@atproto/jwk 0.6.0 → 0.7.0

package/dist/jwks.js

@@ -1,20 +1,17 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.jwksPubSchema = exports.jwksSchema = void 0;
-const zod_1 = require("zod");
-const jwk_js_1 = require("./jwk.js");
+import { z } from 'zod';
+import { jwkPubSchema, jwkSchema } from './jwk.js';
 /**
  * JSON Web Key Set schema. The keys set, in this context, represents a
  * collection of JSON Web Keys (JWKs), that can be both public and private.
  */
-exports.jwksSchema = zod_1.z.object({
-    keys: zod_1.z.array(zod_1.z.unknown()).transform((input) => {
+export const jwksSchema = z.object({
+    keys: z.array(z.unknown()).transform((input) => {
         // > Implementations SHOULD ignore JWKs within a JWK Set that use "kty"
         // > (key type) values that are not understood by them, that are missing
         // > required members, or for which values are out of the supported
         // > ranges.
         return input
-            .map((item) => jwk_js_1.jwkSchema.safeParse(item))
+            .map((item) => jwkSchema.safeParse(item))
             .filter((res) => res.success)
             .map((res) => res.data);
     }),
@@ -22,14 +19,14 @@ exports.jwksSchema = zod_1.z.object({
 /**
  * Public JSON Web Key Set schema.
  */
-exports.jwksPubSchema = zod_1.z.object({
-    keys: zod_1.z.array(zod_1.z.unknown()).transform((input) => {
+export const jwksPubSchema = z.object({
+    keys: z.array(z.unknown()).transform((input) => {
         // > Implementations SHOULD ignore JWKs within a JWK Set that use "kty"
         // > (key type) values that are not understood by them, that are missing
         // > required members, or for which values are out of the supported
         // > ranges.
         return input
-            .map((item) => jwk_js_1.jwkPubSchema.safeParse(item))
+            .map((item) => jwkPubSchema.safeParse(item))
             .filter((res) => res.success)
             .map((res) => res.data);
     }),

package/dist/jwks.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,qCAAkD;AAElD;;;GAGG;AACU,QAAA,UAAU,GAAG,OAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,YAAY;QACZ,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;aACxC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;aAC5B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC;CACH,CAAC,CAAA;AAIF;;GAEG;AACU,QAAA,aAAa,GAAG,OAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,YAAY;QACZ,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;aAC3C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;aAC5B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC;CACH,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { jwkPubSchema, jwkSchema } from './jwk.js'\n\n/**\n * JSON Web Key Set schema. The keys set, in this context, represents a\n * collection of JSON Web Keys (JWKs), that can be both public and private.\n */\nexport const jwksSchema = z.object({\n  keys: z.array(z.unknown()).transform((input) => {\n    // > Implementations SHOULD ignore JWKs within a JWK Set that use \"kty\"\n    // > (key type) values that are not understood by them, that are missing\n    // > required members, or for which values are out of the supported\n    // > ranges.\n    return input\n      .map((item) => jwkSchema.safeParse(item))\n      .filter((res) => res.success)\n      .map((res) => res.data)\n  }),\n})\n\nexport type Jwks = z.output<typeof jwksSchema>\n\n/**\n * Public JSON Web Key Set schema.\n */\nexport const jwksPubSchema = z.object({\n  keys: z.array(z.unknown()).transform((input) => {\n    // > Implementations SHOULD ignore JWKs within a JWK Set that use \"kty\"\n    // > (key type) values that are not understood by them, that are missing\n    // > required members, or for which values are out of the supported\n    // > ranges.\n    return input\n      .map((item) => jwkPubSchema.safeParse(item))\n      .filter((res) => res.success)\n      .map((res) => res.data)\n  }),\n})\n\nexport type JwksPub = z.output<typeof jwksPubSchema>\n"]}
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,YAAY;QACZ,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;aACxC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;aAC5B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC;CACH,CAAC,CAAA;AAIF;;GAEG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7C,uEAAuE;QACvE,wEAAwE;QACxE,mEAAmE;QACnE,YAAY;QACZ,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;aAC3C,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;aAC5B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC;CACH,CAAC,CAAA","sourcesContent":["import { z } from 'zod'\nimport { jwkPubSchema, jwkSchema } from './jwk.js'\n\n/**\n * JSON Web Key Set schema. The keys set, in this context, represents a\n * collection of JSON Web Keys (JWKs), that can be both public and private.\n */\nexport const jwksSchema = z.object({\n  keys: z.array(z.unknown()).transform((input) => {\n    // > Implementations SHOULD ignore JWKs within a JWK Set that use \"kty\"\n    // > (key type) values that are not understood by them, that are missing\n    // > required members, or for which values are out of the supported\n    // > ranges.\n    return input\n      .map((item) => jwkSchema.safeParse(item))\n      .filter((res) => res.success)\n      .map((res) => res.data)\n  }),\n})\n\nexport type Jwks = z.output<typeof jwksSchema>\n\n/**\n * Public JSON Web Key Set schema.\n */\nexport const jwksPubSchema = z.object({\n  keys: z.array(z.unknown()).transform((input) => {\n    // > Implementations SHOULD ignore JWKs within a JWK Set that use \"kty\"\n    // > (key type) values that are not understood by them, that are missing\n    // > required members, or for which values are out of the supported\n    // > ranges.\n    return input\n      .map((item) => jwkPubSchema.safeParse(item))\n      .filter((res) => res.success)\n      .map((res) => res.data)\n  }),\n})\n\nexport type JwksPub = z.output<typeof jwksPubSchema>\n"]}

