@golocalinteractive/golocal-cloud-wrapper 1.0.53 → 1.0.56

package/dist/golocal-cloud-wrapper.es243.js

@@ -0,0 +1,89 @@
+import { concat, uint64be } from "./golocal-cloud-wrapper.es241.js";
+import checkIvLength from "./golocal-cloud-wrapper.es299.js";
+import checkCekLength from "./golocal-cloud-wrapper.es300.js";
+import timingSafeEqual from "./golocal-cloud-wrapper.es303.js";
+import { JWEInvalid, JOSENotSupported, JWEDecryptionFailed } from "./golocal-cloud-wrapper.es240.js";
+import crypto, { isCryptoKey } from "./golocal-cloud-wrapper.es294.js";
+import { checkEncCryptoKey } from "./golocal-cloud-wrapper.es301.js";
+import invalidKeyInput from "./golocal-cloud-wrapper.es297.js";
+import { types } from "./golocal-cloud-wrapper.es298.js";
+async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+  if (!(cek instanceof Uint8Array)) {
+    throw new TypeError(invalidKeyInput(cek, "Uint8Array"));
+  }
+  const keySize = parseInt(enc.slice(1, 4), 10);
+  const encKey = await crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", false, ["decrypt"]);
+  const macKey = await crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
+    hash: `SHA-${keySize << 1}`,
+    name: "HMAC"
+  }, false, ["sign"]);
+  const macData = concat(aad, iv, ciphertext, uint64be(aad.length << 3));
+  const expectedTag = new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3));
+  let macCheckPassed;
+  try {
+    macCheckPassed = timingSafeEqual(tag, expectedTag);
+  } catch {
+  }
+  if (!macCheckPassed) {
+    throw new JWEDecryptionFailed();
+  }
+  let plaintext;
+  try {
+    plaintext = new Uint8Array(await crypto.subtle.decrypt({ iv, name: "AES-CBC" }, encKey, ciphertext));
+  } catch {
+  }
+  if (!plaintext) {
+    throw new JWEDecryptionFailed();
+  }
+  return plaintext;
+}
+async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+  let encKey;
+  if (cek instanceof Uint8Array) {
+    encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["decrypt"]);
+  } else {
+    checkEncCryptoKey(cek, enc, "decrypt");
+    encKey = cek;
+  }
+  try {
+    return new Uint8Array(await crypto.subtle.decrypt({
+      additionalData: aad,
+      iv,
+      name: "AES-GCM",
+      tagLength: 128
+    }, encKey, concat(ciphertext, tag)));
+  } catch {
+    throw new JWEDecryptionFailed();
+  }
+}
+const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
+  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
+    throw new TypeError(invalidKeyInput(cek, ...types, "Uint8Array"));
+  }
+  if (!iv) {
+    throw new JWEInvalid("JWE Initialization Vector missing");
+  }
+  if (!tag) {
+    throw new JWEInvalid("JWE Authentication Tag missing");
+  }
+  checkIvLength(enc, iv);
+  switch (enc) {
+    case "A128CBC-HS256":
+    case "A192CBC-HS384":
+    case "A256CBC-HS512":
+      if (cek instanceof Uint8Array)
+        checkCekLength(cek, parseInt(enc.slice(-3), 10));
+      return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
+    case "A128GCM":
+    case "A192GCM":
+    case "A256GCM":
+      if (cek instanceof Uint8Array)
+        checkCekLength(cek, parseInt(enc.slice(1, 4), 10));
+      return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
+    default:
+      throw new JOSENotSupported("Unsupported JWE Content Encryption Algorithm");
+  }
+};
+export {
+  decrypt as default
+};

