@genation/sdk 0.2.9 → 0.2.11

package/dist/genation.es.js

@@ -1,150 +1,150 @@
-class m extends Error {
+class N extends Error {
   code;
   cause;
-  constructor(e, t, s) {
-    super(e), this.name = "GenationError", this.code = t, this.cause = s;
+  constructor(t, r, n) {
+    super(t), this.name = "GenationError", this.code = r, this.cause = n;
   }
 }
-class l extends m {
-  constructor(e, t, s) {
-    super(e, t, s), this.name = "AuthError";
+class g extends N {
+  constructor(t, r, n) {
+    super(t, r, n), this.name = "AuthError";
   }
-  static invalidGrant(e = "Invalid authorization code or refresh token") {
-    return new l(e, "invalid_grant");
+  static invalidGrant(t = "Invalid authorization code or refresh token") {
+    return new g(t, "invalid_grant");
   }
-  static accessDenied(e = "User denied access") {
-    return new l(e, "access_denied");
+  static accessDenied(t = "User denied access") {
+    return new g(t, "access_denied");
   }
-  static expiredToken(e = "Token has expired") {
-    return new l(e, "expired_token");
+  static expiredToken(t = "Token has expired") {
+    return new g(t, "expired_token");
   }
-  static invalidState(e = "State mismatch, possible CSRF attack") {
-    return new l(e, "invalid_state");
+  static invalidState(t = "State mismatch, possible CSRF attack") {
+    return new g(t, "invalid_state");
   }
-  static pkceVerificationFailed(e = "PKCE verification failed") {
-    return new l(e, "pkce_verification_failed");
+  static pkceVerificationFailed(t = "PKCE verification failed") {
+    return new g(t, "pkce_verification_failed");
   }
 }
-class h extends m {
+class S extends N {
   status;
-  constructor(e, t, s) {
-    super(e, "network_error", s), this.name = "NetworkError", this.status = t;
+  constructor(t, r, n) {
+    super(t, "network_error", n), this.name = "NetworkError", this.status = r;
   }
-  static fromResponse(e) {
-    return new h(
-      `HTTP ${e.status}: ${e.statusText}`,
-      e.status
+  static fromResponse(t) {
+    return new S(
+      `HTTP ${t.status}: ${t.statusText}`,
+      t.status
     );
   }
 }
-class u extends m {
-  constructor(e) {
-    super(e, "config_error"), this.name = "ConfigError";
+class v extends N {
+  constructor(t) {
+    super(t, "config_error"), this.name = "ConfigError";
   }
-  static missingField(e) {
-    return new u(`Missing required config field: ${e}`);
+  static missingField(t) {
+    return new v(`Missing required config field: ${t}`);
   }
 }
-class p {
+class D {
   baseUrl;
   timeout;
-  constructor(e) {
-    this.baseUrl = e.baseUrl.replace(/\/$/, ""), this.timeout = e.timeout ?? 3e4;
+  constructor(t) {
+    this.baseUrl = t.baseUrl.replace(/\/$/, ""), this.timeout = t.timeout ?? 3e4;
   }
   /**
    * Make an HTTP request
    */
-  async request(e, t = {}) {
-    const { method: s = "GET", headers: n = {}, body: i, params: c } = t;
-    let a = `${this.baseUrl}${e}`;
-    if (c) {
-      const o = new URLSearchParams(c);
-      a += `?${o.toString()}`;
-    }
-    const y = new AbortController(), S = setTimeout(() => y.abort(), this.timeout);
+  async request(t, r = {}) {
+    const { method: n = "GET", headers: s = {}, body: a, params: i } = r;
+    let c = `${this.baseUrl}${t}`;
+    if (i) {
+      const o = new URLSearchParams(i);
+      c += `?${o.toString()}`;
+    }
+    const h = new AbortController(), u = setTimeout(() => h.abort(), this.timeout);
     try {
-      const o = await fetch(a, {
-        method: s,
+      const o = await fetch(c, {
+        method: n,
         headers: {
           "Content-Type": "application/json",
-          ...n
+          ...s
         },
-        body: i ? JSON.stringify(i) : void 0,
-        signal: y.signal
+        body: a ? JSON.stringify(a) : void 0,
+        signal: h.signal
       });
-      if (clearTimeout(S), !o.ok)
-        throw h.fromResponse(o);
+      if (clearTimeout(u), !o.ok)
+        throw S.fromResponse(o);
       return await o.json();
     } catch (o) {
-      throw clearTimeout(S), o instanceof h ? o : o instanceof Error && o.name === "AbortError" ? new h("Request timeout", void 0, o) : new h("Network request failed", void 0, o);
+      throw clearTimeout(u), o instanceof S ? o : o instanceof Error && o.name === "AbortError" ? new S("Request timeout", void 0, o) : new S("Network request failed", void 0, o);
     }
   }
   /**
    * POST request with form data (for OAuth token exchange)
    */
-  async postForm(e, t, s = {}) {
-    const n = `${this.baseUrl}${e}`, i = new AbortController(), c = setTimeout(() => i.abort(), this.timeout);
+  async postForm(t, r, n = {}) {
+    const s = `${this.baseUrl}${t}`, a = new AbortController(), i = setTimeout(() => a.abort(), this.timeout);
     try {
-      const a = await fetch(n, {
+      const c = await fetch(s, {
         method: "POST",
         headers: {
           "Content-Type": "application/x-www-form-urlencoded",
-          ...s
+          ...n
         },
-        body: new URLSearchParams(t).toString(),
-        signal: i.signal
+        body: new URLSearchParams(r).toString(),
+        signal: a.signal
       });
-      if (clearTimeout(c), !a.ok)
-        throw h.fromResponse(a);
-      return await a.json();
-    } catch (a) {
-      throw clearTimeout(c), a instanceof h ? a : new h("Network request failed", void 0, a);
+      if (clearTimeout(i), !c.ok)
+        throw S.fromResponse(c);
+      return await c.json();
+    } catch (c) {
+      throw clearTimeout(i), c instanceof S ? c : new S("Network request failed", void 0, c);
     }
   }
 }
-function k(r) {
-  return btoa(String.fromCharCode(...r)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function $(e) {
+  return btoa(String.fromCharCode(...e)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function _() {
-  const r = new Uint8Array(32);
-  return crypto.getRandomValues(r), k(r);
+function fe() {
+  const e = new Uint8Array(32);
+  return crypto.getRandomValues(e), $(e);
 }
-async function b(r) {
-  const t = new TextEncoder().encode(r), s = await crypto.subtle.digest("SHA-256", t);
-  return k(new Uint8Array(s));
+async function de(e) {
+  const r = new TextEncoder().encode(e), n = await crypto.subtle.digest("SHA-256", r);
+  return $(new Uint8Array(n));
 }
-async function v() {
-  const r = _(), e = await b(r);
+async function le() {
+  const e = fe(), t = await de(e);
   return {
-    codeVerifier: r,
-    codeChallenge: e,
+    codeVerifier: e,
+    codeChallenge: t,
     codeChallengeMethod: "S256"
   };
 }
-function C() {
-  const r = new Uint8Array(16);
-  return crypto.getRandomValues(r), k(r);
+function pe() {
+  const e = new Uint8Array(16);
+  return crypto.getRandomValues(e), $(e);
 }
-const d = "tokens", g = "pkce", f = "state";
-class I {
+const W = "tokens", k = "pkce", I = "state";
+class ye {
   storage;
-  constructor(e) {
-    this.storage = e;
+  constructor(t) {
+    this.storage = t;
   }
   /**
    * Store token set
    */
-  async setTokens(e) {
-    await this.storage.set(d, JSON.stringify(e));
+  async setTokens(t) {
+    await this.storage.set(W, JSON.stringify(t));
   }
   /**
    * Get stored tokens
    */
   async getTokens() {
-    const e = await this.storage.get(d);
-    if (!e) return null;
+    const t = await this.storage.get(W);
+    if (!t) return null;
     try {
