lacewing 1.0.0

package/dist/types/src/types.d.ts

@@ -0,0 +1,196 @@
+/**
+ * A string that has been validated against the algorithm registry.
+ * `"none"` is unrepresentable (RFC 8725 §3.2).
+ */
+export type ValidAlg = string & {
+    readonly __alg: unique symbol;
+};
+/**
+ * Brand a string as a {@link ValidAlg}. Rejects `"none"` in any casing.
+ * Registry membership is enforced separately by `lib/algorithms.ts`;
+ * this brand only guarantees the value is not the `none` algorithm.
+ */
+export declare const SetAlg: (value: string) => ValidAlg;
+/**
+ * Seconds, branded so raw numbers must pass through {@link toSeconds}
+ * (or `parseDuration`) before being used as a duration.
+ */
+export type DurationSeconds = number & {
+    readonly __duration: unique symbol;
+};
+export declare function toSeconds(value: number): DurationSeconds;
+export interface JwtHeader {
+    alg: ValidAlg;
+    typ: string;
+    cty?: string;
+    kid?: string;
+}
+export interface JwtPayLoad {
+    iss: string;
+    sub?: string;
+    aud: string | string[];
+    jti?: string;
+    nbf?: number;
+    exp: number;
+    iat: number;
+    [propName: string]: unknown;
+}
+/** @internal Shared shape behind {@link VerifiedJwt} and {@link UntrustedJwt}. */
+type JwtShape = {
+    header: JwtHeader;
+    payload: JwtPayLoad;
+};
+/** Only ever produced by `jwtVerify` - proof that every check passed. */
+export type VerifiedJwt = JwtShape & {
+    readonly __brand: "VerifiedJwt";
+};
+/** Produced by `unsafeDecode` - type-incompatible with {@link VerifiedJwt}. */
+export type UntrustedJwt = JwtShape & {
+    readonly __brand: "UntrustedJwt";
+};
+declare const BrandSymbol: unique symbol;
+export type Branded<T, BrandName extends string> = T & {
+    readonly [BrandSymbol]: BrandName;
+};
+/**
+ * A key bound to exactly one algorithm at import time.
+ * The algorithm travels in the type parameter, so a `LacewingKey<"ES256">`
+ * cannot be passed where a `LacewingKey<"HS256">` is expected.
+ */
+export type LacewingKey<Alg extends string = string> = {
+    readonly __brand: "LacewingKey";
+    readonly algorithm: Alg & ValidAlg;
+    readonly keyType: "public" | "private" | "secret";
+    /** The underlying CryptoKey / raw secret. Internal - do not touch. */
+    readonly key: unknown;
+};
+/** Internal constructor - use `importKey` / `generateKeyPair` instead. */
+export declare function createLacewingKey<const Alg extends string>(algorithm: Alg & ValidAlg, keyType: "public" | "private" | "secret", key: unknown): LacewingKey<Alg>;
+export declare function isLacewingKey(value: unknown): value is LacewingKey;
+export type StaticJWK = {
+    kty: "RSA" | "EC" | "OKP" | "oct";
+    use?: "sig" | "enc";
+    alg?: string;
+    kid?: string;
+    [key: string]: unknown;
+};
+export type StaticJWKS = {
+    keys: StaticJWK[];
+};
+export type RemoteJWKS = {
+    jwksUri: string;
+    cacheTtlSeconds?: number;
+    cooldownSeconds?: number;
+    timeoutMs?: number;
+};
+export type JWKSConfig = StaticJWKS | RemoteJWKS;
+/** A key resolved by a {@link KeySource} for one specific token. */
+export interface ResolvedVerificationKey {
+    alg: ValidAlg;
+    key: unknown;
+}
+/**
+ * Anything that can produce a verification key for a token header.
+ * Implemented by `createLocalJWKSet` and `createRemoteJWKSet`.
+ */
+export interface KeySource {
+    getVerificationKey(header: JwtHeader, allowedAlgorithms: readonly ValidAlg[]): Promise<ResolvedVerificationKey>;
+}
+export interface TokenRevocationContext {
+    jti?: string;
+    sub?: string;
+    sid?: string;
+    exp: number;
+    iat: number;
+}
+export interface RevocationStore {
