@sourceregistry/node-jwt 1.5.10 → 1.6.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/jwt/index.ts","../src/jwks/index.ts"],"sourcesContent":["import crypto, {\n    createHmac,\n    createSign,\n    createVerify,\n    createPrivateKey,\n    createPublicKey,\n    createSecretKey,\n    sign as cryptoSign,\n    verify as cryptoVerify,\n    timingSafeEqual,\n    type KeyLike,\n    type KeyObject\n} from 'crypto';\n\n// Base64URL helpers (padding-safe)\nexport const base64Url = {\n    encode: (input: string | Buffer): string => Buffer.from(input).toString('base64url'),\n    decode: (input: string): string => Buffer.from(input, 'base64url').toString()\n};\n\n/**\n * Timing-safe string comparison to prevent timing attacks\n * @param a\n * @param b\n */\nconst timingSafeCompare = (a: string, b: string): boolean => {\n    if (a.length !== b.length) {\n        return false;\n    }\n    return timingSafeEqual(Buffer.from(a), Buffer.from(b));\n};\n\n// Standard JWT payload claims\nexport interface JWTPayload {\n    /**\n     * Issuer\n     */\n    iss?: string;\n    /**\n     * Subject\n     */\n    sub?: string;\n    /**\n     * Audience\n     */\n    aud?: string | string[];\n    /**\n     * Expiration Time (as UNIX timestamp)\n     */\n    exp?: number;\n    /**\n     * Not Before (as UNIX timestamp)\n     */\n    nbf?: number;\n    /**\n     * Issued At (as UNIX timestamp)\n     */\n    iat?: number;\n    /**\n     * JWT ID\n     */\n    jti?: string;\n    /**\n     * Session ID\n     */\n    sid?: string;\n\n    /**\n     * Custom claims\n     */\n    [key: string]: unknown;\n}\n\nexport interface JWTHeader {\n    alg: string; // Allow unknown algs during decode\n    typ?: string;\n    kid?: string;\n    crit?: string[];\n    [key: string]: unknown;\n}\n\nexport interface JWT {\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string;\n}\n\nconst BASE64URL_SEGMENT_REGEX = /^[A-Za-z0-9_-]+$/;\n\nfunction isPlainObject(input: unknown): input is Record<string, unknown> {\n    return typeof input === 'object' && input !== null && !Array.isArray(input);\n}\n\nfunction isFiniteNumber(input: unknown): input is number {\n    return typeof input === 'number' && Number.isFinite(input);\n}\n\nfunction isStringArray(input: unknown): input is string[] {\n    return Array.isArray(input) && input.every((value) => typeof value === 'string');\n}\n\nfunction validateRegisteredClaims(payload: JWTPayload): { reason: string; code: string } | null {\n    const claimValidators: Array<{ claim: keyof JWTPayload; valid: boolean; expected: string }> = [\n        {claim: 'iss', valid: payload.iss === undefined || typeof payload.iss === 'string', expected: 'string'},\n        {claim: 'sub', valid: payload.sub === undefined || typeof payload.sub === 'string', expected: 'string'},\n        {claim: 'jti', valid: payload.jti === undefined || typeof payload.jti === 'string', expected: 'string'},\n        {claim: 'sid', valid: payload.sid === undefined || typeof payload.sid === 'string', expected: 'string'},\n        {claim: 'iat', valid: payload.iat === undefined || isFiniteNumber(payload.iat), expected: 'number'},\n        {claim: 'exp', valid: payload.exp === undefined || isFiniteNumber(payload.exp), expected: 'number'},\n        {claim: 'nbf', valid: payload.nbf === undefined || isFiniteNumber(payload.nbf), expected: 'number'},\n    ];\n\n    for (const entry of claimValidators) {\n        if (!entry.valid) {\n            return {\n                reason: `Invalid \"${entry.claim}\" claim: expected ${entry.expected}`,\n                code: 'INVALID_CLAIM'\n            };\n        }\n    }\n\n    if (payload.aud !== undefined) {\n        const isValidAudience = typeof payload.aud === 'string' || isStringArray(payload.aud);\n        if (!isValidAudience) {\n            return {\n                reason: 'Invalid \"aud\" claim: expected string or string[]',\n                code: 'INVALID_CLAIM'\n            };\n        }\n    }\n\n    return null;\n}\n\nfunction validateVerifyOptions(options: VerifyOptions): { reason: string; code: string } | null {\n    if (options.signatureFormat !== undefined && options.signatureFormat !== 'der' && options.signatureFormat !== 'jose') {\n        return {\n            reason: 'Invalid signatureFormat option: expected \"der\" or \"jose\"',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.clockSkew !== undefined && (!isFiniteNumber(options.clockSkew) || options.clockSkew < 0)) {\n        return {\n            reason: 'Invalid clockSkew option: expected a non-negative finite number',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.maxTokenAge !== undefined && (!isFiniteNumber(options.maxTokenAge) || options.maxTokenAge < 0)) {\n        return {\n            reason: 'Invalid maxTokenAge option: expected a non-negative finite number',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.ignoreExpiration !== undefined && typeof options.ignoreExpiration !== 'boolean') {\n        return {\n            reason: 'Invalid ignoreExpiration option: expected boolean',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.issuer !== undefined && typeof options.issuer !== 'string') {\n        return {\n            reason: 'Invalid issuer option: expected string',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.subject !== undefined && typeof options.subject !== 'string') {\n        return {\n            reason: 'Invalid subject option: expected string',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.jwtId !== undefined && typeof options.jwtId !== 'string') {\n        return {\n            reason: 'Invalid jwtId option: expected string',\n            code: 'INVALID_OPTIONS'\n        };\n    }\n\n    if (options.audience !== undefined) {\n        const isValidAudience = typeof options.audience === 'string' || isStringArray(options.audience);\n        if (!isValidAudience) {\n            return {\n                reason: 'Invalid audience option: expected string or string[]',\n                code: 'INVALID_OPTIONS'\n            };\n        }\n    }\n\n    if (options.algorithms !== undefined) {\n        if (!Array.isArray(options.algorithms) || options.algorithms.length === 0) {\n            return {\n                reason: 'Invalid algorithms option: expected a non-empty array',\n                code: 'INVALID_OPTIONS'\n            };\n        }\n\n        const invalidAlgorithm = options.algorithms.find((alg) => !(alg in SignatureAlgorithm));\n        if (invalidAlgorithm) {\n            return {\n                reason: `Invalid algorithms option: unsupported algorithm \"${invalidAlgorithm}\"`,\n                code: 'INVALID_OPTIONS'\n            };\n        }\n    }\n\n    if (options.tokenTypes !== undefined) {\n        if (!Array.isArray(options.tokenTypes) || options.tokenTypes.length === 0 || !isStringArray(options.tokenTypes)) {\n            return {\n                reason: 'Invalid tokenTypes option: expected a non-empty string[]',\n                code: 'INVALID_OPTIONS'\n            };\n        }\n\n        if (options.tokenTypes.some((type) => type.length === 0)) {\n            return {\n                reason: 'Invalid tokenTypes option: token types must not be empty',\n                code: 'INVALID_OPTIONS'\n            };\n        }\n    }\n\n    return null;\n}\n\nfunction validateProtectedHeader(header: JWTHeader): { reason: string; code: string } | null {\n    if (header.crit !== undefined) {\n        if (!isStringArray(header.crit) || header.crit.length === 0) {\n            return {\n                reason: 'Invalid \"crit\" header: expected non-empty string[]',\n                code: 'INVALID_HEADER'\n            };\n        }\n\n        return {\n            reason: `Unsupported critical header parameters: ${header.crit.join(', ')}`,\n            code: 'UNSUPPORTED_CRITICAL_HEADER'\n        };\n    }\n\n    return null;\n}\n\n\n//JOSE-helpers\nfunction joseLenForAlg(alg: string): number {\n    switch (alg) {\n        case 'ES256':\n        case 'ES256K':\n            return 64;  // 32 + 32\n        case 'ES384':\n            return 96;  // 48 + 48\n        case 'ES512':\n            return 132; // 66 + 66 (P-521)\n        /* c8 ignore next 2 */\n        default:\n            throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${alg}`);\n    }\n}\n\nfunction derToJose(der: Buffer, outLen: number): Buffer {\n    let i = 0;\n    if (der[i++] !== 0x30) throw new Error('Invalid DER ECDSA signature');\n\n    // seq length (short/long form)\n    let seqLen = der[i++];\n    if (seqLen & 0x80) {\n        const n = seqLen & 0x7f;\n        seqLen = 0;\n        for (let k = 0; k < n; k++) seqLen = (seqLen << 8) | der[i++];\n    }\n\n    if (der[i++] !== 0x02) throw new Error('Invalid DER ECDSA signature (r)');\n    const rLen = der[i++];\n    let r = der.subarray(i, i + rLen);\n    i += rLen;\n\n    if (der[i++] !