life-as-api 0.2.0

package/dist/auth/in-memory-grant-resolver.d.ts

@@ -0,0 +1,21 @@
+import type { Clock, GrantDescriptor, GrantResolver } from "./types.js";
+/** Grant record for InMemoryGrantResolver. */
+export interface GrantRecord {
+    readonly grantId: string;
+    readonly agentId: string;
+    readonly tenantId: string;
+    readonly notBefore: string;
+    readonly notAfter: string;
+    readonly status: "active" | "revoked";
+    readonly personId?: string;
+}
+/** @remarks TEST/DEV ONLY — not for production use. */
+export declare class InMemoryGrantResolver implements GrantResolver {
+    private readonly _grants;
+    private readonly _clock;
+    private readonly _failWith;
+    constructor(grants: ReadonlyArray<GrantRecord>, clock: Clock, opts?: {
+        readonly failWith?: Error;
+    });
+    resolveActiveGrant(agentId: string, grantId: string, tenantId: string): Promise<GrantDescriptor | undefined>;
+}

package/dist/auth/in-memory-grant-resolver.js

@@ -0,0 +1,73 @@
+// TEST/DEV ONLY — InMemoryGrantResolver (Production-02a).
+// Do NOT export from src/index.ts. Do NOT use in production.
+//
+// AUTH_GRANT_ACTIVE_CHECKED_001: resolveActiveGrant fires before every AgentConsentContext mint.
+// AUTH_GRANT_REVOKED_DENIED_001: revoked grants return undefined — never active.
+// AUTH_GRANT_EXPIRED_DENIED_001: grants where clock.now() >= notAfter return undefined.
+// AUTH_GRANT_TENANT_SCOPE_ENFORCED_001: grant tenantId must match requesting tenantId.
+// AUTH_GRANT_AGENT_SCOPE_ENFORCED_001: grant agentId must match requesting agentId.
+//
+// All denial cases return undefined (no existence leak):
+//   missing, revoked, expired, not-yet-active, tenant mismatch, agent mismatch → undefined
+//
+// Storage-failure behavior: if constructed with failWith, resolveActiveGrant throws that error
+//   — storage errors must never be silently converted to undefined.
+//   A real backend storage failure is not the same as "no active grant."
+import { asPersonId } from "../types/ids.js";
+/** @remarks TEST/DEV ONLY — not for production use. */
+export class InMemoryGrantResolver {
+    _grants;
+    _clock;
+    _failWith;
+    constructor(grants, clock, opts) {
+        const map = new Map();
+        for (const g of grants) {
+            map.set(g.grantId, g);
+        }
+        this._grants = map;
+        this._clock = clock;
+        this._failWith = opts?.failWith;
+    }
+    async resolveActiveGrant(agentId, grantId, tenantId) {
+        // Storage-failure simulation — must throw, not return undefined
+        if (this._failWith !== undefined) {
+            throw this._failWith;
+        }
+        const record = this._grants.get(grantId);
+        // Missing grant — return undefined (no existence leak)
+        if (record === undefined) {
+            return undefined;
+        }
+        // AUTH_GRANT_AGENT_SCOPE_ENFORCED_001: agentId must match
+        if (record.agentId !== agentId) {
+            return undefined;
+        }
+        // AUTH_GRANT_TENANT_SCOPE_ENFORCED_001: tenantId must match
+        if (record.tenantId !== tenantId) {
+            return undefined;
+        }
+        // AUTH_GRANT_REVOKED_DENIED_001: revoked grants are permanently denied
+        if (record.status === "revoked") {
+            return undefined;
+        }
+        const now = this._clock.now();
+        // Not-yet-active: before notBefore
+        if (now < record.notBefore) {
+            return undefined;
+        }
+        // AUTH_GRANT_EXPIRED_DENIED_001: expired at or after notAfter
+        if (now >= record.notAfter) {
+            return undefined;
+        }
+        // AUTH_GRANT_ACTIVE_CHECKED_001: all checks passed — return descriptor
+        return {
+            grantId: record.grantId,
+            agentId: record.agentId,
+            tenantId: record.tenantId,
+            notAfter: record.notAfter,
+            // exactOptionalPropertyTypes: omit the property entirely when absent.
+            ...(record.personId !== undefined ? { personId: asPersonId(record.personId) } : {}),
+        };
+    }
+}
+//# sourceMappingURL=in-memory-grant-resolver.js.map

