@astralbeam/sdk 0.17.0 → 0.19.0

package/dist/server.js

@@ -1,71 +1,5 @@
-import { a as isPublicJWK, c as encode, d as JWTInvalid, f as concat, i as isPrivateJWK, l as JOSENotSupported, m as encoder, n as isJWK, o as isSecretJWK, p as encode$1, r as isObject, s as decode, t as isDisjoint, u as JWSInvalid } from "./type_checks-C-WTHaWs.js";
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/crypto_key.js
-const unusable = (name, prop = "algorithm.name") => /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-function checkUsage(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-function checkModulusLength(alg, key) {
-	const { modulusLength } = key.algorithm;
-	if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-}
-function checkCryptoKey(key, expected, usage) {
-	const algorithm = key.algorithm;
-	if (algorithm.name !== expected.name) throw unusable(expected.name);
-	if (expected.hash && algorithm.hash?.name !== expected.hash) throw unusable(expected.hash, "algorithm.hash");
-	if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) throw unusable(expected.namedCurve, "algorithm.namedCurve");
-	if (expected.length !== void 0 && algorithm.length !== expected.length) throw unusable(expected.length, "algorithm.length");
-	checkUsage(key, usage);
-}
-//#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/invalid_key_input.js
-function message(msg, actual, ...types) {
-	if (types.length > 2) {
-		const last = types.pop();
-		msg += `one of type ${types.join(", ")}, or ${last}.`;
-	} else if (types.length === 2) msg += `one of type ${types[0]} or ${types[1]}.`;
-	else msg += `of type ${types[0]}.`;
-	if (actual == null) msg += ` Received ${actual}`;
-	else if (typeof actual === "function" && actual.name) msg += ` Received function ${actual.name}`;
-	else if (typeof actual === "object" && actual != null) {
-		if (actual.constructor?.name) msg += ` Received an instance of ${actual.constructor.name}`;
-	}
-	return msg;
-}
-const withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
-//#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/is_key_like.js
-const isCryptoKey = (key) => {
-	if (key?.[Symbol.toStringTag] === "CryptoKey") return true;
-	try {
-		return key instanceof CryptoKey;
-	} catch {
-		return false;
-	}
-};
-const isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
-const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-//#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/helpers.js
-function assertNotSet(value, name) {
-	if (value) throw new TypeError(`${name} can only be called once`);
-}
-//#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/jwk_to_key.js
-async function jwkToKey(entry, jwk) {
-	if (jwk.kty === "RSA" && "oth" in jwk && jwk.oth !== void 0) throw new JOSENotSupported("RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported");
-	if (!entry.kty.includes(jwk.kty)) throw new JOSENotSupported("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
-	const algorithm = entry.resolve?.({
-		kty: jwk.kty,
-		crv: jwk.crv
-	}) ?? entry.subtle;
-	const isPrivate = !!(jwk.d || jwk.priv);
-	const keyData = { ...jwk };
-	if (keyData.kty !== "AKP") delete keyData.alg;
-	delete keyData.use;
-	return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
-}
-//#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/key.js
+import { a as serializeJoseHeader, c as validateCritDuplicates, d as JOSENotSupported, f as JWSInvalid, g as encoder, h as encode$1, i as isObject, l as decode, m as concat, n as assertNotSet, o as validateB64, p as JWTInvalid, r as isDisjoint, s as validateCrit, t as JWS_RECOGNIZED, u as encode } from "./validate-BOw-BAyv.js";
+//#region ../node_modules/.bun/jose@6.2.12/node_modules/jose/dist/webapi/lib/key.js
 const tag = (key) => key[Symbol.toStringTag];
 const jwkMatchesOp = (entry, key, usage) => {
 	const { alg } = entry;
@@ -79,32 +13,42 @@ const jwkMatchesOp = (entry, key, usage) => {
 		if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
 	}
 };
-function checkKeyType(entry, key, usage) {
-	const { alg, secret } = entry;
