@absolutejs/auth 0.55.9 → 0.56.0

package/dist/index.js

@@ -3214,6 +3214,7 @@ init_crypto();
 var ENCODER = new TextEncoder;
 var ES256 = { hash: "SHA-256", name: "ECDSA" };
 var KEY_PARAMS = { name: "ECDSA", namedCurve: "P-256" };
+var ES256_JOSE_SIGNATURE_BYTES = 64;
 var toBase64Url = (bytes) => Buffer.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)).toString("base64url");
 var fromBase64Url = (value) => new Uint8Array(Buffer.from(value, "base64url"));
 var encodeSegment = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
@@ -3247,9 +3248,18 @@ var jwkThumbprint = async (jwk) => {
   return toBase64Url(await crypto.subtle.digest("SHA-256", ENCODER.encode(canonical)));
 };
 var signJwt = async (payload, signing, typ = "JWT") => {
-  const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
   const input = `${encodeSegment({ alg: "ES256", kid: signing.kid, typ })}.${encodeSegment(payload)}`;
-  const signature = await crypto.subtle.sign(ES256, key, ENCODER.encode(input));
+  const encoded = ENCODER.encode(input);
+  let signature;
+  if (signing.sign !== undefined) {
+    signature = await signing.sign(encoded);
+  } else {
+    const key = await crypto.subtle.importKey("jwk", signing.privateJwk, KEY_PARAMS, false, ["sign"]);
+    signature = await crypto.subtle.sign(ES256, key, encoded);
+  }
+  if (signature.byteLength !== ES256_JOSE_SIGNATURE_BYTES) {
+    throw new Error("ES256 signer must return a 64-byte JOSE signature");
+  }
   return `${input}.${toBase64Url(signature)}`;
 };
 var toPublicJwk = (key) => ({
@@ -30131,5 +30141,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=A4FF719AF12981EA64756E2164756E21
+//# debugId=C0233F9D8EBEC87464756E2164756E21
 //# sourceMappingURL=index.js.map