serverless-event-orchestrator 1.3.2 → 2.0.1

package/README.md

@@ -10,7 +10,7 @@ A lightweight, type-safe event dispatcher and middleware orchestrator for AWS La
 - **Multi-Trigger Support**: Handle HTTP (API Gateway), SQS, EventBridge, and Lambda invocations with a single handler
 - **Segmented Routing**: Organize routes by security context (`public`, `private`, `backoffice`, `internal`)
 - **Path Parameters**: Built-in support for dynamic routes like `/users/{id}`
-- **Identity Aware**: Automatic Cognito User Pool validation per segment and optional JWT extraction from headers
+- **Identity Aware**: Cryptographic JWT signature verification via `aws-jwt-verify`, Cognito User Pool validation per segment
 - **Middleware Support**: Global and per-segment middleware chains
 - **Zero Config CORS**: Built-in CORS handling with sensible defaults
 - **Response Utilities**: Standardized response helpers (success, error, etc.)
@@ -111,10 +111,17 @@ const routes: SegmentedHttpRouter = {
 export const handler = async (event: any) => {
   return dispatchEvent(event, { apigateway: routes }, {
     debug: process.env.DEBUG === 'true',
-    userPools: {
-      private: process.env.USER_POOL_ID,
-      backoffice: process.env.ADMIN_POOL_ID
-    }
+    autoExtractIdentity: true,
+    jwtVerification: {
+      private: {
+        userPoolId: process.env.USER_POOL_ID!,
+        clientId: null,
+      },
+      backoffice: {
+        userPoolId: process.env.ADMIN_POOL_ID!,
+        clientId: null,
+      },
+    },
   });
 };
 ```
@@ -239,29 +246,68 @@ customErrorResponse(MyErrorCodes.QUOTA_EXCEEDED, 'API quota exceeded', codeToSta
 
 ## Identity & Security
 
-Extract and validate Cognito claims:
+### JWT Signature Verification (v2.0+)
+
+JWTs from the `Authorization` header are cryptographically verified against Cognito's JWKS endpoint using [`aws-jwt-verify`](https://github.com/awslabs/aws-jwt-verify). This prevents accepting fabricated tokens with arbitrary claims.
 
 ```typescript
-import { 
-  extractIdentity, 
-  hasAnyGroup, 
-  hasAllGroups,
-  validateIssuer 
+export const handler = async (event: any) => {
+  return dispatchEvent(event, { apigateway: routes }, {
+    autoExtractIdentity: true,
+    jwtVerification: {
+      // Verify tokens for private routes against the Portal User Pool
+      private: {
+        userPoolId: process.env.COGNITO_PORTAL_USER_POOL_ID!,
+        clientId: null,         // null = skip client ID check
+      },
+      // Verify tokens for backoffice routes against the Backoffice User Pool
+      backoffice: {
+        userPoolId: process.env.COGNITO_BACKOFFICE_USER_POOL_ID!,
+        clientId: null,
+      },
+    },
+  });
+};
+```
+
+**How it works:**
+
+- If `event.requestContext.authorizer.claims` exists (API Gateway authorizer), those claims are used directly (already verified by API Gateway)
+- If no authorizer claims exist and `autoExtractIdentity` + `jwtVerification` are configured, the `Authorization` header JWT is verified cryptographically
+- If verification fails, the dispatcher returns **401 Unauthorized**
+- Public and internal segments don't require `jwtVerification`
+- JWKS keys are cached at the module level (persists across Lambda warm starts)
+
+**`JwtVerificationPoolConfig` options:**
+
+| Property | Type | Description |
+|----------|------|-------------|
+| `userPoolId` | `string` | Cognito User Pool ID (e.g., `us-east-1_ABC123`) |
+| `clientId` | `string \| string[] \| null` | App Client ID(s). `null` to skip client ID verification |
+| `tokenUse` | `'id' \| 'access' \| null` | Expected token type. `null` to accept either |
+
+### Working with Identity in Handlers
+
+```typescript
+import {
+  hasAnyGroup,
+  hasAllGroups
 } from 'serverless-event-orchestrator';
 
 const myHandler = async (event: NormalizedEvent) => {
   const identity = event.context.identity;
-  
+
   // Access user info
   console.log(identity?.userId);   // Cognito sub
   console.log(identity?.email);    // User email
   console.log(identity?.groups);   // Cognito groups
-  
+  console.log(identity?.claims);   // All JWT claims
+
   // Check groups
   if (hasAnyGroup(identity, ['Admins', 'Moderators'])) {
     // User has admin or moderator role
   }
-  
+
   if (hasAllGroups(identity, ['Premium', 'Verified'])) {
     // User has both premium and verified status
   }
@@ -296,14 +342,19 @@ const config: OrchestratorConfig = {
   // Enable debug logging
   debug: process.env.NODE_ENV !== 'production',
   
-  // Automatically extract identity from Authorization header if no authorizer is present
-  // Useful when you don't use Cognito Authorizers in API Gateway
+  // Extract identity from Authorization header JWT
   autoExtractIdentity: true,
-  
-  // User Pool validation per segment
-  userPools: {
-    private: 'us-east-1_ABC123',
-    backoffice: 'us-east-1_XYZ789'
+
+  // JWT signature verification per segment (v2.0+)
+  jwtVerification: {
+    private: {
+      userPoolId: 'us-east-1_ABC123',
+      clientId: null,
+    },
+    backoffice: {
+      userPoolId: 'us-east-1_XYZ789',
+      clientId: null,
+    },
   },
   
   // Global middleware (runs for all routes)
@@ -354,7 +405,8 @@ export const handler = async (event: any) => {
 
 | Function | Description |
 |----------|-------------|
-| `extractIdentity(event)` | Extracts Cognito claims from event |
+| `extractIdentity(event, options?)` | Extracts and verifies Cognito claims (async) |
+| `verifyJwt(token, poolConfig)` | Verifies a JWT against Cognito JWKS |
 | `validateIssuer(identity, userPoolId)` | Validates token issuer |
 | `hasAnyGroup(identity, groups)` | Checks if user has any of the groups |
 | `hasAllGroups(identity, groups)` | Checks if user has all groups |
@@ -372,6 +424,7 @@ import type {
   IdentityContext,
   RouteConfig,
   OrchestratorConfig,
+  JwtVerificationPoolConfig,
   MiddlewareFn
 } from 'serverless-event-orchestrator';
 ```

package/dist/dispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAgB,MAAM,4BAA4B,CAAC;AACrE,OAAO,EACL,cAAc,EASd,kBAAkB,EAEnB,MAAM,mBAAmB,CAAC;AAO3B;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,GAAG,SAAS,CAMrD;AA8RD;;GAEG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,cAAc,EACtB,MAAM,GAAE,kBAAuB,GAC9B,OAAO,CAAC,GAAG,CAAC,CA8Kd;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,kBAAuB;sBAE5C,GAAG,UAAU,cAAc;;EAGhD"}
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAgB,MAAM,4BAA4B,CAAC;AACrE,OAAO,EACL,cAAc,EASd,kBAAkB,EAEnB,MAAM,mBAAmB,CAAC;AAQ3B;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,GAAG,SAAS,CAMrD;AA+RD;;GAEG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,cAAc,EACtB,MAAM,GAAE,kBAAuB,GAC9B,OAAO,CAAC,GAAG,CAAC,CAwLd;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,kBAAuB;sBAE5C,GAAG,UAAU,cAAc;;EAGhD"}

package/dist/dispatcher.js

@@ -114,8 +114,8 @@ function findRouteInSegmentsWithActualPath(router, method, routePattern, actualP
 /**
  * Normalizes an API Gateway event into a standard format
  */
-function normalizeApiGatewayEvent(event, segment, extractedParams, autoExtract = false) {
-    const identity = (0, extractor_js_1.extractIdentity)(event, autoExtract);
+async function normalizeApiGatewayEvent(event, segment, extractedParams, autoExtract = false, jwtVerificationConfig) {
+    const identity = await (0, extractor_js_1.extractIdentity)(event, { autoExtract, jwtVerificationConfig });
     // Safely extract pathParameters from event (handle null/undefined)
     const eventPathParams = event.pathParameters && typeof event.pathParameters === 'object'
         ? { ...event.pathParameters }
@@ -330,9 +330,17 @@ async function dispatchEvent(event, routes, config = {}) {
         if (debug) {
             console.log('[SEO] Route matched:', routeMatch.segment, 'Params:', routeMatch.params);
         }
-        // Normalize event
-        let normalized = normalizeApiGatewayEvent(event, routeMatch.segment, routeMatch.params, config.autoExtractIdentity);
-        // Validate User Pool
+        // Normalize event (with JWT verification if configured for this segment)
+        const jwtVerificationConfig = config.jwtVerification?.[routeMatch.segment];
+        let normalized = await normalizeApiGatewayEvent(event, routeMatch.segment, routeMatch.params, config.autoExtractIdentity, jwtVerificationConfig);
+        // If JWT verification is configured but identity is missing, return 401
+        if (jwtVerificationConfig && !normalized.context.identity) {
+            if (debug) {
+                console.log('[SEO] JWT verification failed — no valid identity for segment:', routeMatch.segment);
+            }
+            return applyCorsToResponse((0, response_js_1.unauthorizedResponse)('Invalid or missing authentication token'));
+        }
+        // Validate User Pool (legacy issuer-only check)
         if (!validateSegmentUserPool(normalized, routeMatch.segment, config)) {
             if (debug) {
                 console.log('[SEO] User Pool validation failed for segment:', routeMatch.segment);

