wotann 0.5.0 → 0.5.39

package/dist/browser/humanize-input.js

@@ -0,0 +1,386 @@
+/**
+ * Behavioral input humanization — defeats FingerprintJS / Cloudflare bot
+ * detection by generating mouse paths, typing cadences, and scroll
+ * profiles indistinguishable from human behavior.
+ *
+ * Ported from CloakBrowser research. WOTANN already uses Camoufox for
+ * browser-side stealth (fingerprint masking, WebGL spoof, canvas noise),
+ * but Camoufox does NOT humanize INPUT — straight-line mouse paths and
+ * uniform keypress intervals are the most reliable bot tells.
+ *
+ * This module emits driver-agnostic event streams:
+ *   - readonly Point[]       — mouse path with cubic-Bézier curvature
+ *   - readonly TypingEvent[] — press/backspace stream with bigram-aware
+ *                              cadence + occasional typo+correction
+ *   - readonly ScrollEvent[] — accel/cruise/decel scroll profile
+ *
+ * The runner (chrome-bridge, atomic-actions, etc.) consumes these as
+ * timed sequences and dispatches via CDP / Playwright.
+ *
+ * QUALITY BARS
+ *   - QB#1  immutable: all inputs `readonly`, all outputs `Object.freeze`d
+ *   - QB#6  honest output: deterministic with seed; no Math.random leakage
+ *   - QB#7  per-call state: mulberry32 PRNG is local to each call
+ *   - QB#11 sibling-site scan: only this module owns input humanization
+ *   - QB#13 env guard: zero `process.env` reads
+ *
+ * NO deps: mulberry32 PRNG is ~10 LOC inline.
+ */
+// ── Deterministic PRNG (mulberry32) ──────────────────────────────────────
+/**
+ * mulberry32 — a tiny seeded PRNG with full 2^32 period. Output is
+ * deterministic for a given seed and uniformly distributed in [0, 1).
+ *
+ * Chosen over Math.random because Math.random is not seedable and would
+ * make the module untestable + non-reproducible across CI runs.
+ */
+function mulberry32(seed) {
+    let state = seed >>> 0;
+    return function rng() {
+        state = (state + 0x6d2b79f5) >>> 0;
+        let t = state;
+        t = Math.imul(t ^ (t >>> 15), t | 1);
+        t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+        return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+    };
+}
+function clamp(v, lo, hi) {
+    return v < lo ? lo : v > hi ? hi : v;
+}
+function lerp(a, b, t) {
+    return a + (b - a) * t;
+}
+// ── Mouse path — cubic Bézier with overshoot ─────────────────────────────
+/**
+ * Cubic Bézier interpolation. Order 3 (4 control points, including the
+ * endpoints) is enough to model the slight curvature humans introduce
+ * via wrist-pivot, while staying cheap to sample. Higher orders add
+ * micro-wiggle but are statistically detectable as over-smooth.
+ */
+function cubicBezier(p0, p1, p2, p3, t) {
+    const u = 1 - t;
+    const uu = u * u;
+    const uuu = uu * u;
+    const tt = t * t;
+    const ttt = tt * t;
+    return uuu * p0 + 3 * uu * t * p1 + 3 * u * tt * p2 + ttt * p3;
+}
+/**
+ * Variable-density timestep — humans accelerate from rest, cruise mid-path,
+ * decelerate to settle. We sample with an ease-in-out curve so endpoints
+ * are denser (slower velocity) and the middle is sparser (faster velocity).
+ * This is the inverse of constant-time sampling that bots use.
+ */
+function easeInOutSine(t) {
+    return -(Math.cos(Math.PI * t) - 1) / 2;
+}
+export function humanizeMousePath(from, to, opts = {}) {
+    const startMs = opts.startMs ?? 0;
+    const minDur = opts.minDurationMs ?? 200;
+    const maxDur = opts.maxDurationMs ?? 1200;
+    const seed = opts.seed ?? 0xc0ffee;
+    const overshoot = opts.overshoot !== false; // default true
+    const rng = mulberry32(seed);
+    // Total duration scales with Euclidean distance, clamped.
