permdock 0.3.1 → 0.5.0

package/dist/{json-schema-BsAflUGW.js → json-schema-B-vAwlde.js}

@@ -1,3 +1,5 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
 //#region src/core/json-schema.ts
 function issue(issues, path, message) {
 	issues.push({
@@ -5,9 +7,6 @@ function issue(issues, path, message) {
 		path: [...path]
 	});
 }
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 /**
 * A plain-data copy built from own enumerable keys, so `__proto__` stays an
 * ordinary key and nothing the input inherits is read. Anything JSON cannot
@@ -40,6 +39,12 @@ function copyJson(value, path, issues, ancestors) {
 		ancestors.delete(value);
 	}
 }
+/** JSON Schema counts string length in code points, not UTF-16 units. */
+function codePoints(value) {
+	let count = 0;
+	for (const _ of value) count += 1;
+	return count;
+}
 function typeMatches(type, value) {
 	switch (type) {
 		case "object": return isRecord(value);
@@ -47,6 +52,8 @@ function typeMatches(type, value) {
 		case "string": return typeof value === "string";
 		case "boolean": return typeof value === "boolean";
 		case "integer": return Number.isInteger(value);
+		case "number": return typeof value === "number" && Number.isFinite(value);
+		case "null": return value === null;
 		default: return type;
 	}
 }
@@ -71,12 +78,32 @@ function checkSchema(node, value, path, issues, root = node) {
 		issue(issues, path, `Expected one of ${node.enum.map((item) => JSON.stringify(item)).join(", ")}`);
 		return;
 	}
-	if (node.type !== void 0 && !typeMatches(node.type, value)) {
-		issue(issues, path, `Expected ${node.type}`);
-		return;
+	if (node.type !== void 0) {
+		const types = typeof node.type === "string" ? [node.type] : node.type;
+		if (!types.some((type) => typeMatches(type, value))) {
+			issue(issues, path, `Expected ${types.join(" or ")}`);
+			return;
+		}
+	}
+	if (typeof value === "string") {
+		if (node.pattern !== void 0 && !new RegExp(node.pattern, "u").test(value)) issue(issues, path, `Expected a string matching ${node.pattern}`);
+		if (node.minLength !== void 0 && value.length < node.minLength) issue(issues, path, `Expected at least ${String(node.minLength)} characters`);
+		if (node.maxLength !== void 0 && codePoints(value) > node.maxLength) issue(issues, path, `Expected at most ${String(node.maxLength)} characters`);
+	}
+	if (typeof value === "number") {
+		if (node.minimum !== void 0 && value < node.minimum) issue(issues, path, `Expected at least ${String(node.minimum)}`);
+		if (node.maximum !== void 0 && value > node.maximum) issue(issues, path, `Expected at most ${String(node.maximum)}`);
+		if (node.exclusiveMinimum !== void 0 && value <= node.exclusiveMinimum) issue(issues, path, `Expected more than ${String(node.exclusiveMinimum)}`);
+		if (node.exclusiveMaximum !== void 0 && value >= node.exclusiveMaximum) issue(issues, path, `Expected less than ${String(node.exclusiveMaximum)}`);
 	}
-	if (node.pattern !== void 0 && typeof value === "string" && !new RegExp(node.pattern, "u").test(value)) issue(issues, path, `Expected a string matching ${node.pattern}`);
-	if (node.minimum !== void 0 && typeof value === "number" && value < node.minimum) issue(issues, path, `Expected at least ${String(node.minimum)}`);
+	if (node.anyOf !== void 0) {
+		if (!node.anyOf.some((option) => {
+			const scratch = [];
+			checkSchema(option, value, path, scratch, root);
+			return scratch.length === 0;
+		})) issue(issues, path, "Expected at least one matching form");
+	}
+	for (const option of node.allOf ?? []) checkSchema(option, value, path, issues, root);
 	if (node.oneOf !== void 0) {
 		if (node.oneOf.filter((option) => {
 			const scratch = [];
@@ -86,6 +113,7 @@ function checkSchema(node, value, path, issues, root = node) {
 	}
 	if (Array.isArray(value)) {
 		if (node.minItems !== void 0 && value.length < node.minItems) issue(issues, path, `Expected at least ${String(node.minItems)} items`);
+		if (node.maxItems !== void 0 && value.length > node.maxItems) issue(issues, path, `Expected at most ${String(node.maxItems)} items`);
 		if (node.uniqueItems === true && new Set(value.map((item) => JSON.stringify(item))).size !== value.length) issue(issues, path, "Expected unique items");
 		if (node.items !== void 0) for (const [index, item] of value.entries()) checkSchema(node.items, item, [...path, index], issues, root);