-      return JSON.parse(e);
+      return JSON.parse(t);
     } catch {
       return null;
     }
@@ -153,42 +153,42 @@ class I {
    * Clear stored tokens
    */
   async clearTokens() {
-    await this.storage.remove(d);
+    await this.storage.remove(W);
   }
   /**
    * Check if access token is expired
    */
   async isTokenExpired() {
-    const e = await this.getTokens();
-    if (!e) return !0;
-    const t = e.issuedAt + e.expiresIn * 1e3;
-    return Date.now() > t - 6e4;
+    const t = await this.getTokens();
+    if (!t) return !0;
+    const r = t.issuedAt + t.expiresIn * 1e3;
+    return Date.now() > r - 6e4;
   }
   /**
    * Store PKCE verifier for later validation
    */
-  async setPKCE(e) {
-    await this.storage.set(g, e);
+  async setPKCE(t) {
+    await this.storage.set(k, t);
   }
   /**
    * Get and clear stored PKCE verifier
    */
   async consumePKCE() {
-    const e = await this.storage.get(g);
-    return e && await this.storage.remove(g), e;
+    const t = await this.storage.get(k);
+    return t && await this.storage.remove(k), t;
   }
   /**
    * Store state for CSRF validation
    */
-  async setState(e) {
-    await this.storage.set(f, e);
+  async setState(t) {
+    await this.storage.set(I, t);
   }
   /**
    * Get and clear stored state
    */
   async consumeState() {
-    const e = await this.storage.get(f);
-    return e && await this.storage.remove(f), e;
+    const t = await this.storage.get(I);
+    return t && await this.storage.remove(I), t;
   }
   /**
    * Clear all auth-related data
@@ -197,87 +197,87 @@ class I {
     await this.storage.clear();
   }
 }
-const U = "https://mnnoheowoowbtpuoguul.supabase.co/auth/v1";
-class x {
+const ee = "https://mnnoheowoowbtpuoguul.supabase.co/auth/v1";
+class me {
   config;
   http;
   tokenManager;
-  constructor(e, t) {
+  constructor(t, r) {
     this.config = {
-      clientId: e.clientId,
-      clientSecret: e.clientSecret,
-      redirectUri: e.redirectUri,
-      scopes: e.scopes,
-      authUrl: e.authUrl ?? U
-    }, this.http = new p({ baseUrl: this.config.authUrl }), this.tokenManager = t;
+      clientId: t.clientId,
+      clientSecret: t.clientSecret,
+      redirectUri: t.redirectUri,
+      scopes: t.scopes,
+      authUrl: t.authUrl ?? ee
+    }, this.http = new D({ baseUrl: this.config.authUrl }), this.tokenManager = r;
   }
   /**
    * Generate authorization URL for OAuth flow
    * Stores PKCE verifier and state for later validation
    */
   async getAuthorizationUrl() {
-    const e = await v(), t = C();
-    await this.tokenManager.setPKCE(e.codeVerifier), await this.tokenManager.setState(t);
-    const s = new URLSearchParams({
+    const t = await le(), r = pe();
+    await this.tokenManager.setPKCE(t.codeVerifier), await this.tokenManager.setState(r);
+    const n = new URLSearchParams({
       response_type: "code",
       client_id: this.config.clientId,
       redirect_uri: this.config.redirectUri,
-      state: t,
-      code_challenge: e.codeChallenge,
-      code_challenge_method: e.codeChallengeMethod
+      state: r,
+      code_challenge: t.codeChallenge,
+      code_challenge_method: t.codeChallengeMethod
     });
-    return this.config.scopes && this.config.scopes.length > 0 && s.append("scope", this.config.scopes.join(" ")), `${this.config.authUrl}/oauth/authorize?${s.toString()}`;
+    return this.config.scopes && this.config.scopes.length > 0 && n.append("scope", this.config.scopes.join(" ")), `${this.config.authUrl}/oauth/authorize?${n.toString()}`;
   }
   /**
    * Exchange authorization code for tokens
    */
-  async exchangeCode(e, t) {
-    const s = await this.tokenManager.consumeState();
-    if (!s || s !== t)
-      throw l.invalidState();
-    const n = await this.tokenManager.consumePKCE();
-    if (!n)
-      throw l.pkceVerificationFailed("Missing code verifier");
-    const i = await this.http.postForm(
+  async exchangeCode(t, r) {
+    const n = await this.tokenManager.consumeState();
+    if (!n || n !== r)
+      throw g.invalidState();
+    const s = await this.tokenManager.consumePKCE();
+    if (!s)
+      throw g.pkceVerificationFailed("Missing code verifier");
+    const a = await this.http.postForm(
       "/oauth/token",
       {
         grant_type: "authorization_code",
-        code: e,
+        code: t,
         redirect_uri: this.config.redirectUri,
         client_id: this.config.clientId,
         client_secret: this.config.clientSecret,
-        code_verifier: n
+        code_verifier: s
       }
-    ), c = this.mapTokenResponse(i);
-    return await this.tokenManager.setTokens(c), c;
+    ), i = this.mapTokenResponse(a);
+    return await this.tokenManager.setTokens(i), i;
   }
   /**
    * Refresh access token using refresh token
    */
   async refreshToken() {
-    const e = await this.tokenManager.getTokens();
-    if (!e?.refreshToken)
-      throw l.invalidGrant("No refresh token available");
-    const t = await this.http.postForm(
+    const t = await this.tokenManager.getTokens();
+    if (!t?.refreshToken)
+      throw g.invalidGrant("No refresh token available");
+    const r = await this.http.postForm(
       "/oauth/token",
       {
         grant_type: "refresh_token",
-        refresh_token: e.refreshToken,
+        refresh_token: t.refreshToken,
         client_id: this.config.clientId,
         client_secret: this.config.clientSecret
       }
-    ), s = this.mapTokenResponse(t);
-    return await this.tokenManager.setTokens(s), s;
+    ), n = this.mapTokenResponse(r);
+    return await this.tokenManager.setTokens(n), n;
   }
   /**
    * Revoke current tokens
    */
   async revokeToken() {
-    const e = await this.tokenManager.getTokens();
-    if (e)
+    const t = await this.tokenManager.getTokens();
+    if (t)
       try {
         await this.http.postForm("/oauth/revoke", {
-          token: e.accessToken,
+          token: t.accessToken,
           client_id: this.config.clientId,
           client_secret: this.config.clientSecret
         });
@@ -288,132 +288,1171 @@ class x {
   /**
    * Map OAuth token response to TokenSet
    */
-  mapTokenResponse(e) {
+  mapTokenResponse(t) {
     return {
-      accessToken: e.access_token,
-      refreshToken: e.refresh_token,
-      tokenType: e.token_type,
-      expiresIn: e.expires_in,
+      accessToken: t.access_token,
+      refreshToken: t.refresh_token,
+      tokenType: t.token_type,
+      expiresIn: t.expires_in,
       issuedAt: Date.now(),
-      scope: e.scope
+      scope: t.scope
     };
   }
 }
-class E {
+const G = new TextEncoder(), _ = new TextDecoder();
+function we(...e) {
+  const t = e.reduce((s, { length: a }) => s + a, 0), r = new Uint8Array(t);
+  let n = 0;
+  for (const s of e)
+    r.set(s, n), n += s.length;
+  return r;
+}
+function J(e) {
+  const t = new Uint8Array(e.length);
+  for (let r = 0; r < e.length; r++) {
+    const n = e.charCodeAt(r);
+    if (n > 127)
+      throw new TypeError("non-ASCII string encountered in encode()");
+    t[r] = n;
+  }
+  return t;
+}
+function Se(e) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(e);
+  const t = atob(e), r = new Uint8Array(t.length);
+  for (let n = 0; n < t.length; n++)
+    r[n] = t.charCodeAt(n);
+  return r;
+}
+function C(e) {
+  if (Uint8Array.fromBase64)
