@aauth/local-keys - npm Package Compare versions

Comparing version 1.3.0 to 2.0.0

dist/jwk-alg.d.ts

+import type { JWK } from 'jose';
+/**
+ * Fully-specified JWS algorithm identifiers (RFC 9864) for the key types AAuth
+ * conveys.
+ *
+ * AAuth protocol §Signature Algorithms:
+ *
+ * - The `alg` member MUST be present and MUST be a fully-specified identifier —
+ *   one that determines the signature operation completely, including curve and
+ *   hash where applicable. A verifier MUST reject a key whose `alg` is absent.
+ * - The polymorphic `EdDSA` identifier MUST NOT be used. Use `Ed25519` (or
+ *   `Ed448`), which RFC 9864 registered as its fully-specified replacements.
+ * - `none`, any algorithm whose JOSE Implementation Requirement is `Prohibited`,
+ *   and symmetric algorithms (`oct`, `HS256`, `HS384`, `HS512`) MUST NOT be used.
+ * - A verifier MUST reject a key whose `kty` or, where present, `crv` disagrees
+ *   with its `alg`.
+ *
+ * This package is where AAuth agent keys are generated, stored and read back, so
+ * it owns the rule rather than each consumer patching keys up on the way out.
+ * `@aauth/proxy` carried a private `withFullySpecifiedAlg` for exactly this; it
+ * should import this one instead — the version here also enforces the last rule
+ * (kty/crv vs. alg disagreement), which the proxy copy did not.
+ */
+export type FullySpecifiedAlg = 'Ed25519' | 'Ed448' | 'ES256' | 'ES384' | 'ES512' | 'RS256' | 'RS384' | 'RS512' | 'PS256' | 'PS384' | 'PS512';
+/** Minimal shape needed to reason about a key's algorithm. */
+export interface AlgBearingJwk {
+    kty?: string;
+    crv?: string;
+    alg?: string;
+}
+/**
+ * The one fully-specified `alg` the key material implies, or `undefined` when
+ * the material does not determine it (RSA leaves padding and hash open).
+ */
+export declare function deriveFullySpecifiedAlg(jwk: AlgBearingJwk): FullySpecifiedAlg | undefined;
+/**
+ * Verifier-side check. Throws when the key violates §Signature Algorithms:
+ * absent `alg`, a polymorphic/prohibited/symmetric `alg`, or an `alg` that
+ * disagrees with the key's own `kty`/`crv`.
+ */
+export declare function assertFullySpecifiedAlg(jwk: AlgBearingJwk, context?: string): void;
+/** True when the key satisfies {@link assertFullySpecifiedAlg}. */
+export declare function hasFullySpecifiedAlg(jwk: AlgBearingJwk): boolean;
+/**
+ * Return the key with a fully-specified `alg`, deriving it from `kty`/`crv`.
+ *
+ * A legacy `alg` the key material contradicts — notably the polymorphic `EdDSA`
+ * on an Ed25519 key, which is what every key this package minted before AAuth
+ * -11 carries — is replaced by the derived value. A contradiction the material
+ * does *not* explain (`alg: ES256` on an Ed25519 key) is a corrupt or
+ * substituted key and throws rather than being silently rewritten.
+ *
+ * When the material does not determine the algorithm (RSA), `fallbackAlg` is
+ * used; without one, this throws rather than guessing.
+ */
+export declare function withFullySpecifiedAlg<T extends AlgBearingJwk>(jwk: T, fallbackAlg?: string, context?: string): T;
+/** {@link withFullySpecifiedAlg} for a `jose` JWK. */
+export declare function publicJwkWithAlg(jwk: JWK, fallbackAlg?: string, context?: string): JWK;
+/**
+ * Map a stored algorithm identifier onto its fully-specified form.
+ *
+ * `~/.aauth/config.json` written before AAuth -11 records `algorithm: "EdDSA"`
+ * for software Ed25519 keys. Reading it back must not put `EdDSA` into a JWT
+ * header or a JWK, so normalize at the boundary instead of migrating the file.
+ */
+export declare function normalizeAlgId(alg: string): string;
+//# sourceMappingURL=jwk-alg.d.ts.map

dist/jwk-alg.d.ts.map

+{"version":3,"file":"jwk-alg.d.ts","sourceRoot":"","sources":["../src/jwk-alg.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAE/B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,GACP,OAAO,CAAA;AAEX,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AA0BD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,aAAa,GAAG,iBAAiB,GAAG,SAAS,CAIzF;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,SAAQ,GAAG,IAAI,CAqCjF;AAED,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAOhE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,aAAa,EAC3D,GAAG,EAAE,CAAC,EACN,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,SAAQ,GACd,CAAC,CAqBH;AAED,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,SAAQ,GAAG,GAAG,CAErF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD"}

dist/jwk-alg.js

+/** `alg` values this profile forbids outright, whatever the key looks like. */
+const PROHIBITED_ALGS = new Set([
+    'none',
+    'EdDSA', // polymorphic — RFC 9864 deprecated it in favour of Ed25519 / Ed448
+    'HS256',
+    'HS384',
+    'HS512',
+    'RSA1_5',
+]);
+/** `alg` values that are fully specified but not derivable from `kty` alone. */
+const RSA_ALGS = new Set(['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512']);
+const OKP_CURVE_ALG = {
+    Ed25519: 'Ed25519',
+    Ed448: 'Ed448',
+};
+const EC_CURVE_ALG = {
+    'P-256': 'ES256',
+    'P-384': 'ES384',
+    'P-521': 'ES512',
+};
+/**
+ * The one fully-specified `alg` the key material implies, or `undefined` when
+ * the material does not determine it (RSA leaves padding and hash open).
+ */
+export function deriveFullySpecifiedAlg(jwk) {
+    if (jwk.kty === 'OKP' && jwk.crv)
+        return OKP_CURVE_ALG[jwk.crv];
+    if (jwk.kty === 'EC' && jwk.crv)
+        return EC_CURVE_ALG[jwk.crv];
+    return undefined;
+}
+/**
+ * Verifier-side check. Throws when the key violates §Signature Algorithms:
+ * absent `alg`, a polymorphic/prohibited/symmetric `alg`, or an `alg` that
+ * disagrees with the key's own `kty`/`crv`.
+ */
+export function assertFullySpecifiedAlg(jwk, context = 'JWK') {
+    if (jwk.kty === 'oct') {
+        throw new Error(`${context}: symmetric keys (kty=oct) MUST NOT be used`);
+    }
+    if (!jwk.alg) {
+        throw new Error(`${context}: 'alg' is absent; AAuth requires a fully-specified alg (RFC 9864)`);
+    }
+    if (PROHIBITED_ALGS.has(jwk.alg)) {
+        const hint = jwk.alg === 'EdDSA'
+            ? ` — use ${deriveFullySpecifiedAlg(jwk) ?? 'Ed25519'} instead`
+            : '';
+        throw new Error(`${context}: alg=${jwk.alg} MUST NOT be used${hint}`);
+    }
+    const derived = deriveFullySpecifiedAlg(jwk);
+    if (derived) {
+        if (jwk.alg !== derived) {
+            throw new Error(`${context}: alg=${jwk.alg} disagrees with kty=${jwk.kty} crv=${jwk.crv} (expected ${derived})`);
+        }
+        return;
+    }
+    if (jwk.kty === 'RSA') {
+        if (!RSA_ALGS.has(jwk.alg)) {
+            throw new Error(`${context}: alg=${jwk.alg} is not valid for kty=RSA`);
+        }
+        return;
+    }
+    throw new Error(`${context}: cannot validate alg=${jwk.alg} against kty=${jwk.kty} crv=${jwk.crv}`);
+}
+/** True when the key satisfies {@link assertFullySpecifiedAlg}. */
+export function hasFullySpecifiedAlg(jwk) {
+    try {
+        assertFullySpecifiedAlg(jwk);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Return the key with a fully-specified `alg`, deriving it from `kty`/`crv`.
+ *
+ * A legacy `alg` the key material contradicts — notably the polymorphic `EdDSA`
+ * on an Ed25519 key, which is what every key this package minted before AAuth
+ * -11 carries — is replaced by the derived value. A contradiction the material
+ * does *not* explain (`alg: ES256` on an Ed25519 key) is a corrupt or
+ * substituted key and throws rather than being silently rewritten.
+ *
+ * When the material does not determine the algorithm (RSA), `fallbackAlg` is
+ * used; without one, this throws rather than guessing.
+ */
+export function withFullySpecifiedAlg(jwk, fallbackAlg, context = 'JWK') {
+    const derived = deriveFullySpecifiedAlg(jwk);
+    if (derived) {
+        if (jwk.alg && jwk.alg !== derived && !PROHIBITED_ALGS.has(jwk.alg)) {
+            throw new Error(`${context}: alg=${jwk.alg} disagrees with kty=${jwk.kty} crv=${jwk.crv} (expected ${derived})`);
+        }
+        return { ...jwk, alg: derived };
+    }
+    const candidate = jwk.alg && !PROHIBITED_ALGS.has(jwk.alg) ? jwk.alg : fallbackAlg;
+    if (candidate && jwk.kty === 'RSA' && RSA_ALGS.has(candidate)) {
+        return { ...jwk, alg: candidate };
+    }
+    throw new Error(`${context}: needs a fully-specified alg (RFC 9864); cannot derive one from ` +
+        `kty=${jwk.kty} crv=${jwk.crv}`);
+}
+/** {@link withFullySpecifiedAlg} for a `jose` JWK. */
+export function publicJwkWithAlg(jwk, fallbackAlg, context = 'JWK') {
+    return withFullySpecifiedAlg(jwk, fallbackAlg, context);
+}
+/**
+ * Map a stored algorithm identifier onto its fully-specified form.
+ *
+ * `~/.aauth/config.json` written before AAuth -11 records `algorithm: "EdDSA"`
+ * for software Ed25519 keys. Reading it back must not put `EdDSA` into a JWT
+ * header or a JWK, so normalize at the boundary instead of migrating the file.
+ */
+export function normalizeAlgId(alg) {
+    return alg === 'EdDSA' ? 'Ed25519' : alg;
+}
+//# sourceMappingURL=jwk-alg.js.map

