life-as-api 0.2.0

package/dist/auth/jwt-core.js

@@ -0,0 +1,226 @@
+// src/auth/jwt-core.ts
+// INTERNAL — not exported from src/index.ts.
+// Shared JWT verification primitives used by JwtAuthAdapter and JwtKeyRingAuthAdapter.
+//
+// Credential-verification crypto boundary: this is the only src/auth/** file that may
+// import node:crypto. See CRYPTO_BOUNDARY_ONLY_001 in docs/INVARIANTS.md.
+// jwt-auth-adapter.ts and jwt-key-ring-auth-adapter.ts both delegate here; they do not
+// import node:crypto directly.
+import { createHmac, timingSafeEqual, createPublicKey, verify as cryptoVerify } from "node:crypto";
+// ─── Constants ────────────────────────────────────────────────────────────────
+export const MIN_SECRET_BYTES = 32;
+export const VALID_PRINCIPAL_TYPES = new Set(["user", "agent", "service", "audit"]);
+export const VALID_ROLES = new Set(["owner", "agent", "system", "audit"]);
+const B64URL_PATTERN = /^[A-Za-z0-9\-_]+$/;
+// ─── Error factory ────────────────────────────────────────────────────────────
+export function throwErr(code, detail) {
+    throw Object.assign(new Error(`${code}: ${detail}`), { code });
+}
+// ─── Segment helpers ──────────────────────────────────────────────────────────
+export function decodeB64url(segment) {
+    if (!B64URL_PATTERN.test(segment)) {
+        throwErr("AUTH_CREDENTIAL_MALFORMED_001", "segment contains invalid base64url characters");
+    }
+    return Buffer.from(segment, "base64url");
+}
+export function parseJsonObject(segment, label) {
+    let bytes;
+    try {
+        bytes = decodeB64url(segment);
+    }
+    catch {
+        throwErr("AUTH_CREDENTIAL_MALFORMED_001", `${label} base64url decode failed`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        throwErr("AUTH_CREDENTIAL_MALFORMED_001", `${label} is not valid JSON`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throwErr("AUTH_CREDENTIAL_MALFORMED_001", `${label} is not a JSON object`);
+    }
+    return parsed;
+}
+export function splitJwt(credential) {
+    const parts = credential.split(".");
+    if (parts.length !== 3 || parts.some(s => s.length === 0)) {
+        throwErr("AUTH_CREDENTIAL_MALFORMED_001", "token must have exactly 3 non-empty segments");
+    }
+    return parts;
+}
+export function assertAlgHS256(h) {
+    if (h["alg"] !== "HS256") {
+        throwErr("AUTH_CREDENTIAL_ALGORITHM_UNSUPPORTED_001", "only HS256 is supported");
+    }
+}
+// ─── HMAC-SHA256 with constant-time comparison ────────────────────────────────
+export function verifyHmacSig(rawHeader, rawPayload, rawSig, secret) {
+    // Compute expected over the raw (encoded, not decoded) signing input
+    const expected = createHmac("sha256", secret).update(rawHeader + "." + rawPayload).digest();
+    // Strict base64url before decode to avoid lenient Buffer.from behaviour
+    if (!B64URL_PATTERN.test(rawSig)) {
+        throwErr("AUTH_CREDENTIAL_MALFORMED_001", "signature has invalid base64url characters");
+    }
+    const received = Buffer.from(rawSig, "base64url");
+    // Length check before timingSafeEqual (length mismatch would throw inside TSE)
