@sourceregistry/node-jwt 1.5.1 → 1.5.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/README.md +11 -1
  2. package/dist/{index-CQO8xUW-.js → index-DNa3e1QZ.js} +110 -96
  3. package/dist/index-DNa3e1QZ.js.map +1 -0
  4. package/dist/{index-CJ4L1o5I.cjs → index-YbdG9jsh.cjs} +2 -2
  5. package/dist/index-YbdG9jsh.cjs.map +1 -0
  6. package/dist/index.cjs.js +1 -1
  7. package/dist/index.es.js +7 -6
  8. package/dist/jwks/index.d.ts +14 -10
  9. package/dist/promises.cjs.js +1 -1
  10. package/dist/promises.es.js +2 -2
  11. package/package.json +1 -1
  12. package/dist/index-CJ4L1o5I.cjs.map +0 -1
  13. package/dist/index-CQO8xUW-.js.map +0 -1
package/dist/{index-CJ4L1o5I.cjs → index-YbdG9jsh.cjs} RENAMED
@@ -1,2 +1,2 @@
1
- "use strict";const i=require("crypto"),A={encode:e=>Buffer.from(e).toString("base64url"),decode:e=>Buffer.from(e,"base64url").toString()},K=(e,t)=>e.length!==t.length?!1:i.timingSafeEqual(Buffer.from(e),Buffer.from(t));function D(e){switch(e){case"ES256":case"ES256K":return 64;case"ES384":return 96;case"ES512":return 132;default:throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`)}}function V(e,t){let r=0;if(e[r++]!==48)throw new Error("Invalid DER ECDSA signature");let n=e[r++];if(n&128){const S=n&127;n=0;for(let c=0;c<S;c++)n=n<<8|e[r++]}if(e[r++]!==2)throw new Error("Invalid DER ECDSA signature (r)");const s=e[r++];let a=e.subarray(r,r+s);if(r+=s,e[r++]!==2)throw new Error("Invalid DER ECDSA signature (s)");const u=e[r++];let o=e.subarray(r,r+u);for(;a.length>t/2&&a[0]===0;)a=a.subarray(1);for(;o.length>t/2&&o[0]===0;)o=o.subarray(1);const y=Buffer.concat([Buffer.alloc(t/2-a.length,0),a]),f=Buffer.concat([Buffer.alloc(t/2-o.length,0),o]);return Buffer.concat([y,f])}function P(e){const t=e.length/2;let r=e.subarray(0,t),n=e.subarray(t);for(;r.length>1&&r[0]===0&&(r[1]&128)===0;)r=r.subarray(1);for(;n.length>1&&n[0]===0&&(n[1]&128)===0;)n=n.subarray(1);r[0]&128&&(r=Buffer.concat([Buffer.from([0]),r])),n[0]&128&&(n=Buffer.concat([Buffer.from([0]),n]));const s=Buffer.concat([Buffer.from([2,r.length]),r]),a=Buffer.concat([Buffer.from([2,n.length]),n]),u=s.length+a.length;let o;if(u<128)o=Buffer.from([u]);else{const y=[];let f=u;for(;f>0;)y.unshift(f&255),f>>=8;o=Buffer.from([128|y.length,...y])}return Buffer.concat([Buffer.from([48]),o,s,a])}function W(e){return e==="ES256"||e==="ES384"||e==="ES512"||e==="ES256K"}const p={HS256:{sign:(e,t)=>i.createHmac("sha256",t).update(e).digest("base64url"),verify:(e,t,r)=>{const n=i.createHmac("sha256",t).update(e).digest("base64url");return K(n,r)}},HS384:{sign:(e,t)=>i.createHmac("sha384",t).update(e).digest("base64url"),verify:(e,t,r)=>{const n=i.createHmac("sha384",t).update(e).digest("base64url");return K(n,r)}},HS512:{sign:(e,t)=>i.createHmac("sha512",t).update(e).digest("base64url"),verify:(e,t,r)=>{const n=i.createHmac("sha512",t).update(e).digest("base64url");return K(n,r)}},RS256:{sign:(e,t)=>i.createSign("RSA-SHA256").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA256").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},RS384:{sign:(e,t)=>i.createSign("RSA-SHA384").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA384").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},RS512:{sign:(e,t)=>i.createSign("RSA-SHA512").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA512").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES256:{sign:(e,t)=>i.createSign("SHA256").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("SHA256").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES384:{sign:(e,t)=>i.createSign("SHA384").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("SHA384").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES512:{sign:(e,t)=>i.createSign("SHA512").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("SHA512").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES256K:{sign:(e,t)=>i.createSign("SHA256").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("SHA256").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},PS256:{sign:(e,t)=>i.createSign("RSA-SHA256").update(e).end().sign({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:32}).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA256").update(e).end().verify({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:32},Buffer.from(r,"base64url"))}catch{return!1}}},PS384:{sign:(e,t)=>i.createSign("RSA-SHA384").update(e).end().sign({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:48}).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA384").update(e).end().verify({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:48},Buffer.from(r,"base64url"))}catch{return!1}}},PS512:{sign:(e,t)=>i.createSign("RSA-SHA512").update(e).end().sign({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:64}).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA512").update(e).end().verify({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:64},Buffer.from(r,"base64url"))}catch{return!1}}},EdDSA:{sign:(e,t)=>i.sign(null,typeof e=="string"?Buffer.from(e,"utf8"):e,t).toString("base64url"),verify:(e,t,r)=>{try{return i.verify(null,typeof e=="string"?Buffer.from(e,"utf8"):e,t,Buffer.from(r,"base64url"))}catch{return!1}}}},C=Object.keys(p);function k(e){if(e.type==="secret")return"HS256";if(e.type!=="private")throw new Error("Only private or symmetric keys can be used to sign JWTs");const t=e.asymmetricKeyType,r=e.asymmetricKeyDetails;switch(t){case"rsa":return"RS256";case"rsa-pss":{const n=r?.hashAlgorithm??"sha256";switch(n){case"sha256":return"PS256";case"sha384":return"PS384";case"sha512":return"PS512";default:throw new Error(`Unsupported RSA-PSS hash algorithm: ${n}`)}}case"ec":{const n=r?.namedCurve;switch(n){case"P-256":case"prime256v1":return"ES256";case"P-384":case"secp384r1":return"ES384";case"P-521":case"secp521r1":return"ES512";case"secp256k1":return"ES256K";default:throw new Error(`Unsupported EC curve: ${n}`)}}case"ed25519":return"EdDSA";default:throw new Error(`Unsupported asymmetric key type: ${t}`)}}function M(e){if(typeof e=="object"&&"type"in e)return e;try{return i.createPrivateKey(e)}catch{const t=typeof e=="string"?Buffer.from(e,"utf8"):Buffer.isBuffer(e)?e:(()=>{throw new Error("Unsupported key type")})();return i.createSecretKey(t)}}const T=e=>{const t=e.split(".");if(t.length!==3)throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');const[r,n,s]=t;if(!r||!n||!s)throw new Error("Invalid JWT: empty part detected");try{const a=JSON.parse(A.decode(r)),u=JSON.parse(A.decode(n));return{header:a,payload:u,signature:s}}catch(a){throw new Error(`Invalid JWT: malformed header or payload (${a.message})`)}},_=(e,t,r={})=>{const n=M(t),s=r.alg??k(n),a=r.signatureFormat??"der",u=r.typ??"JWT";if(!(s in p))throw new Error(`Unsupported algorithm: ${s}`);const o={alg:s,typ:u};r.kid&&(o.kid=r.kid);const y=A.encode(JSON.stringify(o)),f=A.encode(JSON.stringify(e)),S=`${y}.${f}`;let c=p[s].sign(S,t);if(a==="jose"&&W(s)){const g=Buffer.from(c,"base64url");c=V(g,D(s)).toString("base64url")}return`${y}.${f}.${c}`},N=(e,t,r={})=>{let n;try{n=T(e)}catch(c){return{valid:!1,error:{reason:c.message,code:"INVALID_TOKEN"}}}const{header:s,payload:a,signature:u}=n,o=s.alg;if(!(o in p))return{valid:!1,error:{reason:`Unsupported or unknown algorithm: ${s.alg}`,code:"INVALID_ALGORITHM"}};if(r.algorithms&&r.algorithms.length>0&&!r.algorithms.includes(o))return{valid:!1,error:{reason:`Algorithm "${o}" is not in the allowed algorithms list`,code:"ALGORITHM_NOT_ALLOWED"}};if(s.typ!==void 0&&s.typ!=="JWT")return{valid:!1,error:{reason:`Invalid token type: expected 'JWT', got '${s.typ}'`,code:"INVALID_TYPE"}};const y=`${A.encode(JSON.stringify(s))}.${A.encode(JSON.stringify(a))}`;if(W(o)){const c=r.signatureFormat;let g;if(c==="jose")try{const m=Buffer.from(u,"base64url"),d=P(m).toString("base64url");g=p[o].verify(y,t,d)}catch{g=!1}else if(c==="der")g=p[o].verify(y,t,u);else if(g=p[o].verify(y,t,u),!g)try{const m=Buffer.from(u,"base64url");if(m.length===D(o)){const d=P(m).toString("base64url");g=p[o].verify(y,t,d)}}catch{}if(!g)return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}}}else if(!p[o].verify(y,t,u))return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}};const f=Math.floor(Date.now()/1e3),S=r.clockSkew??0;if(!r.ignoreExpiration&&a.exp!==void 0&&f>a.exp+S)return{valid:!1,error:{reason:"Token expired",code:"TOKEN_EXPIRED"}};if(a.nbf!==void 0&&f+S<a.nbf)return{valid:!1,error:{reason:"Token not yet valid",code:"TOKEN_NOT_ACTIVE"}};if(a.iat!==void 0&&f+S<a.iat)return{valid:!1,error:{reason:"Token issued in the future",code:"TOKEN_FUTURE_ISSUED"}};if(r.maxTokenAge!==void 0&&a.iat!==void 0){const c=f-a.iat;if(c>r.maxTokenAge)return{valid:!1,error:{reason:`Token age (${c}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,code:"TOKEN_TOO_OLD"}}}if(r.issuer!==void 0){if(a.iss===void 0)return{valid:!1,error:{reason:'Token missing required issuer claim ("iss")',code:"MISSING_ISSUER"}};if(r.issuer!==a.iss)return{valid:!1,error:{reason:`Invalid token issuer: expected "${r.issuer}", got "${a.iss}"`,code:"INVALID_ISSUER"}}}if(r.subject!==void 0){if(a.sub===void 0)return{valid:!1,error:{reason:'Token missing required subject claim ("sub")',code:"MISSING_SUBJECT"}};if(r.subject!==a.sub)return{valid:!1,error:{reason:`Invalid token subject: expected "${r.subject}", got "${a.sub}"`,code:"INVALID_SUBJECT"}}}if(r.audience!==void 0){const c=a.aud;if(c===void 0)return{valid:!1,error:{reason:'Token missing required audience claim ("aud")',code:"MISSING_AUDIENCE"}};const g=Array.isArray(r.audience)?r.audience:[r.audience],m=Array.isArray(c)?c:[c];if(!g.some(l=>m.includes(l)))return{valid:!1,error:{reason:"Audience claim mismatch",code:"INVALID_AUDIENCE"}}}if(r.jwtId!==void 0){if(a.jti===void 0)return{valid:!1,error:{reason:'Token missing required JWT ID claim ("jti")',code:"MISSING_JTI"}};if(r.jwtId!==a.jti)return{valid:!1,error:{reason:`Invalid JWT ID: expected "${r.jwtId}", got "${a.jti}"`,code:"INVALID_JTI"}}}return{valid:!0,header:s,payload:a,signature:u}},G={sign:_,verify:N,decode:T,algorithms:p};function R(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");return e.export({format:"jwk"})}function J(e){if(!e||typeof e!="object")throw new Error("Invalid JWK");switch(e.kty){case"oct":{if(!("k"in e)||typeof e.k!="string")throw new Error('Invalid oct JWK: missing "k"');return i.createSecretKey(Buffer.from(e.k,"base64url"))}case"RSA":case"EC":case"OKP":return"d"in e&&typeof e.d=="string"?i.createPrivateKey({format:"jwk",key:e}):i.createPublicKey({format:"jwk",key:e});default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}}function H(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");const r=(e.type==="private"?i.createPublicKey(e):e).export({format:"jwk"});return delete r.d,delete r.p,delete r.q,delete r.dp,delete r.dq,delete r.qi,r}function B(e,t="sha256"){if(!e||typeof e!="object")throw new Error("Invalid JWK");let r;switch(e.kty){case"RSA":r={e:e.e,kty:e.kty,n:e.n};break;case"EC":r={crv:e.crv,kty:e.kty,x:e.x,y:e.y};break;case"OKP":r={crv:e.crv,kty:e.kty,x:e.x};break;case"oct":r={k:e.k,kty:e.kty};break;default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}const n=JSON.stringify(Object.keys(r).sort().reduce((s,a)=>(s[a]=r[a],s),{}));return i.createHash(t).update(n).digest("base64url")}function O(e){if(e.x5c?.length)return i.createHash("sha1").update(Buffer.from(e.x5c[0],"base64")).digest("base64url")}const q={export:R,import:J,toPublic:H,thumbprint:B};function x(e,t){if(!e||!Array.isArray(e.keys))throw new Error("Invalid JWKS");let r;if(t&&(r=e.keys.find(n=>n.kid===t)),!r&&e.keys.length===1&&(r=e.keys[0]),!r)throw new Error("Key not found in JWKS");return J(r)}function I(e){return{keys:e.keys.map(t=>({...t,kid:t.kid??B(t),x5t:t.x5t??O(t)}))}}const $=async(e,t={})=>{const r=typeof e=="string"?e:e.toString(),n=t.fetch??globalThis.fetch,s=Math.max(0,t.ttl??5*6e4),a=Math.max(0,t.timeoutMs??5e3),u="/.well-known/jwks.json";if(!n)throw new Error("No fetch implementation available");const o=(()=>{if(t.endpointOverride){const d=t.endpointOverride;try{return new URL(d,r).toString()}catch{return d}}return t.overrideEndpointCheck||r.endsWith(u)?r:`${r.replace(/\/+$/,"")}${u}`})(),y=(()=>{if(t.cache)return t.cache;let d;return{get:()=>d,set:(l,h)=>{d=h}}})();let f,S=0,c,g=0;const m=async d=>{if(c)return c;c=(async()=>{const l=new AbortController;let h;a>0&&(h=setTimeout(()=>l.abort(),a));let v;try{v=await n(o,{signal:l.signal})}catch(E){throw l.signal.aborted?new Error(`JWKS fetch timed out after ${a}ms`):E}finally{h&&clearTimeout(h)}if(!v.ok)throw new Error(`Failed to fetch JWKS: ${v.status} ${v.statusText}`);const b=await v.json();if(!b||typeof b!="object"||!Array.isArray(b.keys))throw new Error("Invalid JWKS");return I(b)})();try{const l=await c;return f=l,await y.set(o,l),g=0,s>0&&(S=Date.now()+s),l}catch(l){if(!d||!f)throw l;if(g+=1,s>0){const h=Math.min(Math.max(s,3e4)*Math.pow(2,g-1),9e5);S=Date.now()+h}return console.warn(`JWKS refresh failed for "${o}", using stale cache.`,l),f}finally{c=void 0}};return f=await y.get(o),f?(f=I(f),s>0&&(S=Date.now()+s)):f=await m(!1),{async list(){return s>0&&Date.now()>=S&&await m(!0),Promise.resolve(f.keys)},async refresh(){return await m(!1),f.keys},async key(d){return(await this.list()).find(h=>h.kid===d)},async find(d){const l=await this.list(),h=Object.entries(d);return h.length===0?l:l.filter(v=>h.every(([b,E])=>{const w=v[b];return Array.isArray(E)?Array.isArray(w)&&w.length===E.length&&w.every((U,L)=>U===E[L]):w===E}))},async findFirst(d){return this.find(d).then(([l])=>l)},export(){return f}}},F={toKeyObject:x,normalize:I,fromWeb:$};exports.AutodetectAlgorithm=k;exports.JWK=q;exports.JWKS=F;exports.JWKSToKeyObject=x;exports.JWT=G;exports.SignatureAlgorithm=p;exports.SupportedAlgorithms=C;exports.base64Url=A;exports.computeX5T=O;exports.decode=T;exports.exportJWK=R;exports.fromWeb=$;exports.getJWKThumbprint=B;exports.importJWK=J;exports.normalizeJWKS=I;exports.sign=_;exports.toPublicJWK=H;exports.verify=N;
2
- //# sourceMappingURL=index-CJ4L1o5I.cjs.map
1