package/dist/jwt-decode.js

@@ -1,19 +1,16 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.unsafeDecodeJwt = unsafeDecodeJwt;
-const errors_js_1 = require("./errors.js");
-const jwt_js_1 = require("./jwt.js");
-const util_js_1 = require("./util.js");
-function unsafeDecodeJwt(jwt) {
+import { ERR_JWT_INVALID, JwtVerifyError } from './errors.js';
+import { jwtHeaderSchema, jwtPayloadSchema, } from './jwt.js';
+import { parseB64uJson } from './util.js';
+export function unsafeDecodeJwt(jwt) {
     const { 0: headerEnc, 1: payloadEnc, length } = jwt.split('.');
     if (length > 3 || length < 2) {
-        throw new errors_js_1.JwtVerifyError(undefined, errors_js_1.ERR_JWT_INVALID);
+        throw new JwtVerifyError(undefined, ERR_JWT_INVALID);
     }
-    const header = jwt_js_1.jwtHeaderSchema.parse((0, util_js_1.parseB64uJson)(headerEnc));
+    const header = jwtHeaderSchema.parse(parseB64uJson(headerEnc));
     if (length === 2 && header?.alg !== 'none') {
-        throw new errors_js_1.JwtVerifyError(undefined, errors_js_1.ERR_JWT_INVALID);
+        throw new JwtVerifyError(undefined, ERR_JWT_INVALID);
     }
-    const payload = jwt_js_1.jwtPayloadSchema.parse((0, util_js_1.parseB64uJson)(payloadEnc));
+    const payload = jwtPayloadSchema.parse(parseB64uJson(payloadEnc));
     return { header, payload };
 }
 //# sourceMappingURL=jwt-decode.js.map

package/dist/jwt-decode.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-decode.js","sourceRoot":"","sources":["../src/jwt-decode.ts"],"names":[],"mappings":";;AASA,0CAiBC;AA1BD,2CAA6D;AAC7D,qCAKiB;AACjB,uCAAyC;AAEzC,SAAgB,eAAe,CAAC,GAAW;IAIzC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9D,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,0BAAc,CAAC,SAAS,EAAE,2BAAe,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,wBAAe,CAAC,KAAK,CAAC,IAAA,uBAAa,EAAC,SAAU,CAAC,CAAC,CAAA;IAC/D,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,0BAAc,CAAC,SAAS,EAAE,2BAAe,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,OAAO,GAAG,yBAAgB,CAAC,KAAK,CAAC,IAAA,uBAAa,EAAC,UAAW,CAAC,CAAC,CAAA;IAElE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC5B,CAAC","sourcesContent":["import { ERR_JWT_INVALID, JwtVerifyError } from './errors.js'\nimport {\n  JwtHeader,\n  JwtPayload,\n  jwtHeaderSchema,\n  jwtPayloadSchema,\n} from './jwt.js'\nimport { parseB64uJson } from './util.js'\n\nexport function unsafeDecodeJwt(jwt: string): {\n  header: JwtHeader\n  payload: JwtPayload\n} {\n  const { 0: headerEnc, 1: payloadEnc, length } = jwt.split('.')\n  if (length > 3 || length < 2) {\n    throw new JwtVerifyError(undefined, ERR_JWT_INVALID)\n  }\n\n  const header = jwtHeaderSchema.parse(parseB64uJson(headerEnc!))\n  if (length === 2 && header?.alg !== 'none') {\n    throw new JwtVerifyError(undefined, ERR_JWT_INVALID)\n  }\n\n  const payload = jwtPayloadSchema.parse(parseB64uJson(payloadEnc!))\n\n  return { header, payload }\n}\n"]}
+{"version":3,"file":"jwt-decode.js","sourceRoot":"","sources":["../src/jwt-decode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC7D,OAAO,EAGL,eAAe,EACf,gBAAgB,GACjB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAEzC,MAAM,UAAU,eAAe,CAAC,GAAW;IAIzC,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9D,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,SAAU,CAAC,CAAC,CAAA;IAC/D,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,EAAE,GAAG,KAAK,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC,UAAW,CAAC,CAAC,CAAA;IAElE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AAC5B,CAAC","sourcesContent":["import { ERR_JWT_INVALID, JwtVerifyError } from './errors.js'\nimport {\n  JwtHeader,\n  JwtPayload,\n  jwtHeaderSchema,\n  jwtPayloadSchema,\n} from './jwt.js'\nimport { parseB64uJson } from './util.js'\n\nexport function unsafeDecodeJwt(jwt: string): {\n  header: JwtHeader\n  payload: JwtPayload\n} {\n  const { 0: headerEnc, 1: payloadEnc, length } = jwt.split('.')\n  if (length > 3 || length < 2) {\n    throw new JwtVerifyError(undefined, ERR_JWT_INVALID)\n  }\n\n  const header = jwtHeaderSchema.parse(parseB64uJson(headerEnc!))\n  if (length === 2 && header?.alg !== 'none') {\n    throw new JwtVerifyError(undefined, ERR_JWT_INVALID)\n  }\n\n  const payload = jwtPayloadSchema.parse(parseB64uJson(payloadEnc!))\n\n  return { header, payload }\n}\n"]}

package/dist/jwt-verify.js

@@ -1,3 +1,2 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
+export {};
 //# sourceMappingURL=jwt-verify.js.map

package/dist/jwt.js

@@ -1,191 +1,186 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.jwtPayloadSchema = exports.htuSchema = exports.jwtHeaderSchema = exports.isUnsignedJwt = exports.unsignedJwtSchema = exports.isSignedJwt = exports.signedJwtSchema = void 0;
-const zod_1 = require("zod");
-const jwk_js_1 = require("./jwk.js");
-const util_js_1 = require("./util.js");
-exports.signedJwtSchema = zod_1.z
+import { z } from 'zod';
+import { jwkPubSchema } from './jwk.js';
+import { jwtCharsRefinement, segmentedStringRefinementFactory } from './util.js';
+export const signedJwtSchema = z