+    return Uint8Array.fromBase64(typeof e == "string" ? e : _.decode(e), {
+      alphabet: "base64url"
+    });
+  let t = e;
+  t instanceof Uint8Array && (t = _.decode(t)), t = t.replace(/-/g, "+").replace(/_/g, "/");
+  try {
+    return Se(t);
+  } catch {
+    throw new TypeError("The input to be decoded is not correctly encoded.");
+  }
+}
+class l extends Error {
+  static code = "ERR_JOSE_GENERIC";
+  code = "ERR_JOSE_GENERIC";
+  constructor(t, r) {
+    super(t, r), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+class y extends l {
+  static code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  code = "ERR_JWT_CLAIM_VALIDATION_FAILED";
+  claim;
+  reason;
+  payload;
+  constructor(t, r, n = "unspecified", s = "unspecified") {
+    super(t, { cause: { claim: n, reason: s, payload: r } }), this.claim = n, this.reason = s, this.payload = r;
+  }
+}
+class z extends l {
+  static code = "ERR_JWT_EXPIRED";
+  code = "ERR_JWT_EXPIRED";
+  claim;
+  reason;
+  payload;
+  constructor(t, r, n = "unspecified", s = "unspecified") {
+    super(t, { cause: { claim: n, reason: s, payload: r } }), this.claim = n, this.reason = s, this.payload = r;
+  }
+}
+class w extends l {
+  static code = "ERR_JOSE_NOT_SUPPORTED";
+  code = "ERR_JOSE_NOT_SUPPORTED";
+}
+class f extends l {
+  static code = "ERR_JWS_INVALID";
+  code = "ERR_JWS_INVALID";
+}
+class te extends l {
+  static code = "ERR_JWT_INVALID";
+  code = "ERR_JWT_INVALID";
+}
+class re extends l {
+  static code = "ERR_JWKS_INVALID";
+  code = "ERR_JWKS_INVALID";
+}
+class ne extends l {
+  static code = "ERR_JWKS_NO_MATCHING_KEY";
+  code = "ERR_JWKS_NO_MATCHING_KEY";
+  constructor(t = "no applicable key found in the JSON Web Key Set", r) {
+    super(t, r);
+  }
+}
+class ge extends l {
+  [Symbol.asyncIterator];
+  static code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  code = "ERR_JWKS_MULTIPLE_MATCHING_KEYS";
+  constructor(t = "multiple matching keys found in the JSON Web Key Set", r) {
+    super(t, r);
+  }
+}
+class be extends l {
+  static code = "ERR_JWKS_TIMEOUT";
+  code = "ERR_JWKS_TIMEOUT";
+  constructor(t = "request timed out", r) {
+    super(t, r);
+  }
+}
+class Ee extends l {
+  static code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  code = "ERR_JWS_SIGNATURE_VERIFICATION_FAILED";
+  constructor(t = "signature verification failed", r) {
+    super(t, r);
+  }
+}
+const m = (e, t = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`), A = (e, t) => e.name === t;
+function x(e) {
+  return parseInt(e.name.slice(4), 10);
+}
+function Ae(e) {
+  switch (e) {
+    case "ES256":
+      return "P-256";
+    case "ES384":
+      return "P-384";
+    case "ES512":
+      return "P-521";
+    default:
+      throw new Error("unreachable");
+  }
+}
+function Ke(e, t) {
+  if (!e.usages.includes(t))
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`);
+}
+function Te(e, t, r) {
+  switch (t) {
+    case "HS256":
+    case "HS384":
+    case "HS512": {
+      if (!A(e.algorithm, "HMAC"))
+        throw m("HMAC");
+      const n = parseInt(t.slice(2), 10);
+      if (x(e.algorithm.hash) !== n)
+        throw m(`SHA-${n}`, "algorithm.hash");
+      break;
+    }
+    case "RS256":
+    case "RS384":
+    case "RS512": {
+      if (!A(e.algorithm, "RSASSA-PKCS1-v1_5"))
+        throw m("RSASSA-PKCS1-v1_5");
+      const n = parseInt(t.slice(2), 10);
+      if (x(e.algorithm.hash) !== n)
+        throw m(`SHA-${n}`, "algorithm.hash");
+      break;
+    }
+    case "PS256":
+    case "PS384":
+    case "PS512": {
+      if (!A(e.algorithm, "RSA-PSS"))
+        throw m("RSA-PSS");
+      const n = parseInt(t.slice(2), 10);
+      if (x(e.algorithm.hash) !== n)
+        throw m(`SHA-${n}`, "algorithm.hash");
+      break;
+    }
+    case "Ed25519":
+    case "EdDSA": {
+      if (!A(e.algorithm, "Ed25519"))
+        throw m("Ed25519");
+      break;
+    }
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87": {
+      if (!A(e.algorithm, t))
+        throw m(t);
+      break;
+    }
+    case "ES256":
+    case "ES384":
+    case "ES512": {
+      if (!A(e.algorithm, "ECDSA"))
+        throw m("ECDSA");
+      const n = Ae(t);
+      if (e.algorithm.namedCurve !== n)
+        throw m(n, "algorithm.namedCurve");
+      break;
+    }
+    default:
+      throw new TypeError("CryptoKey does not support this operation");
+  }
+  Ke(e, r);
+}
+function se(e, t, ...r) {
+  if (r = r.filter(Boolean), r.length > 2) {
+    const n = r.pop();
+    e += `one of type ${r.join(", ")}, or ${n}.`;
+  } else r.length === 2 ? e += `one of type ${r[0]} or ${r[1]}.` : e += `of type ${r[0]}.`;
+  return t == null ? e += ` Received ${t}` : typeof t == "function" && t.name ? e += ` Received function ${t.name}` : typeof t == "object" && t != null && t.constructor?.name && (e += ` Received an instance of ${t.constructor.name}`), e;
+}
+const ve = (e, ...t) => se("Key must be ", e, ...t), ae = (e, t, ...r) => se(`Key for the ${e} algorithm must be `, t, ...r), ie = (e) => {
+  if (e?.[Symbol.toStringTag] === "CryptoKey")
+    return !0;
+  try {
+    return e instanceof CryptoKey;
+  } catch {
+    return !1;
+  }
+}, oe = (e) => e?.[Symbol.toStringTag] === "KeyObject", ce = (e) => ie(e) || oe(e);
+function Ce(...e) {
+  const t = e.filter(Boolean);
+  if (t.length === 0 || t.length === 1)
+    return !0;
+  let r;
+  for (const n of t) {
+    const s = Object.keys(n);
+    if (!r || r.size === 0) {
+      r = new Set(s);
+      continue;
+    }
+    for (const a of s) {
+      if (r.has(a))
+        return !1;
+      r.add(a);
+    }
+  }
+  return !0;
+}
+const _e = (e) => typeof e == "object" && e !== null;
+function E(e) {
+  if (!_e(e) || Object.prototype.toString.call(e) !== "[object Object]")
+    return !1;
+  if (Object.getPrototypeOf(e) === null)
+    return !0;
+  let t = e;
+  for (; Object.getPrototypeOf(t) !== null; )
+    t = Object.getPrototypeOf(t);
+  return Object.getPrototypeOf(e) === t;
+}
+function Re(e, t) {
+  if (e.startsWith("RS") || e.startsWith("PS")) {
+    const { modulusLength: r } = t.algorithm;
+    if (typeof r != "number" || r < 2048)
+      throw new TypeError(`${e} requires key modulusLength to be 2048 bits or larger`);
+  }
+}
+function Pe(e) {
+  let t, r;
+  switch (e.kty) {
+    case "AKP": {
+      switch (e.alg) {
+        case "ML-DSA-44":
+        case "ML-DSA-65":
+        case "ML-DSA-87":
+          t = { name: e.alg }, r = e.priv ? ["sign"] : ["verify"];
+          break;
+        default:
+          throw new w('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+      }
+      break;
+    }
+    case "RSA": {
+      switch (e.alg) {
+        case "PS256":
+        case "PS384":
+        case "PS512":
+          t = { name: "RSA-PSS", hash: `SHA-${e.alg.slice(-3)}` }, r = e.d ? ["sign"] : ["verify"];
+          break;
+        case "RS256":
+        case "RS384":
+        case "RS512":
+          t = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${e.alg.slice(-3)}` }, r = e.d ? ["sign"] : ["verify"];
+          break;
+        case "RSA-OAEP":
+        case "RSA-OAEP-256":
+        case "RSA-OAEP-384":
+        case "RSA-OAEP-512":
+          t = {
+            name: "RSA-OAEP",
+            hash: `SHA-${parseInt(e.alg.slice(-3), 10) || 1}`
+          }, r = e.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+          break;