+ "use strict";const i=require("crypto"),b={encode:e=>Buffer.from(e).toString("base64url"),decode:e=>Buffer.from(e,"base64url").toString()},T=(e,t)=>e.length!==t.length?!1:i.timingSafeEqual(Buffer.from(e),Buffer.from(t));function D(e){switch(e){case"ES256":case"ES256K":return 64;case"ES384":return 96;case"ES512":return 132;default:throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`)}}function C(e,t){let r=0;if(e[r++]!==48)throw new Error("Invalid DER ECDSA signature");let n=e[r++];if(n&128){const h=n&127;n=0;for(let c=0;c<h;c++)n=n<<8|e[r++]}if(e[r++]!==2)throw new Error("Invalid DER ECDSA signature (r)");const s=e[r++];let a=e.subarray(r,r+s);if(r+=s,e[r++]!==2)throw new Error("Invalid DER ECDSA signature (s)");const u=e[r++];let o=e.subarray(r,r+u);for(;a.length>t/2&&a[0]===0;)a=a.subarray(1);for(;o.length>t/2&&o[0]===0;)o=o.subarray(1);const y=Buffer.concat([Buffer.alloc(t/2-a.length,0),a]),f=Buffer.concat([Buffer.alloc(t/2-o.length,0),o]);return Buffer.concat([y,f])}function W(e){const t=e.length/2;let r=e.subarray(0,t),n=e.subarray(t);for(;r.length>1&&r[0]===0&&(r[1]&128)===0;)r=r.subarray(1);for(;n.length>1&&n[0]===0&&(n[1]&128)===0;)n=n.subarray(1);r[0]&128&&(r=Buffer.concat([Buffer.from([0]),r])),n[0]&128&&(n=Buffer.concat([Buffer.from([0]),n]));const s=Buffer.concat([Buffer.from([2,r.length]),r]),a=Buffer.concat([Buffer.from([2,n.length]),n]),u=s.length+a.length;let o;if(u<128)o=Buffer.from([u]);else{const y=[];let f=u;for(;f>0;)y.unshift(f&255),f>>=8;o=Buffer.from([128|y.length,...y])}return Buffer.concat([Buffer.from([48]),o,s,a])}function k(e){return e==="ES256"||e==="ES384"||e==="ES512"||e==="ES256K"}const p={HS256:{sign:(e,t)=>i.createHmac("sha256",t).update(e).digest("base64url"),verify:(e,t,r)=>{const n=i.createHmac("sha256",t).update(e).digest("base64url");return T(n,r)}},HS384:{sign:(e,t)=>i.createHmac("sha384",t).update(e).digest("base64url"),verify:(e,t,r)=>{const n=i.createHmac("sha384",t).update(e).digest("base64url");return T(n,r)}},HS512:{sign:(e,t)=>i.createHmac("sha512",t).update(e).digest("base64url"),verify:(e,t,r)=>{const n=i.createHmac("sha512",t).update(e).digest("base64url");return T(n,r)}},RS256:{sign:(e,t)=>i.createSign("RSA-SHA256").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA256").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},RS384:{sign:(e,t)=>i.createSign("RSA-SHA384").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA384").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},RS512:{sign:(e,t)=>i.createSign("RSA-SHA512").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA512").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES256:{sign:(e,t)=>i.createSign("SHA256").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("SHA256").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES384:{sign:(e,t)=>i.createSign("SHA384").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("SHA384").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES512:{sign:(e,t)=>i.createSign("SHA512").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("SHA512").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},ES256K:{sign:(e,t)=>i.createSign("SHA256").update(e).end().sign(t).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("SHA256").update(e).end().verify(t,Buffer.from(r,"base64url"))}catch{return!1}}},PS256:{sign:(e,t)=>i.createSign("RSA-SHA256").update(e).end().sign({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:32}).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA256").update(e).end().verify({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:32},Buffer.from(r,"base64url"))}catch{return!1}}},PS384:{sign:(e,t)=>i.createSign("RSA-SHA384").update(e).end().sign({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:48}).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA384").update(e).end().verify({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:48},Buffer.from(r,"base64url"))}catch{return!1}}},PS512:{sign:(e,t)=>i.createSign("RSA-SHA512").update(e).end().sign({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:64}).toString("base64url"),verify:(e,t,r)=>{try{return i.createVerify("RSA-SHA512").update(e).end().verify({key:t,padding:i.constants.RSA_PKCS1_PSS_PADDING,saltLength:64},Buffer.from(r,"base64url"))}catch{return!1}}},EdDSA:{sign:(e,t)=>i.sign(null,typeof e=="string"?Buffer.from(e,"utf8"):e,t).toString("base64url"),verify:(e,t,r)=>{try{return i.verify(null,typeof e=="string"?Buffer.from(e,"utf8"):e,t,Buffer.from(r,"base64url"))}catch{return!1}}}},M=Object.keys(p);function _(e){if(e.type==="secret")return"HS256";if(e.type!=="private")throw new Error("Only private or symmetric keys can be used to sign JWTs");const t=e.asymmetricKeyType,r=e.asymmetricKeyDetails;switch(t){case"rsa":return"RS256";case"rsa-pss":{const n=r?.hashAlgorithm??"sha256";switch(n){case"sha256":return"PS256";case"sha384":return"PS384";case"sha512":return"PS512";default:throw new Error(`Unsupported RSA-PSS hash algorithm: ${n}`)}}case"ec":{const n=r?.namedCurve;switch(n){case"P-256":case"prime256v1":return"ES256";case"P-384":case"secp384r1":return"ES384";case"P-521":case"secp521r1":return"ES512";case"secp256k1":return"ES256K";default:throw new Error(`Unsupported EC curve: ${n}`)}}case"ed25519":return"EdDSA";default:throw new Error(`Unsupported asymmetric key type: ${t}`)}}function G(e){if(typeof e=="object"&&"type"in e)return e;try{return i.createPrivateKey(e)}catch{const t=typeof e=="string"?Buffer.from(e,"utf8"):Buffer.isBuffer(e)?e:(()=>{throw new Error("Unsupported key type")})();return i.createSecretKey(t)}}const B=e=>{const t=e.split(".");if(t.length!==3)throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');const[r,n,s]=t;if(!r||!n||!s)throw new Error("Invalid JWT: empty part detected");try{const a=JSON.parse(b.decode(r)),u=JSON.parse(b.decode(n));return{header:a,payload:u,signature:s}}catch(a){throw new Error(`Invalid JWT: malformed header or payload (${a.message})`)}},N=(e,t,r={})=>{const n=G(t),s=r.alg??_(n),a=r.signatureFormat??"der",u=r.typ??"JWT";if(!(s in p))throw new Error(`Unsupported algorithm: ${s}`);const o={alg:s,typ:u};r.kid&&(o.kid=r.kid);const y=b.encode(JSON.stringify(o)),f=b.encode(JSON.stringify(e)),h=`${y}.${f}`;let c=p[s].sign(h,t);if(a==="jose"&&k(s)){const g=Buffer.from(c,"base64url");c=C(g,D(s)).toString("base64url")}return`${y}.${f}.${c}`},R=(e,t,r={})=>{let n;try{n=B(e)}catch(c){return{valid:!1,error:{reason:c.message,code:"INVALID_TOKEN"}}}const{header:s,payload:a,signature:u}=n,o=s.alg;if(!(o in p))return{valid:!1,error:{reason:`Unsupported or unknown algorithm: ${s.alg}`,code:"INVALID_ALGORITHM"}};if(r.algorithms&&r.algorithms.length>0&&!r.algorithms.includes(o))return{valid:!1,error:{reason:`Algorithm "${o}" is not in the allowed algorithms list`,code:"ALGORITHM_NOT_ALLOWED"}};if(s.typ!==void 0&&s.typ!=="JWT")return{valid:!1,error:{reason:`Invalid token type: expected 'JWT', got '${s.typ}'`,code:"INVALID_TYPE"}};const y=`${b.encode(JSON.stringify(s))}.${b.encode(JSON.stringify(a))}`;if(k(o)){const c=r.signatureFormat;let g;if(c==="jose")try{const m=Buffer.from(u,"base64url"),d=W(m).toString("base64url");g=p[o].verify(y,t,d)}catch{g=!1}else if(c==="der")g=p[o].verify(y,t,u);else if(g=p[o].verify(y,t,u),!g)try{const m=Buffer.from(u,"base64url");if(m.length===D(o)){const d=W(m).toString("base64url");g=p[o].verify(y,t,d)}}catch{}if(!g)return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}}}else if(!p[o].verify(y,t,u))return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}};const f=Math.floor(Date.now()/1e3),h=r.clockSkew??0;if(!r.ignoreExpiration&&a.exp!==void 0&&f>a.exp+h)return{valid:!1,error:{reason:"Token expired",code:"TOKEN_EXPIRED"}};if(a.nbf!==void 0&&f+h<a.nbf)return{valid:!1,error:{reason:"Token not yet valid",code:"TOKEN_NOT_ACTIVE"}};if(a.iat!==void 0&&f+h<a.iat)return{valid:!1,error:{reason:"Token issued in the future",code:"TOKEN_FUTURE_ISSUED"}};if(r.maxTokenAge!==void 0&&a.iat!==void 0){const c=f-a.iat;if(c>r.maxTokenAge)return{valid:!1,error:{reason:`Token age (${c}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,code:"TOKEN_TOO_OLD"}}}if(r.issuer!==void 0){if(a.iss===void 0)return{valid:!1,error:{reason:'Token missing required issuer claim ("iss")',code:"MISSING_ISSUER"}};if(r.issuer!==a.iss)return{valid:!1,error:{reason:`Invalid token issuer: expected "${r.issuer}", got "${a.iss}"`,code:"INVALID_ISSUER"}}}if(r.subject!==void 0){if(a.sub===void 0)return{valid:!1,error:{reason:'Token missing required subject claim ("sub")',code:"MISSING_SUBJECT"}};if(r.subject!==a.sub)return{valid:!1,error:{reason:`Invalid token subject: expected "${r.subject}", got "${a.sub}"`,code:"INVALID_SUBJECT"}}}if(r.audience!==void 0){const c=a.aud;if(c===void 0)return{valid:!1,error:{reason:'Token missing required audience claim ("aud")',code:"MISSING_AUDIENCE"}};const g=Array.isArray(r.audience)?r.audience:[r.audience],m=Array.isArray(c)?c:[c];if(!g.some(l=>m.includes(l)))return{valid:!1,error:{reason:"Audience claim mismatch",code:"INVALID_AUDIENCE"}}}if(r.jwtId!==void 0){if(a.jti===void 0)return{valid:!1,error:{reason:'Token missing required JWT ID claim ("jti")',code:"MISSING_JTI"}};if(r.jwtId!==a.jti)return{valid:!1,error:{reason:`Invalid JWT ID: expected "${r.jwtId}", got "${a.jti}"`,code:"INVALID_JTI"}}}return{valid:!0,header:s,payload:a,signature:u}},j={sign:N,verify:R,decode:B,algorithms:p};function O(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");return e.export({format:"jwk"})}function J(e){if(!e||typeof e!="object")throw new Error("Invalid JWK");switch(e.kty){case"oct":{if(!("k"in e)||typeof e.k!="string")throw new Error('Invalid oct JWK: missing "k"');return i.createSecretKey(Buffer.from(e.k,"base64url"))}case"RSA":case"EC":case"OKP":return"d"in e&&typeof e.d=="string"?i.createPrivateKey({format:"jwk",key:e}):i.createPublicKey({format:"jwk",key:e});default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}}function H(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");const r=(e.type==="private"?i.createPublicKey(e):e).export({format:"jwk"});return delete r.d,delete r.p,delete r.q,delete r.dp,delete r.dq,delete r.qi,r}function P(e,t="sha256"){if(!e||typeof e!="object")throw new Error("Invalid JWK");let r;switch(e.kty){case"RSA":r={e:e.e,kty:e.kty,n:e.n};break;case"EC":r={crv:e.crv,kty:e.kty,x:e.x,y:e.y};break;case"OKP":r={crv:e.crv,kty:e.kty,x:e.x};break;case"oct":r={k:e.k,kty:e.kty};break;default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}const n=JSON.stringify(Object.keys(r).sort().reduce((s,a)=>(s[a]=r[a],s),{}));return i.createHash(t).update(n).digest("base64url")}function x(e){if(e.x5c?.length)return i.createHash("sha1").update(Buffer.from(e.x5c[0],"base64")).digest("base64url")}const q={export:O,import:J,toPublic:H,thumbprint:P};function $(e,t){if(!e||!Array.isArray(e.keys))throw new Error("Invalid JWKS");let r;if(t&&(r=e.keys.find(n=>n.kid===t)),!r&&e.keys.length===1&&(r=e.keys[0]),!r)throw new Error("Key not found in JWKS");return J(r)}function K(e){return{keys:w(...e.keys)}}function w(...e){return e.map(t=>{const r={...t,kid:t.kid??P(t),x5t:t.x5t??x(t)};return Object.defineProperty(r,"toKeyObject",{enumerable:!1,configurable:!1,writable:!1,value:()=>J(r)}),r})}const U=async(e,t={})=>{const r=typeof e=="string"?e:e.toString(),n=t.fetch??globalThis.fetch,s=Math.max(0,t.ttl??5*6e4),a=Math.max(0,t.timeoutMs??5e3),u="/.well-known/jwks.json";if(!n)throw new Error("No fetch implementation available");const o=(()=>{if(t.endpointOverride){const d=t.endpointOverride;try{return new URL(d,r).toString()}catch{return d}}return t.overrideEndpointCheck||r.endsWith(u)?r:`${r.replace(/\/+$/,"")}${u}`})(),y=(()=>{if(t.cache)return t.cache;let d;return{get:()=>d,set:(l,S)=>{d=S}}})();let f,h=0,c,g=0;const m=async d=>{if(c)return c;c=(async()=>{const l=new AbortController;let S;a>0&&(S=setTimeout(()=>l.abort(),a));let v;try{v=await n(o,{signal:l.signal})}catch(E){throw l.signal.aborted?new Error(`JWKS fetch timed out after ${a}ms`):E}finally{S&&clearTimeout(S)}if(!v.ok)throw new Error(`Failed to fetch JWKS: ${v.status} ${v.statusText}`);const A=await v.json();if(!A||typeof A!="object"||!Array.isArray(A.keys))throw new Error("Invalid JWKS");return K(A)})();try{const l=await c;return f=l,await y.set(o,l),g=0,s>0&&(h=Date.now()+s),l}catch(l){if(!d||!f)throw l;if(g+=1,s>0){const S=Math.min(Math.max(s,3e4)*Math.pow(2,g-1),9e5);h=Date.now()+S}return console.warn(`JWKS refresh failed for "${o}", using stale cache.`,l),f}finally{c=void 0}};return f=await y.get(o),f?(f=K(f),s>0&&(h=Date.now()+s)):f=await m(!1),{async list(){return s>0&&Date.now()>=h&&await m(!0),w(...f.keys)},async refresh(){return await m(!1),this},async key(d){const S=(await this.list()).find(v=>v.kid===d);if(S)return w(S)[0]},async find(d){const l=await this.list(),S=Object.entries(d);return S.length===0?w(...l):w(...l.filter(v=>S.every(([A,E])=>{const I=v[A];return Array.isArray(E)?Array.isArray(I)&&I.length===E.length&&I.every((L,V)=>L===E[V]):I===E})))},async findFirst(d){return this.find(d).then(([l])=>l)},export(){return f}}},F={toKeyObject:$,normalize:K,fromWeb:U};exports.AutodetectAlgorithm=_;exports.JWK=q;exports.JWKS=F;exports.JWKSToKeyObject=$;exports.JWT=j;exports.SignatureAlgorithm=p;exports.SupportedAlgorithms=M;exports.base64Url=b;exports.computeX5T=x;exports.decode=B;exports.exportJWK=O;exports.fromWeb=U;exports.getJWKThumbprint=P;exports.importJWK=J;exports.normalizeJWK=w;exports.normalizeJWKS=K;exports.sign=N;exports.toPublicJWK=H;exports.verify=R;
2
+ //# sourceMappingURL=index-YbdG9jsh.cjs.map
package/dist/index-YbdG9jsh.cjs.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index-YbdG9jsh.cjs","sources":["../src/jwt/index.ts","../src/jwks/index.ts"],"sourcesContent":["import crypto, {\n createHmac,\n createSign,\n createVerify,\n createPrivateKey,\n createSecretKey,\n sign as cryptoSign,\n verify as cryptoVerify,\n timingSafeEqual,\n type BinaryLike,\n type KeyLike,\n type KeyObject\n} from 'crypto';\n\n// Base64URL helpers (padding-safe)\nexport const base64Url = {\n encode: (input: string | Buffer): string => Buffer.from(input).toString('base64url'),\n decode: (input: string): string => Buffer.from(input, 'base64url').toString()\n};\n\n/**\n * Timing-safe string comparison to prevent timing attacks\n * @param a\n * @param b\n */\nconst timingSafeCompare = (a: string, b: string): boolean => {\n if (a.length !== b.length) {\n return false;\n }\n return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n};\n\n// Standard JWT payload claims\nexport interface JWTPayload {\n /**\n * Issuer\n */\n iss?: string;\n /**\n * Subject\n */\n sub?: string;\n /**\n * Audience\n */\n aud?: string | string[];\n /**\n * Expiration Time (as UNIX timestamp)\n */\n exp?: number;\n /**\n * Not Before (as UNIX timestamp)\n */\n nbf?: number;\n /**\n * Issued At (as UNIX timestamp)\n */\n iat?: number;\n /**\n * JWT ID\n */\n jti?: string;\n /**\n * Session ID\n */\n sid?: string;\n\n /**\n * Custom claims\n */\n [key: string]: unknown;\n}\n\nexport interface JWTHeader {\n alg: string; // Allow unknown algs during decode\n typ?: string;\n kid?: string;\n}\n\nexport interface JWT {\n header: JWTHeader;\n payload: JWTPayload;\n signature: string;\n}\n\n\n//JOSE-helpers\nfunction joseLenForAlg(alg: string): number {\n switch (alg) {\n case 'ES256':\n case 'ES256K':\n return 64; // 32 + 32\n case 'ES384':\n return 96; // 48 + 48\n case 'ES512':\n return 132; // 66 + 66 (P-521)\n default:\n throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${alg}`);\n }\n}\n\nfunction derToJose(der: Buffer, outLen: number): Buffer {\n let i = 0;\n if (der[i++] !== 0x30) throw new Error('Invalid DER ECDSA signature');\n\n // seq length (short/long form)\n let seqLen = der[i++];\n if (seqLen & 0x80) {\n const n = seqLen & 0x7f;\n seqLen = 0;\n for (let k = 0; k < n; k++) seqLen = (seqLen << 8) | der[i++];\n }\n\n if (der[i++] !== 0x02) throw new Error('Invalid DER ECDSA signature (r)');\n const rLen = der[i++];\n let r = der.subarray(i, i + rLen);\n i += rLen;\n\n if (der[i++] !== 0x02) throw new Error('Invalid DER ECDSA signature (s)');\n const sLen = der[i++];\n let s = der.subarray(i, i + sLen);\n\n // strip leading zeros\n while (r.length > outLen / 2 && r[0] === 0x00) r = r.subarray(1);\n while (s.length > outLen / 2 && s[0] === 0x00) s = s.subarray(1);\n\n const rPad = Buffer.concat([Buffer.alloc(outLen / 2 - r.length, 0), r]);\n const sPad = Buffer.concat([Buffer.alloc(outLen / 2 - s.length, 0), s]);\n return Buffer.concat([rPad, sPad]);\n}\n\nfunction joseToDer(jose: Buffer): Buffer {\n const half = jose.length / 2;\n let r = jose.subarray(0, half);\n let s = jose.subarray(half);\n\n // trim leading zeros\n while (r.length > 1 && r[0] === 0x00 && (r[1] & 0x80) === 0) r = r.subarray(1);\n while (s.length > 1 && s[0] === 0x00 && (s[1] & 0x80) === 0) s = s.subarray(1);\n\n // if high bit set, prepend 0x00\n if (r[0] & 0x80) r = Buffer.concat([Buffer.from([0x00]), r]);\n if (s[0] & 0x80) s = Buffer.concat([Buffer.from([0x00]), s]);\n\n const rPart = Buffer.concat([Buffer.from([0x02, r.length]), r]);\n const sPart = Buffer.concat([Buffer.from([0x02, s.length]), s]);\n\n const seqLen = rPart.length + sPart.length;\n\n let lenBytes: Buffer;\n if (seqLen < 0x80) {\n lenBytes = Buffer.from([seqLen]);\n } else {\n const tmp: number[] = [];\n let n = seqLen;\n while (n > 0) {\n tmp.unshift(n & 0xff);\n n >>= 8;\n }\n lenBytes = Buffer.from([0x80 | tmp.length, ...tmp]);\n }\n\n return Buffer.concat([Buffer.from([0x30]), lenBytes, rPart, sPart]);\n}\n\nfunction isEcdsaAlg(alg: string): boolean {\n return alg === 'ES256' || alg === 'ES384' || alg === 'ES512' || alg === 'ES256K';\n}\n\n\n// Signature algorithms\nexport const SignatureAlgorithm = {\n // HMAC\n HS256: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createHmac('sha256', secret).update(data).digest('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n const expected = createHmac('sha256', secret).update(data).digest('base64url');\n return timingSafeCompare(expected, signature);\n }\n },\n HS384: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createHmac('sha384', secret).update(data).digest('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n const expected = createHmac('sha384', secret).update(data).digest('base64url');\n return timingSafeCompare(expected, signature);\n }\n },\n HS512: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createHmac('sha512', secret).update(data).digest('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n const expected = createHmac('sha512', secret).update(data).digest('base64url');\n return timingSafeCompare(expected, signature);\n }\n },\n\n // RSA (DER-encoded signatures, base64url)\n RS256: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA256').