+    isRevoked(context: TokenRevocationContext): Promise<boolean>;
+    isAnyRevoked?(contexts: TokenRevocationContext[]): Promise<boolean[]>;
+}
+export type ValidateClaim = (claimValue: unknown, fullPayload: Record<string, unknown>) => void | Promise<void>;
+/**
+ * The claim-checking slice shared by the verify (JWS) and decrypt (JWE) paths.
+ * Both {@link ExpectedJwtProfile} and {@link ExpectedDecryptionProfile}
+ * satisfy it, so one claims engine serves both.
+ */
+export interface ClaimsPolicy {
+    iss: string;
+    aud: string;
+    maxTokenAge: DurationSeconds;
+    maxClockSkew: DurationSeconds;
+    subject?: string;
+    claimValidators?: Record<string, ValidateClaim>;
+}
+/**
+ * A key bound to exactly one JWE key-management algorithm at import time - the
+ * encryption counterpart of {@link LacewingKey}. Kept a distinct brand so an
+ * encryption key can never be handed to `SignJWT.sign`, nor a signing key to
+ * `EncryptJWT.encrypt`.
+ */
+export type LacewingEncryptionKey<Alg extends string = string> = {
+    readonly __brand: "LacewingEncryptionKey";
+    readonly algorithm: Alg & ValidAlg;
+    readonly keyType: "public" | "private" | "secret";
+    readonly key: unknown;
+};
+/** Internal constructor - use `importEncryptionKey` / `generateEncryptionKeyPair`. */
+export declare function createLacewingEncryptionKey<const Alg extends string>(algorithm: Alg & ValidAlg, keyType: "public" | "private" | "secret", key: unknown): LacewingEncryptionKey<Alg>;
+export declare function isLacewingEncryptionKey(value: unknown): value is LacewingEncryptionKey;
+/** A decrypted JWE's protected header (adds `enc` to the JWS header shape). */
+export interface JweHeader {
+    alg: ValidAlg;
+    enc: ValidAlg;
+    typ: string;
+    cty?: string;
+    kid?: string;
+}
+/**
+ * Only ever produced by `jwtDecrypt`: proof that a token decrypted (and thus
+ * authenticated by its AEAD) and passed every claim check. A distinct brand
+ * from {@link VerifiedJwt} - the two are not interchangeable.
+ */
+export type DecryptedJwt = {
+    header: JweHeader;
+    payload: JwtPayLoad;
+} & {
+    readonly __brand: "DecryptedJwt";
+};
+/**
+ * The security boundary for decryption - the JWE analogue of
+ * {@link ExpectedJwtProfile}. Built by `defineDecryptionProfile`, the only
+ * argument shape `jwtDecrypt` accepts.
+ */
+export interface ExpectedDecryptionProfile extends ClaimsPolicy {
+    typ: string;
+    /** Allowlist of key-management (`alg`) algorithms; the header never decides. */
+    keyManagementAlgorithms: readonly ValidAlg[];
+    /** Allowlist of content-encryption (`enc`) algorithms. */
+    contentEncryptionAlgorithms: readonly ValidAlg[];
+    /** The private/secret key that decrypts (scoped to this profile's issuer). */
+    key: LacewingEncryptionKey;
+    revocation?: RevocationStore;
+    unsafeFailOpenOnRevocationError?: boolean;
+}
+/**
+ * The security boundary for verification (RFC 8725 §3.12).
+ * Built by `defineProfile` - the only argument shape `jwtVerify` accepts.
+ */
+export interface ExpectedJwtProfile {
+    typ: string;
+    iss: string;
+    aud: string;
+    alg: readonly ValidAlg[];
+    keys: KeySource | LacewingKey;
+    maxTokenAge: DurationSeconds;
+    maxClockSkew: DurationSeconds;
+    revocation?: RevocationStore;
+    claimValidators?: Record<string, ValidateClaim>;
+    subject?: string;
+    /**
+     * Deliberately ugly escape hatch: when the revocation store errors,
+     * accept the token anyway instead of failing closed (LW-rev.4).
+     */
+    unsafeFailOpenOnRevocationError?: boolean;
+}
+export {};
+//# sourceMappingURL=types.d.ts.map

