@sourceregistry/node-jwt 1.2.1 → 1.3.0

package/dist/index.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs.js","sources":["../src/index.ts"],"sourcesContent":["import crypto, {\n    createHmac,\n    createSign,\n    createVerify,\n    sign as cryptoSign,\n    verify as cryptoVerify,\n    timingSafeEqual,\n    type BinaryLike,\n    type KeyLike\n} from 'crypto';\n\n// Base64URL helpers (padding-safe)\nexport const base64Url = {\n    encode: (input: string | Buffer): string =>\n        Buffer.from(input).toString('base64url'),\n\n    decode: (input: string): string => {\n        // Node.js Buffer handles unpadded base64url since v16, but we normalize for safety\n        return Buffer.from(input, 'base64url').toString();\n    }\n};\n\n// Timing-safe string comparison to prevent timing attacks\nconst timingSafeCompare = (a: string, b: string): boolean => {\n    if (a.length !== b.length) {\n        return false;\n    }\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n};\n\n// Standard JWT payload claims\nexport interface JWTPayload {\n    /**\n     * Issuer\n     */\n    iss?: string;\n    /**\n     * Subject\n     */\n    sub?: string;\n    /**\n     * Audience\n     */\n    aud?: string | string[];\n    /**\n     * Expiration Time (as UNIX timestamp)\n     */\n    exp?: number;\n    /**\n     * Not Before (as UNIX timestamp)\n     */\n    nbf?: number;\n    /**\n     * Issued At (as UNIX timestamp)\n     */\n    iat?: number;\n    /**\n     * JWT ID\n     */\n    jti?: string;\n    /**\n     * Session ID\n     */\n    sid?: string;\n\n    /**\n     * Custom claims\n     */\n    [key: string]: unknown;\n}\n\nexport interface JWTHeader {\n    alg: string; // Allow unknown algs during decode\n    typ?: string;\n    kid?: string;\n}\n\nexport interface JWT {\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string;\n}\n\n// Signature algorithms\nexport const SignatureAlgorithm = {\n    // HMAC\n    HS256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha256', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            const expected = createHmac('sha256', secret).update(data).digest('base64url');\n            return timingSafeCompare(expected, signature);\n        }\n    },\n    HS384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha384', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            const expected = createHmac('sha384', secret).update(data).digest('base64url');\n            return timingSafeCompare(expected, signature);\n        }\n    },\n    HS512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createHmac('sha512', secret).update(data).digest('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            const expected = createHmac('sha512', secret).update(data).digest('base64url');\n            return timingSafeCompare(expected, signature);\n        }\n    },\n\n    // RSA (DER-encoded signatures, base64url)\n    RS256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA256').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA256')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    RS384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA384').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA384')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    RS512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA512').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA512')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n\n    // ECDSA (DER-encoded by default — no dsaEncoding!)\n    ES256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA256').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('SHA256')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    ES384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA384').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('SHA384')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    ES512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA512').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('SHA512')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    ES256K: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('SHA256').update(data).end().sign(secret).toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('SHA256')\n                    .update(data)\n                    .end()\n                    .verify(secret, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    PS256: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA256')\n                .update(data)\n                .end()\n                .sign({\n                    //@ts-ignore\n                    key: secret,\n                    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                    saltLength: 32\n                })\n                .toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA256')\n                    .update(data)\n                    .end()\n                    .verify({\n                        //@ts-ignore\n                        key: secret,\n                        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                        saltLength: 32\n                    }, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    PS384: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA384')\n                .update(data)\n                .end()\n                .sign({\n                    //@ts-ignore\n                    key: secret,\n                    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                    saltLength: 48\n                })\n                .toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA384')\n                    .update(data)\n                    .end()\n                    .verify({\n                        //@ts-ignore\n                        key: secret,\n                        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                        saltLength: 48\n                    }, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    PS512: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            createSign('RSA-SHA512')\n                .update(data)\n                .end()\n                .sign({\n                    //@ts-ignore\n                    key: secret,\n                    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                    saltLength: 64\n                })\n                .toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return createVerify('RSA-SHA512')\n                    .update(data)\n                    .end()\n                    .verify({\n                        //@ts-ignore\n                        key: secret,\n                        padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                        saltLength: 64\n                    }, Buffer.from(signature, 'base64url'));\n            } catch {\n                return false;\n            }\n        }\n    },\n    EdDSA: {\n        sign: (data: BinaryLike, secret: KeyLike) =>\n            cryptoSign(null, typeof data === 'string' ? Buffer.from(data, 'utf8') : data, secret)\n                .toString('base64url'),\n        verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n            try {\n                return cryptoVerify(\n                    null,\n                    typeof data === 'string' ? Buffer.from(data, 'utf8') : data,\n                    secret,\n                    Buffer.from(signature, 'base64url')\n                );\n            } catch {\n                return false;\n            }\n        }\n    }\n} as const;\n\nexport type SupportedAlgorithm = keyof typeof SignatureAlgorithm;\n\nexport const SupportedAlgorithms = Object.keys(SignatureAlgorithm) as Array<SupportedAlgorithm>;\n\n/**\n * Decode a JWT string into its parts (without verification)\n */\nexport const decode = (token: string): JWT => {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n        throw new Error('Invalid JWT: must contain exactly 3 parts separated by \".\"');\n    }\n\n    const [headerPart, payloadPart, signature] = parts;\n\n    if (!headerPart || !payloadPart || !signature) {\n        throw new Error('Invalid JWT: empty part detected');\n    }\n\n    try {\n        const header = JSON.parse(base64Url.decode(headerPart)) as JWTHeader;\n        const payload = JSON.parse(base64Url.decode(payloadPart)) as JWTPayload;\n        return {header, payload, signature};\n    } catch (err) {\n        throw new Error(`Invalid JWT: malformed header or payload (${(err as Error).message})`);\n    }\n};\n\n/**\n * Sign a JWT\n */\nexport const sign = (\n    payload: JWTPayload,\n    secret: KeyLike,\n    options: {\n        alg?: SupportedAlgorithm;\n        kid?: string;\n        typ?: string;\n    } = {}\n): string => {\n    const alg = options.alg ?? 'HS256';\n    const typ = options.typ ?? 'JWT';\n\n    if (!(alg in SignatureAlgorithm)) {\n        throw new Error(`Unsupported algorithm: ${alg}`);\n    }\n\n    const header: JWTHeader = {alg, typ};\n    if (options.kid) header.kid = options.kid;\n\n    const headerEncoded = base64Url.encode(JSON.stringify(header));\n    const payloadEncoded = base64Url.encode(JSON.stringify(payload));\n\n    const signingInput = `${headerEncoded}.${payloadEncoded}`;\n    const signature = SignatureAlgorithm[alg].sign(signingInput, secret);\n\n    return `${headerEncoded}.${payloadEncoded}.