== 0x02) throw new Error('Invalid DER ECDSA signature (s)');\n    const sLen = der[i++];\n    let s = der.subarray(i, i + sLen);\n\n    // strip leading zeros\n    while (r.length > outLen / 2 && r[0] === 0x00) r = r.subarray(1);\n    while (s.length > outLen / 2 && s[0] === 0x00) s = s.subarray(1);\n\n    const rPad = Buffer.concat([Buffer.alloc(outLen / 2 - r.length, 0), r]);\n    const sPad = Buffer.concat([Buffer.alloc(outLen / 2 - s.length, 0), s]);\n    return Buffer.concat([rPad, sPad]);\n}\n\nfunction joseToDer(jose: Buffer): Buffer {\n    const half = jose.length / 2;\n    let r = jose.subarray(0, half);\n    let s = jose.subarray(half);\n\n    // trim leading zeros\n    while (r.length > 1 && r[0] === 0x00 && (r[1] & 0x80) === 0) r = r.subarray(1);\n    while (s.length > 1 && s[0] === 0x00 && (s[1] & 0x80) === 0) s = s.subarray(1);\n\n    // if high bit set, prepend 0x00\n    if (r[0] & 0x80) r = Buffer.concat([Buffer.from([0x00]), r]);\n    if (s[0] & 0x80) s = Buffer.concat([Buffer.from([0x00]), s]);\n\n    const rPart = Buffer.concat([Buffer.from([0x02, r.length]), r]);\n    const sPart = Buffer.concat([Buffer.from([0x02, s.length]), s]);\n\n    const seqLen = rPart.length + sPart.length;\n\n    let lenBytes: Buffer;\n    if (seqLen < 0x80) {\n        lenBytes = Buffer.from([seqLen]);\n    } else {\n        const tmp: number[] = [];\n        let n = seqLen;\n        while (n > 0) {\n            tmp.unshift(n & 0xff);\n            n >>= 8;\n        }\n        lenBytes = Buffer.from([0x80 | tmp.length, ...tmp]);\n    }\n\n    return Buffer.concat([Buffer.from([0x30]), lenBytes, rPart, sPart]);\n}\n\nfunction isEcdsaAlg(alg: string): boolean {\n    return alg === 'ES256' || alg === 'ES384' || alg === 'ES512' || alg === 'ES256K';\n}\n\ntype SignatureAlgorithmImplementation = {\n    sign: (data: string | NodeJS.ArrayBufferView, secret: KeyLike) => string;\n    verify: (data: string | NodeJS.ArrayBufferView, secret: KeyLike, signature: string) => boolean;\n};\n\ntype SignatureAlgorithmsMap = {\n    HS256: SignatureAlgorithmImplementation;\n    HS384: SignatureAlgorithmImplementation;\n    HS512: SignatureAlgorithmImplementation;\n    RS256: SignatureAlgorithmImplementation;\n    RS384: SignatureAlgorithmImplementation;\n    RS512: SignatureAlgorithmImplementation;\n    ES256: SignatureAlgorithmImplementation;\n    ES384: SignatureAlgorithmImplementation;\n    ES512: SignatureAlgorithmImplementation;\n    ES256K: SignatureAlgorithmImplementation;\n    PS256: SignatureAlgorithmImplementation;\n    PS384: SignatureAlgorithmImplementation;\n    PS512: SignatureAlgorithmImplementation;\n    EdDSA: SignatureAlgorithmImplementation;\n};\n\nconst createHmacAlgorithm = (algorithm: string): SignatureAlgorithmImplementation => ({\n    sign: (data: string | NodeJS.ArrayBufferView, secret: KeyLike): string =>\n        createHmac(algorithm, secret).update(data).digest('base64url'),\n    verify: (data: string | NodeJS.ArrayBufferView, secret: KeyLike, signature: string): boolean => {\n        const expected = createHmac(algorithm, secret).update(data).digest('base64url');\n        return timingSafeCompare(expected, signature);\n    }\n});\n\nconst createVerifyAlgorithm = (algorithm: string): SignatureAlgorithmImplementation => ({\n    sign: (data: string | NodeJS.ArrayBufferView, secret: KeyLike): string =>\n        createSign(algorithm).update(data).end().sign(secret).toString('base64url'),\n    verify: (data: string | NodeJS.ArrayBufferView, secret: KeyLike, signature: string): boolean => {\n        try {\n            return createVerify(algorithm)\n                .update(data)\n                .end()\n                .verify(secret, Buffer.from(signature, 'base64url'));\n        } catch {\n            return false;\n        }\n    }\n});\n\nconst createPssAlgorithm = (algorithm: string, saltLength: number): SignatureAlgorithmImplementation => ({\n    sign: (data: string | NodeJS.ArrayBufferView, secret: KeyLike): string =>\n        createSign(algorithm)\n            .update(data)\n            .end()\n            .sign({\n                //@ts-ignore\n                key: secret,\n                padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                saltLength\n            })\n            .toString('base64url'),\n    verify: (data: string | NodeJS.ArrayBufferView, secret: KeyLike, signature: string): boolean => {\n        try {\n            return createVerify(algorithm)\n                .update(data)\n                .end()\n                .verify({\n                    //@ts-ignore\n                    key: secret,\n                    padding: crypto.constants.RSA_PKCS1_PSS_PADDING,\n                    saltLength\n                }, Buffer.from(signature, 'base64url'));\n        } catch {\n            return false;\n        }\n    }\n});\n\nconst edDsaAlgorithm: SignatureAlgorithmImplementation = {\n    sign: (data: string | NodeJS.ArrayBufferView, secret: KeyLike): string =>\n        cryptoSign(null, typeof data === 'string' ? Buffer.from(data, 'utf8') : data, secret)\n            .toString('base64url'),\n    verify: (data: string | NodeJS.ArrayBufferView, secret: KeyLike, signature: string): boolean => {\n        try {\n            return cryptoVerify(\n                null,\n                typeof data === 'string' ? Buffer.from(data, 'utf8') : data,\n                secret,\n                Buffer.from(signature, 'base64url')\n            );\n        } catch {\n            return false;\n        }\n    }\n};\n\n\n// Signature algorithms\nexport const SignatureAlgorithm: SignatureAlgorithmsMap = {\n    // HMAC\n    HS256: createHmacAlgorithm('sha256'),\n    HS384: createHmacAlgorithm('sha384'),\n    HS512: createHmacAlgorithm('sha512'),\n\n    // RSA (DER-encoded signatures, base64url)\n    RS256: createVerifyAlgorithm('RSA-SHA256'),\n    RS384: createVerifyAlgorithm('RSA-SHA384'),\n    RS512: createVerifyAlgorithm('RSA-SHA512'),\n\n    // ECDSA (Node/OpenSSL emits DER; sign() converts to JOSE by default for JWTs)\n    ES256: createVerifyAlgorithm('SHA256'),\n    ES384: createVerifyAlgorithm('SHA384'),\n    ES512: createVerifyAlgorithm('SHA512'),\n    ES256K: createVerifyAlgorithm('SHA256'),\n    PS256: createPssAlgorithm('RSA-SHA256', 32),\n    PS384: createPssAlgorithm('RSA-SHA384', 48),\n    PS512: createPssAlgorithm('RSA-SHA512', 64),\n    EdDSA: edDsaAlgorithm\n} as const;\n\nexport type SupportedAlgorithm = keyof typeof SignatureAlgorithm;\n\nexport const SupportedAlgorithms = Object.keys(SignatureAlgorithm) as Array<SupportedAlgorithm>;\n\n/**\n * Autodetection of algorithm for KeyObjects\n * @param key\n * @constructor\n */\nexport function AutodetectAlgorithm(key: KeyObject): SupportedAlgorithm {\n    if (key.type === 'secret') return 'HS256';\n    if (key.type !== 'private') throw new Error('Only private or symmetric keys can be used to sign JWTs');\n\n    const asymKeyType = key.asymmetricKeyType;\n    const details = key.asymmetricKeyDetails;\n\n    switch (asymKeyType) {\n        case 'rsa':\n            return 'RS256';\n        case 'rsa-pss': {\n            const hash = details?.hashAlgorithm ?? 'sha256';\n            switch (hash) {\n                case 'sha256':\n                    return 'PS256';\n                case 'sha384':\n                    return 'PS384';\n                case 'sha512':\n                    return 'PS512';\n                default:\n                    throw new Error(`Unsupported RSA-PSS hash algorithm: ${hash}`);\n            }\n        }\n        case 'ec': {\n            const curve = details?.namedCurve;\n            switch (curve) {\n                case 'P-256':\n                case 'prime256v1':\n                    return 'ES256';\n                case 'P-384':\n                case 'secp384r1':\n                    return 'ES384';\n                case 'P-521':\n                case 'secp521r1':\n                    return 'ES512';\n                case 'secp256k1':\n                    return 'ES256K';\n                default:\n                    throw new Error(`Unsupported EC curve: ${curve}`);\n            }\n        }\n        case 'ed25519':\n            return 'EdDSA';\n        default:\n            throw new Error(`Unsupported asymmetric key type: ${asymKeyType}`);\n    }\n}\n\n/**\n * Normalize KeyLike input to a KeyObject\n * @param key\n */\nfunction toKeyObject(key: KeyLike, purpose: 'sign' | 'verify'): KeyObject {\n    // Already a KeyObject (private, public, or secret)\n    if (typeof key === 'object' && 'type' in key) return key as KeyObject;\n\n    // A private key can sign and its public component can verify.\n    try {\n        return purpose === 'sign' ? createPrivateKey(key) : createPublicKey(key);\n    } catch {\n        if (purpose === 'sign') {\n            // Do not silently reinterpret a PEM/DER public key as an HMAC secret.\n            try {\n                createPublicKey(key);\n            } catch {\n                // The input is not a public key; it may still be a symmetric secret.\n                if (typeof key === 'string') return createSecretKey(Buffer.from(key, 'utf8'));\n                if (Buffer.isBuffer(key)) return createSecretKey(key);\n                throw new Error('Unsupported key type');\n            }\n            throw new Error('A public key cannot be used to sign JWTs');\n        }\n\n        if (typeof key === 'string') return createSecretKey(Buffer.from(key, 'utf8'));\n        if (Buffer.isBuffer(key)) return createSecretKey(key);\n        throw new Error('Unsupported key type');\n    }\n}\n\nfunction assertKeySupportsAlgorithm(key: KeyObject, alg: SupportedAlgorithm, purpose: 'sign' | 'verify'): void {\n    if (alg.startsWith('HS')) {\n        if (key.type !== 'secret') throw new Error(`${alg} requires a symmetric secret key`);\n        return;\n    }\n\n    if (purpose === 'sign' && key.type !== 'private') {\n        throw new Error(`${alg} requires a private key for signing`);\n    }\n    if (purpose === 'verify' && key.type !== 'public' && key.type !== 'private') {\n        throw new Error(`${alg} requires a public or private key for verification`);\n    }\n\n    const keyType = key.asymmetricKeyType;\n    if (alg.startsWith('RS') && keyType !