@camstack/addon-auth 1.2.126 → 1.2.128

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,19 +1,19 @@
-import { a as loginMethodCapability, c as BaseAddon, i as buildAddonRouteProvider, r as authProviderCapability, s as errMsg, t as addonRoutesCapability } from "../dist-DoUGHO_G.mjs";
+import { a as buildAddonRouteProvider, c as errMsg, i as authProviderCapability, l as BaseAddon, n as addonRoutesCapability, o as loginMethodCapability, t as hubBrowserOrigin } from "../hub-browser-origin-DmRqQVDn.mjs";
 import * as crypto$1 from "node:crypto";
-//#region node_modules/jose/dist/webapi/lib/buffer_utils.js
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
+//#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
 function concat(...buffers) {
-	const size = buffers.reduce((acc, { length }) => acc + length, 0);
-	const buf = new Uint8Array(size);
+	const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
 	let i = 0;
-	for (const buffer of buffers) {
-		buf.set(buffer, i);
-		i += buffer.length;
-	}
+	for (const buffer of buffers) buf.set(buffer, i), i += buffer.length;
 	return buf;
 }
+var NON_ASCII = /[^\x00-\x7f]/;
 function encode(string) {
+	if (typeof string == "string" && string.length >= 128) {
+		if (NON_ASCII.test(string)) throw new TypeError("non-ASCII string encountered in encode()");
+		return encoder.encode(string);
+	}
 	const bytes = new Uint8Array(string.length);
 	for (let i = 0; i < string.length; i++) {
 		const code = string.charCodeAt(i);
@@ -22,117 +22,23 @@ function encode(string) {
 	}
 	return bytes;
 }
-//#endregion
-//#region node_modules/jose/dist/webapi/lib/base64.js
-function decodeBase64(encoded) {
-	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded);
-	const binary = atob(encoded);
-	const bytes = new Uint8Array(binary.length);
+function decodeBase64(encoded, url = !1) {
+	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+	if (url) {
+		if (encoded.includes("+") || encoded.includes("/")) throw new TypeError("Invalid base64url");
+		encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+	}
+	const binary = atob(encoded), bytes = new Uint8Array(binary.length);
 	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
 	return bytes;
 }
 //#endregion
-//#region node_modules/jose/dist/webapi/util/base64url.js
-function decode(input) {
-	if (Uint8Array.fromBase64) return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), { alphabet: "base64url" });
-	let encoded = input;
-	if (encoded instanceof Uint8Array) encoded = decoder.decode(encoded);
-	encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
-	try {
-		return decodeBase64(encoded);
-	} catch {
-		throw new TypeError("The input to be decoded is not correctly encoded.");
-	}
-}
-//#endregion
-//#region node_modules/jose/dist/webapi/lib/crypto_key.js
-var unusable = (name, prop = "algorithm.name") => /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-var isAlgorithm = (algorithm, name) => algorithm.name === name;
-function getHashLength(hash) {
-	return parseInt(hash.name.slice(4), 10);
-}
-function checkHashLength(algorithm, expected) {
-	if (getHashLength(algorithm.hash) !== expected) throw unusable(`SHA-${expected}`, "algorithm.hash");
-}
-function getNamedCurve(alg) {
-	switch (alg) {
-		case "ES256": return "P-256";
-		case "ES384": return "P-384";
-		case "ES512": return "P-521";
-		default: throw new Error("unreachable");
-	}
-}
-function checkUsage(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-function checkSigCryptoKey(key, alg, usage) {
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512":
-			if (!isAlgorithm(key.algorithm, "HMAC")) throw unusable("HMAC");
-			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-			break;
-		case "RS256":
-		case "RS384":
-		case "RS512":
-			if (!isAlgorithm(key.algorithm, "RSASSA-PKCS1-v1_5")) throw unusable("RSASSA-PKCS1-v1_5");
-			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-			break;
-		case "PS256":
-		case "PS384":
-		case "PS512":
-			if (!isAlgorithm(key.algorithm, "RSA-PSS")) throw unusable("RSA-PSS");
-			checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-			break;
-		case "Ed25519":
-		case "EdDSA":
-			if (!isAlgorithm(key.algorithm, "Ed25519")) throw unusable("Ed25519");
-			break;
-		case "ML-DSA-44":
-		case "ML-DSA-65":
-		case "ML-DSA-87":
-			if (!isAlgorithm(key.algorithm, alg)) throw unusable(alg);
-			break;
-		case "ES256":
-		case "ES384":
-		case "ES512": {
-			if (!isAlgorithm(key.algorithm, "ECDSA")) throw unusable("ECDSA");
-			const expected = getNamedCurve(alg);
-			if (key.algorithm.namedCurve !== expected) throw unusable(expected, "algorithm.namedCurve");
-			break;
-		}
-		default: throw new TypeError("CryptoKey does not support this operation");
-	}
-	checkUsage(key, usage);
-}
-//#endregion
-//#region node_modules/jose/dist/webapi/lib/invalid_key_input.js
-function message(msg, actual, ...types) {
-	types = types.filter(Boolean);
-	if (types.length > 2) {
-		const last = types.pop();
-		msg += `one of type ${types.join(", ")}, or ${last}.`;
-	} else if (types.length === 2) msg += `one of type ${types[0]} or ${types[1]}.`;
-	else msg += `of type ${types[0]}.`;
-	if (actual == null) msg += ` Received ${actual}`;
-	else if (typeof actual === "function" && actual.name) msg += ` Received function ${actual.name}`;
-	else if (typeof actual === "object" && actual != null) {
-		if (actual.constructor?.name) msg += ` Received an instance of ${actual.constructor.name}`;
-	}
-	return msg;
-}
-var invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
-var withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
-//#endregion
-//#region node_modules/jose/dist/webapi/util/errors.js
+//#region ../../node_modules/jose/dist/webapi/util/errors.js
 var JOSEError = class extends Error {
 	static code = "ERR_JOSE_GENERIC";
 	code = "ERR_JOSE_GENERIC";
 	constructor(message, options) {
-		super(message, options);
-		this.name = this.constructor.name;
-		Error.captureStackTrace?.(this, this.constructor);
+		super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
 	}
 };
 var JWTClaimValidationFailed = class extends JOSEError {
@@ -146,10 +52,7 @@ var JWTClaimValidationFailed = class extends JOSEError {
 			claim,
 			reason,
 			payload
-		} });
-		this.claim = claim;
-		this.reason = reason;
-		this.payload = payload;
+		} }), this.claim = claim, this.reason = reason, this.payload = payload;
 	}
 };
 var JWTExpired = class extends JOSEError {
@@ -163,10 +66,7 @@ var JWTExpired = class extends JOSEError {
 			claim,
 			reason,
 			payload
-		} });
-		this.claim = claim;
-		this.reason = reason;
-		this.payload = payload;
+		} }), this.claim = claim, this.reason = reason, this.payload = payload;
 	}
 };
 var JOSEAlgNotAllowed = class extends JOSEError {
@@ -197,7 +97,7 @@ var JWKSNoMatchingKey = class extends JOSEError {
 	}
 };
 var JWKSMultipleMatchingKeys = class extends JOSEError {
-	[Symbol.asyncIterator];
+	[Symbol.asyncIterator] = async function* () {};
 	static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
 	code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
 	constructor(message = "multiple matching keys found in the JSON Web Key Set", options) {
@@ -219,810 +119,504 @@ var JWSSignatureVerificationFailed = class extends JOSEError {
 	}
 };
 //#endregion
-//#region node_modules/jose/dist/webapi/lib/is_key_like.js
-var isCryptoKey = (key) => {
-	if (key?.[Symbol.toStringTag] === "CryptoKey") return true;
-	try {
-		return key instanceof CryptoKey;
-	} catch {
-		return false;
-	}