+    if (received.length !== expected.length || !timingSafeEqual(expected, received)) {
+        throwErr("AUTH_CREDENTIAL_SIGNATURE_INVALID_001", "signature verification failed");
+    }
+}
+// ─── Claim helpers ────────────────────────────────────────────────────────────
+export function requireStr(p, name) {
+    if (!(name in p))
+        throwErr("AUTH_CREDENTIAL_CLAIM_MISSING_001", `claim "${name}" is required`);
+    if (typeof p[name] !== "string")
+        throwErr("AUTH_CREDENTIAL_CLAIM_INVALID_001", `claim "${name}" must be a string`);
+    return p[name];
+}
+export function requireStrArr(p, name, valid) {
+    if (!(name in p))
+        throwErr("AUTH_CREDENTIAL_CLAIM_MISSING_001", `claim "${name}" is required`);
+    const val = p[name];
+    if (!Array.isArray(val))
+        throwErr("AUTH_CREDENTIAL_CLAIM_INVALID_001", `claim "${name}" must be an array`);
+    for (const item of val) {
+        if (typeof item !== "string") {
+            throwErr("AUTH_CREDENTIAL_CLAIM_INVALID_001", `claim "${name}" elements must be strings`);
+        }
+        if (valid !== null && !valid.has(item)) {
+            throwErr("AUTH_CREDENTIAL_CLAIM_INVALID_001", `claim "${name}" contains an unrecognised value`);
+        }
+    }
+    return val;
+}
+// ─── Payload verification + VerifiedPrincipal assembly (steps 11-21) ──────────
+export function verifyPayloadAndBuildPrincipal(p, nowMs, expectedIssuer, expectedAudience) {
+    // Step 11 — exp type guard
+    const expVal = p["exp"];
+    if (typeof expVal !== "number") {
+        throwErr("AUTH_CREDENTIAL_TIME_CLAIM_INVALID_001", "exp claim is absent or not a number");
+    }
+    // Step 12 — exp value guard (leeway = 0, fail-closed at boundary)
+    if (expVal * 1000 <= nowMs) {
+        throwErr("AUTH_CREDENTIAL_EXPIRED_001", "token has expired");
+    }
+    // Steps 13-14 — nbf (optional)
+    if ("nbf" in p) {
+        const nbfVal = p["nbf"];
+        if (typeof nbfVal !== "number") {
+            throwErr("AUTH_CREDENTIAL_TIME_CLAIM_INVALID_001", "nbf claim is not a number");
+        }
+        if (nbfVal * 1000 > nowMs) {
+            throwErr("AUTH_CREDENTIAL_NOT_YET_VALID_001", "token is not yet valid");
+        }
+    }
+    // Step 15 — iss: absent or mismatch → same error code
+    if (p["iss"] !== expectedIssuer) {
+        throwErr("AUTH_CREDENTIAL_ISSUER_INVALID_001", "iss claim does not match expected issuer");
+    }
+    // Steps 16-19 — aud: absent, wrong type, or expected audience not present
+    const aud = p["aud"];
+    if (typeof aud === "string") {
+        if (aud !== expectedAudience) {
+            throwErr("AUTH_CREDENTIAL_AUDIENCE_INVALID_001", "aud does not match expected audience");
+        }
+    }
+    else if (Array.isArray(aud)) {
+        if (!aud.some(a => a === expectedAudience)) {
+            throwErr("AUTH_CREDENTIAL_AUDIENCE_INVALID_001", "aud array does not contain expected audience");
+        }
+    }
+    else {
+        throwErr("AUTH_CREDENTIAL_AUDIENCE_INVALID_001", "aud claim is absent or has unsupported type");
+    }
+    // Step 20 — required claims (fail closed on missing or wrong type/value)