 	}
@@ -102,5 +130,14 @@ function checkSchema(node, value, path, issues, root = node) {
 		else if (node.additionalProperties !== void 0) checkSchema(node.additionalProperties, value[key], [...path, key], issues, root);
 	}
 }
+/** The path of the first `__proto__`, `constructor` or `prototype` key in `value`, if any. */
+function forbiddenKeyPath(value, path = []) {
+	if (value === null || typeof value !== "object") return;
+	for (const [key, child] of Object.entries(value)) {
+		if (isForbiddenKey(key)) return [...path, key];
+		const found = forbiddenKeyPath(child, [...path, key]);
+		if (found !== void 0) return found;
+	}
+}
 //#endregion
-export { copyJson as n, checkSchema as t };
+export { copyJson as n, forbiddenKeyPath as r, checkSchema as t };

package/dist/json-schema-CN_iLFH2.d.ts

@@ -0,0 +1,40 @@
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/core/json-schema.d.ts
+/**
+ * The JSON Schema 2020-12 keywords the package's own schemas use;
+ * `checkSchema` interprets exactly these. `$ref` resolves only `#/$defs/<name>`
+ * against the root node. Annotations (`title`, `description`, `format`) are
+ * ignored, so a `format` always sits next to a `pattern` that enforces it.
+ */
+type JsonSchemaNode = {
+  readonly $schema?: string;
+  readonly $id?: string;
+  readonly $ref?: string;
+  readonly $defs?: Readonly<Record<string, JsonSchemaNode>>;
+  readonly title?: string;
+  readonly description?: string;
+  readonly type?: JsonSchemaType | readonly JsonSchemaType[];
+  readonly format?: string;
+  readonly const?: unknown;
+  readonly enum?: readonly unknown[];
+  readonly pattern?: string;
+  readonly minLength?: number;
+  readonly maxLength?: number;
+  readonly minimum?: number;
+  readonly maximum?: number;
+  readonly exclusiveMinimum?: number;
+  readonly exclusiveMaximum?: number;
+  readonly minItems?: number;
+  readonly maxItems?: number;
+  readonly uniqueItems?: boolean;
+  readonly required?: readonly string[];
+  readonly properties?: Readonly<Record<string, JsonSchemaNode>>;
+  readonly additionalProperties?: JsonSchemaNode | false;
+  readonly items?: JsonSchemaNode;
+  readonly oneOf?: readonly JsonSchemaNode[];
+  readonly anyOf?: readonly JsonSchemaNode[];
+  readonly allOf?: readonly JsonSchemaNode[];
+};
+type JsonSchemaType = "object" | "array" | "string" | "boolean" | "integer" | "number" | "null";
+//#endregion
+export { JsonSchemaNode as t };

package/dist/jwt/index.d.ts

@@ -1,7 +1,7 @@
-import { Ft as TokenVerifier, Nr as Principal, Nt as TokenFailureCause, Pr as Subject, Pt as TokenSigner, ct as JwtClaims, et as AuthEvent } from "../policy-IB6yxpC3.js";
-import { a as JsonWebKeySet, c as JwtJwks, d as MappedSubject, g as ReplayStore, i as JoseTokenVerifierOptions, l as JwtPrincipal, n as DpopProofResult, o as JwtAlgorithm, r as JoseTokenSignerOptions, s as JwtClaimPaths, t as DiscoveryInput, u as JwtSubjectOptions } from "../types-Cq_H8N_X.js";
-import { i as LinkPolicy, o as LinkPrincipal, t as Capability } from "../capability-2kYTMWDv.js";
-import { t as memoryReplayStore } from "../replay-CYyiLiwO.js";
+import { Y as JwtClaims, dt as TokenVerifier, ir as Subject, lt as TokenFailureCause, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "../policy-types-DzwivBgR.js";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-BSslw1QV.js";
+import { B as JwtAlgorithm, F as DpopProofResult, H as JwtPrincipal, I as IntrospectionPrincipal, L as JoseTokenSignerOptions, P as DiscoveryInput, R as JoseTokenVerifierOptions, U as JwtSubjectOptions, V as JwtJwks, W as MappedSubject, l as ReplayStore, z as JsonWebKeySet } from "../types-DiQjupG2.js";
+import { t as memoryReplayStore } from "../replay-D7iKcLFe.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/capability.d.ts
 /** `on('auth')` causes: a verification failure, or one of the three capability checks. */
@@ -23,16 +23,23 @@ type CapabilitySubjectOptions = Omit<JoseTokenVerifierOptions, "typ" | "issuer"
   readonly replay?: ReplayStore;
   /** The request's own verified subject, checked against the capability's `redeemer`. */
   readonly viewer?: Subject;
+  /**
+   * The incoming request. A capability with `cnf` resolves only when the
+   * request carries a DPoP proof (RFC 9449) signed by the bound key;
+   * without one it is refused.