-};
-var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
-var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-//#endregion
-//#region node_modules/jose/dist/webapi/lib/helpers.js
-function decodeBase64url(value, label, ErrorClass) {
+//#region ../../node_modules/jose/dist/webapi/util/base64url.js
+var invalid = "The input to be decoded is not correctly encoded.";
+function decode(input) {
 	try {
-		return decode(value);
-	} catch {
-		throw new ErrorClass(`Failed to base64url decode the ${label}`);
+		return decodeBase64(typeof input == "string" ? input : decoder.decode(input), !0);
+	} catch (cause) {
+		throw new TypeError(invalid, { cause });
 	}
 }
 //#endregion
-//#region node_modules/jose/dist/webapi/lib/type_checks.js
-var isObjectLike = (value) => typeof value === "object" && value !== null;
+//#region ../../node_modules/jose/dist/webapi/lib/validate.js
 function isObject(input) {
-	if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") return false;
-	if (Object.getPrototypeOf(input) === null) return true;
-	let proto = input;
-	while (Object.getPrototypeOf(proto) !== null) proto = Object.getPrototypeOf(proto);
-	return Object.getPrototypeOf(input) === proto;
-}
-function isDisjoint(...headers) {
-	const sources = headers.filter(Boolean);
-	if (sources.length === 0 || sources.length === 1) return true;
-	let acc;
-	for (const header of sources) {
-		const parameters = Object.keys(header);
-		if (!acc || acc.size === 0) {
-			acc = new Set(parameters);
-			continue;
-		}
-		for (const parameter of parameters) {
-			if (acc.has(parameter)) return false;
-			acc.add(parameter);
-		}
-	}
-	return true;
+	if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") return !1;
+	const prototype = Object.getPrototypeOf(input);
+	return prototype === null || Object.getPrototypeOf(prototype) === null;
 }
-var isJWK = (key) => isObject(key) && typeof key.kty === "string";
-var isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string");
-var isPublicJWK = (key) => key.kty !== "oct" && key.d === void 0 && key.priv === void 0;
-var isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
-//#endregion
-//#region node_modules/jose/dist/webapi/lib/signing.js
-function checkKeyLength(alg, key) {
-	if (alg.startsWith("RS") || alg.startsWith("PS")) {
-		const { modulusLength } = key.algorithm;
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-	}
+function isJwkSet(input) {
+	return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);
 }
-function subtleAlgorithm(alg, algorithm) {
-	const hash = `SHA-${alg.slice(-3)}`;
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512": return {
-			hash,
-			name: "HMAC"
-		};
-		case "PS256":
-		case "PS384":
-		case "PS512": return {
-			hash,
-			name: "RSA-PSS",
-			saltLength: parseInt(alg.slice(-3), 10) >> 3
-		};
-		case "RS256":
-		case "RS384":
-		case "RS512": return {
-			hash,
-			name: "RSASSA-PKCS1-v1_5"
-		};
-		case "ES256":
-		case "ES384":
-		case "ES512": return {
-			hash,
-			name: "ECDSA",
-			namedCurve: algorithm.namedCurve
-		};
-		case "Ed25519":
-		case "EdDSA": return { name: "Ed25519" };
-		case "ML-DSA-44":
-		case "ML-DSA-65":
-		case "ML-DSA-87": return { name: alg };
-		default: throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+function isDisjoint(...headers) {
+	const parameters = /* @__PURE__ */ new Set();
+	for (const header of headers) if (header) for (const parameter of Object.keys(header)) {
+		if (parameters.has(parameter)) return !1;
+		parameters.add(parameter);
 	}
+	return !0;
 }
-async function getSigKey(alg, key, usage) {
-	if (key instanceof Uint8Array) {
-		if (!alg.startsWith("HS")) throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
-		return crypto.subtle.importKey("raw", key, {
-			hash: `SHA-${alg.slice(-3)}`,
-			name: "HMAC"
-		}, false, [usage]);
+function decodeBase64url(value, label, ErrorClass) {
+	try {
+		return decode(value);
+	} catch {
+		throw new ErrorClass(`Failed to base64url decode the ${label}`);
 	}
-	checkSigCryptoKey(key, alg, usage);
-	return key;
 }
-async function verify(alg, key, signature, data) {
-	const cryptoKey = await getSigKey(alg, key, "verify");
-	checkKeyLength(alg, cryptoKey);
-	const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
+function encodeBase64url(value, label, ErrorClass) {
 	try {
-		return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+		return encode(value);
 	} catch {
-		return false;
+		throw new ErrorClass(`The ${label} is not a valid base64url string`);
 	}
 }
-//#endregion
-//#region node_modules/jose/dist/webapi/lib/jwk_to_key.js
-var unsupportedAlg = "Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value";
-function subtleMapping(jwk) {
-	let algorithm;
-	let keyUsages;
-	switch (jwk.kty) {
-		case "AKP":
-			switch (jwk.alg) {
-				case "ML-DSA-44":
-				case "ML-DSA-65":
-				case "ML-DSA-87":
-					algorithm = { name: jwk.alg };
-					keyUsages = jwk.priv ? ["sign"] : ["verify"];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		case "RSA":
-			switch (jwk.alg) {
-				case "PS256":
-				case "PS384":
-				case "PS512":
-					algorithm = {
-						name: "RSA-PSS",
-						hash: `SHA-${jwk.alg.slice(-3)}`
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "RS256":
-				case "RS384":
-				case "RS512":
-					algorithm = {
-						name: "RSASSA-PKCS1-v1_5",
-						hash: `SHA-${jwk.alg.slice(-3)}`
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "RSA-OAEP":
-				case "RSA-OAEP-256":
-				case "RSA-OAEP-384":
-				case "RSA-OAEP-512":
-					algorithm = {
-						name: "RSA-OAEP",
-						hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`
-					};
-					keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		case "EC":
-			switch (jwk.alg) {
-				case "ES256":
-				case "ES384":
-				case "ES512":
-					algorithm = {
-						name: "ECDSA",
-						namedCurve: {
-							ES256: "P-256",
-							ES384: "P-384",
-							ES512: "P-521"
-						}[jwk.alg]
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "ECDH-ES":
-				case "ECDH-ES+A128KW":
-				case "ECDH-ES+A192KW":
-				case "ECDH-ES+A256KW":
-					algorithm = {
-						name: "ECDH",
-						namedCurve: jwk.crv
-					};
-					keyUsages = jwk.d ? ["deriveBits"] : [];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		case "OKP":
-			switch (jwk.alg) {
-				case "Ed25519":
-				case "EdDSA":
-					algorithm = { name: "Ed25519" };
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "ECDH-ES":
-				case "ECDH-ES+A128KW":
-				case "ECDH-ES+A192KW":
-				case "ECDH-ES+A256KW":
-					algorithm = { name: jwk.crv };
-					keyUsages = jwk.d ? ["deriveBits"] : [];
-					break;
-				default: throw new JOSENotSupported(unsupportedAlg);
-			}
-			break;
-		default: throw new JOSENotSupported("Invalid or unsupported JWK \"kty\" (Key Type) Parameter value");
+function parseJoseHeader(b64, ErrorClass, message) {
+	let parsed;
+	try {
+		parsed = JSON.parse(strictDecoder.decode(decode(b64)));
+	} catch {
+		throw new ErrorClass(message);
 	}
-	return {
-		algorithm,
-		keyUsages
-	};
+	if (!isObject(parsed)) throw new ErrorClass(message);
+	return parsed;
 }
-async function jwkToKey(jwk) {
-	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
-	const { algorithm, keyUsages } = subtleMapping(jwk);
-	const keyData = { ...jwk };
-	if (keyData.kty !== "AKP") delete keyData.alg;
-	delete keyData.use;
-	return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
-}
-//#endregion
-//#region node_modules/jose/dist/webapi/lib/normalize_key.js