+    const sub = requireStr(p, "sub");
+    const principalType = requireStr(p, "principalType");
+    if (!VALID_PRINCIPAL_TYPES.has(principalType)) {
+        throwErr("AUTH_CREDENTIAL_CLAIM_INVALID_001", "principalType is not a recognised value");
+    }
+    const tenantId = requireStr(p, "tenantId");
+    const roles = requireStrArr(p, "roles", VALID_ROLES);
+    const grantIds = requireStrArr(p, "grantIds", null);
+    // iat — required; CLAIM_MISSING/CLAIM_INVALID (not a time guard)
+    if (!("iat" in p)) {
+        throwErr("AUTH_CREDENTIAL_CLAIM_MISSING_001", "iat claim is required");
+    }
+    const iatVal = p["iat"];
+    if (typeof iatVal !== "number") {
+        throwErr("AUTH_CREDENTIAL_CLAIM_INVALID_001", "iat claim must be a number");
+    }
+    // Step 21 — assemble VerifiedPrincipal
+    const expiresAt = new Date(expVal * 1000).toISOString();
+    const issuedAt = new Date(iatVal * 1000).toISOString();
+    const base = {
+        principalId: sub,
+        principalType: principalType,
+        tenantId,
+        roles: roles,
+        grantIds,
+        expiresAt,
+        issuedAt,
+    };
+    // authorizedPersonId is optional — must be omitted (not set to undefined)
+    const authPersonId = p["authorizedPersonId"];
+    if (authPersonId !== undefined) {
+        if (typeof authPersonId !== "string") {
+            throwErr("AUTH_CREDENTIAL_CLAIM_INVALID_001", "authorizedPersonId must be a string");
+        }
+        return { ...base, authorizedPersonId: authPersonId };
+    }
+    return base;
+}
+// ─── RS256 — External IdP crypto boundary ────────────────────────────────────
+//
+// CRYPTO_BOUNDARY_ONLY_001: jwt-core.ts is the sole src/auth/ file that may import
+// node:crypto at runtime. All RS256/RSA operations must live here.
+/**
+ * Import an RSA public key from a JWK entry (Record<string, unknown>).
+ * Enforces: kty must be "RSA", minimum 2048-bit modulus.
+ * Throws EXTERNAL_IDP_PUBLIC_KEY_TOO_SMALL_001 for weak keys.
+ * Throws EXTERNAL_IDP_JWKS_PARSE_ERROR_001 for malformed entries.
+ * Called only from JwksKeyRing — never from the auth adapter directly.
+ */
+export function importRsaPublicKey(entry) {
+    let keyObj;
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        keyObj = createPublicKey({ key: entry, format: "jwk" });
+    }
+    catch {
+        throwErr("EXTERNAL_IDP_JWKS_PARSE_ERROR_001", "RSA public key import failed");
+    }
+    const details = keyObj.asymmetricKeyDetails;
+    if (details?.modulusLength !== undefined && details.modulusLength < 2048) {
+        throwErr("EXTERNAL_IDP_PUBLIC_KEY_TOO_SMALL_001", "RSA key must be at least 2048 bits");
+    }
+    return keyObj;
+}
+/**
+ * Verify an RS256 (PKCS#1 v1.5 / SHA-256) JWT signature.
+ * rawSig:           base64url-encoded signature (JWT third segment).
+ * headerDotPayload: raw signing input ("header.payload", as sent over wire).
+ * publicKey:        RSA KeyObject returned by importRsaPublicKey.
+ * Throws EXTERNAL_IDP_SIGNATURE_INVALID_001 on any verification failure.
+ * No sensitive data in error messages.