+   */
+  readonly request?: Request;
   readonly onAuth?: (event: AuthEvent) => void;
   readonly requestId?: string;
 };
 /**
- * Resolves a `permdock-capability+jwt` into the `link` subject it acts as.
+ * Resolves a `vnd.permdock.capability+jwt` into the `link` subject it acts as.
  * Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim,
  * a revoked link, a replayed one-time token, a redeemer the viewer does not
- * satisfy, a throwing store) is the anonymous subject, never a throw.
+ * satisfy, a `cnf` without a matching DPoP proof, a throwing store) is the
+ * anonymous subject, never a throw.
  */
-export declare function subjectFromCapability(token: string | undefined | null, options: CapabilitySubjectOptions): Promise<Subject<LinkPrincipal> | Subject>;
+export declare function subjectFromCapability(token: string | undefined | null, options: CapabilitySubjectOptions): Promise<Subject<CapabilityPrincipal>>;
 //#endregion
 //#region src/jwt/ci-oidc.d.ts
 type CiOidcProvider = "github" | "gitlab" | "buildkite";
@@ -76,16 +83,16 @@ type DpopProofOptions = {
 export declare function verifyDpopProof(request: Request, claims: JwtClaims, accessToken?: string, options?: DpopProofOptions): Promise<DpopProofResult>;
 //#endregion
 //#region src/jwt/introspection.d.ts
-export declare function subjectFromIntrospection(response: unknown, options?: JwtSubjectOptions): MappedSubject;
+export declare function subjectFromIntrospection(response: unknown, options?: JwtSubjectOptions): Subject<IntrospectionPrincipal>;
 //#endregion
 //#region src/jwt/signer.d.ts
 export declare function joseTokenSigner(options: JoseTokenSignerOptions): TokenSigner;
 //#endregion
 //#region src/jwt/subject.d.ts
-export declare function subjectFromJwt(token: string | undefined | null, options: JwtSubjectOptions, request?: Request): Promise<MappedSubject>;
-export declare function createJwtSubjectResolver(options: JwtSubjectOptions): (token: string | undefined | null, request?: Request) => Promise<MappedSubject>;
+export declare function subjectFromJwt(token: string | undefined | null, options: JwtSubjectOptions, request?: Request): Promise<Subject<JwtPrincipal>>;
+export declare function jwtSubjectResolver(options: JwtSubjectOptions): (token: string | undefined | null, request?: Request) => Promise<MappedSubject>;
 //#endregion
 //#region src/jwt/verifier.d.ts
 export declare function joseTokenVerifier(options: JoseTokenVerifierOptions): TokenVerifier;
 //#endregion
-export { type CapabilityFailureCause, type CapabilitySubjectOptions, type CiOidcPrincipal, type CiOidcProvider, type CiOidcSubjectOptions, type DiscoveryInput, type DpopProofOptions, type DpopProofResult, type JoseTokenSignerOptions, type JoseTokenVerifierOptions, type JsonWebKeySet, type JwtAlgorithm, type JwtClaimPaths, type JwtJwks, type JwtPrincipal, type JwtSubjectOptions, type MappedSubject, type ReplayStore, memoryReplayStore };
+export { type CapabilityFailureCause, type CapabilitySubjectOptions, type CiOidcPrincipal, type CiOidcProvider, type CiOidcSubjectOptions, type DiscoveryInput, type DpopProofOptions, type DpopProofResult, type IntrospectionPrincipal, type JoseTokenSignerOptions, type JoseTokenVerifierOptions, type JsonWebKeySet, type JwtAlgorithm, type JwtJwks, type JwtPrincipal, type JwtSubjectOptions, type ReplayStore, memoryReplayStore };

package/dist/jwt/index.js

@@ -1,12 +1,114 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as sha256, t as bytesToBase64Url } from "../sha256-BO0swRXL.js";
-import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