package/dist/auth/in-memory-grant-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-grant-resolver.js","sourceRoot":"","sources":["../../src/auth/in-memory-grant-resolver.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,6DAA6D;AAC7D,EAAE;AACF,iGAAiG;AACjG,iFAAiF;AACjF,wFAAwF;AACxF,uFAAuF;AACvF,oFAAoF;AACpF,EAAE;AACF,yDAAyD;AACzD,2FAA2F;AAC3F,EAAE;AACF,+FAA+F;AAC/F,oEAAoE;AACpE,yEAAyE;AAGzE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAa7C,uDAAuD;AACvD,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAqC;IAC5C,MAAM,CAAW;IACjB,SAAS,CAAoB;IAE9C,YACE,MAAkC,EAClC,KAAa,EACb,IAAqC;QAErC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,OAAO,GAAK,GAAG,CAAC;QACrB,IAAI,CAAC,MAAM,GAAM,KAAK,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,QAAQ,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAgB,EAChB,OAAgB,EAChB,QAAgB;QAEhB,gEAAgE;QAChE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,SAAS,CAAC;QACvB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEzC,uDAAuD;QACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,0DAA0D;QAC1D,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,4DAA4D;QAC5D,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,uEAAuE;QACvE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAE9B,mCAAmC;QACnC,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,8DAA8D;QAC9D,IAAI,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,uEAAuE;QACvE,OAAO;YACL,OAAO,EAAG,MAAM,CAAC,OAAO;YACxB,OAAO,EAAG,MAAM,CAAC,OAAO;YACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,sEAAsE;YACtE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAC;IACJ,CAAC;CACF"}

package/dist/auth/in-memory-tenant-boundary.d.ts

@@ -0,0 +1,16 @@
+import type { TenantBoundary } from "./types.js";
+/** Membership record for InMemoryTenantBoundary. */
+export interface TenantMembership {
+    readonly tenantId: string;
+    readonly personId: string;
+    readonly status: "active" | "suspended";
+}
+/** @remarks TEST/DEV ONLY — not for production use. */
+export declare class InMemoryTenantBoundary implements TenantBoundary {
+    private readonly _memberships;
+    private readonly _failWith;
+    constructor(memberships: ReadonlyArray<TenantMembership>, opts?: {
+        readonly failWith?: Error;
+    });
+    assertOwnership(tenantId: string, personId: string): Promise<void>;
+}

package/dist/auth/in-memory-tenant-boundary.js

@@ -0,0 +1,37 @@
+// TEST/DEV ONLY — InMemoryTenantBoundary (Production-02a).
+// Do NOT export from src/index.ts. Do NOT use in production.
+//
+// AUTH_TENANT_OWNERSHIP_CHECKED_001: assertOwnership fires before every OwnerContext mint.
+// AUTH_TENANT_OWNERSHIP_DENIED_001: thrown for missing, suspended, or tenant-mismatch.
+// AUTH_TENANT_SUBJECT_NOT_FOUND_SAFE_001: missing and suspended produce identical error
+//   — caller cannot distinguish non-existence from suspension (no enumeration leak).
+//
+// Storage-failure behavior: if constructed with failWith, assertOwnership throws that error
+//   rather than returning or falling through — storage errors must not masquerade as denials.
+/** @remarks TEST/DEV ONLY — not for production use. */
+export class InMemoryTenantBoundary {
+    _memberships;
+    _failWith;
+    constructor(memberships, opts) {
+        const map = new Map();
+        for (const m of memberships) {
+            map.set(`${m.tenantId}:${m.personId}`, m);
+        }
+        this._memberships = map;
+        this._failWith = opts?.failWith;
+    }
+    async assertOwnership(tenantId, personId) {
+        // AUTH_TENANT_OWNERSHIP_CHECKED_001: always fires; never falls through on error
+        if (this._failWith !== undefined) {
+            throw this._failWith;
+        }
+        const record = this._memberships.get(`${tenantId}:${personId}`);
+        // AUTH_TENANT_SUBJECT_NOT_FOUND_SAFE_001:
+        // Missing and suspended produce the same code — no enumeration leak.
+        if (record === undefined || record.status !== "active") {
+            throw Object.assign(new Error("AUTH_TENANT_OWNERSHIP_DENIED_001: subject is not an active member of the tenant"), { code: "AUTH_TENANT_OWNERSHIP_DENIED_001" });
+        }
+        // AUTH_TENANT_OWNERSHIP_CHECKED_001: resolves void on success
+    }
+}
+//# sourceMappingURL=in-memory-tenant-boundary.js.map

package/dist/auth/in-memory-tenant-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-tenant-boundary.js","sourceRoot":"","sources":["../../src/auth/in-memory-tenant-boundary.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,6DAA6D;AAC7D,EAAE;AACF,2FAA2F;AAC3F,uFAAuF;AACvF,wFAAwF;AACxF,qFAAqF;AACrF,EAAE;AACF,4FAA4F;AAC5F,8FAA8F;AAW9F,uDAAuD;AACvD,MAAM,OAAO,sBAAsB;IAChB,YAAY,CAAwC;IACpD,SAAS,CAAuB;IAEjD,YACE,WAA4C,EAC5C,IAAoC;QAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,EAA4B,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC;QACxB,IAAI,CAAC,SAAS,GAAO,IAAI,EAAE,QAAQ,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAgB,EAAE,QAAgB;QACtD,gFAAgF;QAChF,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,SAAS,CAAC;QACvB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;QAEhE,0CAA0C;QAC1C,qEAAqE;QACrE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CACP,iFAAiF,CAClF,EACD,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAC7C,CAAC;QACJ,CAAC;QACD,8DAA8D;IAChE,CAAC;CACF"}