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA256')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n RS384: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA384').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA384')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n RS512: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA512').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA512')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n\n // ECDSA (DER-encoded by default — no dsaEncoding!)\n ES256: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('SHA256').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('SHA256')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n ES384: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('SHA384').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('SHA384')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n ES512: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('SHA512').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('SHA512')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n ES256K: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('SHA256').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('SHA256')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n PS256: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA256')\n .update(data)\n .end()\n .sign({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 32\n })\n .toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA256')\n .update(data)\n .end()\n .verify({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 32\n }, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n PS384: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA384')\n .update(data)\n .end()\n .sign({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 48\n })\n .toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA384')\n .update(data)\n .end()\n .verify({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 48\n }, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n PS512: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA512')\n .update(data)\n .end()\n .sign({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 64\n })\n .toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA512')\n .update(data)\n .end()\n .verify({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 64\n }, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n EdDSA: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n cryptoSign(null, typeof data === 'string' ? Buffer.from(data, 'utf8') : data, secret)\n .toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return cryptoVerify(\n null,\n typeof data === 'string' ? Buffer.from(data, 'utf8') : data,\n secret,\n Buffer.from(signature, 'base64url')\n );\n } catch {\n return false;\n }\n }\n }\n} as const;\n\nexport type SupportedAlgorithm = keyof typeof SignatureAlgorithm;\n\nexport const SupportedAlgorithms = Object.keys(SignatureAlgorithm) as Array<SupportedAlgorithm>;\n\n/**\n * Autodetection of algorithm for KeyObjects\n * @param key\n * @constructor\n */\nexport function AutodetectAlgorithm(key: KeyObject): SupportedAlgorithm {\n if (key.type === 'secret') return 'HS256';\n if (key.type !== 'private') throw new Error('Only private or symmetric keys can be used to sign JWTs');\n\n const asymKeyType = key.asymmetricKeyType;\n const details = key.asymmetricKeyDetails;\n\n switch (asymKeyType) {\n case 'rsa':\n return 'RS256';\n case 'rsa-pss': {\n const hash = details?.hashAlgorithm ?? 'sha256';\n switch (hash) {\n case 'sha256':\n return 'PS256';\n case 'sha384':\n return 'PS384';\n case 'sha512':\n return 'PS512';\n default:\n throw new Error(`Unsupported RSA-PSS hash algorithm: ${hash}`);\n }\n }\n case 'ec': {\n const curve = details?.namedCurve;\n switch (curve) {\n case 'P-256':\n case 'prime256v1':\n return 'ES256';\n case 'P-384':\n case 'secp384r1':\n return 'ES384';\n case 'P-521':\n case 'secp521r1':\n return 'ES512';\n case 'secp256k1':\n return 'ES256K';\n default:\n throw new Error(`Unsupported EC curve: ${curve}`);\n }\n }\n case 'ed25519':\n return 'EdDSA';\n default:\n throw new Error(`Unsupported asymmetric key type: ${asymKeyType}`);\n }\n}\n\n/**\n * Normalize KeyLike input to a KeyObject\n * @param key\n */\nfunction toKeyObject(key: KeyLike): KeyObject {\n // Already a KeyObject (private, public, or secret)\n if (typeof key === 'object' && 'type' in key) return key as KeyObject;\n\n // Try asymmetric private key (PEM / DER / JWK)\n try {\n return createPrivateKey(key);\n } catch {\n // Fallback: symmetric key (HMAC)\n const buffer =\n typeof key === 'string'\n ? Buffer.from(key, 'utf8')\n : Buffer.isBuffer(key)\n ? key\n : (() => {\n throw new Error('Unsupported key type');\n })();\n\n return createSecretKey(buffer);\n }\n}\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): JWT => {\n const parts = token.split('.');\n if (parts.length !== 3) {\n throw new Error('Invalid JWT: must contain exactly 3 parts separated by \".\"');\n }\n\n const [headerPart, payloadPart, signature] = parts;\n\n if (!headerPart || !payloadPart || !signature) {\n throw new Error('Invalid JWT: empty part detected');\n }\n\n try {\n const header = JSON.parse(base64Url.decode(headerPart)) as JWTHeader;\n const payload = JSON.parse(base64Url.decode(payloadPart)) as JWTPayload;\n return {header, payload, signature};\n } catch (err) {\n throw new Error(`Invalid JWT: malformed header or payload (${(err as Error).message})`);\n }\n};\n\n/**\n * Sign a JWT\n * @param payload\n * @param secret\n * @param options\n */\nexport const sign = (\n payload: JWTPayload,\n secret: KeyLike,\n options: {\n alg?: SupportedAlgorithm;\n kid?: string;\n typ?: string;\n /**\n * default 'der'\n */\n signatureFormat?: 'der' | 'jose';\n } = {}\n): string => {\n const key = toKeyObject(secret);\n const alg = options.alg ?? AutodetectAlgorithm(key);\n const signatureFormat = options.signatureFormat ?? 'der';\n const typ = options.typ ?? 'JWT';\n\n if (!(alg in SignatureAlgorithm)) throw new Error(`Unsupported algorithm: ${alg}`);\n\n const header: JWTHeader = {alg, typ};\n if (options.kid) header.kid = options.kid;\n\n const headerEncoded = base64Url.encode(JSON.stringify(header));\n const payloadEncoded = base64Url.encode(JSON.stringify(payload));\n\n const signingInput = `${headerEncoded}.${payloadEncoded}`;\n\n // existing DER/base64url signature from algorithms\n let signature = SignatureAlgorithm[alg].sign(signingInput, secret);\n\n // If ES* and caller requested JOSE, convert the DER signature bytes to JOSE bytes\n if (signatureFormat === 'jose' && isEcdsaAlg(alg)) {\n const der = Buffer.from(signature, 'base64url');\n const jose = derToJose(der, joseLenForAlg(alg));\n signature = jose.toString('base64url');\n }\n\n return `${headerEncoded}.${payloadEncoded}.${signature}`;\n\n};\n\n/**\n * Verify and validate a JWT\n * @param token\n * @param secret\n * @param options\n */\nexport const verify = (\n token: string,\n secret: KeyLike,\n options: {\n algorithms?: SupportedAlgorithm[]; // Whitelist of allowed algorithms\n issuer?: string;\n subject?: string;\n audience?: string | string[];\n jwtId?: string;\n ignoreExpiration?: boolean;\n clockSkew?: number; // in seconds, default 0\n maxTokenAge?: number; // Maximum age in seconds\n signatureFormat?: 'der' | 'jose';\n } = {}\n):\n | { valid: true; header: JWTHeader; payload: JWTPayload; signature: string }\n | { valid: false; error: { reason: string; code: string } } => {\n let decoded: JWT;\n try {\n decoded = decode(token);\n } catch (err) {\n return {\n valid: false,\n error: {\n reason: (err as Error).message,\n code: 'INVALID_TOKEN'\n }\n };\n }\n\n const {header, payload, signature} = decoded;\n\n // Validate algorithm\n const alg = header.alg as SupportedAlgorithm;\n if (!(alg in SignatureAlgorithm)) {\n return {\n valid: false,\n error: {\n reason: `Unsupported or unknown algorithm: ${header.alg}`,\n code: 'INVALID_ALGORITHM'\n }\n };\n }\n\n // Algorithm whitelist validation (prevents algorithm confusion attacks)\n if (options.algorithms && options.algorithms.length > 0) {\n if (!options.algorithms.includes(alg)) {\n return {\n valid: false,\n error: {\n reason: `Algorithm \"${alg}\" is not in the allowed algorithms list`,\n code: 'ALGORITHM_NOT_ALLOWED'\n }\n };\n }\n }\n\n // Validate 'typ' header (must be 'JWT' if present)\n if (header.typ !== undefined && header.typ !== 'JWT') {\n return {\n valid: false,\n error: {\n reason: `Invalid token type: expected 'JWT', got '${header.typ}'`,\n code: 'INVALID_TYPE'\n }\n };\n }\n\n // Verify signature\n const signingInput = `${base64Url.encode(JSON.stringify(header))}.${base64Url.encode(JSON.stringify(payload))}`;\n\n if (!isEcdsaAlg(alg)) {\n // non-ES* algorithms unchanged\n const isValidSignature = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n if (!isValidSignature) {\n return {valid: false, error: {reason: \"Signature verification failed\", code: 'INVALID_SIGNATURE'}};\n }\n } else {\n // ES* algorithms: verify DER by default, but allow JOSE + auto-detect\n const format = options.signatureFormat; // undefined means \"auto\"\n\n let ok: boolean;\n\n // 1) If explicitly JOSE -> convert to DER for verification\n if (format === 'jose') {\n try {\n const jose = Buffer.from(signature, 'base64url');\n const derSigB64Url = joseToDer(jose).toString('base64url');\n ok = SignatureAlgorithm[alg].verify(signingInput, secret, derSigB64Url);\n } catch {\n ok = false;\n }\n }\n // 2) If explicitly DER -> verify as-is\n else if (format === 'der') {\n ok = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n }\n // 3) Auto-detect: try DER first, then JOSE\n else {\n ok = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n if (!ok) {\n try {\n const jose = Buffer.from(signature, 'base64url');\n // quick sanity: only attempt conversion if size matches expected\n if (jose.length === joseLenForAlg(alg)) {\n const derSigB64Url = joseToDer(jose).toString('base64url');\n ok = SignatureAlgorithm[alg].verify(signingInput, secret, derSigB64Url);\n }\n } catch {\n // ignore\n }\n }\n }\n\n if (!ok) {\n return {valid: false, error: {reason: \"Signature verification failed\", code: 'INVALID_SIGNATURE'}};\n }\n }\n\n // Time validation\n const now = Math.floor(Date.now() / 1000);\n const skew = options.clockSkew ?? 0;\n\n if (!options.ignoreExpiration) {\n if (payload.exp !== undefined && now > payload.exp + skew) {\n return {\n valid: false,\n error: {\n reason: 'Token expired',\n code: 'TOKEN_EXPIRED'\n }\n };\n }\n }\n\n if (payload.nbf !== undefined && now + skew < payload.nbf) {\n return {\n valid: false,\n error: {\n reason: 'Token not yet valid',\n code: 'TOKEN_NOT_ACTIVE'\n }\n };\n }\n\n if (payload.iat !== undefined && now + skew < payload.iat) {\n return {\n valid: false,\n error: {\n reason: 'Token issued in the future',\n code: 'TOKEN_FUTURE_ISSUED'\n }\n };\n }\n\n // Maximum token age validation\n if (options.maxTokenAge !== undefined && payload.iat !== undefined) {\n const tokenAge = now - payload.iat;\n if (tokenAge > options.maxTokenAge) {\n return {\n valid: false,\n error: {\n reason: `Token age (${tokenAge}s) exceeds maximum allowed age (${options.maxTokenAge}s)`,\n code: 'TOKEN_TOO_OLD'\n }\n };\n }\n }\n\n // --- Claim validations (only if options provided) ---\n\n // Issuer (`iss`)\n if (options.issuer !== undefined) {\n if (payload.iss === undefined) {\n return {\n valid: false,\n error: {\n reason: 'Token missing required issuer claim (\"iss\")',\n code: 'MISSING_ISSUER'\n }\n };\n }\n if (options.issuer !== payload.iss) {\n return {\n valid: false,\n error: {\n reason: `Invalid token issuer: expected \"${options.issuer}\", got \"${payload.iss}\"`,\n code: 'INVALID_ISSUER'\n }\n };\n }\n }\n\n // Subject (`sub`)\n if (options.subject !== undefined) {\n if (payload.sub === undefined) {\n return {\n valid: false,\n error: {\n reason: 'Token missing required subject claim (\"sub\")',\n code: 'MISSING_SUBJECT'\n }\n };\n }\n if (options.subject !== payload.sub) {\n return {\n valid: false,\n error: {\n reason: `Invalid token subject: expected \"${options.subject}\", got \"${payload.sub}\"`,\n code: 'INVALID_SUBJECT'\n }\n };\n }\n }\n\n // Audience (`aud`)\n if (options.audience !== undefined) {\n const aud = payload.aud;\n if (aud === undefined) {\n return {\n valid: false,\n error: {\n reason: 'Token missing required audience claim (\"aud\")',\n code: 'MISSING_AUDIENCE'\n }\n };\n }\n\n const expectedAud = Array.isArray(options.audience) ? options.audience : [options.audience];\n const tokenAud = Array.isArray(aud) ? aud : [aud];\n\n const hasMatch = expectedAud.some(a => tokenAud.includes(a));\n if (!hasMatch) {\n return {\n valid: false,\n error: {\n reason: 'Audience claim mismatch',\n code: 'INVALID_AUDIENCE'\n }\n };\n }\n }\n\n // JWT ID (`jti`)\n if (options.jwtId !== undefined) {\n if (payload.jti === undefined) {\n return {\n valid: false,\n error: {\n reason: 'Token missing required JWT ID claim (\"jti\")',\n code: 'MISSING_JTI'\n }\n };\n }\n if (options.jwtId !== payload.jti) {\n return {\n valid: false,\n error: {\n reason: `Invalid JWT ID: expected \"${options.jwtId}\", got \"${payload.jti}\"`,\n code: 'INVALID_JTI'\n }\n };\n }\n }\n\n return {valid: true, header, payload, signature};\n};\n\n//namespace export\nexport const JWT = {\n sign,\n verify,\n decode,\n algorithms: SignatureAlgorithm\n};\n\n","import {\n createPrivateKey,\n createPublicKey,\n createSecretKey,\n createHash,\n type KeyObject\n} from 'crypto';\n\n// JWK Types\nexport type JWK =\n | RSAJWK\n | ECJWK\n | OKPJWK\n | OctJWK;\n\nexport type JWKWithHelpers = JWK & {\n toKeyObject(): KeyObject;\n};\n\ninterface BaseJWK {\n kty: string;\n kid?: string;\n alg?: string;\n use?: 'sig' | 'enc';\n key_ops?: Array<'sign' | 'verify'>;\n x5c?: string[]; // X.509 cert chain\n x5t?: string; // Base64url thumbprint\n}\n\nexport interface RSAJWK extends BaseJWK {\n kty: 'RSA';\n n: string;\n e: string;\n d?: string;\n p?: string;\n q?: string;\n dp?: string;\n dq?: string;\n qi?: string;\n}\n\nexport interface ECJWK extends BaseJWK {\n kty: 'EC';\n crv: 'P-256' | 'P-384' | 'P-521' | 'secp256k1';\n x: string;\n y: string;\n d?: string;\n}\n\nexport interface OKPJWK extends BaseJWK {\n kty: 'OKP';\n crv: 'Ed25519';\n x: string;\n d?: string;\n}\n\nexport interface OctJWK extends BaseJWK {\n kty: 'oct';\n k: string;\n}\n\n/**\n * Export KeyObject to JWK\n * @param key\n */\nexport function exportJWK(key: KeyObject): JWK {\n if (!key || typeof key !