value that must appear in the token. */
+    audience: string;
+    /** Explicit key-management (`alg`) allowlist - the header never decides. */
+    keyManagementAlgorithms: readonly string[];
+    /** Explicit content-encryption (`enc`) allowlist. */
+    contentEncryptionAlgorithms: readonly string[];
+    /** The private/secret key that decrypts (bound to one key-management alg). */
+    key: LacewingEncryptionKey;
+    /** Maximum accepted token age, independent of `exp`. */
+    maxTokenAge: number | string;
+    /** Allowed clock skew, default 5s, capped at 120s. */
+    maxClockSkew?: number | string;
+    revocation?: RevocationStore;
+    claimValidators?: Record<string, ValidateClaim>;
+    subject?: string;
+    unsafeFailOpenOnRevocationError?: boolean;
+}
+/** Build the security boundary that `jwtDecrypt` enforces. */
+export declare function defineDecryptionProfile(options: DecryptionProfileOptions): ExpectedDecryptionProfile;
+//# sourceMappingURL=decryption_profile.d.ts.map

package/dist/types/src/jwt/decryption_profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decryption_profile.d.ts","sourceRoot":"","sources":["../../../../src/jwt/decryption_profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAGN,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,wBAAwB;IACxC,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,qDAAqD;IACrD,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,8EAA8E;IAC9E,GAAG,EAAE,qBAAqB,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AASD,8DAA8D;AAC9D,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,yBAAyB,CAuDpG"}

package/dist/types/src/jwt/encrypt.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The encrypted-JWT builder - the JWE counterpart of `SignJWT`.
+ *
+ * Same claim discipline: `typ` is a constructor argument, `.encrypt()` refuses
+ * to run without `iss`, `aud` and `exp` (each waivable only via a grep-loud
+ * `unsafeAllowMissing*`), every token gets a unique `jti`, and lifetimes are
+ * capped. The one deliberate difference from signing: there is **no** payload
+ * hygiene scanner - the whole point of encryption is that the payload is not
+ * readable plaintext, so embedding a secret is exactly the supported use.
+ */
+import { type LacewingEncryptionKey } from "../types.js";
+export interface EncryptJwtOptions {
+    /** Cap on `.expiresIn()`. Default 1h - raising it is a visible choice. */
+    maxLifetime?: number | string;
+    /** Content-encryption algorithm (`enc`). Default `A256GCM`. */
+    contentEncryption?: string;
+}
+export declare class EncryptJWT {
+    #private;
+    constructor(typ: string, options?: EncryptJwtOptions);
+    issuer(iss: string): this;
+    audience(aud: string | string[]): this;
+    subject(sub: string): this;
+    /** Override the auto-assigned `jti`. Uniqueness is then your problem. */
+    jwtId(jti: string): this;
+    expiresIn(duration: number | string): this;
+    notBefore(duration: number | string): this;
+    claim(name: string, value: unknown): this;
+    unsafeAllowMissingIssuer(): this;
+    unsafeAllowMissingAudience(): this;
+    unsafeAllowMissingExpiration(): this;
+    encrypt(key: LacewingEncryptionKey): Promise<string>;
+}
+//# sourceMappingURL=encrypt.d.ts.map

package/dist/types/src/jwt/encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../../../src/jwt/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,EAAiD,KAAK,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAMxG,MAAM,WAAW,iBAAiB;IACjC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,UAAU;;gBAeV,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB;IAWxD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMzB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IAStC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM1B,yEAAyE;IACzE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMxB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAO1C,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAK1C,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IASzC,wBAAwB,IAAI,IAAI;IAKhC,0BAA0B,IAAI,IAAI;IAKlC,4BAA4B,IAAI,IAAI;IAK9B,OAAO,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC;CA4C1D"}

package/dist/types/src/jwt/profile.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Verification profiles - the RFC 8725 §3.12 mechanism and the library's
+ * signature API.
+ *
+ * A profile is the *only* argument shape `jwtVerify` accepts, which makes
+ * `typ`, issuer, audience, and the algorithm allowlist structurally
+ * mandatory. The key source belongs to the profile, which belongs to an
+ * issuer - that is the §3.8 issuer-to-key binding.
+ */
+import { type ExpectedJwtProfile, type KeySource, type LacewingKey, type RemoteJWKS, type RevocationStore, type StaticJWKS, type ValidateClaim } from "../types.js";
+export interface ProfileOptions {
+    /** Expected token type, e.g. `"at+jwt"` (§3.11). */
+    typ: string;
+    /** The one issuer this profile trusts (§3.8). */
+    issuer: string;
+    /** The audience value that must appear in the token (§3.9). */
+    audience: string;
+    /** Explicit algorithm allowlist - the token header never decides (§3.1). */
+    algorithms: readonly string[];
+    /** Key source: a JWKS (static or remote config), a KeySource, or a single key. */
+    keys: KeySource | LacewingKey | StaticJWKS | RemoteJWKS;
+    /** Maximum accepted token age, independent of `exp`. */
+    maxTokenAge: number | string;
+    /** Allowed clock skew, default 5s, capped at 120s. */
+    maxClockSkew?: number | string;
+    /** Optional revocation store - its absence is a visible choice. */
+    revocation?: RevocationStore;
+    /** Extra per-claim predicates, run after all standard checks. */
+    claimValidators?: Record<string, ValidateClaim>;
+    /** Pin the expected `sub` (§3.8.2). */
+    subject?: string;
+    /** Ugly on purpose: accept tokens when the revocation store errors (LW-rev.4). */
+    unsafeFailOpenOnRevocationError?: boolean;
+}
+/** Build the security boundary that `jwtVerify` enforces. */
+export declare function defineProfile(options: ProfileOptions): ExpectedJwtProfile;
+//# sourceMappingURL=profile.d.ts.map