package/dist/golocal-cloud-wrapper.es244.js

@@ -0,0 +1,24 @@
+const isDisjoint = (...headers) => {
+  const sources = headers.filter(Boolean);
+  if (sources.length === 0 || sources.length === 1) {
+    return true;
+  }
+  let acc;
+  for (const header of sources) {
+    const parameters = Object.keys(header);
+    if (!acc || acc.size === 0) {
+      acc = new Set(parameters);
+      continue;
+    }
+    for (const parameter of parameters) {
+      if (acc.has(parameter)) {
+        return false;
+      }
+      acc.add(parameter);
+    }
+  }
+  return true;
+};
+export {
+  isDisjoint as default
+};

package/dist/golocal-cloud-wrapper.es245.js

@@ -0,0 +1,19 @@
+function isObjectLike(value) {
+  return typeof value === "object" && value !== null;
+}
+function isObject(input) {
+  if (!isObjectLike(input) || Object.prototype.toString.call(input) !== "[object Object]") {
+    return false;
+  }
+  if (Object.getPrototypeOf(input) === null) {
+    return true;
+  }
+  let proto = input;
+  while (Object.getPrototypeOf(proto) !== null) {
+    proto = Object.getPrototypeOf(proto);
+  }
+  return Object.getPrototypeOf(input) === proto;
+}
+export {
+  isObject as default
+};

package/dist/golocal-cloud-wrapper.es246.js

@@ -0,0 +1,127 @@
+import { unwrap as unwrap$1 } from "./golocal-cloud-wrapper.es284.js";
+import { ecdhAllowed, deriveKey } from "./golocal-cloud-wrapper.es285.js";
+import { decrypt } from "./golocal-cloud-wrapper.es286.js";
+import { decrypt as decrypt$1 } from "./golocal-cloud-wrapper.es287.js";
+import { decode } from "./golocal-cloud-wrapper.es242.js";
+import normalize from "./golocal-cloud-wrapper.es288.js";
+import { JOSENotSupported, JWEInvalid } from "./golocal-cloud-wrapper.es240.js";
+import { bitLength } from "./golocal-cloud-wrapper.es247.js";
+import { importJWK } from "./golocal-cloud-wrapper.es156.js";
+import checkKeyType from "./golocal-cloud-wrapper.es252.js";
+import isObject from "./golocal-cloud-wrapper.es245.js";
+import { unwrap } from "./golocal-cloud-wrapper.es289.js";
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
+  var _a, _b;
+  checkKeyType(alg, key, "decrypt");
+  key = await ((_b = (_a = normalize).normalizePrivateKey) == null ? void 0 : _b.call(_a, key, alg)) || key;
+  switch (alg) {
+    case "dir": {
+      if (encryptedKey !== void 0)
+        throw new JWEInvalid("Encountered unexpected JWE Encrypted Key");
+      return key;
+    }
+    case "ECDH-ES":
+      if (encryptedKey !== void 0)
+        throw new JWEInvalid("Encountered unexpected JWE Encrypted Key");
+    case "ECDH-ES+A128KW":
+    case "ECDH-ES+A192KW":
+    case "ECDH-ES+A256KW": {
+      if (!isObject(joseHeader.epk))
+        throw new JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);
+      if (!ecdhAllowed(key))
+        throw new JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime");
+      const epk = await importJWK(joseHeader.epk, alg);
+      let partyUInfo;
+      let partyVInfo;
+      if (joseHeader.apu !== void 0) {
+        if (typeof joseHeader.apu !== "string")
+          throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
+        try {
+          partyUInfo = decode(joseHeader.apu);
+        } catch {
+          throw new JWEInvalid("Failed to base64url decode the apu");
+        }
+      }
+      if (joseHeader.apv !== void 0) {
+        if (typeof joseHeader.apv !== "string")
+          throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
+        try {
+          partyVInfo = decode(joseHeader.apv);
+        } catch {
+          throw new JWEInvalid("Failed to base64url decode the apv");
+        }
+      }
+      const sharedSecret = await deriveKey(epk, key, alg === "ECDH-ES" ? joseHeader.enc : alg, alg === "ECDH-ES" ? bitLength(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
+      if (alg === "ECDH-ES")
+        return sharedSecret;
+      if (encryptedKey === void 0)
+        throw new JWEInvalid("JWE Encrypted Key missing");
+      return unwrap$1(alg.slice(-6), sharedSecret, encryptedKey);
+    }
+    case "RSA1_5":
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      if (encryptedKey === void 0)
+        throw new JWEInvalid("JWE Encrypted Key missing");
+      return decrypt$1(alg, key, encryptedKey);
+    }
+    case "PBES2-HS256+A128KW":
+    case "PBES2-HS384+A192KW":
+    case "PBES2-HS512+A256KW": {
+      if (encryptedKey === void 0)
+        throw new JWEInvalid("JWE Encrypted Key missing");
+      if (typeof joseHeader.p2c !== "number")
+        throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+      const p2cLimit = (options == null ? void 0 : options.maxPBES2Count) || 1e4;
+      if (joseHeader.p2c > p2cLimit)
+        throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
+      if (typeof joseHeader.p2s !== "string")
+        throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
+      let p2s;
+      try {
+        p2s = decode(joseHeader.p2s);
+      } catch {
+        throw new JWEInvalid("Failed to base64url decode the p2s");
+      }
+      return decrypt(alg, key, encryptedKey, joseHeader.p2c, p2s);
+    }
+    case "A128KW":
+    case "A192KW":
+    case "A256KW": {
+      if (encryptedKey === void 0)
+        throw new JWEInvalid("JWE Encrypted Key missing");
+      return unwrap$1(alg, key, encryptedKey);
+    }
+    case "A128GCMKW":
+    case "A192GCMKW":
+    case "A256GCMKW": {
+      if (encryptedKey === void 0)
+        throw new JWEInvalid("JWE Encrypted Key missing");
+      if (typeof joseHeader.iv !== "string")
+        throw new JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
+      if (typeof joseHeader.tag !== "string")
+        throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
+      let iv;
+      try {
+        iv = decode(joseHeader.iv);
+      } catch {
+        throw new JWEInvalid("Failed to base64url decode the iv");
+      }
+      let tag;
+      try {
+        tag = decode(joseHeader.tag);
+      } catch {
+        throw new JWEInvalid("Failed to base64url decode the tag");
+      }
+      return unwrap(alg, key, encryptedKey, iv, tag);
+    }
+    default: {
+      throw new JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
+    }
+  }
+}
+export {
+  decryptKeyManagement as default
+};

