@sourceregistry/node-jwt 1.4.1 → 1.5.0

package/dist/index.es.js

@@ -1,21 +1,22 @@
-import { A as t, f as e, j as o, h as r, J as i, S as J, a as K, b as W, c as m, d as g, e as p, g as c, i as l, n as u, s as S, t as b, v as d } from "./index-BmAAEOLC.js";
+import { A as e, f as t, k as o, h as r, J as i, S as J, a as W, b as m, c as K, d as g, e as p, j as b, g as c, i as l, n as u, s as S, t as d, v as h } from "./index-BH3QmxZ_.js";
 export {
-  t as AutodetectAlgorithm,
-  e as JWK,
+  e as AutodetectAlgorithm,
+  t as JWK,
   o as JWKS,
   r as JWKSToKeyObject,
   i as JWT,
   J as SignatureAlgorithm,
-  K as SupportedAlgorithms,
-  W as base64Url,
-  m as computeX5T,
+  W as SupportedAlgorithms,
+  m as base64Url,
+  K as computeX5T,
   g as decode,
   p as exportJWK,
+  b as fromWeb,
   c as getJWKThumbprint,
   l as importJWK,
   u as normalizeJWKS,
   S as sign,
-  b as toPublicJWK,
-  d as verify
+  d as toPublicJWK,
+  h as verify
 };
 //# sourceMappingURL=index.es.js.map

package/dist/jwks/index.d.ts

@@ -84,8 +84,44 @@ export declare function JWKSToKeyObject(jwks: JWKS, kid?: string): KeyObject;
  * @param jwks
  */
 export declare function normalizeJWKS(jwks: JWKS): JWKS;
+export declare const fromWeb: (url: string | URL, options?: Partial<{
+    fetch: typeof fetch;
+    ttl: number;
+    timeoutMs: number;
+    endpointOverride: string;
+    overrideEndpointCheck: boolean;
+    cache: {
+        get: (key: string) => JWKS | undefined | Promise<JWKS | undefined>;
+        set: (key: string, value: JWKS) => void | Promise<void>;
+    };
+}>) => Promise<{
+    list(): Promise<JWK[]>;
+    reload(): Promise<JWK[]>;
+    key(kid: string): Promise<JWK | undefined>;
+    find(input: Partial<BaseJWK>): Promise<JWK[]>;
+    findFirst(input: Partial<BaseJWK>): Promise<JWK>;
+    export(): JWKS | undefined;
+}>;
 export declare const JWKS: {
     toKeyObject: typeof JWKSToKeyObject;
     normalize: typeof normalizeJWKS;
+    fromWeb: (url: string | URL, options?: Partial<{
+        fetch: typeof fetch;
+        ttl: number;
+        timeoutMs: number;
+        endpointOverride: string;
+        overrideEndpointCheck: boolean;
+        cache: {
+            get: (key: string) => JWKS | undefined | Promise<JWKS | undefined>;
+            set: (key: string, value: JWKS) => void | Promise<void>;
+        };
+    }>) => Promise<{
+        list(): Promise<JWK[]>;
+        reload(): Promise<JWK[]>;
+        key(kid: string): Promise<JWK | undefined>;
+        find(input: Partial<BaseJWK>): Promise<JWK[]>;
+        findFirst(input: Partial<BaseJWK>): Promise<JWK>;
+        export(): JWKS | undefined;
+    }>;
 };
 export {};

package/dist/jwt/promises.d.ts

@@ -21,13 +21,13 @@ export declare const verify: (...args: Parameters<typeof verifySync>) => Promise
 }>;
 export type JWT = JSONWebToken;
 export declare const JWT: {
-    sign: (payload: JWTPayload, secret: import('crypto').KeyLike, options?: {
+    sign: (payload: JWTPayload, secret: import('node:crypto').KeyLike, options?: {
         alg?: SupportedAlgorithm;
         kid?: string;
         typ?: string;
         signatureFormat?: "der" | "jose";
     } | undefined) => Promise<string>;
-    verify: (token: string, secret: import('crypto').KeyLike, options?: {
+    verify: (token: string, secret: import('node:crypto').KeyLike, options?: {
         algorithms?: SupportedAlgorithm[];
         issuer?: string;
         subject?: string;
@@ -45,60 +45,60 @@ export declare const JWT: {
     decode: (token: string) => Promise<JSONWebToken>;
     algorithms: {
         readonly HS256: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly HS384: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly HS512: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly RS256: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly RS384: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly RS512: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly ES256: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly ES384: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly ES512: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly ES256K: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly PS256: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly PS384: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly PS512: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         readonly EdDSA: {
-            readonly sign: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike) => string;
-            readonly verify: (data: import('crypto').BinaryLike, secret: import('crypto').KeyLike, signature: string) => boolean;
+            readonly sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
+            readonly verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
     };
 };