package/dist/auth/jwks-key-ring-auth-adapter.d.ts

@@ -0,0 +1,38 @@
+import type { AuthAdapter, VerifiedPrincipal } from "./types.js";
+import type { HttpClient } from "./http-client.js";
+/**
+ * Host-supplied synchronous function that maps a validated external JWT payload
+ * to a VerifiedPrincipal. Called only after signature, exp, nbf, iss, aud verified.
+ * Must throw if mapping is not possible; error is caught and re-thrown as
+ * EXTERNAL_IDP_CLAIM_MAPPER_THREW_001 (original message is NOT propagated).
+ */
+export type ClaimMapper = (payload: Record<string, unknown>) => VerifiedPrincipal;
+export interface JwksKeyRingAuthAdapterConfig {
+    /** Full HTTPS URL to the JWKS endpoint. */
+    readonly jwksUri: string;
+    /** Expected iss claim — exact string match required. */
+    readonly issuer: string;
+    /** Expected aud claim — string or array; at least one must appear in JWT aud. */
+    readonly audience: string | readonly string[];
+    /** Signing algorithm. Only "RS256" is valid. */
+    readonly algorithm: "RS256";
+    /** Host-supplied claim mapper. Must not be async. */
+    readonly claimMapper: ClaimMapper;
+    /** HTTP client used for JWKS fetch. Host-supplied — no default bundled. */
+    readonly httpClient: HttpClient;
+    /** JWKS cache TTL in seconds. Default: 3600. */
+    readonly cacheTtlSeconds?: number;
+    /** JWKS fetch timeout in milliseconds. Default: 5000. */
+    readonly fetchTimeoutMs?: number;
+    /** Maximum JWKS response size in bytes. Default: 65536. */
+    readonly maxJwksByteSize?: number;
+}
+export declare class JwksKeyRingAuthAdapter implements AuthAdapter {
+    private readonly _issuer;
+    private readonly _audience;
+    private readonly _mapper;
+    private readonly _ring;
+    constructor(config: JwksKeyRingAuthAdapterConfig);
+    verify(credential: string): Promise<VerifiedPrincipal>;
+    private _validateAudience;
+}