${signature}`;\n};\n\n/**\n * Verify and validate a JWT\n */\nexport const verify = (\n    token: string,\n    secret: KeyLike,\n    options: {\n        algorithms?: SupportedAlgorithm[]; // Whitelist of allowed algorithms\n        issuer?: string;\n        subject?: string;\n        audience?: string | string[];\n        jwtId?: string;\n        ignoreExpiration?: boolean;\n        clockSkew?: number; // in seconds, default 0\n        maxTokenAge?: number; // Maximum age in seconds\n    } = {}\n):\n    | { valid: true; header: JWTHeader; payload: JWTPayload; signature: string }\n    | { valid: false; error: { reason: string; code: string } } => {\n    let decoded: JWT;\n    try {\n        decoded = decode(token);\n    } catch (err) {\n        return {\n            valid: false,\n            error: {\n                reason: (err as Error).message,\n                code: 'INVALID_TOKEN'\n            }\n        };\n    }\n\n    const {header, payload, signature} = decoded;\n\n    // Validate algorithm\n    const alg = header.alg as SupportedAlgorithm;\n    if (!(alg in SignatureAlgorithm)) {\n        return {\n            valid: false,\n            error: {\n                reason: `Unsupported or unknown algorithm: ${header.alg}`,\n                code: 'INVALID_ALGORITHM'\n            }\n        };\n    }\n\n    // Algorithm whitelist validation (prevents algorithm confusion attacks)\n    if (options.algorithms && options.algorithms.length > 0) {\n        if (!options.algorithms.includes(alg)) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Algorithm \"${alg}\" is not in the allowed algorithms list`,\n                    code: 'ALGORITHM_NOT_ALLOWED'\n                }\n            };\n        }\n    }\n\n    // Validate 'typ' header (must be 'JWT' if present)\n    if (header.typ !== undefined && header.typ !== 'JWT') {\n        return {\n            valid: false,\n            error: {\n                reason: `Invalid token type: expected 'JWT', got '${header.typ}'`,\n                code: 'INVALID_TYPE'\n            }\n        };\n    }\n\n    // Verify signature\n    const signingInput = `${base64Url.encode(JSON.stringify(header))}.${base64Url.encode(JSON.stringify(payload))}`;\n    const isValidSignature = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n\n    if (!isValidSignature) {\n        return {\n            valid: false,\n            error: {\n                reason: \"Signature verification failed\",\n                code: 'INVALID_SIGNATURE'\n            }\n        };\n    }\n\n    // Time validation\n    const now = Math.floor(Date.now() / 1000);\n    const skew = options.clockSkew ?? 0;\n\n    if (!options.ignoreExpiration) {\n        if (payload.exp !== undefined && now > payload.exp + skew) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token expired',\n                    code: 'TOKEN_EXPIRED'\n                }\n            };\n        }\n    }\n\n    if (payload.nbf !== undefined && now + skew < payload.nbf) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token not yet valid',\n                code: 'TOKEN_NOT_ACTIVE'\n            }\n        };\n    }\n\n    if (payload.iat !== undefined && now + skew < payload.iat) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token issued in the future',\n                code: 'TOKEN_FUTURE_ISSUED'\n            }\n        };\n    }\n\n    // Maximum token age validation\n    if (options.maxTokenAge !== undefined && payload.iat !== undefined) {\n        const tokenAge = now - payload.iat;\n        if (tokenAge > options.maxTokenAge) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Token age (${tokenAge}s) exceeds maximum allowed age (${options.maxTokenAge}s)`,\n                    code: 'TOKEN_TOO_OLD'\n                }\n            };\n        }\n    }\n\n    // --- Claim validations (only if options provided) ---\n\n    // Issuer (`iss`)\n    if (options.issuer !== undefined) {\n        if (payload.iss === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required issuer claim (\"iss\")',\n                    code: 'MISSING_ISSUER'\n                }\n            };\n        }\n        if (options.issuer !== payload.iss) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid token issuer: expected \"${options.issuer}\", got \"${payload.iss}\"`,\n                    code: 'INVALID_ISSUER'\n                }\n            };\n        }\n    }\n\n    // Subject (`sub`)\n    if (options.subject !== undefined) {\n        if (payload.sub === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required subject claim (\"sub\")',\n                    code: 'MISSING_SUBJECT'\n                }\n            };\n        }\n        if (options.subject !== payload.sub) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid token subject: expected \"${options.subject}\", got \"${payload.sub}\"`,\n                    code: 'INVALID_SUBJECT'\n                }\n            };\n        }\n    }\n\n    // Audience (`aud`)\n    if (options.audience !