package/dist/types/src/jwt/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/jwt/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,EAGN,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AAKrB,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,kFAAkF;IAClF,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;IACxD,wDAAwD;IACxD,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,mEAAmE;IACnE,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AA+CD,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,kBAAkB,CAmDzE"}

package/dist/types/src/jwt/sign.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The sign builder.
+ *
+ * `.sign()` refuses to produce a token unless `typ` (constructor), `iss`,
+ * `aud` and `exp` are set - each requirement individually waivable only
+ * via a grep-loud `unsafeAllowMissing*` call. Every token gets a unique
+ * `jti`, lifetimes are capped, and the payload hygiene scanner runs as
+ * the final step before signing.
+ */
+import { type LacewingKey } from "../types.js";
+export interface SignJwtOptions {
+    /**
+     * Cap on `.expiresIn()`. Default 1h - raising it is a
+     * deliberate, visible configuration choice.
+     */
+    maxLifetime?: number | string;
+}
+/**
+ * Fluent builder for a signed JWT. `typ` is a constructor argument, and
+ * `.sign()` refuses to run without `issuer`, `audience` and `expiresIn`
+ * (each waivable only via a grep-loud `unsafeAllowMissing*` call).
+ *
+ * @example
+ * ```ts
+ * const token = await new SignJWT("at+jwt")
+ *   .issuer("https://auth.example.com")
+ *   .audience("https://api.example.com")
+ *   .subject("user-42")
+ *   .claim("scope", "read")
+ *   .expiresIn("10m")
+ *   .sign(privateKey);
+ * ```
+ */
+export declare class SignJWT {
+    #private;
+    /** Explicit typing is mandatory (§3.11): the `typ` is a constructor argument. */
+    constructor(typ: string, options?: SignJwtOptions);
+    issuer(iss: string): this;
+    audience(aud: string | string[]): this;
+    subject(sub: string): this;
+    /** Override the auto-assigned `jti`. Uniqueness is then your problem. */
+    jwtId(jti: string): this;
+    /** Token lifetime from now, e.g. `"10m"` or `600`. Capped by maxLifetime. */
+    expiresIn(duration: number | string): this;
+    /** Delay validity by `duration` from now (`nbf`). */
+    notBefore(duration: number | string): this;
+    /** Set a custom claim. Registered claims must use their dedicated methods. */
+    claim(name: string, value: unknown): this;
+    /** Waive the payload hygiene scanner for one claim (LW-payload). Grep for this in review. */
+    unsafeAllowClaim(name: string): this;
+    /** Waive the mandatory `iss`. Grep for this in review. */
+    unsafeAllowMissingIssuer(): this;
+    /** Waive the mandatory `aud`. Grep for this in review. */
+    unsafeAllowMissingAudience(): this;
+    /** Waive the mandatory `exp`. Grep for this in review. */
+    unsafeAllowMissingExpiration(): this;
+    sign(key: LacewingKey): Promise<string>;
+}
+//# sourceMappingURL=sign.d.ts.map

package/dist/types/src/jwt/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../../src/jwt/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,OAAO,EAAuC,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAQpF,MAAM,WAAW,cAAc;IAC9B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,OAAO;;IAenB,iFAAiF;gBACrE,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB;IAUrD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQzB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IAStC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQ1B,yEAAyE;IACzE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQxB,6EAA6E;IAC7E,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAS1C,qDAAqD;IACrD,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAK1C,8EAA8E;IAC9E,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAazC,6FAA6F;IAC7F,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKpC,0DAA0D;IAC1D,wBAAwB,IAAI,IAAI;IAKhC,0DAA0D;IAC1D,0BAA0B,IAAI,IAAI;IAKlC,0DAA0D;IAC1D,4BAA4B,IAAI,IAAI;IAK9B,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CAgD7C"}