== 'rsa') {\n        throw new Error(`${alg} requires an RSA key`);\n    }\n    if (alg.startsWith('PS') && keyType !== 'rsa' && keyType !== 'rsa-pss') {\n        throw new Error(`${alg} requires an RSA or RSA-PSS key`);\n    }\n    if (alg === 'EdDSA' && keyType !== 'ed25519') {\n        throw new Error('EdDSA requires an Ed25519 key');\n    }\n    if (isEcdsaAlg(alg)) {\n        const curve = key.asymmetricKeyDetails?.namedCurve;\n        let expectedCurve: string[] = [];\n        switch (alg) {\n            case 'ES256':\n                expectedCurve = ['P-256', 'prime256v1'];\n                break;\n            case 'ES384':\n                expectedCurve = ['P-384', 'secp384r1'];\n                break;\n            case 'ES512':\n                expectedCurve = ['P-521', 'secp521r1'];\n                break;\n            case 'ES256K':\n                expectedCurve = ['secp256k1'];\n                break;\n        }\n        if (keyType !== 'ec' || !expectedCurve.includes(curve ?? '')) {\n            throw new Error(`${alg} requires its matching EC curve`);\n        }\n    }\n}\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): JWT => {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n        throw new Error('Invalid JWT: must contain exactly 3 parts separated by \".\"');\n    }\n\n    const [headerPart, payloadPart, signature] = parts;\n\n    if (!headerPart || !payloadPart || !signature) {\n        throw new Error('Invalid JWT: empty part detected');\n    }\n\n    if (!BASE64URL_SEGMENT_REGEX.test(headerPart) || !BASE64URL_SEGMENT_REGEX.test(payloadPart) || !BASE64URL_SEGMENT_REGEX.test(signature)) {\n        throw new Error('Invalid JWT: non-base64url characters detected');\n    }\n\n    try {\n        const decodedHeader = JSON.parse(base64Url.decode(headerPart));\n        const decodedPayload = JSON.parse(base64Url.decode(payloadPart));\n\n        if (!isPlainObject(decodedHeader) || !isPlainObject(decodedPayload)) {\n            throw new Error('header and payload must be JSON objects');\n        }\n\n        const header = decodedHeader as unknown as JWTHeader;\n        const payload = decodedPayload as JWTPayload;\n\n        if (typeof header.alg !== 'string' || header.alg.length === 0) {\n            throw new Error('header.alg must be a non-empty string');\n        }\n        if (header.typ !== undefined && typeof header.typ !== 'string') {\n            throw new Error('header.typ must be a string');\n        }\n        if (header.kid !== undefined && typeof header.kid !== 'string') {\n            throw new Error('header.kid must be a string');\n        }\n        if (header.crit !== undefined && (!isStringArray(header.crit) || header.crit.length === 0)) {\n            throw new Error('header.crit must be a non-empty string[]');\n        }\n\n        return {header, payload, signature};\n    } catch (err) {\n        throw new Error(`Invalid JWT: malformed header or payload (${(err as Error).message})`);\n    }\n}\n\nexport type SignOptions = {\n    alg?: SupportedAlgorithm;\n    kid?: string;\n    typ?: string;\n    /**\n     * default 'jose' for ECDSA JWTs, 'der' otherwise\n     */\n    signatureFormat?: 'der' | 'jose';\n}\n\n/**\n * Sign a JWT\n * @param payload\n * @param secret\n * @param options\n */\nexport const sign = (\n    payload: JWTPayload,\n    secret: KeyLike,\n    options: SignOptions = {}\n): string => {\n    const key = toKeyObject(secret, 'sign');\n    const alg = options.alg ?? AutodetectAlgorithm(key);\n    const signatureFormat = options.signatureFormat ?? (isEcdsaAlg(alg) ? 'jose' : 'der');\n    const typ = options.typ ?? 'JWT';\n\n    if (!(alg in SignatureAlgorithm)) throw new Error(`Unsupported algorithm: ${alg}`);\n    assertKeySupportsAlgorithm(key, alg, 'sign');\n\n    const header: JWTHeader = {alg, typ};\n    if (options.kid) header.kid = options.kid;\n\n    const headerEncoded = base64Url.encode(JSON.stringify(header));\n    const payloadEncoded = base64Url.encode(JSON.stringify(payload));\n\n    const signingInput = `${headerEncoded}.${payloadEncoded}`;\n\n    // Node/OpenSSL produces DER signatures for ECDSA; convert to JOSE for JWT output by default.\n    let signature = SignatureAlgorithm[alg].sign(signingInput, key);\n\n    // If ES* and caller requested JOSE, convert the DER signature bytes to JOSE bytes\n    if (signatureFormat === 'jose' && isEcdsaAlg(alg)) {\n        const der = Buffer.from(signature, 'base64url');\n        const jose = derToJose(der, joseLenForAlg(alg));\n        signature = jose.toString('base64url');\n    }\n\n    return `${headerEncoded}.${payloadEncoded}.${signature}`;\n\n};\n\nexport type VerifyOptions = {\n    algorithms?: SupportedAlgorithm[]; // Whitelist of allowed algorithms\n    /** Allowed protected-header `typ` values. Defaults to `['JWT']`. A missing `typ` remains valid. */\n    tokenTypes?: string[];\n    issuer?: string;\n    subject?: string;\n    audience?: string | string[];\n    jwtId?: string;\n    ignoreExpiration?: boolean;\n    clockSkew?: number; // in seconds, default 0\n    maxTokenAge?: number; // Maximum age in seconds; requires an iat claim\n    signatureFormat?: 'der' | 'jose';\n};\n\n/**\n * Verify and validate a JWT\n * @param token\n * @param secret\n * @param options\n */\nexport const verify = (\n    token: string,\n    secret: KeyLike,\n    options: VerifyOptions  = {}\n):\n    | { valid: true; header: JWTHeader; payload: JWTPayload; signature: string }\n    | { valid: false; error: { reason: string; code: string } } => {\n    const invalidOptions = validateVerifyOptions(options);\n    if (invalidOptions) {\n        return {\n            valid: false,\n            error: invalidOptions\n        };\n    }\n\n    let decoded: JWT;\n    try {\n        decoded = decode(token);\n    } catch (err) {\n        return {\n            valid: false,\n            error: {\n                reason: (err as Error).message,\n                code: 'INVALID_TOKEN'\n            }\n        };\n    }\n\n    const {header, payload, signature} = decoded;\n    const invalidHeader = validateProtectedHeader(header);\n    if (invalidHeader) {\n        return {\n            valid: false,\n            error: invalidHeader\n        };\n    }\n\n    const invalidClaims = validateRegisteredClaims(payload);\n    if (invalidClaims) {\n        return {\n            valid: false,\n            error: invalidClaims\n        };\n    }\n\n    // Validate algorithm\n    const alg = header.alg as SupportedAlgorithm;\n    if (!(alg in SignatureAlgorithm)) {\n        return {\n            valid: false,\n            error: {\n                reason: `Unsupported or unknown algorithm: ${header.alg}`,\n                code: 'INVALID_ALGORITHM'\n            }\n        };\n    }\n\n    // Algorithm whitelist validation (prevents algorithm confusion attacks)\n    if (options.algorithms && options.algorithms.length > 0) {\n        if (!options.algorithms.includes(alg)) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Algorithm \"${alg}\" is not in the allowed algorithms list`,\n                    code: 'ALGORITHM_NOT_ALLOWED'\n                }\n            };\n        }\n    }\n\n    // JWT permits omitting `typ`. When present, it must match the caller's\n    // explicit allowlist or the secure default of only `JWT`.\n    const tokenTypes = options.tokenTypes ?? ['JWT'];\n    if (header.typ !== undefined && !tokenTypes.includes(header.typ)) {\n        return {\n            valid: false,\n            error: {\n                reason: `Invalid token type: expected one of ${tokenTypes.map((type) => `'${type}'`).join(', ')}, got '${header.typ}'`,\n                code: 'INVALID_TYPE'\n            }\n        };\n    }\n\n    // Verify signature against the exact original JWT signing input.\n    const [headerPart, payloadPart] = token.split('.');\n    const signingInput = `${headerPart}.${payloadPart}`;\n\n    let key: KeyObject;\n    try {\n        key = toKeyObject(secret, 'verify');\n        assertKeySupportsAlgorithm(key, alg, 'verify');\n    } catch (error) {\n        return {\n            valid: false,\n            error: {\n                reason: (error as Error).message,\n                code: 'KEY_ALGORITHM_MISMATCH'\n            }\n        };\n    }\n\n    if (!isEcdsaAlg(alg)) {\n        // non-ES* algorithms unchanged\n        let isValidSignature = false;\n        try {\n            isValidSignature = SignatureAlgorithm[alg].verify(signingInput, key, signature);\n        } catch {\n            isValidSignature = false;\n        }\n        if (!isValidSignature) {\n            return {valid: false, error: {reason: \"Signature verification failed\", code: 'INVALID_SIGNATURE'}};\n        }\n    } else {\n        // ES* algorithms accept strict DER/JOSE modes or auto-detect for interoperability.