+ */
+export function verifyRsaSig(rawSig, headerDotPayload, publicKey) {
+    if (!B64URL_PATTERN.test(rawSig)) {
+        throwErr("EXTERNAL_IDP_SIGNATURE_INVALID_001", "signature has invalid base64url characters");
+    }
+    const sigBytes = Buffer.from(rawSig, "base64url");
+    const data = Buffer.from(headerDotPayload, "ascii");
+    let ok;
+    try {
+        ok = cryptoVerify("RSA-SHA256", data, publicKey, sigBytes);
+    }
+    catch {
+        throwErr("EXTERNAL_IDP_SIGNATURE_INVALID_001", "signature verification error");
+    }
+    if (!ok) {
+        throwErr("EXTERNAL_IDP_SIGNATURE_INVALID_001", "signature verification failed");
+    }
+}
+//# sourceMappingURL=jwt-core.js.map

package/dist/auth/jwt-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-core.js","sourceRoot":"","sources":["../../src/auth/jwt-core.ts"],"names":[],"mappings":"AAAA,uBAAuB;AACvB,6CAA6C;AAC7C,uFAAuF;AACvF,EAAE;AACF,sFAAsF;AACtF,0EAA0E;AAC1E,uFAAuF;AACvF,+BAA+B;AAE/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AAKnG,iFAAiF;AAEjF,MAAM,CAAC,MAAM,gBAAgB,GAAQ,EAAE,CAAC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5F,MAAM,CAAC,MAAM,WAAW,GAAa,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5F,MAAM,cAAc,GAAiB,mBAAmB,CAAC;AAEzD,iFAAiF;AAEjF,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAc;IACnD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,+BAA+B,EAAE,+CAA+C,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,KAAa;IAC5D,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,+BAA+B,EAAE,GAAG,KAAK,0BAA0B,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,+BAA+B,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,QAAQ,CAAC,+BAA+B,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,UAAkB;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,+BAA+B,EAAE,8CAA8C,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,KAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAA0B;IACvD,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC;QACzB,QAAQ,CAAC,2CAA2C,EAAE,yBAAyB,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,aAAa,CAC3B,SAAkB,EAClB,UAAkB,EAClB,MAAkB,EAClB,MAAkB;IAElB,qEAAqE;IACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5F,wEAAwE;IACxE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,+BAA+B,EAAE,4CAA4C,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,+EAA+E;IAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChF,QAAQ,CAAC,uCAAuC,EAAE,+BAA+B,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,UAAU,CAAC,CAA0B,EAAE,IAAY;IACjE,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAAE,QAAQ,CAAC,mCAAmC,EAAE,UAAU,IAAI,eAAe,CAAC,CAAC;IAC/F,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAAE,QAAQ,CAAC,mCAAmC,EAAE,UAAU,IAAI,oBAAoB,CAAC,CAAC;IACnH,OAAO,CAAC,CAAC,IAAI,CAAW,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,CAA8B,EAC9B,IAAa,EACb,KAAiC;IAEjC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAAE,QAAQ,CAAC,mCAAmC,EAAE,UAAU,IAAI,eAAe,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,QAAQ,CAAC,mCAAmC,EAAE,UAAU,IAAI,oBAAoB,CAAC,CAAC;IAC3G,KAAK,MAAM,IAAI,IAAI,GAAgB,EAAE,CAAC;QACpC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,QAAQ,CAAC,mCAAmC,EAAE,UAAU,IAAI,4BAA4B,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAc,CAAC,EAAE,CAAC;YACjD,QAAQ,CAAC,mCAAmC,EAAE,UAAU,IAAI,kCAAkC,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,OAAO,GAAe,CAAC;AACzB,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,8BAA8B,CAC5C,CAAyC,EACzC,KAAwB,EACxB,cAAwB,EACxB,gBAAwB;IAExB,2BAA2B;IAC3B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,wCAAwC,EAAE,qCAAqC,CAAC,CAAC;IAC5F,CAAC;IAED,kEAAkE;IAClE,IAAI,MAAM,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