dist/jwk-alg.js.map

+{"version":3,"file":"jwk-alg.js","sourceRoot":"","sources":["../src/jwk-alg.ts"],"names":[],"mappings":"AA4CA,+EAA+E;AAC/E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,MAAM;IACN,OAAO,EAAE,oEAAoE;IAC7E,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;CACT,CAAC,CAAA;AAEF,gFAAgF;AAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AAExF,MAAM,aAAa,GAAsC;IACvD,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;CACf,CAAA;AAED,MAAM,YAAY,GAAsC;IACtD,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,OAAO;CACjB,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAkB;IACxD,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC/D,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC7D,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAkB,EAAE,OAAO,GAAG,KAAK;IACzE,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,6CAA6C,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,oEAAoE,CAC/E,CAAA;IACH,CAAC;IACD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GACR,GAAG,CAAC,GAAG,KAAK,OAAO;YACjB,CAAC,CAAC,UAAU,uBAAuB,CAAC,GAAG,CAAC,IAAI,SAAS,UAAU;YAC/D,CAAC,CAAC,EAAE,CAAA;QACR,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,SAAS,GAAG,CAAC,GAAG,oBAAoB,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;IAC5C,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,SAAS,GAAG,CAAC,GAAG,uBAAuB,GAAG,CAAC,GAAG,QAAQ,GAAG,CAAC,GAAG,cAAc,OAAO,GAAG,CAChG,CAAA;QACH,CAAC;QACD,OAAM;IACR,CAAC;IAED,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,SAAS,GAAG,CAAC,GAAG,2BAA2B,CAAC,CAAA;QACxE,CAAC;QACD,OAAM;IACR,CAAC;IAED,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,yBAAyB,GAAG,CAAC,GAAG,gBAAgB,GAAG,CAAC,GAAG,QAAQ,GAAG,CAAC,GAAG,EAAE,CACnF,CAAA;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,oBAAoB,CAAC,GAAkB;IACrD,IAAI,CAAC;QACH,uBAAuB,CAAC,GAAG,CAAC,CAAA;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAM,EACN,WAAoB,EACpB,OAAO,GAAG,KAAK;IAEf,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;IAE5C,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,SAAS,GAAG,CAAC,GAAG,uBAAuB,GAAG,CAAC,GAAG,QAAQ,GAAG,CAAC,GAAG,cAAc,OAAO,GAAG,CAChG,CAAA;QACH,CAAC;QACD,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAA;IAClF,IAAI,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,mEAAmE;QAC3E,OAAO,GAAG,CAAC,GAAG,QAAQ,GAAG,CAAC,GAAG,EAAE,CAClC,CAAA;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAAC,GAAQ,EAAE,WAAoB,EAAE,OAAO,GAAG,KAAK;IAC9E,OAAO,qBAAqB,CAAC,GAAoB,EAAE,WAAW,EAAE,OAAO,CAAQ,CAAA;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA;AAC1C,CAAC"}

dist/agent-token.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"agent-token.d.ts","sourceRoot":"","sources":["../src/agent-token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAe,MAAM,YAAY,CAAA;AAEtF;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAc3B"}
+{"version":3,"file":"agent-token.d.ts","sourceRoot":"","sources":["../src/agent-token.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAe,MAAM,YAAY,CAAA;AAqBtF;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,gBAAgB,CAAC,CAc3B"}

dist/agent-token.js

@@ -7,3 +7,22 @@ import { createHash, randomUUID } from 'node:crypto';
 import { resolveKey } from './resolve-key.js';
+import { publicJwkWithAlg, normalizeAlgId } from './jwk-alg.js';
 /**
+ * Generate the ephemeral key the agent token confirms in `cnf.jwk`.
+ *
+ * Both JWKs carry a fully-specified `alg` (RFC 9864): `@hellocoop/httpsig` 2.0
+ * (signature-key -08) takes the signing algorithm from the JWK's `alg` and
+ * rejects the polymorphic `EdDSA`, and AAuth -11 §Signature Algorithms requires
+ * the same of every key it conveys. `exportJWK` sets no `alg` at all, so it is
+ * derived from the key material here.
+ */
+async function generateEphemeralKey(alg) {
+    // jose 6: keys are non-extractable by default, and these are exported to JWK below
+    const opts = alg === 'ES256' ? { crv: 'P-256', extractable: true } : { crv: 'Ed25519', extractable: true };
+    const { publicKey, privateKey } = await generateKeyPair(alg, opts);
+    return {
+        privateJwk: publicJwkWithAlg(await exportJWK(privateKey), alg, 'ephemeral private key'),
+        publicJwk: publicJwkWithAlg(await exportJWK(publicKey), alg, 'ephemeral public key'),
+    };
+}
+/**
  * Sign an agent token for the given agent URL.
@@ -34,18 +53,14 @@ *
     }
-    const rootJwk = data.keys[kid] || data.keys[data.current];
-    if (!rootJwk) {
+    const storedJwk = data.keys[kid] || data.keys[data.current];
+    if (!storedJwk) {
         throw new Error(`Key ${kid} not found in keychain for ${agentUrl}`);
     }
+    // Keys minted before AAuth -11 sit in the keychain with `alg: "EdDSA"`.
+    // Derive the fully-specified alg from the key material so neither the JWT
+    // header nor anything downstream ever sees the polymorphic identifier.
+    const rootJwk = publicJwkWithAlg(storedJwk, undefined, `keychain key ${kid}`);
     const actualKid = rootJwk.kid || kid;
-    const alg = rootJwk.alg || (rootJwk.crv === 'P-256' ? 'ES256' : 'EdDSA');
-    const ephAlg = alg === 'ES256' ? 'ES256' : 'EdDSA';
-    const ephOpts = alg === 'ES256' ? { crv: 'P-256' } : { crv: 'Ed25519' };
-    const { publicKey: ephPub, privateKey: ephPriv } = await generateKeyPair(ephAlg, ephOpts);
-    const ephPrivJwk = await exportJWK(ephPriv);
-    const ephPubJwk = await exportJWK(ephPub);
-    // @hellocoop/httpsig 2.0 (signature-key -08 / RFC 9864) requires every JWK to
-    // carry a fully-specified alg; the polymorphic 'EdDSA' is rejected.
-    const ephJwkAlg = ephAlg === 'ES256' ? 'ES256' : 'Ed25519';
-    ephPrivJwk.alg = ephJwkAlg;
-    ephPubJwk.alg = ephJwkAlg;
+    const alg = rootJwk.alg;
+    const ephAlg = alg === 'ES256' ? 'ES256' : 'Ed25519';
+    const { privateJwk: ephPrivJwk, publicJwk: ephPubJwk } = await generateEphemeralKey(ephAlg);
     const rootKey = await importJWK(rootJwk, alg);
@@ -75,14 +90,7 @@ const now = Math.floor(Date.now() / 1000);
     const driver = getBackend(resolved.backend);
-    const alg = resolved.algorithm === 'RS256' ? 'RS256' : resolved.algorithm;
-    // Ephemeral signing key — always software, always ES256 or EdDSA
-    const ephAlg = alg === 'RS256' ? 'ES256' : alg;
-    const ephOpts = ephAlg === 'ES256' ? { crv: 'P-256' } : { crv: 'Ed25519' };
-    const { publicKey: ephPub, privateKey: ephPriv } = await generateKeyPair(ephAlg, ephOpts);
-    const ephPrivJwk = await exportJWK(ephPriv);
-    const ephPubJwk = await exportJWK(ephPub);
-    // @hellocoop/httpsig 2.0 (signature-key -08 / RFC 9864) requires every JWK to
-    // carry a fully-specified alg; the polymorphic 'EdDSA' is rejected.
-    const ephJwkAlg = ephAlg === 'ES256' ? 'ES256' : 'Ed25519';
-    ephPrivJwk.alg = ephJwkAlg;
-    ephPubJwk.alg = ephJwkAlg;
+    // A pre-11 config entry can still say "EdDSA"; never put that in a header.
+    const alg = normalizeAlgId(resolved.algorithm);
+    // Ephemeral signing key — always software, always ES256 or Ed25519
+    const ephAlg = alg === 'ES256' || alg === 'RS256' ? 'ES256' : 'Ed25519';
+    const { privateJwk: ephPrivJwk, publicJwk: ephPubJwk } = await generateEphemeralKey(ephAlg);
     const now = Math.floor(Date.now() / 1000);
@@ -89,0 +97,0 @@ const header = {

dist/agent-token.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"agent-token.js","sourceRoot":"","sources":["../src/agent-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAErE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAG7C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA8B;IAE9B,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IAC/E,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,eAAe,GAAG,UAAU,IAAI,WAAW,EAAE,eAAe,CAAA;IAElE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;IAE3C,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IACpF,CAAC;IAED,kCAAkC;IAClC,OAAO,mBAAmB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAA;AACpF,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,QAAgB,EAChB,GAAW,EACX,QAAgB,EAChB,GAAW,EACX,eAAwB;IAExB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,8BAA8B,QAAQ,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAA;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IAExE,MAAM,MAAM,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IAClD,MAAM,OAAO,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;IACvE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACzC,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,SAAS,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,UAAU,CAAC,GAAG,GAAG,SAAS,CAAA;IAC1B,SAAS,CAAC,GAAG,GAAG,SAAS,CAAA;IAEzB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,kBAAkB;QACvB,GAAG;QACH,GAAG,EAAE,UAAU,EAAE;QACjB,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;QACvB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,QAAQ;KACpB,CAAA;IACD,IAAI,eAAe;QAAE,MAAM,CAAC,EAAE,GAAG,eAAe,CAAA;IAEhD,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;SAClC,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;SAChE,IAAI,CAAC,OAAO,CAAC,CAAA;IAEhB,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;KACnC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,QAAqB,EACrB,IAKC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,IAAI,CAAA;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE3C,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAA;IAEzE,iEAAiE;IACjE,MAAM,MAAM,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAA;IAC9C,MAAM,OAAO,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;IAC1E,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;IACzC,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,SAAS,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1D,UAAU,CAAC,GAAG,GAAG,SAAS,CAAA;IAC1B,SAAS,CAAC,GAAG,GAAG,SAAS,CAAA;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,MAAM,MAAM,GAA2B;QACrC,GAAG;QACH,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,QAAQ,CAAC,GAAG;KAClB,CAAA;IAED,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,kBAAkB;QACvB,GAAG;QACH,GAAG,EAAE,UAAU,EAAE;QACjB,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;QACvB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,QAAQ;KACpB,CAAA;IACD,IAAI,eAAe;QAAE,OAAO,CAAC,EAAE,GAAG,eAAe,CAAA;IAEjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC7E,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAA;IAEjD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAA;IAC/D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAE3D,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,YAAY,IAAI,MAAM,EAAE,EAAE;KAChE,CAAA;AACH,CAAC"}
+{"version":3,"file":"agent-token.js","sourceRoot":"","sources":["../src/agent-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAG/D;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,GAAwB;IAC1D,mFAAmF;IACnF,MAAM,IAAI,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IAC1G,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClE,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,MAAM,SAAS,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC;QACvF,SAAS,EAAE,gBAAgB,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,sBAAsB,CAAC;KACrF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA8B;IAE9B,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IAC/E,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,eAAe,GAAG,UAAU,IAAI,WAAW,EAAE,eAAe,CAAA;IAElE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;IAE3C,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IACpF,CAAC;IAED,kCAAkC;IAClC,OAAO,mBAAmB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAA;AACpF,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,QAAgB,EAChB,GAAW,EACX,QAAgB,EAChB,GAAW,EACX,eAAwB;IAExB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IACnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,EAAE,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,8BAA8B,QAAQ,EAAE,CAAC,CAAA;IACrE,CAAC;IAED,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAA;IAC7E,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAA;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAa,CAAA;IAEjC,MAAM,MAAM,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACpD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAE3F,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,MAAM,MAAM,GAA4B;QACtC,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,kBAAkB;QACvB,GAAG;QACH,GAAG,EAAE,UAAU,EAAE;QACjB,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;QACvB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,QAAQ;KACpB,CAAA;IACD,IAAI,eAAe;QAAE,MAAM,CAAC,EAAE,GAAG,eAAe,CAAA;IAEhD,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;SAClC,kBAAkB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;SAChE,IAAI,CAAC,OAAO,CAAC,CAAA;IAEhB,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;KACnC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,QAAqB,EACrB,IAKC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,IAAI,CAAA;IACzD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAE3C,2EAA2E;IAC3E,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAE9C,mEAAmE;IACnE,MAAM,MAAM,GAAG,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACvE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAE3F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAEzC,MAAM,MAAM,GAA2B;QACrC,GAAG;QACH,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,QAAQ,CAAC,GAAG;KAClB,CAAA;IAED,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,kBAAkB;QACvB,GAAG;QACH,GAAG,EAAE,UAAU,EAAE;QACjB,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE;QACvB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,QAAQ;KACpB,CAAA;IACD,IAAI,eAAe;QAAE,OAAO,CAAC,EAAE,GAAG,eAAe,CAAA;IAEjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAC7E,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAA;IAEjD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAA;IAC/D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAE3D,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,YAAY,IAAI,MAAM,EAAE,EAAE;KAChE,CAAA;AACH,CAAC"}