== undefined) {\n        const aud = payload.aud;\n        if (aud === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required audience claim (\"aud\")',\n                    code: 'MISSING_AUDIENCE'\n                }\n            };\n        }\n\n        const expectedAud = Array.isArray(options.audience) ? options.audience : [options.audience];\n        const tokenAud = Array.isArray(aud) ? aud : [aud];\n\n        const hasMatch = expectedAud.some(a => tokenAud.includes(a));\n        if (!hasMatch) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Audience claim mismatch',\n                    code: 'INVALID_AUDIENCE'\n                }\n            };\n        }\n    }\n\n    // JWT ID (`jti`)\n    if (options.jwtId !== undefined) {\n        if (payload.jti === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required JWT ID claim (\"jti\")',\n                    code: 'MISSING_JTI'\n                }\n            };\n        }\n        if (options.jwtId !== payload.jti) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid JWT ID: expected \"${options.jwtId}\", got \"${payload.jti}\"`,\n                    code: 'INVALID_JTI'\n                }\n            };\n        }\n    }\n\n    return {valid: true, header, payload, signature};\n};\n\n// Optional: namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n"],"names":["base64Url","input","timingSafeCompare","a","b","timingSafeEqual","SignatureAlgorithm","data","secret","createHmac","signature","expected","createSign","createVerify","crypto","cryptoSign","cryptoVerify","SupportedAlgorithms","decode","token","parts","headerPart","payloadPart","header","payload","err","sign","options","alg","typ","headerEncoded","payloadEncoded","signingInput","verify","decoded","now","skew","tokenAge","aud","expectedAud","tokenAud","JWT"],"mappings":"0GAYaA,EAAY,CACrB,OAASC,GACL,OAAO,KAAKA,CAAK,EAAE,SAAS,WAAW,EAE3C,OAASA,GAEE,OAAO,KAAKA,EAAO,WAAW,EAAE,SAAA,CAE/C,EAGMC,EAAoB,CAACC,EAAWC,IAC9BD,EAAE,SAAWC,EAAE,OACR,GAEJC,EAAAA,gBAAgB,OAAO,KAAKF,CAAC,EAAG,OAAO,KAAKC,CAAC,CAAC,EAyD5CE,EAAqB,CAE9B,MAAO,CACH,KAAM,CAACC,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IAAsB,CAC9D,MAAMC,EAAWF,aAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAC7E,OAAOL,EAAkBS,EAAUD,CAAS,CAChD,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IAAsB,CAC9D,MAAMC,EAAWF,aAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAC7E,OAAOL,EAAkBS,EAAUD,CAAS,CAChD,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IAAsB,CAC9D,MAAMC,EAAWF,aAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAC7E,OAAOL,EAAkBS,EAAUD,CAAS,CAChD,CAAA,EAIJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAIJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,OAAQ,CACJ,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,aAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK,CAEF,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,CACf,EACA,SAAS,WAAW,EAC7B,OAAQ,CAACP,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO,CAEJ,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,EACb,OAAO,KAAKJ,EAAW,WAAW,CAAC,CAC9C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,aAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK,CAEF,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,CACf,EACA,SAAS,WAAW,EAC7B,OAAQ,CAACP,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO,CAEJ,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,EACb,OAAO,KAAKJ,EAAW,WAAW,CAAC,CAC9C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,aAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK,CAEF,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,CACf,EACA,SAAS,WAAW,EAC7B,OAAQ,CAACP,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO,CAEJ,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,EACb,OAAO,KAAKJ,EAAW,WAAW,CAAC,CAC9C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBO,EAAAA,KAAW,KAAM,OAAOR,GAAS,SAAW,OAAO,KAAKA,EAAM,MAAM,EAAIA,EAAMC,CAAM,EAC/E,SAAS,WAAW,EAC7B,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOM,EAAAA,OACH,KACA,OAAOT,GAAS,SAAW,OAAO,KAAKA,EAAM,MAAM,EAAIA,EACvDC,EACA,OAAO,KAAKE,EAAW,WAAW,CAAA,CAE1C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,CAER,EAIaO,EAAsB,OAAO,KAAKX,CAAkB,EAKpDY,EAAUC,GAAuB,CAC1C,MAAMC,EAAQD,EAAM,MAAM,GAAG,EAC7B,GAAIC,EAAM,SAAW,EACjB,MAAM,IAAI,MAAM,4DAA4D,EAGhF,KAAM,CAACC,EAAYC,EAAaZ,CAAS,EAAIU,EAE7C,GAAI,CAACC,GAAc,CAACC,GAAe,CAACZ,EAChC,MAAM,IAAI,MAAM,kCAAkC,EAGtD,GAAI,CACA,MAAMa,EAAS,KAAK,MAAMvB,EAAU,OAAOqB,CAAU,CAAC,EAChDG,EAAU,KAAK,MAAMxB,EAAU,OAAOsB,CAAW,CAAC,EACxD,MAAO,CAAC,OAAAC,EAAQ,QAAAC,EAAS,UAAAd,CAAA,CAC7B,OAASe,EAAK,CACV,MAAM,IAAI,MAAM,6CAA8CA,EAAc,OAAO,GAAG,CAC1F,CACJ,EAKaC,EAAO,CAChBF,EACAhB,EACAmB,EAII,CAAA,IACK,CACT,MAAMC,EAAMD,EAAQ,KAAO,QACrBE,EAAMF,EAAQ,KAAO,MAE3B,GAAI,EAAEC,KAAOtB,GACT,MAAM,IAAI,MAAM,0BAA0BsB,CAAG,EAAE,EAGnD,MAAML,EAAoB,CAAC,IAAAK,EAAK,IAAAC,CAAA,EAC5BF,EAAQ,MAAKJ,EAAO,IAAMI,EAAQ,KAEtC,MAAMG,EAAgB9B,EAAU,OAAO,KAAK,UAAUuB,CAAM,CAAC,EACvDQ,EAAiB/B,EAAU,OAAO,KAAK,UAAUwB,CAAO,CAAC,EAEzDQ,EAAe,GAAGF,CAAa,IAAIC,CAAc,GACjDrB,EAAYJ,EAAmBsB,CAAG,EAAE,KAAKI,EAAcxB,CAAM,EAEnE,MAAO,GAAGsB,CAAa,IAAIC,CAAc,IAAIrB,CAAS,EAC1D,EAKauB,EAAS,CAClBd,EACAX,EACAmB,EASI,CAAA,IAG2D,CAC/D,IAAIO,EACJ,GAAI,CACAA,EAAUhB,EAAOC,CAAK,CAC1B,OAASM,EAAK,CACV,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAASA,EAAc,QACvB,KAAM,eAAA,CACV,CAER,CAEA,KAAM,CAAC,OAAAF,EAAQ,QAAAC,EAAS,UAAAd,CAAA,EAAawB,EAG/BN,EAAML,EAAO,IACnB,GAAI,EAAEK,KAAOtB,GACT,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,qCAAqCiB,EAAO,GAAG,GACvD,KAAM,mBAAA,CACV,EAKR,GAAII,EAAQ,YAAcA,EAAQ,WAAW,OAAS,GAC9C,CAACA,EAAQ,WAAW,SAASC,CAAG,EAChC,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,cAAcA,CAAG,0CACzB,KAAM,uBAAA,CACV,EAMZ,GAAIL,EAAO,MAAQ,QAAaA,EAAO,MAAQ,MAC3C,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,4CAA4CA,EAAO,GAAG,IAC9D,KAAM,cAAA,CACV,EAKR,MAAMS,EAAe,GAAGhC,EAAU,OAAO,KAAK,UAAUuB,CAAM,CAAC,CAAC,IAAIvB,EAAU,OAAO,KAAK,UAAUwB,CAAO,CAAC,CAAC,GAG7G,GAAI,CAFqBlB,EAAmBsB,CAAG,EAAE,OAAOI,EAAcxB,EAAQE,CAAS,EAGnF,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gCACR,KAAM,mBAAA,CACV,EAKR,MAAMyB,EAAM,KAAK,MAAM,KAAK,IAAA,EAAQ,GAAI,EAClCC,EAAOT,EAAQ,WAAa,EAElC,GAAI,CAACA,EAAQ,kBACLH,EAAQ,MAAQ,QAAaW,EAAMX,EAAQ,IAAMY,EACjD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gBACR,KAAM,eAAA,CACV,EAKZ,GAAIZ,EAAQ,MAAQ,QAAaW,EAAMC,EAAOZ,EAAQ,IAClD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,sBACR,KAAM,kBAAA,CACV,EAIR,GAAIA,EAAQ,MAAQ,QAAaW,EAAMC,EAAOZ,EAAQ,IAClD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,6BACR,KAAM,qBAAA,CACV,EAKR,GAAIG,EAAQ,cAAgB,QAAaH,EAAQ,MAAQ,OAAW,CAChE,MAAMa,EAAWF,EAAMX,EAAQ,IAC/B,GAAIa,EAAWV,EAAQ,YACnB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,cAAcU,CAAQ,mCAAmCV,EAAQ,WAAW,KACpF,KAAM,eAAA,CACV,CAGZ,CAKA,GAAIA,EAAQ,SAAW,OAAW,CAC9B,GAAIH,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,8CACR,KAAM,gBAAA,CACV,EAGR,GAAIG,EAAQ,SAAWH,EAAQ,IAC3B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,mCAAmCG,EAAQ,MAAM,WAAWH,EAAQ,GAAG,IAC/E,KAAM,gBAAA,CACV,CAGZ,CAGA,GAAIG,EAAQ,UAAY,OAAW,CAC/B,GAAIH,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,+CACR,KAAM,iBAAA,CACV,EAGR,GAAIG,EAAQ,UAAYH,EAAQ,IAC5B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,oCAAoCG,EAAQ,OAAO,WAAWH,EAAQ,GAAG,IACjF,KAAM,iBAAA,CACV,CAGZ,CAGA,GAAIG,EAAQ,WAAa,OAAW,CAChC,MAAMW,EAAMd,EAAQ,IACpB,GAAIc,IAAQ,OACR,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gDACR,KAAM,kBAAA,CACV,EAIR,MAAMC,EAAc,MAAM,QAAQZ,EAAQ,QAAQ,EAAIA,EAAQ,SAAW,CAACA,EAAQ,QAAQ,EACpFa,EAAW,MAAM,QAAQF,CAAG,EAAIA,EAAM,CAACA,CAAG,EAGhD,GAAI,CADaC,EAAY,QAAUC,EAAS,SAASrC,CAAC,CAAC,EAEvD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,0BACR,KAAM,kBAAA,CACV,CAGZ,CAGA,GAAIwB,EAAQ,QAAU,OAAW,CAC7B,GAAIH,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,8CACR,KAAM,aAAA,CACV,EAGR,GAAIG,EAAQ,QAAUH,EAAQ,IAC1B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,6BAA6BG,EAAQ,KAAK,WAAWH,EAAQ,GAAG,IACxE,KAAM,aAAA,CACV,CAGZ,CAEA,MAAO,CAAC,MAAO,GAAM,OAAAD,EAAQ,QAAAC,EAAS,UAAAd,CAAA,CAC1C,EAGa+B,EAAM,CACf,KAAAf,EACA,OAAAO,EACA,OAAAf,EACA,WAAYZ,CAChB"}
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -1,236 +1,2 @@
-import { BinaryLike, KeyLike } from 'crypto';
-export declare const base64Url: {
-    encode: (input: string | Buffer) => string;
-    decode: (input: string) => string;
-};
-export interface JWTPayload {
-    /**
-     * Issuer
-     */
-    iss?: string;
-    /**
-     * Subject
-     */
-    sub?: string;
-    /**
-     * Audience
-     */
-    aud?: string | string[];
-    /**
-     * Expiration Time (as UNIX timestamp)
-     */
-    exp?: number;
-    /**
-     * Not Before (as UNIX timestamp)
-     */
-    nbf?: number;
-    /**
-     * Issued At (as UNIX timestamp)
-     */
-    iat?: number;
-    /**
-     * JWT ID
-     */
-    jti?: string;
-    /**
-     * Session ID
-     */
-    sid?: string;
-    /**
-     * Custom claims
-     */
-    [key: string]: unknown;
-}
-export interface JWTHeader {
-    alg: string;
-    typ?: string;
-    kid?: string;
-}
-export interface JWT {
-    header: JWTHeader;
-    payload: JWTPayload;
-    signature: string;
-}
-export declare const SignatureAlgorithm: {
-    readonly HS256: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly HS384: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly HS512: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly RS256: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly RS384: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly RS512: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly ES256: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly ES384: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly ES512: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly ES256K: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly PS256: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly PS384: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly PS512: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-    readonly EdDSA: {