package/dist/auth/jwks-key-ring-auth-adapter.js

@@ -0,0 +1,123 @@
+// src/auth/jwks-key-ring-auth-adapter.ts
+// INTERNAL — not exported from src/index.ts.
+// RS256 AuthAdapter backed by a live JWKS endpoint.
+// Algorithm: RS256 only. alg:none always rejected. kid required.
+//
+// CRYPTO_BOUNDARY_ONLY_001: does NOT import crypto primitives at runtime.
+// All crypto is delegated to jwt-core.ts (verifyRsaSig).
+//
+// AUTH_FACTORY_AUTH_ADAPTER_OPAQUE_001: the production factory does not
+// import this file. It is the host's responsibility to construct and inject.
+//
+// See docs/specs/post-mvp-external-idp-oidc-spec.md §7
+// KeyObject not imported here — verifyRsaSig is called with inferred type from jwt-core
+import { JwksKeyRing } from "./jwks-key-ring.js";
+import { throwErr, splitJwt, parseJsonObject, verifyRsaSig, } from "./jwt-core.js";
+// ─── JwksKeyRingAuthAdapter ───────────────────────────────────────────────────
+export class JwksKeyRingAuthAdapter {
+    _issuer;
+    _audience;
+    _mapper;
+    _ring;
+    constructor(config) {
+        // Construction-time validation
+        if (config.algorithm !== "RS256") {
+            throwErr("EXTERNAL_IDP_ALG_UNSUPPORTED_001", "only RS256 is supported");
+        }
+        if (!config.jwksUri.startsWith("https://")) {
+            throwErr("EXTERNAL_IDP_JWKS_URI_INSECURE_001", "jwksUri must use HTTPS");
+        }
+        if (!config.issuer) {
+            throwErr("EXTERNAL_IDP_ISSUER_EMPTY_001", "issuer must be a non-empty string");
+        }
+        const aud = Array.isArray(config.audience) ? config.audience : [config.audience];
+        if (aud.length === 0 || (aud.length === 1 && aud[0] === "")) {
+            throwErr("EXTERNAL_IDP_AUDIENCE_EMPTY_001", "audience must be a non-empty value");
+        }
+        this._issuer = config.issuer;
+        this._audience = aud;
+        this._mapper = config.claimMapper;
+        this._ring = new JwksKeyRing({
+            jwksUri: config.jwksUri,
+            httpClient: config.httpClient,
+            cacheTtlMs: (config.cacheTtlSeconds ?? 3600) * 1000,
+            fetchTimeoutMs: config.fetchTimeoutMs ?? 5000,
+            maxBytes: config.maxJwksByteSize ?? 65536,
+        });
+    }
+    async verify(credential) {
+        // Step 1 — Split JWT into exactly 3 segments
+        const [rawHeader, rawPayload, rawSig] = splitJwt(credential);
+        // Step 2 — Decode and parse header
+        const h = parseJsonObject(rawHeader, "header");
+        // Step 3 — Algorithm enforcement: alg:none always rejected; then binding check
+        const alg = h["alg"];
+        if (typeof alg === "string" && alg.toLowerCase() === "none") {
+            throwErr("EXTERNAL_IDP_ALG_NONE_REJECTED_001", "alg:none is not accepted");
+        }
+        if (alg !== "RS256") {
+            throwErr("EXTERNAL_IDP_ALG_MISMATCH_001", "unsupported algorithm; RS256 required");
+        }
+        // Step 4 — kid required
+        const kid = h["kid"];
+        if (typeof kid !== "string" || kid.length === 0) {
+            throwErr("EXTERNAL_IDP_KID_REQUIRED_001", "kid header is required and must be a non-empty string");
+        }
+        // Step 5 — Resolve public key (at-most-one JWKS fetch per verify call)
+        const publicKey = await this._ring.getPublicKey(kid);
+        if (publicKey === undefined) {
+            throwErr("EXTERNAL_IDP_KID_NOT_FOUND_001", "kid not found in JWKS");
+        }
+        // Step 6 — RS256 signature verification (delegates to jwt-core; no crypto import here)
+        verifyRsaSig(rawSig, rawHeader + "." + rawPayload, publicKey);
+        // Step 7 — Decode and parse payload
+        const p = parseJsonObject(rawPayload, "payload");
+        // Step 8 — Validate iss (exact match)
+        if (p["iss"] !== this._issuer) {
+            throwErr("EXTERNAL_IDP_ISSUER_MISMATCH_001", "iss does not match expected issuer");
+        }
+        // Step 9 — Validate aud
+        this._validateAudience(p["aud"]);
+        // Step 10 — Validate exp
+        const expRaw = p["exp"];
+        if (typeof expRaw !== "number") {
+            throwErr("EXTERNAL_IDP_TOKEN_EXPIRED_001", "exp claim is absent or not a number");
+        }
+        if (expRaw * 1000 <= Date.now()) {
+            throwErr("EXTERNAL_IDP_TOKEN_EXPIRED_001", "token has expired");
+        }
+        // Step 11 — Validate nbf (if present)
+        if ("nbf" in p) {
+            const nbfRaw = p["nbf"];
+            if (typeof nbfRaw !== "number") {
+                throwErr("EXTERNAL_IDP_TOKEN_NOT_YET_VALID_001", "nbf claim is not a number");
+            }
+            if (nbfRaw * 1000 > Date.now()) {
+                throwErr("EXTERNAL_IDP_TOKEN_NOT_YET_VALID_001", "token is not yet valid");
+            }
+        }
+        // Step 12 — Claim mapping (host-supplied; error message must not propagate)
+        let principal;
+        try {
+            principal = this._mapper(p);
+        }
+        catch {
+            throwErr("EXTERNAL_IDP_CLAIM_MAPPER_THREW_001", "claim mapper failed");
+        }
+        return principal;
+    }
+    // ─── Private helpers ──────────────────────────────────────────────────────
+    _validateAudience(jwtAud) {
+        const jwtAudArr = typeof jwtAud === "string" ? [jwtAud] :
+            Array.isArray(jwtAud) ? jwtAud :
+                [];
+        if (jwtAudArr.length === 0) {
+            throwErr("EXTERNAL_IDP_AUDIENCE_MISMATCH_001", "aud claim is absent or invalid");
+        }
+        const hasMatch = this._audience.some(a => jwtAudArr.includes(a));
+        if (!hasMatch) {
+            throwErr("EXTERNAL_IDP_AUDIENCE_MISMATCH_001", "aud does not include a configured audience value");
+        }
+    }
+}
+//# sourceMappingURL=jwks-key-ring-auth-adapter.js.map