+        default:
+          throw new w('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+      }
+      break;
+    }
+    case "EC": {
+      switch (e.alg) {
+        case "ES256":
+          t = { name: "ECDSA", namedCurve: "P-256" }, r = e.d ? ["sign"] : ["verify"];
+          break;
+        case "ES384":
+          t = { name: "ECDSA", namedCurve: "P-384" }, r = e.d ? ["sign"] : ["verify"];
+          break;
+        case "ES512":
+          t = { name: "ECDSA", namedCurve: "P-521" }, r = e.d ? ["sign"] : ["verify"];
+          break;
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          t = { name: "ECDH", namedCurve: e.crv }, r = e.d ? ["deriveBits"] : [];
+          break;
+        default:
+          throw new w('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+      }
+      break;
+    }
+    case "OKP": {
+      switch (e.alg) {
+        case "Ed25519":
+        case "EdDSA":
+          t = { name: "Ed25519" }, r = e.d ? ["sign"] : ["verify"];
+          break;
+        case "ECDH-ES":
+        case "ECDH-ES+A128KW":
+        case "ECDH-ES+A192KW":
+        case "ECDH-ES+A256KW":
+          t = { name: e.crv }, r = e.d ? ["deriveBits"] : [];
+          break;
+        default:
+          throw new w('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+      }
+      break;
+    }
+    default:
+      throw new w('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+  }
+  return { algorithm: t, keyUsages: r };
+}
+async function R(e) {
+  if (!e.alg)
+    throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+  const { algorithm: t, keyUsages: r } = Pe(e), n = { ...e };
+  return n.kty !== "AKP" && delete n.alg, delete n.use, crypto.subtle.importKey("jwk", n, t, e.ext ?? !(e.d || e.priv), e.key_ops ?? r);
+}
+async function We(e, t, r) {
+  if (!E(e))
+    throw new TypeError("JWK must be an object");
+  let n;
+  switch (t ??= e.alg, n ??= e.ext, e.kty) {
+    case "oct":
+      if (typeof e.k != "string" || !e.k)
+        throw new TypeError('missing "k" (Key Value) Parameter value');
+      return C(e.k);
+    case "RSA":
+      if ("oth" in e && e.oth !== void 0)
+        throw new w('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+      return R({ ...e, alg: t, ext: n });
+    case "AKP": {
+      if (typeof e.alg != "string" || !e.alg)
+        throw new TypeError('missing "alg" (Algorithm) Parameter value');
+      if (t !== void 0 && t !== e.alg)
+        throw new TypeError("JWK alg and alg option value mismatch");
+      return R({ ...e, ext: n });
+    }
+    case "EC":
+    case "OKP":
+      return R({ ...e, alg: t, ext: n });
+    default:
+      throw new w('Unsupported "kty" (Key Type) Parameter value');
+  }
+}
+function ke(e, t, r, n, s) {
+  if (s.crit !== void 0 && n?.crit === void 0)
+    throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');
+  if (!n || n.crit === void 0)
+    return /* @__PURE__ */ new Set();
+  if (!Array.isArray(n.crit) || n.crit.length === 0 || n.crit.some((i) => typeof i != "string" || i.length === 0))
+    throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  let a;
+  a = t;
+  for (const i of n.crit) {
+    if (!a.has(i))
+      throw new w(`Extension Header Parameter "${i}" is not recognized`);
+    if (s[i] === void 0)
+      throw new e(`Extension Header Parameter "${i}" is missing`);
+    if (a.get(i) && n[i] === void 0)
+      throw new e(`Extension Header Parameter "${i}" MUST be integrity protected`);
+  }
+  return new Set(n.crit);
+}
+const L = (e) => E(e) && typeof e.kty == "string", Ie = (e) => e.kty !== "oct" && (e.kty === "AKP" && typeof e.priv == "string" || typeof e.d == "string"), Je = (e) => e.kty !== "oct" && e.d === void 0 && e.priv === void 0, xe = (e) => e.kty === "oct" && typeof e.k == "string";
+let T;
+const B = async (e, t, r, n = !1) => {
+  T ||= /* @__PURE__ */ new WeakMap();
+  let s = T.get(e);
+  if (s?.[r])
+    return s[r];
+  const a = await R({ ...t, alg: r });
+  return n && Object.freeze(e), s ? s[r] = a : T.set(e, { [r]: a }), a;
+}, Ue = (e, t) => {
+  T ||= /* @__PURE__ */ new WeakMap();
+  let r = T.get(e);
+  if (r?.[t])
+    return r[t];
+  const n = e.type === "public", s = !!n;
+  let a;
+  if (e.asymmetricKeyType === "x25519") {
+    switch (t) {
+      case "ECDH-ES":
+      case "ECDH-ES+A128KW":
+      case "ECDH-ES+A192KW":
+      case "ECDH-ES+A256KW":
+        break;
+      default:
+        throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+    }
+    a = e.toCryptoKey(e.asymmetricKeyType, s, n ? [] : ["deriveBits"]);
+  }
+  if (e.asymmetricKeyType === "ed25519") {
+    if (t !== "EdDSA" && t !== "Ed25519")
+      throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+    a = e.toCryptoKey(e.asymmetricKeyType, s, [
+      n ? "verify" : "sign"
+    ]);
+  }
+  switch (e.asymmetricKeyType) {
+    case "ml-dsa-44":
+    case "ml-dsa-65":
+    case "ml-dsa-87": {
+      if (t !== e.asymmetricKeyType.toUpperCase())
+        throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+      a = e.toCryptoKey(e.asymmetricKeyType, s, [
+        n ? "verify" : "sign"
+      ]);
+    }
+  }
+  if (e.asymmetricKeyType === "rsa") {
+    let i;
+    switch (t) {
+      case "RSA-OAEP":
+        i = "SHA-1";
+        break;
+      case "RS256":
+      case "PS256":
+      case "RSA-OAEP-256":
+        i = "SHA-256";
+        break;
+      case "RS384":
+      case "PS384":
+      case "RSA-OAEP-384":
+        i = "SHA-384";
+        break;
+      case "RS512":
+      case "PS512":
+      case "RSA-OAEP-512":
+        i = "SHA-512";
+        break;
+      default:
+        throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+    }
+    if (t.startsWith("RSA-OAEP"))
+      return e.toCryptoKey({
+        name: "RSA-OAEP",
+        hash: i
+      }, s, n ? ["encrypt"] : ["decrypt"]);
+    a = e.toCryptoKey({
+      name: t.startsWith("PS") ? "RSA-PSS" : "RSASSA-PKCS1-v1_5",
+      hash: i
+    }, s, [n ? "verify" : "sign"]);
+  }
+  if (e.asymmetricKeyType === "ec") {
+    const c = (/* @__PURE__ */ new Map([
+      ["prime256v1", "P-256"],
+      ["secp384r1", "P-384"],
+      ["secp521r1", "P-521"]
+    ])).get(e.asymmetricKeyDetails?.namedCurve);
+    if (!c)
+      throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+    t === "ES256" && c === "P-256" && (a = e.toCryptoKey({
+      name: "ECDSA",
+      namedCurve: c
+    }, s, [n ? "verify" : "sign"])), t === "ES384" && c === "P-384" && (a = e.toCryptoKey({
+      name: "ECDSA",
+      namedCurve: c
+    }, s, [n ? "verify" : "sign"])), t === "ES512" && c === "P-521" && (a = e.toCryptoKey({
+      name: "ECDSA",
+      namedCurve: c
+    }, s, [n ? "verify" : "sign"])), t.startsWith("ECDH-ES") && (a = e.toCryptoKey({
+      name: "ECDH",
+      namedCurve: c
+    }, s, n ? [] : ["deriveBits"]));
+  }
+  if (!a)
+    throw new TypeError("given KeyObject instance cannot be used for this algorithm");
+  return r ? r[t] = a : T.set(e, { [t]: a }), a;
+};
+async function De(e, t) {
+  if (e instanceof Uint8Array || ie(e))
+    return e;
+  if (oe(e)) {
+    if (e.type === "secret")
+      return e.export();
+    if ("toCryptoKey" in e && typeof e.toCryptoKey == "function")
+      try {
+        return Ue(e, t);
+      } catch (n) {
+        if (n instanceof TypeError)