== 'object') throw new Error('Invalid KeyObject');\n return key.export({format: 'jwk'}) as JWK;\n}\n\n/**\n * Import JWK to KeyObject\n * @param jwk\n */\nexport function importJWK(jwk: JWK): KeyObject {\n if (!jwk || typeof jwk !== 'object') throw new Error('Invalid JWK');\n\n switch (jwk.kty) {\n case 'oct': {\n if (!('k' in jwk) || typeof jwk.k !== 'string') {\n throw new Error('Invalid oct JWK: missing \"k\"');\n }\n\n return createSecretKey(Buffer.from(jwk.k, 'base64url'));\n }\n\n case 'RSA':\n case 'EC':\n case 'OKP': {\n // private key\n if ('d' in jwk && typeof (jwk as any).d === 'string') {\n // @ts-ignore\n return createPrivateKey({format: 'jwk', key: jwk});\n }\n\n // public key\n // @ts-ignore\n return createPublicKey({format: 'jwk', key: jwk});\n }\n\n default:\n throw new Error(`Unsupported JWK key type: ${(jwk as any).kty}`);\n }\n}\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport function toPublicJWK(key: KeyObject): JWK {\n if (!key || typeof key !== 'object') {\n throw new Error('Invalid KeyObject');\n }\n\n const publicKey =\n key.type === 'private'\n ? createPublicKey(key)\n : key;\n\n const jwk = publicKey.export({format: 'jwk'}) as JWK;\n\n // Ensure private fields are not present\n delete (jwk as any).d;\n delete (jwk as any).p;\n delete (jwk as any).q;\n delete (jwk as any).dp;\n delete (jwk as any).dq;\n delete (jwk as any).qi;\n return jwk;\n}\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport function getJWKThumbprint(jwk: JWK, hashAlg: 'sha256' = 'sha256'): string {\n if (!jwk || typeof jwk !== 'object') {\n throw new Error('Invalid JWK');\n }\n\n let fields: Record<string, string>;\n\n switch (jwk.kty) {\n case 'RSA':\n fields = {e: jwk.e, kty: jwk.kty, n: jwk.n};\n break;\n\n case 'EC':\n fields = {crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y};\n break;\n\n case 'OKP':\n fields = {crv: jwk.crv, kty: jwk.kty, x: jwk.x};\n break;\n\n case 'oct':\n fields = {k: jwk.k, kty: jwk.kty};\n break;\n\n default:\n throw new Error(`Unsupported JWK key type: ${(jwk as any).kty}`);\n }\n\n // Lexicographically sorted JSON\n const json = JSON.stringify(\n Object.keys(fields)\n .sort()\n .reduce((acc, k) => {\n acc[k] = fields[k];\n return acc;\n }, {} as Record<string, string>)\n );\n\n return createHash(hashAlg)\n .update(json)\n .digest('base64url');\n}\n\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport function computeX5T(jwk: JWK): string | undefined {\n if (!jwk.x5c?.length) return undefined;\n return createHash('sha1').update(Buffer.from(jwk.x5c[0], 'base64')).digest('base64url');\n}\n\nexport const JWK = {\n export: exportJWK,\n import: importJWK,\n toPublic: toPublicJWK,\n thumbprint: getJWKThumbprint,\n}\n\nexport interface JWKS {\n keys: JWK[];\n}\n\n/**\n * Convert JWKS specific key of first key to KeyObject\n * @param jwks\n * @param kid\n * @constructor\n */\nexport function JWKSToKeyObject(\n jwks: JWKS,\n kid?: string\n): KeyObject {\n if (!jwks || !Array.isArray(jwks.keys)) throw new Error('Invalid JWKS');\n\n let jwk: JWK | undefined;\n\n if (kid) jwk = jwks.keys.find(k => k.kid === kid);\n\n // Fallback: single-key JWKS\n if (!jwk && jwks.keys.length === 1) jwk = jwks.keys[0];\n\n if (!jwk) throw new Error('Key not found in JWKS');\n return importJWK(jwk);\n}\n\n/**\n * Normalize JWKS\n * @param jwks\n */\nexport function normalizeJWKS(jwks: JWKS): JWKS {\n return {\n keys: normalizeJWK(...jwks.keys)\n };\n}\n\nexport function normalizeJWK(...keys: JWK[]): JWKWithHelpers[] {\n return keys.map((jwk) => {\n const normalized = {\n ...jwk,\n kid: jwk.kid ?? getJWKThumbprint(jwk),\n x5t: jwk.x5t ?? computeX5T(jwk)\n } as JWKWithHelpers;\n\n // Keep helper API out of object enumeration/serialization.\n Object.defineProperty(normalized, 'toKeyObject', {\n enumerable: false,\n configurable: false,\n writable: false,\n value: () => importJWK(normalized)\n });\n\n return normalized;\n })\n}\n\nexport const fromWeb = async (\n url: string | URL,\n options: Partial<{\n fetch: typeof fetch;\n ttl: number;\n timeoutMs: number;\n endpointOverride: string;\n overrideEndpointCheck: boolean;\n cache: {\n get: (key: string) => JWKS | undefined | Promise<JWKS | undefined>;\n set: (key: string, value: JWKS) => void | Promise<void>;\n };\n }> = {}\n) => {\n const baseUrl = typeof url === 'string' ? url : url.toString();\n const fetchFn = options.fetch ?? globalThis.fetch;\n const ttl = Math.max(0, options.ttl ?? 5 * 60_000);\n const timeoutMs = Math.max(0, options.timeoutMs ?? 5_000);\n const wellKnownPath = '/.well-known/jwks.json';\n\n if (!fetchFn) {\n throw new Error('No fetch implementation available');\n }\n\n const endpoint = (() => {\n if (options.endpointOverride) {\n const override = options.endpointOverride;\n try {\n return new URL(override, baseUrl).toString();\n } catch {\n return override;\n }\n }\n\n if (options.overrideEndpointCheck) {\n return baseUrl;\n }\n\n if (baseUrl.endsWith(wellKnownPath)) {\n return baseUrl;\n }\n\n return `${baseUrl.replace(/\\/+$/, '')}${wellKnownPath}`;\n })();\n\n const cache = (() => {\n if (options.cache) return options.cache;\n let memoryValue: JWKS | undefined;\n return {\n get: () => memoryValue,\n set: (_key: string, value: JWKS) => {\n memoryValue = value;\n }\n };\n })();\n\n let cachedJWKS: JWKS | undefined;\n let nextRefreshAt = 0;\n let refreshInFlight: Promise<JWKS> | undefined;\n let consecutiveFailures = 0;\n\n const fetchJWKS = async (allowStaleOnFailure: boolean): Promise<JWKS> => {\n if (refreshInFlight) return refreshInFlight;\n\n refreshInFlight = (async () => {\n const controller = new AbortController();\n let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n\n if (timeoutMs > 0) {\n timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);\n }\n\n let response: Response;\n try {\n response = await fetchFn(endpoint, {signal: controller.signal});\n } catch (error) {\n if (controller.signal.aborted) {\n throw new Error(`JWKS fetch timed out after ${timeoutMs}ms`);\n }\n throw error;\n } finally {\n if (timeoutHandle) clearTimeout(timeoutHandle);\n }\n\n if (!response.ok) {\n throw new Error(`Failed to fetch JWKS: ${response.status} ${response.statusText}`);\n }\n\n const body = await response.json();\n if (!body || typeof body !== 'object' || !Array.isArray((body as any).keys)) {\n throw new Error('Invalid JWKS');\n }\n\n return normalizeJWKS(body as JWKS);\n })();\n\n try {\n const fresh = await refreshInFlight;\n cachedJWKS = fresh;\n await cache.set(endpoint, fresh);\n consecutiveFailures = 0;\n if (ttl > 0) nextRefreshAt = Date.now() + ttl;\n return fresh;\n } catch (error) {\n if (!allowStaleOnFailure || !cachedJWKS) {\n throw error;\n }\n\n consecutiveFailures += 1;\n if (ttl > 0) {\n const backoff = Math.min(\n Math.max(ttl, 30_000) * Math.pow(2, consecutiveFailures - 1),\n 15 * 60_000\n );\n nextRefreshAt = Date.now() + backoff;\n }\n console.warn(`JWKS refresh failed for \"${endpoint}\", using stale cache.`, error);\n return cachedJWKS;\n } finally {\n refreshInFlight = undefined;\n }\n };\n\n cachedJWKS = await cache.get(endpoint);\n if (!cachedJWKS) {\n cachedJWKS = await fetchJWKS(false);\n } else {\n cachedJWKS = normalizeJWKS(cachedJWKS);\n if (ttl > 0) nextRefreshAt = Date.now() + ttl;\n }\n\n\n return ({\n async list(): Promise<JWKWithHelpers[]> {\n if (ttl > 0 && Date.now() >= nextRefreshAt) {\n await fetchJWKS(true);\n }\n return normalizeJWK(...(cachedJWKS as JWKS).keys);\n },\n async refresh() {\n await fetchJWKS(false);\n return this;\n },\n async key(kid: string): Promise<JWKWithHelpers | undefined> {\n const keys = await this.list();\n const key = keys.find((v) => v.kid === kid)\n if (!key) return undefined;\n return normalizeJWK(key)[0];\n },\n async find(input: Partial<BaseJWK>): Promise<JWKWithHelpers[]> {\n const keys = await this.list();\n const entries = Object.entries(input) as Array<[keyof BaseJWK, BaseJWK[keyof BaseJWK]]>;\n\n if (entries.length === 0) return normalizeJWK(...keys);\n\n return normalizeJWK(...keys.filter((key) =>\n entries.every(([field, expected]) => {\n const value = key[field];\n if (Array.isArray(expected)) {\n return Array.isArray(value)\n && value.length === expected.length\n && value.every((item, i) => item === expected[i]);\n }\n return value === expected;\n })\n ));\n },\n async findFirst(input: Partial<BaseJWK>): Promise<JWKWithHelpers | undefined> {\n return this.find(input).then(([key]) => key);\n },\n export(): JWKS | undefined {\n return cachedJWKS;\n }\n });\n}\n\nexport const JWKS = {\n toKeyObject: JWKSToKeyObject,\n normalize: normalizeJWKS,\n fromWeb\n}\n"],"names":["base64Url","input","timingSafeCompare","a","b","timingSafeEqual","joseLenForAlg","alg","derToJose","der","outLen","i","seqLen","n","k","rLen","r","sLen","s","rPad","sPad","joseToDer","jose","half","rPart","sPart","lenBytes","tmp","isEcdsaAlg","SignatureAlgorithm","data","secret","createHmac","signature","expected","createSign","createVerify","crypto","cryptoSign","cryptoVerify","SupportedAlgorithms","AutodetectAlgorithm","key","asymKeyType","details","hash","curve","toKeyObject","createPrivateKey","buffer","createSecretKey","decode","token","parts","headerPart","payloadPart","header","payload","err","sign","options","signatureFormat","typ","headerEncoded","payloadEncoded","signingInput","verify","decoded","format","ok","derSigB64Url","now","skew","tokenAge","aud","expectedAud","tokenAud","JWT","exportJWK","importJWK","jwk","createPublicKey","toPublicJWK","getJWKThumbprint","hashAlg","fields","json","acc","createHash","computeX5T","JWK","JWKSToKeyObject","jwks","kid","normalizeJWKS","normalizeJWK","keys","normalized","fromWeb","url","baseUrl","fetchFn","ttl","timeoutMs","wellKnownPath","endpoint","override","cache","memoryValue","_key","value","cachedJWKS","nextRefreshAt","refreshInFlight","consecutiveFailures","fetchJWKS","allowStaleOnFailure","controller","timeoutHandle","response","error","body","fresh","backoff","entries","field","item","JWKS"],"mappings":"uCAeaA,EAAY,CACrB,OAASC,GAAmC,OAAO,KAAKA,CAAK,EAAE,SAAS,WAAW,EACnF,OAASA,GAA0B,OAAO,KAAKA,EAAO,WAAW,EAAE,SAAA,CACvE,EAOMC,EAAoB,CAACC,EAAWC,IAC9BD,EAAE,SAAWC,EAAE,OACR,GAEJC,EAAAA,gBAAgB,OAAO,KAAKF,CAAC,EAAG,OAAO,KAAKC,CAAC,CAAC,EA0DzD,SAASE,EAAcC,EAAqB,CACxC,OAAQA,EAAA,CACJ,IAAK,QACL,IAAK,SACD,MAAO,IACX,IAAK,QACD,MAAO,IACX,IAAK,QACD,MAAO,KACX,QACI,MAAM,IAAI,MAAM,8CAA8CA,CAAG,EAAE,CAAA,CAE/E,CAEA,SAASC,EAAUC,EAAaC,EAAwB,CACpD,IAAIC,EAAI,EACR,GAAIF,EAAIE,GAAG,IAAM,GAAM,MAAM,IAAI,MAAM,6BAA6B,EAGpE,IAAIC,EAASH,EAAIE,GAAG,EACpB,GAAIC,EAAS,IAAM,CACf,MAAMC,EAAID,EAAS,IACnBA,EAAS,EACT,QAASE,EAAI,EAAGA,EAAID,EAAGC,IAAKF,EAAUA,GAAU,EAAKH,EAAIE,GAAG,CAChE,CAEA,GAAIF,EAAIE,GAAG,IAAM,EAAM,MAAM,IAAI,MAAM,iCAAiC,EACxE,MAAMI,EAAON,EAAIE,GAAG,EACpB,IAAIK,EAAIP,EAAI,SAASE,EAAGA,EAAII,CAAI,EAGhC,GAFAJ,GAAKI,EAEDN,EAAIE,GAAG,IAAM,EAAM,MAAM,IAAI,MAAM,iCAAiC,EACxE,MAAMM,EAAOR,EAAIE,GAAG,EACpB,IAAIO,EAAIT,EAAI,SAASE,EAAGA,EAAIM,CAAI,EAGhC,KAAOD,EAAE,OAASN,EAAS,GAAKM,EAAE,CAAC,IAAM,GAAMA,EAAIA,EAAE,SAAS,CAAC,EAC/D,KAAOE,EAAE,OAASR,EAAS,GAAKQ,EAAE,CAAC,IAAM,GAAMA,EAAIA,EAAE,SAAS,CAAC,EAE/D,MAAMC,EAAO,OAAO,OAAO,CAAC,OAAO,MAAMT,EAAS,EAAIM,EAAE,OAAQ,CAAC,EAAGA,CAAC,CAAC,EAChEI,EAAO,OAAO,OAAO,CAAC,OAAO,MAAMV,EAAS,EAAIQ,EAAE,OAAQ,CAAC,EAAGA,CAAC,CAAC,EACtE,OAAO,OAAO,OAAO,CAACC,EAAMC,CAAI,CAAC,CACrC,CAEA,SAASC,EAAUC,EAAsB,CACrC,MAAMC,EAAOD,EAAK,OAAS,EAC3B,IAAI,EAAIA,EAAK,SAAS,EAAGC,CAAI,EACzBL,EAAII,EAAK,SAASC,CAAI,EAG1B,KAAO,EAAE,OAAS,GAAK,EAAE,CAAC,IAAM,IAAS,EAAE,CAAC,EAAI,OAAU,GAAG,EAAI,EAAE,SAAS,CAAC,EAC7E,KAAOL,EAAE,OAAS,GAAKA,EAAE,CAAC,IAAM,IAASA,EAAE,CAAC,EAAI,OAAU,GAAGA,EAAIA,EAAE,SAAS,CAAC,EAGzE,EAAE,CAAC,EAAI,QAAU,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAI,CAAC,EAAG,CAAC,CAAC,GACvDA,EAAE,CAAC,EAAI,QAAU,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAI,CAAC,EAAGA,CAAC,CAAC,GAE3D,MAAMM,EAAQ,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,EAAM,EAAE,MAAM,CAAC,EAAG,CAAC,CAAC,EACxDC,EAAQ,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,EAAMP,EAAE,MAAM,CAAC,EAAGA,CAAC,CAAC,EAExDN,EAASY,EAAM,OAASC,EAAM,OAEpC,IAAIC,EACJ,GAAId,EAAS,IACTc,EAAW,OAAO,KAAK,CAACd,CAAM,CAAC,MAC5B,CACH,MAAMe,EAAgB,CAAA,EACtB,IAAId,EAAID,EACR,KAAOC,EAAI,GACPc,EAAI,QAAQd,EAAI,GAAI,EACpBA,IAAM,EAEVa,EAAW,OAAO,KAAK,CAAC,IAAOC,EAAI,OAAQ,GAAGA,CAAG,CAAC,CACtD,CAEA,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,EAAI,CAAC,EAAGD,EAAUF,EAAOC,CAAK,CAAC,CACtE,CAEA,SAASG,EAAWrB,EAAsB,CACtC,OAAOA,IAAQ,SAAWA,IAAQ,SAAWA,IAAQ,SAAWA,IAAQ,QAC5E,CAIO,MAAMsB,EAAqB,CAE9B,MAAO,CACH,KAAM,CAACC,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IAAsB,CAC9D,MAAMC,EAAWF,aAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAC7E,OAAO5B,EAAkBgC,EAAUD,CAAS,CAChD,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IAAsB,CAC9D,MAAMC,EAAWF,aAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAC7E,OAAO5B,EAAkBgC,EAAUD,CAAS,CAChD,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IAAsB,CAC9D,MAAMC,EAAWF,aAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAC7E,OAAO5B,EAAkBgC,EAAUD,CAAS,CAChD,CAAA,EAIJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAIJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,OAAQ,CACJ,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,aAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK,CAEF,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,CACf,EACA,SAAS,WAAW,EAC7B,OAAQ,CAACP,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO,CAEJ,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,EACb,OAAO,KAAKJ,EAAW,WAAW,CAAC,CAC9C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,aAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK,CAEF,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,CACf,EACA,SAAS,WAAW,EAC7B,OAAQ,CAACP,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO,CAEJ,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,EACb,OAAO,KAAKJ,EAAW,WAAW,CAAC,CAC9C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,aAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK,CAEF,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,CACf,EACA,SAAS,WAAW,EAC7B,OAAQ,CAACP,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO,CAEJ,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,EACb,OAAO,KAAKJ,EAAW,WAAW,CAAC,CAC9C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBO,EAAAA,KAAW,KAAM,OAAOR,GAAS,SAAW,OAAO,KAAKA,EAAM,MAAM,EAAIA,EAAMC,CAAM,EAC/E,SAAS,WAAW,EAC7B,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOM,EAAAA,OACH,KACA,OAAOT,GAAS,SAAW,OAAO,KAAKA,EAAM,MAAM,EAAIA,EACvDC,EACA,OAAO,KAAKE,EAAW,WAAW,CAAA,CAE1C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,CAER,EAIaO,EAAsB,OAAO,KAAKX,CAAkB,EAO1D,SAASY,EAAoBC,EAAoC,CACpE,GAAIA,EAAI,OAAS,SAAU,MAAO,QAClC,GAAIA,EAAI,OAAS,UAAW,MAAM,IAAI,MAAM,yDAAyD,EAErG,MAAMC,EAAcD,EAAI,kBAClBE,EAAUF,EAAI,qBAEpB,OAAQC,EAAA,CACJ,IAAK,MACD,MAAO,QACX,IAAK,UAAW,CACZ,MAAME,EAAOD,GAAS,eAAiB,SACvC,OAAQC,EAAA,CACJ,IAAK,SACD,MAAO,QACX,IAAK,SACD,MAAO,QACX,IAAK,SACD,MAAO,QACX,QACI,MAAM,IAAI,MAAM,uCAAuCA,CAAI,EAAE,CAAA,CAEzE,CACA,IAAK,KAAM,CACP,MAAMC,EAAQF,GAAS,WACvB,OAAQE,EAAA,CACJ,IAAK,QACL,IAAK,aACD,MAAO,QACX,IAAK,QACL,IAAK,YACD,MAAO,QACX,IAAK,QACL,IAAK,YACD,MAAO,QACX,IAAK,YACD,MAAO,SACX,QACI,MAAM,IAAI,MAAM,yBAAyBA,CAAK,EAAE,CAAA,CAE5D,CACA,IAAK,UACD,MAAO,QACX,QACI,MAAM,IAAI,MAAM,oCAAoCH,CAAW,EAAE,CAAA,CAE7E,CAMA,SAASI,EAAYL,EAAyB,CAE1C,GAAI,OAAOA,GAAQ,UAAY,SAAUA,EAAK,OAAOA,EAGrD,GAAI,CACA,OAAOM,EAAAA,iBAAiBN,CAAG,CAC/B,MAAQ,CAEJ,MAAMO,EACF,OAAOP,GAAQ,SACT,OAAO,KAAKA,EAAK,MAAM,EACvB,OAAO,SAASA,CAAG,EACfA,GACC,IAAM,CACL,MAAM,IAAI,MAAM,sBAAsB,CAC1C,GAAA,EAEZ,OAAOQ,EAAAA,gBAAgBD,CAAM,CACjC,CACJ,CAMO,MAAME,EAAUC,GAAuB,CAC1C,MAAMC,EAAQD,EAAM,MAAM,GAAG,EAC7B,GAAIC,EAAM,SAAW,EACjB,MAAM,IAAI,MAAM,4DAA4D,EAGhF,KAAM,CAACC,EAAYC,EAAatB,CAAS,EAAIoB,EAE7C,GAAI,CAACC,GAAc,CAACC,GAAe,CAACtB,EAChC,MAAM,IAAI,MAAM,kCAAkC,EAGtD,GAAI,CACA,MAAMuB,EAAS,KAAK,MAAMxD,EAAU,OAAOsD,CAAU,CAAC,EAChDG,EAAU,KAAK,MAAMzD,EAAU,OAAOuD,CAAW,CAAC,EACxD,MAAO,CAAC,OAAAC,EAAQ,QAAAC,EAAS,UAAAxB,CAAA,CAC7B,OAASyB,EAAK,CACV,MAAM,IAAI,MAAM,6CAA8CA,EAAc,OAAO,GAAG,CAC1F,CACJ,EAQaC,EAAO,CAChBF,EACA1B,EACA6B,EAQI,CAAA,IACK,CACT,MAAMlB,EAAMK,EAAYhB,CAAM,EACxBxB,EAAMqD,EAAQ,KAAOnB,EAAoBC,CAAG,EAC5CmB,EAAkBD,EAAQ,iBAAmB,MAC7CE,EAAMF,EAAQ,KAAO,MAE3B,GAAI,EAAErD,KAAOsB,GAAqB,MAAM,IAAI,MAAM,0BAA0BtB,CAAG,EAAE,EAEjF,MAAMiD,EAAoB,CAAC,IAAAjD,EAAK,IAAAuD,CAAA,EAC5BF,EAAQ,MAAKJ,EAAO,IAAMI,EAAQ,KAEtC,MAAMG,EAAgB/D,EAAU,OAAO,KAAK,UAAUwD,CAAM,CAAC,EACvDQ,EAAiBhE,EAAU,OAAO,KAAK,UAAUyD,CAAO,CAAC,EAEzDQ,EAAe,GAAGF,CAAa,IAAIC,CAAc,GAGvD,IAAI/B,EAAYJ,EAAmBtB,CAAG,EAAE,KAAK0D,EAAclC,CAAM,EAGjE,GAAI8B,IAAoB,QAAUjC,EAAWrB,CAAG,EAAG,CAC/C,MAAME,EAAM,OAAO,KAAKwB,EAAW,WAAW,EAE9CA,EADazB,EAAUC,EAAKH,EAAcC,CAAG,CAAC,EAC7B,SAAS,WAAW,CACzC,CAEA,MAAO,GAAGwD,CAAa,IAAIC,CAAc,IAAI/B,CAAS,EAE1D,EAQaiC,EAAS,CAClBd,EACArB,EACA6B,EAUI,CAAA,IAG2D,CAC/D,IAAIO,EACJ,GAAI,CACAA,EAAUhB,EAAOC,CAAK,CAC1B,OAASM,EAAK,CACV,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAASA,EAAc,QACvB,KAAM,eAAA,CACV,CAER,CAEA,KAAM,CAAC,OAAAF,EAAQ,QAAAC,EAAS,UAAAxB,CAAA,EAAakC,EAG/B5D,EAAMiD,EAAO,IACnB,GAAI,EAAEjD,KAAOsB,GACT,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,qCAAqC2B,EAAO,GAAG,GACvD,KAAM,mBAAA,CACV,EAKR,GAAII,EAAQ,YAAcA,EAAQ,WAAW,OAAS,GAC9C,CAACA,EAAQ,WAAW,SAASrD,CAAG,EAChC,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,cAAcA,CAAG,0CACzB,KAAM,uBAAA,CACV,EAMZ,GAAIiD,EAAO,MAAQ,QAAaA,EAAO,MAAQ,MAC3C,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,4CAA4CA,EAAO,GAAG,IAC9D,KAAM,cAAA,CACV,EAKR,MAAMS,EAAe,GAAGjE,EAAU,OAAO,KAAK,UAAUwD,CAAM,CAAC,CAAC,IAAIxD,EAAU,OAAO,KAAK,UAAUyD,CAAO,CAAC,CAAC,GAE7G,GAAK7B,EAAWrB,CAAG,EAMZ,CAEH,MAAM6D,EAASR,EAAQ,gBAEvB,IAAIS,EAGJ,GAAID,IAAW,OACX,GAAI,CACA,MAAM9C,EAAO,OAAO,KAAKW,EAAW,WAAW,EACzCqC,EAAejD,EAAUC,CAAI,EAAE,SAAS,WAAW,EACzD+C,EAAKxC,EAAmBtB,CAAG,EAAE,OAAO0D,EAAclC,EAAQuC,CAAY,CAC1E,MAAQ,CACJD,EAAK,EACT,SAGKD,IAAW,MAChBC,EAAKxC,EAAmBtB,CAAG,EAAE,OAAO0D,EAAclC,EAAQE,CAAS,UAInEoC,EAAKxC,EAAmBtB,CAAG,EAAE,OAAO0D,EAAclC,EAAQE,CAAS,EAC/D,CAACoC,EACD,GAAI,CACA,MAAM/C,EAAO,OAAO,KAAKW,EAAW,WAAW,EAE/C,GAAIX,EAAK,SAAWhB,EAAcC,CAAG,EAAG,CACpC,MAAM+D,EAAejD,EAAUC,CAAI,EAAE,SAAS,WAAW,EACzD+C,EAAKxC,EAAmBtB,CAAG,EAAE,OAAO0D,EAAclC,EAAQuC,CAAY,CAC1E,CACJ,MAAQ,CAER,CAIR,GAAI,CAACD,EACD,MAAO,CAAC,MAAO,GAAO,MAAO,CAAC,OAAQ,gCAAiC,KAAM,oBAAmB,CAExG,SA3CQ,CADqBxC,EAAmBtB,CAAG,EAAE,OAAO0D,EAAclC,EAAQE,CAAS,EAEnF,MAAO,CAAC,MAAO,GAAO,MAAO,CAAC,OAAQ,gCAAiC,KAAM,oBAAmB,EA6CxG,MAAMsC,EAAM,KAAK,MAAM,KAAK,IAAA,EAAQ,GAAI,EAClCC,EAAOZ,EAAQ,WAAa,EAElC,GAAI,CAACA,EAAQ,kBACLH,EAAQ,MAAQ,QAAac,EAAMd,EAAQ,IAAMe,EACjD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gBACR,KAAM,eAAA,CACV,EAKZ,GAAIf,EAAQ,MAAQ,QAAac,EAAMC,EAAOf,EAAQ,IAClD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,sBACR,KAAM,kBAAA,CACV,EAIR,GAAIA,EAAQ,MAAQ,QAAac,EAAMC,EAAOf,EAAQ,IAClD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,6BACR,KAAM,qBAAA,CACV,EAKR,GAAIG,EAAQ,cAAgB,QAAaH,EAAQ,MAAQ,OAAW,CAChE,MAAMgB,EAAWF,EAAMd,EAAQ,IAC/B,GAAIgB,EAAWb,EAAQ,YACnB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,cAAca,CAAQ,mCAAmCb,EAAQ,WAAW,KACpF,KAAM,eAAA,CACV,CAGZ,CAKA,GAAIA,EAAQ,SAAW,OAAW,CAC9B,GAAIH,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,8CACR,KAAM,gBAAA,CACV,EAGR,GAAIG,EAAQ,SAAWH,EAAQ,IAC3B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,mCAAmCG,EAAQ,MAAM,WAAWH,EAAQ,GAAG,IAC/E,KAAM,gBAAA,CACV,CAGZ,CAGA,GAAIG,EAAQ,UAAY,OAAW,CAC/B,GAAIH,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,+CACR,KAAM,iBAAA,CACV,EAGR,GAAIG,EAAQ,UAAYH,EAAQ,IAC5B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,oCAAoCG,EAAQ,OAAO,WAAWH,EAAQ,GAAG,IACjF,KAAM,iBAAA,CACV,CAGZ,CAGA,GAAIG,EAAQ,WAAa,OAAW,CAChC,MAAMc,EAAMjB,EAAQ,IACpB,GAAIiB,IAAQ,OACR,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gDACR,KAAM,kBAAA,CACV,EAIR,MAAMC,EAAc,MAAM,QAAQf,EAAQ,QAAQ,EAAIA,EAAQ,SAAW,CAACA,EAAQ,QAAQ,EACpFgB,EAAW,MAAM,QAAQF,CAAG,EAAIA,EAAM,CAACA,CAAG,EAGhD,GAAI,CADaC,EAAY,QAAUC,EAAS,SAASzE,CAAC,CAAC,EAEvD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,0BACR,KAAM,kBAAA,CACV,CAGZ,CAGA,GAAIyD,EAAQ,QAAU,OAAW,CAC7B,GAAIH,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,8CACR,KAAM,aAAA,CACV,EAGR,GAAIG,EAAQ,QAAUH,EAAQ,IAC1B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,6BAA6BG,EAAQ,KAAK,WAAWH,EAAQ,GAAG,IACxE,KAAM,aAAA,CACV,CAGZ,CAEA,MAAO,CAAC,MAAO,GAAM,OAAAD,EAAQ,QAAAC,EAAS,UAAAxB,CAAA,CAC1C,EAGa4C,EAAM,CACf,KAAAlB,EACA,OAAAO,EACA,OAAAf,EACA,WAAYtB,CAChB,ECrwBO,SAASiD,EAAUpC,EAAqB,CAC3C,GAAI,CAACA,GAAO,OAAOA,GAAQ,SAAU,MAAM,IAAI,MAAM,mBAAmB,EACxE,OAAOA,EAAI,OAAO,CAAC,OAAQ,MAAM,CACrC,CAMO,SAASqC,EAAUC,EAAqB,CAC3C,GAAI,CAACA,GAAO,OAAOA,GAAQ,SAAU,MAAM,IAAI,MAAM,aAAa,EAElE,OAAQA,EAAI,IAAA,CACR,IAAK,MAAO,CACR,GAAI,EAAE,MAAOA,IAAQ,OAAOA,EAAI,GAAM,SAClC,MAAM,IAAI,MAAM,8BAA8B,EAGlD,OAAO9B,EAAAA,gBAAgB,OAAO,KAAK8B,EAAI,EAAG,WAAW,CAAC,CAC1D,CAEA,IAAK,MACL,IAAK,KACL,IAAK,MAED,MAAI,MAAOA,GAAO,OAAQA,EAAY,GAAM,SAEjChC,EAAAA,iBAAiB,CAAC,OAAQ,MAAO,IAAKgC,EAAI,EAK9CC,EAAAA,gBAAgB,CAAC,OAAQ,MAAO,IAAKD,EAAI,EAGpD,QACI,MAAM,IAAI,MAAM,6BAA8BA,EAAY,GAAG,EAAE,CAAA,CAE3E,CAMO,SAASE,EAAYxC,EAAqB,CAC7C,GAAI,CAACA,GAAO,OAAOA,GAAQ,SACvB,MAAM,IAAI,MAAM,mBAAmB,EAQvC,MAAMsC,GAJFtC,EAAI,OAAS,UACPuC,EAAAA,gBAAgBvC,CAAG,EACnBA,GAEY,OAAO,CAAC,OAAQ,MAAM,EAG5C,cAAQsC,EAAY,EACpB,OAAQA,EAAY,EACpB,OAAQA,EAAY,EACpB,OAAQA,EAAY,GACpB,OAAQA,EAAY,GACpB,OAAQA,EAAY,GACbA,CACX,CAOO,SAASG,EAAiBH,EAAUI,EAAoB,SAAkB,CAC7E,GAAI,CAACJ,GAAO,OAAOA,GAAQ,SACvB,MAAM,IAAI,MAAM,aAAa,EAGjC,IAAIK,EAEJ,OAAQL,EAAI,IAAA,CACR,IAAK,MACDK,EAAS,CAAC,EAAGL,EAAI,EAAG,IAAKA,EAAI,IAAK,EAAGA,EAAI,CAAA,EACzC,MAEJ,IAAK,KACDK,EAAS,CAAC,IAAKL,EAAI,IAAK,IAAKA,EAAI,IAAK,EAAGA,EAAI,EAAG,EAAGA,EAAI,CAAA,EACvD,MAEJ,IAAK,MACDK,EAAS,CAAC,IAAKL,EAAI,IAAK,IAAKA,EAAI,IAAK,EAAGA,EAAI,CAAA,EAC7C,MAEJ,IAAK,MACDK,EAAS,CAAC,EAAGL,EAAI,EAAG,IAAKA,EAAI,GAAA,EAC7B,MAEJ,QACI,MAAM,IAAI,MAAM,6BAA8BA,EAAY,GAAG,EAAE,CAAA,CAIvE,MAAMM,EAAO,KAAK,UACd,OAAO,KAAKD,CAAM,EACb,OACA,OAAO,CAACE,EAAKzE,KACVyE,EAAIzE,CAAC,EAAIuE,EAAOvE,CAAC,EACVyE,GACR,CAAA,CAA4B,CAAA,EAGvC,OAAOC,EAAAA,WAAWJ,CAAO,EACpB,OAAOE,CAAI,EACX,OAAO,WAAW,CAC3B,CAOO,SAASG,EAAWT,EAA8B,CACrD,GAAKA,EAAI,KAAK,OACd,OAAOQ,EAAAA,WAAW,MAAM,EAAE,OAAO,OAAO,KAAKR,EAAI,IAAI,CAAC,EAAG,QAAQ,CAAC,EAAE,OAAO,WAAW,CAC1F,CAEO,MAAMU,EAAM,CACf,OAAQZ,EACR,OAAQC,EACR,SAAUG,EACV,WAAYC,CAChB,EAYO,SAASQ,EACZC,EACAC,EACS,CACT,GAAI,CAACD,GAAQ,CAAC,MAAM,QAAQA,EAAK,IAAI,EAAG,MAAM,IAAI,MAAM,cAAc,EAEtE,IAAIZ,EAOJ,GALIa,MAAWD,EAAK,KAAK,KAAK9E,GAAKA,EAAE,MAAQ+E,CAAG,GAG5C,CAACb,GAAOY,EAAK,KAAK,SAAW,IAAGZ,EAAMY,EAAK,KAAK,CAAC,GAEjD,CAACZ,EAAK,MAAM,IAAI,MAAM,uBAAuB,EACjD,OAAOD,EAAUC,CAAG,CACxB,CAMO,SAASc,EAAcF,EAAkB,CAC5C,MAAO,CACH,KAAMG,EAAa,GAAGH,EAAK,IAAI,CAAA,CAEvC,CAEO,SAASG,KAAgBC,EAA+B,CAC3D,OAAOA,EAAK,IAAKhB,GAAQ,CACrB,MAAMiB,EAAa,CACf,GAAGjB,EACH,IAAKA,EAAI,KAAOG,EAAiBH,CAAG,EACpC,IAAKA,EAAI,KAAOS,EAAWT,CAAG,CAAA,EAIlC,cAAO,eAAeiB,EAAY,cAAe,CAC7C,WAAY,GACZ,aAAc,GACd,SAAU,GACV,MAAO,IAAMlB,EAAUkB,CAAU,CAAA,CACpC,EAEMA,CACX,CAAC,CACL,CAEO,MAAMC,EAAU,MACnBC,EACAvC,EAUK,KACJ,CACD,MAAMwC,EAAU,OAAOD,GAAQ,SAAWA,EAAMA,EAAI,SAAA,EAC9CE,EAAUzC,EAAQ,OAAS,WAAW,MACtC0C,EAAM,KAAK,IAAI,EAAG1C,EAAQ,KAAO,EAAI,GAAM,EAC3C2C,EAAY,KAAK,IAAI,EAAG3C,EAAQ,WAAa,GAAK,EAClD4C,EAAgB,yBAEtB,GAAI,CAACH,EACD,MAAM,IAAI,MAAM,mCAAmC,EAGvD,MAAMI,GAAY,IAAM,CACpB,GAAI7C,EAAQ,iBAAkB,CAC1B,MAAM8C,EAAW9C,EAAQ,iBACzB,GAAI,CACA,OAAO,IAAI,IAAI8C,EAAUN,CAAO,EAAE,SAAA,CACtC,MAAQ,CACJ,OAAOM,CACX,CACJ,CAMA,OAJI9C,EAAQ,uBAIRwC,EAAQ,SAASI,CAAa,EACvBJ,EAGJ,GAAGA,EAAQ,QAAQ,OAAQ,EAAE,CAAC,GAAGI,CAAa,EACzD,GAAA,EAEMG,GAAS,IAAM,CACjB,GAAI/C,EAAQ,MAAO,OAAOA,EAAQ,MAClC,IAAIgD,EACJ,MAAO,CACH,IAAK,IAAMA,EACX,IAAK,CAACC,EAAcC,IAAgB,CAChCF,EAAcE,CAClB,CAAA,CAER,GAAA,EAEA,IAAIC,EACAC,EAAgB,EAChBC,EACAC,EAAsB,EAE1B,MAAMC,EAAY,MAAOC,GAAgD,CACrE,GAAIH,EAAiB,OAAOA,EAE5BA,GAAmB,SAAY,CAC3B,MAAMI,EAAa,IAAI,gBACvB,IAAIC,EAEAf,EAAY,IACZe,EAAgB,WAAW,IAAMD,EAAW,MAAA,EAASd,CAAS,GAGlE,IAAIgB,EACJ,GAAI,CACAA,EAAW,MAAMlB,EAAQI,EAAU,CAAC,OAAQY,EAAW,OAAO,CAClE,OAASG,EAAO,CACZ,MAAIH,EAAW,OAAO,QACZ,IAAI,MAAM,8BAA8Bd,CAAS,IAAI,EAEzDiB,CACV,QAAA,CACQF,gBAA4BA,CAAa,CACjD,CAEA,GAAI,CAACC,EAAS,GACV,MAAM,IAAI,MAAM,yBAAyBA,EAAS,MAAM,IAAIA,EAAS,UAAU,EAAE,EAGrF,MAAME,EAAO,MAAMF,EAAS,KAAA,EAC5B,GAAI,CAACE,GAAQ,OAAOA,GAAS,UAAY,CAAC,MAAM,QAASA,EAAa,IAAI,EACtE,MAAM,IAAI,MAAM,cAAc,EAGlC,OAAO3B,EAAc2B,CAAY,CACrC,GAAA,EAEA,GAAI,CACA,MAAMC,EAAQ,MAAMT,EACpB,OAAAF,EAAaW,EACb,MAAMf,EAAM,IAAIF,EAAUiB,CAAK,EAC/BR,EAAsB,EAClBZ,EAAM,IAAGU,EAAgB,KAAK,MAAQV,GACnCoB,CACX,OAASF,EAAO,CACZ,GAAI,CAACJ,GAAuB,CAACL,EACzB,MAAMS,EAIV,GADAN,GAAuB,EACnBZ,EAAM,EAAG,CACT,MAAMqB,EAAU,KAAK,IACjB,KAAK,IAAIrB,EAAK,GAAM,EAAI,KAAK,IAAI,EAAGY,EAAsB,CAAC,EAC3D,GAAK,EAETF,EAAgB,KAAK,MAAQW,CACjC,CACA,eAAQ,KAAK,4BAA4BlB,CAAQ,wBAAyBe,CAAK,EACxET,CACX,QAAA,CACIE,EAAkB,MACtB,CACJ,EAEA,OAAAF,EAAa,MAAMJ,EAAM,IAAIF,CAAQ,EAChCM,GAGDA,EAAajB,EAAciB,CAAU,EACjCT,EAAM,IAAGU,EAAgB,KAAK,MAAQV,IAH1CS,EAAa,MAAMI,EAAU,EAAK,EAO9B,CACJ,MAAM,MAAkC,CACpC,OAAIb,EAAM,GAAK,KAAK,IAAA,GAASU,GACzB,MAAMG,EAAU,EAAI,EAEjBpB,EAAa,GAAIgB,EAAoB,IAAI,CACpD,EACA,MAAM,SAAU,CACZ,aAAMI,EAAU,EAAK,EACd,IACX,EACA,MAAM,IAAItB,EAAkD,CAExD,MAAMnD,GADO,MAAM,KAAK,KAAA,GACP,KAAM,GAAM,EAAE,MAAQmD,CAAG,EAC1C,GAAKnD,EACL,OAAOqD,EAAarD,CAAG,EAAE,CAAC,CAC9B,EACA,MAAM,KAAKzC,EAAoD,CAC3D,MAAM+F,EAAO,MAAM,KAAK,KAAA,EAClB4B,EAAU,OAAO,QAAQ3H,CAAK,EAEpC,OAAI2H,EAAQ,SAAW,EAAU7B,EAAa,GAAGC,CAAI,EAE9CD,EAAa,GAAGC,EAAK,OAAQtD,GAChCkF,EAAQ,MAAM,CAAC,CAACC,EAAO3F,CAAQ,IAAM,CACjC,MAAM4E,EAAQpE,EAAImF,CAAK,EACvB,OAAI,MAAM,QAAQ3F,CAAQ,EACf,MAAM,QAAQ4E,CAAK,GACnBA,EAAM,SAAW5E,EAAS,QAC1B4E,EAAM,MAAM,CAACgB,EAAMnH,IAAMmH,IAAS5F,EAASvB,CAAC,CAAC,EAEjDmG,IAAU5E,CACrB,CAAC,CAAA,CACJ,CACL,EACA,MAAM,UAAUjC,EAA8D,CAC1E,OAAO,KAAK,KAAKA,CAAK,EAAE,KAAK,CAAC,CAACyC,CAAG,IAAMA,CAAG,CAC/C,EACA,QAA2B,CACvB,OAAOqE,CACX,CAAA,CAER,EAEagB,EAAO,CAChB,YAAapC,EACb,UAAWG,EACX,QAAAI,CACJ"}
package/dist/index.cjs.js CHANGED
@@ -1,2 +1,2 @@
1
- "use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("./index-CJ4L1o5I.cjs");exports.AutodetectAlgorithm=e.AutodetectAlgorithm;exports.JWK=e.JWK;exports.JWKS=e.JWKS;exports.JWKSToKeyObject=e.JWKSToKeyObject;exports.JWT=e.JWT;exports.SignatureAlgorithm=e.SignatureAlgorithm;exports.SupportedAlgorithms=e.SupportedAlgorithms;exports.base64Url=e.base64Url;exports.computeX5T=e.computeX5T;exports.decode=e.decode;exports.exportJWK=e.exportJWK;exports.fromWeb=e.fromWeb;exports.getJWKThumbprint=e.getJWKThumbprint;exports.importJWK=e.importJWK;exports.normalizeJWKS=e.normalizeJWKS;exports.sign=e.sign;exports.toPublicJWK=e.toPublicJWK;exports.verify=e.verify;
1
+ "use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("./index-YbdG9jsh.cjs");exports.AutodetectAlgorithm=e.AutodetectAlgorithm;exports.JWK=e.JWK;exports.JWKS=e.JWKS;exports.JWKSToKeyObject=e.JWKSToKeyObject;exports.JWT=e.JWT;exports.SignatureAlgorithm=e.SignatureAlgorithm;exports.SupportedAlgorithms=e.SupportedAlgorithms;exports.base64Url=e.base64Url;exports.computeX5T=e.computeX5T;exports.decode=e.decode;exports.exportJWK=e.exportJWK;exports.fromWeb=e.fromWeb;exports.getJWKThumbprint=e.getJWKThumbprint;exports.importJWK=e.importJWK;exports.normalizeJWK=e.normalizeJWK;exports.normalizeJWKS=e.normalizeJWKS;exports.sign=e.sign;exports.toPublicJWK=e.toPublicJWK;exports.verify=e.verify;
2
2
  //# sourceMappingURL=index.cjs.js.map
package/dist/index.es.js CHANGED
@@ -1,4 +1,4 @@
1
- import { A as e, f as t, k as o, h as r, J as i, S as J, a as W, b as m, c as K, d as g, e as p, j as b, g as c, i as l, n as u, s as S, t as d, v as h } from "./index-CQO8xUW-.js";
1
+ import { A as e, f as t, l as o, h as r, J as i, S as J, a as W, b as m, c as K, d as l, e as g, k as p, g as b, i as c, j as n, n as u, s as S, t as d, v as h } from "./index-DNa3e1QZ.js";
2
2
  export {
3
3
  e as AutodetectAlgorithm,
4
4
  t as JWK,
@@ -9,11 +9,12 @@ export {
9
9
  W as SupportedAlgorithms,
10
10
  m as base64Url,
11
11
  K as computeX5T,
12
- g as decode,
13
- p as exportJWK,
14
- b as fromWeb,
15
- c as getJWKThumbprint,
16
- l as importJWK,
12
+ l as decode,
13
+ g as exportJWK,
14
+ p as fromWeb,
15
+ b as getJWKThumbprint,
16
+ c as importJWK,
17
+ n as normalizeJWK,
17
18
  u as normalizeJWKS,
18
19
  S as sign,
19
20
  d as toPublicJWK,
package/dist/jwks/index.d.ts CHANGED
@@ -1,5 +1,8 @@
1
1
  import { KeyObject } from 'crypto';
2
2
  export type JWK = RSAJWK | ECJWK | OKPJWK | OctJWK;
3
+ export type JWKWithHelpers = JWK & {
4
+ toKeyObject(): KeyObject;
5
+ };
3
6
  interface BaseJWK {
4
7
  kty: string;
5
8
  kid?: string;
@@ -84,6 +87,7 @@ export declare function JWKSToKeyObject(jwks: JWKS, kid?: string): KeyObject;
84
87
  * @param jwks
85
88
  */
86
89
  export declare function normalizeJWKS(jwks: JWKS): JWKS;
90
+ export declare function normalizeJWK(...keys: JWK[]): JWKWithHelpers[];
87
91
  export declare const fromWeb: (url: string | URL, options?: Partial<{
88
92
  fetch: typeof fetch;
89
93
  ttl: number;
@@ -95,11 +99,11 @@ export declare const fromWeb: (url: string | URL, options?: Partial<{
95
99
  set: (key: string, value: JWKS) => void | Promise<void>;
96
100
  };
97
101
  }>) => Promise<{
98
- list(): Promise<JWK[]>;
99
- refresh(): Promise<JWK[]>;
100
- key(kid: string): Promise<JWK | undefined>;
101
- find(input: Partial<BaseJWK>): Promise<JWK[]>;
102
- findFirst(input: Partial<BaseJWK>): Promise<JWK>;
102
+ list(): Promise<JWKWithHelpers[]>;
103
+ refresh(): Promise</*elided*/ any>;
104
+ key(kid: string): Promise<JWKWithHelpers | undefined>;
105
+ find(input: Partial<BaseJWK>): Promise<JWKWithHelpers[]>;
106
+ findFirst(input: Partial<BaseJWK>): Promise<JWKWithHelpers | undefined>;
103
107
  export(): JWKS | undefined;
104
108
  }>;
105
109
  export declare const JWKS: {
@@ -116,11 +120,11 @@ export declare const JWKS: {
116
120
  set: (key: string, value: JWKS) => void | Promise<void>;
117
121
  };
118
122
  }>) => Promise<{
119
- list(): Promise<JWK[]>;
120
- refresh(): Promise<JWK[]>;
121
- key(kid: string): Promise<JWK | undefined>;
122
- find(input: Partial<BaseJWK>): Promise<JWK[]>;
123
- findFirst(input: Partial<BaseJWK>): Promise<JWK>;
123
+ list(): Promise<JWKWithHelpers[]>;
124
+ refresh(): Promise</*elided*/ any>;
125
+ key(kid: string): Promise<JWKWithHelpers | undefined>;
126
+ find(input: Partial<BaseJWK>): Promise<JWKWithHelpers[]>;
127
+ findFirst(input: Partial<BaseJWK>): Promise<JWKWithHelpers | undefined>;
124
128
  export(): JWKS | undefined;
125
129
  }>;
126
130
  };
package/dist/promises.cjs.js CHANGED
@@ -1,2 +1,2 @@
1
- "use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("./index-CJ4L1o5I.cjs");require("crypto");const r=e=>Promise.resolve().then(()=>o.decode(e)),i=(...e)=>Promise.resolve().then(()=>o.sign(...e)),s=(...e)=>Promise.resolve().then(()=>{const t=o.verify(...e);if(!t.valid)throw t.error;const{header:W,payload:h,signature:p}=t;return{header:W,payload:h,signature:p}}),g={sign:i,verify:s,decode:r,algorithms:o.SignatureAlgorithm},n=e=>Promise.resolve().then(()=>o.exportJWK(e)),c=e=>Promise.resolve().then(()=>o.importJWK(e)),m=e=>Promise.resolve().then(()=>o.toPublicJWK(e)),l=(e,t="sha256")=>Promise.resolve().then(()=>o.getJWKThumbprint(e,t)),K=(e,t)=>Promise.resolve().then(()=>o.JWKSToKeyObject(e,t)),u=e=>Promise.resolve().then(()=>o.normalizeJWKS(e)),J=e=>Promise.resolve().then(()=>o.computeX5T(e)),a={export:n,import:c,toPublic:m,thumbprint:l,computeX5T:J},v={toKeyObject:K,normalize:u};exports.SignatureAlgorithm=o.SignatureAlgorithm;exports.SupportedAlgorithms=o.SupportedAlgorithms;exports.JWK=a;exports.JWKS=v;exports.JWKSToKeyObject=K;exports.JWT=g;exports.computeX5T=J;exports.decode=r;exports.exportJWK=n;exports.getJWKThumbprint=l;exports.importJWK=c;exports.normalizeJWKS=u;exports.sign=i;exports.toPublicJWK=m;exports.verify=s;
1