package/dist/types/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,MAAM,GAAI,OAAO,MAAM,KAAG,QAKtC,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAE9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAKxD;AAED,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,UAAU;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IACf,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AACzE,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3E,OAAO,CAAC,MAAM,WAAW,EAAE,OAAO,MAAM,CAAC;AACzC,MAAM,MAAM,OAAO,CAAC,CAAC,EAAE,SAAS,SAAS,MAAM,IAAI,CAAC,GAAG;IACtD,QAAQ,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC;CAClC,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,WAAW,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IACtD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,sEAAsE;IACtE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACzD,SAAS,EAAE,GAAG,GAAG,QAAQ,EACzB,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EACxC,GAAG,EAAE,OAAO,GACV,WAAW,CAAC,GAAG,CAAC,CAOlB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAMlE;AAED,MAAM,MAAM,SAAS,GAAG;IACvB,GAAG,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,CAAC;IAClC,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,SAAS,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjD,oEAAoE;AACpE,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACzB,kBAAkB,CACjB,MAAM,EAAE,SAAS,EACjB,iBAAiB,EAAE,SAAS,QAAQ,EAAE,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC/B,SAAS,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,YAAY,CAAC,CAAC,QAAQ,EAAE,sBAAsB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CACtE;AAED,MAAM,MAAM,aAAa,GAAG,CAC3B,UAAU,EAAE,OAAO,EACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAChC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,eAAe,CAAC;IAC7B,YAAY,EAAE,eAAe,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM,IAAI;IAChE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,GAAG,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IAClD,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,sFAAsF;AACtF,wBAAgB,2BAA2B,CAAC,KAAK,CAAC,GAAG,SAAS,MAAM,EACnE,SAAS,EAAE,GAAG,GAAG,QAAQ,EACzB,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,EACxC,GAAG,EAAE,OAAO,GACV,qBAAqB,CAAC,GAAG,CAAC,CAO5B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAMtF;AAED,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACzB,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;CACpB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,YAAY;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,uBAAuB,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC7C,0DAA0D;IAC1D,2BAA2B,EAAE,SAAS,QAAQ,EAAE,CAAC;IACjD,8EAA8E;IAC9E,GAAG,EAAE,qBAAqB,CAAC;IAC3B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,QAAQ,EAAE,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IAC9B,WAAW,EAAE,eAAe,CAAC;IAC7B,YAAY,EAAE,eAAe,CAAC;IAC9B,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAC;CAC1C"}