package/dist/auth/jwks-key-ring-auth-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-key-ring-auth-adapter.js","sourceRoot":"","sources":["../../src/auth/jwks-key-ring-auth-adapter.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,6CAA6C;AAC7C,oDAAoD;AACpD,iEAAiE;AACjE,EAAE;AACF,0EAA0E;AAC1E,yDAAyD;AACzD,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,EAAE;AACF,uDAAuD;AAIvD,wFAAwF;AACxF,OAAO,EAAE,WAAW,EAAE,MAA8B,oBAAoB,CAAC;AACzE,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,YAAY,GACb,MAAM,eAAe,CAAC;AAmCvB,iFAAiF;AAEjF,MAAM,OAAO,sBAAsB;IAChB,OAAO,CAAW;IAClB,SAAS,CAAoB;IAC7B,OAAO,CAAgB;IACvB,KAAK,CAAkB;IAExC,YAAY,MAAoC;QAC9C,+BAA+B;QAC/B,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YACjC,QAAQ,CAAC,kCAAkC,EAAE,yBAAyB,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,oCAAoC,EAAE,wBAAwB,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,QAAQ,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,iCAAiC,EAAE,oCAAoC,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,OAAO,GAAK,MAAM,CAAC,MAAM,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACrB,IAAI,CAAC,OAAO,GAAK,MAAM,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,KAAK,GAAO,IAAI,WAAW,CAAC;YAC/B,OAAO,EAAS,MAAM,CAAC,OAAO;YAC9B,UAAU,EAAM,MAAM,CAAC,UAAU;YACjC,UAAU,EAAM,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC,GAAG,IAAI;YACvD,cAAc,EAAE,MAAM,CAAC,cAAc,IAAK,IAAI;YAC9C,QAAQ,EAAQ,MAAM,CAAC,eAAe,IAAI,KAAK;SAChD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,6CAA6C;QAC7C,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE7D,mCAAmC;QACnC,MAAM,CAAC,GAAG,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAE/C,+EAA+E;QAC/E,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YAC5D,QAAQ,CAAC,oCAAoC,EAAE,0BAA0B,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,+BAA+B,EAAE,uCAAuC,CAAC,CAAC;QACrF,CAAC;QAED,wBAAwB;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,+BAA+B,EAAE,uDAAuD,CAAC,CAAC;QACrG,CAAC;QAED,uEAAuE;QACvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,gCAAgC,EAAE,uBAAuB,CAAC,CAAC;QACtE,CAAC;QAED,uFAAuF;QACvF,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,GAAG,GAAG,UAAU,EAAE,SAAS,CAAC,CAAC;QAE9D,oCAAoC;QACpC,MAAM,CAAC,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEjD,sCAAsC;QACtC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,QAAQ,CAAC,kCAAkC,EAAE,oCAAoC,CAAC,CAAC;QACrF,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAEjC,yBAAyB;QACzB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,gCAAgC,EAAE,qCAAqC,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChC,QAAQ,CAAC,gCAAgC,EAAE,mBAAmB,CAAC,CAAC;QAClE,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,QAAQ,CAAC,sCAAsC,EAAE,2BAA2B,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC/B,QAAQ,CAAC,sCAAsC,EAAE,wBAAwB,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,IAAI,SAA4B,CAAC;QACjC,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,qCAAqC,EAAE,qBAAqB,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6EAA6E;IAErE,iBAAiB,CAAC,MAAe;QACvC,MAAM,SAAS,GACb,OAAO,MAAM,KAAK,QAAQ,CAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAE,CAAC;YACzC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAO,CAAC,CAAC,MAAM,CAAI,CAAC;gBACzC,EAAE,CAAC;QAEL,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,oCAAoC,EAAE,gCAAgC,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CAAC,oCAAoC,EAAE,kDAAkD,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;CACF"}

package/dist/auth/jwks-key-ring.d.ts

@@ -0,0 +1,25 @@
+import type { KeyObject } from "./jwt-core.js";
+import type { HttpClient } from "./http-client.js";
+export interface JwksKeyRingConfig {
+    readonly jwksUri: string;
+    readonly httpClient: HttpClient;
+    readonly cacheTtlMs: number;
+    readonly fetchTimeoutMs: number;
+    readonly maxBytes: number;
+}
+export declare class JwksKeyRing {
+    private readonly _config;
+    private _cache;
+    constructor(config: JwksKeyRingConfig);
+    /**
+     * Resolve the public key for the given kid.
+     * Cache hit (within TTL): returns immediately.
+     * Cache miss / expired: triggers at-most-one JWKS fetch, then looks up again.
+     * Returns undefined if kid is not found after fetch.
+     * Throws EXTERNAL_IDP_JWKS_FETCH_FAILED_001 or EXTERNAL_IDP_JWKS_PARSE_ERROR_001 on error.
+     */
+    getPublicKey(kid: string): Promise<KeyObject | undefined>;
+    /** Force cache invalidation and re-fetch. */
+    forceRefresh(): Promise<void>;
+    private _fetchAndPopulate;
+}