+ "use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("./index-YbdG9jsh.cjs");require("crypto");const r=e=>Promise.resolve().then(()=>o.decode(e)),i=(...e)=>Promise.resolve().then(()=>o.sign(...e)),s=(...e)=>Promise.resolve().then(()=>{const t=o.verify(...e);if(!t.valid)throw t.error;const{header:W,payload:h,signature:p}=t;return{header:W,payload:h,signature:p}}),g={sign:i,verify:s,decode:r,algorithms:o.SignatureAlgorithm},n=e=>Promise.resolve().then(()=>o.exportJWK(e)),c=e=>Promise.resolve().then(()=>o.importJWK(e)),m=e=>Promise.resolve().then(()=>o.toPublicJWK(e)),l=(e,t="sha256")=>Promise.resolve().then(()=>o.getJWKThumbprint(e,t)),K=(e,t)=>Promise.resolve().then(()=>o.JWKSToKeyObject(e,t)),u=e=>Promise.resolve().then(()=>o.normalizeJWKS(e)),J=e=>Promise.resolve().then(()=>o.computeX5T(e)),a={export:n,import:c,toPublic:m,thumbprint:l,computeX5T:J},v={toKeyObject:K,normalize:u};exports.SignatureAlgorithm=o.SignatureAlgorithm;exports.SupportedAlgorithms=o.SupportedAlgorithms;exports.JWK=a;exports.JWKS=v;exports.JWKSToKeyObject=K;exports.JWT=g;exports.computeX5T=J;exports.decode=r;exports.exportJWK=n;exports.getJWKThumbprint=l;exports.importJWK=c;exports.normalizeJWKS=u;exports.sign=i;exports.toPublicJWK=m;exports.verify=s;
2
2
  //# sourceMappingURL=promises.cjs.js.map
package/dist/promises.es.js CHANGED
@@ -1,5 +1,5 @@
1
- import { S as n, d as i, s as m, v as c, e as a, i as l, t as h, g as p, h as K, n as J, c as W } from "./index-CQO8xUW-.js";
2
- import { a as w } from "./index-CQO8xUW-.js";
1
+ import { S as n, d as i, s as m, v as c, e as a, i as l, t as h, g as p, h as K, n as J, c as W } from "./index-DNa3e1QZ.js";
2
+ import { a as w } from "./index-DNa3e1QZ.js";
3
3
  import "crypto";
4
4
  const v = (e) => Promise.resolve().then(() => i(e)), u = (...e) => Promise.resolve().then(() => m(...e)), P = (...e) => Promise.resolve().then(() => {
5
5
  const o = c(...e);
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sourceregistry/node-jwt",
3
- "version": "1.5.1",
3
+ "version": "1.5.3",
4
4
  "description": "A lightweight, zero-dependency TypeScript library for creating, verifying and decoding JSON Web Tokens (JWT).",
5
5
  "main": "./dist/index.cjs.js",
6
6
  "module": "./dist/index.es.js",
package/dist/index-CJ4L1o5I.cjs.map DELETED
@@ -1 +0,0 @@
1
- {"version":3,"file":"index-CJ4L1o5I.cjs","sources":["../src/jwt/index.ts","../src/jwks/index.ts"],"sourcesContent":["import crypto, {\n createHmac,\n createSign,\n createVerify,\n createPrivateKey,\n createSecretKey,\n sign as cryptoSign,\n verify as cryptoVerify,\n timingSafeEqual,\n type BinaryLike,\n type KeyLike,\n type KeyObject\n} from 'crypto';\n\n// Base64URL helpers (padding-safe)\nexport const base64Url = {\n encode: (input: string | Buffer): string => Buffer.from(input).toString('base64url'),\n decode: (input: string): string => Buffer.from(input, 'base64url').toString()\n};\n\n/**\n * Timing-safe string comparison to prevent timing attacks\n * @param a\n * @param b\n */\nconst timingSafeCompare = (a: string, b: string): boolean => {\n if (a.length !== b.length) {\n return false;\n }\n return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n};\n\n// Standard JWT payload claims\nexport interface JWTPayload {\n /**\n * Issuer\n */\n iss?: string;\n /**\n * Subject\n */\n sub?: string;\n /**\n * Audience\n */\n aud?: string | string[];\n /**\n * Expiration Time (as UNIX timestamp)\n */\n exp?: number;\n /**\n * Not Before (as UNIX timestamp)\n */\n nbf?: number;\n /**\n * Issued At (as UNIX timestamp)\n */\n iat?: number;\n /**\n * JWT ID\n */\n jti?: string;\n /**\n * Session ID\n */\n sid?: string;\n\n /**\n * Custom claims\n */\n [key: string]: unknown;\n}\n\nexport interface JWTHeader {\n alg: string; // Allow unknown algs during decode\n typ?: string;\n kid?: string;\n}\n\nexport interface JWT {\n header: JWTHeader;\n payload: JWTPayload;\n signature: string;\n}\n\n\n//JOSE-helpers\nfunction joseLenForAlg(alg: string): number {\n switch (alg) {\n case 'ES256':\n case 'ES256K':\n return 64; // 32 + 32\n case 'ES384':\n return 96; // 48 + 48\n case 'ES512':\n return 132; // 66 + 66 (P-521)\n default:\n throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${alg}`);\n }\n}\n\nfunction derToJose(der: Buffer, outLen: number): Buffer {\n let i = 0;\n if (der[i++] !== 0x30) throw new Error('Invalid DER ECDSA signature');\n\n // seq length (short/long form)\n let seqLen = der[i++];\n if (seqLen & 0x80) {\n const n = seqLen & 0x7f;\n seqLen = 0;\n for (let k = 0; k < n; k++) seqLen = (seqLen << 8) | der[i++];\n }\n\n if (der[i++] !== 0x02) throw new Error('Invalid DER ECDSA signature (r)');\n const rLen = der[i++];\n let r = der.subarray(i, i + rLen);\n i += rLen;\n\n if (der[i++] !== 0x02) throw new Error('Invalid DER ECDSA signature (s)');\n const sLen = der[i++];\n let s = der.subarray(i, i + sLen);\n\n // strip leading zeros\n while (r.length > outLen / 2 && r[0] === 0x00) r = r.subarray(1);\n while (s.length > outLen / 2 && s[0] === 0x00) s = s.subarray(1);\n\n const rPad = Buffer.concat([Buffer.alloc(outLen / 2 - r.length, 0), r]);\n const sPad = Buffer.concat([Buffer.alloc(outLen / 2 - s.length, 0), s]);\n return Buffer.concat([rPad, sPad]);\n}\n\nfunction joseToDer(jose: Buffer): Buffer {\n const half = jose.length / 2;\n let r = jose.subarray(0, half);\n let s = jose.subarray(half);\n\n // trim leading zeros\n while (r.length > 1 && r[0] === 0x00 && (r[1] & 0x80) === 0) r = r.subarray(1);\n while (s.length > 1 && s[0] === 0x00 && (s[1] & 0x80) === 0) s = s.subarray(1);\n\n // if high bit set, prepend 0x00\n if (r[0] & 0x80) r = Buffer.concat([Buffer.from([0x00]), r]);\n if (s[0] & 0x80) s = Buffer.concat([Buffer.from([0x00]), s]);\n\n const rPart = Buffer.concat([Buffer.from([0x02, r.length]), r]);\n const sPart = Buffer.concat([Buffer.from([0x02, s.length]), s]);\n\n const seqLen = rPart.length + sPart.length;\n\n let lenBytes: Buffer;\n if (seqLen < 0x80) {\n lenBytes = Buffer.from([seqLen]);\n } else {\n const tmp: number[] = [];\n let n = seqLen;\n while (n > 0) {\n tmp.unshift(n & 0xff);\n n >>= 8;\n }\n lenBytes = Buffer.from([0x80 | tmp.length, ...tmp]);\n }\n\n return Buffer.concat([Buffer.from([0x30]), lenBytes, rPart, sPart]);\n}\n\nfunction isEcdsaAlg(alg: string): boolean {\n return alg === 'ES256' || alg === 'ES384' || alg === 'ES512' || alg === 'ES256K';\n}\n\n\n// Signature algorithms\nexport const SignatureAlgorithm = {\n // HMAC\n HS256: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createHmac('sha256', secret).update(data).digest('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n const expected = createHmac('sha256', secret).update(data).digest('base64url');\n return timingSafeCompare(expected, signature);\n }\n },\n HS384: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createHmac('sha384', secret).update(data).digest('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n const expected = createHmac('sha384', secret).update(data).digest('base64url');\n return timingSafeCompare(expected, signature);\n }\n },\n HS512: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createHmac('sha512', secret).update(data).digest('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n const expected = createHmac('sha512', secret).update(data).digest('base64url');\n return timingSafeCompare(expected, signature);\n }\n },\n\n // RSA (DER-encoded signatures, base64url)\n RS256: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA256').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA256')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n RS384: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA384').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA384')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n RS512: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA512').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA512')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n\n // ECDSA (DER-encoded by default — no dsaEncoding!)\n ES256: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('SHA256').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('SHA256')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n ES384: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('SHA384').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('SHA384')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n ES512: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('SHA512').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('SHA512')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n ES256K: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('SHA256').update(data).end().sign(secret).toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('SHA256')\n .update(data)\n .end()\n .verify(secret, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n PS256: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA256')\n .update(data)\n .end()\n .sign({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 32\n })\n .toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA256')\n .update(data)\n .end()\n .verify({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 32\n }, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n PS384: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA384')\n .update(data)\n .end()\n .sign({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 48\n })\n .toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA384')\n .update(data)\n .end()\n .verify({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 48\n }, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n PS512: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n createSign('RSA-SHA512')\n .update(data)\n .end()\n .sign({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 64\n })\n .toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return createVerify('RSA-SHA512')\n .update(data)\n .end()\n .verify({\n //@ts-ignore\n key: secret,\n padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n saltLength: 64\n }, Buffer.from(signature, 'base64url'));\n } catch {\n return false;\n }\n }\n },\n EdDSA: {\n sign: (data: BinaryLike, secret: KeyLike) =>\n cryptoSign(null, typeof data === 'string' ? Buffer.from(data, 'utf8') : data, secret)\n .toString('base64url'),\n verify: (data: BinaryLike, secret: KeyLike, signature: string) => {\n try {\n return cryptoVerify(\n null,\n typeof data === 'string' ? Buffer.from(data, 'utf8') : data,\n secret,\n Buffer.from(signature, 'base64url')\n );\n } catch {\n return false;\n }\n }\n }\n} as const;\n\nexport type SupportedAlgorithm = keyof typeof SignatureAlgorithm;\n\nexport const SupportedAlgorithms = Object.keys(SignatureAlgorithm) as Array<SupportedAlgorithm>;\n\n/**\n * Autodetection of algorithm for KeyObjects\n * @param key\n * @constructor\n */\nexport function AutodetectAlgorithm(key: KeyObject): SupportedAlgorithm {\n if (key.type === 'secret') return 'HS256';\n if (key.type !== 'private') throw new Error('Only private or symmetric keys can be used to sign JWTs');\n\n const asymKeyType = key.asymmetricKeyType;\n const details = key.asymmetricKeyDetails;\n\n switch (asymKeyType) {\n case 'rsa':\n return 'RS256';\n case 'rsa-pss': {\n const hash = details?.hashAlgorithm ?? 'sha256';\n switch (hash) {\n case 'sha256':\n return 'PS256';\n case 'sha384':\n return 'PS384';\n case 'sha512':\n return 'PS512';\n default:\n throw new Error(`Unsupported RSA-PSS hash algorithm: ${hash}`);\n }\n }\n case 'ec': {\n const curve = details?.namedCurve;\n switch (curve) {\n case 'P-256':\n case 'prime256v1':\n return 'ES256';\n case 'P-384':\n case 'secp384r1':\n return 'ES384';\n case 'P-521':\n case 'secp521r1':\n return 'ES512';\n case 'secp256k1':\n return 'ES256K';\n default:\n throw new Error(`Unsupported EC curve: ${curve}`);\n }\n }\n case 'ed25519':\n return 'EdDSA';\n default:\n throw new Error(`Unsupported asymmetric key type: ${asymKeyType}`);\n }\n}\n\n/**\n * Normalize KeyLike input to a KeyObject\n * @param key\n */\nfunction toKeyObject(key: KeyLike): KeyObject {\n // Already a KeyObject (private, public, or secret)\n if (typeof key === 'object' && 'type' in key) return key as KeyObject;\n\n // Try asymmetric private key (PEM / DER / JWK)\n try {\n return createPrivateKey(key);\n } catch {\n // Fallback: symmetric key (HMAC)\n const buffer =\n typeof key === 'string'\n ? Buffer.from(key, 'utf8')\n : Buffer.isBuffer(key)\n ? key\n : (() => {\n throw new Error('Unsupported key type');\n })();\n\n return createSecretKey(buffer);\n }\n}\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): JWT => {\n const parts = token.split('.');\n if (parts.length !== 3) {\n throw new Error('Invalid JWT: must contain exactly 3 parts separated by \".\"');\n }\n\n const [headerPart, payloadPart, signature] = parts;\n\n if (!headerPart || !payloadPart || !signature) {\n throw new Error('Invalid JWT: empty part detected');\n }\n\n try {\n const header = JSON.parse(base64Url.decode(headerPart)) as JWTHeader;\n const payload = JSON.parse(base64Url.decode(payloadPart)) as JWTPayload;\n return {header, payload, signature};\n } catch (err) {\n throw new Error(`Invalid JWT: malformed header or payload (${(err as Error).message})`);\n }\n};\n\n/**\n * Sign a JWT\n * @param payload\n * @param secret\n * @param options\n */\nexport const sign = (\n payload: JWTPayload,\n secret: KeyLike,\n options: {\n alg?: SupportedAlgorithm;\n kid?: string;\n typ?: string;\n /**\n * default 'der'\n */\n signatureFormat?: 'der' | 'jose';\n } = {}\n): string => {\n const key = toKeyObject(secret);\n const alg = options.alg ?? AutodetectAlgorithm(key);\n const signatureFormat = options.signatureFormat ?? 'der';\n const typ = options.typ ?? 'JWT';\n\n if (!(alg in SignatureAlgorithm)) throw new Error(`Unsupported algorithm: ${alg}`);\n\n const header: JWTHeader = {alg, typ};\n if (options.kid) header.kid = options.kid;\n\n const headerEncoded = base64Url.encode(JSON.stringify(header));\n const payloadEncoded = base64Url.encode(JSON.stringify(payload));\n\n const signingInput = `${headerEncoded}.${payloadEncoded}`;\n\n // existing DER/base64url signature from algorithms\n let signature = SignatureAlgorithm[alg].sign(signingInput, secret);\n\n // If ES* and caller requested JOSE, convert the DER signature bytes to JOSE bytes\n if (signatureFormat === 'jose' && isEcdsaAlg(alg)) {\n const der = Buffer.from(signature, 'base64url');\n const jose = derToJose(der, joseLenForAlg(alg));\n signature = jose.toString('base64url');\n }\n\n return `${headerEncoded}.${payloadEncoded}.${signature}`;\n\n};\n\n/**\n * Verify and validate a JWT\n * @param token\n * @param secret\n * @param options\n */\nexport const verify = (\n token: string,\n secret: KeyLike,\n options: {\n algorithms?: SupportedAlgorithm[]; // Whitelist of allowed algorithms\n issuer?: string;\n subject?: string;\n audience?: string | string[];\n jwtId?: string;\n ignoreExpiration?: boolean;\n clockSkew?: number; // in seconds, default 0\n maxTokenAge?: number; // Maximum age in seconds\n signatureFormat?: 'der' | 'jose';\n } = {}\n):\n | { valid: true; header: JWTHeader; payload: JWTPayload; signature: string }\n | { valid: false; error: { reason: string; code: string } } => {\n let decoded: JWT;\n try {\n decoded = decode(token);\n } catch (err) {\n return {\n valid: false,\n error: {\n reason: (err as Error).message,\n code: 'INVALID_TOKEN'\n }\n };\n }\n\n const {header, payload, signature} = decoded;\n\n // Validate algorithm\n const alg = header.alg as SupportedAlgorithm;\n if (!(alg in SignatureAlgorithm)) {\n return {\n valid: false,\n error: {\n reason: `Unsupported or unknown algorithm: ${header.alg}`,\n code: 'INVALID_ALGORITHM'\n }\n };\n }\n\n // Algorithm whitelist validation (prevents algorithm confusion attacks)\n if (options.algorithms && options.algorithms.length > 0) {\n if (!options.algorithms.includes(alg)) {\n return {\n valid: false,\n error: {\n reason: `Algorithm \"${alg}\" is not in the allowed algorithms list`,\n code: 'ALGORITHM_NOT_ALLOWED'\n }\n };\n }\n }\n\n // Validate 'typ' header (must be 'JWT' if present)\n if (header.typ !