-        readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-        readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-    };
-};
-export type SupportedAlgorithm = keyof typeof SignatureAlgorithm;
-export declare const SupportedAlgorithms: Array<SupportedAlgorithm>;
-/**
- * Decode a JWT string into its parts (without verification)
- */
-export declare const decode: (token: string) => JWT;
-/**
- * Sign a JWT
- */
-export declare const sign: (payload: JWTPayload, secret: KeyLike, options?: {
-    alg?: SupportedAlgorithm;
-    kid?: string;
-    typ?: string;
-}) => string;
-/**
- * Verify and validate a JWT
- */
-export declare const verify: (token: string, secret: KeyLike, options?: {
-    algorithms?: SupportedAlgorithm[];
-    issuer?: string;
-    subject?: string;
-    audience?: string | string[];
-    jwtId?: string;
-    ignoreExpiration?: boolean;
-    clockSkew?: number;
-    maxTokenAge?: number;
-}) => {
-    valid: true;
-    header: JWTHeader;
-    payload: JWTPayload;
-    signature: string;
-} | {
-    valid: false;
-    error: {
-        reason: string;
-        code: string;
-    };
-};
-export declare const JWT: {
-    sign: (payload: JWTPayload, secret: KeyLike, options?: {
-        alg?: SupportedAlgorithm;
-        kid?: string;
-        typ?: string;
-    }) => string;
-    verify: (token: string, secret: KeyLike, options?: {
-        algorithms?: SupportedAlgorithm[];
-        issuer?: string;
-        subject?: string;
-        audience?: string | string[];
-        jwtId?: string;
-        ignoreExpiration?: boolean;
-        clockSkew?: number;
-        maxTokenAge?: number;
-    }) => {
-        valid: true;
-        header: JWTHeader;
-        payload: JWTPayload;
-        signature: string;
-    } | {
-        valid: false;
-        error: {
-            reason: string;
-            code: string;
-        };
-    };
-    decode: (token: string) => JWT;
-    algorithms: {
-        readonly HS256: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly HS384: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly HS512: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly RS256: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly RS384: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly RS512: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly ES256: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly ES384: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly ES512: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly ES256K: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly PS256: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly PS384: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly PS512: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-        readonly EdDSA: {
-            readonly sign: (data: BinaryLike, secret: KeyLike) => string;
-            readonly verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
-        };
-    };
-};
+export * from './jwt';
+export * from './jwks';

package/dist/index.es.js

@@ -1,369 +1,21 @@
-import l, { sign as T, createSign as s, createHmac as c, verify as E, createVerify as d, timingSafeEqual as N } from "crypto";
-const S = {
-  encode: (e) => Buffer.from(e).toString("base64url"),
-  decode: (e) => Buffer.from(e, "base64url").toString()
-}, h = (e, r) => e.length !== r.length ? !1 : N(Buffer.from(e), Buffer.from(r)), g = {
-  // HMAC
-  HS256: {
-    sign: (e, r) => c("sha256", r).update(e).digest("base64url"),
-    verify: (e, r, t) => {
-      const n = c("sha256", r).update(e).digest("base64url");
-      return h(n, t);
-    }
-  },
-  HS384: {
-    sign: (e, r) => c("sha384", r).update(e).digest("base64url"),
-    verify: (e, r, t) => {
-      const n = c("sha384", r).update(e).digest("base64url");
-      return h(n, t);
-    }
-  },
-  HS512: {
-    sign: (e, r) => c("sha512", r).update(e).digest("base64url"),
-    verify: (e, r, t) => {
-      const n = c("sha512", r).update(e).digest("base64url");
-      return h(n, t);
-    }
-  },
-  // RSA (DER-encoded signatures, base64url)
-  RS256: {
-    sign: (e, r) => s("RSA-SHA256").update(e).end().sign(r).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return d("RSA-SHA256").update(e).end().verify(r, Buffer.from(t, "base64url"));
-      } catch {
-        return !1;
-      }
-    }
-  },
-  RS384: {
-    sign: (e, r) => s("RSA-SHA384").update(e).end().sign(r).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return d("RSA-SHA384").update(e).end().verify(r, Buffer.from(t, "base64url"));
-      } catch {
-        return !1;
-      }
-    }
-  },
-  RS512: {
-    sign: (e, r) => s("RSA-SHA512").update(e).end().sign(r).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return d("RSA-SHA512").update(e).end().verify(r, Buffer.from(t, "base64url"));
-      } catch {
-        return !1;
-      }
-    }
-  },
-  // ECDSA (DER-encoded by default — no dsaEncoding!)