package/dist/dispatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":";;AAuBA,0CAMC;AAiSD,sCAkLC;AAKD,gDAKC;AA1fD,mEAAqE;AAcrE,6DAAmE;AACnE,mDAAsD;AACtD,0DAAwE;AACxE,0DAA0E;AAC1E,oDAA6F;AAE7F;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAU;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,8BAAS,CAAC,WAAW,CAAC;IAClE,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,8BAAS,CAAC,UAAU,CAAC;IAC1E,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,KAAK,SAAS;QAAE,OAAO,8BAAS,CAAC,GAAG,CAAC;IACvH,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,8BAAS,CAAC,MAAM,CAAC;IAChD,OAAO,8BAAS,CAAC,OAAO,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAW;IACpC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,MAAW;IAClC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,OAA+C;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,OAA+C;IAC/E,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC9D,OAAO,EAAE,CAAC;AACZ,CAAC;AAGD;;GAEG;AACH,SAAS,+BAA+B,CACtC,MAA8B,EAC9B,MAAkB,EAClB,YAAoB,EACpB,UAAkB;IAElB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,iBAAiB,GAAG,IAAA,+BAAa,EAAC,YAAY,CAAC,CAAC;IACtD,MAAM,oBAAoB,GAAG,IAAA,+BAAa,EAAC,UAAU,CAAC,CAAC;IAEvD,0CAA0C;IAC1C,IAAI,YAAY,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpC,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAA,2BAAS,EAAC,iBAAiB,EAAE,oBAAoB,CAAC,IAAI,EAAE,CAAC;QACxE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7D,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAA,2BAAS,EAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,iCAAiC,CACxC,MAAqD,EACrD,MAAkB,EAClB,YAAoB,EACpB,UAAkB;IAElB,MAAM,QAAQ,GAAmB;QAC/B,iCAAY,CAAC,MAAM;QACnB,iCAAY,CAAC,OAAO;QACpB,iCAAY,CAAC,UAAU;QACvB,iCAAY,CAAC,QAAQ;KACtB,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,+BAA+B,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAE7F,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;gBAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO;gBACP,UAAU,EAAE,wBAAwB,CAAC,aAAa,CAAC;gBACnD,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAGD;;GAEG;AACH,SAAS,wBAAwB,CAC/B,KAAU,EACV,OAAqB,EACrB,eAAuC,EACvC,cAAuB,KAAK;IAE5B,MAAM,QAAQ,GAAG,IAAA,8BAAe,EAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAErD,mEAAmE;IACnE,MAAM,eAAe,GAA2B,KAAK,CAAC,cAAc,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QAC9G,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,cAAc,EAAE;QAC7B,CAAC,CAAC,EAAE,CAAC;IAEP,gGAAgG;IAChG,MAAM,MAAM,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC;IAE1D,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,8BAAS,CAAC,UAAU;QAC/B,OAAO,EAAE;YACP,IAAI,EAAE,IAAA,8BAAa,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,eAAe,CAAC;YACtD,cAAc,EAAE,MAAM;YACtB,qBAAqB,EAAE,IAAA,iCAAgB,EAAC,KAAK,CAAC,qBAAqB,CAAC;YACpE,OAAO,EAAE,IAAA,6BAAgB,EAAC,KAAK,CAAC,OAAO,CAAC;SACzC;QACD,MAAM;QACN,OAAO,EAAE;YACP,OAAO;YACP,QAAQ;YACR,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS;SAC3C;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,KAAU;IAC3C,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,8BAAS,CAAC,WAAW;QAChC,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,MAAM;SACnB;QACD,MAAM,EAAE,EAAE;QACV,OAAO,EAAE;YACP,OAAO,EAAE,iCAAY,CAAC,QAAQ;YAC9B,SAAS,EAAE,KAAK,CAAC,EAAE;SACpB;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,KAAU;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,IAAI,GAAwB,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAwB,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,8BAAS,CAAC,GAAG;QACxB,OAAO,EAAE;YACP,IAAI;SACL;QACD,MAAM,EAAE,EAAE;QACV,OAAO,EAAE;YACP,OAAO,EAAE,iCAAY,CAAC,QAAQ;YAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,KAAU;IACtC,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,8BAAS,CAAC,MAAM;QAC3B,OAAO,EAAE;YACP,IAAI,EAAE,KAAK;SACZ;QACD,MAAM,EAAE,EAAE;QACV,OAAO,EAAE;YACP,OAAO,EAAE,iCAAY,CAAC,QAAQ;SAC/B;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAC9B,UAA2B,EAC3B,OAAqB,EACrB,MAA0B;IAE1B,yCAAyC;IACzC,IAAI,OAAO,KAAK,iCAAY,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEjD,0CAA0C;IAC1C,MAAM,kBAAkB,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,6CAA6C;IAC7C,OAAO,IAAA,6BAAc,EAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,YAAY,IAAI,KAAK;QACrB,OAAQ,KAAa,CAAC,UAAU,KAAK,QAAQ,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,UAA0B,EAC1B,KAAsB;IAEtB,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,YAAY,GAAG,MAAM,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,QAAa;IACxC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE/D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAClD,oIAAoI,CAAC;IACvI,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,mCAAmC,CAAC;IAE5F,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IAE/C,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE;YACP,6BAA6B,EAAE,UAAU;YACzC,8BAA8B,EAAE,WAAW;YAC3C,8BAA8B,EAAE,WAAW;YAC3C,GAAG,eAAe;SACnB;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CACjC,KAAU,EACV,MAAsB,EACtB,SAA6B,EAAE;IAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IAEpC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEpC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,4BAA4B;IAC5B,IAAI,IAAI,KAAK,8BAAS,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,WAAW,EAAgB,CAAC;QAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;QAClD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC;QAEhD,+CAA+C;QAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC;YAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAClD,oIAAoI,CAAC;YACvI,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,mCAAmC,CAAC;YAC5F,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC;YAErD,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE;oBACP,6BAA6B,EAAE,UAAU;oBACzC,8BAA8B,EAAE,WAAW;oBAC3C,8BAA8B,EAAE,WAAW;oBAC3C,wBAAwB,EAAE,UAAU;iBACrC;gBACD,IAAI,EAAE,EAAE;aACT,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAA,8BAAgB,EAAC,0BAA0B,CAAC,CAAC,CAAC;QAC7G,CAAC;QAED,IAAI,UAAU,GAAsB,IAAI,CAAC;QAEzC,0EAA0E;QAC1E,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAuB,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAC1G,IAAI,MAAM,EAAE,CAAC;gBACX,UAAU,GAAG;oBACX,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;oBAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,iCAAY,CAAC,MAAM;oBAC5B,UAAU,EAAE,EAAE;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAA,8BAAgB,EAAC,oBAAoB,MAAM,CAAC,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC;QAC7I,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACxF,CAAC;QAED,kBAAkB;QAClB,IAAI,UAAU,GAAG,wBAAwB,CACvC,KAAK,EACL,UAAU,CAAC,OAAO,EAClB,UAAU,CAAC,MAAM,EACjB,MAAM,CAAC,mBAAmB,CAC3B,CAAC;QAEF,qBAAqB;QACrB,IAAI,CAAC,uBAAuB,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACrE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,gDAAgD,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,IAAA,+BAAiB,EAAC,qCAAqC,CAAC,CAAC,CAAC;QAC1H,CAAC;QAED,kEAAkE;QAClE,IAAI,CAAC;YACH,4BAA4B;YAC5B,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;gBACpC,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;YAC5E,CAAC;YAED,6BAA6B;YAC7B,IAAI,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;gBAClC,UAAU,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,4FAA4F;YAC5F,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,yCAAyC;YACzC,MAAM,MAAM,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7D,OAAO,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;IAED,4BAA4B;IAC5B,IAAI,IAAI,KAAK,8BAAS,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC;QAClD,MAAM,OAAO,GAAG,aAAa;YAC3B,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,OAAO;YACpE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;QAEhC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,aAAa,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,oBAAoB;IACpB,IAAI,IAAI,KAAK,8BAAS,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC;QAClD,MAAM,SAAS,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;QAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,SAAS,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;QAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,2BAA2B;IAC3B,IAAI,IAAI,KAAK,8BAAS,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAEvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,qBAAqB;IACrB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,oBAAoB,CAAC,IAAI,IAAA,gCAAkB,EAAC,oBAAoB,CAAC,CAAC;AAC1G,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,SAA6B,EAAE;IAChE,OAAO;QACL,QAAQ,EAAE,CAAC,KAAU,EAAE,MAAsB,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;QACtF,MAAM;KACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../src/dispatcher.ts"],"names":[],"mappings":";;AAwBA,0CAMC;AAkSD,sCA4LC;AAKD,gDAKC;AAtgBD,mEAAqE;AAcrE,6DAAmE;AACnE,mDAAsD;AACtD,0DAAwE;AACxE,0DAA0E;AAE1E,oDAAmH;AAEnH;;GAEG;AACH,SAAgB,eAAe,CAAC,KAAU;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc;QAAE,OAAO,8BAAS,CAAC,WAAW,CAAC;IAClE,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,8BAAS,CAAC,UAAU,CAAC;IAC1E,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,KAAK,SAAS;QAAE,OAAO,8BAAS,CAAC,GAAG,CAAC;IACvH,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,8BAAS,CAAC,MAAM,CAAC;IAChD,OAAO,8BAAS,CAAC,OAAO,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAW;IACpC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,MAAW;IAClC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,OAA+C;