+    const dx = to.x - from.x;
+    const dy = to.y - from.y;
+    const dist = Math.sqrt(dx * dx + dy * dy);
+    const baseDur = clamp(dist * 1.8 + 180, minDur, maxDur);
+    const duration = baseDur * (0.85 + rng() * 0.3); // ±15% jitter
+    // Sample count scales with distance — ~1 sample per 8px, min 14.
+    const sampleCount = Math.max(14, Math.min(80, Math.round(dist / 8) + 14));
+    // Bézier control points — perpendicular offset proportional to distance.
+    // Sign of offset is randomized so curves can bow either way.
+    const perpX = -dy / (dist || 1);
+    const perpY = dx / (dist || 1);
+    const curvature = (0.15 + rng() * 0.25) * (rng() < 0.5 ? -1 : 1);
+    const offset = dist * curvature;
+    const c1x = from.x + dx * 0.3 + perpX * offset;
+    const c1y = from.y + dy * 0.3 + perpY * offset;
+    const c2x = from.x + dx * 0.7 + perpX * offset * 0.6;
+    const c2y = from.y + dy * 0.7 + perpY * offset * 0.6;
+    // Optional overshoot — sail slightly past `to`, then settle. Computed
+    // as a target a few px beyond `to` along the path direction.
+    const overshootMagnitude = overshoot ? clamp(dist * 0.04, 2, 18) : 0;
+    const dirX = dx / (dist || 1);
+    const dirY = dy / (dist || 1);
+    const overshootX = to.x + dirX * overshootMagnitude;
+    const overshootY = to.y + dirY * overshootMagnitude;
+    // Phase split: 0..0.85 = main path to overshoot target,
+    //              0.85..1.0 = settle back from overshoot to true target.
+    const mainEnd = overshoot ? 0.85 : 1.0;
+    const points = [];
+    for (let i = 0; i < sampleCount; i++) {
+        const raw = i / (sampleCount - 1);
+        const eased = easeInOutSine(raw);
+        let x;
+        let y;
+        if (!overshoot || eased <= mainEnd) {
+            // Main Bézier path. Re-map eased into [0,1] over the main phase.
+            const localT = overshoot ? eased / mainEnd : eased;
+            const targetX = overshoot ? overshootX : to.x;
+            const targetY = overshoot ? overshootY : to.y;
+            x = cubicBezier(from.x, c1x, c2x, targetX, localT);
+            y = cubicBezier(from.y, c1y, c2y, targetY, localT);
+        }
+        else {
+            // Settle phase — straight lerp from overshoot back to true target.
+            const localT = (eased - mainEnd) / (1 - mainEnd);
+            x = lerp(overshootX, to.x, localT);
+            y = lerp(overshootY, to.y, localT);
+        }
+        // Micro-jitter — sub-pixel hand tremor, larger mid-path than endpoints.
+        const jitterScale = 4 * raw * (1 - raw); // peaks at 0.5
+        const jx = (rng() - 0.5) * jitterScale;
+        const jy = (rng() - 0.5) * jitterScale;
+        const t = startMs + eased * duration;
+        if (i === 0) {
+            // Anchor first sample exactly at `from` — no jitter on entry.
+            points.push(Object.freeze({ x: from.x, y: from.y, t: startMs }));
+        }
+        else if (i === sampleCount - 1) {
+            // Anchor last sample exactly at `to` — no jitter on exit.
+            points.push(Object.freeze({ x: to.x, y: to.y, t: startMs + duration }));
+        }
+        else {
+            points.push(Object.freeze({ x: x + jx, y: y + jy, t }));
+        }
+    }
+    return Object.freeze(points);
+}
+// ── Typing — bigram-aware cadence with occasional typo+correction ────────
+/**
+ * Common-letter bigrams — these pairs are typed faster than average
+ * because the muscle memory for the transition is over-trained. Source:
+ * Norvig's letter-pair frequency analysis of the Google Books corpus.