-import { i as linkPolicyViolation, o as parseCapability, s as redeemerAllows, t as capabilitySubject } from "../capability-4qPdO9gk.js";
-import { a as decodeHeader, i as issuerFromDiscovery, n as assertSubjectConfig, o as normalizeTyp, r as fail, t as joseTokenVerifier } from "../verifier-BxBo6I44.js";
-import { t as loadJose } from "../load-jose-BL6LH4bL.js";
-import { n as mapClaimsToSubject, r as validateCustomClaims, t as acceptMismatch } from "../map-claims-Z4QZOiFF.js";
-import { t as memoryReplayStore } from "../replay-BsOyTrdV.js";
+import { o as epochSeconds, p as nowSeconds } from "../time-DkWjdL98.js";
+import { n as sha256, t as bytesToBase64Url } from "../sha256-D9ihqmvd.js";
+import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
+import { i as linkPolicyViolation, r as capabilitySubject, s as redeemerAllows, t as capabilityFromClaims } from "../capability-N1K9IpqS.js";
+import { a as verifierOptions, i as issuerFromDiscovery, n as assertSubjectConfig, o as decodeHeader, r as fail, s as normalizeTyp, t as joseTokenVerifier } from "../verifier-DHuh-okk.js";
+import { t as loadJose } from "../load-jose-DZ4dnjri.js";
+import { n as mapClaimsToSubject, r as validateCustomClaims, t as acceptMismatch } from "../map-claims-D3oRmTk0.js";
+import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
+//#region src/jwt/dpop.ts
+const DPOP_WINDOW_SECONDS = 60;
+const PROOF_ALGS = /* @__PURE__ */ new Set([
+	"ES256",
+	"PS256",
+	"Ed25519",
+	"EdDSA",
+	"RS256"
+]);
+const PRIVATE_MEMBERS = [
+	"d",
+	"p",
+	"q",
+	"dp",
+	"dq",
+	"qi",
+	"k"
+];
+function headerOf(request) {
+	return request.headers.get("DPoP") ?? request.headers.get("dpop");
+}
+function withoutQuery(value) {
+	if (typeof value !== "string" || !URL.canParse(value)) return null;
+	const url = new URL(value);
+	url.search = "";
+	url.hash = "";
+	return url.href;
+}
+async function claimJti(replay, key, expiresAt) {
+	if (replay.claim !== void 0) return replay.claim(key, expiresAt);
+	if (await replay.seen(key)) return false;
+	await replay.remember(key, expiresAt);
+	return true;
+}
+function verifyDpopProof(request, claims, accessToken, options = {}) {
+	return verify(request, claims, accessToken, options);
+}
+async function verify(request, claims, accessToken, options) {
+	const proof = headerOf(request);
+	if (proof === null || proof.length === 0) return {
+		ok: false,
+		cause: "dpop-proof-invalid"
+	};
+	const expectedJkt = claims["cnf"] !== null && typeof claims["cnf"] === "object" && !Array.isArray(claims["cnf"]) && typeof claims["cnf"].jkt === "string" ? claims["cnf"].jkt : void 0;
+	if (expectedJkt === void 0) return {
+		ok: false,
+		cause: "dpop-proof-invalid"
+	};
+	const header = decodeHeader(proof);
+	if (header?.typ?.toLowerCase() !== "dpop+jwt") return {
+		ok: false,
+		cause: "dpop-proof-invalid"
+	};
+	const jwk = header["jwk"];
+	if (!PROOF_ALGS.has(header.alg ?? "") || jwk === null || typeof jwk !== "object" || Array.isArray(jwk) || PRIVATE_MEMBERS.some((member) => member in jwk)) return {
+		ok: false,
+		cause: "dpop-proof-invalid"
+	};
+	try {
+		const jose = await loadJose();
+		const key = await jose.importJWK(jwk, header.alg);
+		const result = await jose.jwtVerify(proof, key, {
+			typ: "dpop+jwt",
+			maxTokenAge: DPOP_WINDOW_SECONDS
+		});
+		const jkt = await jose.calculateJwkThumbprint(jwk, "sha256");
+		if (jkt !== expectedJkt) return {
+			ok: false,
+			cause: "dpop-proof-invalid"
+		};
+		const htm = result.payload["htm"];
+		const htu = result.payload["htu"];
+		const expectedHtu = withoutQuery(request.url);
+		if (htm !== request.method || expectedHtu === null || withoutQuery(htu) !== expectedHtu) return {