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IACpD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,OAA+C;IAC/E,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,eAAe,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC9D,OAAO,EAAE,CAAC;AACZ,CAAC;AAGD;;GAEG;AACH,SAAS,+BAA+B,CACtC,MAA8B,EAC9B,MAAkB,EAClB,YAAoB,EACpB,UAAkB;IAElB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,iBAAiB,GAAG,IAAA,+BAAa,EAAC,YAAY,CAAC,CAAC;IACtD,MAAM,oBAAoB,GAAG,IAAA,+BAAa,EAAC,UAAU,CAAC,CAAC;IAEvD,0CAA0C;IAC1C,IAAI,YAAY,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpC,wDAAwD;QACxD,MAAM,MAAM,GAAG,IAAA,2BAAS,EAAC,iBAAiB,EAAE,oBAAoB,CAAC,IAAI,EAAE,CAAC;QACxE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7D,CAAC;IAED,6BAA6B;IAC7B,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAA,2BAAS,EAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,iCAAiC,CACxC,MAAqD,EACrD,MAAkB,EAClB,YAAoB,EACpB,UAAkB;IAElB,MAAM,QAAQ,GAAmB;QAC/B,iCAAY,CAAC,MAAM;QACnB,iCAAY,CAAC,OAAO;QACpB,iCAAY,CAAC,UAAU;QACvB,iCAAY,CAAC,QAAQ;KACtB,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,+BAA+B,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAE7F,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;gBAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO;gBACP,UAAU,EAAE,wBAAwB,CAAC,aAAa,CAAC;gBACnD,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAGD;;GAEG;AACH,KAAK,UAAU,wBAAwB,CACrC,KAAU,EACV,OAAqB,EACrB,eAAuC,EACvC,cAAuB,KAAK,EAC5B,qBAAiD;IAEjD,MAAM,QAAQ,GAAG,MAAM,IAAA,8BAAe,EAAC,KAAK,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAEtF,mEAAmE;IACnE,MAAM,eAAe,GAA2B,KAAK,CAAC,cAAc,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QAC9G,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,cAAc,EAAE;QAC7B,CAAC,CAAC,EAAE,CAAC;IAEP,gGAAgG;IAChG,MAAM,MAAM,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,eAAe,EAAE,CAAC;IAE1D,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,8BAAS,CAAC,UAAU;QAC/B,OAAO,EAAE;YACP,IAAI,EAAE,IAAA,8BAAa,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,eAAe,CAAC;YACtD,cAAc,EAAE,MAAM;YACtB,qBAAqB,EAAE,IAAA,iCAAgB,EAAC,KAAK,CAAC,qBAAqB,CAAC;YACpE,OAAO,EAAE,IAAA,6BAAgB,EAAC,KAAK,CAAC,OAAO,CAAC;SACzC;QACD,MAAM;QACN,OAAO,EAAE;YACP,OAAO;YACP,QAAQ;YACR,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE,SAAS;SAC3C;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,KAAU;IAC3C,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,8BAAS,CAAC,WAAW;QAChC,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,MAAM;SACnB;QACD,MAAM,EAAE,EAAE;QACV,OAAO,EAAE;YACP,OAAO,EAAE,iCAAY,CAAC,QAAQ;YAC9B,SAAS,EAAE,KAAK,CAAC,EAAE;SACpB;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,KAAU;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,IAAI,GAAwB,EAAE,CAAC;IAEnC,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAwB,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,8BAAS,CAAC,GAAG;QACxB,OAAO,EAAE;YACP,IAAI;SACL;QACD,MAAM,EAAE,EAAE;QACV,OAAO,EAAE;YACP,OAAO,EAAE,iCAAY,CAAC,QAAQ;YAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,KAAU;IACtC,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,8BAAS,CAAC,MAAM;QAC3B,OAAO,EAAE;YACP,IAAI,EAAE,KAAK;SACZ;QACD,MAAM,EAAE,EAAE;QACV,OAAO,EAAE;YACP,OAAO,EAAE,iCAAY,CAAC,QAAQ;SAC/B;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAC9B,UAA2B,EAC3B,OAAqB,EACrB,MAA0B;IAE1B,yCAAyC;IACzC,IAAI,OAAO,KAAK,iCAAY,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEjD,0CAA0C;IAC1C,MAAM,kBAAkB,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAErC,6CAA6C;IAC7C,OAAO,IAAA,6BAAc,EAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,YAAY,IAAI,KAAK;QACrB,OAAQ,KAAa,CAAC,UAAU,KAAK,QAAQ,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,UAA0B,EAC1B,KAAsB;IAEtB,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,MAAM,EAAE,CAAC;YACX,YAAY,GAAG,MAAM,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,QAAa;IACxC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE/D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAClD,oIAAoI,CAAC;IACvI,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,mCAAmC,CAAC;IAE5F,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;IAE/C,OAAO;QACL,GAAG,QAAQ;QACX,OAAO,EAAE;YACP,6BAA6B,EAAE,UAAU;YACzC,8BAA8B,EAAE,WAAW;YAC3C,8BAA8B,EAAE,WAAW;YAC3C,GAAG,eAAe;SACnB;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CACjC,KAAU,EACV,MAAsB,EACtB,SAA6B,EAAE;IAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IAEpC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEpC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,4BAA4B;IAC5B,IAAI,IAAI,KAAK,8BAAS,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,WAAW,EAAgB,CAAC;QAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC;QAClD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC;QAEhD,+CAA+C;QAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC;YAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;gBAClD,oIAAoI,CAAC;YACvI,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,mCAAmC,CAAC;YAC5F,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC;YAErD,OAAO;gBACL,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE;oBACP,6BAA6B,EAAE,UAAU;oBACzC,8BAA8B,EAAE,WAAW;oBAC3C,8BAA8B,EAAE,WAAW;oBAC3C,wBAAwB,EAAE,UAAU;iBACrC;gBACD,IAAI,EAAE,EAAE;aACT,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAA,8BAAgB,EAAC,0BAA0B,CAAC,CAAC,CAAC;QAC7G,CAAC;QAED,IAAI,UAAU,GAAsB,IAAI,CAAC;QAEzC,0EAA0E;QAC1E,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAuB,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC;YAC1G,IAAI,MAAM,EAAE,CAAC;gBACX,UAAU,GAAG;oBACX,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;oBAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,iCAAY,CAAC,MAAM;oBAC5B,UAAU,EAAE,EAAE;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAA,8BAAgB,EAAC,oBAAoB,MAAM,CAAC,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC;QAC7I,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACxF,CAAC;QAED,yEAAyE;QACzE,MAAM,qBAAqB,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3E,IAAI,UAAU,GAAG,MAAM,wBAAwB,CAC7C,KAAK,EACL,UAAU,CAAC,OAAO,EAClB,UAAU,CAAC,MAAM,EACjB,MAAM,CAAC,mBAAmB,EAC1B,qBAAqB,CACtB,CAAC;QAEF,wEAAwE;QACxE,IAAI,qBAAqB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1D,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,gEAAgE,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,mBAAmB,CAAC,IAAA,kCAAoB,EAAC,yCAAyC,CAAC,CAAC,CAAC;QAC9F,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,uBAAuB,CAAC,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACrE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,gDAAgD,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,IAAA,+BAAiB,EAAC,qCAAqC,CAAC,CAAC,CAAC;QAC1H,CAAC;QAED,kEAAkE;QAClE,IAAI,CAAC;YACH,4BAA4B;YAC5B,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;gBACpC,UAAU,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;YAC5E,CAAC;YAED,6BAA6B;YAC7B,IAAI,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;gBAClC,UAAU,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,4FAA4F;YAC5F,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,yCAAyC;YACzC,MAAM,MAAM,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7D,OAAO,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAC9C,CAAC;IAED,4BAA4B;IAC5B,IAAI,IAAI,KAAK,8BAAS,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC;QAClD,MAAM,OAAO,GAAG,aAAa;YAC3B,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,OAAO;YACpE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;QAEhC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,aAAa,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,oBAAoB;IACpB,IAAI,IAAI,KAAK,8BAAS,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC;QAClD,MAAM,SAAS,GAAG,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;QAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,SAAS,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;QAC5D,CAAC;QAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,2BAA2B;IAC3B,IAAI,IAAI,KAAK,8BAAS,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;QAEvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAED,qBAAqB;IACrB,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,oBAAoB,CAAC,IAAI,IAAA,gCAAkB,EAAC,oBAAoB,CAAC,CAAC;AAC1G,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,SAA6B,EAAE;IAChE,OAAO;QACL,QAAQ,EAAE,CAAC,KAAU,EAAE,MAAsB,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC;QACtF,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/identity/extractor.d.ts

@@ -1,11 +1,22 @@
-import { IdentityContext } from '../types/routes.js';
+import { IdentityContext, JwtVerificationPoolConfig } from '../types/routes.js';
 /**
- * Extracts identity information from the event's authorizer context or Authorization header
+ * Options for extractIdentity when using JWT verification
+ */
+export interface ExtractIdentityOptions {
+    autoExtract?: boolean;
+    jwtVerificationConfig?: JwtVerificationPoolConfig;
+}
+/**
+ * Extracts identity information from the event's authorizer context or Authorization header.
+ * When jwtVerificationConfig is provided, JWT signatures are cryptographically verified
+ * against the Cognito JWKS endpoint. Without it, identity is only extracted from
+ * API Gateway authorizer claims (already verified by API Gateway).