package/dist/golocal-cloud-wrapper.es247.js

@@ -0,0 +1,24 @@
+import { JOSENotSupported } from "./golocal-cloud-wrapper.es240.js";
+import random from "./golocal-cloud-wrapper.es283.js";
+function bitLength(alg) {
+  switch (alg) {
+    case "A128GCM":
+      return 128;
+    case "A192GCM":
+      return 192;
+    case "A256GCM":
+    case "A128CBC-HS256":
+      return 256;
+    case "A192CBC-HS384":
+      return 384;
+    case "A256CBC-HS512":
+      return 512;
+    default:
+      throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
+  }
+}
+const generateCek = (alg) => random(new Uint8Array(bitLength(alg) >> 3));
+export {
+  bitLength,
+  generateCek as default
+};

package/dist/golocal-cloud-wrapper.es248.js

@@ -0,0 +1,33 @@
+import { JOSENotSupported } from "./golocal-cloud-wrapper.es240.js";
+function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+  if (joseHeader.crit !== void 0 && (protectedHeader == null ? void 0 : protectedHeader.crit) === void 0) {
+    throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+  }
+  if (!protectedHeader || protectedHeader.crit === void 0) {
+    return /* @__PURE__ */ new Set();
+  }
+  if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) {
+    throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+  }
+  let recognized;
+  if (recognizedOption !== void 0) {
+    recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
+  } else {
+    recognized = recognizedDefault;
+  }
+  for (const parameter of protectedHeader.crit) {
+    if (!recognized.has(parameter)) {
+      throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+    }
+    if (joseHeader[parameter] === void 0) {
+      throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+    }
+    if (recognized.get(parameter) && protectedHeader[parameter] === void 0) {
+      throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
+    }
+  }
+  return new Set(protectedHeader.crit);
+}
+export {
+  validateCrit as default
+};