-var unusableForAlg = "given KeyObject instance cannot be used for this algorithm";
-var cache;
-var handleJWK = async (key, jwk, alg, freeze = false) => {
-	cache ||= /* @__PURE__ */ new WeakMap();
-	let cached = cache.get(key);
-	if (cached?.[alg]) return cached[alg];
-	const cryptoKey = await jwkToKey({
-		...jwk,
-		alg
-	});
-	if (freeze) Object.freeze(key);
-	if (!cached) cache.set(key, { [alg]: cryptoKey });
-	else cached[alg] = cryptoKey;
-	return cryptoKey;
-};
-var handleKeyObject = (keyObject, alg) => {
-	cache ||= /* @__PURE__ */ new WeakMap();
-	let cached = cache.get(keyObject);
-	if (cached?.[alg]) return cached[alg];
-	const isPublic = keyObject.type === "public";
-	const extractable = isPublic ? true : false;
-	let cryptoKey;
-	if (keyObject.asymmetricKeyType === "x25519") {
-		switch (alg) {
-			case "ECDH-ES":
-			case "ECDH-ES+A128KW":
-			case "ECDH-ES+A192KW":
-			case "ECDH-ES+A256KW": break;
-			default: throw new TypeError(unusableForAlg);
-		}
-		cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ["deriveBits"]);
-	}
-	if (keyObject.asymmetricKeyType === "ed25519") {
-		if (alg !== "EdDSA" && alg !== "Ed25519") throw new TypeError(unusableForAlg);
-		cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [isPublic ? "verify" : "sign"]);
-	}
-	switch (keyObject.asymmetricKeyType) {
-		case "ml-dsa-44":
-		case "ml-dsa-65":
-		case "ml-dsa-87":
-			if (alg !== keyObject.asymmetricKeyType.toUpperCase()) throw new TypeError(unusableForAlg);
-			cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [isPublic ? "verify" : "sign"]);
-	}
-	if (keyObject.asymmetricKeyType === "rsa") {
-		let hash;
-		switch (alg) {
-			case "RSA-OAEP":
-				hash = "SHA-1";
-				break;
-			case "RS256":
-			case "PS256":
-			case "RSA-OAEP-256":
-				hash = "SHA-256";
-				break;
-			case "RS384":
-			case "PS384":
-			case "RSA-OAEP-384":
-				hash = "SHA-384";
-				break;
-			case "RS512":
-			case "PS512":
-			case "RSA-OAEP-512":
-				hash = "SHA-512";
-				break;
-			default: throw new TypeError(unusableForAlg);
-		}
-		if (alg.startsWith("RSA-OAEP")) return keyObject.toCryptoKey({
-			name: "RSA-OAEP",
-			hash
-		}, extractable, isPublic ? ["encrypt"] : ["decrypt"]);
-		cryptoKey = keyObject.toCryptoKey({
-			name: alg.startsWith("PS") ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
-			hash
-		}, extractable, [isPublic ? "verify" : "sign"]);
-	}
-	if (keyObject.asymmetricKeyType === "ec") {
-		const namedCurve = new Map([
-			["prime256v1", "P-256"],
-			["secp384r1", "P-384"],
-			["secp521r1", "P-521"]
-		]).get(keyObject.asymmetricKeyDetails?.namedCurve);
-		if (!namedCurve) throw new TypeError(unusableForAlg);
-		const expectedCurve = {
-			ES256: "P-256",
-			ES384: "P-384",
-			ES512: "P-521"
-		};
-		if (expectedCurve[alg] && namedCurve === expectedCurve[alg]) cryptoKey = keyObject.toCryptoKey({
-			name: "ECDSA",
-			namedCurve
-		}, extractable, [isPublic ? "verify" : "sign"]);
-		if (alg.startsWith("ECDH-ES")) cryptoKey = keyObject.toCryptoKey({
-			name: "ECDH",
-			namedCurve
-		}, extractable, isPublic ? [] : ["deriveBits"]);
-	}
-	if (!cryptoKey) throw new TypeError(unusableForAlg);
-	if (!cached) cache.set(keyObject, { [alg]: cryptoKey });
-	else cached[alg] = cryptoKey;
-	return cryptoKey;
+var JWS_RECOGNIZED = {
+	__proto__: null,
+	b64: !0
 };
-async function normalizeKey(key, alg) {
-	if (key instanceof Uint8Array) return key;
-	if (isCryptoKey(key)) return key;
-	if (isKeyObject(key)) {
-		if (key.type === "secret") return key.export();
-		if ("toCryptoKey" in key && typeof key.toCryptoKey === "function") try {
-			return handleKeyObject(key, alg);
-		} catch (err) {
-			if (err instanceof TypeError) throw err;
-		}
-		return handleJWK(key, key.export({ format: "jwk" }), alg);
-	}
-	if (isJWK(key)) {
-		if (key.k) return decode(key.k);
-		return handleJWK(key, key, alg, true);
-	}
-	throw new Error("unreachable");
-}
-//#endregion
-//#region node_modules/jose/dist/webapi/key/import.js
-async function importJWK(jwk, alg, options) {
-	if (!isObject(jwk)) throw new TypeError("JWK must be an object");
-	let ext;
-	alg ??= jwk.alg;
-	ext ??= options?.extractable ?? jwk.ext;
-	switch (jwk.kty) {
-		case "oct":
-			if (typeof jwk.k !== "string" || !jwk.k) throw new TypeError("missing \"k\" (Key Value) Parameter value");
-			return decode(jwk.k);
-		case "RSA":
-			if ("oth" in jwk && jwk.oth !== void 0) throw new JOSENotSupported("RSA JWK \"oth\" (Other Primes Info) Parameter value is not supported");
-			return jwkToKey({
-				...jwk,
-				alg,
-				ext
-			});
-		case "AKP":
-			if (typeof jwk.alg !== "string" || !jwk.alg) throw new TypeError("missing \"alg\" (Algorithm) Parameter value");
-			if (alg !== void 0 && alg !== jwk.alg) throw new TypeError("JWK alg and alg option value mismatch");
-			return jwkToKey({
-				...jwk,
-				ext
-			});
-		case "EC":
-		case "OKP": return jwkToKey({
-			...jwk,
-			alg,
-			ext
-		});
-		default: throw new JOSENotSupported("Unsupported \"kty\" (Key Type) Parameter value");
-	}
+function validateAlgorithms(option, algorithms) {
+	if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string"))) throw new TypeError(`"${option}" option must be an array of strings`);
+	return algorithms === void 0 ? void 0 : new Set(algorithms);
 }
-//#endregion
-//#region node_modules/jose/dist/webapi/lib/validate_crit.js
 function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
 	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
-	if (!protectedHeader || protectedHeader.crit === void 0) return /* @__PURE__ */ new Set();
-	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
-	let recognized;
-	if (recognizedOption !== void 0) recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
-	else recognized = recognizedDefault;
+	if (!protectedHeader || protectedHeader.crit === void 0) return [];
+	if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0)) throw new Err("\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present");
+	const recognized = recognizedOption === void 0 ? recognizedDefault : {
+		__proto__: null,
+		...recognizedOption,
+		...recognizedDefault
+	};
 	for (const parameter of protectedHeader.crit) {
-		if (!recognized.has(parameter)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-		if (joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-		if (recognized.get(parameter) && protectedHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+		if (!(parameter in recognized)) throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+		if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0) throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+		if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0)) throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
 	}
-	return new Set(protectedHeader.crit);
+	return protectedHeader.crit;
 }
-//#endregion
-//#region node_modules/jose/dist/webapi/lib/validate_algorithms.js
-function validateAlgorithms(option, algorithms) {
-	if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) throw new TypeError(`"${option}" option must be an array of strings`);
-	if (!algorithms) return;
-	return new Set(algorithms);
+function validateB64(protectedHeader, extensions) {
+	if (extensions.includes("b64")) {
+		const b64 = protectedHeader.b64;
+		if (typeof b64 != "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
+		return b64;
+	}
+	return !0;
 }
 //#endregion
-//#region node_modules/jose/dist/webapi/lib/check_key_type.js
-var tag = (key) => key?.[Symbol.toStringTag];
-var jwkMatchesOp = (alg, key, usage) => {