dist/backends/secure-enclave.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"secure-enclave.d.ts","sourceRoot":"","sources":["../../src/backends/secure-enclave.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAGV,gBAAgB,EAEjB,MAAM,aAAa,CAAA;AAmDpB,eAAO,MAAM,oBAAoB,EAAE,gBAwFlC,CAAA"}
+{"version":3,"file":"secure-enclave.d.ts","sourceRoot":"","sources":["../../src/backends/secure-enclave.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAGV,gBAAgB,EAEjB,MAAM,aAAa,CAAA;AAmDpB,eAAO,MAAM,oBAAoB,EAAE,gBAyFlC,CAAA"}

dist/backends/secure-enclave.js

@@ -7,2 +7,3 @@ import { execFileSync } from 'node:child_process';
 import { machineLabel } from '../device-label.js';
+import { publicJwkWithAlg } from '../jwk-alg.js';
 const __filename = fileURLToPath(import.meta.url);
@@ -85,3 +86,4 @@ const __dirname = dirname(__filename);
         const result = callHelper('generate', label);
-        const publicJwk = result.publicJwk;
+        // se-helper emits a bare EC JWK with no `alg`; AAuth -11 requires one.
+        const publicJwk = publicJwkWithAlg(result.publicJwk, 'ES256', 'secure enclave key');
         return {
@@ -121,3 +123,3 @@ backend: 'secure-enclave',
         const result = callHelper('public-key', keyId);
-        return result.publicJwk;
+        return publicJwkWithAlg(result.publicJwk, 'ES256', `secure enclave key ${keyId}`);
     },
@@ -124,0 +126,0 @@ getDeviceLabel() {

dist/backends/secure-enclave.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"secure-enclave.js","sourceRoot":"","sources":["../../src/backends/secure-enclave.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAY,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAQjD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;AAErC,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAA;IACrE,MAAM,OAAO,GAAG,wBAAwB,IAAI,EAAE,CAAA;IAE9C,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,eAAe,CAAC,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACxC,IAAI,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAE/B,MAAM,UAAU,GAAG;QACjB,mCAAmC;QACnC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,CAAC;QAC5E,2BAA2B;QAC3B,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC;KAChD,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,GAAG,IAAc;IAEjB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;IAC9B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAE1D,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACxB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE;QACxC,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,KAAK;KACf,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAqB;IACpD,QAAQ;QACN,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAE9C,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,kDAAkD;QAClD,IAAI,CAAC;YACH,UAAU,CAAC,MAAM,CAAC,CAAA;YAClB,OAAO;gBACL,OAAO,EAAE,gBAAgB;gBACzB,WAAW,EAAE,sCAAsC;gBACnD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,OAAO;aAClB,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAuB;QACvC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC;aAC1C,QAAQ,CAAC,EAAE,CAAC;aACZ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACnB,MAAM,KAAK,GAAG,mBAAmB,IAAI,IAAI,GAAG,EAAE,CAAA;QAE9C,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,KAAK,CAA4B,CAAA;QACvE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAgB,CAAA;QAEzC,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,OAAO;YAClB,KAAK,EAAE,KAAK;YACZ,SAAS;SACV,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,KAAa,EACb,IAAY;QAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAA4B,CAAA;QAE5E,6BAA6B;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAmB,CAAA;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAElD,OAAO;YACL,SAAS;YACT,SAAS,EAAE,OAAO;SACnB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAmC,CAAA;YAClE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC1B,OAAO,EAAE,gBAAyB;gBAClC,SAAS,EAAE,OAAgB;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAe;gBAC3B,SAAS,EAAE,EAAS,EAAE,gCAAgC;aACvD,CAAC,CAAC,CAAA;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,KAAK,CAA4B,CAAA;QACzE,OAAO,MAAM,CAAC,SAAgB,CAAA;IAChC,CAAC;IAED,cAAc;QACZ,OAAO,YAAY,EAAE,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,kEAAkE;QAClE,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC7B,CAAC;CACF,CAAA"}
+{"version":3,"file":"secure-enclave.js","sourceRoot":"","sources":["../../src/backends/secure-enclave.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAY,MAAM,oBAAoB,CAAA;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAQhD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;AAErC,SAAS,aAAa;IACpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAA;IACrE,MAAM,OAAO,GAAG,wBAAwB,IAAI,EAAE,CAAA;IAE9C,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,eAAe,CAAC,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACxC,IAAI,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAE/B,MAAM,UAAU,GAAG;QACjB,mCAAmC;QACnC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,CAAC;QAC5E,2BAA2B;QAC3B,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC;KAChD,CAAA;IACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,GAAG,IAAc;IAEjB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;IAC9B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAE1D,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACxB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE;QACxC,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,KAAK;KACf,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAqB;IACpD,QAAQ;QACN,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAE9C,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QAExB,kDAAkD;QAClD,IAAI,CAAC;YACH,UAAU,CAAC,MAAM,CAAC,CAAA;YAClB,OAAO;gBACL,OAAO,EAAE,gBAAgB;gBACzB,WAAW,EAAE,sCAAsC;gBACnD,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,OAAO;aAClB,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAuB;QACvC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC;aAC1C,QAAQ,CAAC,EAAE,CAAC;aACZ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QACnB,MAAM,KAAK,GAAG,mBAAmB,IAAI,IAAI,GAAG,EAAE,CAAA;QAE9C,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,KAAK,CAA4B,CAAA;QACvE,uEAAuE;QACvE,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,SAAgB,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAA;QAE1F,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,SAAS,EAAE,OAAO;YAClB,KAAK,EAAE,KAAK;YACZ,SAAS;SACV,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,KAAa,EACb,IAAY;QAEZ,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAA4B,CAAA;QAE5E,6BAA6B;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAmB,CAAA;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAElD,OAAO;YACL,SAAS;YACT,SAAS,EAAE,OAAO;SACnB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAmC,CAAA;YAClE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC1B,OAAO,EAAE,gBAAyB;gBAClC,SAAS,EAAE,OAAgB;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAe;gBAC3B,SAAS,EAAE,EAAS,EAAE,gCAAgC;aACvD,CAAC,CAAC,CAAA;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,EAAE,KAAK,CAA4B,CAAA;QACzE,OAAO,gBAAgB,CAAC,MAAM,CAAC,SAAgB,EAAE,OAAO,EAAE,sBAAsB,KAAK,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,cAAc;QACZ,OAAO,YAAY,EAAE,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,kEAAkE;QAClE,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC7B,CAAC;CACF,CAAA"}

dist/backends/software.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"software.d.ts","sourceRoot":"","sources":["../../src/backends/software.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAGV,gBAAgB,EAEjB,MAAM,aAAa,CAAA;AAWpB,eAAO,MAAM,eAAe,EAAE,gBAgH7B,CAAA"}
+{"version":3,"file":"software.d.ts","sourceRoot":"","sources":["../../src/backends/software.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAGV,gBAAgB,EAEjB,MAAM,aAAa,CAAA;AAWpB,eAAO,MAAM,eAAe,EAAE,gBAwH7B,CAAA"}

dist/backends/software.js

 import { generateKeyPair, exportJWK } from 'jose';
 import { readKeychain, writeKeychain, deleteKeychain, listAgentUrls } from '../keychain.js';
 import { machineLabel } from '../device-label.js';
+import { publicJwkWithAlg } from '../jwk-alg.js';
 function generateKid() {
@@ -17,3 +18,3 @@ const now = new Date();
             description: 'Software keys stored in OS keychain',
-            algorithms: ['EdDSA', 'ES256'],
+            algorithms: ['Ed25519', 'ES256'],
             deviceId: 'local',
@@ -26,9 +27,10 @@ };
         let opts;
-        if (algorithm === 'EdDSA') {
-            alg = 'EdDSA';
-            opts = { crv: 'Ed25519' };
+        if (algorithm === 'Ed25519') {
+            alg = 'Ed25519';
+            // jose 6: keys are non-extractable by default, and these are exported to JWK below
+            opts = { crv: 'Ed25519', extractable: true };
         }
         else if (algorithm === 'ES256') {
             alg = 'ES256';
-            opts = { crv: 'P-256' };
+            opts = { crv: 'P-256', extractable: true };
         }
@@ -39,9 +41,8 @@ else {
         const { publicKey, privateKey } = await generateKeyPair(alg, opts);
-        const privateJwk = await exportJWK(privateKey);
-        const publicJwk = await exportJWK(publicKey);
+        // Fully-specified alg (RFC 9864) — `Ed25519`, never the polymorphic `EdDSA`.
+        const privateJwk = publicJwkWithAlg(await exportJWK(privateKey), alg, 'generated private key');
+        const publicJwk = publicJwkWithAlg(await exportJWK(publicKey), alg, 'generated public key');
         privateJwk.kid = kid;
-        privateJwk.alg = alg;
         privateJwk.use = 'sig';
         publicJwk.kid = kid;
-        publicJwk.alg = alg;
         publicJwk.use = 'sig';
@@ -69,10 +70,18 @@ return {
             for (const [kid, jwk] of Object.entries(data.keys)) {
-                const alg = jwk.crv === 'P-256' ? 'ES256' : 'EdDSA';
+                // The keychain may hold pre-11 JWKs stamped `alg: "EdDSA"`; derive the
+                // fully-specified alg from the key material rather than trusting it.
+                const alg = jwk.crv === 'P-256' ? 'ES256' : 'Ed25519';
                 const { d: _d, ...pub } = jwk;
-                refs.push({
-                    backend: 'software',
-                    algorithm: alg,
-                    keyId: kid,
-                    publicJwk: { ...pub, use: 'sig', alg: alg === 'ES256' ? 'ES256' : 'EdDSA' },
-                });
+                try {
+                    refs.push({
+                        backend: 'software',
+                        algorithm: alg,
+                        keyId: kid,
+                        publicJwk: { ...publicJwkWithAlg(pub, alg, `keychain key ${kid}`), use: 'sig' },
+                    });
+                }
+                catch {
+                    // Key material we can't pin a fully-specified alg to is unusable
+                    // under AAuth -11 — skip it rather than emitting a polymorphic alg.
+                }
             }
@@ -91,3 +100,5 @@ }
                 const { d: _d, ...pub } = jwk;
-                return { ...pub, use: 'sig' };
+                // Re-derive `alg`: a key stored before -11 carries `EdDSA`, and callers
+                // hand this JWK straight to a verifier that rejects it.
+                return { ...publicJwkWithAlg(pub, undefined, `keychain key ${keyId}`), use: 'sig' };
             }
@@ -94,0 +105,0 @@ }