package/dist/promises.cjs.js

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("./index-eYY-I3Pd.cjs");require("crypto");const r=e=>Promise.resolve().then(()=>o.decode(e)),i=(...e)=>Promise.resolve().then(()=>o.sign(...e)),s=(...e)=>Promise.resolve().then(()=>{const t=o.verify(...e);if(!t.valid)throw t.error;const{header:W,payload:h,signature:p}=t;return{header:W,payload:h,signature:p}}),g={sign:i,verify:s,decode:r,algorithms:o.SignatureAlgorithm},n=e=>Promise.resolve().then(()=>o.exportJWK(e)),c=e=>Promise.resolve().then(()=>o.importJWK(e)),m=e=>Promise.resolve().then(()=>o.toPublicJWK(e)),l=(e,t="sha256")=>Promise.resolve().then(()=>o.getJWKThumbprint(e,t)),K=(e,t)=>Promise.resolve().then(()=>o.JWKSToKeyObject(e,t)),u=e=>Promise.resolve().then(()=>o.normalizeJWKS(e)),J=e=>Promise.resolve().then(()=>o.computeX5T(e)),a={export:n,import:c,toPublic:m,thumbprint:l,computeX5T:J},v={toKeyObject:K,normalize:u};exports.SignatureAlgorithm=o.SignatureAlgorithm;exports.SupportedAlgorithms=o.SupportedAlgorithms;exports.JWK=a;exports.JWKS=v;exports.JWKSToKeyObject=K;exports.JWT=g;exports.computeX5T=J;exports.decode=r;exports.exportJWK=n;exports.getJWKThumbprint=l;exports.importJWK=c;exports.normalizeJWKS=u;exports.sign=i;exports.toPublicJWK=m;exports.verify=s;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("./index-BSuQzHXZ.cjs");require("crypto");const r=e=>Promise.resolve().then(()=>o.decode(e)),i=(...e)=>Promise.resolve().then(()=>o.sign(...e)),s=(...e)=>Promise.resolve().then(()=>{const t=o.verify(...e);if(!t.valid)throw t.error;const{header:W,payload:h,signature:p}=t;return{header:W,payload:h,signature:p}}),g={sign:i,verify:s,decode:r,algorithms:o.SignatureAlgorithm},n=e=>Promise.resolve().then(()=>o.exportJWK(e)),c=e=>Promise.resolve().then(()=>o.importJWK(e)),m=e=>Promise.resolve().then(()=>o.toPublicJWK(e)),l=(e,t="sha256")=>Promise.resolve().then(()=>o.getJWKThumbprint(e,t)),K=(e,t)=>Promise.resolve().then(()=>o.JWKSToKeyObject(e,t)),u=e=>Promise.resolve().then(()=>o.normalizeJWKS(e)),J=e=>Promise.resolve().then(()=>o.computeX5T(e)),a={export:n,import:c,toPublic:m,thumbprint:l,computeX5T:J},v={toKeyObject:K,normalize:u};exports.SignatureAlgorithm=o.SignatureAlgorithm;exports.SupportedAlgorithms=o.SupportedAlgorithms;exports.JWK=a;exports.JWKS=v;exports.JWKSToKeyObject=K;exports.JWT=g;exports.computeX5T=J;exports.decode=r;exports.exportJWK=n;exports.getJWKThumbprint=l;exports.importJWK=c;exports.normalizeJWKS=u;exports.sign=i;exports.toPublicJWK=m;exports.verify=s;
 //# sourceMappingURL=promises.cjs.js.map