\n        const format = options.signatureFormat; // undefined means \"auto\"\n\n        let ok: boolean;\n\n        // 1) If explicitly JOSE -> convert to DER for verification\n        if (format === 'jose') {\n            try {\n                const jose = Buffer.from(signature, 'base64url');\n                const derSigB64Url = joseToDer(jose).toString('base64url');\n                ok = SignatureAlgorithm[alg].verify(signingInput, key, derSigB64Url);\n            } catch {\n                ok = false;\n            }\n        }\n        // 2) If explicitly DER -> verify as-is\n        else if (format === 'der') {\n            ok = SignatureAlgorithm[alg].verify(signingInput, key, signature);\n        }\n        // 3) Auto-detect: try DER first, then JOSE\n        else {\n            ok = SignatureAlgorithm[alg].verify(signingInput, key, signature);\n            if (!ok) {\n                try {\n                    const jose = Buffer.from(signature, 'base64url');\n                    // quick sanity: only attempt conversion if size matches expected\n                    if (jose.length === joseLenForAlg(alg)) {\n                        const derSigB64Url = joseToDer(jose).toString('base64url');\n                        ok = SignatureAlgorithm[alg].verify(signingInput, key, derSigB64Url);\n                    }\n                } catch {\n                    // ignore\n                }\n            }\n        }\n\n        if (!ok) {\n            return {valid: false, error: {reason: \"Signature verification failed\", code: 'INVALID_SIGNATURE'}};\n        }\n    }\n\n    // Time validation\n    const now = Math.floor(Date.now() / 1000);\n    const skew = options.clockSkew ?? 0;\n\n    if (!options.ignoreExpiration) {\n        if (payload.exp !== undefined && now > payload.exp + skew) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token expired',\n                    code: 'TOKEN_EXPIRED'\n                }\n            };\n        }\n    }\n\n    if (payload.nbf !== undefined && now + skew < payload.nbf) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token not yet valid',\n                code: 'TOKEN_NOT_ACTIVE'\n            }\n        };\n    }\n\n    if (payload.iat !== undefined && now + skew < payload.iat) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token issued in the future',\n                code: 'TOKEN_FUTURE_ISSUED'\n            }\n        };\n    }\n\n    // Maximum token age validation\n    if (options.maxTokenAge !== undefined && payload.iat === undefined) {\n        return {\n            valid: false,\n            error: {\n                reason: 'Token missing required issued-at claim (\"iat\")',\n                code: 'MISSING_IAT'\n            }\n        };\n    }\n\n    if (options.maxTokenAge !== undefined && payload.iat !== undefined) {\n        const tokenAge = now - payload.iat;\n        if (tokenAge > options.maxTokenAge) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Token age (${tokenAge}s) exceeds maximum allowed age (${options.maxTokenAge}s)`,\n                    code: 'TOKEN_TOO_OLD'\n                }\n            };\n        }\n    }\n\n    // --- Claim validations (only if options provided) ---\n\n    // Issuer (`iss`)\n    if (options.issuer !== undefined) {\n        if (payload.iss === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required issuer claim (\"iss\")',\n                    code: 'MISSING_ISSUER'\n                }\n            };\n        }\n        if (options.issuer !== payload.iss) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid token issuer: expected \"${options.issuer}\", got \"${payload.iss}\"`,\n                    code: 'INVALID_ISSUER'\n                }\n            };\n        }\n    }\n\n    // Subject (`sub`)\n    if (options.subject !== undefined) {\n        if (payload.sub === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required subject claim (\"sub\")',\n                    code: 'MISSING_SUBJECT'\n                }\n            };\n        }\n        if (options.subject !== payload.sub) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid token subject: expected \"${options.subject}\", got \"${payload.sub}\"`,\n                    code: 'INVALID_SUBJECT'\n                }\n            };\n        }\n    }\n\n    // Audience (`aud`)\n    if (options.audience !== undefined) {\n        const aud = payload.aud;\n        if (aud === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required audience claim (\"aud\")',\n                    code: 'MISSING_AUDIENCE'\n                }\n            };\n        }\n\n        const expectedAud = Array.isArray(options.audience) ? options.audience : [options.audience];\n        const tokenAud = Array.isArray(aud) ? aud : [aud];\n\n        const hasMatch = expectedAud.some(a => tokenAud.includes(a));\n        if (!hasMatch) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Audience claim mismatch',\n                    code: 'INVALID_AUDIENCE'\n                }\n            };\n        }\n    }\n\n    // JWT ID (`jti`)\n    if (options.jwtId !== undefined) {\n        if (payload.jti === undefined) {\n            return {\n                valid: false,\n                error: {\n                    reason: 'Token missing required JWT ID claim (\"jti\")',\n                    code: 'MISSING_JTI'\n                }\n            };\n        }\n        if (options.jwtId !== payload.jti) {\n            return {\n                valid: false,\n                error: {\n                    reason: `Invalid JWT ID: expected \"${options.jwtId}\", got \"${payload.jti}\"`,\n                    code: 'INVALID_JTI'\n                }\n            };\n        }\n    }\n\n    return {valid: true, header, payload, signature};\n};\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n} as const;\n","import {\n    createPrivateKey,\n    createPublicKey,\n    createSecretKey,\n    createHash,\n    type KeyObject\n} from 'crypto';\n\n// JWK Types\nexport type JWK =\n    | RSAJWK\n    | ECJWK\n    | OKPJWK\n    | OctJWK;\n\nexport type JWKWithHelpers = JWK & {\n    toKeyObject(): KeyObject;\n};\n\nexport interface BaseJWK {\n    kty: string;\n    kid?: string;\n    alg?: string;\n    use?: 'sig' | 'enc';\n    key_ops?: Array<'sign' | 'verify'>;\n    x5c?: string[]; // X.509 cert chain\n    x5t?: string;   // Base64url thumbprint\n}\n\nexport interface RSAJWK extends BaseJWK {\n    kty: 'RSA';\n    n: string;\n    e: string;\n    d?: string;\n    p?: string;\n    q?: string;\n    dp?: string;\n    dq?: string;\n    qi?: string;\n}\n\nexport interface ECJWK extends BaseJWK {\n    kty: 'EC';\n    crv: 'P-256' | 'P-384' | 'P-521' | 'secp256k1';\n    x: string;\n    y: string;\n    d?: string;\n}\n\nexport interface OKPJWK extends BaseJWK {\n    kty: 'OKP';\n    crv: 'Ed25519';\n    x: string;\n    d?: string;\n}\n\nexport interface OctJWK extends BaseJWK {\n    kty: 'oct';\n    k: string;\n}\n\n/**\n * Export KeyObject to JWK\n * @param key\n */\nexport function exportJWK(key: KeyObject): JWK {\n    if (!key || typeof key !== 'object') throw new Error('Invalid KeyObject');\n    return key.export({format: 'jwk'}) as JWK;\n}\n\n/**\n * Import JWK to KeyObject\n * @param jwk\n */\nexport function importJWK(jwk: JWK): KeyObject {\n    if (!jwk || typeof jwk !== 'object') throw new Error('Invalid JWK');\n\n    switch (jwk.kty) {\n        case 'oct': {\n            if (!('k' in jwk) || typeof jwk.k !== 'string') {\n                throw new Error('Invalid oct JWK: missing \"k\"');\n            }\n\n            return createSecretKey(Buffer.from(jwk.k, 'base64url'));\n        }\n\n        case 'RSA':\n        case 'EC':\n        case 'OKP': {\n            // private key\n            if ('d' in jwk && typeof (jwk as any).d === 'string') {\n                // @ts-ignore\n                return createPrivateKey({format: 'jwk', key: jwk});\n            }\n\n            // public key\n            // @ts-ignore\n            return createPublicKey({format: 'jwk', key: jwk});\n        }\n\n        default:\n            throw new Error(`Unsupported JWK key type: ${(jwk as any).kty}`);\n    }\n}\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport function toPublicJWK(key: KeyObject): JWK {\n    if (!key || typeof key !== 'object') {\n        throw new Error('Invalid KeyObject');\n    }\n\n    const publicKey =\n        key.type === 'private'\n            ? createPublicKey(key)\n            : key;\n\n    const jwk = publicKey.export({format: 'jwk'}) as JWK;\n\n    // Ensure private fields are not present\n    delete (jwk as any).d;\n    delete (jwk as any).p;\n    delete (jwk as any).q;\n    delete (jwk as any).dp;\n    delete (jwk as any).dq;\n    delete (jwk as any).qi;\n    return jwk;\n}\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport function getJWKThumbprint(jwk: JWK, hashAlg: 'sha256' = 'sha256'): string {\n    if (!jwk || typeof jwk !