+ *
  * @param event - Raw API Gateway event
- * @param autoExtract - Whether to automatically extract from Authorization header if authorizer is missing
+ * @param optionsOrAutoExtract - Boolean for backwards compatibility, or ExtractIdentityOptions
  * @returns Identity context or undefined if not authenticated
  */
-export declare function extractIdentity(event: any, autoExtract?: boolean): IdentityContext | undefined;
+export declare function extractIdentity(event: any, optionsOrAutoExtract?: boolean | ExtractIdentityOptions): Promise<IdentityContext | undefined>;
 /**
  * Extracts the User Pool ID from the issuer URL
  * @param issuer - Cognito issuer URL (e.g., https://cognito-idp.us-east-1.amazonaws.com/us-east-1_xxxxx)

package/dist/identity/extractor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/identity/extractor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAoDrD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,WAAW,GAAE,OAAe,GAAG,eAAe,GAAG,SAAS,CAuBrG;AAmCD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAMhF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAKzG;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAInG;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAIrG"}
+{"version":3,"file":"extractor.d.ts","sourceRoot":"","sources":["../../src/identity/extractor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAGhF;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qBAAqB,CAAC,EAAE,yBAAyB,CAAC;CACnD;AAoDD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,oBAAoB,CAAC,EAAE,OAAO,GAAG,sBAAsB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAuC/I;AAgDD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAMhF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAKzG;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAInG;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAIrG"}

package/dist/identity/extractor.js

@@ -5,6 +5,7 @@ exports.extractUserPoolId = extractUserPoolId;
 exports.validateIssuer = validateIssuer;
 exports.hasAnyGroup = hasAnyGroup;
 exports.hasAllGroups = hasAllGroups;
+const jwt_verifier_js_1 = require("./jwt-verifier.js");
 /**
  * Extracts identity context from API Gateway authorizer claims
  * Supports multiple API Gateway formats:
@@ -50,31 +51,48 @@ function hasIdentityProperties(obj) {
     return identityKeys.some(key => key in obj);
 }
 /**
- * Extracts identity information from the event's authorizer context or Authorization header
+ * Extracts identity information from the event's authorizer context or Authorization header.
+ * When jwtVerificationConfig is provided, JWT signatures are cryptographically verified
+ * against the Cognito JWKS endpoint. Without it, identity is only extracted from
+ * API Gateway authorizer claims (already verified by API Gateway).
+ *
  * @param event - Raw API Gateway event
- * @param autoExtract - Whether to automatically extract from Authorization header if authorizer is missing
+ * @param optionsOrAutoExtract - Boolean for backwards compatibility, or ExtractIdentityOptions
  * @returns Identity context or undefined if not authenticated
  */
-function extractIdentity(event, autoExtract = false) {
+async function extractIdentity(event, optionsOrAutoExtract) {
+    const options = typeof optionsOrAutoExtract === 'boolean'
+        ? { autoExtract: optionsOrAutoExtract }
+        : optionsOrAutoExtract ?? {};
+    const { autoExtract = false, jwtVerificationConfig } = options;
     const authorizer = event?.requestContext?.authorizer;
-    let claims = extractClaims(authorizer);
-    // If no authorizer claims found and autoExtract is enabled, try decoding the Authorization header
-    if (!claims && autoExtract) {
+    const claims = extractClaims(authorizer);
+    // If authorizer claims exist, API Gateway already verified the token — use them directly
+    if (claims) {
+        return buildIdentity(claims);
+    }
+    // If autoExtract is enabled, extract identity from Authorization header
+    if (autoExtract) {
         const authHeader = event?.headers?.authorization || event?.headers?.Authorization;
         if (authHeader) {
-            claims = decodeJwtFromHeader(authHeader);
+            // If jwtVerificationConfig is provided, verify signature cryptographically
+            if (jwtVerificationConfig) {
+                const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : authHeader;
+                const verifiedClaims = await (0, jwt_verifier_js_1.verifyJwt)(token, jwtVerificationConfig);
+                if (verifiedClaims) {
+                    return buildIdentity(verifiedClaims);
+                }
+                // Verification failed → return undefined (caller will return 401)
+                return undefined;
+            }
+            // No jwtVerificationConfig → decode-only fallback (no signature verification)
+            const decoded = decodeJwtFromHeader(authHeader);
+            if (decoded) {
+                return buildIdentity(decoded);
+            }
         }
     }
-    if (!claims) {
-        return undefined;
-    }
-    return {
-        userId: claims.userId || claims.user_id || claims['cognito:username'] || claims.sub,
-        email: claims.email,
-        groups: parseGroups(claims['cognito:groups'] || claims.groups),
-        issuer: claims.iss,
-        claims,
-    };
+    return undefined;
 }
 /**
  * Decodes a JWT from the Authorization header without validating signature
@@ -96,6 +114,18 @@ function decodeJwtFromHeader(authHeader) {
         return undefined;
     }
 }
+/**
+ * Builds an IdentityContext from raw claims
+ */
+function buildIdentity(claims) {
+    return {
+        userId: claims.userId || claims.user_id || claims['cognito:username'] || claims.sub,
+        email: claims.email,
+        groups: parseGroups(claims['cognito:groups'] || claims.groups),
+        issuer: claims.iss,
+        claims,
+    };
+}
 /**
  * Parses Cognito groups from claims
  * Groups can come as a string or array depending on configuration

package/dist/identity/extractor.js.map

@@ -1 +1 @@
-{"version":3,"file":"extractor.js","sourceRoot":"","sources":["../../src/identity/extractor.ts"],"names":[],"mappings":";;AA0DA,0CAuBC;AAwCD,8CAMC;AAQD,wCAKC;AAQD,kCAIC;AAQD,oCAIC;AAlKD;;;;;;;GAOG;AAEH;;;;GAIG;AACH,SAAS,aAAa,CAAC,UAAe;IACpC,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,mEAAmE;IACnE,IAAI,UAAU,CAAC,MAAM,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,IAAI,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxE,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU,CAAC,MAAM,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,GAAQ;IACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7F,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,KAAU,EAAE,cAAuB,KAAK;IACtE,MAAM,UAAU,GAAG,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC;IACrD,IAAI,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAEvC,kGAAkG;IAClG,IAAI,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,EAAE,OAAO,EAAE,aAAa,IAAI,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC;QAClF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,GAAG;QACnF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC;QAC9D,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAClF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAqC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAEzC,6DAA6D;IAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,MAA0B;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,6CAA6C;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,QAAqC,EAAE,kBAA0B;IAC9F,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,gBAAgB,KAAK,kBAAkB,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,QAAqC,EAAE,aAAuB;IACxF,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpE,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,QAAqC,EAAE,cAAwB;IAC1F,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpE,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC"}
+{"version":3,"file":"extractor.js","sourceRoot":"","sources":["../../src/identity/extractor.ts"],"names":[],"mappings":";;AAuEA,0CAuCC;AAqDD,8CAMC;AAQD,wCAKC;AAQD,kCAIC;AAQD,oCAIC;AA7MD,uDAA8C;AAU9C;;;;;;;GAOG;AAEH;;;;GAIG;AACH,SAAS,aAAa,CAAC,UAAe;IACpC,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,mEAAmE;IACnE,IAAI,UAAU,CAAC,MAAM,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,yDAAyD;IACzD,IAAI,UAAU,CAAC,GAAG,EAAE,MAAM,IAAI,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxE,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,wDAAwD;IACxD,IAAI,UAAU,CAAC,MAAM,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/D,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,GAAQ;IACrC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7F,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACI,KAAK,UAAU,eAAe,CAAC,KAAU,EAAE,oBAAuD;IACvG,MAAM,OAAO,GAA2B,OAAO,oBAAoB,KAAK,SAAS;QAC/E,CAAC,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE;QACvC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC;IAE/B,MAAM,EAAE,WAAW,GAAG,KAAK,EAAE,qBAAqB,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,UAAU,GAAG,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAEzC,yFAAyF;IACzF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,wEAAwE;IACxE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,KAAK,EAAE,OAAO,EAAE,aAAa,IAAI,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC;QAClF,IAAI,UAAU,EAAE,CAAC;YACf,2EAA2E;YAC3E,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;gBAClF,MAAM,cAAc,GAAG,MAAM,IAAA,2BAAS,EAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;gBACrE,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,aAAa,CAAC,cAAc,CAAC,CAAC;gBACvC,CAAC;gBACD,kEAAkE;gBAClE,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,8EAA8E;YAC9E,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAClF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEzC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,MAA2B;IAChD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,GAAG;QACnF,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC;QAC9D,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,MAAqC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAEzC,6DAA6D;IAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,MAA0B;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,6CAA6C;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,QAAqC,EAAE,kBAA0B;IAC9F,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAEpC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,gBAAgB,KAAK,kBAAkB,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,QAAqC,EAAE,aAAuB;IACxF,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpE,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,QAAqC,EAAE,cAAwB;IAC1F,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpE,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC"}

package/dist/identity/index.d.ts

@@ -1,2 +1,3 @@
 export * from './extractor.js';
+export { verifyJwt } from './jwt-verifier.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/identity/index.js

@@ -14,5 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyJwt = void 0;
 __exportStar(require("./extractor.js"), exports);
+var jwt_verifier_js_1 = require("./jwt-verifier.js");
+Object.defineProperty(exports, "verifyJwt", { enumerable: true, get: function () { return jwt_verifier_js_1.verifyJwt; } });
 //# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,qDAA8C;AAArC,4GAAA,SAAS,OAAA"}

package/dist/identity/jwt-verifier.d.ts

@@ -0,0 +1,7 @@
+import type { JwtVerificationPoolConfig } from '../types/routes.js';
+/**
+ * Verifies a JWT token against a Cognito User Pool's JWKS.