package/dist/types/src/util/errors.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Typed error hierarchy.
+ *
+ * Every error carries a machine-readable `code` so operators can branch on
+ * failure modes, while messages stay generic: security-relevant rejections
+ * never echo untrusted token content (no oracle for attackers, no log
+ * injection - RFC 8725 §3.10 hygiene).
+ */
+export declare abstract class JWTError extends Error {
+    abstract readonly code: string;
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Token structure or signature is invalid. */
+export declare class JWTInvalid extends JWTError {
+    readonly code = "JWT_INVALID";
+}
+/** Token is past `exp`, or older than the profile's `maxTokenAge`. */
+export declare class JWTExpired extends JWTError {
+    readonly code = "JWT_EXPIRED";
+}
+/** A claim is present but does not satisfy the profile's rules. */
+export declare class JWTClaimValidationFailed extends JWTError {
+    readonly code = "JWT_CLAIM_VALIDATION_FAILED";
+    /** Name of the offending claim (never its value). */
+    readonly claim: string;
+    constructor(claim: string, message: string, options?: {
+        cause?: unknown;
+    });
+}
+/** A claim required by the profile or by Lacewing policy is absent. */
+export declare class MissingClaim extends JWTError {
+    readonly code = "MISSING_CLAIM";
+    readonly claim: string;
+    constructor(claim: string, message?: string);
+}
+/** Algorithm is not in the registry / profile allowlist. */
+export declare class AlgorithmNotAllowed extends JWTError {
+    readonly code = "ALGORITHM_NOT_ALLOWED";
+}
+/** Key material could not be imported. */
+export declare class KeyImportFailed extends JWTError {
+    readonly code = "KEY_IMPORT_FAILED";
+}
+/** Key does not match the algorithm it is being used with. */
+export declare class KeyTypeMismatch extends JWTError {
+    readonly code = "KEY_TYPE_MISMATCH";
+}
+/** Key material could not be exported. */
+export declare class KeyExportFailed extends JWTError {
+    readonly code = "KEY_EXPORT_FAILED";
+}
+/** HMAC secret failed the strength checks (RFC 8725 §3.5). */
+export declare class EntropyCheckFailed extends JWTError {
+    readonly code = "ENTROPY_CHECK_FAILED";
+}
+/** Remote JWKS could not be fetched or parsed. */
+export declare class JWKSFetchFailed extends JWTError {
+    readonly code = "JWKS_FETCH_FAILED";
+}
+/** No key in the JWKS matches the token's header. */
+export declare class JWKSNoMatchingKey extends JWTError {
+    readonly code = "JWKS_NO_MATCHING_KEY";
+}
+/** Token is valid but its `jti` has been revoked (LW-rev.2). */
+export declare class JWTRevoked extends JWTError {
+    readonly code = "JWT_REVOKED";
+}
+/** The revocation store errored; Lacewing fails closed (LW-rev.4). */
+export declare class RevocationCheckFailed extends JWTError {
+    readonly code = "REVOCATION_CHECK_FAILED";
+}
+/** Sign-time payload hygiene scanner found sensitive data (LW-payload). */
+export declare class PayloadHygieneViolation extends JWTError {
+    readonly code = "PAYLOAD_HYGIENE_VIOLATION";
+    /** Name of the offending claim (never its value). */
+    readonly claim: string;
+    constructor(claim: string, message: string);
+}
+/** Requested token lifetime exceeds the configured cap (LW-life.1). */
+export declare class MaxLifetimeExceeded extends JWTError {
+    readonly code = "MAX_LIFETIME_EXCEEDED";
+}
+/** `Authorization` header failed strict RFC 6750 parsing (LW-http.2). */
+export declare class BearerParseFailed extends JWTError {
+    readonly code = "BEARER_PARSE_FAILED";
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/types/src/util/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/util/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,8BAAsB,QAAS,SAAQ,KAAK;IAC3C,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEnB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAI1D;AAED,+CAA+C;AAC/C,qBAAa,UAAW,SAAQ,QAAQ;IACvC,QAAQ,CAAC,IAAI,iBAAiB;CAC9B;AAED,sEAAsE;AACtE,qBAAa,UAAW,SAAQ,QAAQ;IACvC,QAAQ,CAAC,IAAI,iBAAiB;CAC9B;AAED,mEAAmE;AACnE,qBAAa,wBAAyB,SAAQ,QAAQ;IACrD,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAIzE;AAED,uEAAuE;AACvE,qBAAa,YAAa,SAAQ,QAAQ;IACzC,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAI3C;AAED,4DAA4D;AAC5D,qBAAa,mBAAoB,SAAQ,QAAQ;IAChD,QAAQ,CAAC,IAAI,2BAA2B;CACxC;AAED,0CAA0C;AAC1C,qBAAa,eAAgB,SAAQ,QAAQ;IAC5C,QAAQ,CAAC,IAAI,uBAAuB;CACpC;AAED,8DAA8D;AAC9D,qBAAa,eAAgB,SAAQ,QAAQ;IAC5C,QAAQ,CAAC,IAAI,uBAAuB;CACpC;AAED,0CAA0C;AAC1C,qBAAa,eAAgB,SAAQ,QAAQ;IAC5C,QAAQ,CAAC,IAAI,uBAAuB;CACpC;AAED,8DAA8D;AAC9D,qBAAa,kBAAmB,SAAQ,QAAQ;IAC/C,QAAQ,CAAC,IAAI,0BAA0B;CACvC;AAED,kDAAkD;AAClD,qBAAa,eAAgB,SAAQ,QAAQ;IAC5C,QAAQ,CAAC,IAAI,uBAAuB;CACpC;AAED,qDAAqD;AACrD,qBAAa,iBAAkB,SAAQ,QAAQ;IAC9C,QAAQ,CAAC,IAAI,0BAA0B;CACvC;AAED,gEAAgE;AAChE,qBAAa,UAAW,SAAQ,QAAQ;IACvC,QAAQ,CAAC,IAAI,iBAAiB;CAC9B;AAED,sEAAsE;AACtE,qBAAa,qBAAsB,SAAQ,QAAQ;IAClD,QAAQ,CAAC,IAAI,6BAA6B;CAC1C;AAED,2EAA2E;AAC3E,qBAAa,uBAAwB,SAAQ,QAAQ;IACpD,QAAQ,CAAC,IAAI,+BAA+B;IAC5C,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBAEX,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAI1C;AAED,uEAAuE;AACvE,qBAAa,mBAAoB,SAAQ,QAAQ;IAChD,QAAQ,CAAC,IAAI,2BAA2B;CACxC;AAED,yEAAyE;AACzE,qBAAa,iBAAkB,SAAQ,QAAQ;IAC9C,QAAQ,CAAC,IAAI,yBAAyB;CACtC"}