+//#region ../../node_modules/jose/dist/webapi/lib/key.js
+var tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {
+	const { alg } = entry;
 	if (key.use !== void 0) {
-		let expected;
-		switch (usage) {
-			case "sign":
-			case "verify":
-				expected = "sig";
-				break;
-			case "encrypt":
-			case "decrypt":
-				expected = "enc";
-				break;
-		}
+		const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
 		if (key.use !== expected) throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
 	}
 	if (key.alg !== void 0 && key.alg !== alg) throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
 	if (Array.isArray(key.key_ops)) {
-		let expectedKeyOp;
-		switch (true) {
-			case usage === "sign" || usage === "verify":
-			case alg === "dir":
-			case alg.includes("CBC-HS"):
-				expectedKeyOp = usage;
-				break;
-			case alg.startsWith("PBES2"):
-				expectedKeyOp = "deriveBits";
-				break;
-			case /^A\d{3}(?:GCM)?(?:KW)?$/.test(alg):
-				if (!alg.includes("GCM") && alg.endsWith("KW")) expectedKeyOp = usage === "encrypt" ? "wrapKey" : "unwrapKey";
-				else expectedKeyOp = usage;
-				break;
-			case usage === "encrypt" && alg.startsWith("RSA"):
-				expectedKeyOp = "wrapKey";
-				break;
-			case usage === "decrypt":
-				expectedKeyOp = alg.startsWith("RSA") ? "unwrapKey" : "deriveBits";
-				break;
-		}
-		if (expectedKeyOp && key.key_ops?.includes?.(expectedKeyOp) === false) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+		const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+		if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
 	}
-	return true;
 };
-var symmetricTypeCheck = (alg, key, usage) => {
-	if (key instanceof Uint8Array) return;
-	if (isJWK(key)) {
-		if (isSecretJWK(key) && jwkMatchesOp(alg, key, usage)) return;
-		throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
-	}
-	if (!isKeyLike(key)) throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array"));
-	if (key.type !== "secret") throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
-};
-var asymmetricTypeCheck = (alg, key, usage) => {
-	if (isJWK(key)) switch (usage) {
-		case "decrypt":
-		case "sign":
-			if (isPrivateJWK(key) && jwkMatchesOp(alg, key, usage)) return;
-			throw new TypeError(`JSON Web Key for this operation must be a private JWK`);
-		case "encrypt":
-		case "verify":
-			if (isPublicJWK(key) && jwkMatchesOp(alg, key, usage)) return;
-			throw new TypeError(`JSON Web Key for this operation must be a public JWK`);
-	}
-	if (!isKeyLike(key)) throw new TypeError(withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
-	if (key.type === "secret") throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
-	if (key.type === "public") switch (usage) {
-		case "sign": throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
-		case "decrypt": throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
-	}
-	if (key.type === "private") switch (usage) {
-		case "verify": throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
-		case "encrypt": throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
+async function prepareKey(entry, key, usage) {
+	const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+	if (secret && key instanceof Uint8Array) return key;
+	let normalized, keyObject;
+	if (isObject(key)) {
+		if (normalized = normalizeJwk(key), typeof normalized.kty != "string") throw invalidKeyType(alg, key, secret);
+		if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0))) throw new TypeError(secret ? "JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present" : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+		if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct") return decode(normalized.k);
+		if (!Object.isFrozen(key)) {
+			const { key_ops } = key;
+			Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
+		}
+	} else {
+		if (!isKeyLike(key)) throw invalidKeyType(alg, key, secret);
+		const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+		if (key.type !== expectedType && (secret || [
+			"secret",
+			"public",
+			"private"
+		].includes(key.type))) throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+		if (isCryptoKey(key)) return key;
+		if (keyObject = key, keyObject.type === "secret") return keyObject.export();
 	}
+	cache ||= /* @__PURE__ */ new WeakMap();
+	const cacheKey = key;
+	let cached = cache.get(cacheKey);
+	if (cached?.[alg]) return cached[alg];
+	if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+		const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({
+			crv,
+			asymmetricKeyType: keyObject.asymmetricKeyType
+		}) ?? entry.subtle;
+		return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+	}
+	return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
+}
+var cache;
+var nist = {
+	__proto__: null,
+	prime256v1: "P-256",
+	secp384r1: "P-384",
+	secp521r1: "P-521"
 };
-function checkKeyType(alg, key, usage) {
-	switch (alg.substring(0, 2)) {
-		case "A1":
-		case "A2":
-		case "di":
-		case "HS":
-		case "PB":
-			symmetricTypeCheck(alg, key, usage);
-			break;
-		default: asymmetricTypeCheck(alg, key, usage);
+var isCryptoKey = (key) => {
+	if (key?.[Symbol.toStringTag] === "CryptoKey") return !0;
+	try {
+		return key instanceof CryptoKey;
+	} catch {
+		return !1;
 	}
+}, isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+	if (types.length > 2) {
+		const last = types.pop();
+		msg += `one of type ${types.join(", ")}, or ${last}.`;
+	} else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+	return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+function invalidKeyType(alg, actual, secret) {
+	const types = [
+		"CryptoKey",
+		"KeyObject",
+		"JSON Web Key"
+	];
+	return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+}
+var unusable = (name, prop = "algorithm.name") => /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+	const { modulusLength } = key.algorithm;
+	if (typeof modulusLength != "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+	const algorithm = key.algorithm;
+	if (algorithm.name !== expected.name) throw unusable(expected.name);
+	if (expected.hash && algorithm.hash?.name !== expected.hash) throw unusable(expected.hash, "algorithm.hash");
+	if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) throw unusable(expected.namedCurve, "algorithm.namedCurve");
+	if (expected.length !== void 0 && algorithm.length !== expected.length) throw unusable(expected.length, "algorithm.length");
+	checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+	return {
+		__proto__: null,
+		...jwk
+	};
+}
+function normalizeJwk(jwk) {
+	const normalized = snapshotJwk(jwk);
+	if (normalized.ext !== void 0 && typeof normalized.ext != "boolean") throw new TypeError("\"ext\" (Extractable) Parameter must be a boolean");
+	if (normalized.key_ops !== void 0) {
+		const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+		if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length) throw new TypeError("\"key_ops\" (Key Operations) Parameter must be an array of unique strings");
+		normalized.key_ops = keyOps;
+	}
+	return normalized;
+}
+async function jwkToKey(entry, jwk, extractable) {
+	if (!entry.kty.includes(jwk.kty)) throw new JOSENotSupported("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+	const algorithm = entry.resolve?.({
+		kty: jwk.kty,
+		crv: jwk.crv
+	}) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = {
+		...jwk,
+		ext: extractable ?? jwk.ext
+	};
+	return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = !1) {
+	return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