+ * Returns the verified payload (claims) or undefined if verification fails.
+ */
+export declare function verifyJwt(token: string, poolConfig: JwtVerificationPoolConfig): Promise<Record<string, any> | undefined>;
+//# sourceMappingURL=jwt-verifier.d.ts.map

package/dist/identity/jwt-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-verifier.d.ts","sourceRoot":"","sources":["../../src/identity/jwt-verifier.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAuBpE;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,yBAAyB,GACpC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,CAS1C"}

package/dist/identity/jwt-verifier.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyJwt = verifyJwt;
+const aws_jwt_verify_1 = require("aws-jwt-verify");
+/**
+ * Module-level cache of CognitoJwtVerifier instances keyed by userPoolId.
+ * Persists across Lambda warm invocations. Each verifier internally caches JWKS.
+ */
+const verifierCache = new Map();
+function getVerifier(poolConfig) {
+    const cacheKey = poolConfig.userPoolId;
+    if (!verifierCache.has(cacheKey)) {
+        const verifier = aws_jwt_verify_1.CognitoJwtVerifier.create({
+            userPoolId: poolConfig.userPoolId,
+            clientId: poolConfig.clientId ?? null,
+            tokenUse: poolConfig.tokenUse ?? null,
+        });
+        verifierCache.set(cacheKey, verifier);
+    }
+    return verifierCache.get(cacheKey);
+}
+/**
+ * Verifies a JWT token against a Cognito User Pool's JWKS.
+ * Returns the verified payload (claims) or undefined if verification fails.
+ */
+async function verifyJwt(token, poolConfig) {
+    try {
+        const verifier = getVerifier(poolConfig);
+        const payload = await verifier.verify(token);
+        return payload;
+    }
+    catch (error) {
+        console.error('[SEO] JWT verification failed:', error?.message || error);
+        return undefined;
+    }
+}
+//# sourceMappingURL=jwt-verifier.js.map

package/dist/identity/jwt-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-verifier.js","sourceRoot":"","sources":["../../src/identity/jwt-verifier.ts"],"names":[],"mappings":";;AA4BA,8BAYC;AAxCD,mDAAoD;AAGpD;;;GAGG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAwD,CAAC;AAEtF,SAAS,WAAW,CAAC,UAAqC;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC;IAEvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,mCAAkB,CAAC,MAAM,CAAC;YACzC,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,IAAI;YACrC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,IAAI;SACtC,CAAC,CAAC;QACH,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,SAAS,CAC7B,KAAa,EACb,UAAqC;IAErC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,OAAyC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -7,11 +7,13 @@
  */
 export { dispatchEvent, detectEventType, createOrchestrator } from './dispatcher.js';
 export { EventType, RouteSegment, } from './types/event-type.enum.js';
-export { HttpMethod, MiddlewareFn, RouteConfig, CorsConfig, RateLimitConfig, HttpRouter, SegmentedHttpRouter, SegmentConfig, AdvancedSegmentedRouter, EventBridgeRoutes, LambdaRoutes, SqsRoutes, DispatchRoutes, IdentityContext, RouteMatch, NormalizedEvent, OrchestratorConfig, } from './types/routes.js';
+export { HttpMethod, MiddlewareFn, RouteConfig, CorsConfig, RateLimitConfig, HttpRouter, SegmentedHttpRouter, SegmentConfig, AdvancedSegmentedRouter, EventBridgeRoutes, LambdaRoutes, SqsRoutes, DispatchRoutes, IdentityContext, RouteMatch, NormalizedEvent, OrchestratorConfig, JwtVerificationPoolConfig, } from './types/routes.js';
 export { HttpStatus, StandardResponse, HttpResponse, DefaultResponseCode, createStandardResponse, successResponse, createdResponse, badRequestResponse, unauthorizedResponse, forbiddenResponse, notFoundResponse, conflictResponse, validationErrorResponse, internalErrorResponse, customErrorResponse, } from './http/response.js';
 export { parseJsonBody, parseQueryParams, withJsonBodyParser, } from './http/body-parser.js';
 export { isPreflightRequest, createPreflightResponse, applyCorsHeaders, withCors, } from './http/cors.js';
 export { extractIdentity, extractUserPoolId, validateIssuer, hasAnyGroup, hasAllGroups, } from './identity/extractor.js';
+export type { ExtractIdentityOptions } from './identity/extractor.js';
+export { verifyJwt } from './identity/jwt-verifier.js';
 export { matchPath, patternToRegex, hasPathParameters, normalizePath, } from './utils/path-matcher.js';
 export { normalizeHeaders, getHeader, getCorsHeaders, } from './utils/headers.js';
 export { TenantContext } from './tenant/TenantContext.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrF,OAAO,EACL,SAAS,EACT,YAAY,GACb,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,cAAc,EACd,eAAe,EACf,UAAU,EACV,eAAe,EACf,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,QAAQ,GACT,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,SAAS,EACT,cAAc,EACd,iBAAiB,EACjB,aAAa,GACd,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,cAAc,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,YAAY,EACV,UAAU,EACV,UAAU,EACV,IAAI,EACJ,cAAc,EACd,YAAY,GACb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,EACZ,MAAM,EACN,cAAc,GACf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,QAAQ,GACT,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrF,OAAO,EACL,SAAS,EACT,YAAY,GACb,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,UAAU,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,cAAc,EACd,eAAe,EACf,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,QAAQ,GACT,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAGvD,OAAO,EACL,SAAS,EACT,cAAc,EACd,iBAAiB,EACjB,aAAa,GACd,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,cAAc,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,YAAY,EACV,UAAU,EACV,UAAU,EACV,IAAI,EACJ,cAAc,EACd,YAAY,GACb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,EACZ,MAAM,EACN,cAAc,GACf,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,iBAAiB,EACjB,WAAW,EACX,QAAQ,GACT,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -7,7 +7,7 @@
  * Cognito User Pool validation, and built-in infrastructure middlewares.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.crmGuard = exports.tenantGuard = exports.initTenantContext = exports.tenantInfoToHeaders = exports.tenantInfoFromHeaders = exports.tenantInfoFromClaims = exports.TENANT_HEADERS = exports.isPlan = exports.isTenantType = exports.TenantContext = exports.getCorsHeaders = exports.getHeader = exports.normalizeHeaders = exports.normalizePath = exports.hasPathParameters = exports.patternToRegex = exports.matchPath = exports.hasAllGroups = exports.hasAnyGroup = exports.validateIssuer = exports.extractUserPoolId = exports.extractIdentity = exports.withCors = exports.applyCorsHeaders = exports.createPreflightResponse = exports.isPreflightRequest = exports.withJsonBodyParser = exports.parseQueryParams = exports.parseJsonBody = exports.customErrorResponse = exports.internalErrorResponse = exports.validationErrorResponse = exports.conflictResponse = exports.notFoundResponse = exports.forbiddenResponse = exports.unauthorizedResponse = exports.badRequestResponse = exports.createdResponse = exports.successResponse = exports.createStandardResponse = exports.DefaultResponseCode = exports.HttpStatus = exports.RouteSegment = exports.EventType = exports.createOrchestrator = exports.detectEventType = void 0;