-	const privateKey = usage === "decrypt" || usage === "sign";
-	if (secret && key instanceof Uint8Array) return [BYTES, key];
-	if (isJWK(key)) {
-		if (secret ? !isSecretJWK(key) : !(privateKey ? isPrivateJWK(key) : isPublicJWK(key))) throw new TypeError(secret ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present` : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
-		jwkMatchesOp(entry, key, usage);
-		return [JWK, key];
-	}
-	if (!isKeyLike(key)) throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
-	if (secret) {
-		if (key.type !== "secret") throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
-	} else {
-		if (key.type === "secret") throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
-		const expectedType = privateKey ? "private" : "public";
-		if ((key.type === "public" || key.type === "private") && key.type !== expectedType) {
-			const operation = usage === "sign" ? "signing" : usage === "verify" ? "verifying" : `${usage.slice(0, -1)}tion`;
-			throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`);
+async function prepareKey(entry, key, usage) {
+	const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+	if (secret && key instanceof Uint8Array) return key;
+	let normalized, keyObject;
+	if (isObject(key)) {
+		if (normalized = normalizeJwk(key), typeof normalized.kty != "string") throw invalidKeyType(alg, key, secret);
+		if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0))) throw new TypeError(secret ? "JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present" : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+		if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct") return decode(normalized.k);
+		if (!Object.isFrozen(key)) {
+			const { key_ops } = key;
+			Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
 		}
+	} else {
+		if (!isKeyLike(key)) throw invalidKeyType(alg, key, secret);
+		const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+		if (key.type !== expectedType && (secret || [
+			"secret",
+			"public",
+			"private"
+		].includes(key.type))) throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+		if (isCryptoKey(key)) return key;
+		if (keyObject = key, keyObject.type === "secret") return keyObject.export();
 	}
-	return isCryptoKey(key) ? [CRYPTO, key] : [KEYOBJECT, key];
+	cache ||= /* @__PURE__ */ new WeakMap();
+	const cacheKey = key;
+	let cached = cache.get(cacheKey);
+	if (cached?.[alg]) return cached[alg];
+	if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+		const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({
+			crv,
+			asymmetricKeyType: keyObject.asymmetricKeyType
+		}) ?? entry.subtle;
+		return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+	}
+	return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
 }
-const BYTES = 0;
-const CRYPTO = 1;
-const KEYOBJECT = 2;
-const JWK = 3;
 let cache;
 const nist = {
 	__proto__: null,
@@ -112,58 +56,79 @@ const nist = {
 	secp384r1: "P-384",
 	secp521r1: "P-521"
 };
-function cached(key, alg, value) {
-	cache ||= /* @__PURE__ */ new WeakMap();
-	const entry = cache.get(key);
-	if (value) if (entry) entry[alg] = value;
-	else cache.set(key, {
-		__proto__: null,
-		[alg]: value
-	});
-	return value ?? entry?.[alg];
-}
-const handleJWK = async (key, jwk, entry) => cached(key, entry.alg) ?? cached(key, entry.alg, await jwkToKey(entry, {
-	...jwk,
-	alg: entry.alg
-}));
-const handleKeyObject = (keyObject, entry) => {
-	const hit = cached(keyObject, entry.alg);
-	if (hit) return hit;
-	const isPublic = keyObject.type === "public";
-	const usages = entry.usages[isPublic ? 0 : 1];
-	const { asymmetricKeyType } = keyObject;
-	const crv = nist[keyObject.asymmetricKeyDetails?.namedCurve];
-	const params = entry.resolve?.({
-		crv,
-		asymmetricKeyType
-	}) ?? entry.subtle;
-	return cached(keyObject, entry.alg, keyObject.toCryptoKey(params, isPublic, usages));
+const isCryptoKey = (key) => {
+	if (key?.[Symbol.toStringTag] === "CryptoKey") return !0;
+	try {
+		return key instanceof CryptoKey;
+	} catch {
+		return !1;
+	}
 };
-async function prepareKey(entry, key, usage) {