+}
+//#endregion
+//#region ../../node_modules/jose/dist/webapi/lib/key_descriptor.js
+function table(entries) {
+	const out = { __proto__: null };
+	for (const alg in entries) out[alg] = {
+		...entries[alg],
+		alg
+	};
+	return out;
+}
+//#endregion
+//#region ../../node_modules/jose/dist/webapi/lib/jws_algorithms.js
+var sig = [["verify"], ["sign"]];
+function hmac(bits) {
+	const subtle = {
+		name: "HMAC",
+		hash: `SHA-${bits}`
+	};
+	return {
+		kty: ["oct"],
+		secret: !0,
+		subtle,
+		signing: subtle,
+		usages: sig
+	};
+}
+function rsa(bits, saltLength) {
+	const subtle = {
+		name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+		hash: `SHA-${bits}`
+	};
+	return {
+		kty: ["RSA"],
+		subtle,
+		signing: saltLength ? {
+			...subtle,
+			saltLength
+		} : subtle,
+		usages: sig,
+		minRsaBits: 2048
+	};
+}
+function ecdsa(crv, bits) {
+	return {
+		kty: ["EC"],
+		crv,
+		subtle: {
+			name: "ECDSA",
+			namedCurve: crv
+		},
+		signing: {
+			name: "ECDSA",
+			hash: `SHA-${bits}`
+		},
+		usages: sig
+	};
+}
+function eddsa() {
+	const subtle = { name: "Ed25519" };
+	return {
+		kty: ["OKP"],
+		crv: "Ed25519",
+		subtle,
+		signing: subtle,
+		usages: sig
+	};
+}
+function mldsa(bits) {
+	const subtle = { name: `ML-DSA-${bits}` };
+	return {
+		kty: ["AKP"],
+		subtle,
+		signing: subtle,
+		usages: sig
+	};
+}
+var JWS = table({
+	HS256: hmac(256),
+	HS384: hmac(384),
+	HS512: hmac(512),
+	RS256: rsa(256),
+	RS384: rsa(384),
+	RS512: rsa(512),
+	PS256: rsa(256, 32),
+	PS384: rsa(384, 48),
+	PS512: rsa(512, 64),
+	ES256: ecdsa("P-256", 256),
+	ES384: ecdsa("P-384", 384),
+	ES512: ecdsa("P-521", 512),
+	EdDSA: eddsa(),
+	Ed25519: eddsa(),
+	"ML-DSA-44": mldsa(44),
+	"ML-DSA-65": mldsa(65),
+	"ML-DSA-87": mldsa(87)
+});
+function jwsAlgorithm(alg) {
+	const entry = typeof alg == "string" ? JWS[alg] : void 0;
+	if (!entry) throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+	return entry;
 }
 //#endregion
-//#region node_modules/jose/dist/webapi/jws/flattened/verify.js
-async function flattenedVerify(jws, key, options) {
-	if (!isObject(jws)) throw new JWSInvalid("Flattened JWS must be an object");
-	if (jws.protected === void 0 && jws.header === void 0) throw new JWSInvalid("Flattened JWS must have either of the \"protected\" or \"header\" members");
-	if (jws.protected !== void 0 && typeof jws.protected !== "string") throw new JWSInvalid("JWS Protected Header incorrect type");
-	if (jws.payload === void 0) throw new JWSInvalid("JWS Payload missing");
-	if (typeof jws.signature !== "string") throw new JWSInvalid("JWS Signature missing or incorrect type");
-	if (jws.header !== void 0 && !isObject(jws.header)) throw new JWSInvalid("JWS Unprotected Header incorrect type");
-	let parsedProt = {};
-	if (jws.protected) try {
-		const protectedHeader = decode(jws.protected);
-		parsedProt = JSON.parse(decoder.decode(protectedHeader));
+//#region ../../node_modules/jose/dist/webapi/lib/jws_verify.js
+function prepareVerify(options) {
+	return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
+}
+function parseProtectedHeader(encodedProtected) {
+	return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+}
+function encodeCompactUnencodedPayload(payload) {
+	try {
+		return encode(payload);
 	} catch {
-		throw new JWSInvalid("JWS Protected Header is invalid");
+		throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
 	}
-	if (!isDisjoint(parsedProt, jws.header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+}
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+	const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+	if (!isDisjoint(parsedProt, header)) throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
 	const joseHeader = {
 		...parsedProt,
-		...jws.header
-	};
-	const extensions = validateCrit(JWSInvalid, new Map([["b64", true]]), options?.crit, parsedProt, joseHeader);
-	let b64 = true;
-	if (extensions.has("b64")) {
-		b64 = parsedProt.b64;
-		if (typeof b64 !== "boolean") throw new JWSInvalid("The \"b64\" (base64url-encode payload) Header Parameter must be a boolean");
-	}
-	const { alg } = joseHeader;
-	if (typeof alg !== "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
-	const algorithms = options && validateAlgorithms("algorithms", options.algorithms);
-	if (algorithms && !algorithms.has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
+		...header
+	}, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+	if (typeof alg != "string" || !alg) throw new JWSInvalid("JWS \"alg\" (Algorithm) Header Parameter missing or invalid");
+	if (shared[0] && !shared[0].has(alg)) throw new JOSEAlgNotAllowed("\"alg\" (Algorithm) Header Parameter value not allowed");
 	if (b64) {
-		if (typeof jws.payload !== "string") throw new JWSInvalid("JWS Payload must be a string");
-	} else if (typeof jws.payload !== "string" && !(jws.payload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
-	let resolvedKey = false;
-	if (typeof key === "function") {
-		key = await key(parsedProt, jws);
-		resolvedKey = true;
-	}
-	checkKeyType(alg, key, "verify");
-	const data = concat(jws.protected !== void 0 ? encode(jws.protected) : new Uint8Array(), encode("."), typeof jws.payload === "string" ? b64 ? encode(jws.payload) : encoder.encode(jws.payload) : jws.payload);
-	const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
-	const k = await normalizeKey(key, alg);
-	if (!await verify(alg, k, signature, data)) throw new JWSSignatureVerificationFailed();
-	let payload;
-	if (b64) payload = decodeBase64url(jws.payload, "payload", JWSInvalid);
-	else if (typeof jws.payload === "string") payload = encoder.encode(jws.payload);
-	else payload = jws.payload;
-	const result = { payload };
-	if (jws.protected !== void 0) result.protectedHeader = parsedProt;
-	if (jws.header !== void 0) result.unprotectedHeader = jws.header;
-	if (resolvedKey) return {
+		if (typeof inputPayload != "string") throw new JWSInvalid("JWS Payload must be a string");
+	} else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array)) throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+	const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+	let resolvedKey = !1;
+	typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
+	const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof signingPayload == "string" ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+	entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+	let verified = !1;
+	try {
+		verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+	} catch {}
+	if (!verified) throw new JWSSignatureVerificationFailed();
+	const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+	return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{
 		...result,
 		key: k
-	};
-	return result;
+	}, b64] : [result, b64];
 }
-//#endregion
-//#region node_modules/jose/dist/webapi/jws/compact/verify.js
-async function compactVerify(jws, key, options) {
-	if (jws instanceof Uint8Array) jws = decoder.decode(jws);
-	if (typeof jws !== "string") throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+async function verifyCompact(jws, shared, key) {
+	if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string") throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
 	const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
 	if (length !== 3) throw new JWSInvalid("Invalid Compact JWS");
-	const verified = await flattenedVerify({
+	return verifySignature({
 		payload,
 		protected: protectedHeader,
 		signature