package/dist/golocal-cloud-wrapper.es249.js

@@ -0,0 +1,12 @@
+const validateAlgorithms = (option, algorithms) => {
+  if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
+    throw new TypeError(`"${option}" option must be an array of strings`);
+  }
+  if (!algorithms) {
+    return void 0;
+  }
+  return new Set(algorithms);
+};
+export {
+  validateAlgorithms as default
+};

package/dist/golocal-cloud-wrapper.es25.js

@@ -0,0 +1,17 @@
+import createLucideIcon from "./golocal-cloud-wrapper.es61.js";
+/**
+ * @license lucide-react v0.522.0 - ISC
+ *
+ * This source code is licensed under the ISC license.
+ * See the LICENSE file in the root directory of this source tree.
+ */
+const __iconNode = [
+  ["path", { d: "m16 17 5-5-5-5", key: "1bji2h" }],
+  ["path", { d: "M21 12H9", key: "dn1m92" }],
+  ["path", { d: "M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4", key: "1uf3rs" }]
+];
+const LogOut = createLucideIcon("log-out", __iconNode);
+export {
+  __iconNode,
+  LogOut as default
+};

package/dist/golocal-cloud-wrapper.es250.js

@@ -0,0 +1,24 @@
+import { flattenedVerify } from "./golocal-cloud-wrapper.es198.js";
+import { JWSInvalid } from "./golocal-cloud-wrapper.es240.js";
+import { decoder } from "./golocal-cloud-wrapper.es241.js";
+async function compactVerify(jws, key, options) {
+  if (jws instanceof Uint8Array) {
+    jws = decoder.decode(jws);
+  }
+  if (typeof jws !== "string") {
+    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+  }
+  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+  if (length !== 3) {
+    throw new JWSInvalid("Invalid Compact JWS");
+  }
+  const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);
+  const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
+  if (typeof key === "function") {
+    return { ...result, key: verified.key };
+  }
+  return result;
+}
+export {
+  compactVerify
+};

package/dist/golocal-cloud-wrapper.es251.js

@@ -0,0 +1,17 @@
+import subtleDsa from "./golocal-cloud-wrapper.es293.js";
+import crypto from "./golocal-cloud-wrapper.es294.js";
+import checkKeyLength from "./golocal-cloud-wrapper.es295.js";
+import getCryptoKey from "./golocal-cloud-wrapper.es296.js";
+const verify = async (alg, key, signature, data) => {
+  const cryptoKey = await getCryptoKey(alg, key, "verify");
+  checkKeyLength(alg, cryptoKey);
+  const algorithm = subtleDsa(alg, cryptoKey.algorithm);
+  try {
+    return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+  } catch {
+    return false;
+  }
+};
+export {
+  verify as default
+};