-	const tagged = checkKeyType(entry, key, usage);
-	switch (tagged[0]) {
-		case BYTES:
-		case CRYPTO: return tagged[1];
-		case JWK: {
-			const key = tagged[1];
-			if (key.k) return decode(key.k);
-			if (!Object.isFrozen(key)) {
-				const { key_ops } = key;
-				if (Array.isArray(key_ops)) Object.freeze(key_ops);
-				Object.freeze(key);
-			}
-			return handleJWK(key, key, entry);
-		}
-		case KEYOBJECT: {
-			const keyObject = tagged[1];
-			if (keyObject.type === "secret") return keyObject.export();
-			if ("toCryptoKey" in keyObject && typeof keyObject.toCryptoKey === "function") return handleKeyObject(keyObject, entry);
-			return handleJWK(keyObject, keyObject.export({ format: "jwk" }), entry);
-		}
+const isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+	if (types.length > 2) {
+		const last = types.pop();
+		msg += `one of type ${types.join(", ")}, or ${last}.`;
+	} else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+	return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+function invalidKeyType(alg, actual, secret) {
+	const types = [
+		"CryptoKey",
+		"KeyObject",
+		"JSON Web Key"
+	];
+	return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+const unusable = (name, prop = "algorithm.name") => /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+	const { modulusLength } = key.algorithm;
+	if (typeof modulusLength != "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+	const algorithm = key.algorithm;
+	if (algorithm.name !== expected.name) throw unusable(expected.name);
+	if (expected.hash && algorithm.hash?.name !== expected.hash) throw unusable(expected.hash, "algorithm.hash");
+	if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) throw unusable(expected.namedCurve, "algorithm.namedCurve");
+	if (expected.length !== void 0 && algorithm.length !== expected.length) throw unusable(expected.length, "algorithm.length");
+	checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+	return {
+		__proto__: null,
+		...jwk
+	};
+}
+function normalizeJwk(jwk) {
+	const normalized = snapshotJwk(jwk);
+	if (normalized.ext !== void 0 && typeof normalized.ext != "boolean") throw new TypeError("\"ext\" (Extractable) Parameter must be a boolean");
+	if (normalized.key_ops !== void 0) {
+		const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+		if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length) throw new TypeError("\"key_ops\" (Key Operations) Parameter must be an array of unique strings");
+		normalized.key_ops = keyOps;
 	}
+	return normalized;
+}
+async function jwkToKey(entry, jwk, extractable) {
+	if (!entry.kty.includes(jwk.kty)) throw new JOSENotSupported("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+	const algorithm = entry.resolve?.({
+		kty: jwk.kty,
+		crv: jwk.crv
+	}) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = {
+		...jwk,
+		ext: extractable ?? jwk.ext
+	};
+	return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = !1) {
+	return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
 }
 //#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/key_descriptor.js
+//#region ../node_modules/.bun/jose@6.2.12/node_modules/jose/dist/webapi/lib/key_descriptor.js
 function table(entries) {
 	const out = { __proto__: null };
 	for (const alg in entries) out[alg] = {
@@ -173,46 +138,7 @@ function table(entries) {
 	return out;
 }
 //#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/options.js
-const JWS_RECOGNIZED = {
-	__proto__: null,
-	b64: true
-};
-function validateCritDuplicates(Err, protectedHeader) {
-	const { crit } = protectedHeader ?? {};
-	if (Array.isArray(crit) && new Set(crit).size !== crit.length) throw new Err("\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values");
-}
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
-	if (!protectedHeader || protectedHeader.crit === void 0) return [];
-	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
-	const recognized = recognizedOption === void 0 ? recognizedDefault : {
-		__proto__: null,
-		...recognizedOption,
-		...recognizedDefault
-	};