package/dist/auth/jwks-key-ring.js

@@ -0,0 +1,111 @@
+// src/auth/jwks-key-ring.ts
+// INTERNAL — not exported from src/index.ts.
+// In-memory JWKS key cache with TTL and at-most-one-fetch-per-call semantics.
+//
+// CRYPTO_BOUNDARY_ONLY_001: does NOT import crypto primitives at runtime.
+// All RSA key operations are delegated to importRsaPublicKey() in jwt-core.ts.
+//
+// See docs/specs/post-mvp-external-idp-oidc-spec.md §7.3, §7.4
+import { importRsaPublicKey, throwErr } from "./jwt-core.js";
+// ─── JwksKeyRing ─────────────────────────────────────────────────────────────
+export class JwksKeyRing {
+    _config;
+    _cache;
+    constructor(config) {
+        this._config = config;
+        this._cache = new Map();
+    }
+    /**
+     * Resolve the public key for the given kid.
+     * Cache hit (within TTL): returns immediately.
+     * Cache miss / expired: triggers at-most-one JWKS fetch, then looks up again.
+     * Returns undefined if kid is not found after fetch.
+     * Throws EXTERNAL_IDP_JWKS_FETCH_FAILED_001 or EXTERNAL_IDP_JWKS_PARSE_ERROR_001 on error.
+     */
+    async getPublicKey(kid) {
+        const now = Date.now();
+        const cached = this._cache.get(kid);
+        if (cached !== undefined && cached.expiresAtMs > now) {
+            return cached.publicKey;
+        }
+        // Cache miss or expired — fetch once
+        await this._fetchAndPopulate();
+        const fresh = this._cache.get(kid);
+        if (fresh !== undefined && fresh.expiresAtMs > now) {
+            return fresh.publicKey;
+        }
+        return undefined;
+    }
+    /** Force cache invalidation and re-fetch. */
+    async forceRefresh() {
+        this._cache.clear();
+        await this._fetchAndPopulate();
+    }
+    // ─── Private ───────────────────────────────────────────────────────────────
+    async _fetchAndPopulate() {
+        const { jwksUri, httpClient, fetchTimeoutMs, maxBytes, cacheTtlMs } = this._config;
+        // Fetch JWKS endpoint
+        let responseText;
+        try {
+            responseText = await httpClient.getText(jwksUri, { timeoutMs: fetchTimeoutMs, maxBytes });
+        }
+        catch {
+            throwErr("EXTERNAL_IDP_JWKS_FETCH_FAILED_001", "JWKS fetch failed");
+        }
+        // Belt-and-suspenders size guard (in case client doesn't enforce maxBytes)
+        if (responseText.length > maxBytes) {
+            throwErr("EXTERNAL_IDP_JWKS_FETCH_FAILED_001", "JWKS response exceeds maximum allowed size");
+        }
+        // Parse JSON
+        let parsed;
+        try {
+            parsed = JSON.parse(responseText);
+        }
+        catch {
+            throwErr("EXTERNAL_IDP_JWKS_PARSE_ERROR_001", "JWKS response is not valid JSON");
+        }
+        if (typeof parsed !== "object" || parsed === null || !("keys" in parsed)) {
+            throwErr("EXTERNAL_IDP_JWKS_PARSE_ERROR_001", "JWKS response missing keys field");
+        }
+        const keysField = parsed.keys;
+        if (!Array.isArray(keysField)) {
+            throwErr("EXTERNAL_IDP_JWKS_PARSE_ERROR_001", "JWKS keys is not an array");
+        }
+        const expiresAtMs = Date.now() + cacheTtlMs;
+        let imported = 0;
+        for (const raw of keysField) {
+            if (typeof raw !== "object" || raw === null)
+                continue;
+            const entry = raw;
+            // Only RSA signing keys
+            if (entry["kty"] !== "RSA")
+                continue;
+            const useField = entry["use"];
+            if (useField !== undefined && useField !== "sig")
+                continue;
+            const kidField = entry["kid"];
+            if (typeof kidField !== "string" || kidField.length === 0)
+                continue;
+            // Delegate RSA key import to jwt-core (CRYPTO_BOUNDARY_ONLY_001)
+            // importRsaPublicKey throws on malformed or weak keys — catch and skip.
+            let publicKey;
+            try {
+                publicKey = importRsaPublicKey(entry);
+            }
+            catch (err) {
+                // Re-throw EXTERNAL_IDP_PUBLIC_KEY_TOO_SMALL_001 (security invariant) but skip parse errors.
+                if (err instanceof Error &&
+                    err.code === "EXTERNAL_IDP_PUBLIC_KEY_TOO_SMALL_001") {
+                    throw err;
+                }
+                continue; // skip malformed entries; keep trying remaining keys
+            }
+            this._cache.set(kidField, { publicKey, expiresAtMs });
+            imported++;
+        }
+        if (imported === 0) {
+            throwErr("EXTERNAL_IDP_JWKS_PARSE_ERROR_001", "JWKS contains no valid RSA signing keys");
+        }
+    }
+}
+//# sourceMappingURL=jwks-key-ring.js.map