dist/backends/software.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"software.js","sourceRoot":"","sources":["../../src/backends/software.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEjD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAQjD,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC;SAC1C,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACnB,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAqB;IAC/C,QAAQ;QACN,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,qCAAqC;YAClD,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;YAC9B,QAAQ,EAAE,OAAO;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAuB;QACvC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;QACzB,IAAI,GAAW,CAAA;QACf,IAAI,IAA4B,CAAA;QAEhC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,GAAG,GAAG,OAAO,CAAA;YACb,IAAI,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;QAC3B,CAAC;aAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACjC,GAAG,GAAG,OAAO,CAAA;YACb,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAClE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAA;QAE5C,UAAU,CAAC,GAAG,GAAG,GAAG,CAAA;QACpB,UAAU,CAAC,GAAG,GAAG,GAAG,CAAA;QACpB,UAAU,CAAC,GAAG,GAAG,KAAK,CAAA;QACtB,SAAS,CAAC,GAAG,GAAG,GAAG,CAAA;QACnB,SAAS,CAAC,GAAG,GAAG,GAAG,CAAA;QACnB,SAAS,CAAC,GAAG,GAAG,KAAK,CAAA;QAErB,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,SAAS;YACT,KAAK,EAAE,GAAG;YACV,SAAS;SACV,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,KAAa;QAEb,+DAA+D;QAC/D,iEAAiE;QACjE,qDAAqD;QACrD,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;QAC5B,MAAM,IAAI,GAAmB,EAAE,CAAA;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,MAAM,GAAG,GACP,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;gBACzC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAA;gBAC7B,IAAI,CAAC,IAAI,CAAC;oBACR,OAAO,EAAE,UAAU;oBACnB,SAAS,EAAE,GAAG;oBACd,KAAK,EAAE,GAAG;oBACV,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE;iBAC5E,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC5B,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAA;gBAC7B,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;YAC/B,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,cAAc;QACZ,OAAO,YAAY,EAAE,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,yEAAyE;QACzE,iFAAiF;QACjF,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAQ;YAChC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACvB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,cAAc,CAAC,GAAG,CAAC,CAAA;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;oBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;gBACvD,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC1B,CAAC;YACD,OAAM;QACR,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"software.js","sourceRoot":"","sources":["../../src/backends/software.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEjD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAQhD,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC;SAC1C,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACnB,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAqB;IAC/C,QAAQ;QACN,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,WAAW,EAAE,qCAAqC;YAClD,UAAU,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;YAChC,QAAQ,EAAE,OAAO;SAClB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAuB;QACvC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;QACzB,IAAI,GAAW,CAAA;QACf,IAAI,IAA2C,CAAA;QAE/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,GAAG,SAAS,CAAA;YACf,mFAAmF;YACnF,IAAI,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QAC9C,CAAC;aAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACjC,GAAG,GAAG,OAAO,CAAA;YACb,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAClE,6EAA6E;QAC7E,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,SAAS,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAA;QAC9F,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;QAE3F,UAAU,CAAC,GAAG,GAAG,GAAG,CAAA;QACpB,UAAU,CAAC,GAAG,GAAG,KAAK,CAAA;QACtB,SAAS,CAAC,GAAG,GAAG,GAAG,CAAA;QACnB,SAAS,CAAC,GAAG,GAAG,KAAK,CAAA;QAErB,OAAO;YACL,OAAO,EAAE,UAAU;YACnB,SAAS;YACT,KAAK,EAAE,GAAG;YACV,SAAS;SACV,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,MAAc,EACd,KAAa;QAEb,+DAA+D;QAC/D,iEAAiE;QACjE,qDAAqD;QACrD,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;QAC5B,MAAM,IAAI,GAAmB,EAAE,CAAA;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnD,uEAAuE;gBACvE,qEAAqE;gBACrE,MAAM,GAAG,GAAiB,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;gBACnE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAA;gBAC7B,IAAI,CAAC;oBACH,IAAI,CAAC,IAAI,CAAC;wBACR,OAAO,EAAE,UAAU;wBACnB,SAAS,EAAE,GAAG;wBACd,KAAK,EAAE,GAAG;wBACV,SAAS,EAAE,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE;qBAChF,CAAC,CAAA;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;oBACjE,oEAAoE;gBACtE,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC5B,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAA;gBAC7B,wEAAwE;gBACxE,wDAAwD;gBACxD,OAAO,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;YACrF,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAA;IACrD,CAAC;IAED,cAAc;QACZ,OAAO,YAAY,EAAE,CAAA;IACvB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,yEAAyE;QACzE,iFAAiF;QACjF,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAC9B,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAQ;YAChC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACvB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,cAAc,CAAC,GAAG,CAAC,CAAA;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;oBAAE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;gBACvD,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YAC1B,CAAC;YACD,OAAM;QACR,CAAC;IACH,CAAC;CACF,CAAA"}

dist/backends/yubikey-piv.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"yubikey-piv.d.ts","sourceRoot":"","sources":["../../src/backends/yubikey-piv.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAGV,gBAAgB,EAEjB,MAAM,aAAa,CAAA;AAmDpB,eAAO,MAAM,iBAAiB,EAAE,gBA0F/B,CAAA"}
+{"version":3,"file":"yubikey-piv.d.ts","sourceRoot":"","sources":["../../src/backends/yubikey-piv.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAGV,gBAAgB,EAEjB,MAAM,aAAa,CAAA;AAmDpB,eAAO,MAAM,iBAAiB,EAAE,gBA2G/B,CAAA"}

dist/backends/yubikey-piv.js

@@ -5,2 +5,3 @@ import { createRequire } from 'node:module';
 import { yubikeyLabel } from '../device-label.js';
+import { publicJwkWithAlg } from '../jwk-alg.js';
 import { KeyDeletionUnsupportedError } from '../types.js';
@@ -58,3 +59,4 @@ const require = createRequire(import.meta.url);
         const result = addon.generateKey('yubikey-piv', algStr);
-        const publicJwk = JSON.parse(result.publicJwk);
+        // The native addon emits a bare JWK with no `alg`; AAuth -11 requires one.
+        const publicJwk = publicJwkWithAlg(JSON.parse(result.publicJwk), algStr, `yubikey-piv key ${result.keyId}`);
         return {
@@ -83,8 +85,17 @@ backend: 'yubikey-piv',
             const keys = addon.listKeys('yubikey-piv');
-            return keys.map((k) => ({
-                backend: 'yubikey-piv',
-                algorithm: k.algorithm,
-                keyId: k.keyId,
-                publicJwk: JSON.parse(k.publicJwk),
-            }));
+            const refs = [];
+            for (const k of keys) {
+                try {
+                    refs.push({
+                        backend: 'yubikey-piv',
+                        algorithm: k.algorithm,
+                        keyId: k.keyId,
+                        publicJwk: publicJwkWithAlg(JSON.parse(k.publicJwk), k.algorithm, `yubikey-piv key ${k.keyId}`),
+                    });
+                }
+                catch {
+                    // No fully-specified alg derivable — unusable under AAuth -11.
+                }
+            }
+            return refs;
         }
@@ -91,0 +102,0 @@ catch {