package/dist/promises.es.js

@@ -1,5 +1,5 @@
-import { S as n, d as i, s as m, v as c, e as a, i as l, t as h, g as p, h as K, n as J, c as W } from "./index-BmAAEOLC.js";
-import { a as w } from "./index-BmAAEOLC.js";
+import { S as n, d as i, s as m, v as c, e as a, i as l, t as h, g as p, h as K, n as J, c as W } from "./index-BH3QmxZ_.js";
+import { a as w } from "./index-BH3QmxZ_.js";
 import "crypto";
 const v = (e) => Promise.resolve().then(() => i(e)), u = (...e) => Promise.resolve().then(() => m(...e)), P = (...e) => Promise.resolve().then(() => {
   const o = c(...e);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/node-jwt",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "description": "A lightweight, zero-dependency TypeScript library for creating, verifying and decoding JSON Web Tokens (JWT).",
   "main": "./dist/index.cjs.js",
   "module": "./dist/index.es.js",
@@ -41,7 +41,9 @@
     "zero-dependency",
     "vapid",
     "jose",
-    "der"
+    "der",
+    "jwks",
+    "json web key set"
   ],
   "author": "A.P.A. Slaa (a.p.a.slaa@projectsource.nl)",
   "license": "Apache-2.0",
@@ -62,14 +64,14 @@
     "@semantic-release/git": "^10.0.1",
     "@semantic-release/npm": "^12.0.2",
     "@semantic-release/release-notes-generator": "^14.0.3",
-    "@types/node": "^24.3.0",
-    "@vitest/coverage-v8": "^3.2.4",
-    "@vitest/ui": "^3.2.4",
-    "typedoc": "^0.28.14",
+    "@types/node": "^25.3.0",
+    "@vitest/coverage-v8": "^4.0.18",
+    "@vitest/ui": "^4.0.18",
+    "typedoc": "^0.28.17",
     "typescript": "^5.9.3",
-    "vite": "^7.1.12",
+    "vite": "^7.3.1",
     "vite-plugin-dts": "^4.5.4",
-    "vitest": "^3.2.4"
+    "vitest": "^4.0.18"
   },
   "release": {
     "branches": [