+exports.crmGuard = exports.tenantGuard = exports.initTenantContext = exports.tenantInfoToHeaders = exports.tenantInfoFromHeaders = exports.tenantInfoFromClaims = exports.TENANT_HEADERS = exports.isPlan = exports.isTenantType = exports.TenantContext = exports.getCorsHeaders = exports.getHeader = exports.normalizeHeaders = exports.normalizePath = exports.hasPathParameters = exports.patternToRegex = exports.matchPath = exports.verifyJwt = exports.hasAllGroups = exports.hasAnyGroup = exports.validateIssuer = exports.extractUserPoolId = exports.extractIdentity = exports.withCors = exports.applyCorsHeaders = exports.createPreflightResponse = exports.isPreflightRequest = exports.withJsonBodyParser = exports.parseQueryParams = exports.parseJsonBody = exports.customErrorResponse = exports.internalErrorResponse = exports.validationErrorResponse = exports.conflictResponse = exports.notFoundResponse = exports.forbiddenResponse = exports.unauthorizedResponse = exports.badRequestResponse = exports.createdResponse = exports.successResponse = exports.createStandardResponse = exports.DefaultResponseCode = exports.HttpStatus = exports.RouteSegment = exports.EventType = exports.createOrchestrator = exports.detectEventType = void 0;
 // Core dispatcher
 var dispatcher_js_1 = require("./dispatcher.js");
 Object.defineProperty(exports, "dispatchEvent", { enumerable: true, get: function () { return dispatcher_js_1.dispatchEvent; } });
@@ -48,6 +48,8 @@ Object.defineProperty(exports, "extractUserPoolId", { enumerable: true, get: fun
 Object.defineProperty(exports, "validateIssuer", { enumerable: true, get: function () { return extractor_js_1.validateIssuer; } });
 Object.defineProperty(exports, "hasAnyGroup", { enumerable: true, get: function () { return extractor_js_1.hasAnyGroup; } });
 Object.defineProperty(exports, "hasAllGroups", { enumerable: true, get: function () { return extractor_js_1.hasAllGroups; } });
+var jwt_verifier_js_1 = require("./identity/jwt-verifier.js");
+Object.defineProperty(exports, "verifyJwt", { enumerable: true, get: function () { return jwt_verifier_js_1.verifyJwt; } });
 // Path utilities
 var path_matcher_js_1 = require("./utils/path-matcher.js");
 Object.defineProperty(exports, "matchPath", { enumerable: true, get: function () { return path_matcher_js_1.matchPath; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,kBAAkB;AAClB,iDAAqF;AAA5E,8GAAA,aAAa,OAAA;AAAE,gHAAA,eAAe,OAAA;AAAE,mHAAA,kBAAkB,OAAA;AAE3D,QAAQ;AACR,iEAGoC;AAFlC,+GAAA,SAAS,OAAA;AACT,kHAAA,YAAY,OAAA;AAuBd,iBAAiB;AACjB,kDAgB4B;AAf1B,yGAAA,UAAU,OAAA;AAGV,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AACtB,8GAAA,eAAe,OAAA;AACf,8GAAA,eAAe,OAAA;AACf,iHAAA,kBAAkB,OAAA;AAClB,mHAAA,oBAAoB,OAAA;AACpB,gHAAA,iBAAiB,OAAA;AACjB,+GAAA,gBAAgB,OAAA;AAChB,+GAAA,gBAAgB,OAAA;AAChB,sHAAA,uBAAuB,OAAA;AACvB,oHAAA,qBAAqB,OAAA;AACrB,kHAAA,mBAAmB,OAAA;AAGrB,wDAI+B;AAH7B,+GAAA,aAAa,OAAA;AACb,kHAAA,gBAAgB,OAAA;AAChB,oHAAA,kBAAkB,OAAA;AAGpB,0CAKwB;AAJtB,6GAAA,kBAAkB,OAAA;AAClB,kHAAA,uBAAuB,OAAA;AACvB,2GAAA,gBAAgB,OAAA;AAChB,mGAAA,QAAQ,OAAA;AAGV,qBAAqB;AACrB,wDAMiC;AAL/B,+GAAA,eAAe,OAAA;AACf,iHAAA,iBAAiB,OAAA;AACjB,8GAAA,cAAc,OAAA;AACd,2GAAA,WAAW,OAAA;AACX,4GAAA,YAAY,OAAA;AAGd,iBAAiB;AACjB,2DAKiC;AAJ/B,4GAAA,SAAS,OAAA;AACT,iHAAA,cAAc,OAAA;AACd,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AAGf,mBAAmB;AACnB,iDAI4B;AAH1B,8GAAA,gBAAgB,OAAA;AAChB,uGAAA,SAAS,OAAA;AACT,4GAAA,cAAc,OAAA;AAGhB,iBAAiB;AACjB,8DAA0D;AAAjD,iHAAA,aAAa,OAAA;AAUtB,8CAI2B;AAHzB,wGAAA,YAAY,OAAA;AACZ,kGAAA,MAAM,OAAA;AACN,0GAAA,cAAc,OAAA;AAGhB,kDAI6B;AAH3B,kHAAA,oBAAoB,OAAA;AACpB,mHAAA,qBAAqB,OAAA;AACrB,iHAAA,mBAAmB,OAAA;AAGrB,oBAAoB;AACpB,kDAI+B;AAH7B,6GAAA,iBAAiB,OAAA;AACjB,uGAAA,WAAW,OAAA;AACX,oGAAA,QAAQ,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,kBAAkB;AAClB,iDAAqF;AAA5E,8GAAA,aAAa,OAAA;AAAE,gHAAA,eAAe,OAAA;AAAE,mHAAA,kBAAkB,OAAA;AAE3D,QAAQ;AACR,iEAGoC;AAFlC,+GAAA,SAAS,OAAA;AACT,kHAAA,YAAY,OAAA;AAwBd,iBAAiB;AACjB,kDAgB4B;AAf1B,yGAAA,UAAU,OAAA;AAGV,kHAAA,mBAAmB,OAAA;AACnB,qHAAA,sBAAsB,OAAA;AACtB,8GAAA,eAAe,OAAA;AACf,8GAAA,eAAe,OAAA;AACf,iHAAA,kBAAkB,OAAA;AAClB,mHAAA,oBAAoB,OAAA;AACpB,gHAAA,iBAAiB,OAAA;AACjB,+GAAA,gBAAgB,OAAA;AAChB,+GAAA,gBAAgB,OAAA;AAChB,sHAAA,uBAAuB,OAAA;AACvB,oHAAA,qBAAqB,OAAA;AACrB,kHAAA,mBAAmB,OAAA;AAGrB,wDAI+B;AAH7B,+GAAA,aAAa,OAAA;AACb,kHAAA,gBAAgB,OAAA;AAChB,oHAAA,kBAAkB,OAAA;AAGpB,0CAKwB;AAJtB,6GAAA,kBAAkB,OAAA;AAClB,kHAAA,uBAAuB,OAAA;AACvB,2GAAA,gBAAgB,OAAA;AAChB,mGAAA,QAAQ,OAAA;AAGV,qBAAqB;AACrB,wDAMiC;AAL/B,+GAAA,eAAe,OAAA;AACf,iHAAA,iBAAiB,OAAA;AACjB,8GAAA,cAAc,OAAA;AACd,2GAAA,WAAW,OAAA;AACX,4GAAA,YAAY,OAAA;AAKd,8DAAuD;AAA9C,4GAAA,SAAS,OAAA;AAElB,iBAAiB;AACjB,2DAKiC;AAJ/B,4GAAA,SAAS,OAAA;AACT,iHAAA,cAAc,OAAA;AACd,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AAGf,mBAAmB;AACnB,iDAI4B;AAH1B,8GAAA,gBAAgB,OAAA;AAChB,uGAAA,SAAS,OAAA;AACT,4GAAA,cAAc,OAAA;AAGhB,iBAAiB;AACjB,8DAA0D;AAAjD,iHAAA,aAAa,OAAA;AAUtB,8CAI2B;AAHzB,wGAAA,YAAY,OAAA;AACZ,kGAAA,MAAM,OAAA;AACN,0GAAA,cAAc,OAAA;AAGhB,kDAI6B;AAH3B,kHAAA,oBAAoB,OAAA;AACpB,mHAAA,qBAAqB,OAAA;AACrB,iHAAA,mBAAmB,OAAA;AAGrB,oBAAoB;AACpB,kDAI+B;AAH7B,6GAAA,iBAAiB,OAAA;AACjB,uGAAA,WAAW,OAAA;AACX,oGAAA,QAAQ,OAAA"}

package/dist/types/routes.d.ts

@@ -134,6 +134,17 @@ export interface NormalizedEvent {
         tenantInfo?: TenantInfo;
     };
 }
+/**
+ * JWT verification configuration for a Cognito User Pool
+ */
+export interface JwtVerificationPoolConfig {
+    /** Cognito User Pool ID (e.g., "us-east-1_ABC123") */
+    userPoolId: string;
+    /** App Client ID(s). Pass null to skip client ID verification. */
+    clientId?: string | string[] | null;
+    /** Expected token use. Pass null to accept either. Defaults to null. */
+    tokenUse?: 'id' | 'access' | null;
+}
 /**
  * Orchestrator configuration options
  */
@@ -143,7 +154,8 @@ export interface OrchestratorConfig {
      */
     debug?: boolean;
     /**
-     * User Pool ID mappings for segment-based validation
+     * User Pool ID mappings for segment-based validation (issuer string only).
+     * @deprecated Use jwtVerification instead for cryptographic signature verification.
      */
     userPools?: {
         [K in RouteSegment]?: string;
@@ -165,5 +177,13 @@ export interface OrchestratorConfig {
      * Automatically extract identity from Authorization header if no authorizer is present
      */
     autoExtractIdentity?: boolean;
+    /**
+     * JWT signature verification configuration.
+     * When provided for a segment, JWTs from the Authorization header
+     * are cryptographically verified against the Cognito JWKS endpoint.