+          throw n;
+      }
+    let r = e.export({ format: "jwk" });
+    return B(e, r, t);
+  }
+  if (L(e))
+    return e.k ? C(e.k) : B(e, e, t, !0);
+  throw new Error("unreachable");
+}
+const K = (e) => e?.[Symbol.toStringTag], M = (e, t, r) => {
+  if (t.use !== void 0) {
+    let n;
+    switch (r) {
+      case "sign":
+      case "verify":
+        n = "sig";
+        break;
+      case "encrypt":
+      case "decrypt":
+        n = "enc";
+        break;
+    }
+    if (t.use !== n)
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${n}" when present`);
+  }
+  if (t.alg !== void 0 && t.alg !== e)
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${e}" when present`);
+  if (Array.isArray(t.key_ops)) {
+    let n;
+    switch (!0) {
+      case r === "verify":
+      case e === "dir":
+      case e.includes("CBC-HS"):
+        n = r;
+        break;
+      case e.startsWith("PBES2"):
+        n = "deriveBits";
+        break;
+      case /^A\d{3}(?:GCM)?(?:KW)?$/.test(e):
+        !e.includes("GCM") && e.endsWith("KW") ? n = "unwrapKey" : n = r;
+        break;
+      case r === "encrypt":
+        n = "wrapKey";
+        break;
+      case r === "decrypt":
+        n = e.startsWith("RSA") ? "unwrapKey" : "deriveBits";
+        break;
+    }
+    if (n && t.key_ops?.includes?.(n) === !1)
+      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${n}" when present`);
+  }
+  return !0;
+}, Me = (e, t, r) => {
+  if (!(t instanceof Uint8Array)) {
+    if (L(t)) {
+      if (xe(t) && M(e, t, r))
+        return;
+      throw new TypeError('JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present');
+    }
+    if (!ce(t))
+      throw new TypeError(ae(e, t, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array"));
+    if (t.type !== "secret")
+      throw new TypeError(`${K(t)} instances for symmetric algorithms must be of type "secret"`);
+  }
+}, Oe = (e, t, r) => {
+  if (L(t))
+    switch (r) {
+      case "decrypt":
+      case "sign":
+        if (Ie(t) && M(e, t, r))
+          return;
+        throw new TypeError("JSON Web Key for this operation must be a private JWK");
+      case "encrypt":
+      case "verify":
+        if (Je(t) && M(e, t, r))
+          return;
+        throw new TypeError("JSON Web Key for this operation must be a public JWK");
+    }
+  if (!ce(t))
+    throw new TypeError(ae(e, t, "CryptoKey", "KeyObject", "JSON Web Key"));
+  if (t.type === "secret")
+    throw new TypeError(`${K(t)} instances for asymmetric algorithms must not be of type "secret"`);
+  if (t.type === "public")
+    switch (r) {
+      case "sign":
+        throw new TypeError(`${K(t)} instances for asymmetric algorithm signing must be of type "private"`);
+      case "decrypt":
+        throw new TypeError(`${K(t)} instances for asymmetric algorithm decryption must be of type "private"`);
+    }
+  if (t.type === "private")
+    switch (r) {
+      case "verify":
+        throw new TypeError(`${K(t)} instances for asymmetric algorithm verifying must be of type "public"`);
+      case "encrypt":
+        throw new TypeError(`${K(t)} instances for asymmetric algorithm encryption must be of type "public"`);
+    }
+};
+function He(e, t, r) {
+  switch (e.substring(0, 2)) {
+    case "A1":
+    case "A2":
+    case "di":
+    case "HS":
+    case "PB":
+      Me(e, t, r);
+      break;
+    default:
+      Oe(e, t, r);
+  }
+}
+function Ne(e, t) {
+  const r = `SHA-${e.slice(-3)}`;
+  switch (e) {
+    case "HS256":
+    case "HS384":
+    case "HS512":
+      return { hash: r, name: "HMAC" };
+    case "PS256":
+    case "PS384":
+    case "PS512":
+      return { hash: r, name: "RSA-PSS", saltLength: parseInt(e.slice(-3), 10) >> 3 };
+    case "RS256":
+    case "RS384":
+    case "RS512":
+      return { hash: r, name: "RSASSA-PKCS1-v1_5" };
+    case "ES256":
+    case "ES384":
+    case "ES512":
+      return { hash: r, name: "ECDSA", namedCurve: t.namedCurve };
+    case "Ed25519":
+    case "EdDSA":
+      return { name: "Ed25519" };
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87":
+      return { name: e };
+    default:
+      throw new w(`alg ${e} is not supported either by JOSE or your javascript runtime`);
+  }
+}
+async function $e(e, t, r) {
+  if (t instanceof Uint8Array) {
+    if (!e.startsWith("HS"))
+      throw new TypeError(ve(t, "CryptoKey", "KeyObject", "JSON Web Key"));
+    return crypto.subtle.importKey("raw", t, { hash: `SHA-${e.slice(-3)}`, name: "HMAC" }, !1, [r]);
+  }
+  return Te(t, e, r), t;
+}
+async function Le(e, t, r, n) {
+  const s = await $e(e, t, "verify");
+  Re(e, s);
+  const a = Ne(e, s.algorithm);
+  try {
+    return await crypto.subtle.verify(a, s, r, n);
+  } catch {
+    return !1;
+  }
+}
+async function Fe(e, t, r) {
+  if (!E(e))
+    throw new f("Flattened JWS must be an object");
+  if (e.protected === void 0 && e.header === void 0)
+    throw new f('Flattened JWS must have either of the "protected" or "header" members');
+  if (e.protected !== void 0 && typeof e.protected != "string")
+    throw new f("JWS Protected Header incorrect type");
+  if (e.payload === void 0)
+    throw new f("JWS Payload missing");
+  if (typeof e.signature != "string")
+    throw new f("JWS Signature missing or incorrect type");
+  if (e.header !== void 0 && !E(e.header))
+    throw new f("JWS Unprotected Header incorrect type");
+  let n = {};
+  if (e.protected)
+    try {
+      const P = C(e.protected);
+      n = JSON.parse(_.decode(P));
+    } catch {
+      throw new f("JWS Protected Header is invalid");
+    }
+  if (!Ce(n, e.header))
+    throw new f("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const s = {
+    ...n,
+    ...e.header
+  }, a = ke(f, /* @__PURE__ */ new Map([["b64", !0]]), r?.crit, n, s);
+  let i = !0;
+  if (a.has("b64") && (i = n.b64, typeof i != "boolean"))
+    throw new f('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+  const { alg: c } = s;
+  if (typeof c != "string" || !c)
+    throw new f('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (i) {
+    if (typeof e.payload != "string")
+      throw new f("JWS Payload must be a string");
+  } else if (typeof e.payload != "string" && !(e.payload instanceof Uint8Array))
+    throw new f("JWS Payload must be a string or an Uint8Array instance");
+  let h = !1;
+  typeof t == "function" && (t = await t(n, e), h = !0), He(c, t, "verify");
+  const u = we(e.protected !== void 0 ? J(e.protected) : new Uint8Array(), J("."), typeof e.payload == "string" ? i ? J(e.payload) : G.encode(e.payload) : e.payload);
+  let o;
+  try {
+    o = C(e.signature);
+  } catch {
+    throw new f("Failed to base64url decode the signature");
+  }
+  const d = await De(t, c);
+  if (!await Le(c, d, o, u))
+    throw new Ee();
+  let b;
+  if (i)
+    try {
+      b = C(e.payload);
+    } catch {
+      throw new f("Failed to base64url decode the payload");
+    }
+  else typeof e.payload == "string" ? b = G.encode(e.payload) : b = e.payload;
+  const p = { payload: b };
+  return e.protected !== void 0 && (p.protectedHeader = n), e.header !== void 0 && (p.unprotectedHeader = e.header), h ? { ...p, key: d } : p;
+}
+async function Ve(e, t, r) {
+  if (e instanceof Uint8Array && (e = _.decode(e)), typeof e != "string")
+    throw new f("Compact JWS must be a string or Uint8Array");