package/dist/golocal-cloud-wrapper.es252.js

@@ -0,0 +1,78 @@
+import { withAlg } from "./golocal-cloud-wrapper.es297.js";
+import isKeyLike, { types } from "./golocal-cloud-wrapper.es298.js";
+import { isJWK, isSecretJWK, isPublicJWK, isPrivateJWK } from "./golocal-cloud-wrapper.es253.js";
+const tag = (key) => key == null ? void 0 : key[Symbol.toStringTag];
+const jwkMatchesOp = (alg, key, usage) => {
+  var _a, _b;
+  if (key.use !== void 0 && key.use !== "sig") {
+    throw new TypeError("Invalid key for this operation, when present its use must be sig");
+  }
+  if (key.key_ops !== void 0 && ((_b = (_a = key.key_ops).includes) == null ? void 0 : _b.call(_a, usage)) !== true) {
+    throw new TypeError(`Invalid key for this operation, when present its key_ops must include ${usage}`);
+  }
+  if (key.alg !== void 0 && key.alg !== alg) {
+    throw new TypeError(`Invalid key for this operation, when present its alg must be ${alg}`);
+  }
+  return true;
+};
+const symmetricTypeCheck = (alg, key, usage, allowJwk) => {
+  if (key instanceof Uint8Array)
+    return;
+  if (allowJwk && isJWK(key)) {
+    if (isSecretJWK(key) && jwkMatchesOp(alg, key, usage))
+      return;
+    throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+  }
+  if (!isKeyLike(key)) {
+    throw new TypeError(withAlg(alg, key, ...types, "Uint8Array", allowJwk ? "JSON Web Key" : null));
+  }
+  if (key.type !== "secret") {
+    throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
+  }
+};
+const asymmetricTypeCheck = (alg, key, usage, allowJwk) => {
+  if (allowJwk && isJWK(key)) {
+    switch (usage) {
+      case "sign":
+        if (isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))
+          return;
+        throw new TypeError(`JSON Web Key for this operation be a private JWK`);
+      case "verify":
+        if (isPublicJWK(key) && jwkMatchesOp(alg, key, usage))
+          return;
+        throw new TypeError(`JSON Web Key for this operation be a public JWK`);
+    }
+  }
+  if (!isKeyLike(key)) {
+    throw new TypeError(withAlg(alg, key, ...types, allowJwk ? "JSON Web Key" : null));
+  }
+  if (key.type === "secret") {
+    throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
+  }
+  if (usage === "sign" && key.type === "public") {
+    throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
+  }
+  if (usage === "decrypt" && key.type === "public") {
+    throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
+  }
+  if (key.algorithm && usage === "verify" && key.type === "private") {
+    throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
+  }
+  if (key.algorithm && usage === "encrypt" && key.type === "private") {
+    throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
+  }
+};
+function checkKeyType(allowJwk, alg, key, usage) {
+  const symmetric = alg.startsWith("HS") || alg === "dir" || alg.startsWith("PBES2") || /^A\d{3}(?:GCM)?KW$/.test(alg);
+  if (symmetric) {
+    symmetricTypeCheck(alg, key, usage, allowJwk);
+  } else {
+    asymmetricTypeCheck(alg, key, usage, allowJwk);
+  }
+}
+const checkKeyType$1 = checkKeyType.bind(void 0, false);
+const checkKeyTypeWithJwk = checkKeyType.bind(void 0, true);
+export {
+  checkKeyTypeWithJwk,
+  checkKeyType$1 as default
+};

package/dist/golocal-cloud-wrapper.es253.js

@@ -0,0 +1,19 @@
+import isObject from "./golocal-cloud-wrapper.es245.js";
+function isJWK(key) {
+  return isObject(key) && typeof key.kty === "string";
+}
+function isPrivateJWK(key) {
+  return key.kty !== "oct" && typeof key.d === "string";
+}
+function isPublicJWK(key) {
+  return key.kty !== "oct" && typeof key.d === "undefined";
+}
+function isSecretJWK(key) {
+  return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
+}
+export {
+  isJWK,
+  isPrivateJWK,
+  isPublicJWK,
+  isSecretJWK
+};