-	}, key, options);
-	const result = {
-		payload: verified.payload,
-		protectedHeader: verified.protectedHeader
-	};
-	if (typeof key === "function") return {
-		...result,
-		key: verified.key
-	};
-	return result;
+	}, shared, key, encodeCompactUnencodedPayload);
 }
 //#endregion
-//#region node_modules/jose/dist/webapi/lib/jwt_claims_set.js
-var epoch = (date) => Math.floor(date.getTime() / 1e3);
-var minute = 60;
-var hour = minute * 60;
-var day = hour * 24;
-var week = day * 7;
-var year = day * 365.25;
-var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+//#region ../../node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+var epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {
+	s: 1,
+	m: 60,
+	h: 3600,
+	d: 86400,
+	w: 604800,
+	y: 31557600
+}, REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = "check_failed";
+function invalidDuration() {
+	throw new TypeError("Invalid time period format");
+}
 function secs(str) {
+	typeof str != "string" && invalidDuration();
 	const matched = REGEX.exec(str);
-	if (!matched || matched[4] && matched[1]) throw new TypeError("Invalid time period format");
-	const value = parseFloat(matched[2]);
-	const unit = matched[3].toLowerCase();
-	let numericDate;
-	switch (unit) {
-		case "sec":
-		case "secs":
-		case "second":
-		case "seconds":
-		case "s":
-			numericDate = Math.round(value);
-			break;
-		case "minute":
-		case "minutes":
-		case "min":
-		case "mins":
-		case "m":
-			numericDate = Math.round(value * minute);
-			break;
-		case "hour":
-		case "hours":
-		case "hr":
-		case "hrs":
-		case "h":
-			numericDate = Math.round(value * hour);
-			break;
-		case "day":
-		case "days":
-		case "d":
-			numericDate = Math.round(value * day);
-			break;
-		case "week":
-		case "weeks":
-		case "w":
-			numericDate = Math.round(value * week);
-			break;
-		default:
-			numericDate = Math.round(value * year);
-			break;
-	}
-	if (matched[1] === "-" || matched[4] === "ago") return -numericDate;
-	return numericDate;
+	(!matched || matched[4] && matched[1]) && invalidDuration();
+	const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+	return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
+}
+function validateInput(label, input) {
+	if (!Number.isFinite(input)) throw new TypeError(`Invalid ${label} input`);
+	return input;
 }
 var normalizeTyp = (value) => {
-	if (value.includes("/")) return value.toLowerCase();
-	return `application/${value.toLowerCase()}`;
-};
-var checkAudiencePresence = (audPayload, audOption) => {
-	if (typeof audPayload === "string") return audOption.includes(audPayload);
-	if (Array.isArray(audPayload)) return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
-	return false;
-};
+	const normalized = value.toLowerCase();
+	return value.includes("/") ? normalized : `application/${normalized}`;
+}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
+function validateNumericDate(payload, claim, required = !1) {
+	const value = payload[claim];
+	if (!(value === void 0 && !required)) {
+		if (typeof value != "number") throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+		return value;
+	}
+}
+function unexpectedClaim(payload, claim) {
+	throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
 function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
 	let payload;
 	try {
-		payload = JSON.parse(decoder.decode(encodedPayload));
+		payload = JSON.parse(strictDecoder.decode(encodedPayload));
 	} catch {}
 	if (!isObject(payload)) throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
 	const { typ } = options;
-	if (typ && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", "check_failed");
-	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
-	const presenceCheck = [...requiredClaims];
-	if (maxTokenAge !== void 0) presenceCheck.push("iat");
-	if (audience !== void 0) presenceCheck.push("aud");
-	if (subject !== void 0) presenceCheck.push("sub");
-	if (issuer !== void 0) presenceCheck.push("iss");
-	for (const claim of new Set(presenceCheck.reverse())) if (!(claim in payload)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-	if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) throw new JWTClaimValidationFailed("unexpected \"iss\" claim value", payload, "iss", "check_failed");
-	if (subject && payload.sub !== subject) throw new JWTClaimValidationFailed("unexpected \"sub\" claim value", payload, "sub", "check_failed");
-	if (audience && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) throw new JWTClaimValidationFailed("unexpected \"aud\" claim value", payload, "aud", "check_failed");
-	let tolerance;
-	switch (typeof options.clockTolerance) {
-		case "string":
-			tolerance = secs(options.clockTolerance);
-			break;
-		case "number":
-			tolerance = options.clockTolerance;
-			break;
-		case "undefined":
-			tolerance = 0;
-			break;
-		default: throw new TypeError("Invalid clockTolerance option type");
-	}
-	const { currentDate } = options;
-	const now = epoch(currentDate || /* @__PURE__ */ new Date());
-	if ((payload.iat !== void 0 || maxTokenAge) && typeof payload.iat !== "number") throw new JWTClaimValidationFailed("\"iat\" claim must be a number", payload, "iat", "invalid");
-	if (payload.nbf !== void 0) {
-		if (typeof payload.nbf !== "number") throw new JWTClaimValidationFailed("\"nbf\" claim must be a number", payload, "nbf", "invalid");
-		if (payload.nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", "check_failed");
-	}
-	if (payload.exp !== void 0) {
-		if (typeof payload.exp !== "number") throw new JWTClaimValidationFailed("\"exp\" claim must be a number", payload, "exp", "invalid");
-		if (payload.exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", "check_failed");
-	}
-	if (maxTokenAge) {
-		const age = now - payload.iat;
-		const max = typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge);
-		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", "check_failed");
-		if (age < 0 - tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", "check_failed");
+	if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) throw new JWTClaimValidationFailed("unexpected \"typ\" JWT header value", payload, "typ", checkFailed);
+	const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+	maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+	for (const claim of new Set(presenceCheck.reverse())) if (!Object.hasOwn(payload, claim)) throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+	issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+	const { clockTolerance } = options;
+	let tolerance = 0;
+	if (typeof clockTolerance == "string") tolerance = secs(clockTolerance);
+	else if (clockTolerance !== void 0) {
+		if (typeof clockTolerance != "number") throw new TypeError("Invalid clockTolerance option type");
+		tolerance = clockTolerance;
+	}
+	validateInput("clockTolerance option", tolerance);
+	const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+	if (nbf !== void 0 && nbf > now + tolerance) throw new JWTClaimValidationFailed("\"nbf\" claim timestamp check failed", payload, "nbf", checkFailed);
+	const exp = validateNumericDate(payload, "exp");
+	if (exp !== void 0 && exp <= now - tolerance) throw new JWTExpired("\"exp\" claim timestamp check failed", payload, "exp", checkFailed);
+	if (maxTokenAge !== void 0) {
+		const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+		if (age - tolerance > max) throw new JWTExpired("\"iat\" claim timestamp check failed (too far in the past)", payload, "iat", checkFailed);