     .string()
-    .superRefine(util_js_1.jwtCharsRefinement)
-    .superRefine((0, util_js_1.segmentedStringRefinementFactory)(3));
-const isSignedJwt = (data) => exports.signedJwtSchema.safeParse(data).success;
-exports.isSignedJwt = isSignedJwt;
-exports.unsignedJwtSchema = zod_1.z
+    .superRefine(jwtCharsRefinement)
+    .superRefine(segmentedStringRefinementFactory(3));
+export const isSignedJwt = (data) => signedJwtSchema.safeParse(data).success;
+export const unsignedJwtSchema = z
     .string()
-    .superRefine(util_js_1.jwtCharsRefinement)
-    .superRefine((0, util_js_1.segmentedStringRefinementFactory)(2));
-const isUnsignedJwt = (data) => exports.unsignedJwtSchema.safeParse(data).success;
-exports.isUnsignedJwt = isUnsignedJwt;
+    .superRefine(jwtCharsRefinement)
+    .superRefine(segmentedStringRefinementFactory(2));
+export const isUnsignedJwt = (data) => unsignedJwtSchema.safeParse(data).success;
 /**
  * @see {@link https://www.rfc-editor.org/rfc/rfc7515.html#section-4}
  */
-exports.jwtHeaderSchema = zod_1.z
+export const jwtHeaderSchema = z
     .object({
     /** "alg" (Algorithm) Header Parameter */
-    alg: zod_1.z.string(),
+    alg: z.string(),
     /** "jku" (JWK Set URL) Header Parameter */
-    jku: zod_1.z.string().url().optional(),
+    jku: z.string().url().optional(),
     /** "jwk" (JSON Web Key) Header Parameter */
-    jwk: zod_1.z
+    jwk: z
         .object({
-        kty: zod_1.z.string(),
-        crv: zod_1.z.string().optional(),
-        x: zod_1.z.string().optional(),
-        y: zod_1.z.string().optional(),
-        e: zod_1.z.string().optional(),
-        n: zod_1.z.string().optional(),
+        kty: z.string(),
+        crv: z.string().optional(),
+        x: z.string().optional(),
+        y: z.string().optional(),
+        e: z.string().optional(),
+        n: z.string().optional(),
     })
         .optional(),
     /** "kid" (Key ID) Header Parameter */
-    kid: zod_1.z.string().optional(),
+    kid: z.string().optional(),
     /** "x5u" (X.509 URL) Header Parameter */
-    x5u: zod_1.z.string().optional(),
+    x5u: z.string().optional(),
     /** "x5c" (X.509 Certificate Chain) Header Parameter */
-    x5c: zod_1.z.array(zod_1.z.string()).optional(),
+    x5c: z.array(z.string()).optional(),
     /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
-    x5t: zod_1.z.string().optional(),
+    x5t: z.string().optional(),
     /** "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Header Parameter */
-    'x5t#S256': zod_1.z.string().optional(),
+    'x5t#S256': z.string().optional(),
     /** "typ" (Type) Header Parameter */
-    typ: zod_1.z.string().optional(),
+    typ: z.string().optional(),
     /** "cty" (Content Type) Header Parameter */
-    cty: zod_1.z.string().optional(),
+    cty: z.string().optional(),
     /** "crit" (Critical) Header Parameter */
-    crit: zod_1.z.array(zod_1.z.string()).optional(),
+    crit: z.array(z.string()).optional(),
 })
     .passthrough();
 /**
  * @see {@link https://www.rfc-editor.org/rfc/rfc9449.html#section-4.2-4.6}
  * @see {@link https://www.rfc-editor.org/rfc/rfc9110#section-7.1}
  */
-exports.htuSchema = zod_1.z.string().superRefine((value, ctx) => {
+export const htuSchema = z.string().superRefine((value, ctx) => {
     try {
         const url = new URL(value);
         if (url.protocol !== 'http:' && url.protocol !== 'https:') {
             ctx.addIssue({
-                code: zod_1.z.ZodIssueCode.custom,
+                code: z.ZodIssueCode.custom,
                 message: 'Only http: and https: protocols are allowed',
             });
         }
         if (url.username || url.password) {
             ctx.addIssue({
-                code: zod_1.z.ZodIssueCode.custom,
+                code: z.ZodIssueCode.custom,
                 message: 'Credentials not allowed',
             });
         }
         if (url.search) {
             ctx.addIssue({
-                code: zod_1.z.ZodIssueCode.custom,
+                code: z.ZodIssueCode.custom,
                 message: 'Query string not allowed',
             });
         }
         if (url.hash) {
             ctx.addIssue({
-                code: zod_1.z.ZodIssueCode.custom,
+                code: z.ZodIssueCode.custom,
                 message: 'Fragment not allowed',
             });
         }
     }
     catch (err) {
         ctx.addIssue({
-            code: zod_1.z.ZodIssueCode.invalid_string,
+            code: z.ZodIssueCode.invalid_string,
             validation: 'url',
         });
     }
     return value;
 });
 // https://www.iana.org/assignments/jwt/jwt.xhtml
-exports.jwtPayloadSchema = zod_1.z
+export const jwtPayloadSchema = z
     .object({
-    iss: zod_1.z.string().optional(),
-    aud: zod_1.z.union([zod_1.z.string(), zod_1.z.array(zod_1.z.string()).nonempty()]).optional(),
-    sub: zod_1.z.string().optional(),
-    exp: zod_1.z.number().int().optional(),
-    nbf: zod_1.z.number().int().optional(),
-    iat: zod_1.z.number().int().optional(),
-    jti: zod_1.z.string().optional(),
-    htm: zod_1.z.string().optional(),
-    htu: exports.htuSchema.optional(),
-    ath: zod_1.z.string().optional(),
-    acr: zod_1.z.string().optional(),
-    azp: zod_1.z.string().optional(),
-    amr: zod_1.z.array(zod_1.z.string()).optional(),
+    iss: z.string().optional(),
+    aud: z.union([z.string(), z.array(z.string()).nonempty()]).optional(),
+    sub: z.string().optional(),
+    exp: z.number().int().optional(),
+    nbf: z.number().int().optional(),