dist/backends/yubikey-piv.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"yubikey-piv.js","sourceRoot":"","sources":["../../src/backends/yubikey-piv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAEzD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAuBzD,IAAI,WAAW,GAAmC,SAAS,CAAA;AAE3D,SAAS,SAAS;IAChB,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAA;IACjD,IAAI,CAAC;QACH,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAgB,CAAA;QAC5D,OAAO,WAAW,CAAA;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAC5B,SAAS,EACT,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,CAC9C,CAAA;YACD,WAAW,GAAG,OAAO,CAAC,SAAS,CAAgB,CAAA;YAC/C,OAAO,WAAW,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,IAAI,CAAA;YAClB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAqB;IACjD,QAAQ;QACN,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;YACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAA;YAC5D,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YACpB,OAAO;gBACL,OAAO,EAAE,aAAa;gBACtB,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,UAAU,EAAE,EAAE,CAAC,UAA4B;gBAC3C,QAAQ,EAAE,EAAE,CAAC,QAAQ;aACtB,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAuB;QACvC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;QACzB,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QAEhE,MAAM,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;QACxD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAQ,CAAA;QAErD,OAAO;YACL,OAAO,EAAE,aAAa;YACtB,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS;SACV,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,KAAa,EACb,IAAY;QAEZ,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;QACzB,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QAEhE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACzD,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACxC,SAAS,EAAE,MAAM,CAAC,SAAyB;SAC5C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAA;QAErB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,OAAO,EAAE,aAAsB;gBAC/B,SAAS,EAAE,CAAC,CAAC,SAAyB;gBACtC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAQ;aAC1C,CAAC,CAAC,CAAA;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAA;QACvE,OAAO,GAAG,CAAC,SAAS,CAAA;IACtB,CAAC;IAED,cAAc;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAA;QAC3B,gGAAgG;QAChG,gCAAgC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAClD,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,4EAA4E;QAC5E,+EAA+E;QAC/E,MAAM,IAAI,2BAA2B,CACnC,0CAA0C,KAAK,yEAAyE,KAAK,EAAE,CAChI,CAAA;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"yubikey-piv.js","sourceRoot":"","sources":["../../src/backends/yubikey-piv.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAOhD,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAEzD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAuBzD,IAAI,WAAW,GAAmC,SAAS,CAAA;AAE3D,SAAS,SAAS;IAChB,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAA;IACjD,IAAI,CAAC;QACH,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAgB,CAAA;QAC5D,OAAO,WAAW,CAAA;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;YACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAC5B,SAAS,EACT,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,CAC9C,CAAA;YACD,WAAW,GAAG,OAAO,CAAC,SAAS,CAAgB,CAAA;YAC/C,OAAO,WAAW,CAAA;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,IAAI,CAAA;YAClB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAqB;IACjD,QAAQ;QACN,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;YACjC,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,aAAa,CAAC,CAAA;YAC5D,IAAI,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAA;YACpB,OAAO;gBACL,OAAO,EAAE,aAAa;gBACtB,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,UAAU,EAAE,EAAE,CAAC,UAA4B;gBAC3C,QAAQ,EAAE,EAAE,CAAC,QAAQ;aACtB,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,SAAuB;QACvC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;QACzB,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QAEhE,MAAM,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;QACxD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QACvD,2EAA2E;QAC3E,MAAM,SAAS,GAAG,gBAAgB,CAChC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAQ,EACnC,MAAM,EACN,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAClC,CAAA;QAED,OAAO;YACL,OAAO,EAAE,aAAa;YACtB,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS;SACV,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,KAAa,EACb,IAAY;QAEZ,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;QACzB,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QAEhE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACzD,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACxC,SAAS,EAAE,MAAM,CAAC,SAAyB;SAC5C,CAAA;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;QACzB,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAA;QAErB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAA;YAC1C,MAAM,IAAI,GAAmB,EAAE,CAAA;YAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,IAAI,CAAC,IAAI,CAAC;wBACR,OAAO,EAAE,aAAsB;wBAC/B,SAAS,EAAE,CAAC,CAAC,SAAyB;wBACtC,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,SAAS,EAAE,gBAAgB,CACzB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAQ,EAC9B,CAAC,CAAC,SAAS,EACX,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAC7B;qBACF,CAAC,CAAA;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,+DAA+D;gBACjE,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAA;QACvE,OAAO,GAAG,CAAC,SAAS,CAAA;IACtB,CAAC;IAED,cAAc;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAA;QAC3B,gGAAgG;QAChG,gCAAgC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAClD,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,4EAA4E;QAC5E,+EAA+E;QAC/E,MAAM,IAAI,2BAA2B,CACnC,0CAA0C,KAAK,yEAAyE,KAAK,EAAE,CAChI,CAAA;IACH,CAAC;CACF,CAAA"}

dist/index.d.ts

@@ -7,3 +7,6 @@ export { readKeychain, writeKeychain, deleteKeychain, listAgentUrls } from './keychain.js';
 export { getConfigDir, readConfig, writeConfig, clearConfig, deleteConfigFile, getAgentConfig, setAgentConfig, addKeyToAgent, setPersonServer, setHosting, deleteAgentProvider, listAgentProviders, validateUrl, ensureAgentUrls, } from './config.js';
-export { readCachedMetadata, writeCachedMetadata, evictCachedMetadata, parseMaxAge, PS_METADATA_FILE, } from './metadata-cache.js';
+export { readCachedMetadata, writeCachedMetadata, evictCachedMetadata, parseMaxAge, isPersonServerMetadata, missingPersonServerMembers, PS_METADATA_FILE, CACHE_SCHEMA_VERSION, } from './metadata-cache.js';
+export type { PersonServerMetadata } from './metadata-cache.js';
+export { deriveFullySpecifiedAlg, assertFullySpecifiedAlg, hasFullySpecifiedAlg, withFullySpecifiedAlg, publicJwkWithAlg, normalizeAlgId, } from './jwk-alg.js';
+export type { FullySpecifiedAlg, AlgBearingJwk } from './jwk-alg.js';
 export { resolveKey, checkKeyAvailability } from './resolve-key.js';
@@ -10,0 +13,0 @@ export { machineLabel, yubikeyLabel } from './device-label.js';

dist/index.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC1F,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EACL,YAAY,EACZ,UAAU,EACV,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,aAAa,EACb,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,GACjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AACxD,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,WAAW,GACZ,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC1F,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EACL,YAAY,EACZ,UAAU,EACV,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,aAAa,EACb,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,GACf,MAAM,cAAc,CAAA;AACrB,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACpE,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AACxD,YAAY,EACV,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,EACf,uBAAuB,EACvB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,WAAW,GACZ,MAAM,YAAY,CAAA"}

dist/index.js

@@ -7,3 +7,4 @@ export { readKeychain, writeKeychain, deleteKeychain, listAgentUrls } from './keychain.js';
 export { getConfigDir, readConfig, writeConfig, clearConfig, deleteConfigFile, getAgentConfig, setAgentConfig, addKeyToAgent, setPersonServer, setHosting, deleteAgentProvider, listAgentProviders, validateUrl, ensureAgentUrls, } from './config.js';
-export { readCachedMetadata, writeCachedMetadata, evictCachedMetadata, parseMaxAge, PS_METADATA_FILE, } from './metadata-cache.js';
+export { readCachedMetadata, writeCachedMetadata, evictCachedMetadata, parseMaxAge, isPersonServerMetadata, missingPersonServerMembers, PS_METADATA_FILE, CACHE_SCHEMA_VERSION, } from './metadata-cache.js';
+export { deriveFullySpecifiedAlg, assertFullySpecifiedAlg, hasFullySpecifiedAlg, withFullySpecifiedAlg, publicJwkWithAlg, normalizeAlgId, } from './jwk-alg.js';
 export { resolveKey, checkKeyAvailability } from './resolve-key.js';
@@ -10,0 +11,0 @@ export { machineLabel, yubikeyLabel } from './device-label.js';

dist/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC1F,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EACL,YAAY,EACZ,UAAU,EACV,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,aAAa,EACb,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,GACjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC1F,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EACL,YAAY,EACZ,UAAU,EACV,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,aAAa,EACb,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,GACf,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA"}

dist/keygen.d.ts

 import type { JWK } from 'jose';
 import type { GeneratedKeyPair } from './types.js';
 export declare function generateKid(): string;
-export declare function generateKey(algorithm?: 'EdDSA' | 'ES256'): Promise<GeneratedKeyPair>;
-/** Strip private material from a JWK, deriving `alg` from the curve. */
+/**
+ * Generate an agent signing key.
+ *
+ * The emitted JWKs carry a fully-specified `alg` (RFC 9864) — `Ed25519`, never
+ * the polymorphic `EdDSA`. These keys are published in the agent server's
+ * `jwks.json`, where a -11 verifier rejects anything less.
+ */
+export declare function generateKey(algorithm?: 'Ed25519' | 'ES256'): Promise<GeneratedKeyPair>;
+/**
+ * Strip private material from a JWK and give it a fully-specified `alg` derived
+ * from the key material. Throws when the stored `alg` contradicts the curve.
+ */
 export declare function toPublicJwk(jwk: JWK): JWK;
 //# sourceMappingURL=keygen.d.ts.map

dist/keygen.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../src/keygen.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,wBAAgB,WAAW,IAAI,MAAM,CAOpC;AAED,wBAAsB,WAAW,CAC/B,SAAS,GAAE,OAAO,GAAG,OAAiB,GACrC,OAAO,CAAC,gBAAgB,CAAC,CAiB3B;AAED,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAIzC"}
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../src/keygen.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAE/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,wBAAgB,WAAW,IAAI,MAAM,CAOpC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,SAAS,GAAE,SAAS,GAAG,OAAmB,GACzC,OAAO,CAAC,gBAAgB,CAAC,CAgB3B;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAGzC"}

dist/keygen.js

 import { generateKeyPair, exportJWK } from 'jose';
+import { publicJwkWithAlg } from './jwk-alg.js';
 export function generateKid() {
@@ -10,23 +11,31 @@ const now = new Date();
 }
-export async function generateKey(algorithm = 'EdDSA') {
+/**
+ * Generate an agent signing key.
+ *
+ * The emitted JWKs carry a fully-specified `alg` (RFC 9864) — `Ed25519`, never
+ * the polymorphic `EdDSA`. These keys are published in the agent server's
+ * `jwks.json`, where a -11 verifier rejects anything less.
+ */
+export async function generateKey(algorithm = 'Ed25519') {
     const kid = generateKid();
-    const alg = algorithm === 'ES256' ? 'ES256' : 'EdDSA';
-    const opts = alg === 'ES256' ? { crv: 'P-256' } : { crv: 'Ed25519' };
+    const alg = algorithm === 'ES256' ? 'ES256' : 'Ed25519';
+    // jose 6: keys are non-extractable by default, and these are exported to JWK below
+    const opts = alg === 'ES256' ? { crv: 'P-256', extractable: true } : { crv: 'Ed25519', extractable: true };
     const { publicKey, privateKey } = await generateKeyPair(alg, opts);
-    const privateJwk = await exportJWK(privateKey);
-    const publicJwk = await exportJWK(publicKey);
+    const privateJwk = publicJwkWithAlg(await exportJWK(privateKey), alg, 'generated private key');
+    const publicJwk = publicJwkWithAlg(await exportJWK(publicKey), alg, 'generated public key');
     privateJwk.kid = kid;
-    privateJwk.alg = alg;
     privateJwk.use = 'sig';
     publicJwk.kid = kid;
-    publicJwk.alg = alg;
     publicJwk.use = 'sig';
     return { privateJwk, publicJwk };
 }
-/** Strip private material from a JWK, deriving `alg` from the curve. */
+/**
+ * Strip private material from a JWK and give it a fully-specified `alg` derived
+ * from the key material. Throws when the stored `alg` contradicts the curve.
+ */
 export function toPublicJwk(jwk) {
     const { d: _d, ...pub } = jwk;
-    const alg = pub.alg ?? (pub.crv === 'P-256' ? 'ES256' : 'EdDSA');
-    return { ...pub, use: 'sig', alg };
+    return { ...publicJwkWithAlg(pub, undefined, 'public JWK'), use: 'sig' };
 }
 //# sourceMappingURL=keygen.js.map