-  ES256: {
-    sign: (e, r) => s("SHA256").update(e).end().sign(r).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return d("SHA256").update(e).end().verify(r, Buffer.from(t, "base64url"));
-      } catch {
-        return !1;
-      }
-    }
-  },
-  ES384: {
-    sign: (e, r) => s("SHA384").update(e).end().sign(r).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return d("SHA384").update(e).end().verify(r, Buffer.from(t, "base64url"));
-      } catch {
-        return !1;
-      }
-    }
-  },
-  ES512: {
-    sign: (e, r) => s("SHA512").update(e).end().sign(r).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return d("SHA512").update(e).end().verify(r, Buffer.from(t, "base64url"));
-      } catch {
-        return !1;
-      }
-    }
-  },
-  ES256K: {
-    sign: (e, r) => s("SHA256").update(e).end().sign(r).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return d("SHA256").update(e).end().verify(r, Buffer.from(t, "base64url"));
-      } catch {
-        return !1;
-      }
-    }
-  },
-  PS256: {
-    sign: (e, r) => s("RSA-SHA256").update(e).end().sign({
-      //@ts-ignore
-      key: r,
-      padding: l.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: 32
-    }).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return d("RSA-SHA256").update(e).end().verify({
-          //@ts-ignore
-          key: r,
-          padding: l.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: 32
-        }, Buffer.from(t, "base64url"));
-      } catch {
-        return !1;
-      }
-    }
-  },
-  PS384: {
-    sign: (e, r) => s("RSA-SHA384").update(e).end().sign({
-      //@ts-ignore
-      key: r,
-      padding: l.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: 48
-    }).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return d("RSA-SHA384").update(e).end().verify({
-          //@ts-ignore
-          key: r,
-          padding: l.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: 48
-        }, Buffer.from(t, "base64url"));
-      } catch {
-        return !1;
-      }
-    }
-  },
-  PS512: {
-    sign: (e, r) => s("RSA-SHA512").update(e).end().sign({
-      //@ts-ignore
-      key: r,
-      padding: l.constants.RSA_PKCS1_PSS_PADDING,
-      saltLength: 64
-    }).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return d("RSA-SHA512").update(e).end().verify({
-          //@ts-ignore
-          key: r,
-          padding: l.constants.RSA_PKCS1_PSS_PADDING,
-          saltLength: 64
-        }, Buffer.from(t, "base64url"));
-      } catch {
-        return !1;
-      }
-    }
-  },
-  EdDSA: {
-    sign: (e, r) => T(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, r).toString("base64url"),
-    verify: (e, r, t) => {
-      try {
-        return E(
-          null,
-          typeof e == "string" ? Buffer.from(e, "utf8") : e,
-          r,
-          Buffer.from(t, "base64url")
-        );
-      } catch {
-        return !1;
-      }
-    }
-  }
-}, P = Object.keys(g), I = (e) => {
-  const r = e.split(".");
-  if (r.length !== 3)
-    throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');
-  const [t, n, i] = r;
-  if (!t || !n || !i)
-    throw new Error("Invalid JWT: empty part detected");
-  try {
-    const a = JSON.parse(S.decode(t)), o = JSON.parse(S.decode(n));
-    return { header: a, payload: o, signature: i };
-  } catch (a) {
-    throw new Error(`Invalid JWT: malformed header or payload (${a.message})`);
-  }
-}, k = (e, r, t = {}) => {
-  const n = t.alg ?? "HS256", i = t.typ ?? "JWT";
-  if (!(n in g))
-    throw new Error(`Unsupported algorithm: ${n}`);
-  const a = { alg: n, typ: i };
-  t.kid && (a.kid = t.kid);
-  const o = S.encode(JSON.stringify(a)), f = S.encode(JSON.stringify(e)), A = `${o}.${f}`, m = g[n].sign(A, r);
-  return `${o}.${f}.${m}`;
-}, D = (e, r, t = {}) => {
-  let n;
-  try {
-    n = I(e);
-  } catch (u) {
-    return {
-      valid: !1,
-      error: {
-        reason: u.message,
-        code: "INVALID_TOKEN"
-      }
-    };
-  }
-  const { header: i, payload: a, signature: o } = n, f = i.alg;
-  if (!(f in g))
-    return {
-      valid: !1,
-      error: {
-        reason: `Unsupported or unknown algorithm: ${i.alg}`,
-        code: "INVALID_ALGORITHM"
-      }
-    };
-  if (t.algorithms && t.algorithms.length > 0 && !t.algorithms.includes(f))
-    return {