+    iat: z.number().int().optional(),
+    jti: z.string().optional(),
+    htm: z.string().optional(),
+    htu: htuSchema.optional(),
+    ath: z.string().optional(),
+    acr: z.string().optional(),
+    azp: z.string().optional(),
+    amr: z.array(z.string()).optional(),
     // https://datatracker.ietf.org/doc/html/rfc7800
-    cnf: zod_1.z
+    cnf: z
         .object({
-        kid: zod_1.z.string().optional(), // Key ID
-        jwk: jwk_js_1.jwkPubSchema.optional(), // JWK
-        jwe: zod_1.z.string().optional(), // Encrypted key
-        jku: zod_1.z.string().url().optional(), // JWK Set URI ("kid" should also be provided)
+        kid: z.string().optional(), // Key ID
+        jwk: jwkPubSchema.optional(), // JWK
+        jwe: z.string().optional(), // Encrypted key
+        jku: z.string().url().optional(), // JWK Set URI ("kid" should also be provided)
         // https://datatracker.ietf.org/doc/html/rfc9449#section-6.1
-        jkt: zod_1.z.string().optional(),
+        jkt: z.string().optional(),
         // https://datatracker.ietf.org/doc/html/rfc8705
-        'x5t#S256': zod_1.z.string().optional(), // X.509 Certificate SHA-256 Thumbprint
+        'x5t#S256': z.string().optional(), // X.509 Certificate SHA-256 Thumbprint
         // https://datatracker.ietf.org/doc/html/rfc9203
-        osc: zod_1.z.string().optional(), // OSCORE_Input_Material carrying the parameters for using OSCORE per-message security with implicit key confirmation
+        osc: z.string().optional(), // OSCORE_Input_Material carrying the parameters for using OSCORE per-message security with implicit key confirmation
     })
         .optional(),
-    client_id: zod_1.z.string().optional(),
-    scope: zod_1.z.string().optional(),
-    nonce: zod_1.z.string().optional(),
-    at_hash: zod_1.z.string().optional(),
-    c_hash: zod_1.z.string().optional(),
-    s_hash: zod_1.z.string().optional(),
-    auth_time: zod_1.z.number().int().optional(),
+    client_id: z.string().optional(),
+    scope: z.string().optional(),
+    nonce: z.string().optional(),
+    at_hash: z.string().optional(),
+    c_hash: z.string().optional(),
+    s_hash: z.string().optional(),
+    auth_time: z.number().int().optional(),
     // https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
     // OpenID: "profile" scope
-    name: zod_1.z.string().optional(),
-    family_name: zod_1.z.string().optional(),
-    given_name: zod_1.z.string().optional(),
-    middle_name: zod_1.z.string().optional(),
-    nickname: zod_1.z.string().optional(),
-    preferred_username: zod_1.z.string().optional(),
-    gender: zod_1.z.string().optional(), // OpenID only defines "male" and "female" without forbidding other values
-    picture: zod_1.z.string().url().optional(),
-    profile: zod_1.z.string().url().optional(),
-    website: zod_1.z.string().url().optional(),
-    birthdate: zod_1.z
+    name: z.string().optional(),
+    family_name: z.string().optional(),
+    given_name: z.string().optional(),
+    middle_name: z.string().optional(),
+    nickname: z.string().optional(),
+    preferred_username: z.string().optional(),
+    gender: z.string().optional(), // OpenID only defines "male" and "female" without forbidding other values
+    picture: z.string().url().optional(),
+    profile: z.string().url().optional(),
+    website: z.string().url().optional(),
+    birthdate: z
         .string()
         .regex(/\d{4}-\d{2}-\d{2}/) // YYYY-MM-DD
         .optional(),
-    zoneinfo: zod_1.z
+    zoneinfo: z
         .string()
         .regex(/^[A-Za-z0-9_/]+$/)
         .optional(),
-    locale: zod_1.z
+    locale: z
         .string()
         .regex(/^[a-z]{2,3}(-[A-Z]{2})?$/)
         .optional(),
-    updated_at: zod_1.z.number().int().optional(),
+    updated_at: z.number().int().optional(),
     // OpenID: "email" scope
-    email: zod_1.z.string().optional(),
-    email_verified: zod_1.z.boolean().optional(),
+    email: z.string().optional(),
+    email_verified: z.boolean().optional(),
     // OpenID: "phone" scope
-    phone_number: zod_1.z.string().optional(),
-    phone_number_verified: zod_1.z.boolean().optional(),
+    phone_number: z.string().optional(),
+    phone_number_verified: z.boolean().optional(),
     // OpenID: "address" scope
     // https://openid.net/specs/openid-connect-core-1_0.html#AddressClaim
-    address: zod_1.z
+    address: z
         .object({
-        formatted: zod_1.z.string().optional(),
-        street_address: zod_1.z.string().optional(),
-        locality: zod_1.z.string().optional(),
-        region: zod_1.z.string().optional(),
-        postal_code: zod_1.z.string().optional(),
-        country: zod_1.z.string().optional(),
+        formatted: z.string().optional(),
+        street_address: z.string().optional(),
+        locality: z.string().optional(),
+        region: z.string().optional(),
+        postal_code: z.string().optional(),
+        country: z.string().optional(),
     })
         .optional(),
     // https://datatracker.ietf.org/doc/html/rfc9396#section-14.2
-    authorization_details: zod_1.z
-        .array(zod_1.z
+    authorization_details: z
+        .array(z
         .object({
-        type: zod_1.z.string(),
+        type: z.string(),
         // https://datatracker.ietf.org/doc/html/rfc9396#section-2.2
-        locations: zod_1.z.array(zod_1.z.string()).optional(),
-        actions: zod_1.z.array(zod_1.z.string()).optional(),
-        datatypes: zod_1.z.array(zod_1.z.string()).optional(),