== undefined && header.typ !== 'JWT') {\n return {\n valid: false,\n error: {\n reason: `Invalid token type: expected 'JWT', got '${header.typ}'`,\n code: 'INVALID_TYPE'\n }\n };\n }\n\n // Verify signature\n const signingInput = `${base64Url.encode(JSON.stringify(header))}.${base64Url.encode(JSON.stringify(payload))}`;\n\n if (!isEcdsaAlg(alg)) {\n // non-ES* algorithms unchanged\n const isValidSignature = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n if (!isValidSignature) {\n return {valid: false, error: {reason: \"Signature verification failed\", code: 'INVALID_SIGNATURE'}};\n }\n } else {\n // ES* algorithms: verify DER by default, but allow JOSE + auto-detect\n const format = options.signatureFormat; // undefined means \"auto\"\n\n let ok: boolean;\n\n // 1) If explicitly JOSE -> convert to DER for verification\n if (format === 'jose') {\n try {\n const jose = Buffer.from(signature, 'base64url');\n const derSigB64Url = joseToDer(jose).toString('base64url');\n ok = SignatureAlgorithm[alg].verify(signingInput, secret, derSigB64Url);\n } catch {\n ok = false;\n }\n }\n // 2) If explicitly DER -> verify as-is\n else if (format === 'der') {\n ok = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n }\n // 3) Auto-detect: try DER first, then JOSE\n else {\n ok = SignatureAlgorithm[alg].verify(signingInput, secret, signature);\n if (!ok) {\n try {\n const jose = Buffer.from(signature, 'base64url');\n // quick sanity: only attempt conversion if size matches expected\n if (jose.length === joseLenForAlg(alg)) {\n const derSigB64Url = joseToDer(jose).toString('base64url');\n ok = SignatureAlgorithm[alg].verify(signingInput, secret, derSigB64Url);\n }\n } catch {\n // ignore\n }\n }\n }\n\n if (!ok) {\n return {valid: false, error: {reason: \"Signature verification failed\", code: 'INVALID_SIGNATURE'}};\n }\n }\n\n // Time validation\n const now = Math.floor(Date.now() / 1000);\n const skew = options.clockSkew ?? 0;\n\n if (!options.ignoreExpiration) {\n if (payload.exp !== undefined && now > payload.exp + skew) {\n return {\n valid: false,\n error: {\n reason: 'Token expired',\n code: 'TOKEN_EXPIRED'\n }\n };\n }\n }\n\n if (payload.nbf !== undefined && now + skew < payload.nbf) {\n return {\n valid: false,\n error: {\n reason: 'Token not yet valid',\n code: 'TOKEN_NOT_ACTIVE'\n }\n };\n }\n\n if (payload.iat !== undefined && now + skew < payload.iat) {\n return {\n valid: false,\n error: {\n reason: 'Token issued in the future',\n code: 'TOKEN_FUTURE_ISSUED'\n }\n };\n }\n\n // Maximum token age validation\n if (options.maxTokenAge !== undefined && payload.iat !== undefined) {\n const tokenAge = now - payload.iat;\n if (tokenAge > options.maxTokenAge) {\n return {\n valid: false,\n error: {\n reason: `Token age (${tokenAge}s) exceeds maximum allowed age (${options.maxTokenAge}s)`,\n code: 'TOKEN_TOO_OLD'\n }\n };\n }\n }\n\n // --- Claim validations (only if options provided) ---\n\n // Issuer (`iss`)\n if (options.issuer !== undefined) {\n if (payload.iss === undefined) {\n return {\n valid: false,\n error: {\n reason: 'Token missing required issuer claim (\"iss\")',\n code: 'MISSING_ISSUER'\n }\n };\n }\n if (options.issuer !== payload.iss) {\n return {\n valid: false,\n error: {\n reason: `Invalid token issuer: expected \"${options.issuer}\", got \"${payload.iss}\"`,\n code: 'INVALID_ISSUER'\n }\n };\n }\n }\n\n // Subject (`sub`)\n if (options.subject !== undefined) {\n if (payload.sub === undefined) {\n return {\n valid: false,\n error: {\n reason: 'Token missing required subject claim (\"sub\")',\n code: 'MISSING_SUBJECT'\n }\n };\n }\n if (options.subject !== payload.sub) {\n return {\n valid: false,\n error: {\n reason: `Invalid token subject: expected \"${options.subject}\", got \"${payload.sub}\"`,\n code: 'INVALID_SUBJECT'\n }\n };\n }\n }\n\n // Audience (`aud`)\n if (options.audience !== undefined) {\n const aud = payload.aud;\n if (aud === undefined) {\n return {\n valid: false,\n error: {\n reason: 'Token missing required audience claim (\"aud\")',\n code: 'MISSING_AUDIENCE'\n }\n };\n }\n\n const expectedAud = Array.isArray(options.audience) ? options.audience : [options.audience];\n const tokenAud = Array.isArray(aud) ? aud : [aud];\n\n const hasMatch = expectedAud.some(a => tokenAud.includes(a));\n if (!hasMatch) {\n return {\n valid: false,\n error: {\n reason: 'Audience claim mismatch',\n code: 'INVALID_AUDIENCE'\n }\n };\n }\n }\n\n // JWT ID (`jti`)\n if (options.jwtId !== undefined) {\n if (payload.jti === undefined) {\n return {\n valid: false,\n error: {\n reason: 'Token missing required JWT ID claim (\"jti\")',\n code: 'MISSING_JTI'\n }\n };\n }\n if (options.jwtId !== payload.jti) {\n return {\n valid: false,\n error: {\n reason: `Invalid JWT ID: expected \"${options.jwtId}\", got \"${payload.jti}\"`,\n code: 'INVALID_JTI'\n }\n };\n }\n }\n\n return {valid: true, header, payload, signature};\n};\n\n//namespace export\nexport const JWT = {\n sign,\n verify,\n decode,\n algorithms: SignatureAlgorithm\n};\n\n","import {\n createPrivateKey,\n createPublicKey,\n createSecretKey,\n createHash,\n type KeyObject\n} from 'crypto';\n\n// JWK Types\nexport type JWK =\n | RSAJWK\n | ECJWK\n | OKPJWK\n | OctJWK;\n\ninterface BaseJWK {\n kty: string;\n kid?: string;\n alg?: string;\n use?: 'sig' | 'enc';\n key_ops?: Array<'sign' | 'verify'>;\n x5c?: string[]; // X.509 cert chain\n x5t?: string; // Base64url thumbprint\n}\n\nexport interface RSAJWK extends BaseJWK {\n kty: 'RSA';\n n: string;\n e: string;\n d?: string;\n p?: string;\n q?: string;\n dp?: string;\n dq?: string;\n qi?: string;\n}\n\nexport interface ECJWK extends BaseJWK {\n kty: 'EC';\n crv: 'P-256' | 'P-384' | 'P-521' | 'secp256k1';\n x: string;\n y: string;\n d?: string;\n}\n\nexport interface OKPJWK extends BaseJWK {\n kty: 'OKP';\n crv: 'Ed25519';\n x: string;\n d?: string;\n}\n\nexport interface OctJWK extends BaseJWK {\n kty: 'oct';\n k: string;\n}\n\n/**\n * Export KeyObject to JWK\n * @param key\n */\nexport function exportJWK(key: KeyObject): JWK {\n if (!key || typeof key !== 'object') throw new Error('Invalid KeyObject');\n return key.export({format: 'jwk'}) as JWK;\n}\n\n/**\n * Import JWK to KeyObject\n * @param jwk\n */\nexport function importJWK(jwk: JWK): KeyObject {\n if (!jwk || typeof jwk !== 'object') throw new Error('Invalid JWK');\n\n switch (jwk.kty) {\n case 'oct': {\n if (!('k' in jwk) || typeof jwk.k !== 'string') {\n throw new Error('Invalid oct JWK: missing \"k\"');\n }\n\n return createSecretKey(Buffer.from(jwk.k, 'base64url'));\n }\n\n case 'RSA':\n case 'EC':\n case 'OKP': {\n // private key\n if ('d' in jwk && typeof (jwk as any).d === 'string') {\n // @ts-ignore\n return createPrivateKey({format: 'jwk', key: jwk});\n }\n\n // public key\n // @ts-ignore\n return createPublicKey({format: 'jwk', key: jwk});\n }\n\n default:\n throw new Error(`Unsupported JWK key type: ${(jwk as any).kty}`);\n }\n}\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport function toPublicJWK(key: KeyObject): JWK {\n if (!key || typeof key !== 'object') {\n throw new Error('Invalid KeyObject');\n }\n\n const publicKey =\n key.type === 'private'\n ? createPublicKey(key)\n : key;\n\n const jwk = publicKey.export({format: 'jwk'}) as JWK;\n\n // Ensure private fields are not present\n delete (jwk as any).d;\n delete (jwk as any).p;\n delete (jwk as any).q;\n delete (jwk as any).dp;\n delete (jwk as any).dq;\n delete (jwk as any).qi;\n return jwk;\n}\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport function getJWKThumbprint(jwk: JWK, hashAlg: 'sha256' = 'sha256'): string {\n if (!jwk || typeof jwk !== 'object') {\n throw new Error('Invalid JWK');\n }\n\n let fields: Record<string, string>;\n\n switch (jwk.kty) {\n case 'RSA':\n fields = {e: jwk.e, kty: jwk.kty, n: jwk.n};\n break;\n\n case 'EC':\n fields = {crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y};\n break;\n\n case 'OKP':\n fields = {crv: jwk.crv, kty: jwk.kty, x: jwk.x};\n break;\n\n case 'oct':\n fields = {k: jwk.k, kty: jwk.kty};\n break;\n\n default:\n throw new Error(`Unsupported JWK key type: ${(jwk as any).kty}`);\n }\n\n // Lexicographically sorted JSON\n const json = JSON.stringify(\n Object.keys(fields)\n .sort()\n .reduce((acc, k) => {\n acc[k] = fields[k];\n return acc;\n }, {} as Record<string, string>)\n );\n\n return createHash(hashAlg)\n .update(json)\n .digest('base64url');\n}\n\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport function computeX5T(jwk: JWK): string | undefined {\n if (!jwk.x5c?.length) return undefined;\n return createHash('sha1').update(Buffer.from(jwk.x5c[0], 'base64')).digest('base64url');\n}\n\nexport const JWK = {\n export: exportJWK,\n import: importJWK,\n toPublic: toPublicJWK,\n thumbprint: getJWKThumbprint,\n}\n\nexport interface JWKS {\n keys: JWK[];\n}\n\n/**\n * Convert JWKS specific key of first key to KeyObject\n * @param jwks\n * @param kid\n * @constructor\n */\nexport function JWKSToKeyObject(\n jwks: JWKS,\n kid?: string\n): KeyObject {\n if (!jwks || !Array.isArray(jwks.keys)) throw new Error('Invalid JWKS');\n\n let jwk: JWK | undefined;\n\n if (kid) jwk = jwks.keys.find(k => k.kid === kid);\n\n // Fallback: single-key JWKS\n if (!jwk && jwks.keys.length === 1) jwk = jwks.keys[0];\n\n if (!jwk) throw new Error('Key not found in JWKS');\n return importJWK(jwk);\n}\n\n/**\n * Normalize JWKS\n * @param jwks\n */\nexport function normalizeJWKS(jwks: JWKS): JWKS {\n return {\n keys: jwks.keys.map(jwk => ({\n ...jwk,\n kid: jwk.kid ?? getJWKThumbprint(jwk),\n x5t: jwk.x5t ?? computeX5T(jwk)\n }))\n };\n}\n\nexport const fromWeb = async (\n url: string | URL,\n options: Partial<{\n fetch: typeof fetch;\n ttl: number;\n timeoutMs: number;\n endpointOverride: string;\n overrideEndpointCheck: boolean;\n cache: {\n get: (key: string) => JWKS | undefined | Promise<JWKS | undefined>;\n set: (key: string, value: JWKS) => void | Promise<void>;\n };\n }> = {}\n) => {\n const baseUrl = typeof url === 'string' ? url : url.toString();\n const fetchFn = options.fetch ?? globalThis.fetch;\n const ttl = Math.max(0, options.ttl ?? 5 * 60_000);\n const timeoutMs = Math.max(0, options.timeoutMs ?? 5_000);\n const wellKnownPath = '/.well-known/jwks.json';\n\n if (!fetchFn) {\n throw new Error('No fetch implementation available');\n }\n\n const endpoint = (() => {\n if (options.endpointOverride) {\n const override = options.endpointOverride;\n try {\n return new URL(override, baseUrl).toString();\n } catch {\n return override;\n }\n }\n\n if (options.overrideEndpointCheck) {\n return baseUrl;\n }\n\n if (baseUrl.endsWith(wellKnownPath)) {\n return baseUrl;\n }\n\n return `${baseUrl.replace(/\\/+$/, '')}${wellKnownPath}`;\n })();\n\n const cache = (() => {\n if (options.cache) return options.cache;\n let memoryValue: JWKS | undefined;\n return {\n get: () => memoryValue,\n set: (_key: string, value: JWKS) => {\n memoryValue = value;\n }\n };\n })();\n\n let cachedJWKS: JWKS | undefined;\n let nextRefreshAt = 0;\n let refreshInFlight: Promise<JWKS> | undefined;\n let consecutiveFailures = 0;\n\n const fetchJWKS = async (allowStaleOnFailure: boolean): Promise<JWKS> => {\n if (refreshInFlight) return refreshInFlight;\n\n refreshInFlight = (async () => {\n const controller = new AbortController();\n let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n\n if (timeoutMs > 0) {\n timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);\n }\n\n let response: Response;\n try {\n response = await fetchFn(endpoint, {signal: controller.signal});\n } catch (error) {\n if (controller.signal.aborted) {\n throw new Error(`JWKS fetch timed out after ${timeoutMs}ms`);\n }\n throw error;\n } finally {\n if (timeoutHandle) clearTimeout(timeoutHandle);\n }\n\n if (!response.ok) {\n throw new Error(`Failed to fetch JWKS: ${response.status} ${response.statusText}`);\n }\n\n const body = await response.json();\n if (!body || typeof body !== 'object' || !Array.isArray((body as any).keys)) {\n throw new Error('Invalid JWKS');\n }\n\n return normalizeJWKS(body as JWKS);\n })();\n\n try {\n const fresh = await refreshInFlight;\n cachedJWKS = fresh;\n await cache.set(endpoint, fresh);\n consecutiveFailures = 0;\n if (ttl > 0) nextRefreshAt = Date.now() + ttl;\n return fresh;\n } catch (error) {\n if (!allowStaleOnFailure || !cachedJWKS) {\n throw error;\n }\n\n consecutiveFailures += 1;\n if (ttl > 0) {\n const backoff = Math.min(\n Math.max(ttl, 30_000) * Math.pow(2, consecutiveFailures - 1),\n 15 * 60_000\n );\n nextRefreshAt = Date.now() + backoff;\n }\n console.warn(`JWKS refresh failed for \"${endpoint}\", using stale cache.`, error);\n return cachedJWKS;\n } finally {\n refreshInFlight = undefined;\n }\n };\n\n cachedJWKS = await cache.get(endpoint);\n if (!cachedJWKS) {\n cachedJWKS = await fetchJWKS(false);\n } else {\n cachedJWKS = normalizeJWKS(cachedJWKS);\n if (ttl > 0) nextRefreshAt = Date.now() + ttl;\n }\n\n\n return ({\n async list(): Promise<JWK[]> {\n if (ttl > 0 && Date.now() >= nextRefreshAt) {\n await fetchJWKS(true);\n }\n return Promise.resolve((cachedJWKS as JWKS).keys);\n },\n async refresh(): Promise<JWK[]> {\n await fetchJWKS(false);\n return (cachedJWKS as JWKS).keys;\n },\n async key(kid: string) {\n const keys = await this.list();\n return keys.find((v) => v.kid === kid);\n },\n async find(input: Partial<BaseJWK>): Promise<JWK[]> {\n const keys = await this.list();\n const entries = Object.entries(input) as Array<[keyof BaseJWK, BaseJWK[keyof BaseJWK]]>;\n\n if (entries.length === 0) return keys;\n\n return keys.filter((key) =>\n entries.every(([field, expected]) => {\n const value = key[field];\n if (Array.isArray(expected)) {\n return Array.isArray(value)\n && value.length === expected.length\n && value.every((item, i) => item === expected[i]);\n }\n return value === expected;\n })\n );\n },\n async findFirst(input: Partial<BaseJWK>): Promise<JWK> {\n return this.find(input).then(([key]) => key);\n },\n export(): JWKS | undefined {\n return cachedJWKS;\n }\n });\n}\n\nexport const JWKS = {\n toKeyObject: JWKSToKeyObject,\n normalize: normalizeJWKS,\n