-      valid: !1,
-      error: {
-        reason: `Algorithm "${f}" is not in the allowed algorithms list`,
-        code: "ALGORITHM_NOT_ALLOWED"
-      }
-    };
-  if (i.typ !== void 0 && i.typ !== "JWT")
-    return {
-      valid: !1,
-      error: {
-        reason: `Invalid token type: expected 'JWT', got '${i.typ}'`,
-        code: "INVALID_TYPE"
-      }
-    };
-  const A = `${S.encode(JSON.stringify(i))}.${S.encode(JSON.stringify(a))}`;
-  if (!g[f].verify(A, r, o))
-    return {
-      valid: !1,
-      error: {
-        reason: "Signature verification failed",
-        code: "INVALID_SIGNATURE"
-      }
-    };
-  const y = Math.floor(Date.now() / 1e3), v = t.clockSkew ?? 0;
-  if (!t.ignoreExpiration && a.exp !== void 0 && y > a.exp + v)
-    return {
-      valid: !1,
-      error: {
-        reason: "Token expired",
-        code: "TOKEN_EXPIRED"
-      }
-    };
-  if (a.nbf !== void 0 && y + v < a.nbf)
-    return {
-      valid: !1,
-      error: {
-        reason: "Token not yet valid",
-        code: "TOKEN_NOT_ACTIVE"
-      }
-    };
-  if (a.iat !== void 0 && y + v < a.iat)
-    return {
-      valid: !1,
-      error: {
-        reason: "Token issued in the future",
-        code: "TOKEN_FUTURE_ISSUED"
-      }
-    };
-  if (t.maxTokenAge !== void 0 && a.iat !== void 0) {
-    const u = y - a.iat;
-    if (u > t.maxTokenAge)
-      return {
-        valid: !1,
-        error: {
-          reason: `Token age (${u}s) exceeds maximum allowed age (${t.maxTokenAge}s)`,
-          code: "TOKEN_TOO_OLD"
-        }
-      };
-  }
-  if (t.issuer !== void 0) {
-    if (a.iss === void 0)
-      return {
-        valid: !1,
-        error: {
-          reason: 'Token missing required issuer claim ("iss")',
-          code: "MISSING_ISSUER"
-        }
-      };
-    if (t.issuer !== a.iss)
-      return {
-        valid: !1,
-        error: {
-          reason: `Invalid token issuer: expected "${t.issuer}", got "${a.iss}"`,
-          code: "INVALID_ISSUER"
-        }
-      };
-  }
-  if (t.subject !== void 0) {
-    if (a.sub === void 0)
-      return {
-        valid: !1,
-        error: {
-          reason: 'Token missing required subject claim ("sub")',
-          code: "MISSING_SUBJECT"
-        }
-      };
-    if (t.subject !== a.sub)
-      return {
-        valid: !1,
-        error: {
-          reason: `Invalid token subject: expected "${t.subject}", got "${a.sub}"`,
-          code: "INVALID_SUBJECT"
-        }
-      };
-  }
-  if (t.audience !== void 0) {
-    const u = a.aud;
-    if (u === void 0)
-      return {
-        valid: !1,
-        error: {
-          reason: 'Token missing required audience claim ("aud")',
-          code: "MISSING_AUDIENCE"
-        }
-      };
-    const p = Array.isArray(t.audience) ? t.audience : [t.audience], b = Array.isArray(u) ? u : [u];
-    if (!p.some((_) => b.includes(_)))
-      return {
-        valid: !1,
-        error: {
-          reason: "Audience claim mismatch",
-          code: "INVALID_AUDIENCE"
-        }
-      };
-  }
-  if (t.jwtId !== void 0) {
-    if (a.jti === void 0)
-      return {
-        valid: !1,
-        error: {
-          reason: 'Token missing required JWT ID claim ("jti")',
-          code: "MISSING_JTI"
-        }
-      };
-    if (t.jwtId !== a.jti)
-      return {
-        valid: !1,
-        error: {
-          reason: `Invalid JWT ID: expected "${t.jwtId}", got "${a.jti}"`,
-          code: "INVALID_JTI"
-        }
-      };
-  }
-  return { valid: !0, header: i, payload: a, signature: o };
-}, $ = {
-  sign: k,
-  verify: D,
-  decode: I,
-  algorithms: g
-};
+import { A as t, f as e, j as o, h as r, J as i, S as J, a as K, b as W, c as m, d as g, e as p, g as c, i as l, n as u, s as S, t as b, v as d } from "./index-DyXdSqEc.js";
 export {
-  $ as JWT,
-  g as SignatureAlgorithm,
-  P as SupportedAlgorithms,
-  S as base64Url,
-  I as decode,
-  k as sign,
-  D as verify
+  t as AutodetectAlgorithm,
+  e as JWK,
+  o as JWKS,
+  r as JWKSToKeyObject,
+  i as JWT,
+  J as SignatureAlgorithm,
+  K as SupportedAlgorithms,
+  W as base64Url,
+  m as computeX5T,
+  g as decode,
+  p as exportJWK,
+  c as getJWKThumbprint,
+  l as importJWK,
+  u as normalizeJWKS,
+  S as sign,
+  b as toPublicJWK,
+  d as verify
 };
 //# sourceMappingURL=index.es.js.map