package/dist/index-eYY-I3Pd.cjs

@@ -1,2 +0,0 @@
-"use strict";const n=require("crypto"),h={encode:e=>Buffer.from(e).toString("base64url"),decode:e=>Buffer.from(e,"base64url").toString()},m=(e,t)=>e.length!==t.length?!1:n.timingSafeEqual(Buffer.from(e),Buffer.from(t));function I(e){switch(e){case"ES256":case"ES256K":return 64;case"ES384":return 96;case"ES512":return 132;default:throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`)}}function W(e,t){let r=0;if(e[r++]!==48)throw new Error("Invalid DER ECDSA signature");let a=e[r++];if(a&128){const g=a&127;a=0;for(let c=0;c<g;c++)a=a<<8|e[r++]}if(e[r++]!==2)throw new Error("Invalid DER ECDSA signature (r)");const s=e[r++];let i=e.subarray(r,r+s);if(r+=s,e[r++]!==2)throw new Error("Invalid DER ECDSA signature (s)");const u=e[r++];let o=e.subarray(r,r+u);for(;i.length>t/2&&i[0]===0;)i=i.subarray(1);for(;o.length>t/2&&o[0]===0;)o=o.subarray(1);const f=Buffer.concat([Buffer.alloc(t/2-i.length,0),i]),d=Buffer.concat([Buffer.alloc(t/2-o.length,0),o]);return Buffer.concat([f,d])}function E(e){const t=e.length/2;let r=e.subarray(0,t),a=e.subarray(t);for(;r.length>1&&r[0]===0&&(r[1]&128)===0;)r=r.subarray(1);for(;a.length>1&&a[0]===0&&(a[1]&128)===0;)a=a.subarray(1);r[0]&128&&(r=Buffer.concat([Buffer.from([0]),r])),a[0]&128&&(a=Buffer.concat([Buffer.from([0]),a]));const s=Buffer.concat([Buffer.from([2,r.length]),r]),i=Buffer.concat([Buffer.from([2,a.length]),a]),u=s.length+i.length;let o;if(u<128)o=Buffer.from([u]);else{const f=[];let d=u;for(;d>0;)f.unshift(d&255),d>>=8;o=Buffer.from([128|f.length,...f])}return Buffer.concat([Buffer.from([48]),o,s,i])}function K(e){return e==="ES256"||e==="ES384"||e==="ES512"||e==="ES256K"}const S={HS256:{sign:(e,t)=>n.createHmac("sha256",t).update(e).digest("base64url"),verify:(e,t,r)=>{const a=n.createHmac("sha256",t).update(e).digest("base64url");return m(a,r)}},HS384:{sign:(e,t)=>n.createHmac("sha384",t).update(e).digest("base64url"),verify:(e,t,r)=>{const a=n.createHmac("sha384",t).update(e).digest("base64url");return m(a,r)}},HS512:{sign:(e,t)=>n.createHmac("sha512",t).update(e).digest("base64url"),verify:(e,t,r)=>{const a=n.createHmac("sha512",t).update(e).digest("base64url");return m(a,r)}},RS256:{sign:(e,t)=>n.createSign("RSA-SHA256").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return n.createVerify("RSA-SHA256").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},RS384:{sign:(e,t)=>n.createSign("RSA-SHA384").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return n.createVerify("RSA-SHA384").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},RS512:{sign:(e,t)=>n.createSign("RSA-SHA512").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return n.createVerify("RSA-SHA512").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES256:{sign:(e,t)=>n.createSign("SHA256").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return n.createVerify("SHA256").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES384:{sign:(e,t)=>n.createSign("SHA384").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return n.createVerify("SHA384").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES512:{sign:(e,t)=>n.createSign("SHA512").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return n.createVerify("SHA512").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES256K:{sign:(e,t)=>n.createSign("SHA256").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return n.createVerify("SHA256").