package/dist/types/src/util/unsafe-decode.d.ts

@@ -0,0 +1,21 @@
+/**
+ * DANGER: decode-without-verify, for debugging and inspection only.
+ */
+import type { UntrustedJwt } from "../types.js";
+/**
+ * DANGER: Decodes a JWT **without verifying the signature** and without
+ * validating a single claim - expired, forged and `alg: none` tokens all
+ * decode successfully. The returned {@link UntrustedJwt} is type-branded
+ * and incompatible with `VerifiedJwt`, so it cannot flow into
+ * authentication logic. Never base an auth decision on it.
+ *
+ * Legitimate uses: inspecting expired tokens while debugging, examining
+ * token structure without the key, observability of token contents.
+ * Since the token is unverified, fields the types mark mandatory may be
+ * absent at runtime.
+ *
+ * Throws only on malformed structure (base64url / UTF-8 / JSON) - never
+ * because a signature is missing or wrong.
+ */
+export declare function unsafeDecode(token: string): UntrustedJwt;
+//# sourceMappingURL=unsafe-decode.d.ts.map

package/dist/types/src/util/unsafe-decode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsafe-decode.d.ts","sourceRoot":"","sources":["../../../../src/util/unsafe-decode.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAyB,YAAY,EAAE,MAAM,aAAa,CAAC;AAQvE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAiBxD"}

package/package.json

@@ -0,0 +1,70 @@
+{
+	"name": "lacewing",
+	"version": "1.0.0",
+	"description": "An opinionated JWT library that makes RFC 8725 (JWT Best Current Practices) the default behavior, not an optional configuration.",
+	"type": "module",
+	"engines": {
+		"node": ">=24"
+	},
+	"main": "dist/index.js",
+	"types": "dist/types/index.d.ts",
+	"exports": {
+		".": {
+			"types": "./dist/types/index.d.ts",
+			"default": "./dist/index.js"
+		},
+		"./legacy/rs256": {
+			"types": "./dist/types/src/legacy/rs256.d.ts",
+			"default": "./dist/src/legacy/rs256.js"
+		},
+		"./legacy/rsa": {
+			"types": "./dist/types/src/legacy/rsa.d.ts",
+			"default": "./dist/src/legacy/rsa.js"
+		}
+	},
+	"scripts": {
+		"build": "tsc",
+		"typecheck": "tsc --noEmit",
+		"lint": "eslint .",
+		"lint:fix": "eslint . --fix",
+		"test": "node --import tsx --test \"tests/**/*.test.ts\"",
+		"test:tap": "node --import tsx --test --test-reporter=tap \"tests/**/*.test.ts\"",
+		"compliance": "node --import tsx tools/run-compliance.ts",
+		"demo": "node --import tsx examples/demo.ts",
+		"docs": "typedoc",
+		"changelog": "git-cliff -o CHANGELOG.md",
+		"prepare": "lefthook install",
+		"prepublishOnly": "npm run typecheck && npm run lint && npm test && npm run build"
+	},
+	"keywords": [
+		"jwt",
+		"jose",
+		"rfc8725",
+		"security",
+		"jwks",
+		"typescript"
+	],
+	"author": "Smiduweorc",
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/grMLEqomlkkU5Eeinz4brIrOVCUCkJuN/lacewing.git"
+	},
+	"devDependencies": {
+		"@commitlint/cli": "^21.2.1",
+		"@commitlint/config-conventional": "^21.2.0",
+		"@eslint/js": "^10.0.1",
+		"@types/node": "^26.1.1",
+		"eslint": "^10.7.0",
+		"fast-check": "^4.9.0",
+		"git-cliff": "^2.13.1",
+		"lefthook": "^2.1.10",
+		"tsx": "^4.23.0",
+		"typedoc": "^0.28.20",
+		"typescript": "^6.0.3",
+		"typescript-eslint": "^8.63.0"
+	},
+	"dependencies": {
+		"jose": "^6.2.3"
+	}
+}