;QAC3B,QAAQ,CAAC,6BAA6B,EAAE,mBAAmB,CAAC,CAAC;IAC/D,CAAC;IAED,+BAA+B;IAC/B,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,wCAAwC,EAAE,2BAA2B,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;YAC1B,QAAQ,CAAC,mCAAmC,EAAE,wBAAwB,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,cAAc,EAAE,CAAC;QAChC,QAAQ,CAAC,oCAAoC,EAAE,0CAA0C,CAAC,CAAC;IAC7F,CAAC;IAED,0EAA0E;IAC1E,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,gBAAgB,EAAE,CAAC;YAC7B,QAAQ,CAAC,sCAAsC,EAAE,sCAAsC,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,sCAAsC,EAAE,8CAA8C,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,sCAAsC,EAAE,6CAA6C,CAAC,CAAC;IAClG,CAAC;IAED,yEAAyE;IACzE,MAAM,GAAG,GAAa,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IACrD,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9C,QAAQ,CAAC,mCAAmC,EAAE,yCAAyC,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAM,aAAa,CAAC,CAAC,EAAE,OAAO,EAAK,WAAW,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAEpD,iEAAiE;IACjE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QAClB,QAAQ,CAAC,mCAAmC,EAAE,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,QAAQ,CAAC,mCAAmC,EAAE,4BAA4B,CAAC,CAAC;IAC9E,CAAC;IAED,uCAAuC;IACvC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAI,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAExD,MAAM,IAAI,GAAsB;QAC9B,WAAW,EAAI,GAAG;QAClB,aAAa,EAAE,aAAuD;QACtE,QAAQ;QACR,KAAK,EAAU,KAA8D;QAC7E,QAAQ;QACR,SAAS;QACT,QAAQ;KACT,CAAC;IAEF,0EAA0E;IAC1E,MAAM,YAAY,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,QAAQ,CAAC,mCAAmC,EAAE,qCAAqC,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,EAAE;AACF,mFAAmF;AACnF,mEAAmE;AAEnE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,8DAA8D;QAC9D,MAAM,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,KAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,mCAAmC,EAAE,8BAA8B,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAC5C,IAAI,OAAO,EAAE,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,EAAE,CAAC;QACzE,QAAQ,CAAC,uCAAuC,EAAE,oCAAoC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAwB,EACxB,gBAAwB,EACxB,SAA2B;IAE3B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,oCAAoC,EAAE,4CAA4C,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,MAAM,IAAI,GAAO,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACxD,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,oCAAoC,EAAE,8BAA8B,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,QAAQ,CAAC,oCAAoC,EAAE,+BAA+B,CAAC,CAAC;IAClF,CAAC;AACH,CAAC"}

package/dist/auth/jwt-key-ring-auth-adapter.d.ts

@@ -0,0 +1,16 @@
+import type { AuthAdapter, Clock, VerifiedPrincipal } from "./types.js";
+import type { StaticJwtKeyRing } from "./static-jwt-key-ring.js";
+export interface JwtKeyRingAuthAdapterConfig {
+    readonly keyRing: StaticJwtKeyRing;
+    readonly expectedIssuer: string;
+    readonly expectedAudience: string;
+    readonly clock?: Clock;
+}
+export declare class JwtKeyRingAuthAdapter implements AuthAdapter {
+    private readonly _keyRing;
+    private readonly _issuer;
+    private readonly _audience;
+    private readonly _clock;
+    constructor(config: JwtKeyRingAuthAdapterConfig);
+    verify(credential: string): Promise<VerifiedPrincipal>;
+}

package/dist/auth/jwt-key-ring-auth-adapter.js

@@ -0,0 +1,58 @@
+// src/auth/jwt-key-ring-auth-adapter.ts
+// TEST/DEV only — NOT exported from src/index.ts.
+// Key-ring mode: token MUST carry kid; secret selected from StaticJwtKeyRing.
+// HS256 only. Verifier only — no signing. Secret injection is always caller-owned.
+//
+// AUTH_JWT_KEY_ID_REQUIRED_001 ✅ Production-04-a
+//
+// See docs/specs/production-04-jwt-secret-custody-spec.md §5.