package/dist/auth/jwks-key-ring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-key-ring.js","sourceRoot":"","sources":["../../src/auth/jwks-key-ring.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,6CAA6C;AAC7C,8EAA8E;AAC9E,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,EAAE;AACF,+DAA+D;AAI/D,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAmB7D,gFAAgF;AAEhF,MAAM,OAAO,WAAW;IACL,OAAO,CAAqB;IAC5B,MAAM,CAA2B;IAElD,YAAY,MAAyB;QACnC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAI,IAAI,GAAG,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,GAAG,GAAO,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;YACrD,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;QACD,qCAAqC;QACrC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,GAAG,GAAG,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC,SAAS,CAAC;QACzB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED,8EAA8E;IAEtE,KAAK,CAAC,iBAAiB;QAC7B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEnF,sBAAsB;QACtB,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,oCAAoC,EAAE,mBAAmB,CAAC,CAAC;QACtE,CAAC;QAED,2EAA2E;QAC3E,IAAI,YAAY,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;YACnC,QAAQ,CAAC,oCAAoC,EAAE,4CAA4C,CAAC,CAAC;QAC/F,CAAC;QAED,aAAa;QACb,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,mCAAmC,EAAE,iCAAiC,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC;YACzE,QAAQ,CAAC,mCAAmC,EAAE,kCAAkC,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,SAAS,GAAI,MAAqC,CAAC,IAAI,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,mCAAmC,EAAE,2BAA2B,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;QAC5C,IAAM,QAAQ,GAAM,CAAC,CAAC;QAEtB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;gBAAE,SAAS;YAEtD,MAAM,KAAK,GAAG,GAA8B,CAAC;YAE7C,wBAAwB;YACxB,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK;gBAAE,SAAS;YACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,KAAK;gBAAE,SAAS;YAE3D,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAEpE,iEAAiE;YACjE,wEAAwE;YACxE,IAAI,SAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,6FAA6F;gBAC7F,IACE,GAAG,YAAY,KAAK;oBACnB,GAAiC,CAAC,IAAI,KAAK,uCAAuC,EACnF,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,SAAS,CAAC,qDAAqD;YACjE,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;YACtD,QAAQ,EAAE,CAAC;QACb,CAAC;QAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,mCAAmC,EAAE,yCAAyC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;CACF"}

package/dist/auth/jwt-auth-adapter.d.ts

@@ -0,0 +1,15 @@
+import type { AuthAdapter, Clock, VerifiedPrincipal } from "./types.js";
+export interface JwtAuthAdapterConfig {
+    readonly secret: Uint8Array;
+    readonly expectedIssuer: string;
+    readonly expectedAudience: string;
+    readonly clock?: Clock;
+}
+export declare class JwtAuthAdapter implements AuthAdapter {
+    private readonly _secret;
+    private readonly _issuer;
+    private readonly _audience;
+    private readonly _clock;
+    constructor(config: JwtAuthAdapterConfig);
+    verify(credential: string): Promise<VerifiedPrincipal>;
+}

package/dist/auth/jwt-auth-adapter.js

@@ -0,0 +1,59 @@
+// src/auth/jwt-auth-adapter.ts
+// TEST/DEV in Production-03-a — NOT exported from src/index.ts.
+// Single-secret HS256 adapter. Cryptographic helpers live in jwt-core.ts
+// (the credential-verification crypto boundary).
+//
+// AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001    ✅ Production-03-a
+// AUTH_CREDENTIAL_MALFORMED_001             ✅ Production-03-a
+// AUTH_CREDENTIAL_ALGORITHM_UNSUPPORTED_001 ✅ Production-03-a
+// AUTH_CREDENTIAL_KEY_ID_UNKNOWN_001        ✅ Production-03-a
+// AUTH_CREDENTIAL_SIGNATURE_INVALID_001     ✅ Production-03-a
+// AUTH_CREDENTIAL_TIME_CLAIM_INVALID_001    ✅ Production-03-a
+// AUTH_CREDENTIAL_EXPIRED_001               ✅ Production-03-a
+// AUTH_CREDENTIAL_NOT_YET_VALID_001         ✅ Production-03-a
+// AUTH_CREDENTIAL_ISSUER_INVALID_001        ✅ Production-03-a
+// AUTH_CREDENTIAL_AUDIENCE_INVALID_001      ✅ Production-03-a
+// AUTH_CREDENTIAL_CLAIM_MISSING_001         ✅ Production-03-a
+// AUTH_CREDENTIAL_CLAIM_INVALID_001         ✅ Production-03-a
+import { throwErr, MIN_SECRET_BYTES, splitJwt, parseJsonObject, assertAlgHS256, verifyHmacSig, verifyPayloadAndBuildPrincipal, } from "./jwt-core.js";
+export class JwtAuthAdapter {
+    _secret;
+    _issuer;
+    _audience;
+    _clock;
+    constructor(config) {
+        // C1 — construction-time guards (AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001)
+        if (config.secret == null || config.secret.length < MIN_SECRET_BYTES) {
+            throwErr("AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001", `secret must be a Uint8Array of at least ${MIN_SECRET_BYTES} bytes`);
+        }
+        if (!config.expectedIssuer) {
+            throwErr("AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001", "expectedIssuer must be a non-empty string");
+        }
+        if (!config.expectedAudience) {
+            throwErr("AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001", "expectedAudience must be a non-empty string");
+        }
+        this._secret = Buffer.from(config.secret);
+        this._issuer = config.expectedIssuer;
+        this._audience = config.expectedAudience;
+        this._clock = config.clock ?? { now: () => new Date().toISOString() };
+    }
+    async verify(credential) {
+        const nowMs = Date.parse(this._clock.now());
+        // Step 1 — structure: exactly 3 non-empty segments
+        const [rawHeader, rawPayload, rawSig] = splitJwt(credential);
+        // Steps 2-3 — header: base64url decode + JSON parse
+        const h = parseJsonObject(rawHeader, "header");
+        // Step 4 — algorithm enforcement
+        assertAlgHS256(h);
+        // Step 5 — kid rejection (single-key mode never accepts a kid-bearing token)
+        if ("kid" in h) {
+            throwErr("AUTH_CREDENTIAL_KEY_ID_UNKNOWN_001", "token contains kid; multi-key is not supported in single-secret mode");
+        }
+        // Steps 6-8 — HMAC-SHA256 with timingSafeEqual (via jwt-core.ts)
+        verifyHmacSig(rawHeader, rawPayload, rawSig, this._secret);
+        // Steps 9-21 — payload parse + full verification + VerifiedPrincipal assembly
+        const p = parseJsonObject(rawPayload, "payload");
+        return verifyPayloadAndBuildPrincipal(p, nowMs, this._issuer, this._audience);
+    }
+}
+//# sourceMappingURL=jwt-auth-adapter.js.map