+			ok: false,
+			cause: "dpop-proof-invalid"
+		};
+		if (accessToken !== void 0) {
+			const ath = bytesToBase64Url(sha256(accessToken));
+			if (result.payload["ath"] !== ath) return {
+				ok: false,
+				cause: "dpop-proof-invalid"
+			};
+		}
+		if (options.replay !== void 0) {
+			const jti = result.payload.jti;
+			const iat = result.payload.iat;
+			if (typeof jti !== "string" || jti === "" || typeof iat !== "number" || !await claimJti(options.replay, `dpop\u0000${jkt}\u0000${jti}`, iat + DPOP_WINDOW_SECONDS)) return {
+				ok: false,
+				cause: "dpop-proof-invalid"
+			};
+		}
+		return { ok: true };
+	} catch {
+		return {
+			ok: false,
+			cause: "dpop-proof-invalid"
+		};
+	}
+}
+//#endregion
 //#region src/jwt/capability.ts
 function emit(options, reason, cause, token) {
 	if (options.onAuth === void 0) return;
@@ -44,10 +146,11 @@ async function stores(options, capability, issuedAt, once) {
 	}
 }
 /**
-* Resolves a `permdock-capability+jwt` into the `link` subject it acts as.
+* Resolves a `vnd.permdock.capability+jwt` into the `link` subject it acts as.
 * Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim,
 * a revoked link, a replayed one-time token, a redeemer the viewer does not
-* satisfy, a throwing store) is the anonymous subject, never a throw.
+* satisfy, a `cnf` without a matching DPoP proof, a throwing store) is the
+* anonymous subject, never a throw.
 */
 async function subjectFromCapability(token, options) {
 	if (token === void 0 || token === null || token.length === 0) return anonymousSubject();
@@ -61,7 +164,7 @@ async function subjectFromCapability(token, options) {
 	try {
 		verifier = options.verifier ?? joseTokenVerifier({
 			...options,
-			typ: "permdock-capability+jwt"
+			typ: "vnd.permdock.capability+jwt"
 		});
 	} catch {
 		return deny("malformed");
@@ -69,7 +172,7 @@ async function subjectFromCapability(token, options) {
 	let verified;
 	try {
 		verified = await verifier.verify(token, compact({
-			typ: "permdock-capability+jwt",
+			typ: "vnd.permdock.capability+jwt",
 			issuer: options.issuer,
 			audience: options.audience,
 			clockTolerance: options.clockTolerance
@@ -78,16 +181,14 @@ async function subjectFromCapability(token, options) {
 		return deny("malformed");
 	}
 	if (!verified.ok) return deny(verified.cause);
-	if (normalizeTyp(verified.header.typ) !== "permdock-capability+jwt") return deny("wrong-token-type");
-	const parsed = parseCapability(verified.claims["capability"]);
-	const exp = verified.claims.exp;
-	if (parsed?.holder !== "link" || verified.claims.sub !== parsed.id || typeof exp !== "number") return deny("invalid-claims");
-	const capability = {
-		...parsed,
-		expiresAt: Math.min(parsed.expiresAt, exp)
-	};
-	const now = Date.now() / 1e3;
+	if (normalizeTyp(verified.header.typ) !== "vnd.permdock.capability+jwt") return deny("wrong-token-type");
+	const capability = capabilityFromClaims(verified.claims);
+	if (capability?.holder !== "link" || verified.claims["cnf"] !== void 0 && capability.cnf === void 0) return deny("invalid-claims");
+	const now = epochSeconds();
 	if (capability.expiresAt <= now) return deny("expired");
+	if (capability.cnf !== void 0) {
+		if (!(options.request === void 0 ? { ok: false } : await verifyDpopProof(options.request, verified.claims, token, compact({ replay: options.replay }))).ok) return deny("dpop-proof-invalid");
+	}
 	if (!redeemerAllows(capability.redeemer, options.viewer, now)) return deny("redeemer-mismatch");
 	const jti = verified.claims["jti"];
 	if (capability.once === true && (options.replay === void 0 || typeof jti !== "string" || jti === "")) return deny("invalid-claims");