+ *
+ * Values are speed multipliers: <1 = faster than mean, >1 = slower.
+ */
+const FAST_BIGRAMS = Object.freeze({
+    th: 0.7,
+    he: 0.72,
+    in: 0.75,
+    er: 0.76,
+    an: 0.77,
+    re: 0.78,
+    on: 0.78,
+    at: 0.79,
+    en: 0.79,
+    nd: 0.8,
+    ti: 0.8,
+    es: 0.81,
+    or: 0.81,
+    te: 0.82,
+    of: 0.82,
+    ed: 0.82,
+    is: 0.83,
+    it: 0.83,
+    al: 0.84,
+    ar: 0.84,
+    st: 0.84,
+    to: 0.85,
+    nt: 0.85,
+    ng: 0.86,
+    se: 0.86,
+});
+/**
+ * Rare bigrams — letter pairs that are awkward on QWERTY (cross-hand
+ * with no rhythm, or same-finger transitions) take longer than average.
+ */
+const SLOW_BIGRAMS = Object.freeze({
+    qz: 1.6,
+    qx: 1.55,
+    jq: 1.5,
+    zx: 1.5,
+    qj: 1.5,
+    vq: 1.45,
+    bq: 1.45,
+    gz: 1.4,
+    pz: 1.4,
+    fz: 1.4,
+    kz: 1.4,
+    vx: 1.35,
+    jx: 1.35,
+    zq: 1.35,
+    xz: 1.3,
+});
+/**
+ * Adjacent-key typo map — when a typo fires, the wrong key is usually
+ * a neighbour on QWERTY. Maps each lowercase letter to a string of
+ * candidate neighbour keys.
+ */
+const QWERTY_NEIGHBOURS = Object.freeze({
+    q: "wa",
+    w: "qeasd",
+    e: "wrsdf",
+    r: "etdfg",
+    t: "ryfgh",
+    y: "tughj",
+    u: "yihjk",
+    i: "uojkl",
+    o: "ipkl",
+    p: "ol",
+    a: "qwsz",
+    s: "awedxz",
+    d: "serfcx",
+    f: "dergvc",
+    g: "frthbv",
+    h: "gtynbj",
+    j: "hyuknm",
+    k: "juilm",
+    l: "kiop",
+    z: "asx",
+    x: "zsdc",
+    c: "xdfv",
+    v: "cfgb",
+    b: "vghn",
+    n: "bhjm",
+    m: "njk",
+});
+function bigramMultiplier(prev, cur) {
+    if (!prev || !cur)
+        return 1;
+    const key = (prev + cur).toLowerCase();
+    const fast = FAST_BIGRAMS[key];
+    if (fast !== undefined)
+        return fast;
+    const slow = SLOW_BIGRAMS[key];
+    if (slow !== undefined)
+        return slow;
+    return 1;
+}
+function neighbourTypo(ch, rng) {
+    const low = ch.toLowerCase();
+    const pool = QWERTY_NEIGHBOURS[low];
+    if (!pool || pool.length === 0)
+        return null;
+    const idx = Math.floor(rng() * pool.length);
+    const wrong = pool[idx];
+    if (wrong === undefined)
+        return null;
+    // Preserve case of the original character.
+    return ch === low ? wrong : wrong.toUpperCase();
+}
+export function humanizeTyping(opts) {
+    const text = opts.text;
+    const startMs = opts.startMs ?? 0;
+    const meanInterval = opts.meanIntervalMs ?? 65;
+    const typoProb = clamp(opts.typoProbability ?? 0.02, 0, 1);
+    const seed = opts.seed ?? 0xfeedface;
+    const rng = mulberry32(seed);
+    const events = [];
+    let t = startMs;
+    let prev = "";
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === undefined)
+            continue;
+        // Per-character interval = mean * bigram multiplier * jitter(±30%)
+        const bigram = bigramMultiplier(prev, ch);
+        const jitter = 0.7 + rng() * 0.6; // 0.7..1.3
+        const interval = meanInterval * bigram * jitter;
+        t += interval;
+        // Roll for typo BEFORE emitting the real key.