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},PS256:{sign:(e,t)=>n.createSign("RSA-SHA256").update(e).end().sign({key:t,padding:n.constants.RSA_PKCS1_PSS_PADDING,saltLength:32}).toString("base64url"),verify:(e,t,r)=>{try{return n.createVerify("RSA-SHA256").update(e).end().verify({key:t,padding:n.constants.RSA_PKCS1_PSS_PADDING,saltLength:32},Buffer.from(r,"base64url"))}catch{return!1}}},PS384:{sign:(e,t)=>n.createSign("RSA-SHA384").update(e).end().sign({key:t,padding:n.constants.RSA_PKCS1_PSS_PADDING,saltLength:48}).toString("base64url"),verify:(e,t,r)=>{try{return n.createVerify("RSA-SHA384").update(e).end().verify({key:t,padding:n.constants.RSA_PKCS1_PSS_PADDING,saltLength:48},Buffer.from(r,"base64url"))}catch{return!1}}},PS512:{sign:(e,t)=>n.createSign("RSA-SHA512").update(e).end().sign({key:t,padding:n.constants.RSA_PKCS1_PSS_PADDING,saltLength:64}).toString("base64url"),verify:(e,t,r)=>{try{return n.createVerify("RSA-SHA512").update(e).end().verify({key:t,padding:n.constants.RSA_PKCS1_PSS_PADDING,saltLength:64},Buffer.from(r,"base64url"))}catch{return!1}}},EdDSA:{sign:(e,t)=>n.sign(null,typeof e=="string"?Buffer.from(e,"utf8"):e,t).toString("base64url"),verify:(e,t,r)=>{try{return n.verify(null,typeof e=="string"?Buffer.from(e,"utf8"):e,t,Buffer.from(r,"base64url"))}catch{return!1}}}},H=Object.keys(S);function T(e){if(e.type==="secret")return"HS256";if(e.type!=="private")throw new Error("Only private or symmetric keys can be used to sign JWTs");const t=e.asymmetricKeyType,r=e.asymmetricKeyDetails;switch(t){case"rsa":return"RS256";case"rsa-pss":{const a=r?.hashAlgorithm??"sha256";switch(a){case"sha256":return"PS256";case"sha384":return"PS384";case"sha512":return"PS512";default:throw new Error(`Unsupported RSA-PSS hash algorithm: ${a}`)}}case"ec":{const a=r?.namedCurve;switch(a){case"P-256":case"prime256v1":return"ES256";case"P-384":case"secp384r1":return"ES384";case"P-521":case"secp521r1":return"ES512";case"secp256k1":return"ES256K";default:throw new Error(`Unsupported EC curve: ${a}`)}}case"ed25519":return"EdDSA";default:throw new Error(`Unsupported asymmetric key type: ${t}`)}}function O(e){if(typeof e=="object"&&"type"in e)return e;try{return n.createPrivateKey(e)}catch{const t=typeof e=="string"?Buffer.from(e,"utf8"):Buffer.isBuffer(e)?e:(()=>{throw new Error("Unsupported key type")})();return n.createSecretKey(t)}}const v=e=>{const t=e.split(".");if(t.length!==3)throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');const[r,a,s]=t;if(!r||!a||!s)throw new Error("Invalid JWT: empty part detected");try{const i=JSON.parse(h.decode(r)),u=JSON.parse(h.decode(a));return{header:i,payload:u,signature:s}}catch(i){throw new Error(`Invalid JWT: malformed header or payload (${i.message})`)}},B=(e,t,r={})=>{const a=O(t),s=r.alg??T(a),i=r.signatureFormat??"der",u=r.typ??"JWT";if(!(s in S))throw new Error(`Unsupported algorithm: ${s}`);const o={alg:s,typ:u};r.kid&&(o.kid=r.kid);const f=h.encode(JSON.stringify(o)),d=h.encode(JSON.stringify(e)),g=`${f}.${d}`;let c=S[s].sign(g,t);if(i==="jose"&&K(s)){const l=Buffer.from(c,"base64url");c=W(l,I(s)).toString("base64url")}return`${f}.${d}.${c}`},J=(e,t,r={})=>{let a;try{a=v(e)}catch(c){return{valid:!1,error:{reason:c.message,code:"INVALID_TOKEN"}}}const{header:s,payload:i,signature:u}=a,o=s.alg;if(!(o in S))return{valid:!1,error:{reason:`Unsupported or unknown algorithm: ${s.alg}`,code:"INVALID_ALGORITHM"}};if(r.algorithms&&r.algorithms.length>0&&!r.algorithms.includes(o))return{valid:!1,error:{reason:`Algorithm "${o}" is not in the allowed algorithms list`,code:"ALGORITHM_NOT_ALLOWED"}};if(s.typ!==void 0&&s.typ!=="JWT")return{valid:!1,error:{reason:`Invalid token type: expected 'JWT', got '${s.typ}'`,code:"INVALID_TYPE"}};const f=`${h.encode(JSON.stringify(s))}.${h.encode(JSON.stringify(i))}`;if(K(o)){const c=r.signatureFormat;let l;if(c==="jose")try{const y=Buffer.from(u,"base64url"),p=E(y).toString("base64url");l=S[o].verify(f,t,p)}catch{l=!1}else if(c==="der")l=S[o].verify(f,t,u);else if(l=S[o].verify(f,t,u),!l)try{const y=Buffer.from(u,"base64url");if(y.length===I(o)){const p=E(y).toString("base64url");l=S[o].verify(f,t,p)}}catch{}if(!l)return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}}}else if(!S[o].verify(f,t,u))return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}};const d=Math.floor(Date.now()/1e3),g=r.clockSkew??0;if(!r.ignoreExpiration&&i.exp!