@@ -217,107 +318,6 @@ async function subjectFromCiOidc(token, options) {
 	});
 }
 //#endregion
-//#region src/jwt/dpop.ts
-const DPOP_WINDOW_SECONDS = 60;
-const PROOF_ALGS = /* @__PURE__ */ new Set([
-	"ES256",
-	"PS256",
-	"Ed25519",
-	"EdDSA",
-	"RS256"
-]);
-const PRIVATE_MEMBERS = [
-	"d",
-	"p",
-	"q",
-	"dp",
-	"dq",
-	"qi",
-	"k"
-];
-function headerOf(request) {
-	return request.headers.get("DPoP") ?? request.headers.get("dpop");
-}
-function withoutQuery(value) {
-	if (typeof value !== "string" || !URL.canParse(value)) return null;
-	const url = new URL(value);
-	url.search = "";
-	url.hash = "";
-	return url.href;
-}
-async function claimJti(replay, key, expiresAt) {
-	if (replay.claim !== void 0) return replay.claim(key, expiresAt);
-	if (await replay.seen(key)) return false;
-	await replay.remember(key, expiresAt);
-	return true;
-}
-function verifyDpopProof(request, claims, accessToken, options = {}) {
-	return verify(request, claims, accessToken, options);
-}
-async function verify(request, claims, accessToken, options) {
-	const proof = headerOf(request);
-	if (proof === null || proof.length === 0) return {
-		ok: false,
-		cause: "dpop-proof-invalid"
-	};
-	const expectedJkt = claims["cnf"] !== null && typeof claims["cnf"] === "object" && !Array.isArray(claims["cnf"]) && typeof claims["cnf"].jkt === "string" ? claims["cnf"].jkt : void 0;
-	if (expectedJkt === void 0) return {
-		ok: false,
-		cause: "dpop-proof-invalid"
-	};
-	const header = decodeHeader(proof);
-	if (header?.typ?.toLowerCase() !== "dpop+jwt") return {
-		ok: false,
-		cause: "dpop-proof-invalid"
-	};
-	const jwk = header["jwk"];
-	if (!PROOF_ALGS.has(header.alg ?? "") || jwk === null || typeof jwk !== "object" || Array.isArray(jwk) || PRIVATE_MEMBERS.some((member) => member in jwk)) return {
-		ok: false,
-		cause: "dpop-proof-invalid"
-	};
-	try {
-		const jose = await loadJose();
-		const key = await jose.importJWK(jwk, header.alg);
-		const result = await jose.jwtVerify(proof, key, {
-			typ: "dpop+jwt",
-			maxTokenAge: DPOP_WINDOW_SECONDS
-		});
-		const jkt = await jose.calculateJwkThumbprint(jwk, "sha256");
-		if (jkt !== expectedJkt) return {
-			ok: false,
-			cause: "dpop-proof-invalid"
-		};
-		const htm = result.payload["htm"];
-		const htu = result.payload["htu"];
-		const expectedHtu = withoutQuery(request.url);
-		if (htm !== request.method || expectedHtu === null || withoutQuery(htu) !== expectedHtu) return {
-			ok: false,
-			cause: "dpop-proof-invalid"
-		};
-		if (accessToken !== void 0) {
-			const ath = bytesToBase64Url(sha256(accessToken));
-			if (result.payload["ath"] !== ath) return {
-				ok: false,
-				cause: "dpop-proof-invalid"
-			};
-		}
-		if (options.replay !== void 0) {
-			const jti = result.payload.jti;
-			const iat = result.payload.iat;
-			if (typeof jti !== "string" || jti === "" || typeof iat !== "number" || !await claimJti(options.replay, `dpop\u0000${jkt}\u0000${jti}`, iat + DPOP_WINDOW_SECONDS)) return {
-				ok: false,
-				cause: "dpop-proof-invalid"
-			};
-		}
-		return { ok: true };
-	} catch {
-		return {
-			ok: false,
-			cause: "dpop-proof-invalid"
-		};
-	}
-}
-//#endregion
 //#region src/jwt/introspection.ts
 function emitAuth$1(options, cause) {
 	if (options.onAuth === void 0) return;
@@ -329,12 +329,9 @@ function emitAuth$1(options, cause) {
 		requestId: options.requestId
 	}));
 }
-function isRecord$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function keyToCnf(key) {
-	if (!isRecord$1(key)) return;
-	if (isRecord$1(key["jwk"])) return { jwk: key["jwk"] };