-        identifier: zod_1.z.string().optional(),
-        privileges: zod_1.z.array(zod_1.z.string()).optional(),
+        locations: z.array(z.string()).optional(),
+        actions: z.array(z.string()).optional(),
+        datatypes: z.array(z.string()).optional(),
+        identifier: z.string().optional(),
+        privileges: z.array(z.string()).optional(),
     })
         .passthrough())
         .optional(),

package/dist/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AACvB,qCAAuC;AACvC,uCAAgF;AAEnE,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,EAAE;KACR,WAAW,CAAC,4BAAkB,CAAC;KAC/B,WAAW,CAAC,IAAA,0CAAgC,EAAC,CAAC,CAAC,CAAC,CAAA;AAG5C,MAAM,WAAW,GAAG,CAAC,IAAa,EAAqB,EAAE,CAC9D,uBAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAD5B,QAAA,WAAW,eACiB;AAE5B,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,EAAE;KACR,WAAW,CAAC,4BAAkB,CAAC;KAC/B,WAAW,CAAC,IAAA,0CAAgC,EAAC,CAAC,CAAC,CAAC,CAAA;AAG5C,MAAM,aAAa,GAAG,CAAC,IAAa,EAAuB,EAAE,CAClE,yBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAD9B,QAAA,aAAa,iBACiB;AAE3C;;GAEG;AACU,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,yCAAyC;IACzC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE;IACf,2CAA2C;IAC3C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,4CAA4C;IAC5C,GAAG,EAAE,OAAC;SACH,MAAM,CAAC;QACN,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE;QACf,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxB,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxB,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxB,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzB,CAAC;SACD,QAAQ,EAAE;IACb,sCAAsC;IACtC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,yCAAyC;IACzC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uDAAuD;IACvD,GAAG,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnC,kEAAkE;IAClE,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,yEAAyE;IACzE,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,oCAAoC;IACpC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,4CAA4C;IAC5C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,yCAAyC;IACzC,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,WAAW,EAAE,CAAA;AAIhB;;;GAGG;AACU,QAAA,SAAS,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,yBAAyB;aACnC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,0BAA0B;aACpC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,sBAAsB;aAChC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,cAAc;YACnC,UAAU,EAAE,KAAK;SAClB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAA;AAEF,iDAAiD;AACpC,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrE,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,iBAAS,CAAC,QAAQ,EAAE;IACzB,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnC,gDAAgD;IAChD,GAAG,EAAE,OAAC;SACH,MAAM,CAAC;QACN,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS;QACrC,GAAG,EAAE,qBAAY,CAAC,QAAQ,EAAE,EAAE,MAAM;QACpC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,gBAAgB;QAC5C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,8CAA8C;QAEhF,4DAA4D;QAC5D,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAE1B,gDAAgD;QAChD,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uCAAuC;QAE1E,gDAAgD;QAChD,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qHAAqH;KAClJ,CAAC;SACD,QAAQ,EAAE;IAEb,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5B,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,uEAAuE;IAEvE,0BAA0B;IAC1B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,0EAA0E;IACzG,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,CAAC,CAAC,aAAa;SACxC,QAAQ,EAAE;IACb,QAAQ,EAAE,OAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,kBAAkB,CAAC;SACzB,QAAQ,EAAE;IACb,MAAM,EAAE,OAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,0BAA0B,CAAC;SACjC,QAAQ,EAAE;IACb,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEvC,wBAAwB;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,wBAAwB;IACxB,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,qBAAqB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,0BAA0B;IAC1B,qEAAqE;IACrE,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC;SACD,QAAQ,EAAE;IAEb,6DAA6D;IAC7D,qBAAqB,EAAE,OAAC;SACrB,KAAK,CACJ,OAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE;QAChB,4DAA4D;QAC5D,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzC,OAAO,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvC,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC;SACD,WAAW,EAAE,CACjB;SACA,QAAQ,EAAE;CACd,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { jwkPubSchema } from './jwk.js'\nimport { jwtCharsRefinement, segmentedStringRefinementFactory } from './util.js'\n\nexport const signedJwtSchema = z\n  .string()\n  .superRefine(jwtCharsRefinement)\n  .superRefine(segmentedStringRefinementFactory(3))\n\nexport type SignedJwt = z.infer<typeof signedJwtSchema>\nexport const isSignedJwt = (data: unknown): data is SignedJwt =>\n  signedJwtSchema.safeParse(data).success\n\nexport const unsignedJwtSchema = z\n  .string()\n  .superRefine(jwtCharsRefinement)\n  .superRefine(segmentedStringRefinementFactory(2))\n\nexport type UnsignedJwt = z.infer<typeof unsignedJwtSchema>\nexport const isUnsignedJwt = (data: unknown): data is UnsignedJwt =>\n  unsignedJwtSchema.safeParse(data).success\n\n/**\n * @see {@link https://www.rfc-editor.org/rfc/rfc7515.html#section-4}\n */\nexport const jwtHeaderSchema = z\n  .object({\n    /** \"alg\" (Algorithm) Header Parameter */\n    alg: z.string(),\n    /** \"jku\" (JWK Set URL) Header