+        if (typoProb > 0 && rng() < typoProb) {
+            const wrong = neighbourTypo(ch, rng);
+            if (wrong !== null) {
+                // Emit the wrong key.
+                events.push(Object.freeze({ type: "press", key: wrong, t }));
+                // Pause briefly (~realization time), then backspace.
+                const realization = meanInterval * (1.5 + rng() * 1.2);
+                t += realization;
+                events.push(Object.freeze({ type: "backspace", key: "Backspace", t }));
+                // Brief pause before retry.
+                const retry = meanInterval * (0.6 + rng() * 0.5);
+                t += retry;
+            }
+        }
+        // Emit the correct key.
+        events.push(Object.freeze({ type: "press", key: ch, t }));
+        prev = ch;
+    }
+    return Object.freeze(events);
+}
+// ── Scroll — accel/cruise/decel profile ──────────────────────────────────
+/**
+ * Human scroll profiles have three distinct phases:
+ *   1. Acceleration — short ramp-up from rest (~15-25% of duration)
+ *   2. Cruise       — sustained peak velocity through the middle
+ *   3. Deceleration — soft landing on the target Y (~25-35% of duration)
+ *
+ * Bot scroll detection looks for either constant-velocity (instant jump)
+ * or linear ramp (uniformly accelerated). This profile uses a trapezoid
+ * with rounded corners that matches real wheel/trackpad behavior.
+ */
+export function humanizeScroll(opts) {
+    const fromY = opts.fromY;
+    const toY = opts.toY;
+    const startMs = opts.startMs ?? 0;
+    const seed = opts.seed ?? 0xdecaf;
+    const rng = mulberry32(seed);
+    const distance = toY - fromY;
+    const absDist = Math.abs(distance);
+    // Total duration scales with distance — roughly 1.2ms per pixel,
+    // clamped to a reasonable range, ±15% jitter.
+    const duration = clamp(absDist * 1.2 + 200, 250, 2500) * (0.85 + rng() * 0.3);
+    // ~50ms tick interval per spec, with small jitter so ticks don't land
+    // on a perfectly periodic grid.
+    const baseTick = 50;
+    const tickCount = Math.max(6, Math.round(duration / baseTick));
+    // Phase boundaries — accel = first 20%, decel = last 30%, cruise = middle.
+    const accelEnd = 0.2;
+    const decelStart = 0.7;
+    /**
+     * Velocity profile sampled at normalized time u ∈ [0,1]:
+     *   - accel:    smoothstep from 0 → 1 over [0, accelEnd]
+     *   - cruise:   constant 1 over [accelEnd, decelStart]
+     *   - decel:    smoothstep from 1 → 0 over [decelStart, 1]
+     * The displacement at time u is the integral of velocity * total_distance.
+     * We pre-compute via numeric integration so the curve is exact.
+     */
+    function velocity(u) {
+        if (u < accelEnd) {
+            const local = u / accelEnd;
+            return local * local * (3 - 2 * local); // smoothstep
+        }
+        if (u < decelStart) {
+            return 1;
+        }
+        const local = (u - decelStart) / (1 - decelStart);
+        const eased = local * local * (3 - 2 * local);
+        return 1 - eased;
+    }
+    // Integrate velocity over the full range so we can normalize.
+    const integrationSteps = 200;
+    let totalIntegral = 0;
+    for (let i = 0; i < integrationSteps; i++) {
+        const u = (i + 0.5) / integrationSteps;
+        totalIntegral += velocity(u);
+    }
+    totalIntegral /= integrationSteps;
+    // totalIntegral is now the time-averaged velocity. distance = duration * mean_v.