+	if (!isRecord(key)) return;
+	if (isRecord(key["jwk"])) return { jwk: key["jwk"] };
 	return { jwk: key };
 }
 function introspectionToClaims(body) {
@@ -401,7 +398,7 @@ function boundToConfig(body, options) {
 }
 function subjectFromIntrospection(response, options = {}) {
 	try {
-		if (!isRecord$1(response) || response["active"] !== true || !boundToConfig(response, options)) return anonymousSubject();
+		if (!isRecord(response) || response["active"] !== true || !boundToConfig(response, options)) return anonymousSubject();
 		const mapped = mapClaimsToSubject(introspectionToClaims(response), options);
 		if (mapped.invalidChain) {
 			emitAuth$1(options, "invalid-chain");
@@ -421,9 +418,6 @@ const SIGNING_ALGS = /* @__PURE__ */ new Set([
 	"Ed25519",
 	"RS256"
 ]);
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function publicJwk(key) {
 	const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, k: _k, ...pub } = key;
 	return pub;
@@ -432,6 +426,8 @@ function joseTokenSigner(options) {
 	if (options.alg === "HS256" || options.alg === "EdDSA") throw new Error("PermDock: joseTokenSigner refuses HS* and polymorphic EdDSA on outputs.");
 	if (!SIGNING_ALGS.has(options.alg)) throw new Error(`PermDock: unsupported signing alg '${options.alg}'.`);
 	if (options.kid.length === 0) throw new Error("PermDock: joseTokenSigner requires kid.");
+	if (typeof options.issuer !== "string" || options.issuer.length === 0) throw new Error("PermDock: joseTokenSigner requires issuer.");
+	const issuer = options.issuer;
 	const importKey = async () => {
 		if (options.key instanceof Uint8Array) throw new TypeError("PermDock: HMAC keys cannot sign PermDock outputs.");
 		return (await loadJose()).importJWK(options.key, options.alg);
@@ -447,20 +443,24 @@ function joseTokenSigner(options) {
 		}
 	};
 	async function signJwt(payload, signOptions) {
+		const audience = signOptions.audience ?? options.audience;
+		if (audience === void 0 || audience.length === 0) throw new Error("PermDock: joseTokenSigner requires an audience.");
+		const issuedAt = signOptions.issuedAt ?? nowSeconds();
+		if (!Number.isSafeInteger(issuedAt)) throw new TypeError("PermDock: iat must be a whole NumericDate.");
 		const jose = await loadJose();
 		const key = await importKey();
-		const now = Math.floor(Date.now() / 1e3);
-		const jwt = new jose.SignJWT({ ...payload });
+		const { iss: _iss, aud: _aud, exp: _exp, iat: _iat, nbf: _nbf, jti: _jti, ...claims } = payload;
+		const jwt = new jose.SignJWT(claims);
 		jwt.setProtectedHeader({
 			alg: options.alg,
 			kid: options.kid,
 			typ: signOptions.typ
 		});
-		jwt.setIssuedAt(now);
-		jwt.setJti(globalThis.crypto.randomUUID());
-		if (options.issuer !== void 0) jwt.setIssuer(options.issuer);
-		if (signOptions.audience !== void 0) jwt.setAudience(signOptions.audience);
-		jwt.setExpirationTime(signOptions.expiresAt ?? now + 3600);
+		jwt.setIssuedAt(issuedAt);
+		jwt.setJti(signOptions.jti ?? globalThis.crypto.randomUUID());
+		jwt.setIssuer(issuer);
+		jwt.setAudience(audience);
+		jwt.setExpirationTime(signOptions.expiresAt ?? issuedAt + 3600);
 		return jwt.sign(key);
 	}
 }
@@ -490,6 +490,20 @@ function mtlsThumbprint(claims) {
 	const value = cnf["x5t#S256"];
 	return typeof value === "string" ? value : void 0;
 }
+/**
+* The sender constraint to enforce. Without a configured `sender`, a token
+* whose `cnf` binds it to a key or a certificate is held to that binding,
+* never accepted as a bearer token (RFC 9449 section 7.1, RFC 8705
+* section 3). An explicit `sender: "none"` is the opt-out for a gateway
+* that verified the binding upstream.