+import { throwErr, splitJwt, parseJsonObject, assertAlgHS256, verifyHmacSig, verifyPayloadAndBuildPrincipal, } from "./jwt-core.js";
+// ─── JwtKeyRingAuthAdapter ────────────────────────────────────────────────────
+export class JwtKeyRingAuthAdapter {
+    _keyRing;
+    _issuer;
+    _audience;
+    _clock;
+    constructor(config) {
+        if (config.keyRing == null) {
+            throwErr("AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001", "keyRing must be provided");
+        }
+        if (!config.expectedIssuer) {
+            throwErr("AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001", "expectedIssuer must be a non-empty string");
+        }
+        if (!config.expectedAudience) {
+            throwErr("AUTH_CREDENTIAL_KEY_CONFIG_INVALID_001", "expectedAudience must be a non-empty string");
+        }
+        this._keyRing = config.keyRing;
+        this._issuer = config.expectedIssuer;
+        this._audience = config.expectedAudience;
+        this._clock = config.clock ?? { now: () => new Date().toISOString() };
+    }
+    async verify(credential) {
+        // Compute clock once — used for both key temporal checks and token exp/nbf
+        const nowMs = Date.parse(this._clock.now());
+        // Step 1 — structure: exactly 3 non-empty segments
+        const [rawHeader, rawPayload, rawSig] = splitJwt(credential);
+        // Steps 2-3 — header
+        const h = parseJsonObject(rawHeader, "header");
+        // Step 4 — algorithm enforcement (alg: none / RS256 / etc. → rejected)
+        assertAlgHS256(h);
+        // Step 5 — kid required; key-ring mode never falls back to a default secret
+        // (AUTH_JWT_KEY_ID_REQUIRED_001)
+        if (!("kid" in h)) {
+            throwErr("AUTH_JWT_KEY_ID_REQUIRED_001", "key-ring mode requires kid in token header");
+        }
+        const kid = h["kid"];
+        if (typeof kid !== "string" || kid.length === 0) {
+            throwErr("AUTH_JWT_KEY_ID_REQUIRED_001", "kid must be a non-empty string");
+        }
+        // Step 6 — resolve key from ring (throws on unknown / revoked / not-yet-active / expired)
+        const secret = this._keyRing.resolveKey(kid, nowMs);
+        // Steps 7-8 — HMAC-SHA256 with timingSafeEqual (via jwt-core.ts)
+        verifyHmacSig(rawHeader, rawPayload, rawSig, secret);
+        // Steps 9-21 — payload parse + full verification + VerifiedPrincipal assembly
+        const p = parseJsonObject(rawPayload, "payload");
+        return verifyPayloadAndBuildPrincipal(p, nowMs, this._issuer, this._audience);
+    }
+}
+//# sourceMappingURL=jwt-key-ring-auth-adapter.js.map

package/dist/auth/jwt-key-ring-auth-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-key-ring-auth-adapter.js","sourceRoot":"","sources":["../../src/auth/jwt-key-ring-auth-adapter.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,kDAAkD;AAClD,8EAA8E;AAC9E,mFAAmF;AACnF,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,8DAA8D;AAG9D,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,cAAc,EACd,aAAa,EACb,8BAA8B,GAC/B,MAAM,eAAe,CAAC;AAYvB,iFAAiF;AAEjF,MAAM,OAAO,qBAAqB;IACf,QAAQ,CAAoB;IAC5B,OAAO,CAAW;IAClB,SAAS,CAAS;IAClB,MAAM,CAAW;IAElC,YAAY,MAAmC;QAC7C,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC3B,QAAQ,CAAC,wCAAwC,EAAE,0BAA0B,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,QAAQ,CAAC,wCAAwC,EAAE,2CAA2C,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC7B,QAAQ,CAAC,wCAAwC,EAAE,6CAA6C,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,QAAQ,GAAI,MAAM,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,GAAK,MAAM,CAAC,cAAc,CAAC;QACvC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACzC,IAAI,CAAC,MAAM,GAAM,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,2EAA2E;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAE5C,mDAAmD;QACnD,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE7D,qBAAqB;QACrB,MAAM,CAAC,GAAG,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAE/C,uEAAuE;QACvE,cAAc,CAAC,CAAC,CAAC,CAAC;QAElB,4EAA4E;QAC5E,iCAAiC;QACjC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;YAClB,QAAQ,CAAC,8BAA8B,EAAE,4CAA4C,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC;QAC7E,CAAC;QAED,0FAA0F;QAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEpD,iEAAiE;QACjE,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAErD,8EAA8E;QAC9E,MAAM,CAAC,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACjD,OAAO,8BAA8B,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/auth/oidc-discovery.d.ts

@@ -0,0 +1,15 @@
+import type { HttpClient } from "./http-client.js";
+/**
+ * Resolve the JWKS URI from an OIDC issuer's discovery document.