== 'object') {\n        throw new Error('Invalid JWK');\n    }\n\n    let fields: Record<string, string>;\n\n    switch (jwk.kty) {\n        case 'RSA':\n            fields = {e: jwk.e, kty: jwk.kty, n: jwk.n};\n            break;\n\n        case 'EC':\n            fields = {crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y};\n            break;\n\n        case 'OKP':\n            fields = {crv: jwk.crv, kty: jwk.kty, x: jwk.x};\n            break;\n\n        case 'oct':\n            fields = {k: jwk.k, kty: jwk.kty};\n            break;\n\n        default:\n            throw new Error(`Unsupported JWK key type: ${(jwk as any).kty}`);\n    }\n\n    // Lexicographically sorted JSON\n    const json = JSON.stringify(\n        Object.keys(fields)\n            .sort()\n            .reduce((acc, k) => {\n                acc[k] = fields[k];\n                return acc;\n            }, {} as Record<string, string>)\n    );\n\n    return createHash(hashAlg)\n        .update(json)\n        .digest('base64url');\n}\n\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport function computeX5T(jwk: JWK): string | undefined {\n    if (!jwk.x5c?.length) return undefined;\n    return createHash('sha1').update(Buffer.from(jwk.x5c[0], 'base64')).digest('base64url');\n}\n\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n}\n\nexport interface JWKS {\n    keys: JWK[];\n}\n\nexport interface JWKSResolver {\n    list(): Promise<JWKWithHelpers[]>;\n    refresh(): Promise<JWKSResolver>;\n    key(kid: string): Promise<JWKWithHelpers | undefined>;\n    find(input: Partial<BaseJWK>): Promise<JWKWithHelpers[]>;\n    findFirst(input: Partial<BaseJWK>): Promise<JWKWithHelpers | undefined>;\n    export(): JWKS | undefined;\n}\n\n/**\n * Convert JWKS specific key of first key to KeyObject\n * @param jwks\n * @param kid\n * @constructor\n */\nexport function JWKSToKeyObject(\n    jwks: JWKS,\n    kid?: string\n): KeyObject {\n    if (!jwks || !Array.isArray(jwks.keys)) throw new Error('Invalid JWKS');\n\n    let jwk: JWK | undefined;\n\n    if (kid) jwk = jwks.keys.find(k => k.kid === kid);\n\n    // Fallback: single-key JWKS\n    if (!jwk && jwks.keys.length === 1) jwk = jwks.keys[0];\n\n    if (!jwk) throw new Error('Key not found in JWKS');\n    return importJWK(jwk);\n}\n\n/**\n * Normalize JWKS\n * @param jwks\n */\nexport function normalizeJWKS(jwks: JWKS): JWKS {\n    return {\n        keys: normalizeJWK(...jwks.keys)\n    };\n}\n\nexport function normalizeJWK(...keys: JWK[]): JWKWithHelpers[] {\n    return keys.map((jwk) => {\n        const normalized = {\n            ...jwk,\n            kid: jwk.kid ?? getJWKThumbprint(jwk),\n            x5t: jwk.x5t ?? computeX5T(jwk)\n        } as JWKWithHelpers;\n\n        // Keep helper API out of object enumeration/serialization.\n        Object.defineProperty(normalized, 'toKeyObject', {\n            enumerable: false,\n            configurable: false,\n            writable: false,\n            value: () => importJWK(normalized)\n        });\n\n        return normalized;\n    })\n}\n\nexport const fromWeb = async (\n    url: string | URL,\n    options: Partial<{\n        fetch: typeof fetch;\n        ttl: number;\n        timeoutMs: number;\n        endpointOverride: string;\n        overrideEndpointCheck: boolean;\n        cache: {\n            get: (key: string) => JWKS | undefined | Promise<JWKS | undefined>;\n            set: (key: string, value: JWKS) => void | Promise<void>;\n        };\n    }> = {}\n): Promise<JWKSResolver> => {\n    const baseUrl = typeof url === 'string' ? url : url.toString();\n    const fetchFn = options.fetch ?? globalThis.fetch;\n    const ttl = Math.max(0, options.ttl ?? 5 * 60_000);\n    const timeoutMs = Math.max(0, options.timeoutMs ?? 5_000);\n    const wellKnownPath = '/.well-known/jwks.json';\n\n    if (!fetchFn) {\n        throw new Error('No fetch implementation available');\n    }\n\n    const endpoint = (() => {\n        if (options.endpointOverride) {\n            const override = options.endpointOverride;\n            try {\n                return new URL(override, baseUrl).toString();\n            } catch {\n                return override;\n            }\n        }\n\n        if (options.overrideEndpointCheck) {\n            return baseUrl;\n        }\n\n        if (baseUrl.endsWith(wellKnownPath)) {\n            return baseUrl;\n        }\n\n        return `${baseUrl.replace(/\\/+$/, '')}${wellKnownPath}`;\n    })();\n\n    const cache = (() => {\n        if (options.cache) return options.cache;\n        let memoryValue: JWKS | undefined;\n        return {\n            get: () => memoryValue,\n            set: (_key: string, value: JWKS) => {\n                memoryValue = value;\n            }\n        };\n    })();\n\n    let cachedJWKS: JWKS | undefined;\n    let nextRefreshAt = 0;\n    let refreshInFlight: Promise<JWKS> | undefined;\n    let consecutiveFailures = 0;\n\n    const fetchJWKS = async (allowStaleOnFailure: boolean): Promise<JWKS> => {\n        if (refreshInFlight) return refreshInFlight;\n\n        refreshInFlight = (async () => {\n            const controller = new AbortController();\n            let timeoutHandle: ReturnType<typeof setTimeout> | undefined;\n\n            if (timeoutMs > 0) {\n                timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);\n            }\n\n            let response: Response;\n            try {\n                response = await fetchFn(endpoint, {signal: controller.signal});\n            } catch (error) {\n                if (controller.signal.aborted) {\n                    throw new Error(`JWKS fetch timed out after ${timeoutMs}ms`);\n                }\n                throw error;\n            } finally {\n                if (timeoutHandle) clearTimeout(timeoutHandle);\n            }\n\n            if (!response.ok) {\n                throw new Error(`Failed to fetch JWKS: ${response.status} ${response.statusText}`);\n            }\n\n            const body = await response.json();\n            if (!body || typeof body !== 'object' || !Array.isArray((body as any).keys)) {\n                throw new Error('Invalid JWKS');\n            }\n\n            return normalizeJWKS(body as JWKS);\n        })();\n\n        try {\n            const fresh = await refreshInFlight;\n            cachedJWKS = fresh;\n            await cache.set(endpoint, fresh);\n            consecutiveFailures = 0;\n            if (ttl > 0) nextRefreshAt = Date.now() + ttl;\n            return fresh;\n        } catch (error) {\n            if (!allowStaleOnFailure || !cachedJWKS) {\n                throw error;\n            }\n\n            consecutiveFailures += 1;\n            /* c8 ignore start - stale-on-failure is only reachable when ttl > 0 (auto-refresh path) */\n            if (ttl > 0) {\n                const backoff = Math.min(\n                    Math.max(ttl, 30_000) * Math.pow(2, consecutiveFailures - 1),\n                    15 * 60_000\n                );\n                nextRefreshAt = Date.now() + backoff;\n            }\n            /* c8 ignore stop */\n            console.warn(`JWKS refresh failed for \"${endpoint}\", using stale cache.`, error);\n            return cachedJWKS;\n        } finally {\n            refreshInFlight = undefined;\n        }\n    };\n\n    cachedJWKS = await cache.get(endpoint);\n    if (!cachedJWKS) {\n        cachedJWKS = await fetchJWKS(false);\n    } else {\n        cachedJWKS = normalizeJWKS(cachedJWKS);\n        if (ttl > 0) nextRefreshAt = Date.now() + ttl;\n    }\n\n\n    const resolver: JWKSResolver = {\n        async list(): Promise<JWKWithHelpers[]> {\n            if (ttl > 0 && Date.now() >= nextRefreshAt) {\n                await fetchJWKS(true);\n            }\n            return normalizeJWK(...(cachedJWKS as JWKS).keys);\n        },\n        async refresh(): Promise<JWKSResolver> {\n            await fetchJWKS(false);\n            return resolver;\n        },\n        async key(kid: string): Promise<JWKWithHelpers | undefined> {\n            const keys = await resolver.list();\n            const key = keys.find((v) => v.kid === kid)\n            if (!key) return undefined;\n            return normalizeJWK(key)[0];\n        },\n        async find(input: Partial<BaseJWK>): Promise<JWKWithHelpers[]> {\n            const keys = await resolver.list();\n            const entries = Object.entries(input) as Array<[keyof BaseJWK, BaseJWK[keyof BaseJWK]]>;\n\n            if (entries.length === 0) return normalizeJWK(...keys);\n\n            return normalizeJWK(...keys.filter((key) =>\n                entries.every(([field, expected]) => {\n                    const value = key[field];\n                    if (Array.isArray(expected)) {\n                        return Array.isArray(value)\n                            && value.length === expected.length\n                            && value.every((item, i) => item === expected[i]);\n                    }\n                    return value === expected;\n                })\n            ));\n        },\n        async findFirst(input: Partial<BaseJWK>): Promise<JWKWithHelpers | undefined> {\n            return resolver.find(input).then(([key]) => key);\n        },\n        export(): JWKS | undefined {\n            return cachedJWKS;\n        }\n    };\n\n    return resolver;\n}\n\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS,\n    fromWeb\n}\n"],"mappings":";;AAeA,IAAa,IAAY;CACrB,SAAS,MAAmC,OAAO,KAAK,CAAK,CAAC,CAAC,SAAS,WAAW;CACnF,SAAS,MAA0B,OAAO,KAAK,GAAO,WAAW,CAAC,CAAC,SAAS;AAChF,GAOM,KAAqB,GAAW,MAC9B,EAAE,WAAW,EAAE,UAGZ,EAAgB,OAAO,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,GA0DnD,IAA0B;AAEhC,SAAS,EAAc,GAAkD;CACrE,OAAO,OAAO,KAAU,cAAY,KAAkB,CAAC,MAAM,QAAQ,CAAK;AAC9E;AAEA,SAAS,EAAe,GAAiC;CACrD,OAAO,OAAO,KAAU,YAAY,OAAO,SAAS,CAAK;AAC7D;AAEA,SAAS,EAAc,GAAmC;CACtD,OAAO,MAAM,QAAQ,CAAK,KAAK,EAAM,OAAO,MAAU,OAAO,KAAU,QAAQ;AACnF;AAEA,SAAS,EAAyB,GAA8D;CAC5F,IAAM,IAAwF;EAC1F;GAAC,OAAO;GAAO,OAAO,EAAQ,QAAQ,KAAA,KAAa,OAAO,EAAQ,OAAQ;GAAU,UAAU;EAAQ;EACtG;GAAC,OAAO;GAAO,OAAO,EAAQ,QAAQ,KAAA,KAAa,OAAO,EAAQ,OAAQ;GAAU,UAAU;EAAQ;EACtG;GAAC,OAAO;GAAO,OAAO,EAAQ,QAAQ,KAAA,KAAa,OAAO,EAAQ,OAAQ;GAAU,UAAU;EAAQ;EACtG;GAAC,OAAO;GAAO,OAAO,EAAQ,QAAQ,KAAA,KAAa,OAAO,EAAQ,OAAQ;GAAU,UAAU;EAAQ;EACtG;GAAC,OAAO;GAAO,OAAO,EAAQ,QAAQ,KAAA,KAAa,EAAe,EAAQ,GAAG;GAAG,UAAU;EAAQ;EAClG;GAAC,OAAO;GAAO,OAAO,EAAQ,QAAQ,KAAA,KAAa,EAAe,EAAQ,GAAG;GAAG,UAAU;EAAQ;EAClG;GAAC,OAAO;GAAO,OAAO,EAAQ,QAAQ,KAAA,KAAa,EAAe,EAAQ,GAAG;GAAG,UAAU;EAAQ;CACtG;CAEA,KAAK,IAAM,KAAS,GAChB,IAAI,CAAC,EAAM,OACP,OAAO;EACH,QAAQ,YAAY,EAAM,MAAM,oBAAoB,EAAM;EAC1D,MAAM;CACV;CAcR,OAVI,EAAQ,QAAQ,KAAA,KAEZ,EADoB,OAAO,EAAQ,OAAQ,YAAY,EAAc,EAAQ,GAAG,KAEzE;EACH,QAAQ;EACR,MAAM;CACV,IAID;AACX;AAEA,SAAS,EAAsB,GAAiE;CAC5F,IAAI,EAAQ,oBAAoB,KAAA,KAAa,EAAQ,oBAAoB,SAAS,EAAQ,oBAAoB,QAC1G,OAAO;EACH,QAAQ;EACR,MAAM;CACV;CAGJ,IAAI,EAAQ,cAAc,KAAA,MAAc,CAAC,EAAe,EAAQ,SAAS,KAAK,EAAQ,YAAY,IAC9F,OAAO;EACH,QAAQ;EACR,MAAM;CACV;CAGJ,IAAI,EAAQ,gBAAgB,KAAA,MAAc,CAAC,EAAe,EAAQ,WAAW,KAAK,EAAQ,cAAc,IACpG,OAAO;EACH,QAAQ;EACR,MAAM;CACV;CAGJ,IAAI,EAAQ,qBAAqB,KAAA,KAAa,OAAO,EAAQ,oBAAqB,WAC9E,OAAO;EACH,QAAQ;EACR,MAAM;CACV;CAGJ,IAAI,EAAQ,WAAW,KAAA,KAAa,OAAO,EAAQ,UAAW,UAC1D,OAAO;EACH,QAAQ;EACR,MAAM;CACV;CAGJ,IAAI,EAAQ,YAAY,KAAA,KAAa,OAAO,EAAQ,WAAY,UAC5D,OAAO;EACH,QAAQ;EACR,MAAM;CACV;CAGJ,IAAI,EAAQ,UAAU,KAAA,KAAa,OAAO,EAAQ,SAAU,UACxD,OAAO;EACH,QAAQ;EACR,MAAM;CACV;CAGJ,IAAI,EAAQ,aAAa,KAAA,KAEjB,EADoB,OAAO,EAAQ,YAAa,YAAY,EAAc,EAAQ,QAAQ,IAE1F,OAAO;EACH,QAAQ;EACR,MAAM;CACV;CAIR,IAAI,EAAQ,eAAe,KAAA,GAAW;EAClC,IAAI,CAAC,MAAM,QAAQ,EAAQ,UAAU,KAAK,EAAQ,WAAW,WAAW,GACpE,OAAO;GACH,QAAQ;GACR,MAAM;EACV;EAGJ,IAAM,IAAmB,EAAQ,WAAW,MAAM,MAAQ,EAAE,KAAO,EAAmB;EACtF,IAAI,GACA,OAAO;GACH,QAAQ,qDAAqD,EAAiB;GAC9E,MAAM;EACV;CAER;CAEA,IAAI,EAAQ,eAAe,KAAA,GAAW;EAClC,IAAI,CAAC,MAAM,QAAQ,EAAQ,UAAU,KAAK,EAAQ,WAAW,WAAW,KAAK,CAAC,EAAc,EAAQ,UAAU,GAC1G,OAAO;GACH,QAAQ;GACR,MAAM;EACV;EAGJ,IAAI,EAAQ,WAAW,MAAM,MAAS,EAAK,WAAW,CAAC,GACnD,OAAO;GACH,QAAQ;GACR,MAAM;EACV;CAER;CAEA,OAAO;AACX;AAEA,SAAS,EAAwB,GAA4D;CAezF,OAdI,EAAO,SAAS,KAAA,IAcb,OAbC,CAAC,EAAc,EAAO,IAAI,KAAK,EAAO,KAAK,WAAW,IAC/C;EACH,QAAQ;EACR,MAAM;CACV,IAGG;EACH,QAAQ,2CAA2C,EAAO,KAAK,KAAK,IAAI;EACxE,MAAM;CACV;AAIR;AAIA,SAAS,EAAc,GAAqB;CACxC,QAAQ,GAAR;EACI,KAAK;EACL,KAAK,UACD,OAAO;EACX,KAAK,SACD,OAAO;EACX,KAAK,SACD,OAAO;;EAEX,SACI,MAAU,MAAM,8CAA8C,GAAK;CAC3E;AACJ;AAEA,SAAS,EAAU,GAAa,GAAwB;CACpD,IAAI,IAAI;CACR,IAAI,EAAI,SAAS,IAAM,MAAU,MAAM,6BAA6B;CAGpE,IAAI,IAAS,EAAI;CACjB,IAAI,IAAS,KAAM;EACf,IAAM,IAAI,IAAS;EACnB,IAAS;EACT,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK,IAAU,KAAU,IAAK,EAAI;CAC7D;CAEA,IAAI,EAAI,SAAS,GAAM,MAAU,MAAM,iCAAiC;CACxE,IAAM,IAAO,EAAI,MACb,IAAI,EAAI,SAAS,GAAG,IAAI,CAAI;CAGhC,IAFA,KAAK,GAED,EAAI,SAAS,GAAM,MAAU,MAAM,iCAAiC;CACxE,IAAM,IAAO,EAAI,MACb,IAAI,EAAI,SAAS,GAAG,IAAI,CAAI;CAGhC,OAAO,EAAE,SAAS,IAAS,KAAK,EAAE,OAAO,IAAM,IAAI,EAAE,SAAS,CAAC;CAC/D,OAAO,EAAE,SAAS,IAAS,KAAK,EAAE,OAAO,IAAM,IAAI,EAAE,SAAS,CAAC;CAE/D,IAAM,IAAO,OAAO,OAAO,CAAC,OAAO,MAAM,IAAS,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAChE,IAAO,OAAO,OAAO,CAAC,OAAO,MAAM,IAAS,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;CACtE,OAAO,OAAO,OAAO,CAAC,GAAM,CAAI,CAAC;AACrC;AAEA,SAAS,EAAU,GAAsB;CACrC,IAAM,IAAO,EAAK,SAAS,GACvB,IAAI,EAAK,SAAS,GAAG,CAAI,GACzB,IAAI,EAAK,SAAS,CAAI;CAG1B,OAAO,EAAE,SAAS,KAAK,EAAE,OAAO,KAAA,EAAS,EAAE,KAAK,OAAa,IAAI,EAAE,SAAS,CAAC;CAC7E,OAAO,EAAE,SAAS,KAAK,EAAE,OAAO,KAAA,EAAS,EAAE,KAAK,OAAa,IAAI,EAAE,SAAS,CAAC;CAI7E,AADI,EAAE,KAAK,QAAM,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAI,CAAC,GAAG,CAAC,CAAC,IACvD,EAAE,KAAK,QAAM,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,CAAI,CAAC,GAAG,CAAC,CAAC;CAE3D,IAAM,IAAQ,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,GAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,GACxD,IAAQ,OAAO,OAAO,CAAC,OAAO,KAAK,CAAC,GAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,GAExD,IAAS,EAAM,SAAS,EAAM,QAEhC;CACJ,IAAI,IAAS,KACT,IAAW,OAAO,KAAK,CAAC,CAAM,CAAC;MAC5B;EACH,IAAM,IAAgB,CAAC,GACnB,IAAI;EACR,OAAO,IAAI,IAEP,AADA,EAAI,QAAQ,IAAI,GAAI,GACpB,MAAM;EAEV,IAAW,OAAO,KAAK,CAAC,MAAO,EAAI,QAAQ,GAAG,CAAG,CAAC;CACtD;CAEA,OAAO,OAAO,OAAO;EAAC,OAAO,KAAK,CAAC,EAAI,CAAC;EAAG;EAAU;EAAO;CAAK,CAAC;AACtE;AAEA,SAAS,EAAW,GAAsB;CACtC,OAAO,MAAQ,WAAW,MAAQ,WAAW,MAAQ,WAAW,MAAQ;AAC5E;AAwBA,IAAM,KAAuB,OAAyD;CAClF,OAAO,GAAuC,MAC1C,EAAW,GAAW,CAAM,CAAC,CAAC,OAAO,CAAI,CAAC,CAAC,OAAO,WAAW;CACjE,SAAS,GAAuC,GAAiB,MAEtD,EADU,EAAW,GAAW,CAAM,CAAC,CAAC,OAAO,CAAI,CAAC,CAAC,OAAO,WAC1C,GAAU,CAAS;AAEpD,IAEM,KAAyB,OAAyD;CACpF,OAAO,GAAuC,MAC1C,EAAW,CAAS,CAAC,CAAC,OAAO,CAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAM,CAAC,CAAC,SAAS,WAAW;CAC9E,SAAS,GAAuC,GAAiB,MAA+B;EAC5F,IAAI;GACA,OAAO,EAAa,CAAS,CAAC,CACzB,OAAO,CAAI,CAAC,CACZ,IAAI,CAAC,CACL,OAAO,GAAQ,OAAO,KAAK,GAAW,WAAW,CAAC;EAC3D,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ,IAEM,KAAsB,GAAmB,OAA0D;CACrG,OAAO,GAAuC,MAC1C,EAAW,CAAS,CAAC,CAChB,OAAO,CAAI,CAAC,CACZ,IAAI,CAAC,CACL,KAAK;EAEF,KAAK;EACL,SAAS,EAAO,UAAU;EAC1B;CACJ,CAAC,CAAC,CACD,SAAS,WAAW;CAC7B,SAAS,GAAuC,GAAiB,MAA+B;EAC5F,IAAI;GACA,OAAO,EAAa,CAAS,CAAC,CACzB,OAAO,CAAI,CAAC,CACZ,IAAI,CAAC,CACL,OAAO;IAEJ,KAAK;IACL,SAAS,EAAO,UAAU;IAC1B;GACJ,GAAG,OAAO,KAAK,GAAW,WAAW,CAAC;EAC9C,QAAQ;GACJ,OAAO;EACX;CACJ;AACJ,IAsBa,IAA6C;CAEtD,OAAO,EAAoB,QAAQ;CACnC,OAAO,EAAoB,QAAQ;CACnC,OAAO,EAAoB,QAAQ;CAGnC,OAAO,EAAsB,YAAY;CACzC,OAAO,EAAsB,YAAY;CACzC,OAAO,EAAsB,YAAY;CAGzC,OAAO,EAAsB,QAAQ;CACrC,OAAO,EAAsB,QAAQ;CACrC,OAAO,EAAsB,QAAQ;CACrC,QAAQ,EAAsB,QAAQ;CACtC,OAAO,EAAmB,cAAc,EAAE;CAC1C,OAAO,EAAmB,cAAc,EAAE;CAC1C,OAAO,EAAmB,cAAc,EAAE;CAC1C,OAAO;EAtCP,OAAO,GAAuC,MAC1C,EAAW,MAAM,OAAO,KAAS,WAAW,OAAO,KAAK,GAAM,MAAM,IAAI,GAAM,CAAM,CAAC,CAChF,SAAS,WAAW;EAC7B,SAAS,GAAuC,GAAiB,MAA+B;GAC5F,IAAI;IACA,OAAO,EACH,MACA,OAAO,KAAS,WAAW,OAAO,KAAK,GAAM,MAAM,IAAI,GACvD,GACA,OAAO,KAAK,GAAW,WAAW,CACtC;GACJ,QAAQ;IACJ,OAAO;GACX;EACJ;CAwBO;AACX,GAIa,IAAsB,OAAO,KAAK,CAAkB;AAOjE,SAAgB,EAAoB,GAAoC;CACpE,IAAI,EAAI,SAAS,UAAU,OAAO;CAClC,IAAI,EAAI,SAAS,WAAW,MAAU,MAAM,yDAAyD;CAErG,IAAM,IAAc,EAAI,mBAClB,IAAU,EAAI;CAEpB,QAAQ,GAAR;EACI,KAAK,OACD,OAAO;EACX,KAAK,WAAW;GACZ,IAAM,KAAA,KAAA,OAAA,KAAA,IAAO,EAAS,kBAAiB;GACvC,QAAQ,GAAR;IACI,KAAK,UACD,OAAO;IACX,KAAK,UACD,OAAO;IACX,KAAK,UACD,OAAO;IACX,SACI,MAAU,MAAM,uCAAuC,GAAM;GACrE;EACJ;EACA,KAAK,MAAM;GACP,IAAM,IAAA,KAAA,OAAA,KAAA,IAAQ,EAAS;GACvB,QAAQ,GAAR;IACI,KAAK;IACL,KAAK,cACD,OAAO;IACX,KAAK;IACL,KAAK,aACD,OAAO;IACX,KAAK;IACL,KAAK,aACD,OAAO;IACX,KAAK,aACD,OAAO;IACX,SACI,MAAU,MAAM,yBAAyB,GAAO;GACxD;EACJ;EACA,KAAK,WACD,OAAO;EACX,SACI,MAAU,MAAM,oCAAoC,GAAa;CACzE;AACJ;AAMA,SAAS,EAAY,GAAc,GAAuC;CAEtE,IAAI,OAAO,KAAQ,YAAY,UAAU,GAAK,OAAO;CAGrD,IAAI;EACA,OAAO,MAAY,SAAS,EAAiB,CAAG,IAAI,EAAgB,CAAG;CAC3E,QAAQ;EACJ,IAAI,MAAY,QAAQ;GAEpB,IAAI;IACA,EAAgB,CAAG;GACvB,QAAQ;IAEJ,IAAI,OAAO,KAAQ,UAAU,OAAO,EAAgB,OAAO,KAAK,GAAK,MAAM,CAAC;IAC5E,IAAI,OAAO,SAAS,CAAG,GAAG,OAAO,EAAgB,CAAG;IACpD,MAAU,MAAM,sBAAsB;GAC1C;GACA,MAAU,MAAM,0CAA0C;EAC9D;EAEA,IAAI,OAAO,KAAQ,UAAU,OAAO,EAAgB,OAAO,KAAK,GAAK,MAAM,CAAC;EAC5E,IAAI,OAAO,SAAS,CAAG,GAAG,OAAO,EAAgB,CAAG;EACpD,MAAU,MAAM,sBAAsB;CAC1C;AACJ;AAEA,SAAS,EAA2B,GAAgB,GAAyB,GAAkC;CAC3G,IAAI,EAAI,WAAW,IAAI,GAAG;EACtB,IAAI,EAAI,SAAS,UAAU,MAAU,MAAM,GAAG,EAAI,iCAAiC;EACnF;CACJ;CAEA,IAAI,MAAY,UAAU,EAAI,SAAS,WACnC,MAAU,MAAM,GAAG,EAAI,oCAAoC;CAE/D,IAAI,MAAY,YAAY,EAAI,SAAS,YAAY,EAAI,SAAS,WAC9D,MAAU,MAAM,GAAG,EAAI,mDAAmD;CAG9E,IAAM,IAAU,EAAI;CACpB,IAAI,EAAI,WAAW,IAAI,KAAK,MAAY,OACpC,MAAU,MAAM,GAAG,EAAI,qBAAqB;CAEhD,IAAI,EAAI,WAAW,IAAI,KAAK,MAAY,SAAS,MAAY,WACzD,MAAU,MAAM,GAAG,EAAI,gCAAgC;CAE3D,IAAI,MAAQ,WAAW,MAAY,WAC/B,MAAU,MAAM,+BAA+B;CAEnD,IAAI,EAAW,CAAG,GAAG;;EACjB,IAAM,KAAA,IAAQ,EAAI,yBAAA,OAAA,KAAA,IAAA,EAAsB,YACpC,IAA0B,CAAC;EAC/B,QAAQ,GAAR;GACI,KAAK;IACD,IAAgB,CAAC,SAAS,YAAY;IACtC;GACJ,KAAK;IACD,IAAgB,CAAC,SAAS,WAAW;IACrC;GACJ,KAAK;IACD,IAAgB,CAAC,SAAS,WAAW;IACrC;GACJ,KAAK,UACD,IAAgB,CAAC,WAAW;EAEpC;EACA,IAAI,MAAY,QAAQ,CAAC,EAAc,SAAS,KAAS,EAAE,GACvD,MAAU,MAAM,GAAG,EAAI,gCAAgC;CAE/D;AACJ;AAMA,IAAa,KAAU,MAAuB;CAC1C,IAAM,IAAQ,EAAM,MAAM,GAAG;CAC7B,IAAI,EAAM,WAAW,GACjB,MAAU,MAAM,8DAA4D;CAGhF,IAAM,CAAC,GAAY,GAAa,KAAa;CAE7C,IAAI,CAAC,KAAc,CAAC,KAAe,CAAC,GAChC,MAAU,MAAM,kCAAkC;CAGtD,IAAI,CAAC,EAAwB,KAAK,CAAU,KAAK,CAAC,EAAwB,KAAK,CAAW,KAAK,CAAC,EAAwB,KAAK,CAAS,GAClI,MAAU,MAAM,gDAAgD;CAGpE,IAAI;EACA,IAAM,IAAgB,KAAK,MAAM,EAAU,OAAO,CAAU,CAAC,GACvD,IAAiB,KAAK,MAAM,EAAU,OAAO,CAAW,CAAC;EAE/D,IAAI,CAAC,EAAc,CAAa,KAAK,CAAC,EAAc,CAAc,GAC9D,MAAU,MAAM,yCAAyC;EAG7D,IAAM,IAAS,GACT,IAAU;EAEhB,IAAI,OAAO,EAAO,OAAQ,YAAY,EAAO,IAAI,WAAW,GACxD,MAAU,MAAM,uCAAuC;EAE3D,IAAI,EAAO,QAAQ,KAAA,KAAa,OAAO,EAAO,OAAQ,UAClD,MAAU,MAAM,6BAA6B;EAEjD,IAAI,EAAO,QAAQ,KAAA,KAAa,OAAO,EAAO,OAAQ,UAClD,MAAU,MAAM,6BAA6B;EAEjD,IAAI,EAAO,SAAS,KAAA,MAAc,CAAC,EAAc,EAAO,IAAI,KAAK,EAAO,KAAK,WAAW,IACpF,MAAU,MAAM,0CAA0C;EAG9D,OAAO;GAAC;GAAQ;GAAS;EAAS;CACtC,SAAS,GAAK;EACV,MAAU,MAAM,6CAA8C,EAAc,QAAQ,EAAE;CAC1F;AACJ,GAkBa,KACT,GACA,GACA,IAAuB,CAAC,MACf;CACT,IAAM,IAAM,EAAY,GAAQ,MAAM,GAChC,IAAM,EAAQ,OAAO,EAAoB,CAAG,GAC5C,IAAkB,EAAQ,oBAAoB,EAAW,CAAG,IAAI,SAAS,QACzE,IAAM,EAAQ,OAAO;CAE3B,IAAI,EAAE,KAAO,IAAqB,MAAU,MAAM,0BAA0B,GAAK;CACjF,EAA2B,GAAK,GAAK,MAAM;CAE3C,IAAM,IAAoB;EAAC;EAAK;CAAG;CACnC,AAAI,EAAQ,QAAK,EAAO,MAAM,EAAQ;CAEtC,IAAM,IAAgB,EAAU,OAAO,KAAK,UAAU,CAAM,CAAC,GACvD,IAAiB,EAAU,OAAO,KAAK,UAAU,CAAO,CAAC,GAEzD,IAAe,GAAG,EAAc,GAAG,KAGrC,IAAY,EAAmB,EAAI,CAAC,KAAK,GAAc,CAAG;CAS9D,OANI,MAAoB,UAAU,EAAW,CAAG,MAG5C,IADa,EADD,OAAO,KAAK,GAAW,WACZ,GAAK,EAAc,CAAG,CACjC,CAAA,CAAK,SAAS,WAAW,IAGlC,GAAG,EAAc,GAAG,EAAe,GAAG;AAEjD,GAsBa,KACT,GACA,GACA,IAA0B,CAAC,MAGoC;CAC/D,IAAM,IAAiB,EAAsB,CAAO;CACpD,IAAI,GACA,OAAO;EACH,OAAO;EACP,OAAO;CACX;CAGJ,IAAI;CACJ,IAAI;EACA,IAAU,EAAO,CAAK;CAC1B,SAAS,GAAK;EACV,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAS,EAAc;IACvB,MAAM;GACV;EACJ;CACJ;CAEA,IAAM,EAAC,WAAQ,YAAS,iBAAa,GAC/B,IAAgB,EAAwB,CAAM;CACpD,IAAI,GACA,OAAO;EACH,OAAO;EACP,OAAO;CACX;CAGJ,IAAM,IAAgB,EAAyB,CAAO;CACtD,IAAI,GACA,OAAO;EACH,OAAO;EACP,OAAO;CACX;CAIJ,IAAM,IAAM,EAAO;CACnB,IAAI,EAAE,KAAO,IACT,OAAO;EACH,OAAO;EACP,OAAO;GACH,QAAQ,qCAAqC,EAAO;GACpD,MAAM;EACV;CACJ;CAIJ,IAAI,EAAQ,cAAc,EAAQ,WAAW,SAAS,KAC9C,CAAC,EAAQ,WAAW,SAAS,CAAG,GAChC,OAAO;EACH,OAAO;EACP,OAAO;GACH,QAAQ,cAAc,EAAI;GAC1B,MAAM;EACV;CACJ;CAMR,IAAM,IAAa,EAAQ,cAAc,CAAC,KAAK;CAC/C,IAAI,EAAO,QAAQ,KAAA,KAAa,CAAC,EAAW,SAAS,EAAO,GAAG,GAC3D,OAAO;EACH,OAAO;EACP,OAAO;GACH,QAAQ,uCAAuC,EAAW,KAAK,MAAS,IAAI,EAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,SAAS,EAAO,IAAI;GACpH,MAAM;EACV;CACJ;CAIJ,IAAM,CAAC,GAAY,KAAe,EAAM,MAAM,GAAG,GAC3C,IAAe,GAAG,EAAW,GAAG,KAElC;CACJ,IAAI;EAEA,AADA,IAAM,EAAY,GAAQ,QAAQ,GAClC,EAA2B,GAAK,GAAK,QAAQ;CACjD,SAAS,GAAO;EACZ,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAS,EAAgB;IACzB,MAAM;GACV;EACJ;CACJ;CAEA,IAAK,EAAW,CAAG,GAWZ;EAEH,IAAM,IAAS,EAAQ,iBAEnB;EAGJ,IAAI,MAAW,QACX,IAAI;GAEA,IAAM,IAAe,EADR,OAAO,KAAK,GAAW,WACL,CAAI,CAAC,CAAC,SAAS,WAAW;GACzD,IAAK,EAAmB,EAAI,CAAC,OAAO,GAAc,GAAK,CAAY;EACvE,QAAQ;GACJ,IAAK;EACT;OAGC,IAAI,MAAW,OAChB,IAAK,EAAmB,EAAI,CAAC,OAAO,GAAc,GAAK,CAAS;OAKhE,IADA,IAAK,EAAmB,EAAI,CAAC,OAAO,GAAc,GAAK,CAAS,GAC5D,CAAC,GACD,IAAI;GACA,IAAM,IAAO,OAAO,KAAK,GAAW,WAAW;GAE/C,IAAI,EAAK,WAAW,EAAc,CAAG,GAAG;IACpC,IAAM,IAAe,EAAU,CAAI,CAAC,CAAC,SAAS,WAAW;IACzD,IAAK,EAAmB,EAAI,CAAC,OAAO,GAAc,GAAK,CAAY;GACvE;EACJ,QAAQ,CAER;EAIR,IAAI,CAAC,GACD,OAAO;GAAC,OAAO;GAAO,OAAO;IAAC,QAAQ;IAAiC,MAAM;GAAmB;EAAC;CAEzG,OAnDsB;EAElB,IAAI,IAAmB;EACvB,IAAI;GACA,IAAmB,EAAmB,EAAI,CAAC,OAAO,GAAc,GAAK,CAAS;EAClF,QAAQ;GACJ,IAAmB;EACvB;EACA,IAAI,CAAC,GACD,OAAO;GAAC,OAAO;GAAO,OAAO;IAAC,QAAQ;IAAiC,MAAM;GAAmB;EAAC;CAEzG;CA2CA,IAAM,IAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAClC,IAAO,EAAQ,aAAa;CAElC,IAAI,CAAC,EAAQ,oBACL,EAAQ,QAAQ,KAAA,KAAa,IAAM,EAAQ,MAAM,GACjD,OAAO;EACH,OAAO;EACP,OAAO;GACH,QAAQ;GACR,MAAM;EACV;CACJ;CAIR,IAAI,EAAQ,QAAQ,KAAA,KAAa,IAAM,IAAO,EAAQ,KAClD,OAAO;EACH,OAAO;EACP,OAAO;GACH,QAAQ;GACR,MAAM;EACV;CACJ;CAGJ,IAAI,EAAQ,QAAQ,KAAA,KAAa,IAAM,IAAO,EAAQ,KAClD,OAAO;EACH,OAAO;EACP,OAAO;GACH,QAAQ;GACR,MAAM;EACV;CACJ;CAIJ,IAAI,EAAQ,gBAAgB,KAAA,KAAa,EAAQ,QAAQ,KAAA,GACrD,OAAO;EACH,OAAO;EACP,OAAO;GACH,QAAQ;GACR,MAAM;EACV;CACJ;CAGJ,IAAI,EAAQ,gBAAgB,KAAA,KAAa,EAAQ,QAAQ,KAAA,GAAW;EAChE,IAAM,IAAW,IAAM,EAAQ;EAC/B,IAAI,IAAW,EAAQ,aACnB,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAQ,cAAc,EAAS,kCAAkC,EAAQ,YAAY;IACrF,MAAM;GACV;EACJ;CAER;CAKA,IAAI,EAAQ,WAAW,KAAA,GAAW;EAC9B,IAAI,EAAQ,QAAQ,KAAA,GAChB,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAQ;IACR,MAAM;GACV;EACJ;EAEJ,IAAI,EAAQ,WAAW,EAAQ,KAC3B,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAQ,mCAAmC,EAAQ,OAAO,UAAU,EAAQ,IAAI;IAChF,MAAM;GACV;EACJ;CAER;CAGA,IAAI,EAAQ,YAAY,KAAA,GAAW;EAC/B,IAAI,EAAQ,QAAQ,KAAA,GAChB,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAQ;IACR,MAAM;GACV;EACJ;EAEJ,IAAI,EAAQ,YAAY,EAAQ,KAC5B,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAQ,oCAAoC,EAAQ,QAAQ,UAAU,EAAQ,IAAI;IAClF,MAAM;GACV;EACJ;CAER;CAGA,IAAI,EAAQ,aAAa,KAAA,GAAW;EAChC,IAAM,IAAM,EAAQ;EACpB,IAAI,MAAQ,KAAA,GACR,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAQ;IACR,MAAM;GACV;EACJ;EAGJ,IAAM,IAAc,MAAM,QAAQ,EAAQ,QAAQ,IAAI,EAAQ,WAAW,CAAC,EAAQ,QAAQ,GACpF,IAAW,MAAM,QAAQ,CAAG,IAAI,IAAM,CAAC,CAAG;EAGhD,IAAI,CADa,EAAY,MAAK,MAAK,EAAS,SAAS,CAAC,CACrD,GACD,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAQ;IACR,MAAM;GACV;EACJ;CAER;CAGA,IAAI,EAAQ,UAAU,KAAA,GAAW;EAC7B,IAAI,EAAQ,QAAQ,KAAA,GAChB,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAQ;IACR,MAAM;GACV;EACJ;EAEJ,IAAI,EAAQ,UAAU,EAAQ,KAC1B,OAAO;GACH,OAAO;GACP,OAAO;IACH,QAAQ,6BAA6B,EAAQ,MAAM,UAAU,EAAQ,IAAI;IACzE,MAAM;GACV;EACJ;CAER;CAEA,OAAO;EAAC,OAAO;EAAM;EAAQ;EAAS;CAAS;AACnD,GAGa,IAAM;CACf;CACA;CACA;CACA,YAAY;AAChB;;;AC/7BA,SAAgB,EAAU,GAAqB;CAC3C,IAAI,CAAC,KAAO,OAAO,KAAQ,UAAU,MAAU,MAAM,mBAAmB;CACxE,OAAO,EAAI,OAAO,EAAC,QAAQ,MAAK,CAAC;AACrC;AAMA,SAAgB,EAAU,GAAqB;CAC3C,IAAI,CAAC,KAAO,OAAO,KAAQ,UAAU,MAAU,MAAM,aAAa;CAElE,QAAQ,EAAI,KAAZ;EACI,KAAK;GACD,IAAI,EAAE,OAAO,MAAQ,OAAO,EAAI,KAAM,UAClC,MAAU,MAAM,gCAA8B;GAGlD,OAAO,EAAgB,OAAO,KAAK,EAAI,GAAG,WAAW,CAAC;EAG1D,KAAK;EACL,KAAK;EACL,KAAK,OASD,OAPI,OAAO,KAAO,OAAQ,EAAY,KAAM,WAEjC,EAAiB;GAAC,QAAQ;GAAO,KAAK;EAAG,CAAC,IAK9C,EAAgB;GAAC,QAAQ;GAAO,KAAK;EAAG,CAAC;EAGpD,SACI,MAAU,MAAM,6BAA8B,EAAY,KAAK;CACvE;AACJ;AAMA,SAAgB,EAAY,GAAqB;CAC7C,IAAI,CAAC,KAAO,OAAO,KAAQ,UACvB,MAAU,MAAM,mBAAmB;CAQvC,IAAM,KAJF,EAAI,SAAS,YACP,EAAgB,CAAG,IACnB,EAAA,CAEY,OAAO,EAAC,QAAQ,MAAK,CAAC;CAS5C,OANA,OAAQ,EAAY,GACpB,OAAQ,EAAY,GACpB,OAAQ,EAAY,GACpB,OAAQ,EAAY,IACpB,OAAQ,EAAY,IACpB,OAAQ,EAAY,IACb;AACX;AAOA,SAAgB,EAAiB,GAAU,IAAoB,UAAkB;CAC7E,IAAI,CAAC,KAAO,OAAO,KAAQ,UACvB,MAAU,MAAM,aAAa;CAGjC,IAAI;CAEJ,QAAQ,EAAI,KAAZ;EACI,KAAK;GACD,IAAS;IAAC,GAAG,EAAI;IAAG,KAAK,EAAI;IAAK,GAAG,EAAI;GAAC;GAC1C;EAEJ,KAAK;GACD,IAAS;IAAC,KAAK,EAAI;IAAK,KAAK,EAAI;IAAK,GAAG,EAAI;IAAG,GAAG,EAAI;GAAC;GACxD;EAEJ,KAAK;GACD,IAAS;IAAC,KAAK,EAAI;IAAK,KAAK,EAAI;IAAK,GAAG,EAAI;GAAC;GAC9C;EAEJ,KAAK;GACD,IAAS;IAAC,GAAG,EAAI;IAAG,KAAK,EAAI;GAAG;GAChC;EAEJ,SACI,MAAU,MAAM,6BAA8B,EAAY,KAAK;CACvE;CAGA,IAAM,IAAO,KAAK,UACd,OAAO,KAAK,CAAM,CAAC,CACd,KAAK,CAAC,CACN,QAAQ,GAAK,OACV,EAAI,KAAK,EAAO,IACT,IACR,CAAC,CAA2B,CACvC;CAEA,OAAO,EAAW,CAAO,CAAC,CACrB,OAAO,CAAI,CAAC,CACZ,OAAO,WAAW;AAC3B;AAOA,SAAgB,EAAW,GAA8B;;CACjD,KAAA,IAAC,EAAI,QAAA,QAAA,EAAK,QACd,OAAO,EAAW,MAAM,CAAC,CAAC,OAAO,OAAO,KAAK,EAAI,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,OAAO,WAAW;AAC1F;AAEA,IAAa,IAAM;CACf,QAAQ;CACR,QAAQ;CACR,UAAU;CACV,YAAY;AAChB;AAqBA,SAAgB,EACZ,GACA,GACS;CACT,IAAI,CAAC,KAAQ,CAAC,MAAM,QAAQ,EAAK,IAAI,GAAG,MAAU,MAAM,cAAc;CAEtE,IAAI;CAOJ,IALI,MAAK,IAAM,EAAK,KAAK,MAAK,MAAK,EAAE,QAAQ,CAAG,IAG5C,CAAC,KAAO,EAAK,KAAK,WAAW,MAAG,IAAM,EAAK,KAAK,KAEhD,CAAC,GAAK,MAAU,MAAM,uBAAuB;CACjD,OAAO,EAAU,CAAG;AACxB;AAMA,SAAgB,EAAc,GAAkB;CAC5C,OAAO,EACH,MAAM,EAAa,GAAG,EAAK,IAAI,EACnC;AACJ;AAEA,SAAgB,EAAa,GAAG,GAA+B;CAC3D,OAAO,EAAK,KAAK,MAAQ;EACrB,IAAM,IAAa;GACf,GAAG;GACH,KAAK,EAAI,OAAO,EAAiB,CAAG;GACpC,KAAK,EAAI,OAAO,EAAW,CAAG;EAClC;EAUA,OAPA,OAAO,eAAe,GAAY,eAAe;GAC7C,YAAY;GACZ,cAAc;GACd,UAAU;GACV,aAAa,EAAU,CAAU;EACrC,CAAC,GAEM;CACX,CAAC;AACL;AAEA,IAAa,IAAU,OACnB,GACA,IAUK,CAAC,MACkB;CACxB,IAAM,IAAU,OAAO,KAAQ,WAAW,IAAM,EAAI,SAAS,GACvD,IAAU,EAAQ,SAAS,WAAW,OACtC,IAAM,KAAK,IAAI,GAAG,EAAQ,OAAO,GAAU,GAC3C,IAAY,KAAK,IAAI,GAAG,EAAQ,aAAa,GAAK,GAClD,IAAgB;CAEtB,IAAI,CAAC,GACD,MAAU,MAAM,mCAAmC;CAGvD,IAAM,WAAkB;EACpB,IAAI,EAAQ,kBAAkB;GAC1B,IAAM,IAAW,EAAQ;GACzB,IAAI;IACA,OAAO,IAAI,IAAI,GAAU,CAAO,CAAC,CAAC,SAAS;GAC/C,QAAQ;IACJ,OAAO;GACX;EACJ;EAUA,OARI,EAAQ,yBAIR,EAAQ,SAAS,CAAa,IACvB,IAGJ,GAAG,EAAQ,QAAQ,QAAQ,EAAE,IAAI;CAC5C,EAAA,CAAG,GAEG,WAAe;EACjB,IAAI,EAAQ,OAAO,OAAO,EAAQ;EAClC,IAAI;EACJ,OAAO;GACH,WAAW;GACX,MAAM,GAAc,MAAgB;IAChC,IAAc;GAClB;EACJ;CACJ,EAAA,CAAG,GAEC,GACA,IAAgB,GAChB,GACA,IAAsB,GAEpB,IAAY,OAAO,MAAgD;EACrE,IAAI,GAAiB,OAAO;EAE5B,KAAmB,YAAY;GAC3B,IAAM,IAAa,IAAI,gBAAgB,GACnC;GAEJ,AAAI,IAAY,MACZ,IAAgB,iBAAiB,EAAW,MAAM,GAAG,CAAS;GAGlE,IAAI;GACJ,IAAI;IACA,IAAW,MAAM,EAAQ,GAAU,EAAC,QAAQ,EAAW,OAAM,CAAC;GAClE,SAAS,GAAO;IAIZ,MAHI,EAAW,OAAO,UACR,MAAM,8BAA8B,EAAU,GAAG,IAEzD;GACV,UAAU;IACN,AAAI,KAAe,aAAa,CAAa;GACjD;GAEA,IAAI,CAAC,EAAS,IACV,MAAU,MAAM,yBAAyB,EAAS,OAAO,GAAG,EAAS,YAAY;GAGrF,IAAM,IAAO,MAAM,EAAS,KAAK;GACjC,IAAI,CAAC,KAAQ,OAAO,KAAS,YAAY,CAAC,MAAM,QAAS,EAAa,IAAI,GACtE,MAAU,MAAM,cAAc;GAGlC,OAAO,EAAc,CAAY;EACrC,EAAA,CAAG;EAEH,IAAI;GACA,IAAM,IAAQ,MAAM;GAKpB,OAJA,IAAa,GACb,MAAM,EAAM,IAAI,GAAU,CAAK,GAC/B,IAAsB,GAClB,IAAM,MAAG,IAAgB,KAAK,IAAI,IAAI,IACnC;EACX,SAAS,GAAO;GACZ,IAAI,CAAC,KAAuB,CAAC,GACzB,MAAM;;GAKV,IAFA,KAAuB,GAEnB,IAAM,GAAG;IACT,IAAM,IAAU,KAAK,IACjB,KAAK,IAAI,GAAK,GAAM,IAAa,MAAG,IAAsB,IAC1D,GACJ;IACA,IAAgB,KAAK,IAAI,IAAI;GACjC;GAGA,OADA,QAAQ,KAAK,4BAA4B,EAAS,wBAAwB,CAAK,GACxE;EACX,UAAU;GACN,IAAkB,KAAA;EACtB;CACJ;CAGA,AADA,IAAa,MAAM,EAAM,IAAI,CAAQ,GAChC,KAGD,IAAa,EAAc,CAAU,GACjC,IAAM,MAAG,IAAgB,KAAK,IAAI,IAAI,MAH1C,IAAa,MAAM,EAAU,EAAK;CAOtC,IAAM,IAAyB;EAC3B,MAAM,OAAkC;GAIpC,OAHI,IAAM,KAAK,KAAK,IAAI,KAAK,KACzB,MAAM,EAAU,EAAI,GAEjB,EAAa,GAAI,EAAoB,IAAI;EACpD;EACA,MAAM,UAAiC;GAEnC,OADA,MAAM,EAAU,EAAK,GACd;EACX;EACA,MAAM,IAAI,GAAkD;GAExD,IAAM,KAAM,MADO,EAAS,KAAK,EAAA,CAChB,MAAM,MAAM,EAAE,QAAQ,CAAG;GACrC,OACL,OAAO,EAAa,CAAG,CAAC,CAAC;EAC7B;EACA,MAAM,KAAK,GAAoD;GAC3D,IAAM,IAAO,MAAM,EAAS,KAAK,GAC3B,IAAU,OAAO,QAAQ,CAAK;GAIpC,OAFI,EAAQ,WAAW,IAAU,EAAa,GAAG,CAAI,IAE9C,EAAa,GAAG,EAAK,QAAQ,MAChC,EAAQ,OAAO,CAAC,GAAO,OAAc;IACjC,IAAM,IAAQ,EAAI;IAMlB,OALI,MAAM,QAAQ,CAAQ,IACf,MAAM,QAAQ,CAAK,KACnB,EAAM,WAAW,EAAS,UAC1B,EAAM,OAAO,GAAM,MAAM,MAAS,EAAS,EAAE,IAEjD,MAAU;GACrB,CAAC,CACL,CAAC;EACL;EACA,MAAM,UAAU,GAA8D;GAC1E,OAAO,EAAS,KAAK,CAAK,CAAC,CAAC,MAAM,CAAC,OAAS,CAAG;EACnD;EACA,SAA2B;GACvB,OAAO;EACX;CACJ;CAEA,OAAO;AACX,GAEa,IAAO;CAChB,aAAa;CACb,WAAW;CACX;AACJ"}

package/dist/jwt/index.d.ts

@@ -1,4 +1,4 @@
-import { BinaryLike, KeyLike, KeyObject } from 'crypto';
+import { KeyLike, KeyObject } from 'crypto';
 export declare const base64Url: {
     encode: (input: string | Buffer) => string;
     decode: (input: string) => string;
@@ -54,8 +54,8 @@ export interface JWT {
     signature: string;
 }
 type SignatureAlgorithmImplementation = {
-    sign: (data: BinaryLike, secret: KeyLike) => string;
-    verify: (data: BinaryLike, secret: KeyLike, signature: string) => boolean;
+    sign: (data: string | NodeJS.ArrayBufferView, secret: KeyLike) => string;
+    verify: (data: string | NodeJS.ArrayBufferView, secret: KeyLike, signature: string) => boolean;
 };
 type SignatureAlgorithmsMap = {
     HS256: SignatureAlgorithmImplementation;
@@ -105,6 +105,8 @@ export type SignOptions = {
 export declare const sign: (payload: JWTPayload, secret: KeyLike, options?: SignOptions) => string;
 export type VerifyOptions = {
     algorithms?: SupportedAlgorithm[];
+    /** Allowed protected-header `typ` values. Defaults to `['JWT']`. A missing `typ` remains valid. */
+    tokenTypes?: string[];
     issuer?: string;
     subject?: string;
     audience?: string | string[];

package/dist/jwt/promises.d.ts

@@ -30,60 +30,60 @@ export declare const JWT: {
     decode: (token: string) => Promise<JSONWebToken>;
     algorithms: {