+    // We scale velocity by (distance / (duration * totalIntegral)) when emitting.
+    const scale = distance / (duration * totalIntegral);
+    const events = [];
+    let y = fromY;
+    events.push(Object.freeze({ y: fromY, t: startMs }));
+    let lastT = 0;
+    for (let i = 1; i < tickCount - 1; i++) {
+        const u = i / (tickCount - 1);
+        const tickT = u * duration;
+        const dt = tickT - lastT;
+        // Mid-tick velocity for trapezoidal integration of the segment.
+        const midU = (u + lastT / duration) / 2;
+        const v = velocity(midU) * scale;
+        y += v * dt;
+        lastT = tickT;
+        // Small per-tick timing jitter (±15% of base tick), but keep monotonic.
+        const jitterT = startMs + tickT + (rng() - 0.5) * baseTick * 0.3;
+        const t = Math.max(events[events.length - 1].t + 1, Math.min(startMs + duration - 1, jitterT));
+        events.push(Object.freeze({ y, t }));
+    }
+    // Anchor exact endpoint.
+    events.push(Object.freeze({ y: toY, t: startMs + duration }));
+    return Object.freeze(events);
+}
+//# sourceMappingURL=humanize-input.js.map

package/dist/browser/humanize-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"humanize-input.js","sourceRoot":"","sources":["../../src/browser/humanize-input.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA4CH,4EAA4E;AAE5E;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC;IACvB,OAAO,SAAS,GAAG;QACjB,KAAK,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,KAAK,CAAC;QACd,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,CAAS,EAAE,EAAU,EAAE,EAAU;IAC9C,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAC3C,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,4EAA4E;AAE5E;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAU,EAAE,EAAU,EAAE,EAAU,EAAE,EAAU,EAAE,CAAS;IAC5E,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;IACnB,OAAO,GAAG,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAW,EACX,EAAS,EACT,OAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,eAAe;IAE3D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE7B,0DAA0D;IAC1D,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc;IAE/D,iEAAiE;IACjE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE1E,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;IAErD,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,kBAAkB,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,kBAAkB,CAAC;IACpD,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,kBAAkB,CAAC;IAEpD,wDAAwD;IACxD,sEAAsE;IACtE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAS,CAAC;QACd,IAAI,CAAS,CAAC;QAEd,IAAI,CAAC,SAAS,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;YACnC,iEAAiE;YACjE,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YACnD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;YACjD,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACnC,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,wEAAwE;QACxE,MAAM,WAAW,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe;QACxD,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC;QACvC,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,WAAW,CAAC;QAEvC,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;QAErC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,8DAA8D;YAC9D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC;aAAM,IAAI,CAAC,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;YACjC,0DAA0D;YAC1D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,4EAA4E;AAE5E;;;;;;GAMG;AACH,MAAM,YAAY,GAAqC,MAAM,CAAC,MAAM,CAAC;IACnE,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;CACT,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,YAAY,GAAqC,MAAM,CAAC,MAAM,CAAC;IACnE,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,GAAG;CACR,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,iBAAiB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACxE,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,QAAQ;IACX,CAAC,EAAE,OAAO;IACV,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,KAAK;CACT,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,IAAY,EAAE,GAAW;IACjD,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,EAAU,EAAE,GAAiB;IAClD,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,2CAA2C;IAC3C,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAA2B;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC;IACrC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,OAAO,CAAC;IAChB,IAAI,IAAI,GAAG,EAAE,CAAC;IAEd