+     */
+    jwtVerification?: {
+        [K in RouteSegment]?: JwtVerificationPoolConfig;
+    };
 }
 //# sourceMappingURL=routes.d.ts.map

package/dist/types/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/types/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1F;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAClD,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5B,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG;KACtB,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE;QAClB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;KAC7B;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,UAAU,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC;IACpC,OAAO,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC;IACrC,UAAU,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC;IACxC,QAAQ,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAEzF;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAEjF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,UAAU,GAAG,mBAAmB,GAAG,uBAAuB,CAAC;IACxE,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,GAAG,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE;QACP,OAAO,EAAE,YAAY,CAAC;QACtB,QAAQ,CAAC,EAAE,eAAe,CAAC;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,UAAU,CAAC;KACzB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;OAEG;IACH,SAAS,CAAC,EAAE;SACT,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,MAAM;KAC7B,CAAC;IAEF;;OAEG;IACH,gBAAgB,CAAC,EAAE,YAAY,EAAE,CAAC;IAElC;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC;QACtB,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,CAAC;QACvC,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,CAAC;KAC3C,CAAC;IAEF;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/types/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1F;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAClD,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC5B,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG;KACtB,CAAC,IAAI,UAAU,CAAC,CAAC,EAAE;QAClB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;KAC7B;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,UAAU,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC;IACpC,OAAO,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC;IACrC,UAAU,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC;IACxC,QAAQ,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAEzF;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAEjF;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,UAAU,GAAG,mBAAmB,GAAG,uBAAuB,CAAC;IACxE,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,GAAG,CAAC,EAAE,SAAS,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,GAAG,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE;QACP,OAAO,EAAE,YAAY,CAAC;QACtB,QAAQ,CAAC,EAAE,eAAe,CAAC;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,UAAU,CAAC;KACzB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;IACpC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,IAAI,GAAG,QAAQ,GAAG,IAAI,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;OAGG;IACH,SAAS,CAAC,EAAE;SACT,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,MAAM;KAC7B,CAAC;IAEF;;OAEG;IACH,gBAAgB,CAAC,EAAE,YAAY,EAAE,CAAC;IAElC;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC;QACtB,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,CAAC;QACvC,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,GAAG,CAAC;KAC3C,CAAC;IAEF;;OAEG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;OAIG;IACH,eAAe,CAAC,EAAE;SACf,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,yBAAyB;KAChD,CAAC;CACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "serverless-event-orchestrator",
-  "version": "1.3.2",
+  "version": "2.0.1",
   "description": "A lightweight, type-safe event dispatcher and middleware orchestrator for AWS Lambda. Designed for hexagonal architectures with support for segmented routing (public, private, backoffice), Cognito User Pool validation, and built-in infrastructure middlewares.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -62,6 +62,9 @@
     "url": "https://github.com/carlosmora01/serverless-event-orchestrator/issues"
   },
   "homepage": "https://github.com/carlosmora01/serverless-event-orchestrator#readme",
+  "dependencies": {
+    "aws-jwt-verify": "^5.1.1"
+  },
   "devDependencies": {
     "@types/jest": "^29.5.0",
     "@types/node": "^20.0.0",

package/src/dispatcher.ts

@@ -16,7 +16,8 @@ import { matchPath, normalizePath } from './utils/path-matcher.js';
 import { normalizeHeaders } from './utils/headers.js';
 import { parseJsonBody, parseQueryParams } from './http/body-parser.js';
 import { extractIdentity, validateIssuer } from './identity/extractor.js';
-import { forbiddenResponse, badRequestResponse, notFoundResponse } from './http/response.js';
+import type { JwtVerificationPoolConfig } from './types/routes.js';
+import { forbiddenResponse, badRequestResponse, notFoundResponse, unauthorizedResponse } from './http/response.js';
 
 /**
  * Detects the type of AWS event
@@ -139,13 +140,14 @@ function findRouteInSegmentsWithActualPath(
 /**
  * Normalizes an API Gateway event into a standard format
  */
-function normalizeApiGatewayEvent(
+async function normalizeApiGatewayEvent(
   event: any,
   segment: RouteSegment,
   extractedParams: Record<string, string>,
-  autoExtract: boolean = false
-): NormalizedEvent {
-  const identity = extractIdentity(event, autoExtract);
+  autoExtract: boolean = false,
+  jwtVerificationConfig?: JwtVerificationPoolConfig
+): Promise<NormalizedEvent> {
+  const identity = await extractIdentity(event, { autoExtract, jwtVerificationConfig });
 
   // Safely extract pathParameters from event (handle null/undefined)
   const eventPathParams: Record<string, string> = event.pathParameters && typeof event.pathParameters === 'object'
@@ -401,15 +403,25 @@ export async function dispatchEvent(
       console.log('[SEO] Route matched:', routeMatch.segment, 'Params:', routeMatch.params);
     }
     
-    // Normalize event
-    let normalized = normalizeApiGatewayEvent(
+    // Normalize event (with JWT verification if configured for this segment)
+    const jwtVerificationConfig = config.jwtVerification?.[routeMatch.segment];
+    let normalized = await normalizeApiGatewayEvent(
       event,
       routeMatch.segment,
       routeMatch.params,
-      config.autoExtractIdentity
+      config.autoExtractIdentity,
+      jwtVerificationConfig
     );
-    
-    // Validate User Pool
+
+    // If JWT verification is configured but identity is missing, return 401
+    if (jwtVerificationConfig && !normalized.context.identity) {
+      if (debug) {
+        console.log('[SEO] JWT verification failed — no valid identity for segment:', routeMatch.segment);
+      }
+      return applyCorsToResponse(unauthorizedResponse('Invalid or missing authentication token'));
+    }
+
+    // Validate User Pool (legacy issuer-only check)
     if (!validateSegmentUserPool(normalized, routeMatch.segment, config)) {
       if (debug) {
         console.log('[SEO] User Pool validation failed for segment:', routeMatch.segment);

package/src/identity/extractor.ts

@@ -1,4 +1,13 @@
-import { IdentityContext } from '../types/routes.js';
+import { IdentityContext, JwtVerificationPoolConfig } from '../types/routes.js';
+import { verifyJwt } from './jwt-verifier.js';
+
+/**
+ * Options for extractIdentity when using JWT verification
+ */
+export interface ExtractIdentityOptions {
+  autoExtract?: boolean;
+  jwtVerificationConfig?: JwtVerificationPoolConfig;
+}
 
 /**
  * Extracts identity context from API Gateway authorizer claims
@@ -51,34 +60,54 @@ function hasIdentityProperties(obj: any): boolean {
 }
 
 /**
- * Extracts identity information from the event's authorizer context or Authorization header
+ * Extracts identity information from the event's authorizer context or Authorization header.
+ * When jwtVerificationConfig is provided, JWT signatures are cryptographically verified
+ * against the Cognito JWKS endpoint. Without it, identity is only extracted from
+ * API Gateway authorizer claims (already verified by API Gateway).
+ *
  * @param event - Raw API Gateway event
- * @param autoExtract - Whether to automatically extract from Authorization header if authorizer is missing
+ * @param optionsOrAutoExtract - Boolean for backwards compatibility, or ExtractIdentityOptions
  * @returns Identity context or undefined if not authenticated
  */
-export function extractIdentity(event: any, autoExtract: boolean = false): IdentityContext | undefined {
+export async function extractIdentity(event: any, optionsOrAutoExtract?: boolean | ExtractIdentityOptions): Promise<IdentityContext | undefined> {
+  const options: ExtractIdentityOptions = typeof optionsOrAutoExtract === 'boolean'
+    ? { autoExtract: optionsOrAutoExtract }
+    : optionsOrAutoExtract ?? {};
+
+  const { autoExtract = false, jwtVerificationConfig } = options;
+
   const authorizer = event?.requestContext?.authorizer;
-  let claims = extractClaims(authorizer);
-  
-  // If no authorizer claims found and autoExtract is enabled, try decoding the Authorization header
-  if (!claims && autoExtract) {
+  const claims = extractClaims(authorizer);
+
+  // If authorizer claims exist, API Gateway already verified the token — use them directly
+  if (claims) {
+    return buildIdentity(claims);
+  }
+
+  // If autoExtract is enabled, extract identity from Authorization header
+  if (autoExtract) {
     const authHeader = event?.headers?.authorization || event?.headers?.Authorization;
     if (authHeader) {
-      claims = decodeJwtFromHeader(authHeader);
+      // If jwtVerificationConfig is provided, verify signature cryptographically
+      if (jwtVerificationConfig) {
+        const token = authHeader.startsWith('Bearer ') ? authHeader.slice(7) : authHeader;
+        const verifiedClaims = await verifyJwt(token, jwtVerificationConfig);
+        if (verifiedClaims) {
+          return buildIdentity(verifiedClaims);
+        }
+        // Verification failed → return undefined (caller will return 401)
+        return undefined;
+      }
+
+      // No jwtVerificationConfig → decode-only fallback (no signature verification)
+      const decoded = decodeJwtFromHeader(authHeader);
+      if (decoded) {
+        return buildIdentity(decoded);
+      }
     }
   }
-  
-  if (!claims) {
-    return undefined;
-  }
-  
-  return {
-    userId: claims.userId || claims.user_id || claims['cognito:username'] || claims.sub,
-    email: claims.email,
-    groups: parseGroups(claims['cognito:groups'] || claims.groups),
-    issuer: claims.iss,
-    claims,
-  };
+
+  return undefined;
 }
 
 /**
@@ -94,7 +123,7 @@ function decodeJwtFromHeader(authHeader: string): Record<string, any> | undefine
     const payload = parts[1];
     const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
     const jsonPayload = Buffer.from(base64, 'base64').toString('utf8');
-    
+
     return JSON.parse(jsonPayload);
   } catch (error) {
     console.error('[SEO] Error decoding JWT from header:', error);
@@ -102,6 +131,19 @@ function decodeJwtFromHeader(authHeader: string): Record<string, any> | undefine
   }
 }
 
+/**
+ * Builds an IdentityContext from raw claims
+ */
+function buildIdentity(claims: Record<string, any>): IdentityContext {
+  return {
+    userId: claims.userId || claims.user_id || claims['cognito:username'] || claims.sub,
+    email: claims.email,
+    groups: parseGroups(claims['cognito:groups'] || claims.groups),
+    issuer: claims.iss,
+    claims,
+  };
+}
+
 /**
  * Parses Cognito groups from claims
  * Groups can come as a string or array depending on configuration

package/src/identity/index.ts

@@ -1 +1,2 @@
 export * from './extractor.js';
+export { verifyJwt } from './jwt-verifier.js';

package/src/identity/jwt-verifier.ts

@@ -0,0 +1,41 @@
+import { CognitoJwtVerifier } from 'aws-jwt-verify';
+import type { JwtVerificationPoolConfig } from '../types/routes.js';
+
+/**
+ * Module-level cache of CognitoJwtVerifier instances keyed by userPoolId.