fromWeb\n}\n"],"names":["base64Url","input","timingSafeCompare","a","b","timingSafeEqual","joseLenForAlg","alg","derToJose","der","outLen","i","seqLen","n","k","rLen","r","sLen","s","rPad","sPad","joseToDer","jose","half","rPart","sPart","lenBytes","tmp","isEcdsaAlg","SignatureAlgorithm","data","secret","createHmac","signature","expected","createSign","createVerify","crypto","cryptoSign","cryptoVerify","SupportedAlgorithms","AutodetectAlgorithm","key","asymKeyType","details","hash","curve","toKeyObject","createPrivateKey","buffer","createSecretKey","decode","token","parts","headerPart","payloadPart","header","payload","err","sign","options","signatureFormat","typ","headerEncoded","payloadEncoded","signingInput","verify","decoded","format","ok","derSigB64Url","now","skew","tokenAge","aud","expectedAud","tokenAud","JWT","exportJWK","importJWK","jwk","createPublicKey","toPublicJWK","getJWKThumbprint","hashAlg","fields","json","acc","createHash","computeX5T","JWK","JWKSToKeyObject","jwks","kid","normalizeJWKS","fromWeb","url","baseUrl","fetchFn","ttl","timeoutMs","wellKnownPath","endpoint","override","cache","memoryValue","_key","value","cachedJWKS","nextRefreshAt","refreshInFlight","consecutiveFailures","fetchJWKS","allowStaleOnFailure","controller","timeoutHandle","response","error","body","fresh","backoff","v","keys","entries","field","item","JWKS"],"mappings":"uCAeaA,EAAY,CACrB,OAASC,GAAmC,OAAO,KAAKA,CAAK,EAAE,SAAS,WAAW,EACnF,OAASA,GAA0B,OAAO,KAAKA,EAAO,WAAW,EAAE,SAAA,CACvE,EAOMC,EAAoB,CAACC,EAAWC,IAC9BD,EAAE,SAAWC,EAAE,OACR,GAEJC,EAAAA,gBAAgB,OAAO,KAAKF,CAAC,EAAG,OAAO,KAAKC,CAAC,CAAC,EA0DzD,SAASE,EAAcC,EAAqB,CACxC,OAAQA,EAAA,CACJ,IAAK,QACL,IAAK,SACD,MAAO,IACX,IAAK,QACD,MAAO,IACX,IAAK,QACD,MAAO,KACX,QACI,MAAM,IAAI,MAAM,8CAA8CA,CAAG,EAAE,CAAA,CAE/E,CAEA,SAASC,EAAUC,EAAaC,EAAwB,CACpD,IAAIC,EAAI,EACR,GAAIF,EAAIE,GAAG,IAAM,GAAM,MAAM,IAAI,MAAM,6BAA6B,EAGpE,IAAIC,EAASH,EAAIE,GAAG,EACpB,GAAIC,EAAS,IAAM,CACf,MAAMC,EAAID,EAAS,IACnBA,EAAS,EACT,QAASE,EAAI,EAAGA,EAAID,EAAGC,IAAKF,EAAUA,GAAU,EAAKH,EAAIE,GAAG,CAChE,CAEA,GAAIF,EAAIE,GAAG,IAAM,EAAM,MAAM,IAAI,MAAM,iCAAiC,EACxE,MAAMI,EAAON,EAAIE,GAAG,EACpB,IAAIK,EAAIP,EAAI,SAASE,EAAGA,EAAII,CAAI,EAGhC,GAFAJ,GAAKI,EAEDN,EAAIE,GAAG,IAAM,EAAM,MAAM,IAAI,MAAM,iCAAiC,EACxE,MAAMM,EAAOR,EAAIE,GAAG,EACpB,IAAIO,EAAIT,EAAI,SAASE,EAAGA,EAAIM,CAAI,EAGhC,KAAOD,EAAE,OAASN,EAAS,GAAKM,EAAE,CAAC,IAAM,GAAMA,EAAIA,EAAE,SAAS,CAAC,EAC/D,KAAOE,EAAE,OAASR,EAAS,GAAKQ,EAAE,CAAC,IAAM,GAAMA,EAAIA,EAAE,SAAS,CAAC,EAE/D,MAAMC,EAAO,OAAO,OAAO,CAAC,OAAO,MAAMT,EAAS,EAAIM,EAAE,OAAQ,CAAC,EAAGA,CAAC,CAAC,EAChEI,EAAO,OAAO,OAAO,CAAC,OAAO,MAAMV,EAAS,EAAIQ,EAAE,OAAQ,CAAC,EAAGA,CAAC,CAAC,EACtE,OAAO,OAAO,OAAO,CAACC,EAAMC,CAAI,CAAC,CACrC,CAEA,SAASC,EAAUC,EAAsB,CACrC,MAAMC,EAAOD,EAAK,OAAS,EAC3B,IAAI,EAAIA,EAAK,SAAS,EAAGC,CAAI,EACzBL,EAAII,EAAK,SAASC,CAAI,EAG1B,KAAO,EAAE,OAAS,GAAK,EAAE,CAAC,IAAM,IAAS,EAAE,CAAC,EAAI,OAAU,GAAG,EAAI,EAAE,SAAS,CAAC,EAC7E,KAAOL,EAAE,OAAS,GAAKA,EAAE,CAAC,IAAM,IAASA,EAAE,CAAC,EAAI,OAAU,GAAGA,EAAIA,EAAE,SAAS,CAAC,EAGzE,EAAE,CAAC,EAAI,QAAU,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAI,CAAC,EAAG,CAAC,CAAC,GACvDA,EAAE,CAAC,EAAI,QAAU,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAI,CAAC,EAAGA,CAAC,CAAC,GAE3D,MAAMM,EAAQ,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,EAAM,EAAE,MAAM,CAAC,EAAG,CAAC,CAAC,EACxDC,EAAQ,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,EAAMP,EAAE,MAAM,CAAC,EAAGA,CAAC,CAAC,EAExDN,EAASY,EAAM,OAASC,EAAM,OAEpC,IAAIC,EACJ,GAAId,EAAS,IACTc,EAAW,OAAO,KAAK,CAACd,CAAM,CAAC,MAC5B,CACH,MAAMe,EAAgB,CAAA,EACtB,IAAId,EAAID,EACR,KAAOC,EAAI,GACPc,EAAI,QAAQd,EAAI,GAAI,EACpBA,IAAM,EAEVa,EAAW,OAAO,KAAK,CAAC,IAAOC,EAAI,OAAQ,GAAGA,CAAG,CAAC,CACtD,CAEA,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,EAAI,CAAC,EAAGD,EAAUF,EAAOC,CAAK,CAAC,CACtE,CAEA,SAASG,EAAWrB,EAAsB,CACtC,OAAOA,IAAQ,SAAWA,IAAQ,SAAWA,IAAQ,SAAWA,IAAQ,QAC5E,CAIO,MAAMsB,EAAqB,CAE9B,MAAO,CACH,KAAM,CAACC,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IAAsB,CAC9D,MAAMC,EAAWF,aAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAC7E,OAAO5B,EAAkBgC,EAAUD,CAAS,CAChD,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IAAsB,CAC9D,MAAMC,EAAWF,aAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAC7E,OAAO5B,EAAkBgC,EAAUD,CAAS,CAChD,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBC,EAAAA,WAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAChE,OAAQ,CAACA,EAAkBC,EAAiBE,IAAsB,CAC9D,MAAMC,EAAWF,aAAW,SAAUD,CAAM,EAAE,OAAOD,CAAI,EAAE,OAAO,WAAW,EAC7E,OAAO5B,EAAkBgC,EAAUD,CAAS,CAChD,CAAA,EAIJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,YAAY,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EACjF,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAIJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,OAAQ,CACJ,KAAM,CAACH,EAAkBC,IACrBI,EAAAA,WAAW,QAAQ,EAAE,OAAOL,CAAI,EAAE,MAAM,KAAKC,CAAM,EAAE,SAAS,WAAW,EAC7E,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,QAAQ,EACvB,OAAON,CAAI,EACX,IAAA,EACA,OAAOC,EAAQ,OAAO,KAAKE,EAAW,WAAW,CAAC,CAC3D,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,aAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK,CAEF,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,CACf,EACA,SAAS,WAAW,EAC7B,OAAQ,CAACP,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO,CAEJ,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,EACb,OAAO,KAAKJ,EAAW,WAAW,CAAC,CAC9C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,aAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK,CAEF,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,CACf,EACA,SAAS,WAAW,EAC7B,OAAQ,CAACP,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO,CAEJ,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,EACb,OAAO,KAAKJ,EAAW,WAAW,CAAC,CAC9C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBI,aAAW,YAAY,EAClB,OAAOL,CAAI,EACX,IAAA,EACA,KAAK,CAEF,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,CACf,EACA,SAAS,WAAW,EAC7B,OAAQ,CAACP,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOG,EAAAA,aAAa,YAAY,EAC3B,OAAON,CAAI,EACX,IAAA,EACA,OAAO,CAEJ,IAAKC,EACL,QAASM,EAAO,UAAU,sBAC1B,WAAY,EAAA,EACb,OAAO,KAAKJ,EAAW,WAAW,CAAC,CAC9C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,EAEJ,MAAO,CACH,KAAM,CAACH,EAAkBC,IACrBO,EAAAA,KAAW,KAAM,OAAOR,GAAS,SAAW,OAAO,KAAKA,EAAM,MAAM,EAAIA,EAAMC,CAAM,EAC/E,SAAS,WAAW,EAC7B,OAAQ,CAACD,EAAkBC,EAAiBE,IAAsB,CAC9D,GAAI,CACA,OAAOM,EAAAA,OACH,KACA,OAAOT,GAAS,SAAW,OAAO,KAAKA,EAAM,MAAM,EAAIA,EACvDC,EACA,OAAO,KAAKE,EAAW,WAAW,CAAA,CAE1C,MAAQ,CACJ,MAAO,EACX,CACJ,CAAA,CAER,EAIaO,EAAsB,OAAO,KAAKX,CAAkB,EAO1D,SAASY,EAAoBC,EAAoC,CACpE,GAAIA,EAAI,OAAS,SAAU,MAAO,QAClC,GAAIA,EAAI,OAAS,UAAW,MAAM,IAAI,MAAM,yDAAyD,EAErG,MAAMC,EAAcD,EAAI,kBAClBE,EAAUF,EAAI,qBAEpB,OAAQC,EAAA,CACJ,IAAK,MACD,MAAO,QACX,IAAK,UAAW,CACZ,MAAME,EAAOD,GAAS,eAAiB,SACvC,OAAQC,EAAA,CACJ,IAAK,SACD,MAAO,QACX,IAAK,SACD,MAAO,QACX,IAAK,SACD,MAAO,QACX,QACI,MAAM,IAAI,MAAM,uCAAuCA,CAAI,EAAE,CAAA,CAEzE,CACA,IAAK,KAAM,CACP,MAAMC,EAAQF,GAAS,WACvB,OAAQE,EAAA,CACJ,IAAK,QACL,IAAK,aACD,MAAO,QACX,IAAK,QACL,IAAK,YACD,MAAO,QACX,IAAK,QACL,IAAK,YACD,MAAO,QACX,IAAK,YACD,MAAO,SACX,QACI,MAAM,IAAI,MAAM,yBAAyBA,CAAK,EAAE,CAAA,CAE5D,CACA,IAAK,UACD,MAAO,QACX,QACI,MAAM,IAAI,MAAM,oCAAoCH,CAAW,EAAE,CAAA,CAE7E,CAMA,SAASI,EAAYL,EAAyB,CAE1C,GAAI,OAAOA,GAAQ,UAAY,SAAUA,EAAK,OAAOA,EAGrD,GAAI,CACA,OAAOM,EAAAA,iBAAiBN,CAAG,CAC/B,MAAQ,CAEJ,MAAMO,EACF,OAAOP,GAAQ,SACT,OAAO,KAAKA,EAAK,MAAM,EACvB,OAAO,SAASA,CAAG,EACfA,GACC,IAAM,CACL,MAAM,IAAI,MAAM,sBAAsB,CAC1C,GAAA,EAEZ,OAAOQ,EAAAA,gBAAgBD,CAAM,CACjC,CACJ,CAMO,MAAME,EAAUC,GAAuB,CAC1C,MAAMC,EAAQD,EAAM,MAAM,GAAG,EAC7B,GAAIC,EAAM,SAAW,EACjB,MAAM,IAAI,MAAM,4DAA4D,EAGhF,KAAM,CAACC,EAAYC,EAAatB,CAAS,EAAIoB,EAE7C,GAAI,CAACC,GAAc,CAACC,GAAe,CAACtB,EAChC,MAAM,IAAI,MAAM,kCAAkC,EAGtD,GAAI,CACA,MAAMuB,EAAS,KAAK,MAAMxD,EAAU,OAAOsD,CAAU,CAAC,EAChDG,EAAU,KAAK,MAAMzD,EAAU,OAAOuD,CAAW,CAAC,EACxD,MAAO,CAAC,OAAAC,EAAQ,QAAAC,EAAS,UAAAxB,CAAA,CAC7B,OAASyB,EAAK,CACV,MAAM,IAAI,MAAM,6CAA8CA,EAAc,OAAO,GAAG,CAC1F,CACJ,EAQaC,EAAO,CAChBF,EACA1B,EACA6B,EAQI,CAAA,IACK,CACT,MAAMlB,EAAMK,EAAYhB,CAAM,EACxBxB,EAAMqD,EAAQ,KAAOnB,EAAoBC,CAAG,EAC5CmB,EAAkBD,EAAQ,iBAAmB,MAC7CE,EAAMF,EAAQ,KAAO,MAE3B,GAAI,EAAErD,KAAOsB,GAAqB,MAAM,IAAI,MAAM,0BAA0BtB,CAAG,EAAE,EAEjF,MAAMiD,EAAoB,CAAC,IAAAjD,EAAK,IAAAuD,CAAA,EAC5BF,EAAQ,MAAKJ,EAAO,IAAMI,EAAQ,KAEtC,MAAMG,EAAgB/D,EAAU,OAAO,KAAK,UAAUwD,CAAM,CAAC,EACvDQ,EAAiBhE,EAAU,OAAO,KAAK,UAAUyD,CAAO,CAAC,EAEzDQ,EAAe,GAAGF,CAAa,IAAIC,CAAc,GAGvD,IAAI/B,EAAYJ,EAAmBtB,CAAG,EAAE,KAAK0D,EAAclC,CAAM,EAGjE,GAAI8B,IAAoB,QAAUjC,EAAWrB,CAAG,EAAG,CAC/C,MAAME,EAAM,OAAO,KAAKwB,EAAW,WAAW,EAE9CA,EADazB,EAAUC,EAAKH,EAAcC,CAAG,CAAC,EAC7B,SAAS,WAAW,CACzC,CAEA,MAAO,GAAGwD,CAAa,IAAIC,CAAc,IAAI/B,CAAS,EAE1D,EAQaiC,EAAS,CAClBd,EACArB,EACA6B,EAUI,CAAA,IAG2D,CAC/D,IAAIO,EACJ,GAAI,CACAA,EAAUhB,EAAOC,CAAK,CAC1B,OAASM,EAAK,CACV,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAASA,EAAc,QACvB,KAAM,eAAA,CACV,CAER,CAEA,KAAM,CAAC,OAAAF,EAAQ,QAAAC,EAAS,UAAAxB,CAAA,EAAakC,EAG/B5D,EAAMiD,EAAO,IACnB,GAAI,EAAEjD,KAAOsB,GACT,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,qCAAqC2B,EAAO,GAAG,GACvD,KAAM,mBAAA,CACV,EAKR,GAAII,EAAQ,YAAcA,EAAQ,WAAW,OAAS,GAC9C,CAACA,EAAQ,WAAW,SAASrD,CAAG,EAChC,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,cAAcA,CAAG,0CACzB,KAAM,uBAAA,CACV,EAMZ,GAAIiD,EAAO,MAAQ,QAAaA,EAAO,MAAQ,MAC3C,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,4CAA4CA,EAAO,GAAG,IAC9D,KAAM,cAAA,CACV,EAKR,MAAMS,EAAe,GAAGjE,EAAU,OAAO,KAAK,UAAUwD,CAAM,CAAC,CAAC,IAAIxD,EAAU,OAAO,KAAK,UAAUyD,CAAO,CAAC,CAAC,GAE7G,GAAK7B,EAAWrB,CAAG,EAMZ,CAEH,MAAM6D,EAASR,EAAQ,gBAEvB,IAAIS,EAGJ,GAAID,IAAW,OACX,GAAI,CACA,MAAM9C,EAAO,OAAO,KAAKW,EAAW,WAAW,EACzCqC,EAAejD,EAAUC,CAAI,EAAE,SAAS,WAAW,EACzD+C,EAAKxC,EAAmBtB,CAAG,EAAE,OAAO0D,EAAclC,EAAQuC,CAAY,CAC1E,MAAQ,CACJD,EAAK,EACT,SAGKD,IAAW,MAChBC,EAAKxC,EAAmBtB,CAAG,EAAE,OAAO0D,EAAclC,EAAQE,CAAS,UAInEoC,EAAKxC,EAAmBtB,CAAG,EAAE,OAAO0D,EAAclC,EAAQE,CAAS,EAC/D,CAACoC,EACD,GAAI,CACA,MAAM/C,EAAO,OAAO,KAAKW,EAAW,WAAW,EAE/C,GAAIX,EAAK,SAAWhB,EAAcC,CAAG,EAAG,CACpC,MAAM+D,EAAejD,EAAUC,CAAI,EAAE,SAAS,WAAW,EACzD+C,EAAKxC,EAAmBtB,CAAG,EAAE,OAAO0D,EAAclC,EAAQuC,CAAY,CAC1E,CACJ,MAAQ,CAER,CAIR,GAAI,CAACD,EACD,MAAO,CAAC,MAAO,GAAO,MAAO,CAAC,OAAQ,gCAAiC,KAAM,oBAAmB,CAExG,SA3CQ,CADqBxC,EAAmBtB,CAAG,EAAE,OAAO0D,EAAclC,EAAQE,CAAS,EAEnF,MAAO,CAAC,MAAO,GAAO,MAAO,CAAC,OAAQ,gCAAiC,KAAM,oBAAmB,EA6CxG,MAAMsC,EAAM,KAAK,MAAM,KAAK,IAAA,EAAQ,GAAI,EAClCC,EAAOZ,EAAQ,WAAa,EAElC,GAAI,CAACA,EAAQ,kBACLH,EAAQ,MAAQ,QAAac,EAAMd,EAAQ,IAAMe,EACjD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gBACR,KAAM,eAAA,CACV,EAKZ,GAAIf,EAAQ,MAAQ,QAAac,EAAMC,EAAOf,EAAQ,IAClD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,sBACR,KAAM,kBAAA,CACV,EAIR,GAAIA,EAAQ,MAAQ,QAAac,EAAMC,EAAOf,EAAQ,IAClD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,6BACR,KAAM,qBAAA,CACV,EAKR,GAAIG,EAAQ,cAAgB,QAAaH,EAAQ,MAAQ,OAAW,CAChE,MAAMgB,EAAWF,EAAMd,EAAQ,IAC/B,GAAIgB,EAAWb,EAAQ,YACnB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,cAAca,CAAQ,mCAAmCb,EAAQ,WAAW,KACpF,KAAM,eAAA,CACV,CAGZ,CAKA,GAAIA,EAAQ,SAAW,OAAW,CAC9B,GAAIH,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,8CACR,KAAM,gBAAA,CACV,EAGR,GAAIG,EAAQ,SAAWH,EAAQ,IAC3B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,mCAAmCG,EAAQ,MAAM,WAAWH,EAAQ,GAAG,IAC/E,KAAM,gBAAA,CACV,CAGZ,CAGA,GAAIG,EAAQ,UAAY,OAAW,CAC/B,GAAIH,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,+CACR,KAAM,iBAAA,CACV,EAGR,GAAIG,EAAQ,UAAYH,EAAQ,IAC5B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,oCAAoCG,EAAQ,OAAO,WAAWH,EAAQ,GAAG,IACjF,KAAM,iBAAA,CACV,CAGZ,CAGA,GAAIG,EAAQ,WAAa,OAAW,CAChC,MAAMc,EAAMjB,EAAQ,IACpB,GAAIiB,IAAQ,OACR,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,gDACR,KAAM,kBAAA,CACV,EAIR,MAAMC,EAAc,MAAM,QAAQf,EAAQ,QAAQ,EAAIA,EAAQ,SAAW,CAACA,EAAQ,QAAQ,EACpFgB,EAAW,MAAM,QAAQF,CAAG,EAAIA,EAAM,CAACA,CAAG,EAGhD,GAAI,CADaC,EAAY,QAAUC,EAAS,SAASzE,CAAC,CAAC,EAEvD,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,0BACR,KAAM,kBAAA,CACV,CAGZ,CAGA,GAAIyD,EAAQ,QAAU,OAAW,CAC7B,GAAIH,EAAQ,MAAQ,OAChB,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,8CACR,KAAM,aAAA,CACV,EAGR,GAAIG,EAAQ,QAAUH,EAAQ,IAC1B,MAAO,CACH,MAAO,GACP,MAAO,CACH,OAAQ,6BAA6BG,EAAQ,KAAK,WAAWH,EAAQ,GAAG,IACxE,KAAM,aAAA,CACV,CAGZ,CAEA,MAAO,CAAC,MAAO,GAAM,OAAAD,EAAQ,QAAAC,EAAS,UAAAxB,CAAA,CAC1C,EAGa4C,EAAM,CACf,KAAAlB,EACA,OAAAO,EACA,OAAAf,EACA,WAAYtB,CAChB,ECzwBO,SAASiD,EAAUpC,EAAqB,CAC3C,GAAI,CAACA,GAAO,OAAOA,GAAQ,SAAU,MAAM,IAAI,MAAM,mBAAmB,EACxE,OAAOA,EAAI,OAAO,CAAC,OAAQ,MAAM,CACrC,CAMO,SAASqC,EAAUC,EAAqB,CAC3C,GAAI,CAACA,GAAO,OAAOA,GAAQ,SAAU,MAAM,IAAI,MAAM,aAAa,EAElE,OAAQA,EAAI,IAAA,CACR,IAAK,MAAO,CACR,GAAI,EAAE,MAAOA,IAAQ,OAAOA,EAAI,GAAM,SAClC,MAAM,IAAI,MAAM,8BAA8B,EAGlD,OAAO9B,EAAAA,gBAAgB,OAAO,KAAK8B,EAAI,EAAG,WAAW,CAAC,CAC1D,CAEA,IAAK,MACL,IAAK,KACL,IAAK,MAED,MAAI,MAAOA,GAAO,OAAQA,EAAY,GAAM,SAEjChC,EAAAA,iBAAiB,CAAC,OAAQ,MAAO,IAAKgC,EAAI,EAK9CC,EAAAA,gBAAgB,CAAC,OAAQ,MAAO,IAAKD,EAAI,EAGpD,QACI,MAAM,IAAI,MAAM,6BAA8BA,EAAY,GAAG,EAAE,CAAA,CAE3E,CAMO,SAASE,EAAYxC,EAAqB,CAC7C,GAAI,CAACA,GAAO,OAAOA,GAAQ,SACvB,MAAM,IAAI,MAAM,mBAAmB,EAQvC,MAAMsC,GAJFtC,EAAI,OAAS,UACPuC,EAAAA,gBAAgBvC,CAAG,EACnBA,GAEY,OAAO,CAAC,OAAQ,MAAM,EAG5C,cAAQsC,EAAY,EACpB,OAAQA,EAAY,EACpB,OAAQA,EAAY,EACpB,OAAQA,EAAY,GACpB,OAAQA,EAAY,GACpB,OAAQA,EAAY,GACbA,CACX,CAOO,SAASG,EAAiBH,EAAUI,EAAoB,SAAkB,CAC7E,GAAI,CAACJ,GAAO,OAAOA,GAAQ,SACvB,MAAM,IAAI,MAAM,aAAa,EAGjC,IAAIK,EAEJ,OAAQL,EAAI,IAAA,CACR,IAAK,MACDK,EAAS,CAAC,EAAGL,EAAI,EAAG,IAAKA,EAAI,IAAK,EAAGA,EAAI,CAAA,EACzC,MAEJ,IAAK,KACDK,EAAS,CAAC,IAAKL,EAAI,IAAK,IAAKA,EAAI,IAAK,EAAGA,EAAI,EAAG,EAAGA,EAAI,CAAA,EACvD,MAEJ,IAAK,MACDK,EAAS,CAAC,IAAKL,EAAI,IAAK,IAAKA,EAAI,IAAK,EAAGA,EAAI,CAAA,EAC7C,MAEJ,IAAK,MACDK,EAAS,CAAC,EAAGL,EAAI,EAAG,IAAKA,EAAI,GAAA,EAC7B,MAEJ,QACI,MAAM,IAAI,MAAM,6BAA8BA,EAAY,GAAG,EAAE,CAAA,CAIvE,MAAMM,EAAO,KAAK,UACd,OAAO,KAAKD,CAAM,EACb,OACA,OAAO,CAACE,EAAKzE,KACVyE,EAAIzE,CAAC,EAAIuE,EAAOvE,CAAC,EACVyE,GACR,CAAA,CAA4B,CAAA,EAGvC,OAAOC,EAAAA,WAAWJ,CAAO,EACpB,OAAOE,CAAI,EACX,OAAO,WAAW,CAC3B,CAOO,SAASG,EAAWT,EAA8B,CACrD,GAAKA,EAAI,KAAK,OACd,OAAOQ,EAAAA,WAAW,MAAM,EAAE,OAAO,OAAO,KAAKR,EAAI,IAAI,CAAC,EAAG,QAAQ,CAAC,EAAE,OAAO,WAAW,CAC1F,CAEO,MAAMU,EAAM,CACf,OAAQZ,EACR,OAAQC,EACR,SAAUG,EACV,WAAYC,CAChB,EAYO,SAASQ,EACZC,EACAC,EACS,CACT,GAAI,CAACD,GAAQ,CAAC,MAAM,QAAQA,EAAK,IAAI,EAAG,MAAM,IAAI,MAAM,cAAc,EAEtE,IAAIZ,EAOJ,GALIa,MAAWD,EAAK,KAAK,KAAK9E,GAAKA,EAAE,MAAQ+E,CAAG,GAG5C,CAACb,GAAOY,EAAK,KAAK,SAAW,IAAGZ,EAAMY,EAAK,KAAK,CAAC,GAEjD,CAACZ,EAAK,MAAM,IAAI,MAAM,uBAAuB,EACjD,OAAOD,EAAUC,CAAG,CACxB,CAMO,SAASc,EAAcF,EAAkB,CAC5C,MAAO,CACH,KAAMA,EAAK,KAAK,IAAIZ,IAAQ,CACxB,GAAGA,EACH,IAAKA,EAAI,KAAOG,EAAiBH,CAAG,EACpC,IAAKA,EAAI,KAAOS,EAAWT,CAAG,CAAA,EAChC,CAAA,CAEV,CAEO,MAAMe,EAAU,MACnBC,EACApC,EAUK,KACJ,CACD,MAAMqC,EAAU,OAAOD,GAAQ,SAAWA,EAAMA,EAAI,SAAA,EAC9CE,EAAUtC,EAAQ,OAAS,WAAW,MACtCuC,EAAM,KAAK,IAAI,EAAGvC,EAAQ,KAAO,EAAI,GAAM,EAC3CwC,EAAY,KAAK,IAAI,EAAGxC,EAAQ,WAAa,GAAK,EAClDyC,EAAgB,yBAEtB,GAAI,CAACH,EACD,MAAM,IAAI,MAAM,mCAAmC,EAGvD,MAAMI,GAAY,IAAM,CACpB,GAAI1C,EAAQ,iBAAkB,CAC1B,MAAM2C,EAAW3C,EAAQ,iBACzB,GAAI,CACA,OAAO,IAAI,IAAI2C,EAAUN,CAAO,EAAE,SAAA,CACtC,MAAQ,CACJ,OAAOM,CACX,CACJ,CAMA,OAJI3C,EAAQ,uBAIRqC,EAAQ,SAASI,CAAa,EACvBJ,EAGJ,GAAGA,EAAQ,QAAQ,OAAQ,EAAE,CAAC,GAAGI,CAAa,EACzD,GAAA,EAEMG,GAAS,IAAM,CACjB,GAAI5C,EAAQ,MAAO,OAAOA,EAAQ,MAClC,IAAI6C,EACJ,MAAO,CACH,IAAK,IAAMA,EACX,IAAK,CAACC,EAAcC,IAAgB,CAChCF,EAAcE,CAClB,CAAA,CAER,GAAA,EAEA,IAAIC,EACAC,EAAgB,EAChBC,EACAC,EAAsB,EAE1B,MAAMC,EAAY,MAAOC,GAAgD,CACrE,GAAIH,EAAiB,OAAOA,EAE5BA,GAAmB,SAAY,CAC3B,MAAMI,EAAa,IAAI,gBACvB,IAAIC,EAEAf,EAAY,IACZe,EAAgB,WAAW,IAAMD,EAAW,MAAA,EAASd,CAAS,GAGlE,IAAIgB,EACJ,GAAI,CACAA,EAAW,MAAMlB,EAAQI,EAAU,CAAC,OAAQY,EAAW,OAAO,CAClE,OAASG,EAAO,CACZ,MAAIH,EAAW,OAAO,QACZ,IAAI,MAAM,8BAA8Bd,CAAS,IAAI,EAEzDiB,CACV,QAAA,CACQF,gBAA4BA,CAAa,CACjD,CAEA,GAAI,CAACC,EAAS,GACV,MAAM,IAAI,MAAM,yBAAyBA,EAAS,MAAM,IAAIA,EAAS,UAAU,EAAE,EAGrF,MAAME,EAAO,MAAMF,EAAS,KAAA,EAC5B,GAAI,CAACE,GAAQ,OAAOA,GAAS,UAAY,CAAC,MAAM,QAASA,EAAa,IAAI,EACtE,MAAM,IAAI,MAAM,cAAc,EAGlC,OAAOxB,EAAcwB,CAAY,CACrC,GAAA,EAEA,GAAI,CACA,MAAMC,EAAQ,MAAMT,EACpB,OAAAF,EAAaW,EACb,MAAMf,EAAM,IAAIF,EAAUiB,CAAK,EAC/BR,EAAsB,EAClBZ,EAAM,IAAGU,EAAgB,KAAK,MAAQV,GACnCoB,CACX,OAASF,EAAO,CACZ,GAAI,CAACJ,GAAuB,CAACL,EACzB,MAAMS,EAIV,GADAN,GAAuB,EACnBZ,EAAM,EAAG,CACT,MAAMqB,EAAU,KAAK,IACjB,KAAK,IAAIrB,EAAK,GAAM,EAAI,KAAK,IAAI,EAAGY,EAAsB,CAAC,EAC3D,GAAK,EAETF,EAAgB,KAAK,MAAQW,CACjC,CACA,eAAQ,KAAK,4BAA4BlB,CAAQ,wBAAyBe,CAAK,EACxET,CACX,QAAA,CACIE,EAAkB,MACtB,CACJ,EAEA,OAAAF,EAAa,MAAMJ,EAAM,IAAIF,CAAQ,EAChCM,GAGDA,EAAad,EAAcc,CAAU,EACjCT,EAAM,IAAGU,EAAgB,KAAK,MAAQV,IAH1CS,EAAa,MAAMI,EAAU,EAAK,EAO9B,CACJ,MAAM,MAAuB,CACzB,OAAIb,EAAM,GAAK,KAAK,IAAA,GAASU,GACzB,MAAMG,EAAU,EAAI,EAEjB,QAAQ,QAASJ,EAAoB,IAAI,CACpD,EACA,MAAM,SAA0B,CAC5B,aAAMI,EAAU,EAAK,EACbJ,EAAoB,IAChC,EACA,MAAM,IAAIf,EAAa,CAEnB,OADa,MAAM,KAAK,KAAA,GACZ,KAAM4B,GAAMA,EAAE,MAAQ5B,CAAG,CACzC,EACA,MAAM,KAAK5F,EAAyC,CAChD,MAAMyH,EAAO,MAAM,KAAK,KAAA,EAClBC,EAAU,OAAO,QAAQ1H,CAAK,EAEpC,OAAI0H,EAAQ,SAAW,EAAUD,EAE1BA,EAAK,OAAQhF,GAChBiF,EAAQ,MAAM,CAAC,CAACC,EAAO1F,CAAQ,IAAM,CACjC,MAAMyE,EAAQjE,EAAIkF,CAAK,EACvB,OAAI,MAAM,QAAQ1F,CAAQ,EACf,MAAM,QAAQyE,CAAK,GACnBA,EAAM,SAAWzE,EAAS,QAC1ByE,EAAM,MAAM,CAACkB,EAAMlH,IAAMkH,IAAS3F,EAASvB,CAAC,CAAC,EAEjDgG,IAAUzE,CACrB,CAAC,CAAA,CAET,EACA,MAAM,UAAUjC,EAAuC,CACnD,OAAO,KAAK,KAAKA,CAAK,EAAE,KAAK,CAAC,CAACyC,CAAG,IAAMA,CAAG,CAC/C,EACA,QAA2B,CACvB,OAAOkE,CACX,CAAA,CAER,EAEakB,EAAO,CAChB,YAAanC,EACb,UAAWG,EACX,QAAAC,CACJ"}