dist/keygen.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"keygen.js","sourceRoot":"","sources":["../src/keygen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAIjD,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,aAAa;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC;SAC1C,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACnB,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,YAA+B,OAAO;IAEtC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IACrD,MAAM,IAAI,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;IACpE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAElE,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAA;IAE5C,UAAU,CAAC,GAAG,GAAG,GAAG,CAAA;IACpB,UAAU,CAAC,GAAG,GAAG,GAAG,CAAA;IACpB,UAAU,CAAC,GAAG,GAAG,KAAK,CAAA;IACtB,SAAS,CAAC,GAAG,GAAG,GAAG,CAAA;IACnB,SAAS,CAAC,GAAG,GAAG,GAAG,CAAA;IACnB,SAAS,CAAC,GAAG,GAAG,KAAK,CAAA;IAErB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;AAClC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,GAAQ;IAClC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAA;IAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IAChE,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;AACpC,CAAC"}
+{"version":3,"file":"keygen.js","sourceRoot":"","sources":["../src/keygen.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG/C,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,aAAa;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC;SAC1C,QAAQ,CAAC,EAAE,CAAC;SACZ,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACnB,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,YAAiC,SAAS;IAE1C,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IACvD,mFAAmF;IACnF,MAAM,IAAI,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IAC1G,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAElE,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,SAAS,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAA;IAC9F,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAA;IAE3F,UAAU,CAAC,GAAG,GAAG,GAAG,CAAA;IACpB,UAAU,CAAC,GAAG,GAAG,KAAK,CAAA;IACtB,SAAS,CAAC,GAAG,GAAG,GAAG,CAAA;IACnB,SAAS,CAAC,GAAG,GAAG,KAAK,CAAA;IAErB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAQ;IAClC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,GAAG,CAAA;IAC7B,OAAO,EAAE,GAAG,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;AAC1E,CAAC"}

dist/metadata-cache.d.ts

 /** Standard filename for person-server metadata. */
 export declare const PS_METADATA_FILE = "aauth-person.json";
+/**
+ * Stored-shape version. Bumped to 2 for AAuth -11 (`auth_token_endpoint` +
+ * `person_token_endpoint`). Entries at any other version are evicted on read.
+ */
+export declare const CACHE_SCHEMA_VERSION = 2;
+/**
+ * Person Server metadata, `/.well-known/aauth-person.json` (AAuth -11
+ * #ps-metadata). Unknown members are preserved verbatim — the cache stores what
+ * the server sent.
+ */
+export interface PersonServerMetadata {
+    /** REQUIRED. The PS's HTTPS URL; the `iss` of tokens it issues. */
+    issuer: string;
+    /** REQUIRED. Where agents send token requests. Renamed from `token_endpoint` in -11. */
+    auth_token_endpoint: string;
+    /** REQUIRED, new in -11. Where agents request a person token for a resource. */
+    person_token_endpoint: string;
+    /** REQUIRED. The PS's JWKS. */
+    jwks_uri: string;
+    name?: string;
+    description?: string;
+    logo_uri?: string;
+    logo_dark_uri?: string;
+    documentation_uri?: string;
+    tos_uri?: string;
+    policy_uri?: string;
+    mission_endpoint?: string;
+    permission_endpoint?: string;
+    audit_endpoint?: string;
+    interaction_endpoint?: string;
+    mission_control_endpoint?: string;
+    revocation_endpoint?: string;
+    scopes_supported?: string[];
+    claims_supported?: string[];
+    [member: string]: unknown;
+}
 /** Parse `max-age` (seconds) from a `Cache-Control` header value, if present. */
 export declare function parseMaxAge(cacheControl: string | null | undefined): number | undefined;
-/** The cached doc if present and not expired, else null. */
-export declare function readCachedMetadata(host: string, file?: string): unknown | null;
-/** Persist a fetched doc + its expiry (server `max-age` if given, else the 1-day default). */
+/**
+ * Members of {@link PS_REQUIRED_MEMBERS} the document is missing. Empty when the
+ * document is a valid -11 PS metadata document.
+ */
+export declare function missingPersonServerMembers(doc: unknown): string[];
+/** Type guard for a document that satisfies -11 #ps-metadata. */
+export declare function isPersonServerMetadata(doc: unknown): doc is PersonServerMetadata;
+/**
+ * The cached doc if present, current-schema, unexpired and well-formed, else
+ * null. A stale-schema or malformed entry is evicted so the next fetch replaces
+ * it rather than the miss recurring forever.
+ */
+export declare function readCachedMetadata<T = PersonServerMetadata>(host: string, file?: string): T | null;
+/**
+ * Persist a fetched doc + its expiry (server `max-age` if given, else the 1-day
+ * default).
+ *
+ * Writing `aauth-person.json` throws when the document is not valid -11 PS
+ * metadata: a PS without a `person_token_endpoint` is not one this stack can
+ * use, and caching it would only defer the failure to a later read.
+ */
 export declare function writeCachedMetadata(host: string, doc: unknown, maxAgeSeconds?: number, file?: string): void;
@@ -9,0 +63,0 @@ /** Drop a cached entry (used by the self-heal path when an endpoint goes stale). */

dist/metadata-cache.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"metadata-cache.d.ts","sourceRoot":"","sources":["../src/metadata-cache.ts"],"names":[],"mappings":"AAuBA,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,sBAAsB,CAAA;AAuCnD,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIvF;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAmB,GAAG,OAAO,GAAG,IAAI,CAQxF;AAED,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,SAAmB,GAAG,IAAI,CAMrH;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAmB,GAAG,IAAI,CAK/E"}
+{"version":3,"file":"metadata-cache.d.ts","sourceRoot":"","sources":["../src/metadata-cache.ts"],"names":[],"mappings":"AA+CA,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,sBAAsB,CAAA;AAEnD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAA;AAErC;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAA;IACd,wFAAwF;IACxF,mBAAmB,EAAE,MAAM,CAAA;IAC3B,gFAAgF;IAChF,qBAAqB,EAAE,MAAM,CAAA;IAC7B,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAEhB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAE3B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1B;AAqDD,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAIvF;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAIjE;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,oBAAoB,CAEhF;AAgBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,GAAG,oBAAoB,EACzD,IAAI,EAAE,MAAM,EACZ,IAAI,SAAmB,GACtB,CAAC,GAAG,IAAI,CA0BV;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,OAAO,EACZ,aAAa,CAAC,EAAE,MAAM,EACtB,IAAI,SAAmB,GACtB,IAAI,CAgBN;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAmB,GAAG,IAAI,CAK/E"}

dist/metadata-cache.js

@@ -12,3 +12,3 @@ import { readFileSync, writeFileSync, mkdirSync, renameSync, rmSync } from 'node:fs';
  *   cache/<host dots→dashes>/aauth-person.json   ← the raw fetched doc
- *   cache/index.json                              ← { "<host>/<file>": { expires_at } }
+ *   cache/index.json                              ← { "<host>/<file>": { expires_at, schema } }
  *
@@ -18,2 +18,26 @@ * Freshness is purely time-based: use the cached doc while `now < expires_at`,
  * max-age` if it sent one, else a 1-day default. No etag/revalidation.
+ *
+ * ## Schema version — AAuth -11
+ *
+ * -11 renamed the PS metadata field `token_endpoint` to `auth_token_endpoint`
+ * and added `person_token_endpoint` as REQUIRED (#ps-metadata). Entries written
+ * before -11 therefore hold a document whose auth token endpoint is under a name
+ * no -11 reader looks at, and which has no person token endpoint at all.
+ *
+ * Those entries are **invalidated, not migrated**. Migration is not possible in
+ * the direction that matters: `person_token_endpoint` is REQUIRED and there is
+ * nothing in a pre-11 document to derive it from, so a "migrated" entry would be
+ * a document that still fails -11 validation while now looking current. The
+ * rename alone is mechanical, but half a migration is worse than none — the
+ * whole point is that a cache holding `token_endpoint` must never read back as a
+ * PS with no auth token endpoint. The cache is a latency optimization over a
+ * public document, so the cost of invalidating is one HTTP GET per PS.
+ *
+ * Two independent gates enforce that:
+ *
+ *  1. every entry carries `schema`, and a read at any other version evicts the
+ *     entry and reports a miss; and
+ *  2. reads and writes of `aauth-person.json` validate the document shape, so an
+ *     entry that somehow carries the right version but the wrong body is still a
+ *     miss.
  */
@@ -25,2 +49,14 @@ const CACHE_DIR = join(homedir(), '.aauth', 'cache');
 export const PS_METADATA_FILE = 'aauth-person.json';
+/**
+ * Stored-shape version. Bumped to 2 for AAuth -11 (`auth_token_endpoint` +
+ * `person_token_endpoint`). Entries at any other version are evicted on read.
+ */
+export const CACHE_SCHEMA_VERSION = 2;
+/** The members #ps-metadata marks REQUIRED. */
+const PS_REQUIRED_MEMBERS = [
+    'issuer',
+    'auth_token_endpoint',
+    'person_token_endpoint',
+    'jwks_uri',
+];
 /** Hostname → cache dir segment, dots→dashes: `person.hello.coop` → `person-hello-coop`. */
@@ -61,9 +97,45 @@ function hostSegment(host) {
 }
-/** The cached doc if present and not expired, else null. */
+/**
+ * Members of {@link PS_REQUIRED_MEMBERS} the document is missing. Empty when the
+ * document is a valid -11 PS metadata document.
+ */
+export function missingPersonServerMembers(doc) {
+    if (!doc || typeof doc !== 'object')
+        return [...PS_REQUIRED_MEMBERS];
+    const d = doc;
+    return PS_REQUIRED_MEMBERS.filter((m) => typeof d[m] !== 'string' || d[m] === '');
+}
+/** Type guard for a document that satisfies -11 #ps-metadata. */
+export function isPersonServerMetadata(doc) {
+    return missingPersonServerMembers(doc).length === 0;
+}
+/**
+ * Throw a diagnosis for a document that is not valid -11 PS metadata, calling
+ * out the -10 → -11 rename when the document still carries `token_endpoint`.
+ */
+function rejectPersonServerDoc(doc, missing, what) {
+    const legacy = doc && typeof doc === 'object' && typeof doc.token_endpoint === 'string'
+        ? " — it carries the pre-11 'token_endpoint', renamed to 'auth_token_endpoint' in AAuth -11"
+        : '';
+    throw new Error(`${what} is not valid AAuth -11 person server metadata: missing ${missing.join(', ')}${legacy}`);
+}
+/**
+ * The cached doc if present, current-schema, unexpired and well-formed, else
+ * null. A stale-schema or malformed entry is evicted so the next fetch replaces
+ * it rather than the miss recurring forever.
+ */
 export function readCachedMetadata(host, file = PS_METADATA_FILE) {
     const entry = readIndex()[entryKey(host, file)];
-    if (!entry || Math.floor(Date.now() / 1000) >= entry.expires_at)
+    if (!entry)
         return null;
+    // Gate 1: stored shape. Pre-11 entries have no `schema` at all.
+    if (entry.schema !== CACHE_SCHEMA_VERSION) {
+        evictCachedMetadata(host, file);
+        return null;
+    }
+    if (Math.floor(Date.now() / 1000) >= entry.expires_at)
+        return null;
+    let doc;
     try {
-        return JSON.parse(readFileSync(docPath(host, file), 'utf-8'));
+        doc = JSON.parse(readFileSync(docPath(host, file), 'utf-8'));
     }
@@ -73,9 +145,31 @@ catch {
     }
+    // Gate 2: document shape, for the one file whose shape this package knows.
+    if (file === PS_METADATA_FILE && !isPersonServerMetadata(doc)) {
+        evictCachedMetadata(host, file);
+        return null;
+    }
+    return doc;
 }
-/** Persist a fetched doc + its expiry (server `max-age` if given, else the 1-day default). */
+/**
+ * Persist a fetched doc + its expiry (server `max-age` if given, else the 1-day
+ * default).
+ *
+ * Writing `aauth-person.json` throws when the document is not valid -11 PS
+ * metadata: a PS without a `person_token_endpoint` is not one this stack can
+ * use, and caching it would only defer the failure to a later read.
+ */
 export function writeCachedMetadata(host, doc, maxAgeSeconds, file = PS_METADATA_FILE) {
+    if (file === PS_METADATA_FILE) {
+        const missing = missingPersonServerMembers(doc);
+        if (missing.length > 0) {
+            rejectPersonServerDoc(doc, missing, `Person server metadata for ${host}`);
+        }
+    }
     atomicWrite(docPath(host, file), JSON.stringify(doc, null, 2) + '\n');
     const index = readIndex();
     const ttl = maxAgeSeconds && maxAgeSeconds > 0 ? maxAgeSeconds : DEFAULT_TTL_SECONDS;
-    index[entryKey(host, file)] = { expires_at: Math.floor(Date.now() / 1000) + ttl };
+    index[entryKey(host, file)] = {
+        expires_at: Math.floor(Date.now() / 1000) + ttl,
+        schema: CACHE_SCHEMA_VERSION,
+    };
     writeIndex(index);
@@ -82,0 +176,0 @@ }