+ * Fetches {issuerUrl}/.well-known/openid-configuration and extracts jwks_uri.
+ *
+ * This is a one-time startup utility — not called per-request.
+ * The result (jwks_uri string) should be passed to JwksKeyRingAuthAdapterConfig.jwksUri.
+ *
+ * @throws EXTERNAL_IDP_DISCOVERY_FETCH_FAILED_001 on HTTP error or timeout.
+ * @throws EXTERNAL_IDP_DISCOVERY_JWKS_URI_MISSING_001 if jwks_uri is absent in document.
+ */
+export declare function resolveJwksUri(issuerUrl: string, httpClient: HttpClient, options?: {
+    timeoutMs?: number;
+    maxBytes?: number;
+}): Promise<string>;

package/dist/auth/oidc-discovery.js

@@ -0,0 +1,46 @@
+// src/auth/oidc-discovery.ts
+// INTERNAL — not exported from src/index.ts.
+// Optional OIDC discovery utility — resolves jwks_uri from issuer metadata.
+// The JwksKeyRingAuthAdapter does not call this internally;
+// it accepts jwksUri directly. This is a host startup convenience only.
+//
+// See docs/specs/post-mvp-external-idp-oidc-spec.md §9
+import { throwErr } from "./jwt-core.js";
+/**
+ * Resolve the JWKS URI from an OIDC issuer's discovery document.
+ * Fetches {issuerUrl}/.well-known/openid-configuration and extracts jwks_uri.
+ *
+ * This is a one-time startup utility — not called per-request.
+ * The result (jwks_uri string) should be passed to JwksKeyRingAuthAdapterConfig.jwksUri.
+ *
+ * @throws EXTERNAL_IDP_DISCOVERY_FETCH_FAILED_001 on HTTP error or timeout.
+ * @throws EXTERNAL_IDP_DISCOVERY_JWKS_URI_MISSING_001 if jwks_uri is absent in document.
+ */
+export async function resolveJwksUri(issuerUrl, httpClient, options) {
+    const timeoutMs = options?.timeoutMs ?? 5000;
+    const maxBytes = options?.maxBytes ?? 65536;
+    const discoveryUrl = issuerUrl.replace(/\/+$/, "") + "/.well-known/openid-configuration";
+    let responseText;
+    try {
+        responseText = await httpClient.getText(discoveryUrl, { timeoutMs, maxBytes });
+    }
+    catch {
+        throwErr("EXTERNAL_IDP_DISCOVERY_FETCH_FAILED_001", "OIDC discovery fetch failed");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(responseText);
+    }
+    catch {
+        throwErr("EXTERNAL_IDP_DISCOVERY_FETCH_FAILED_001", "OIDC discovery response is not valid JSON");
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        throwErr("EXTERNAL_IDP_DISCOVERY_FETCH_FAILED_001", "OIDC discovery response is not an object");
+    }
+    const jwksUri = parsed["jwks_uri"];
+    if (typeof jwksUri !== "string" || jwksUri.length === 0) {
+        throwErr("EXTERNAL_IDP_DISCOVERY_JWKS_URI_MISSING_001", "jwks_uri absent from discovery document");
+    }
+    return jwksUri;
+}
+//# sourceMappingURL=oidc-discovery.js.map

package/dist/auth/oidc-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-discovery.js","sourceRoot":"","sources":["../../src/auth/oidc-discovery.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,6CAA6C;AAC7C,4EAA4E;AAC5E,4DAA4D;AAC5D,wEAAwE;AACxE,EAAE;AACF,uDAAuD;AAGvD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAoB,EACpB,UAAwB,EACxB,OAAuD;IAEvD,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;IAC7C,MAAM,QAAQ,GAAI,OAAO,EAAE,QAAQ,IAAK,KAAK,CAAC;IAE9C,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mCAAmC,CAAC;IAEzF,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,yCAAyC,EAAE,6BAA6B,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,yCAAyC,EAAE,2CAA2C,CAAC,CAAC;IACnG,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,QAAQ,CAAC,yCAAyC,EAAE,0CAA0C,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,OAAO,GAAI,MAAkC,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,QAAQ,CAAC,6CAA6C,EAAE,yCAAyC,CAAC,CAAC;IACrG,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/auth/production-scoped-life-api.d.ts