+*/
+function senderFor(options, cnf) {
+	if (options.sender !== void 0) return options.sender;
+	if (options.profile === "fapi2") return "dpop";
+	if (cnf === null || typeof cnf !== "object" || Array.isArray(cnf)) return "none";
+	if (Object.hasOwn(cnf, "jkt")) return "dpop";
+	return Object.hasOwn(cnf, "x5t#S256") ? "mtls" : "none";
+}
 async function extraMemberships(options, subject, tenant) {
 	if (options.memberships === void 0 || subject.principal === null) return subject;
 	try {
@@ -507,15 +521,21 @@ async function extraMemberships(options, subject, tenant) {
 			}
 		});
 	} catch {
+		options.onAuth?.(compact({
+			reason: "source-threw",
+			source: "memberships",
+			issuer: options.issuer,
+			requestId: options.requestId
+		}));
 		return subject;
 	}
 }
 function subjectFromJwt(token, options, request) {
 	return resolveSubject(token, options, request);
 }
-function createJwtSubjectResolver(options) {
+function jwtSubjectResolver(options) {
 	assertSubjectConfig(options);
-	const verifier = options.verifier ?? joseTokenVerifier(options);
+	const verifier = options.verifier ?? joseTokenVerifier(verifierOptions(options));
 	return (token, request) => resolveSubject(token, {
 		...options,
 		verifier
@@ -528,12 +548,13 @@ async function resolveSubject(token, options, request) {
 		emitAuth(options, "token-in-query", token);
 		return anonymousSubject();
 	}
-	const verifier = options.verifier ?? joseTokenVerifier(options);
+	const verifier = options.verifier ?? joseTokenVerifier(verifierOptions(options));
+	const audience = options.audience === false ? void 0 : options.audience;
 	const issuer = options.issuer ?? (options.discovery === void 0 ? void 0 : issuerFromDiscovery(options.discovery));
 	let verified;
 	try {
 		verified = await verifier.verify(token, compact({
-			audience: options.audience,
+			audience,
 			issuer,
 			clockTolerance: options.clockTolerance,
 			typ: options.accept === "id-token" ? ["JWT"] : options.profile === "fapi2" ? "at+jwt" : ["at+jwt", "JWT"]
@@ -545,13 +566,13 @@ async function resolveSubject(token, options, request) {
 		emitAuth(options, verified.cause, token);
 		return anonymousSubject();
 	}
-	if (acceptMismatch(verified.claims, verified.header.typ, options, options.audience)) {
+	if (acceptMismatch(verified.claims, verified.header.typ, options, audience)) {
 		emitAuth(options, "wrong-token-type", token);
 		return anonymousSubject();
 	}
-	const sender = options.sender ?? (options.profile === "fapi2" ? "dpop" : "none");
 	const cnf = verified.claims["cnf"];
 	const hasCnf = cnf !== null && typeof cnf === "object";
+	const sender = senderFor(options, cnf);
 	if (options.profile === "fapi2" && !hasCnf) {
 		emitAuth(options, "sender-constraint-required", token);
 		return anonymousSubject();
@@ -587,4 +608,4 @@ async function resolveSubject(token, options, request) {
 	return extraMemberships(options, mapped.subject, mapped.subject.principal.tenant);
 }
 //#endregion
-export { createJwtSubjectResolver, joseTokenSigner, joseTokenVerifier, memoryReplayStore, subjectFromCapability, subjectFromCiOidc, subjectFromIntrospection, subjectFromJwt, verifyDpopProof };
+export { joseTokenSigner, joseTokenVerifier, jwtSubjectResolver, memoryReplayStore, subjectFromCapability, subjectFromCiOidc, subjectFromIntrospection, subjectFromJwt, verifyDpopProof };