-	for (const parameter of protectedHeader.crit) {
-		if (!(parameter in recognized)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-		if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-		if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0)) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-	}
-	return protectedHeader.crit;
-}
-//#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/signing.js
-async function getSigKey(entry, key, usage) {
-	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, entry.subtle, false, [usage]);
-	checkCryptoKey(key, entry.subtle, usage);
-	if (entry.minRsaBits) checkModulusLength(entry.alg, key);
-	return key;
-}
-async function sign(entry, key, data) {
-	const cryptoKey = await getSigKey(entry, key, "sign");
-	const signature = await crypto.subtle.sign(entry.signing, cryptoKey, data);
-	return new Uint8Array(signature);
-}
-//#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/jws_algorithms.js
+//#region ../node_modules/.bun/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_algorithms.js
 const sig = [["verify"], ["sign"]];
 function hmac(bits) {
 	const subtle = {
@@ -221,7 +147,7 @@ function hmac(bits) {
 	};
 	return {
 		kty: ["oct"],
-		secret: true,
+		secret: !0,
 		subtle,
 		signing: subtle,
 		usages: sig
@@ -297,12 +223,12 @@ const JWS = table({
 	"ML-DSA-87": mldsa(87)
 });
 function jwsAlgorithm(alg) {
-	const entry = typeof alg === "string" ? JWS[alg] : void 0;
+	const entry = typeof alg == "string" ? JWS[alg] : void 0;
 	if (!entry) throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
 	return entry;
 }
 //#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+//#region ../node_modules/.bun/jose@6.2.12/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
 const epoch = (date) => Math.floor(date.getTime() / 1e3);
 const multipliers = {
 	s: 1,
@@ -313,211 +239,128 @@ const multipliers = {
 	y: 31557600
 };
 const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+function invalidDuration() {
+	throw new TypeError("Invalid time period format");
+}
 function secs(str) {
+	typeof str != "string" && invalidDuration();
 	const matched = REGEX.exec(str);
-	if (!matched || matched[4] && matched[1]) throw new TypeError("Invalid time period format");
-	const value = parseFloat(matched[2]);
-	const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-	if (matched[1] === "-" || matched[4] === "ago") return -numericDate;
-	return numericDate;
+	(!matched || matched[4] && matched[1]) && invalidDuration();
+	const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+	return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
 }
 function validateInput(label, input) {
 	if (!Number.isFinite(input)) throw new TypeError(`Invalid ${label} input`);
 	return input;
 }
+function validateStringClaim(claim, value) {
+	if (typeof value != "string") throw new TypeError(`"${claim}" claim must be a string`);
+}
+function validateAudienceClaim(value) {
+	if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string"))) throw new TypeError("\"aud\" claim must be a string or an array of strings");
+}
 function numericDate(value, label) {
-	if (typeof value === "number") return validateInput(label, value);
-	if (value instanceof Date) return validateInput(label, epoch(value));
-	return epoch(/* @__PURE__ */ new Date()) + secs(value);
+	return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
+}
+let producerPayloads;
+function producerPayload(producer) {
+	return producerPayloads.get(producer);
+}
+function jwtData(producer) {
+	const payload = producerPayload(producer);
+	for (const claim of [
+		"iat",
+		"nbf",
+		"exp"
+	]) {
+		const value = payload[claim];
+		if (typeof value == "number" && !Number.isFinite(value)) throw new TypeError(`"${claim}" claim must be a finite number`);
+	}
+	return encoder.encode(JSON.stringify(payload));
 }
 var JWTClaimsBuilder = class {
-	#payload;
-	constructor(payload) {
+	constructor(payload = {}) {
 		if (!isObject(payload)) throw new TypeError("JWT Claims Set MUST be an object");
-		this.#payload = structuredClone(payload);