@@ -0,0 +1,58 @@
+import type { PersonId, ProposalId } from "../types/ids.js";
+import type { AcceptOptions, Proposal, RejectOptions, ProposalInput, ProposalStatus } from "../types/proposal.js";
+import type { QueryContractsInput, ContextQueryResult } from "../surface/evidence-backed-context-query.js";
+import type { ErasureStatus } from "../erasure/tombstone.js";
+import type { LifeApi } from "../sdk/life-api.js";
+import type { MintedContext, GuardianContextMintingBoundary } from "./types.js";
+import type { AuditLog } from "../audit/audit-log.js";
+import type { UnitOfWork } from "../persistence/unit-of-work.js";
+import type { Logger } from "../observability/logger.js";
+import type { MetricsRecorder } from "../observability/metrics.js";
+import type { HealthCheckResult } from "../observability/health.js";
+export interface ListProposalsInput {
+    readonly status?: ProposalStatus;
+}
+export interface ProductionScopedLifeApi {
+    requestErasure(subject: PersonId): Promise<void>;
+    getErasureStatus(subject: PersonId): Promise<ErasureStatus | undefined>;
+    queryContracts(input: QueryContractsInput): Promise<ContextQueryResult>;
+    acceptProposal(proposalId: ProposalId, options: AcceptOptions): Promise<Proposal>;
+    rejectProposal(proposalId: ProposalId, options: RejectOptions): Promise<Proposal>;
+    createProposal(input: ProposalInput): Promise<Proposal>;
+    getProposal(proposalId: ProposalId): Promise<Proposal | undefined>;
+    listProposals(input?: ListProposalsInput): Promise<readonly Proposal[]>;
+}
+export type ProductionApiBundle = {
+    readonly auth: GuardianContextMintingBoundary;
+    readonly createScopedApi: (mintedCtx: MintedContext) => ProductionScopedLifeApi;
+    readonly healthCheck: () => Promise<HealthCheckResult>;
+};
+export declare function assertOwnerSelfForErasure(subject: PersonId, mintedCtx: MintedContext): void;
+export declare function assertOwnerOwnsProposalSubjectForReject(proposal: Proposal, mintedCtx: MintedContext): void;
+export declare class ProductionScopedLifeApiImpl implements ProductionScopedLifeApi {
+    private readonly _api;
+    private readonly _minted;
+    private readonly _audit;
+    private readonly _mutationLog;
+    private readonly _uow;
+    private readonly _logger?;
+    private readonly _metricsRecorder?;
+    private readonly _subjectApi;
+    private readonly _proposalApi;
+    constructor(_api: LifeApi, _minted: MintedContext, _audit: AuditLog, _mutationLog: AuditLog, _uow: UnitOfWork, _logger?: Logger | undefined, _metricsRecorder?: MetricsRecorder | undefined);
+    private _emitProposalOutcome;
+    private _writeAuditOrFail;
+    private _actorLabel;
+    private _now;
+    private _guardianFields;
+    private _assertGuardianScope;
+    private _denyGuardianErasure;
+    requestErasure(subject: PersonId): Promise<void>;
+    getErasureStatus(subject: PersonId): Promise<ErasureStatus | undefined>;
+    queryContracts(input: QueryContractsInput): Promise<ContextQueryResult>;
+    acceptProposal(proposalId: ProposalId, options: AcceptOptions): Promise<Proposal>;
+    createProposal(input: ProposalInput): Promise<Proposal>;
+    getProposal(proposalId: ProposalId): Promise<Proposal | undefined>;
+    listProposals(input?: ListProposalsInput): Promise<readonly Proposal[]>;
+    rejectProposal(proposalId: ProposalId, options: RejectOptions): Promise<Proposal>;
+}