dist/metadata-cache.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"metadata-cache.js","sourceRoot":"","sources":["../src/metadata-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC;;;;;;;;;;;;GAYG;AAEH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;AACpD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;AAChD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAExC,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAA;AAMnD,4FAA4F;AAC5F,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;AACvC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;AACjD,CAAC;AAED,2FAA2F;AAC3F,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAA;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACxB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAe,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;AAChE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,YAAuC;IACjE,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAA;IACnC,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC9D,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3C,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAI,GAAG,gBAAgB;IACtE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAC5E,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAY,EAAE,aAAsB,EAAE,IAAI,GAAG,gBAAgB;IAC7G,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACrE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IACzB,MAAM,GAAG,GAAG,aAAa,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACpF,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,CAAA;IACjF,UAAU,CAAC,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAI,GAAG,gBAAgB;IACvE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IACzB,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAClC,UAAU,CAAC,KAAK,CAAC,CAAA;IACjB,IAAI,CAAC;QAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"metadata-cache.js","sourceRoot":"","sources":["../src/metadata-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;AACpD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;AAChD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAExC,oDAAoD;AACpD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAA;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAoCrC,+CAA+C;AAC/C,MAAM,mBAAmB,GAAG;IAC1B,QAAQ;IACR,qBAAqB;IACrB,uBAAuB;IACvB,UAAU;CACF,CAAA;AAYV,4FAA4F;AAC5F,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;AACvC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;AACjD,CAAC;AAED,2FAA2F;AAC3F,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAA;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACxB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAe,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;AAChE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,YAAuC;IACjE,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAA;IACnC,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC9D,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAY;IACrD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAA;IACpE,MAAM,CAAC,GAAG,GAA8B,CAAA;IACxC,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;AACnF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,0BAA0B,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAA;AACrD,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,GAAY,EAAE,OAAiB,EAAE,IAAY;IAC1E,MAAM,MAAM,GACV,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAA+B,CAAC,cAAc,KAAK,QAAQ;QACnG,CAAC,CAAC,0FAA0F;QAC5F,CAAC,CAAC,EAAE,CAAA;IACR,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,2DAA2D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAChG,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAY,EACZ,IAAI,GAAG,gBAAgB;IAEvB,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,gEAAgE;IAChE,IAAI,KAAK,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC1C,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAElE,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI,KAAK,gBAAgB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,GAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,GAAY,EACZ,aAAsB,EACtB,IAAI,GAAG,gBAAgB;IAEvB,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAA;QAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,IAAI,EAAE,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACrE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IACzB,MAAM,GAAG,GAAG,aAAa,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACpF,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG;QAC5B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;QAC/C,MAAM,EAAE,oBAAoB;KAC7B,CAAA;IACD,UAAU,CAAC,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAI,GAAG,gBAAgB;IACvE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAA;IACzB,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAClC,UAAU,CAAC,KAAK,CAAC,CAAA;IACjB,IAAI,CAAC;QAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAClE,CAAC"}

dist/resolve-key.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"resolve-key.d.ts","sourceRoot":"","sources":["../src/resolve-key.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAG/B,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEzD;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAoCvE;AA+LD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACnE,SAAS,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,GAAG,CAAC;QAAC,OAAO,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClE,WAAW,EAAE,GAAG,EAAE,CAAA;CACnB,CAAC,CAqBD"}
+{"version":3,"file":"resolve-key.d.ts","sourceRoot":"","sources":["../src/resolve-key.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAI/B,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAgB,MAAM,YAAY,CAAA;AAEvE;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAoCvE;AA2MD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACnE,SAAS,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,GAAG,CAAC;QAAC,OAAO,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClE,WAAW,EAAE,GAAG,EAAE,CAAA;CACnB,CAAC,CAqBD"}

dist/resolve-key.js

 import { calculateJwkThumbprint } from 'jose';
 import { getAgentConfig } from './config.js';
 import { discoverBackends, getBackend } from './backends/index.js';
+import { normalizeAlgId, publicJwkWithAlg } from './jwk-alg.js';
 /**
@@ -110,3 +111,3 @@ * Resolve a signing key for an agent URL.
                         kid: k.publicJwk.kid || k.keyId,
-                        algorithm: k.algorithm,
+                        algorithm: normalizeAlgId(k.algorithm),
                         publicJwk: k.publicJwk,
@@ -130,2 +131,10 @@ thumbprint,
  * Match JWKS keys against local keys. Prefers hardware over software.
+ *
+ * Matching is by JWK thumbprint (RFC 7638), which covers only the key material —
+ * `alg` is not an input. That is deliberate: an agent whose published
+ * `jwks.json` still carries the pre-11 `alg: "EdDSA"` must still resolve to its
+ * local key. The resolved algorithm is taken from the local key, never from the
+ * remote document, so a stale published `alg` cannot reach a signature or a
+ * `cnf.jwk`. Verifying a remote key's `alg` is the verifier's job — see
+ * `assertFullySpecifiedAlg` in `jwk-alg.ts`.
  */
@@ -169,3 +178,7 @@ async function matchJwksToLocal(jwksKeys, localKeys) {
  */
-async function resolveFromConfig(configKeys, localKeys) {
+async function resolveFromConfig(
+// `algorithm` is widened to string: a `~/.aauth/config.json` written before
+// AAuth -11 records "EdDSA", which is no longer a KeyAlgorithm. It is
+// normalized to "Ed25519" below rather than migrating the file.
+configKeys, localKeys) {
     const backends = discoverBackends();
@@ -194,4 +207,5 @@ let softwareMatch = null;
                 const driver = getBackend(meta.backend);
-                const pubJwk = await driver.getPublicKey(meta.keyId);
-                if (pubJwk && pubJwk.kty) {
+                const rawJwk = await driver.getPublicKey(meta.keyId);
+                if (rawJwk && rawJwk.kty) {
+                    const algorithm = normalizeAlgId(meta.algorithm);
                     lazyHardwareMatch = {
@@ -201,4 +215,4 @@ backend: meta.backend,
                         kid,
-                        algorithm: meta.algorithm,
-                        publicJwk: pubJwk,
+                        algorithm,
+                        publicJwk: publicJwkWithAlg(rawJwk, algorithm, `${meta.backend} key ${meta.keyId}`),
                     };
@@ -205,0 +219,0 @@ }