Parameter */\n    jku: z.string().url().optional(),\n    /** \"jwk\" (JSON Web Key) Header Parameter */\n    jwk: z\n      .object({\n        kty: z.string(),\n        crv: z.string().optional(),\n        x: z.string().optional(),\n        y: z.string().optional(),\n        e: z.string().optional(),\n        n: z.string().optional(),\n      })\n      .optional(),\n    /** \"kid\" (Key ID) Header Parameter */\n    kid: z.string().optional(),\n    /** \"x5u\" (X.509 URL) Header Parameter */\n    x5u: z.string().optional(),\n    /** \"x5c\" (X.509 Certificate Chain) Header Parameter */\n    x5c: z.array(z.string()).optional(),\n    /** \"x5t\" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */\n    x5t: z.string().optional(),\n    /** \"x5t#S256\" (X.509 Certificate SHA-256 Thumbprint) Header Parameter */\n    'x5t#S256': z.string().optional(),\n    /** \"typ\" (Type) Header Parameter */\n    typ: z.string().optional(),\n    /** \"cty\" (Content Type) Header Parameter */\n    cty: z.string().optional(),\n    /** \"crit\" (Critical) Header Parameter */\n    crit: z.array(z.string()).optional(),\n  })\n  .passthrough()\n\nexport type JwtHeader = z.infer<typeof jwtHeaderSchema>\n\n/**\n * @see {@link https://www.rfc-editor.org/rfc/rfc9449.html#section-4.2-4.6}\n * @see {@link https://www.rfc-editor.org/rfc/rfc9110#section-7.1}\n */\nexport const htuSchema = z.string().superRefine((value, ctx) => {\n  try {\n    const url = new URL(value)\n    if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'Only http: and https: protocols are allowed',\n      })\n    }\n\n    if (url.username || url.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'Credentials not allowed',\n      })\n    }\n\n    if (url.search) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'Query string not allowed',\n      })\n    }\n\n    if (url.hash) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'Fragment not allowed',\n      })\n    }\n  } catch (err) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.invalid_string,\n      validation: 'url',\n    })\n  }\n\n  return value\n})\n\n// https://www.iana.org/assignments/jwt/jwt.xhtml\nexport const jwtPayloadSchema = z\n  .object({\n    iss: z.string().optional(),\n    aud: z.union([z.string(), z.array(z.string()).nonempty()]).optional(),\n    sub: z.string().optional(),\n    exp: z.number().int().optional(),\n    nbf: z.number().int().optional(),\n    iat: z.number().int().optional(),\n    jti: z.string().optional(),\n    htm: z.string().optional(),\n    htu: htuSchema.optional(),\n    ath: z.string().optional(),\n    acr: z.string().optional(),\n    azp: z.string().optional(),\n    amr: z.array(z.string()).optional(),\n    // https://datatracker.ietf.org/doc/html/rfc7800\n    cnf: z\n      .object({\n        kid: z.string().optional(), // Key ID\n        jwk: jwkPubSchema.optional(), // JWK\n        jwe: z.string().optional(), // Encrypted key\n        jku: z.string().url().optional(), // JWK Set URI (\"kid\" should also be provided)\n\n        // https://datatracker.ietf.org/doc/html/rfc9449#section-6.1\n        jkt: z.string().optional(),\n\n        // https://datatracker.ietf.org/doc/html/rfc8705\n        'x5t#S256': z.string().optional(), // X.509 Certificate SHA-256 Thumbprint\n\n        // https://datatracker.ietf.org/doc/html/rfc9203\n        osc: z.string().optional(), // OSCORE_Input_Material carrying the parameters for using OSCORE per-message security with implicit key confirmation\n      })\n      .optional(),\n\n    client_id: z.string().optional(),\n\n    scope: z.string().optional(),\n    nonce: z.string().optional(),\n\n    at_hash: z.string().optional(),\n    c_hash: z.string().optional(),\n    s_hash: z.string().optional(),\n    auth_time: z.number().int().optional(),\n\n    // https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\n\n    // OpenID: \"profile\" scope\n    name: z.string().optional(),\n    family_name: z.string().optional(),\n    given_name: z.string().optional(),\n    middle_name: z.string().optional(),\n    nickname: z.string().optional(),\n    preferred_username: z.string().optional(),\n    gender: z.string().optional(), // OpenID only defines \"male\" and \"female\" without forbidding other values\n    picture: z.string().url().optional(),\n    profile: z.string().url().optional(),\n    website: z.string().url().optional(),\n    birthdate: z\n      .string()\n      .regex(/\\d{4}-\\d{2}-\\d{2}/) // YYYY-MM-DD\n      .optional(),\n    zoneinfo: z\n      .string()\n      .regex(/^[A-Za-z0-9_/]+$/)\n      .optional(),\n    locale: z\n      .string()\n      .regex(/^[a-z]{2,3}(-[A-Z]{2})?$/)\n      .optional(),\n    updated_at: z.number().int().optional(),\n\n    // OpenID: \"email\" scope\n    email: z.string().optional(),\n    email_verified: z.boolean().optional(),\n\n    // OpenID: \"phone\" scope\n    phone_number: z.string().optional(),\n    phone_number_verified: z.boolean().optional(),\n\n    // OpenID: \"address\" scope\n    // https://openid.net/specs/openid-connect-core-1_0.html#AddressClaim\n    address: z\n      .object({\n        formatted: z.string().optional(),\n        street_address: z.string().optional(),\n        locality: z.string().optional(),\n        region: z.string().optional(),\n        postal_code: z.string().optional(),\n        country: z.string().optional(),\n      })\n      .optional(),\n\n    // https://datatracker.ietf.org/doc/html/rfc9396#section-14.2\n    authorization_details: z\n      .array(\n        