package/dist/auth/jwt-auth-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth-adapter.js","sourceRoot":"","sources":["../../src/auth/jwt-auth-adapter.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,gEAAgE;AAChE,yEAAyE;AACzE,iDAAiD;AACjD,EAAE;AACF,8DAA8D;AAC9D,8DAA8D;AAC9D,8DAA8D;AAC9D,8DAA8D;AAC9D,8DAA8D;AAC9D,8DAA8D;AAC9D,8DAA8D;AAC9D,8DAA8D;AAC9D,8DAA8D;AAC9D,8DAA8D;AAC9D,8DAA8D;AAC9D,8DAA8D;AAG9D,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,cAAc,EACd,aAAa,EACb,8BAA8B,GAC/B,MAAM,eAAe,CAAC;AAWvB,MAAM,OAAO,cAAc;IACR,OAAO,CAAW;IAClB,OAAO,CAAW;IAClB,SAAS,CAAS;IAClB,MAAM,CAAW;IAElC,YAAY,MAA4B;QACtC,yEAAyE;QACzE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACrE,QAAQ,CACN,wCAAwC,EACxC,2CAA2C,gBAAgB,QAAQ,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,QAAQ,CAAC,wCAAwC,EAAE,2CAA2C,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC7B,QAAQ,CAAC,wCAAwC,EAAE,6CAA6C,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,OAAO,GAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,GAAK,MAAM,CAAC,cAAc,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACzC,IAAI,CAAC,MAAM,GAAM,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAE5C,mDAAmD;QACnD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE7D,oDAAoD;QACpD,MAAM,CAAC,GAAG,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAE/C,iCAAiC;QACjC,cAAc,CAAC,CAAC,CAAC,CAAC;QAElB,6EAA6E;QAC7E,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,QAAQ,CACN,oCAAoC,EACpC,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3D,8EAA8E;QAC9E,MAAM,CAAC,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACjD,OAAO,8BAA8B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/auth/jwt-core.d.ts

@@ -0,0 +1,32 @@
+import type { KeyObject } from "node:crypto";
+export type { KeyObject };
+import type { VerifiedPrincipal } from "./types.js";
+export declare const MIN_SECRET_BYTES = 32;
+export declare const VALID_PRINCIPAL_TYPES: Set<string>;
+export declare const VALID_ROLES: Set<string>;
+export declare function throwErr(code: string, detail: string): never;
+export declare function decodeB64url(segment: string): Buffer;
+export declare function parseJsonObject(segment: string, label: string): Record<string, unknown>;
+export declare function splitJwt(credential: string): [string, string, string];
+export declare function assertAlgHS256(h: Record<string, unknown>): void;
+export declare function verifyHmacSig(rawHeader: string, rawPayload: string, rawSig: string, secret: Buffer): void;
+export declare function requireStr(p: Record<string, unknown>, name: string): string;
+export declare function requireStrArr(p: Record<string, unknown>, name: string, valid: ReadonlySet<string> | null): ReadonlyArray<string>;
+export declare function verifyPayloadAndBuildPrincipal(p: Record<string, unknown>, nowMs: number, expectedIssuer: string, expectedAudience: string): VerifiedPrincipal;
+/**
+ * Import an RSA public key from a JWK entry (Record<string, unknown>).
+ * Enforces: kty must be "RSA", minimum 2048-bit modulus.
+ * Throws EXTERNAL_IDP_PUBLIC_KEY_TOO_SMALL_001 for weak keys.
+ * Throws EXTERNAL_IDP_JWKS_PARSE_ERROR_001 for malformed entries.
+ * Called only from JwksKeyRing — never from the auth adapter directly.
+ */
+export declare function importRsaPublicKey(entry: Record<string, unknown>): KeyObject;
+/**
+ * Verify an RS256 (PKCS#1 v1.5 / SHA-256) JWT signature.
+ * rawSig:           base64url-encoded signature (JWT third segment).
+ * headerDotPayload: raw signing input ("header.payload", as sent over wire).
+ * publicKey:        RSA KeyObject returned by importRsaPublicKey.
+ * Throws EXTERNAL_IDP_SIGNATURE_INVALID_001 on any verification failure.
+ * No sensitive data in error messages.
+ */
+export declare function verifyRsaSig(rawSig: string, headerDotPayload: string, publicKey: KeyObject): void;