-	}
-	data() {
-		return encoder.encode(JSON.stringify(this.#payload));
+		(producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
 	}
-	get iss() {
-		return this.#payload.iss;
+	setIssuer(value) {
+		return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
 	}
-	set iss(value) {
-		this.#payload.iss = value;
+	setSubject(value) {
+		return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
 	}
-	get sub() {
-		return this.#payload.sub;
+	setAudience(value) {
+		return validateAudienceClaim(value), producerPayload(this).aud = value, this;
 	}
-	set sub(value) {
-		this.#payload.sub = value;
+	setJti(value) {
+		return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
 	}
-	get aud() {
-		return this.#payload.aud;
+	setNotBefore(value) {
+		return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
 	}
-	set aud(value) {
-		this.#payload.aud = value;
+	setExpirationTime(value) {
+		return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
 	}
-	set jti(value) {
-		this.#payload.jti = value;
-	}
-	set nbf(value) {
-		this.#payload.nbf = numericDate(value, "setNotBefore");
-	}
-	set exp(value) {
-		this.#payload.exp = numericDate(value, "setExpirationTime");
-	}
-	set iat(value) {
-		if (value === void 0) this.#payload.iat = epoch(/* @__PURE__ */ new Date());
-		else if (typeof value === "string") this.#payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value));
-		else this.#payload.iat = numericDate(value, "setIssuedAt");
+	setIssuedAt(value) {
+		const payload = producerPayload(this);
+		return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
 	}
 };
 //#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/lib/jws_sign.js
-function unencodedPayload(protectedHeader) {
-	return protectedHeader?.b64 === false && Array.isArray(protectedHeader.crit) && protectedHeader.crit.includes("b64");
-}
-async function createSignature(input, key) {
-	const { protectedHeader, unprotectedHeader } = input;
-	if (!protectedHeader && !unprotectedHeader) throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+//#region ../node_modules/.bun/jose@6.2.12/node_modules/jose/dist/webapi/lib/jws_sign.js
+async function createSignature(input, key, rejectUnencoded) {
+	let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
+	if (protectedHeader !== void 0) {
+		const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+		protectedHeader = normalized[0], protectedHeaderString = encode(normalized[1]);
+	}
+	if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader) throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
 	if (!isDisjoint(protectedHeader, unprotectedHeader)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
 	const joseHeader = {
 		...protectedHeader,
 		...unprotectedHeader
 	};
 	validateCritDuplicates(JWSInvalid, protectedHeader);
-	const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, input.crit, protectedHeader, joseHeader);
-	let b64 = true;
-	if (extensions.includes("b64")) {
-		b64 = protectedHeader.b64;
-		if (typeof b64 !== "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
-	}
+	const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+	b64 || rejectUnencoded?.();
 	const { alg } = joseHeader;
-	if (typeof alg !== "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
+	if (typeof alg != "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
 	const entry = jwsAlgorithm(alg);
-	let payloadS;
-	let payloadB;
+	let payloadS = "", payloadB = payload, data;
 	if (b64) {
-		const encoded = input.encoded ??= [];
-		encoded[0] ??= encode(input.payload);
-		encoded[1] ??= encode$1(encoded[0]);
-		payloadS = encoded[0];
-		payloadB = encoded[1];
-	} else {
-		payloadB = input.payload;
-		payloadS = "";
-	}
-	let protectedHeaderString;
-	let protectedHeaderBytes;
-	if (protectedHeader) {
-		protectedHeaderString = encode(JSON.stringify(protectedHeader));
-		protectedHeaderBytes = encode$1(protectedHeaderString);
-	} else {
-		protectedHeaderString = "";
-		protectedHeaderBytes = /* @__PURE__ */ new Uint8Array();
+		const encoded = input[4];