z\n          .object({\n            type: z.string(),\n            // https://datatracker.ietf.org/doc/html/rfc9396#section-2.2\n            locations: z.array(z.string()).optional(),\n            actions: z.array(z.string()).optional(),\n            datatypes: z.array(z.string()).optional(),\n            identifier: z.string().optional(),\n            privileges: z.array(z.string()).optional(),\n          })\n          .passthrough(),\n      )\n      .optional(),\n  })\n  .passthrough()\n\nexport type JwtPayload = z.infer<typeof jwtPayloadSchema>\n"]}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,gCAAgC,EAAE,MAAM,WAAW,CAAA;AAEhF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,WAAW,CAAC,kBAAkB,CAAC;KAC/B,WAAW,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAA;AAGnD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAa,EAAqB,EAAE,CAC9D,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAEzC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,WAAW,CAAC,kBAAkB,CAAC;KAC/B,WAAW,CAAC,gCAAgC,CAAC,CAAC,CAAC,CAAC,CAAA;AAGnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAa,EAAuB,EAAE,CAClE,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAA;AAE3C;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,yCAAyC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,2CAA2C;IAC3C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,4CAA4C;IAC5C,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACzB,CAAC;SACD,QAAQ,EAAE;IACb,sCAAsC;IACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,yCAAyC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,uDAAuD;IACvD,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnC,kEAAkE;IAClE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,yEAAyE;IACzE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,oCAAoC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,4CAA4C;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,yCAAyC;IACzC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,WAAW,EAAE,CAAA;AAIhB;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,6CAA6C;aACvD,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,yBAAyB;aACnC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,0BAA0B;aACpC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,sBAAsB;aAChC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,cAAc;YACnC,UAAU,EAAE,KAAK;SAClB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAA;AAEF,iDAAiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,SAAS,CAAC,QAAQ,EAAE;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnC,gDAAgD;IAChD,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS;QACrC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM;QACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,gBAAgB;QAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,8CAA8C;QAEhF,4DAA4D;QAC5D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAE1B,gDAAgD;QAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,uCAAuC;QAE1E,gDAAgD;QAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,qHAAqH;KAClJ,CAAC;SACD,QAAQ,EAAE;IAEb,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEtC,uEAAuE;IAEvE,0BAA0B;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,0EAA0E;IACzG,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,mBAAmB,CAAC,CAAC,aAAa;SACxC,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,KAAK,CAAC,kBAAkB,CAAC;SACzB,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,0BAA0B,CAAC;SACjC,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAEvC,wBAAwB;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,wBAAwB;IACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE7C,0BAA0B;IAC1B,qEAAqE;IACrE,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC;SACD,QAAQ,EAAE;IAEb,6DAA6D;IAC7D,qBAAqB,EAAE,CAAC;SACrB,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,4DAA4D;QAC5D,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC;SACD,WAAW,EAAE,CACjB;SACA,QAAQ,EAAE;CACd,CAAC;KACD,WAAW,EAAE,CAAA","sourcesContent":["import { z } from 'zod'\nimport { jwkPubSchema } from './jwk.js'\nimport { jwtCharsRefinement, segmentedStringRefinementFactory } from './util.js'\n\nexport const signedJwtSchema = z\n  .string()\n  .superRefine(jwtCharsRefinement)\n  .superRefine(segmentedStringRefinementFactory(3))\n\nexport type SignedJwt = z.infer<typeof signedJwtSchema>\nexport const isSignedJwt = (data: unknown): data is SignedJwt =>\n  signedJwtSchema.safeParse(data).success\n\nexport const unsignedJwtSchema = z\n  .string()\n  .superRefine(jwtCharsRefinement)\n  .superRefine(segmentedStringRefinementFactory(2))\n\nexport type UnsignedJwt = z.infer<typeof unsignedJwtSchema>\nexport const isUnsignedJwt = (data: unknown): data is UnsignedJwt =>\n  unsignedJwtSchema.safeParse(data).success\n\n/**\n * @see {@link https://www.rfc-editor.org/rfc/rfc7515.html#section-4}\n */\nexport const jwtHeaderSchema = z\n  .object({\n    /** \"alg\" (Algorithm) Header Parameter */\n    alg: z.string(),\n    /** \"jku\" (JWK Set URL) Header Parameter */\n    jku: z.string().url().optional(),\n    /** \"jwk\" (JSON Web Key) Header Parameter */\n    jwk: z\n      .object({\n        kty: z.string(),\n        crv: z.string().optional(),\n        x: z.string().optional(),\n        y: z.string().optional(),\n        e: z.string().optional(),\n        n: z.string().optional(),\n      })\n      .optional(),\n    /** \"kid\" (Key ID) Header Parameter */\n    kid: z.string().optional(),\n    /** \"x5u\" (X.509 URL) Header Parameter */\n    x5u: z.string().optional(),\n    /** \"x5c\" (X.509 