package/dist/golocal-cloud-wrapper.es254.js

@@ -0,0 +1,102 @@
+import { JWTInvalid, JWTClaimValidationFailed, JWTExpired } from "./golocal-cloud-wrapper.es240.js";
+import { decoder } from "./golocal-cloud-wrapper.es241.js";
+import epoch from "./golocal-cloud-wrapper.es291.js";
+import secs from "./golocal-cloud-wrapper.es292.js";
+import isObject from "./golocal-cloud-wrapper.es245.js";
+const normalizeTyp = (value) => value.toLowerCase().replace(/^application\//, "");
+const checkAudiencePresence = (audPayload, audOption) => {
+  if (typeof audPayload === "string") {
+    return audOption.includes(audPayload);
+  }
+  if (Array.isArray(audPayload)) {
+    return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
+  }
+  return false;
+};
+const jwtPayload = (protectedHeader, encodedPayload, options = {}) => {
+  let payload;
+  try {
+    payload = JSON.parse(decoder.decode(encodedPayload));
+  } catch {
+  }
+  if (!isObject(payload)) {
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+  }
+  const { typ } = options;
+  if (typ && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", "check_failed");
+  }
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
+  const presenceCheck = [...requiredClaims];
+  if (maxTokenAge !== void 0)
+    presenceCheck.push("iat");
+  if (audience !== void 0)
+    presenceCheck.push("aud");
+  if (subject !== void 0)
+    presenceCheck.push("sub");
+  if (issuer !== void 0)
+    presenceCheck.push("iss");
+  for (const claim of new Set(presenceCheck.reverse())) {
+    if (!(claim in payload)) {
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+    }
+  }
+  if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
+    throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, "iss", "check_failed");
+  }
+  if (subject && payload.sub !== subject) {
+    throw new JWTClaimValidationFailed('unexpected "sub" claim value', payload, "sub", "check_failed");
+  }
+  if (audience && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) {
+    throw new JWTClaimValidationFailed('unexpected "aud" claim value', payload, "aud", "check_failed");
+  }
+  let tolerance;
+  switch (typeof options.clockTolerance) {
+    case "string":
+      tolerance = secs(options.clockTolerance);
+      break;
+    case "number":
+      tolerance = options.clockTolerance;
+      break;
+    case "undefined":
+      tolerance = 0;
+      break;
+    default:
+      throw new TypeError("Invalid clockTolerance option type");
+  }
+  const { currentDate } = options;
+  const now = epoch(currentDate || /* @__PURE__ */ new Date());
+  if ((payload.iat !== void 0 || maxTokenAge) && typeof payload.iat !== "number") {
+    throw new JWTClaimValidationFailed('"iat" claim must be a number', payload, "iat", "invalid");
+  }
+  if (payload.nbf !== void 0) {
+    if (typeof payload.nbf !== "number") {
+      throw new JWTClaimValidationFailed('"nbf" claim must be a number', payload, "nbf", "invalid");
+    }
+    if (payload.nbf > now + tolerance) {
+      throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", "check_failed");
+    }
+  }
+  if (payload.exp !== void 0) {
+    if (typeof payload.exp !== "number") {
+      throw new JWTClaimValidationFailed('"exp" claim must be a number', payload, "exp", "invalid");
+    }
+    if (payload.exp <= now - tolerance) {
+      throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", "check_failed");
+    }
+  }
+  if (maxTokenAge) {
+    const age = now - payload.iat;
+    const max = typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge);
+    if (age - tolerance > max) {
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", "check_failed");
+    }
+    if (age < 0 - tolerance) {
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", "check_failed");
+    }
+  }
+  return payload;
+};
+export {
+  jwtPayload as default
+};

package/dist/golocal-cloud-wrapper.es255.js

@@ -0,0 +1,29 @@
+import { FlattenedEncrypt } from "./golocal-cloud-wrapper.es256.js";
+class CompactEncrypt {
+  constructor(plaintext) {
+    this._flattened = new FlattenedEncrypt(plaintext);
+  }
+  setContentEncryptionKey(cek) {
+    this._flattened.setContentEncryptionKey(cek);
+    return this;
+  }
+  setInitializationVector(iv) {
+    this._flattened.setInitializationVector(iv);
+    return this;
+  }
+  setProtectedHeader(protectedHeader) {
+    this._flattened.setProtectedHeader(protectedHeader);
+    return this;
+  }
+  setKeyManagementParameters(parameters) {
+    this._flattened.setKeyManagementParameters(parameters);
+    return this;
+  }
+  async encrypt(key, options) {
+    const jwe = await this._flattened.encrypt(key, options);
+    return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
+  }
+}
+export {
+  CompactEncrypt
+};