+		encoded ? (payloadS = encoded[0] ??= encode(payload), payloadB = encoded[1] ??= encode$1(payloadS)) : (payloadS = encode(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
 	}
-	const data = concat(protectedHeaderBytes, encode$1("."), payloadB);
+	data ??= concat(encode$1(protectedHeaderString), encode$1("."), payloadB);
+	const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
+	entry.minRsaBits && checkModulusLength(entry.alg, k);
 	const jws = {
-		signature: encode(await sign(entry, await prepareKey(entry, key, "sign"), data)),
+		signature: encode(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
 		payload: payloadS
 	};
-	if (protectedHeader) jws.protected = protectedHeaderString;
-	if (unprotectedHeader) jws.header = unprotectedHeader;
-	return jws;
+	return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
+}
+async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
+	const [jws] = await createSignature([
+		payload,
+		protectedHeader,
+		void 0,
+		crit
+	], key, rejectUnencoded);
+	return `${jws.protected}.${jws.payload}.${jws.signature}`;
 }
 //#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/jws/flattened/sign.js
-var FlattenedSign = class {
-	#payload;
-	#protectedHeader;
-	#unprotectedHeader;
-	constructor(payload) {
-		if (!(payload instanceof Uint8Array)) throw new TypeError("payload must be an instance of Uint8Array");
-		this.#payload = payload;
-	}
-	setProtectedHeader(protectedHeader) {
-		assertNotSet(this.#protectedHeader, "setProtectedHeader");
-		this.#protectedHeader = protectedHeader;
-		return this;
-	}
-	setUnprotectedHeader(unprotectedHeader) {
-		assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader");
-		this.#unprotectedHeader = unprotectedHeader;
-		return this;
-	}
-	async sign(key, options) {
-		return createSignature({
-			payload: this.#payload,
-			protectedHeader: this.#protectedHeader,
-			unprotectedHeader: this.#unprotectedHeader,
-			crit: options?.crit
-		}, key);
-	}
-};
-//#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/jws/compact/sign.js
-var CompactSign = class {
-	#flattened;
-	#protectedHeader;
-	constructor(payload) {
-		this.#flattened = new FlattenedSign(payload);
-	}
-	setProtectedHeader(protectedHeader) {
-		this.#flattened.setProtectedHeader(protectedHeader);
-		this.#protectedHeader = protectedHeader;
-		return this;
-	}
-	async sign(key, options) {
-		if (unencodedPayload(this.#protectedHeader)) throw new TypeError("use the flattened module for creating JWS with b64: false");
-		const jws = await this.#flattened.sign(key, options);
-		return `${jws.protected}.${jws.payload}.${jws.signature}`;
-	}
-};
-//#endregion
-//#region node_modules/.deno/jose@6.2.9/node_modules/jose/dist/webapi/jwt/sign.js
-var SignJWT = class {
+//#region ../node_modules/.bun/jose@6.2.12/node_modules/jose/dist/webapi/jwt/sign.js
+const SignJWT_base = JWTClaimsBuilder;
+var SignJWT = class extends SignJWT_base {
 	#protectedHeader;
-	#jwt;
-	constructor(payload = {}) {
-		this.#jwt = new JWTClaimsBuilder(payload);
-	}
-	setIssuer(issuer) {
-		this.#jwt.iss = issuer;
-		return this;
-	}
-	setSubject(subject) {
-		this.#jwt.sub = subject;
-		return this;
-	}
-	setAudience(audience) {
-		this.#jwt.aud = audience;
-		return this;
-	}
-	setJti(jwtId) {
-		this.#jwt.jti = jwtId;
-		return this;
-	}
-	setNotBefore(input) {
-		this.#jwt.nbf = input;
-		return this;
-	}
-	setExpirationTime(input) {
-		this.#jwt.exp = input;
-		return this;
-	}
-	setIssuedAt(input) {
-		this.#jwt.iat = input;
-		return this;
-	}
 	setProtectedHeader(protectedHeader) {
-		this.#protectedHeader = protectedHeader;
-		return this;
+		return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
 	}
 	async sign(key, options) {
-		const sig = new CompactSign(this.#jwt.data());
-		sig.setProtectedHeader(this.#protectedHeader);
-		if (unencodedPayload(this.#protectedHeader)) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-		return sig.sign(key, options);
+		return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
+			throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+		});
 	}
 };
 //#endregion