Certificate Chain) Header Parameter */\n    x5c: z.array(z.string()).optional(),\n    /** \"x5t\" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */\n    x5t: z.string().optional(),\n    /** \"x5t#S256\" (X.509 Certificate SHA-256 Thumbprint) Header Parameter */\n    'x5t#S256': z.string().optional(),\n    /** \"typ\" (Type) Header Parameter */\n    typ: z.string().optional(),\n    /** \"cty\" (Content Type) Header Parameter */\n    cty: z.string().optional(),\n    /** \"crit\" (Critical) Header Parameter */\n    crit: z.array(z.string()).optional(),\n  })\n  .passthrough()\n\nexport type JwtHeader = z.infer<typeof jwtHeaderSchema>\n\n/**\n * @see {@link https://www.rfc-editor.org/rfc/rfc9449.html#section-4.2-4.6}\n * @see {@link https://www.rfc-editor.org/rfc/rfc9110#section-7.1}\n */\nexport const htuSchema = z.string().superRefine((value, ctx) => {\n  try {\n    const url = new URL(value)\n    if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'Only http: and https: protocols are allowed',\n      })\n    }\n\n    if (url.username || url.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'Credentials not allowed',\n      })\n    }\n\n    if (url.search) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'Query string not allowed',\n      })\n    }\n\n    if (url.hash) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: 'Fragment not allowed',\n      })\n    }\n  } catch (err) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.invalid_string,\n      validation: 'url',\n    })\n  }\n\n  return value\n})\n\n// https://www.iana.org/assignments/jwt/jwt.xhtml\nexport const jwtPayloadSchema = z\n  .object({\n    iss: z.string().optional(),\n    aud: z.union([z.string(), z.array(z.string()).nonempty()]).optional(),\n    sub: z.string().optional(),\n    exp: z.number().int().optional(),\n    nbf: z.number().int().optional(),\n    iat: z.number().int().optional(),\n    jti: z.string().optional(),\n    htm: z.string().optional(),\n    htu: htuSchema.optional(),\n    ath: z.string().optional(),\n    acr: z.string().optional(),\n    azp: z.string().optional(),\n    amr: z.array(z.string()).optional(),\n    // https://datatracker.ietf.org/doc/html/rfc7800\n    cnf: z\n      .object({\n        kid: z.string().optional(), // Key ID\n        jwk: jwkPubSchema.optional(), // JWK\n        jwe: z.string().optional(), // Encrypted key\n        jku: z.string().url().optional(), // JWK Set URI (\"kid\" should also be provided)\n\n        // https://datatracker.ietf.org/doc/html/rfc9449#section-6.1\n        jkt: z.string().optional(),\n\n        // https://datatracker.ietf.org/doc/html/rfc8705\n        'x5t#S256': z.string().optional(), // X.509 Certificate SHA-256 Thumbprint\n\n        // https://datatracker.ietf.org/doc/html/rfc9203\n        osc: z.string().optional(), // OSCORE_Input_Material carrying the parameters for using OSCORE per-message security with implicit key confirmation\n      })\n      .optional(),\n\n    client_id: z.string().optional(),\n\n    scope: z.string().optional(),\n    nonce: z.string().optional(),\n\n    at_hash: z.string().optional(),\n    c_hash: z.string().optional(),\n    s_hash: z.string().optional(),\n    auth_time: z.number().int().optional(),\n\n    // https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims\n\n    // OpenID: \"profile\" scope\n    name: z.string().optional(),\n    family_name: z.string().optional(),\n    given_name: z.string().optional(),\n    middle_name: z.string().optional(),\n    nickname: z.string().optional(),\n    preferred_username: z.string().optional(),\n    gender: z.string().optional(), // OpenID only defines \"male\" and \"female\" without forbidding other values\n    picture: z.string().url().optional(),\n    profile: z.string().url().optional(),\n    website: z.string().url().optional(),\n    birthdate: z\n      .string()\n      .regex(/\\d{4}-\\d{2}-\\d{2}/) // YYYY-MM-DD\n      .optional(),\n    zoneinfo: z\n      .string()\n      .regex(/^[A-Za-z0-9_/]+$/)\n      .optional(),\n    locale: z\n      .string()\n      .regex(/^[a-z]{2,3}(-[A-Z]{2})?$/)\n      .optional(),\n    updated_at: z.number().int().optional(),\n\n    // OpenID: \"email\" scope\n    email: z.string().optional(),\n    email_verified: z.boolean().optional(),\n\n    // OpenID: \"phone\" scope\n    phone_number: z.string().optional(),\n    phone_number_verified: z.boolean().optional(),\n\n    // OpenID: \"address\" scope\n    // https://openid.net/specs/openid-connect-core-1_0.html#AddressClaim\n    address: z\n      .object({\n        formatted: z.string().optional(),\n        street_address: z.string().optional(),\n        locality: z.string().optional(),\n        region: z.string().optional(),\n        postal_code: z.string().optional(),\n        country: z.string().optional(),\n      })\n      .optional(),\n\n    // https://datatracker.ietf.org/doc/html/rfc9396#section-14.2\n    authorization_details: z\n      .array(\n        z\n          .object({\n            type: z.string(),\n            // https://datatracker.ietf.org/doc/html/rfc9396#section-2.2\n            locations: z.array(z.string()).optional(),\n            actions: z.array(z.string()).optional(),\n            datatypes: z.array(z.string()).optional(),\n            identifier: z.string().optional(),\n            privileges: z.array(z.string()).optional(),\n          })\n          .passthrough(),\n      )\n      .optional(),\n  })\n  .passthrough()\n\nexport type JwtPayload = z.infer<typeof jwtPayloadSchema>\n"]}