+ * Persists across Lambda warm invocations. Each verifier internally caches JWKS.
+ */
+const verifierCache = new Map<string, ReturnType<typeof CognitoJwtVerifier.create>>();
+
+function getVerifier(poolConfig: JwtVerificationPoolConfig) {
+  const cacheKey = poolConfig.userPoolId;
+
+  if (!verifierCache.has(cacheKey)) {
+    const verifier = CognitoJwtVerifier.create({
+      userPoolId: poolConfig.userPoolId,
+      clientId: poolConfig.clientId ?? null,
+      tokenUse: poolConfig.tokenUse ?? null,
+    });
+    verifierCache.set(cacheKey, verifier);
+  }
+
+  return verifierCache.get(cacheKey)!;
+}
+
+/**
+ * Verifies a JWT token against a Cognito User Pool's JWKS.
+ * Returns the verified payload (claims) or undefined if verification fails.
+ */
+export async function verifyJwt(
+  token: string,
+  poolConfig: JwtVerificationPoolConfig
+): Promise<Record<string, any> | undefined> {
+  try {
+    const verifier = getVerifier(poolConfig);
+    const payload = await verifier.verify(token);
+    return payload as unknown as Record<string, any>;
+  } catch (error: any) {
+    console.error('[SEO] JWT verification failed:', error?.message || error);
+    return undefined;
+  }
+}

package/src/index.ts

@@ -33,6 +33,7 @@ export {
   RouteMatch,
   NormalizedEvent,
   OrchestratorConfig,
+  JwtVerificationPoolConfig,
 } from './types/routes.js';
 
 // HTTP utilities
@@ -76,6 +77,10 @@ export {
   hasAllGroups,
 } from './identity/extractor.js';
 
+export type { ExtractIdentityOptions } from './identity/extractor.js';
+
+export { verifyJwt } from './identity/jwt-verifier.js';
+
 // Path utilities
 export {
   matchPath,

package/src/types/routes.ts

@@ -151,6 +151,18 @@ export interface NormalizedEvent {
   };
 }
 
+/**
+ * JWT verification configuration for a Cognito User Pool
+ */
+export interface JwtVerificationPoolConfig {
+  /** Cognito User Pool ID (e.g., "us-east-1_ABC123") */
+  userPoolId: string;
+  /** App Client ID(s). Pass null to skip client ID verification. */
+  clientId?: string | string[] | null;
+  /** Expected token use. Pass null to accept either. Defaults to null. */
+  tokenUse?: 'id' | 'access' | null;
+}
+
 /**
  * Orchestrator configuration options
  */
@@ -161,7 +173,8 @@ export interface OrchestratorConfig {
   debug?: boolean;
 
   /**
-   * User Pool ID mappings for segment-based validation
+   * User Pool ID mappings for segment-based validation (issuer string only).
+   * @deprecated Use jwtVerification instead for cryptographic signature verification.
    */
   userPools?: {
     [K in RouteSegment]?: string;
@@ -186,4 +199,13 @@ export interface OrchestratorConfig {
    * Automatically extract identity from Authorization header if no authorizer is present
    */
   autoExtractIdentity?: boolean;
+
+  /**
+   * JWT signature verification configuration.
+   * When provided for a segment, JWTs from the Authorization header
+   * are cryptographically verified against the Cognito JWKS endpoint.
+   */
+  jwtVerification?: {
+    [K in RouteSegment]?: JwtVerificationPoolConfig;
+  };
 }

package/tests/identity.test.ts

@@ -8,17 +8,17 @@ import {
 import { IdentityContext } from '../src/types/routes';
 
 describe('extractIdentity', () => {
-  it('should return undefined when no claims present', () => {
+  it('should return undefined when no claims present', async () => {
     const event = { requestContext: {} };
-    expect(extractIdentity(event)).toBeUndefined();
+    expect(await extractIdentity(event)).toBeUndefined();
   });
 
-  it('should return undefined when event has no requestContext', () => {
+  it('should return undefined when event has no requestContext', async () => {
     const event = {};
-    expect(extractIdentity(event)).toBeUndefined();
+    expect(await extractIdentity(event)).toBeUndefined();
   });
 
-  it('should extract identity from Cognito claims', () => {
+  it('should extract identity from Cognito claims', async () => {
     const event = {
       requestContext: {
         authorizer: {
@@ -32,7 +32,7 @@ describe('extractIdentity', () => {
       }
     };
 
-    const identity = extractIdentity(event);
+    const identity = await extractIdentity(event);
 
     expect(identity).toEqual({
       userId: 'user-123',
@@ -43,7 +43,7 @@ describe('extractIdentity', () => {
     });
   });
 
-  it('should handle cognito:username as userId fallback', () => {
+  it('should handle cognito:username as userId fallback', async () => {
     const event = {
       requestContext: {
         authorizer: {
@@ -54,11 +54,11 @@ describe('extractIdentity', () => {
       }
     };
 
-    const identity = extractIdentity(event);
+    const identity = await extractIdentity(event);
     expect(identity?.userId).toBe('john_doe');
   });
 
-  it('should handle groups as array', () => {
+  it('should handle groups as array', async () => {
     const event = {
       requestContext: {
         authorizer: {
@@ -70,12 +70,12 @@ describe('extractIdentity', () => {
       }
     };
 
-    const identity = extractIdentity(event);
+    const identity = await extractIdentity(event);
     expect(identity?.groups).toEqual(['Admin', 'User']);
   });
 
   // HTTP API with JWT Authorizer tests
-  it('should extract identity from HTTP API JWT Authorizer format', () => {
+  it('should extract identity from HTTP API JWT Authorizer format', async () => {
     const event = {
       requestContext: {
         authorizer: {
@@ -90,7 +90,7 @@ describe('extractIdentity', () => {
       }
     };
 
-    const identity = extractIdentity(event);
+    const identity = await extractIdentity(event);
 
     expect(identity).toEqual({
       userId: 'user-456',
@@ -102,7 +102,7 @@ describe('extractIdentity', () => {
   });
 
   // HTTP API with Lambda Authorizer tests
-  it('should extract identity from HTTP API Lambda Authorizer format', () => {
+  it('should extract identity from HTTP API Lambda Authorizer format', async () => {
     const event = {
       requestContext: {
         authorizer: {
@@ -115,7 +115,7 @@ describe('extractIdentity', () => {
       }
     };
 
-    const identity = extractIdentity(event);
+    const identity = await extractIdentity(event);
 
     expect(identity?.userId).toBe('lambda-user-789');
     expect(identity?.email).toBe('lambda@example.com');
@@ -123,7 +123,7 @@ describe('extractIdentity', () => {
   });
 
   // REST API with Custom Lambda Authorizer (flat structure)
-  it('should extract identity from custom Lambda Authorizer with flat structure', () => {
+  it('should extract identity from custom Lambda Authorizer with flat structure', async () => {
     const event = {
       requestContext: {
         authorizer: {
@@ -134,14 +134,14 @@ describe('extractIdentity', () => {
       }
     };
 
-    const identity = extractIdentity(event);
+    const identity = await extractIdentity(event);
 
     expect(identity?.userId).toBe('custom-user-101');
     expect(identity?.email).toBe('custom@example.com');
     expect(identity?.issuer).toBe('https://custom-issuer.com');
   });
 
-  it('should handle userId fallback from user_id in custom authorizer', () => {
+  it('should handle userId fallback from user_id in custom authorizer', async () => {
     const event = {
       requestContext: {
         authorizer: {
@@ -151,11 +151,11 @@ describe('extractIdentity', () => {
       }
     };
 
-    const identity = extractIdentity(event);
+    const identity = await extractIdentity(event);
     expect(identity?.userId).toBe('underscore-user');
   });
 
-  it('should return undefined when authorizer has no identity properties', () => {
+  it('should return undefined when authorizer has no identity properties', async () => {
     const event = {
       requestContext: {
         authorizer: {
@@ -165,11 +165,10 @@ describe('extractIdentity', () => {
       }
     };
 
-    expect(extractIdentity(event)).toBeUndefined();
+    expect(await extractIdentity(event)).toBeUndefined();
   });
 
-  it('should extract identity from Authorization header when autoExtract is true', () => {
-    // Mock JWT payload: { sub: 'user-header', email: 'header@example.com', 'cognito:groups': 'Admin', iss: 'https://cognito-idp.com' }
+  it('should extract identity from Authorization header with autoExtract using decode-only fallback', async () => {
     const payload = {
       sub: 'user-header',
       email: 'header@example.com',
@@ -178,15 +177,15 @@ describe('extractIdentity', () => {
     };
     const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64').replace(/=/g, '');
     const mockToken = `header.${encodedPayload}.signature`;
-    
+
     const event = {
       headers: {
         Authorization: `Bearer ${mockToken}`
       }
     };
 
-    const identity = extractIdentity(event, true);
-
+    // Without jwtVerificationConfig, autoExtract decodes the token without signature verification
+    const identity = await extractIdentity(event, true);
     expect(identity).toEqual({
       userId: 'user-header',
       email: 'header@example.com',
@@ -196,13 +195,13 @@ describe('extractIdentity', () => {
     });
   });
 
-  it('should not extract from Authorization header when autoExtract is false', () => {
+  it('should not extract from Authorization header when autoExtract is false', async () => {
     const event = {
       headers: {
         Authorization: 'Bearer some.token.here'
       }
     };
-    expect(extractIdentity(event, false)).toBeUndefined();
+    expect(await extractIdentity(event, false)).toBeUndefined();
   });
 });