==void 0&&d>i.exp+g)return{valid:!1,error:{reason:"Token expired",code:"TOKEN_EXPIRED"}};if(i.nbf!==void 0&&d+g<i.nbf)return{valid:!1,error:{reason:"Token not yet valid",code:"TOKEN_NOT_ACTIVE"}};if(i.iat!==void 0&&d+g<i.iat)return{valid:!1,error:{reason:"Token issued in the future",code:"TOKEN_FUTURE_ISSUED"}};if(r.maxTokenAge!==void 0&&i.iat!==void 0){const c=d-i.iat;if(c>r.maxTokenAge)return{valid:!1,error:{reason:`Token age (${c}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,code:"TOKEN_TOO_OLD"}}}if(r.issuer!==void 0){if(i.iss===void 0)return{valid:!1,error:{reason:'Token missing required issuer claim ("iss")',code:"MISSING_ISSUER"}};if(r.issuer!==i.iss)return{valid:!1,error:{reason:`Invalid token issuer: expected "${r.issuer}", got "${i.iss}"`,code:"INVALID_ISSUER"}}}if(r.subject!==void 0){if(i.sub===void 0)return{valid:!1,error:{reason:'Token missing required subject claim ("sub")',code:"MISSING_SUBJECT"}};if(r.subject!==i.sub)return{valid:!1,error:{reason:`Invalid token subject: expected "${r.subject}", got "${i.sub}"`,code:"INVALID_SUBJECT"}}}if(r.audience!==void 0){const c=i.aud;if(c===void 0)return{valid:!1,error:{reason:'Token missing required audience claim ("aud")',code:"MISSING_AUDIENCE"}};const l=Array.isArray(r.audience)?r.audience:[r.audience],y=Array.isArray(c)?c:[c];if(!l.some(R=>y.includes(R)))return{valid:!1,error:{reason:"Audience claim mismatch",code:"INVALID_AUDIENCE"}}}if(r.jwtId!==void 0){if(i.jti===void 0)return{valid:!1,error:{reason:'Token missing required JWT ID claim ("jti")',code:"MISSING_JTI"}};if(r.jwtId!==i.jti)return{valid:!1,error:{reason:`Invalid JWT ID: expected "${r.jwtId}", got "${i.jti}"`,code:"INVALID_JTI"}}}return{valid:!0,header:s,payload:i,signature:u}},x={sign:B,verify:J,decode:v,algorithms:S};function P(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");return e.export({format:"jwk"})}function A(e){if(!e||typeof e!="object")throw new Error("Invalid JWK");switch(e.kty){case"oct":{if(!("k"in e)||typeof e.k!="string")throw new Error('Invalid oct JWK: missing "k"');return n.createSecretKey(Buffer.from(e.k,"base64url"))}case"RSA":case"EC":case"OKP":return"d"in e&&typeof e.d=="string"?n.createPrivateKey({format:"jwk",key:e}):n.createPublicKey({format:"jwk",key:e});default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}}function D(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");const r=(e.type==="private"?n.createPublicKey(e):e).export({format:"jwk"});return delete r.d,delete r.p,delete r.q,delete r.dp,delete r.dq,delete r.qi,r}function b(e,t="sha256"){if(!e||typeof e!="object")throw new Error("Invalid JWK");let r;switch(e.kty){case"RSA":r={e:e.e,kty:e.kty,n:e.n};break;case"EC":r={crv:e.crv,kty:e.kty,x:e.x,y:e.y};break;case"OKP":r={crv:e.crv,kty:e.kty,x:e.x};break;case"oct":r={k:e.k,kty:e.kty};break;default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}const a=JSON.stringify(Object.keys(r).sort().reduce((s,i)=>(s[i]=r[i],s),{}));return n.createHash(t).update(a).digest("base64url")}function _(e){if(e.x5c?.length)return n.createHash("sha1").update(Buffer.from(e.x5c[0],"base64")).digest("base64url")}const k={export:P,import:A,toPublic:D,thumbprint:b};function w(e,t){if(!e||!Array.isArray(e.keys))throw new Error("Invalid JWKS");let r;if(t&&(r=e.keys.find(a=>a.kid===t)),!r&&e.keys.length===1&&(r=e.keys[0]),!r)throw new Error("Key not found in JWKS");return A(r)}function N(e){return{keys:e.keys.map(t=>({...t,kid:t.kid??b(t),x5t:t.x5t??_(t)}))}}const $={toKeyObject:w,normalize:N};exports.AutodetectAlgorithm=T;exports.JWK=k;exports.JWKS=$;exports.JWKSToKeyObject=w;exports.JWT=x;exports.SignatureAlgorithm=S;exports.SupportedAlgorithms=H;exports.base64Url=h;exports.computeX5T=_;exports.decode=v;exports.exportJWK=P;exports.getJWKThumbprint=b;exports.importJWK=A;exports.normalizeJWKS=N;exports.sign=B;exports.toPublicJWK=D;exports.verify=J;
-//# sourceMappingURL=index-eYY-I3Pd.cjs.map