+  const { 0: n, 1: s, 2: a, length: i } = e.split(".");
+  if (i !== 3)
+    throw new f("Invalid Compact JWS");
+  const c = await Fe({ payload: s, protected: n, signature: a }, t, r), h = { payload: c.payload, protectedHeader: c.protectedHeader };
+  return typeof t == "function" ? { ...h, key: c.key } : h;
+}
+const Ge = (e) => Math.floor(e.getTime() / 1e3), ue = 60, he = ue * 60, F = he * 24, ze = F * 7, Be = F * 365.25, qe = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+function q(e) {
+  const t = qe.exec(e);
+  if (!t || t[4] && t[1])
+    throw new TypeError("Invalid time period format");
+  const r = parseFloat(t[2]), n = t[3].toLowerCase();
+  let s;
+  switch (n) {
+    case "sec":
+    case "secs":
+    case "second":
+    case "seconds":
+    case "s":
+      s = Math.round(r);
+      break;
+    case "minute":
+    case "minutes":
+    case "min":
+    case "mins":
+    case "m":
+      s = Math.round(r * ue);
+      break;
+    case "hour":
+    case "hours":
+    case "hr":
+    case "hrs":
+    case "h":
+      s = Math.round(r * he);
+      break;
+    case "day":
+    case "days":
+    case "d":
+      s = Math.round(r * F);
+      break;
+    case "week":
+    case "weeks":
+    case "w":
+      s = Math.round(r * ze);
+      break;
+    default:
+      s = Math.round(r * Be);
+      break;
+  }
+  return t[1] === "-" || t[4] === "ago" ? -s : s;
+}
+const Y = (e) => e.includes("/") ? e.toLowerCase() : `application/${e.toLowerCase()}`, Ye = (e, t) => typeof e == "string" ? t.includes(e) : Array.isArray(e) ? t.some(Set.prototype.has.bind(new Set(e))) : !1;
+function Xe(e, t, r = {}) {
+  let n;
+  try {
+    n = JSON.parse(_.decode(t));
+  } catch {
+  }
+  if (!E(n))
+    throw new te("JWT Claims Set must be a top-level JSON object");
+  const { typ: s } = r;
+  if (s && (typeof e.typ != "string" || Y(e.typ) !== Y(s)))
+    throw new y('unexpected "typ" JWT header value', n, "typ", "check_failed");
+  const { requiredClaims: a = [], issuer: i, subject: c, audience: h, maxTokenAge: u } = r, o = [...a];
+  u !== void 0 && o.push("iat"), h !== void 0 && o.push("aud"), c !== void 0 && o.push("sub"), i !== void 0 && o.push("iss");
+  for (const p of new Set(o.reverse()))
+    if (!(p in n))
+      throw new y(`missing required "${p}" claim`, n, p, "missing");
+  if (i && !(Array.isArray(i) ? i : [i]).includes(n.iss))
+    throw new y('unexpected "iss" claim value', n, "iss", "check_failed");
+  if (c && n.sub !== c)
+    throw new y('unexpected "sub" claim value', n, "sub", "check_failed");
+  if (h && !Ye(n.aud, typeof h == "string" ? [h] : h))
+    throw new y('unexpected "aud" claim value', n, "aud", "check_failed");
+  let d;
+  switch (typeof r.clockTolerance) {
+    case "string":
+      d = q(r.clockTolerance);
+      break;
+    case "number":
+      d = r.clockTolerance;
+      break;
+    case "undefined":
+      d = 0;
+      break;
+    default:
+      throw new TypeError("Invalid clockTolerance option type");
+  }
+  const { currentDate: V } = r, b = Ge(V || /* @__PURE__ */ new Date());
+  if ((n.iat !== void 0 || u) && typeof n.iat != "number")
+    throw new y('"iat" claim must be a number', n, "iat", "invalid");
+  if (n.nbf !== void 0) {
+    if (typeof n.nbf != "number")
+      throw new y('"nbf" claim must be a number', n, "nbf", "invalid");
+    if (n.nbf > b + d)
+      throw new y('"nbf" claim timestamp check failed', n, "nbf", "check_failed");
+  }
+  if (n.exp !== void 0) {
+    if (typeof n.exp != "number")
+      throw new y('"exp" claim must be a number', n, "exp", "invalid");
+    if (n.exp <= b - d)
+      throw new z('"exp" claim timestamp check failed', n, "exp", "check_failed");
+  }
+  if (u) {
+    const p = b - n.iat, P = typeof u == "number" ? u : q(u);
+    if (p - d > P)
+      throw new z('"iat" claim timestamp check failed (too far in the past)', n, "iat", "check_failed");
+    if (p < 0 - d)
+      throw new y('"iat" claim timestamp check failed (it should be in the past)', n, "iat", "check_failed");
+  }
+  return n;
+}
+async function Qe(e, t, r) {
+  const n = await Ve(e, t, r);
+  if (n.protectedHeader.crit?.includes("b64") && n.protectedHeader.b64 === !1)
+    throw new te("JWTs MUST NOT use unencoded payload");
+  const a = { payload: Xe(n.protectedHeader, n.payload, r), protectedHeader: n.protectedHeader };
+  return typeof t == "function" ? { ...a, key: n.key } : a;
+}
+function Ze(e) {
+  switch (typeof e == "string" && e.slice(0, 2)) {
+    case "RS":
+    case "PS":
+      return "RSA";
+    case "ES":
+      return "EC";
+    case "Ed":
+      return "OKP";
+    case "ML":
+      return "AKP";
+    default:
+      throw new w('Unsupported "alg" value for a JSON Web Key Set');
+  }
+}
+function je(e) {
+  return e && typeof e == "object" && Array.isArray(e.keys) && e.keys.every(et);
+}
+function et(e) {
+  return E(e);
+}
+class tt {
+  #r;
+  #i = /* @__PURE__ */ new WeakMap();
+  constructor(t) {
+    if (!je(t))
+      throw new re("JSON Web Key Set malformed");
+    this.#r = structuredClone(t);
+  }
+  jwks() {
+    return this.#r;
+  }
+  async getKey(t, r) {
+    const { alg: n, kid: s } = { ...t, ...r?.header }, a = Ze(n), i = this.#r.keys.filter((u) => {
+      let o = a === u.kty;
+      if (o && typeof s == "string" && (o = s === u.kid), o && (typeof u.alg == "string" || a === "AKP") && (o = n === u.alg), o && typeof u.use == "string" && (o = u.use === "sig"), o && Array.isArray(u.key_ops) && (o = u.key_ops.includes("verify")), o)
+        switch (n) {
+          case "ES256":
+            o = u.crv === "P-256";
+            break;
+          case "ES384":
+            o = u.crv === "P-384";
+            break;
+          case "ES512":
+            o = u.crv === "P-521";
+            break;
+          case "Ed25519":
+          case "EdDSA":
+            o = u.crv === "Ed25519";
+            break;
+        }
+      return o;
+    }), { 0: c, length: h } = i;
+    if (h === 0)
+      throw new ne();
+    if (h !== 1) {
+      const u = new ge(), o = this.#i;
+      throw u[Symbol.asyncIterator] = async function* () {
+        for (const d of i)
+          try {
+            yield await X(o, d, n);
+          } catch {
+          }
+      }, u;
+    }
+    return X(this.#i, c, n);
+  }
+}
+async function X(e, t, r) {
+  const n = e.get(t) || e.set(t, {}).get(t);
+  if (n[r] === void 0) {
+    const s = await We({ ...t, ext: !0 }, r);
+    if (s instanceof Uint8Array || s.type !== "public")
+      throw new re("JSON Web Key Set members must be public keys");
+    n[r] = s;
+  }
+  return n[r];
+}
+function Q(e) {
+  const t = new tt(e), r = async (n, s) => t.getKey(n, s);
+  return Object.defineProperties(r, {
+    jwks: {
+      value: () => structuredClone(t.jwks()),
+      enumerable: !1,
+      configurable: !1,
+      writable: !1
+    }
+  }), r;
+}
+function rt() {
+  return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
+}
+let O;
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (O = "jose/v6.1.3");
+const nt = /* @__PURE__ */ Symbol();
+async function st(e, t, r, n = fetch) {
+  const s = await n(e, {
+    method: "GET",
+    signal: r,
+    redirect: "manual",
+    headers: t
+  }).catch((a) => {
+    throw a.name === "TimeoutError" ? new be() : a;
+  });
+  if (s.status !== 200)