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS;QAE/B,mEAAmE;QACnE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW;QAC7C,MAAM,QAAQ,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;QAChD,CAAC,IAAI,QAAQ,CAAC;QAEd,8CAA8C;QAC9C,IAAI,QAAQ,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,sBAAsB;gBACtB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7D,qDAAqD;gBACrD,MAAM,WAAW,GAAG,YAAY,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;gBACvD,CAAC,IAAI,WAAW,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvE,4BAA4B;gBAC5B,MAAM,KAAK,GAAG,YAAY,GAAG,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;gBACjD,CAAC,IAAI,KAAK,CAAC;YACb,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,4EAA4E;AAE5E;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,IAA2B;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;IAClC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,QAAQ,GAAG,GAAG,GAAG,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEnC,iEAAiE;IACjE,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;IAE9E,sEAAsE;IACtE,gCAAgC;IAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC;IAE/D,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC;IACrB,MAAM,UAAU,GAAG,GAAG,CAAC;IAEvB;;;;;;;OAOG;IACH,SAAS,QAAQ,CAAC,CAAS;QACzB,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC;YAC3B,OAAO,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa;QACvD,CAAC;QACD,IAAI,CAAC,GAAG,UAAU,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,8DAA8D;IAC9D,MAAM,gBAAgB,GAAG,GAAG,CAAC;IAC7B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,gBAAgB,CAAC;QACvC,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,aAAa,IAAI,gBAAgB,CAAC;IAClC,iFAAiF;IACjF,8EAA8E;IAC9E,MAAM,KAAK,GAAG,QAAQ,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAErD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC;QAC3B,MAAM,EAAE,GAAG,KAAK,GAAG,KAAK,CAAC;QACzB,gEAAgE;QAChE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACjC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACZ,KAAK,GAAG,KAAK,CAAC;QACd,wEAAwE;QACxE,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,QAAQ,GAAG,GAAG,CAAC;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,QAAQ,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAChG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,yBAAyB;IACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC"}

package/dist/channels/teams.d.ts

@@ -39,31 +39,53 @@ export declare class TeamsAdapter implements ChannelAdapter {
     private messageHandler;
     private accessToken;
     private tokenExpiresAt;
+    private jwksCache;
+    private jwksLastFetched;
+    private jwksFetchInFlight;
+    private static readonly JWKS_CACHE_TTL_MS;
+    private static readonly BOT_FRAMEWORK_OPENID;
     constructor(appId?: string, appPassword?: string);
     /**
-     * V9 T1.6 — Structural JWT-header validation for Bot Framework webhooks.
+     * Resolve the OpenID-Connect discovery → JWKS chain for the Bot
+     * Framework and hydrate the public-key cache. Coalesces concurrent
+     * callers so we never issue parallel JWKS fetches.
      *
-     * Microsoft Teams webhooks arrive as signed JWT Bearer tokens in the
-     * `Authorization` header. Full cryptographic verification requires
-     * fetching Microsoft's OpenID Connect metadata + public keys from
-     * `https://login.botframework.com/v1/.well-known/openidconfiguration`
-     * and then its JWKS URL, then RS256-verifying the token — that's
-     * 150+ LOC of JWT + JWKS plumbing with a network fetch.
+     * Returns silently on network failure — callers (verifySignature) treat an
+     * empty cache as "verify-fail" so a stale or unreachable JWKS endpoint
+     * never produces a false-positive ACCEPT.
      *
-     * For Tier-1 ship this implements the STRUCTURAL checks a real JWT
-     * verifier must pass BEFORE the crypto step: shape (`x.y.z`), base64
-     * decodability, expected issuer, expected audience (appId), and
-     * non-expired timestamps. Any failure here means the token is
-     * definitely invalid; passing here means crypto-verify is the
-     * remaining step.
+     * Public + injectable `fetchImpl` so tests can supply a fake without
+     * touching the network.
+     */
+    fetchJwksIfStale(fetchImpl?: typeof fetch): Promise<void>;
+    /**
+     * Crypto-verify the RS256 JWT against the cached JWKS. Returns true
+     * iff `${headerB64}.${payloadB64}` signs to `signatureB64Url`
+     * under the public key identified by `kid`.