dist/resolve-key.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"resolve-key.js","sourceRoot":"","sources":["../src/resolve-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,MAAM,CAAA;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAGlE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,0CAA0C;IAC1C,qFAAqF;IACrF,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IAErE,kCAAkC;IAClC,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAE3C,+CAA+C;IAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACzD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IAED,8BAA8B;IAC9B,IAAI,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QACxE,IAAI,WAAW;YAAE,OAAO,WAAW,CAAA;IACrC,CAAC;IAED,8FAA8F;IAC9F,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAA;IACtE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;IAED,8CAA8C;IAC9C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,IAAI;QACxC,qDAAqD,CACtD,CAAA;AACH,CAAC;AAED,wBAAwB;AAExB,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,aAAsB;IACpE,IAAI,CAAC;QACH,iEAAiE;QACjE,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAA;QAE7E,IAAI,aAAa,EAAE,CAAC;YAClB,+DAA+D;YAC/D,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC7C,KAAK,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;gBAC7E,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACxE,CAAC,CAAA;YAEF,4DAA4D;YAC5D,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAA;gBAC7D,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;oBACrD,yDAAyD;oBACzD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;oBACnF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;wBACjB,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAqB,CAAA;wBACzD,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;oBACxB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,mCAAmC;YACnC,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAA;gBACxD,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;YACxB,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAA;QAE3B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAA;QAC7D,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAA;QAE7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAClF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAA;QAE3B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAA;QACxD,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAaD,KAAK,UAAU,iBAAiB;IAC9B,MAAM,IAAI,GAAe,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;IAEnC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAA;YAC3C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG;oBAAE,SAAQ;gBAC9C,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACtE,IAAI,CAAC,IAAI,CAAC;wBACR,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK;wBAC/B,SAAS,EAAE,CAAC,CAAC,SAAS;wBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;wBACtB,UAAU;qBACX,CAAC,CAAA;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,6CAA6C;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,mBAAmB;AAEnB;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAe,EACf,SAAqB;IAErB,IAAI,aAAa,GAAuB,IAAI,CAAA;IAE5C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG;YAAE,SAAQ;QACtB,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YACpE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAA;YACtE,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAgB;oBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG;oBACzB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAA;gBACD,oCAAoC;gBACpC,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBACjC,OAAO,QAAQ,CAAA;gBACjB,CAAC;gBACD,2DAA2D;gBAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,aAAa,GAAG,QAAQ,CAAA;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,UAA0G,EAC1G,SAAqB;IAErB,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;IACnC,IAAI,aAAa,GAAuB,IAAI,CAAA;IAC5C,IAAI,iBAAiB,GAAuB,IAAI,CAAA;IAEhD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,0CAA0C;QAC1C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;QACzE,IAAI,CAAC,gBAAgB;YAAE,SAAQ;QAE/B,kDAAkD;QAClD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAC5D,CAAA;QACD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,QAAQ,GAAgB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,CAAA;YAC/C,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU;gBAAE,OAAO,QAAQ,CAAA;YACjD,IAAI,CAAC,aAAa;gBAAE,aAAa,GAAG,QAAQ,CAAA;YAC5C,SAAQ;QACV,CAAC;QAED,+EAA+E;QAC/E,sDAAsD;QACtD,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACpD,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;oBACzB,iBAAiB,GAAG;wBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,GAAG;wBACH,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,SAAS,EAAE,MAAM;qBAClB,CAAA;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,IAAI,aAAa,CAAA;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAe;IAIxD,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC3C,MAAM,SAAS,GAA4D,EAAE,CAAA;IAC7E,MAAM,WAAW,GAAU,EAAE,CAAA;IAE7B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG;YAAE,SAAQ;QACtB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAA;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;YACrE,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;AACnC,CAAC"}
+{"version":3,"file":"resolve-key.js","sourceRoot":"","sources":["../src/resolve-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,MAAM,CAAA;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAG/D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,0CAA0C;IAC1C,qFAAqF;IACrF,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IAErE,kCAAkC;IAClC,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAE3C,+CAA+C;IAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QACzD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IAED,8BAA8B;IAC9B,IAAI,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QACxE,IAAI,WAAW;YAAE,OAAO,WAAW,CAAA;IACrC,CAAC;IAED,8FAA8F;IAC9F,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAA;IACtE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,CAAC,CAAC,CAAA;IACxB,CAAC;IAED,8CAA8C;IAC9C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,CAAC,CAAC,CAAA;IACrB,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4BAA4B,QAAQ,IAAI;QACxC,qDAAqD,CACtD,CAAA;AACH,CAAC;AAED,wBAAwB;AAExB,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,aAAsB;IACpE,IAAI,CAAC;QACH,iEAAiE;QACjE,MAAM,OAAO,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,+BAA+B,CAAA;QAE7E,IAAI,aAAa,EAAE,CAAC;YAClB,+DAA+D;YAC/D,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC7C,KAAK,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;gBAC7E,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACxE,CAAC,CAAA;YAEF,4DAA4D;YAC5D,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAA;gBAC7D,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;oBACrD,yDAAyD;oBACzD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;oBACnF,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;wBACjB,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAqB,CAAA;wBACzD,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;oBACxB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,mCAAmC;YACnC,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAA;gBACxD,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;YACxB,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAA;QAE3B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAA;QAC7D,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAA;QAE7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAClF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAA;QAE3B,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAA;QACxD,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAaD,KAAK,UAAU,iBAAiB;IAC9B,MAAM,IAAI,GAAe,EAAE,CAAA;IAC3B,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;IAEnC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAA;YAC3C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG;oBAAE,SAAQ;gBAC9C,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;oBACtE,IAAI,CAAC,IAAI,CAAC;wBACR,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK;wBAC/B,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAiB;wBACtD,SAAS,EAAE,CAAC,CAAC,SAAS;wBACtB,UAAU;qBACX,CAAC,CAAA;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,6CAA6C;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,mBAAmB;AAEnB;;;;;;;;;;GAUG;AACH,KAAK,UAAU,gBAAgB,CAC7B,QAAe,EACf,SAAqB;IAErB,IAAI,aAAa,GAAuB,IAAI,CAAA;IAE5C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG;YAAE,SAAQ;QACtB,IAAI,CAAC;YACH,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YACpE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAA;YACtE,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAgB;oBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG;oBACzB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B,CAAA;gBACD,oCAAoC;gBACpC,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;oBACjC,OAAO,QAAQ,CAAA;gBACjB,CAAC;gBACD,2DAA2D;gBAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,aAAa,GAAG,QAAQ,CAAA;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAA;AACtB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB;AAC9B,4EAA4E;AAC5E,sEAAsE;AACtE,gEAAgE;AAChE,UAAqF,EACrF,SAAqB;IAErB,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAA;IACnC,IAAI,aAAa,GAAuB,IAAI,CAAA;IAC5C,IAAI,iBAAiB,GAAuB,IAAI,CAAA;IAEhD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,0CAA0C;QAC1C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAA;QACzE,IAAI,CAAC,gBAAgB;YAAE,SAAQ;QAE/B,kDAAkD;QAClD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAC5D,CAAA;QACD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,QAAQ,GAAgB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,CAAA;YAC/C,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU;gBAAE,OAAO,QAAQ,CAAA;YACjD,IAAI,CAAC,aAAa;gBAAE,aAAa,GAAG,QAAQ,CAAA;YAC5C,SAAQ;QACV,CAAC;QAED,+EAA+E;QAC/E,sDAAsD;QACtD,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;gBACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACpD,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;oBACzB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAiB,CAAA;oBAChE,iBAAiB,GAAG;wBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;wBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,GAAG;wBACH,SAAS;wBACT,SAAS,EAAE,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;qBACpF,CAAA;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,iBAAiB,IAAI,aAAa,CAAA;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAe;IAIxD,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAA;IAC3C,MAAM,SAAS,GAA4D,EAAE,CAAA;IAC7E,MAAM,WAAW,GAAU,EAAE,CAAA;IAE7B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG;YAAE,SAAQ;QACtB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAA;YAChE,IAAI,KAAK,EAAE,CAAC;gBACV,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;YACrE,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACvB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAA;AACnC,CAAC"}

dist/types.d.ts

 import type { JWK } from 'jose';
 export type KeyBackend = 'software' | 'yubikey-piv' | 'secure-enclave';
-export type KeyAlgorithm = 'EdDSA' | 'ES256' | 'RS256';
+/**
+ * Signing algorithms, as fully-specified identifiers (RFC 9864).
+ *
+ * `Ed25519` replaces the polymorphic `EdDSA` used before AAuth -11 — see
+ * `jwk-alg.ts`. Config files written by earlier versions still record `EdDSA`;
+ * `normalizeAlgId` maps those on read.
+ */
+export type KeyAlgorithm = 'Ed25519' | 'ES256' | 'RS256';
 export interface BackendInfo {
@@ -5,0 +12,0 @@ backend: KeyBackend;

dist/types.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAI/B,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,gBAAgB,CAAA;AACtE,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAA;AAEtD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,YAAY,EAAE,CAAA;IAC1B,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,UAAU,CAAA;IACnB,SAAS,EAAE,YAAY,CAAA;IACvB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,GAAG,CAAA;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,IAAI,WAAW,GAAG,IAAI,CAAA;IAC9B,WAAW,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,YAAY,CAAA;KAAE,CAAC,CAAA;IAC9F,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IACnC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,iDAAiD;IACjD,cAAc,IAAI,MAAM,CAAA;IACxB;;;;;OAKG;IACH,SAAS,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;aACxB,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;CAIzC;AAID,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,cAAe,SAAQ,GAAG;IACzC,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB;AAID,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,YAAY,CAAA;IACvB,SAAS,EAAE,GAAG,CAAA;CACf;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,UAAU,CAAA;IACnB,SAAS,EAAE,YAAY,CAAA;IACvB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAA;IAChB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CACpC;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,GAAG,CAAA;IACf,SAAS,EAAE,GAAG,CAAA;CACf;AAID,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iGAAiG;IACjG,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,KAAK,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,GAAG,CAAA;IACf,YAAY,EAAE,eAAe,CAAA;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6FAA6F;IAC7F,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;kFAE8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAA;AAI/B,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,gBAAgB,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAA;AAExD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,YAAY,EAAE,CAAA;IAC1B,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,UAAU,CAAA;IACnB,SAAS,EAAE,YAAY,CAAA;IACvB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,GAAG,CAAA;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,IAAI,WAAW,GAAG,IAAI,CAAA;IAC9B,WAAW,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,YAAY,CAAA;KAAE,CAAC,CAAA;IAC9F,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IACnC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACzC,iDAAiD;IACjD,cAAc,IAAI,MAAM,CAAA;IACxB;;;;;OAKG;IACH,SAAS,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzC;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;aACxB,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;CAIzC;AAID,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,cAAe,SAAQ,GAAG;IACzC,KAAK,CAAC,EAAE,gBAAgB,CAAA;CACzB;AAID,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,UAAU,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,YAAY,CAAA;IACvB,SAAS,EAAE,GAAG,CAAA;CACf;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,UAAU,CAAA;IACnB,SAAS,EAAE,YAAY,CAAA;IACvB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAA;IACb,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAA;IAChB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,YAAY,CAAA;IACtB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;CACpC;AAID,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,GAAG,CAAA;IACf,SAAS,EAAE,GAAG,CAAA;CACf;AAID,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iGAAiG;IACjG,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,KAAK,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,GAAG,CAAA;IACf,YAAY,EAAE,eAAe,CAAA;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,6FAA6F;IAC7F,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;kFAE8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB"}

dist/types.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAuCA;;;GAGG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACxB;IAA5B,YAA4B,IAAY;QACtC,KAAK,CAAC,IAAI,CAAC,CAAA;QADe,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;IAC3C,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AA+CA;;;GAGG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACxB;IAA5B,YAA4B,IAAY;QACtC,KAAK,CAAC,IAAI,CAAC,CAAA;QADe,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;IAC3C,CAAC;CACF"}

package.json

 {
   "name": "@aauth/local-keys",
-  "version": "1.3.0",
+  "version": "2.0.0",
   "description": "Manage AAuth agent signing keys across hardware and software backends",
@@ -40,3 +40,3 @@ "type": "module",
     "@napi-rs/keyring": "^1.1.3",
-    "jose": "^5.0.0"
+    "jose": "^6.0.0"
   },
@@ -43,0 +43,0 @@ "optionalDependencies": {

README.md

@@ -21,6 +21,8 @@ # @aauth/local-keys
 | `secure-enclave` | ES256 | macOS (Apple Silicon) | Secure Enclave hardware |
-| `software` | EdDSA, ES256 | All | OS keychain |
+| `software` | Ed25519, ES256 | All | OS keychain |
 
 Hardware keys are always preferred over software keys. If a YubiKey is unplugged, signing automatically falls back to the next available key.
 
+Algorithm identifiers are fully specified per [RFC 9864](https://www.rfc-editor.org/rfc/rfc9864.html), as AAuth -11 §Signature Algorithms requires: `Ed25519`, never the polymorphic `EdDSA`. Every JWK this package emits carries an `alg` that agrees with its `kty`/`crv`, and keys generated before 2.0.0 are normalized on read — see `withFullySpecifiedAlg` / `assertFullySpecifiedAlg`.
+
 ## API
@@ -27,0 +29,0 @@

No alert changes

Improved metrics

Total package byte prevSize

140455

24.25%

Number of package files

64

6.67%

Lines of code

1757

29.96%

Number of lines in readme file

144

1.41%

Dependency changes

• + Added

  jose@6.2.10
  (transitive)

• - Removed

  jose@5.10.0
  (transitive)

• Updated

  jose@^6.0.0