+    throw new l("Expected 200 OK from the JSON Web Key Set HTTP response");
+  try {
+    return await s.json();
+  } catch {
+    throw new l("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  }
+}
+const U = /* @__PURE__ */ Symbol();
+function at(e, t) {
+  return !(typeof e != "object" || e === null || !("uat" in e) || typeof e.uat != "number" || Date.now() - e.uat >= t || !("jwks" in e) || !E(e.jwks) || !Array.isArray(e.jwks.keys) || !Array.prototype.every.call(e.jwks.keys, E));
+}
+class it {
+  #r;
+  #i;
+  #c;
+  #o;
+  #n;
+  #e;
+  #t;
+  #u;
+  #s;
+  #a;
+  constructor(t, r) {
+    if (!(t instanceof URL))
+      throw new TypeError("url must be an instance of URL");
+    this.#r = new URL(t.href), this.#i = typeof r?.timeoutDuration == "number" ? r?.timeoutDuration : 5e3, this.#c = typeof r?.cooldownDuration == "number" ? r?.cooldownDuration : 3e4, this.#o = typeof r?.cacheMaxAge == "number" ? r?.cacheMaxAge : 6e5, this.#t = new Headers(r?.headers), O && !this.#t.has("User-Agent") && this.#t.set("User-Agent", O), this.#t.has("accept") || (this.#t.set("accept", "application/json"), this.#t.append("accept", "application/jwk-set+json")), this.#u = r?.[nt], r?.[U] !== void 0 && (this.#a = r?.[U], at(r?.[U], this.#o) && (this.#n = this.#a.uat, this.#s = Q(this.#a.jwks)));
+  }
+  pendingFetch() {
+    return !!this.#e;
+  }
+  coolingDown() {
+    return typeof this.#n == "number" ? Date.now() < this.#n + this.#c : !1;
+  }
+  fresh() {
+    return typeof this.#n == "number" ? Date.now() < this.#n + this.#o : !1;
+  }
+  jwks() {
+    return this.#s?.jwks();
+  }
+  async getKey(t, r) {
+    (!this.#s || !this.fresh()) && await this.reload();
+    try {
+      return await this.#s(t, r);
+    } catch (n) {
+      if (n instanceof ne && this.coolingDown() === !1)
+        return await this.reload(), this.#s(t, r);
+      throw n;
+    }
+  }
+  async reload() {
+    this.#e && rt() && (this.#e = void 0), this.#e ||= st(this.#r.href, this.#t, AbortSignal.timeout(this.#i), this.#u).then((t) => {
+      this.#s = Q(t), this.#a && (this.#a.uat = Date.now(), this.#a.jwks = t), this.#n = Date.now(), this.#e = void 0;
+    }).catch((t) => {
+      throw this.#e = void 0, t;
+    }), await this.#e;
+  }
+}
+function ot(e, t) {
+  const r = new it(e, t), n = async (s, a) => r.getKey(s, a);
+  return Object.defineProperties(n, {
+    coolingDown: {
+      get: () => r.coolingDown(),
+      enumerable: !0,
+      configurable: !1
+    },
+    fresh: {
+      get: () => r.fresh(),
+      enumerable: !0,
+      configurable: !1
+    },
+    reload: {
+      value: () => r.reload(),
+      enumerable: !0,
+      configurable: !1,
+      writable: !1
+    },
+    reloading: {
+      get: () => r.pendingFetch(),
+      enumerable: !0,
+      configurable: !1
+    },
+    jwks: {
+      value: () => r.jwks(),
+      enumerable: !0,
+      configurable: !1,
+      writable: !1
+    }
+  }), n;
+}
+const Z = /* @__PURE__ */ new Map();
+async function ct(e, t = `${ee}/.well-known/jwks.json`) {
+  let r = Z.get(t);
+  return r || (r = ot(new URL(t)), Z.set(t, r)), Qe(e, r);
+}
+class ut {
   store = /* @__PURE__ */ new Map();
-  async get(e) {
-    return this.store.get(e) ?? null;
+  async get(t) {
+    return this.store.get(t) ?? null;
   }
-  async set(e, t) {
-    this.store.set(e, t);
+  async set(t, r) {
+    this.store.set(t, r);
   }
-  async remove(e) {
-    this.store.delete(e);
+  async remove(t) {
+    this.store.delete(t);
   }
   async clear() {
     this.store.clear();
   }
 }
-class T {
+class j {
   prefix;
-  constructor(e = "genation") {
-    this.prefix = e;
+  constructor(t = "genation") {
+    this.prefix = t;
   }
-  getKey(e) {
-    return `${this.prefix}:${e}`;
+  getKey(t) {
+    return `${this.prefix}:${t}`;
   }
-  async get(e) {
-    return typeof window > "u" ? null : localStorage.getItem(this.getKey(e));
+  async get(t) {
+    return typeof window > "u" ? null : localStorage.getItem(this.getKey(t));
   }
-  async set(e, t) {
-    typeof window > "u" || localStorage.setItem(this.getKey(e), t);
+  async set(t, r) {
+    typeof window > "u" || localStorage.setItem(this.getKey(t), r);
   }
-  async remove(e) {
-    typeof window > "u" || localStorage.removeItem(this.getKey(e));
+  async remove(t) {
+    typeof window > "u" || localStorage.removeItem(this.getKey(t));
   }
   async clear() {
     if (typeof window > "u") return;
     Object.keys(localStorage).filter(
-      (t) => t.startsWith(`${this.prefix}:`)
-    ).forEach((t) => localStorage.removeItem(t));
+      (r) => r.startsWith(`${this.prefix}:`)
+    ).forEach((r) => localStorage.removeItem(r));
   }
 }
-class A {
+class ht {
   prefix;
-  constructor(e = "genation") {
-    this.prefix = e;
+  constructor(t = "genation") {
+    this.prefix = t;
   }
-  getKey(e) {
-    return `${this.prefix}:${e}`;
+  getKey(t) {
+    return `${this.prefix}:${t}`;
   }
-  async get(e) {
-    return typeof window > "u" ? null : sessionStorage.getItem(this.getKey(e));
+  async get(t) {
+    return typeof window > "u" ? null : sessionStorage.getItem(this.getKey(t));
   }
-  async set(e, t) {
-    typeof window > "u" || sessionStorage.setItem(this.getKey(e), t);
+  async set(t, r) {
+    typeof window > "u" || sessionStorage.setItem(this.getKey(t), r);
   }
-  async remove(e) {
-    typeof window > "u" || sessionStorage.removeItem(this.getKey(e));
+  async remove(t) {
+    typeof window > "u" || sessionStorage.removeItem(this.getKey(t));
   }
   async clear() {
     if (typeof window > "u") return;
     Object.keys(sessionStorage).filter(
-      (t) => t.startsWith(`${this.prefix}:`)
-    ).forEach((t) => sessionStorage.removeItem(t));
+      (r) => r.startsWith(`${this.prefix}:`)
+    ).forEach((r) => sessionStorage.removeItem(r));
   }
 }
-function M(r = "localStorage") {
-  switch (r) {
+function ft(e = "localStorage") {
+  switch (e) {
     case "memory":
-      return new E();
+      return new ut();
     case "localStorage":
-      return new T();
+      return new j();
     case "sessionStorage":
-      return new A();
+      return new ht();
     default:
-      return new T();
+      return new j();
   }
 }
-function w(r) {
-  return Array.isArray(r) ? r.map(w) : typeof r == "object" && r !== null ? Object.fromEntries(
-    Object.entries(r).map(([e, t]) => [
-      e.replace(/_([a-z])/g, (s, n) => n.toUpperCase()),
-      w(t)
+function H(e) {
+  return Array.isArray(e) ? e.map(H) : typeof e == "object" && e !== null ? Object.fromEntries(
+    Object.entries(e).map(([t, r]) => [
+      t.replace(/_([a-z])/g, (n, s) => s.toUpperCase()),
+      H(r)
     ])
-  ) : r;
+  ) : e;
 }
-class K {
+class dt {
   oauth;
   tokenManager;
+  jwksUrl;
   http;
   httpServer;
   listeners = /* @__PURE__ */ new Set();
   initialized = !1;
-  constructor(e) {
-    this.validateConfig(e);
-    const t = typeof e.storage == "object" ? e.storage : M(e.storage);
-    this.tokenManager = new I(t), this.oauth = new x(e, this.tokenManager), this.http = new p({
-      baseUrl: e.authUrl ?? "https://mnnoheowoowbtpuoguul.supabase.co/auth/v1"
-    }), this.httpServer = new p({
+  constructor(t) {
+    this.validateConfig(t);
+    const r = typeof t.storage == "object" ? t.storage : ft(t.storage), n = t.authUrl ?? "https://mnnoheowoowbtpuoguul.supabase.co/auth/v1";