+		if (age < -tolerance) throw new JWTClaimValidationFailed("\"iat\" claim timestamp check failed (it should be in the past)", payload, "iat", checkFailed);
 	}
 	return payload;
 }
 //#endregion
-//#region node_modules/jose/dist/webapi/jwt/verify.js
+//#region ../../node_modules/jose/dist/webapi/jwt/verify.js
 async function jwtVerify(jwt, key, options) {
-	const verified = await compactVerify(jwt, key, options);
-	if (verified.protectedHeader.crit?.includes("b64") && verified.protectedHeader.b64 === false) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-	const result = {
-		payload: validateClaimsSet(verified.protectedHeader, verified.payload, options),
-		protectedHeader: verified.protectedHeader
-	};
-	if (typeof key === "function") return {
-		...result,
-		key: verified.key
+	const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+	if (!b64) throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+	const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+	return {
+		...verified,
+		payload
 	};
-	return result;
 }
 //#endregion
-//#region node_modules/jose/dist/webapi/jwks/local.js
-function getKtyFromAlg(alg) {
-	switch (typeof alg === "string" && alg.slice(0, 2)) {
-		case "RS":
-		case "PS": return "RSA";
-		case "ES": return "EC";
-		case "Ed": return "OKP";
-		case "ML": return "AKP";
-		default: throw new JOSENotSupported("Unsupported \"alg\" value for a JSON Web Key Set");
-	}
+//#region ../../node_modules/jose/dist/webapi/jwks/local.js
+function isUsableJWK(jwk, entry, alg, kid) {
+	const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
+	return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
 }
-function isJWKSLike(jwks) {
-	return jwks && typeof jwks === "object" && Array.isArray(jwks.keys) && jwks.keys.every(isJWKLike);
-}
-function isJWKLike(key) {
-	return isObject(key);
-}
-var LocalJWKSet = class {
-	#jwks;
-	#cached = /* @__PURE__ */ new WeakMap();
-	constructor(jwks) {
-		if (!isJWKSLike(jwks)) throw new JWKSInvalid("JSON Web Key Set malformed");
-		this.#jwks = structuredClone(jwks);
-	}
-	jwks() {
-		return this.#jwks;
+async function importWithAlgCache(cache, jwk, entry) {
+	const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;
+	if (cached[alg] === void 0) {
+		const pending = jwkToKey(entry, jwk, !0).then((key) => {
+			if (key.type !== "public") throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+			return cached[alg] = key, key;
+		}).catch((error) => {
+			throw cached[alg] === pending && delete cached[alg], error;
+		});
+		cached[alg] = pending;
 	}
-	async getKey(protectedHeader, token) {
+	return cached[alg];
+}
+function createLocalJWKSet(jwks) {
+	let snapshot;
+	try {
+		snapshot = structuredClone(jwks);
+	} catch {}
+	if (!isJwkSet(snapshot)) throw new JWKSInvalid("JSON Web Key Set malformed");
+	const metadata = snapshot.keys.map((jwk) => {
+		const normalized = snapshotJwk(jwk);
+		return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+	}), cached = /* @__PURE__ */ new WeakMap();
+	return Object.defineProperty(async (protectedHeader, token) => {
 		const { alg, kid } = {
 			...protectedHeader,
 			...token?.header
-		};
-		const kty = getKtyFromAlg(alg);
-		const candidates = this.#jwks.keys.filter((jwk) => {
-			let candidate = kty === jwk.kty;
-			if (candidate && typeof kid === "string") candidate = kid === jwk.kid;
-			if (candidate && (typeof jwk.alg === "string" || kty === "AKP")) candidate = alg === jwk.alg;
-			if (candidate && typeof jwk.use === "string") candidate = jwk.use === "sig";
-			if (candidate && Array.isArray(jwk.key_ops)) candidate = jwk.key_ops.includes("verify");
-			if (candidate) switch (alg) {
-				case "ES256":
-					candidate = jwk.crv === "P-256";
-					break;
-				case "ES384":
-					candidate = jwk.crv === "P-384";
-					break;
-				case "ES512":
-					candidate = jwk.crv === "P-521";
-					break;
-				case "Ed25519":
-				case "EdDSA":
-					candidate = jwk.crv === "Ed25519";
-					break;
-			}
-			return candidate;
-		});
-		const { 0: jwk, length } = candidates;
-		if (length === 0) throw new JWKSNoMatchingKey();
+		}, entry = typeof alg == "string" ? JWS[alg] : void 0;
+		if (!entry || entry.secret) throw new JOSENotSupported("Unsupported \"alg\" value for a JSON Web Key Set");
+		const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
+		if (!length) throw new JWKSNoMatchingKey();
 		if (length !== 1) {
 			const error = new JWKSMultipleMatchingKeys();
-			const _cached = this.#cached;
-			error[Symbol.asyncIterator] = async function* () {
-				for (const jwk of candidates) try {
-					yield await importWithAlgCache(_cached, jwk, alg);
+			throw error[Symbol.asyncIterator] = async function* () {
+				for (const jwk2 of candidates) try {
+					yield await importWithAlgCache(cached, jwk2, entry);
 				} catch {}
-			};
-			throw error;
+			}, error;
 		}
-		return importWithAlgCache(this.#cached, jwk, alg);
-	}
-};
-async function importWithAlgCache(cache, jwk, alg) {
-	const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
-	if (cached[alg] === void 0) {
-		const key = await importJWK({
-			...jwk,
-			ext: true
-		}, alg);
-		if (key instanceof Uint8Array || key.type !== "public") throw new JWKSInvalid("JSON Web Key Set members must be public keys");
-		cached[alg] = key;
-	}
-	return cached[alg];
-}
-function createLocalJWKSet(jwks) {
-	const set = new LocalJWKSet(jwks);
-	const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-	Object.defineProperties(localJWKSet, { jwks: {
-		value: () => structuredClone(set.jwks()),
-		enumerable: false,
-		configurable: false,
-		writable: false
-	} });
-	return localJWKSet;
+		return importWithAlgCache(cached, jwk, entry);
+	}, "jwks", { value: () => structuredClone(snapshot) });
 }
 //#endregion
-//#region node_modules/jose/dist/webapi/jwks/remote.js
+//#region ../../node_modules/jose/dist/webapi/jwks/remote.js
 function isCloudflareWorkers() {
-	return typeof WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime !== "undefined" && EdgeRuntime === "vercel";
+	return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 var USER_AGENT;
-if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) USER_AGENT = `jose/v6.2.3`;
-var customFetch = Symbol();
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
+var customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
 	const response = await fetchImpl(url, {
 		method: "GET",
@@ -1030,8 +624,7 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
 		redirect: "manual",
 		headers
 	}).catch((err) => {
-		if (err.name === "TimeoutError") throw new JWKSTimeout();
-		throw err;
+		throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
 	});
 	if (response.status !== 200) throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
 	try {
@@ -1040,121 +633,70 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
 		throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
 	}
 }
-var jwksCache = Symbol();
-function isFreshJwksCache(input, cacheMaxAge) {
-	if (typeof input !== "object" || input === null) return false;
-	if (!("uat" in input) || typeof input.uat !== "number" || Date.now() - input.uat >= cacheMaxAge) return false;
-	if (!("jwks" in input) || !isObject(input.jwks) || !Array.isArray(input.jwks.keys) || !Array.prototype.every.call(input.jwks.keys, isObject)) return false;
-	return true;
+var jwksCache = /* @__PURE__ */ Symbol();
+function isFreshFor(timestamp, duration) {
+	return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
 }
-var RemoteJWKSet = class {
-	#url;
-	#timeoutDuration;
-	#cooldownDuration;