+     *
+     * Internal — exposed for unit testing by the test file's `as never`
+     * cast. Production callers go through verifySignature().
+     */
+    cryptoVerifyJwt(headerB64: string, payloadB64: string, signatureB64Url: string, kid: string): boolean;
+    /**
+     * Verify a Bot Framework JWT in the `Authorization` header.
+     *
+     * Two layers run in order:
+     *   1. Structural validation — shape `x.y.z`, base64 decodability,
+     *      RS256 alg, expected issuer, audience-binding to the bot's
+     *      appId, exp/nbf timestamps.
+     *   2. Cryptographic RS256 signature verification against
+     *      Microsoft's published JWKS keys (24h-cached, hydrated at
+     *      `start()` and on-demand via `fetchJwksIfStale()`).
      *
-     * A V9 follow-up task should wire the full JWKS path; leaving the
-     * structural wire in place NOW lets the webhook host call
-     * `verifySignature(...)` and get a hard fail on malformed tokens
-     * without waiting for the full plumb.
+     * Sync by contract — callers in `webhook-router.ts` use this
+     * inline. The crypto step succeeds when (and only when) the JWKS
+     * cache contains the `kid` from the token header. Cache misses
+     * fail-closed (return false) and fire a background refresh so the
+     * NEXT webhook delivery can verify.
      *
-     * @param authHeader Full `Authorization` header (expected form `Bearer <jwt>`).
-     * @returns true when structural checks pass (NOT a full crypto verify).
+     * @param authHeader Full `Authorization` header (form `Bearer <jwt>`).
+     * @returns true iff structural + crypto checks both pass.
      */
     verifySignature(authHeader: string): boolean;
     start(): Promise<void>;

package/dist/channels/teams.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"teams.d.ts","sourceRoot":"","sources":["../../src/channels/teams.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIlG,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE;QACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAUD,qBAAa,YAAa,YAAW,cAAc;IACjD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAW;IACrC,QAAQ,CAAC,IAAI,qBAAqB;IAElC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,cAAc,CAA0D;IAChF,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,cAAc,CAAa;gBAEvB,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;IAKhD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAoCtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAatB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAmCtD,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIjE,WAAW,IAAI,OAAO;IAItB;;;OAGG;IACG,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;YAmBrD,YAAY;YA0BZ,gBAAgB;CAK/B;AA2BD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAExF,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,gBAAgB,GAChB,4BAA4B,CAAC;AAEjC,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAIpE;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,mBAAmB,EAC5B,MAAM,GAAE,kBAAuB,GAC9B,0BAA0B,CA2B5B"}
+{"version":3,"file":"teams.d.ts","sourceRoot":"","sources":["../../src/channels/teams.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIlG,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE;QACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAUD,qBAAa,YAAa,YAAW,cAAc;IACjD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAW;IACrC,QAAQ,CAAC,IAAI,qBAAqB;IAElC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,cAAc,CAA0D;IAChF,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,cAAc,CAAa;IAMnC,OAAO,CAAC,SAAS,CAA6C;IAC9D,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,iBAAiB,CAA8B;IAEvD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAuB;IAChE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAC0B;gBAE1D,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;IAKhD;;;;;;;;;;;OAWG;IACG,gBAAgB,CAAC,SAAS,GAAE,OAAO,KAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAgDtE;;;;;;;OAOG;IACH,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,GAAG,EAAE,MAAM,GACV,OAAO;IAQV;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IA0CtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAMrB,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAmCtD,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAIjE,WAAW,IAAI,OAAO;IAItB;;;OAGG;IACG,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;YAmBrD,YAAY;YA0BZ,gBAAgB;CAK/B;AA2BD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAExF,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,gBAAgB,GAChB,4BAA4B,CAAC;AAEjC,MAAM,MAAM,0BAA0B,GAClC;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAIpE;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,mBAAmB,EAC5B,MAAM,GAAE,kBAAuB,GAC9B,0BAA0B,CA2B5B"}