+    this.tokenManager = new ye(r), this.oauth = new me(t, this.tokenManager), this.jwksUrl = `${n}/.well-known/jwks.json`, this.http = new D({
+      baseUrl: n
+    }), this.httpServer = new D({
       baseUrl: "https://ff-api.genation.ai/api/v2/client"
     });
   }
-  validateConfig(e) {
-    if (!e.clientId) throw u.missingField("clientId");
-    if (!e.clientSecret)
-      throw u.missingField("clientSecret");
-    if (!e.redirectUri) throw u.missingField("redirectUri");
+  validateConfig(t) {
+    if (!t.clientId) throw v.missingField("clientId");
+    if (!t.clientSecret)
+      throw v.missingField("clientSecret");
+    if (!t.redirectUri) throw v.missingField("redirectUri");
   }
   /**
    * Emit auth state change event to all listeners
    */
-  async emitAuthStateChange(e) {
-    const t = await this.getSession();
-    this.listeners.forEach((s) => {
+  async emitAuthStateChange(t) {
+    const r = await this.getSession();
+    this.listeners.forEach((n) => {
       try {
-        s(e, t);
-      } catch (n) {
-        console.error("Error in auth state change callback:", n);
+        n(t, r);
+      } catch (s) {
+        console.error("Error in auth state change callback:", s);
       }
     });
   }
@@ -452,15 +1491,15 @@ class K {
    * subscription.unsubscribe();
    * ```
    */
-  onAuthStateChange(e) {
-    return this.listeners.add(e), this.initialized ? setTimeout(() => {
+  onAuthStateChange(t) {
+    return this.listeners.add(t), this.initialized ? setTimeout(() => {
       this.emitAuthStateChange("INITIAL_SESSION");
     }, 0) : (this.initialized = !0, setTimeout(() => {
       this.emitAuthStateChange("INITIAL_SESSION");
     }, 0)), {
       subscription: {
         unsubscribe: () => {
-          this.listeners.delete(e);
+          this.listeners.delete(t);
         }
       }
     };
@@ -506,31 +1545,30 @@ class K {
    * }
    * ```
    */
-  async handleCallback(e) {
-    const t = new URL(e), s = t.searchParams.get("code"), n = t.searchParams.get("state");
-    if (!s || !n)
+  async handleCallback(t) {
+    const r = new URL(t), n = r.searchParams.get("code"), s = r.searchParams.get("state");
+    if (!n || !s)
       throw new Error("Missing code or state");
-    const i = await this.oauth.exchangeCode(s, n);
-    return await this.emitAuthStateChange("SIGNED_IN"), i;
-  }
-  // /**
-  //  * Sign out and revoke tokens
-  //  *
-  //  * Clears local session and revokes tokens on server.
-  //  * Triggers `SIGNED_OUT` event for all listeners.
-  //  *
-  //  * @example
-  //  * ```typescript
-  //  * async function handleLogout() {
-  //  *   await client.signOut();
-  //  *   // onAuthStateChange will fire with SIGNED_OUT event
-  //  * }
-  //  * ```
-  //  */
-  // async signOut(): Promise<void> {
-  //     await this.oauth.revokeToken();
-  //     await this.emitAuthStateChange("SIGNED_OUT");
-  // }
+    const a = await this.oauth.exchangeCode(n, s);
+    return await this.emitAuthStateChange("SIGNED_IN"), a;
+  }
+  /**
+   * Sign out and revoke tokens
+   *
+   * Clears local session.
+   * Triggers `SIGNED_OUT` event for all listeners.
+   *
+   * @example
+   * ```typescript
+   * async function handleLogout() {
+   *   await client.signOut();
+   *   // onAuthStateChange will fire with SIGNED_OUT event
+   * }
+   * ```
+   */
+  async signOut() {
+    await this.tokenManager.clearTokens(), await this.emitAuthStateChange("SIGNED_OUT");
+  }
   /**
    * Get current session
    *
@@ -559,17 +1597,30 @@ class K {
       } catch {
         return null;
       }
-    const t = await this.tokenManager.getTokens();
-    if (!t) return null;
-    const s = await this.fetchUser(t.accessToken);
+    const r = await this.tokenManager.getTokens();
+    if (!r) return null;
+    const n = await this.fetchUser(r.accessToken);
     return {
-      accessToken: t.accessToken,
-      refreshToken: t.refreshToken,
-      expiresIn: t.expiresIn,
-      expiresAt: t.issuedAt + t.expiresIn * 1e3,
-      user: s
+      accessToken: r.accessToken,
+      refreshToken: r.refreshToken,
+      expiresIn: r.expiresIn,
+      expiresAt: r.issuedAt + r.expiresIn * 1e3,
+      user: n
     };
   }
+  /**
+   * Verify a JWT token
+   *
+   * Validates the token signature using the public JWKS.
+   *
+   * @param token - JWT token to verify
+   * @returns Decoded token payload if valid
+   * @throws Error if token is invalid
+   */
+  async verifyToken(t) {
+    const { payload: r } = await ct(t, this.jwksUrl);
+    return r;
+  }
   /**
    * Get licenses
    * @param accessToken - The access token to use for the request
@@ -577,51 +1628,52 @@ class K {
    * @param options.expiresAfter - Query licenses that are expired after the given date, default set to today to get all valid licenses (unexpired licenses)
    * @returns The licenses
    */
-  async getLicenses(e = {}) {
-    const t = await this.getSession();
-    if (!t)
+  async getLicenses(t = {}) {
+    const r = await this.getSession();
+    if (!r)
       return null;
-    const s = t.accessToken, { expiresAfter: n = /* @__PURE__ */ new Date() } = e, i = await this.httpServer.request("/licenses", {
-      headers: { Authorization: `Bearer ${s}` },
-      params: { expiresAfter: n.toISOString() }
+    const n = r.accessToken, { expiresAfter: s = /* @__PURE__ */ new Date() } = t, a = await this.httpServer.request("/licenses", {
+      headers: { Authorization: `Bearer ${n}` },
+      params: { expiresAfter: s.toISOString() }
     });
-    return i.ok ? w(i.data) : (console.error("GenationClient: Error fetching licenses:", i.error), null);
+    return a.ok ? H(a.data) : (console.error("GenationClient: Error fetching licenses:", a.error), null);
   }
   /**
    * Fetch user info from auth server
    */
-  async fetchUser(e) {
+  async fetchUser(t) {
     try {
-      const t = await this.http.request("/oauth/userinfo", {
-        headers: { Authorization: `Bearer ${e}` }
+      const r = await this.http.request("/oauth/userinfo", {
+        headers: { Authorization: `Bearer ${t}` }
       });
       return {
-        sub: t.sub,
-        name: t.name,
-        picture: t.picture,
-        email: t.email,
-        email_verified: t.email_verified,
-        phone_number: t.phone_number,
-        phone_number_verified: t.phone_number_verified
+        sub: r.sub,
+        name: r.name,
+        picture: r.picture,
+        email: r.email,
+        email_verified: r.email_verified,
+        phone_number: r.phone_number,
+        phone_number_verified: r.phone_number_verified
       };
-    } catch (t) {
-      return console.error("GenationClient: Error fetching user:", t), null;
+    } catch (r) {
+      return console.error("GenationClient: Error fetching user:", r), null;
     }
   }
 }
-function $(r) {
-  return new K(r);
+function lt(e) {
+  return new dt(e);
 }
 export {
-  l as AuthError,
-  u as ConfigError,
-  K as GenationClient,
-  m as GenationError,
-  T as LocalStorage,
-  E as MemoryStorage,
-  h as NetworkError,
-  A as SessionStorage,
-  $ as createClient,
-  M as createStorage
+  g as AuthError,
+  v as ConfigError,
+  dt as GenationClient,
+  N as GenationError,
+  j as LocalStorage,
+  ut as MemoryStorage,
+  S as NetworkError,
+  ht as SessionStorage,
+  lt as createClient,
+  ft as createStorage,
+  ct as verifyToken
 };
 //# sourceMappingURL=genation.es.js.map