-	#cacheMaxAge;
-	#jwksTimestamp;
-	#pendingFetch;
-	#headers;
-	#customFetch;
-	#local;
-	#cache;
-	constructor(url, options) {
-		if (!(url instanceof URL)) throw new TypeError("url must be an instance of URL");
-		this.#url = new URL(url.href);
-		this.#timeoutDuration = typeof options?.timeoutDuration === "number" ? options?.timeoutDuration : 5e3;
-		this.#cooldownDuration = typeof options?.cooldownDuration === "number" ? options?.cooldownDuration : 3e4;
-		this.#cacheMaxAge = typeof options?.cacheMaxAge === "number" ? options?.cacheMaxAge : 6e5;
-		this.#headers = new Headers(options?.headers);
-		if (USER_AGENT && !this.#headers.has("User-Agent")) this.#headers.set("User-Agent", USER_AGENT);
-		if (!this.#headers.has("accept")) {
-			this.#headers.set("accept", "application/json");
-			this.#headers.append("accept", "application/jwk-set+json");
-		}
-		this.#customFetch = options?.[customFetch];
-		if (options?.[jwksCache] !== void 0) {
-			this.#cache = options?.[jwksCache];
-			if (isFreshJwksCache(options?.[jwksCache], this.#cacheMaxAge)) {
-				this.#jwksTimestamp = this.#cache.uat;
-				this.#local = createLocalJWKSet(this.#cache.jwks);
-			}
+function validateDuration(value, fallback, option) {
+	if (Number.isNaN(value)) throw new TypeError(`"${option}" option must not be NaN`);
+	return typeof value == "number" ? value : fallback;
+}
+function createRemoteJWKSet(url, options) {
+	if (!(url instanceof URL)) throw new TypeError("url must be an instance of URL");
+	const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+	if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0)) throw new TypeError("\"timeoutDuration\" option must be a non-negative integer");
+	const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+	USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+	const fetchImpl = opts[customFetch], cache = opts[jwksCache];
+	let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+	if (cache && typeof cache == "object") {
+		const { uat, jwks } = cache;
+		isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
+	}
+	const reload = async () => {
+		if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+			const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+				const next = createLocalJWKSet(json);
+				if (sequence <= appliedSequence) return;
+				local = next;
+				const updatedAt = Date.now();
+				cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
+			}).finally(() => {
+				pendingFetch === current && (pendingFetch = void 0);
+			});
 		}
-	}
-	pendingFetch() {
-		return !!this.#pendingFetch;
-	}
-	coolingDown() {
-		return typeof this.#jwksTimestamp === "number" ? Date.now() < this.#jwksTimestamp + this.#cooldownDuration : false;
-	}
-	fresh() {
-		return typeof this.#jwksTimestamp === "number" ? Date.now() < this.#jwksTimestamp + this.#cacheMaxAge : false;
-	}
-	jwks() {
-		return this.#local?.jwks();
-	}
-	async getKey(protectedHeader, token) {
-		if (!this.#local || !this.fresh()) await this.reload();
+		await pendingFetch;
+	};
+	return Object.defineProperties(async (protectedHeader, token) => {
+		(!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
 		try {
-			return await this.#local(protectedHeader, token);
+			return await local(protectedHeader, token);
 		} catch (err) {
-			if (err instanceof JWKSNoMatchingKey) {
-				if (this.coolingDown() === false) {
-					await this.reload();
-					return this.#local(protectedHeader, token);
-				}
-			}
+			if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) return await reload(), local(protectedHeader, token);
 			throw err;
 		}
-	}
-	async reload() {
-		if (this.#pendingFetch && isCloudflareWorkers()) this.#pendingFetch = void 0;
-		this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch).then((json) => {
-			this.#local = createLocalJWKSet(json);
-			if (this.#cache) {
-				this.#cache.uat = Date.now();
-				this.#cache.jwks = json;
-			}
-			this.#jwksTimestamp = Date.now();
-			this.#pendingFetch = void 0;
-		}).catch((err) => {
-			this.#pendingFetch = void 0;
-			throw err;
-		});
-		await this.#pendingFetch;
-	}
-};
-function createRemoteJWKSet(url, options) {
-	const set = new RemoteJWKSet(url, options);
-	const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-	Object.defineProperties(remoteJWKSet, {
+	}, {
 		coolingDown: {
-			get: () => set.coolingDown(),
-			enumerable: true,
-			configurable: false
+			get: () => isFreshFor(jwksTimestamp, cooldownDuration),
+			enumerable: !0
 		},
 		fresh: {
-			get: () => set.fresh(),
-			enumerable: true,
-			configurable: false
+			get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
+			enumerable: !0
 		},
 		reload: {
-			value: () => set.reload(),
-			enumerable: true,
-			configurable: false,
-			writable: false
+			value: reload,
+			enumerable: !0
 		},
 		reloading: {
-			get: () => set.pendingFetch(),
-			enumerable: true,
-			configurable: false
+			get: () => !!pendingFetch,
+			enumerable: !0
 		},
 		jwks: {
-			value: () => set.jwks(),
-			enumerable: true,
-			configurable: false,
-			writable: false
+			value: () => local?.jwks(),
+			enumerable: !0
 		}
 	});
-	return remoteJWKSet;
 }
 //#endregion
 //#region src/oidc/auth-oidc.addon.ts
@@ -1338,7 +880,7 @@ var AuthOidcAddon = class extends BaseAddon {
 						type: "text",
 						key: "redirectUri",
 						label: "Redirect URI override",
-						description: "Optional. Default uses CAMSTACK_PUBLIC_ORIGIN + the instance id.",
+						description: "Optional. Default uses the hub address from Network (public tunnel, then mesh, then LAN) + the instance id.",
 						default: ""
 					},
 					{
@@ -1427,12 +969,12 @@ var AuthOidcAddon = class extends BaseAddon {
 		}
 		return doc;
 	}
-	buildRedirectUri(providerId) {
+	async buildRedirectUri(providerId) {
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: no provider configured with id "${providerId}"`);
 		const configured = inst.config.redirectUri?.trim();
 		if (configured) return configured;
-		return `${(process.env["CAMSTACK_PUBLIC_ORIGIN"] || "https://localhost:4443").replace(/\/+$/, "")}/addon/auth-oidc/${providerId}/callback`;
+		return `${await hubBrowserOrigin(this.ctx.api.localNetwork, this.ctx.logger) ?? "https://localhost:4443"}/addon/auth-oidc/${providerId}/callback`;
 	}
 	async buildLoginUrl(providerId, state) {
 		const inst = this.instances.get(providerId);
@@ -1441,17 +983,19 @@ var AuthOidcAddon = class extends BaseAddon {
 		const codeVerifier = crypto$1.randomBytes(32).toString("base64url");
 		const codeChallenge = crypto$1.createHash("sha256").update(codeVerifier).digest("base64url");
 		const nonce = crypto$1.randomBytes(16).toString("base64url");
+		const redirectUri = await this.buildRedirectUri(providerId);
 		this.pruneExpiredStates();
 		this.pendingStates.set(state, {
 			codeVerifier,
 			nonce,
 			providerId,
+			redirectUri,
 			createdAt: Date.now()
 		});
 		const params = new URLSearchParams({
 			response_type: "code",
 			client_id: inst.config.clientId,
-			redirect_uri: this.buildRedirectUri(providerId),
+			redirect_uri: redirectUri,
 			scope: inst.config.scopes || DEFAULT_PROVIDER.scopes,
 			state,
 			nonce,
@@ -1481,7 +1025,7 @@ var AuthOidcAddon = class extends BaseAddon {
 			body: new URLSearchParams({
 				grant_type: "authorization_code",
 				code,
-				redirect_uri: this.buildRedirectUri(providerId),
+				redirect_uri: pending.redirectUri,
 				client_id: inst.config.clientId,
 				client_secret: inst.config.clientSecret,
 				code_verifier: pending.codeVerifier