         HS256: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         HS384: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         HS512: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         RS256: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         RS384: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         RS512: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         ES256: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         ES384: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         ES512: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         ES256K: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         PS256: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         PS384: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         PS512: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
         EdDSA: {
-            sign: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike) => string;
-            verify: (data: import('node:crypto').BinaryLike, secret: import('node:crypto').KeyLike, signature: string) => boolean;
+            sign: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike) => string;
+            verify: (data: string | NodeJS.ArrayBufferView, secret: import('node:crypto').KeyLike, signature: string) => boolean;
         };
     };
 };

package/dist/promises.cjs

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("./index-CaEvPIqc.cjs");require("crypto");const r=e=>Promise.resolve().then(()=>o.decode(e)),i=(...e)=>Promise.resolve().then(()=>o.sign(...e)),s=(...e)=>Promise.resolve().then(()=>{const t=o.verify(...e);if("error"in t)throw t.error;const{header:J,payload:p,signature:g}=t;return{header:J,payload:p,signature:g}}),b={sign:i,verify:s,decode:r,algorithms:o.SignatureAlgorithm},n=e=>Promise.resolve().then(()=>o.exportJWK(e)),m=e=>Promise.resolve().then(()=>o.importJWK(e)),c=e=>Promise.resolve().then(()=>o.toPublicJWK(e)),l=(e,t="sha256")=>Promise.resolve().then(()=>o.getJWKThumbprint(e,t)),W=(e,t)=>Promise.resolve().then(()=>o.JWKSToKeyObject(e,t)),K=e=>Promise.resolve().then(()=>o.normalizeJWKS(e)),h=e=>Promise.resolve().then(()=>o.computeX5T(e)),u=(...e)=>Promise.resolve().then(()=>o.fromWeb(...e)),P={export:n,import:m,toPublic:c,thumbprint:l,computeX5T:h},a={toKeyObject:W,normalize:K,fromWeb:u};exports.SignatureAlgorithm=o.SignatureAlgorithm;exports.SupportedAlgorithms=o.SupportedAlgorithms;exports.JWK=P;exports.JWKS=a;exports.JWKSToKeyObject=W;exports.JWT=b;exports.computeX5T=h;exports.decode=r;exports.exportJWK=n;exports.fromWeb=u;exports.getJWKThumbprint=l;exports.importJWK=m;exports.normalizeJWKS=K;exports.sign=i;exports.toPublicJWK=c;exports.verify=s;
-//# sourceMappingURL=promises.cjs.map
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./index.cjs");var t=t=>Promise.resolve().then(()=>e.decode(t)),n=(...t)=>Promise.resolve().then(()=>e.sign(...t)),r=(...t)=>Promise.resolve().then(()=>{let n=e.verify(...t);if(`error`in n)throw n.error;let{header:r,payload:i,signature:a}=n;return{header:r,payload:i,signature:a}}),i={sign:n,verify:r,decode:t,algorithms:e.SignatureAlgorithm},a=t=>Promise.resolve().then(()=>e.exportJWK(t)),o=t=>Promise.resolve().then(()=>e.importJWK(t)),s=t=>Promise.resolve().then(()=>e.toPublicJWK(t)),c=(t,n=`sha256`)=>Promise.resolve().then(()=>e.getJWKThumbprint(t,n)),l=(t,n)=>Promise.resolve().then(()=>e.JWKSToKeyObject(t,n)),u=t=>Promise.resolve().then(()=>e.normalizeJWKS(t)),d=t=>Promise.resolve().then(()=>e.computeX5T(t)),f=(...t)=>Promise.resolve().then(()=>e.fromWeb(...t)),p={export:a,import:o,toPublic:s,thumbprint:c,computeX5T:d},m={toKeyObject:l,normalize:u,fromWeb:f};exports.JWK=p,exports.JWKS=m,exports.JWKSToKeyObject=l,exports.JWT=i,exports.SignatureAlgorithm=e.SignatureAlgorithm,exports.SupportedAlgorithms=e.SupportedAlgorithms,exports.computeX5T=d,exports.decode=t,exports.exportJWK=a,exports.fromWeb=f,exports.getJWKThumbprint=c,exports.importJWK=o,exports.normalizeJWKS=u,exports.sign=n,exports.toPublicJWK=s,exports.verify=r;
+//# sourceMappingURL=promises.cjs.map

package/dist/promises.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"promises.cjs","sources":["../src/jwt/promises.ts","../src/jwks/promises.ts"],"sourcesContent":["import {\n    type JWT as JSONWebToken,\n    decode as decodeSync,\n    sign as signSync,\n    verify as verifySync,\n    JWTPayload,\n    JWTHeader,\n    SignatureAlgorithm\n} from '../index.js';\n\nexport {\n    type SupportedAlgorithm, SupportedAlgorithms, SignatureAlgorithm, type JWTHeader, type JWTPayload\n} from '../index.js';\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): Promise<JSONWebToken> =>\n    Promise.resolve().then(() => decodeSync(token));\n\n/**\n * Sign a JWT\n * @see(synchronous parameters)\n */\nexport const sign = (...args: Parameters<typeof signSync>): Promise<string> =>\n    Promise.resolve().then(() => signSync(...args));\n\n/**\n * Verify and validate a JWT\n * @throws { { reason: string; code: string } } if invalid\n */\nexport const verify = (...args: Parameters<typeof verifySync>): Promise<{\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string\n}> =>\n    Promise.resolve().then(() => {\n        const result = verifySync(...args);\n        if ('error' in result) {\n            throw result.error;\n        }\n        const {header, payload, signature} = result;\n        return {header, payload, signature};\n    });\n\nexport type JWT = JSONWebToken;\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n","import type {KeyObject} from 'crypto';\n\nimport {\n    type JWK as JWKType,\n    type JWKSResolver,\n    type JWKS as JSONWebKeySet,\n    exportJWK as exportJWKSYNC,\n    importJWK as importJWKSYNC,\n    toPublicJWK as toPublicJWKSYNC,\n    getJWKThumbprint as getJWKThumbprintSYNC,\n    JWKSToKeyObject as JWKSToKeyObjectSYNC,\n    normalizeJWKS as normalizeJWKSSYNC,\n    computeX5T as computeX5TSYNC,\n    fromWeb as fromWebSYNC\n} from './index.js';\n\n/**\n * Export a KeyObject to JWK\n * @param key\n */\nexport const exportJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => exportJWKSYNC(key));\n\n/**\n * Import a JWK to KeyObject\n * @param jwk\n */\nexport const importJWK = (jwk: JWKType): Promise<KeyObject> =>\n    Promise.resolve().then(() => importJWKSYNC(jwk));\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport const toPublicJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => toPublicJWKSYNC(key));\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport const getJWKThumbprint = (\n    jwk: JWKType,\n    hashAlg: 'sha256' = 'sha256'\n): Promise<string> =>\n    Promise.resolve().then(() => getJWKThumbprintSYNC(jwk, hashAlg));\n\n/**\n * Resolve a KeyObject from a JWKS (kid-based)\n * @param jwks\n * @param kid\n * @constructor\n */\nexport const JWKSToKeyObject = (\n    jwks: JSONWebKeySet,\n    kid?: string\n): Promise<KeyObject> =>\n    Promise.resolve().then(() => JWKSToKeyObjectSYNC(jwks, kid));\n\n/**\n * Normalize JWKS (auto-generate missing kid values)\n * @param jwks\n */\nexport const normalizeJWKS = (\n    jwks: JSONWebKeySet\n): Promise<JSONWebKeySet> =>\n    Promise.resolve().then(() => normalizeJWKSSYNC(jwks));\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport const computeX5T = (jwk: JWKType): Promise<string | undefined> =>\n    Promise.resolve().then(() => computeX5TSYNC(jwk));\n\n/**\n * Load and resolve JWKS from a remote endpoint\n * @param args\n */\nexport const fromWeb = (\n    ...args: Parameters<typeof fromWebSYNC>\n): Promise<JWKSResolver> =>\n    Promise.resolve().then(() => fromWebSYNC(...args));\n\n//namespaced exports\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n    computeX5T: computeX5T,\n};\n\n//namespaced exports\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS,\n    fromWeb,\n};\n"],"names":["decode","token","decodeSync","sign","args","signSync","verify","result","verifySync","header","payload","signature","JWT","SignatureAlgorithm","exportJWK","key","exportJWKSYNC","importJWK","jwk","importJWKSYNC","toPublicJWK","toPublicJWKSYNC","getJWKThumbprint","hashAlg","getJWKThumbprintSYNC","JWKSToKeyObject","jwks","kid","JWKSToKeyObjectSYNC","normalizeJWKS","normalizeJWKSSYNC","computeX5T","computeX5TSYNC","fromWeb","fromWebSYNC","JWK","JWKS"],"mappings":"0IAkBO,MAAMA,EAAUC,GACnB,QAAQ,QAAA,EAAU,KAAK,IAAMC,EAAAA,OAAWD,CAAK,CAAC,EAMrCE,EAAO,IAAIC,IACpB,QAAQ,QAAA,EAAU,KAAK,IAAMC,OAAS,GAAGD,CAAI,CAAC,EAMrCE,EAAS,IAAIF,IAKtB,QAAQ,QAAA,EAAU,KAAK,IAAM,CACzB,MAAMG,EAASC,SAAW,GAAGJ,CAAI,EACjC,GAAI,UAAWG,EACX,MAAMA,EAAO,MAEjB,KAAM,CAAC,OAAAE,EAAQ,QAAAC,EAAS,UAAAC,CAAA,EAAaJ,EACrC,MAAO,CAAC,OAAAE,EAAQ,QAAAC,EAAS,UAAAC,CAAA,CAC7B,CAAC,EAKQC,EAAM,CACf,KAAAT,EACA,OAAAG,EACA,OAAAN,EACA,WAAYa,EAAAA,kBAChB,EClCaC,EAAaC,GACtB,QAAQ,QAAA,EAAU,KAAK,IAAMC,EAAAA,UAAcD,CAAG,CAAC,EAMtCE,EAAaC,GACtB,QAAQ,QAAA,EAAU,KAAK,IAAMC,EAAAA,UAAcD,CAAG,CAAC,EAMtCE,EAAeL,GACxB,QAAQ,QAAA,EAAU,KAAK,IAAMM,EAAAA,YAAgBN,CAAG,CAAC,EAOxCO,EAAmB,CAC5BJ,EACAK,EAAoB,WAEpB,QAAQ,QAAA,EAAU,KAAK,IAAMC,mBAAqBN,EAAKK,CAAO,CAAC,EAQtDE,EAAkB,CAC3BC,EACAC,IAEA,QAAQ,UAAU,KAAK,IAAMC,EAAAA,gBAAoBF,EAAMC,CAAG,CAAC,EAMlDE,EACTH,GAEA,QAAQ,QAAA,EAAU,KAAK,IAAMI,EAAAA,cAAkBJ,CAAI,CAAC,EAM3CK,EAAcb,GACvB,QAAQ,QAAA,EAAU,KAAK,IAAMc,EAAAA,WAAed,CAAG,CAAC,EAMvCe,EAAU,IAChB7B,IAEH,QAAQ,QAAA,EAAU,KAAK,IAAM8B,UAAY,GAAG9B,CAAI,CAAC,EAGxC+B,EAAM,CACf,OAAQrB,EACR,OAAQG,EACR,SAAUG,EACV,WAAYE,EACZ,WAAAS,CACJ,EAGaK,EAAO,CAChB,YAAaX,EACb,UAAWI,EACX,QAAAI,CACJ"}
+{"version":3,"file":"promises.cjs","names":[],"sources":["../src/jwt/promises.ts","../src/jwks/promises.ts"],"sourcesContent":["import {\n    type JWT as JSONWebToken,\n    decode as decodeSync,\n    sign as signSync,\n    verify as verifySync,\n    JWTPayload,\n    JWTHeader,\n    SignatureAlgorithm\n} from '../index.js';\n\nexport {\n    type SupportedAlgorithm, SupportedAlgorithms, SignatureAlgorithm, type JWTHeader, type JWTPayload\n} from '../index.js';\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): Promise<JSONWebToken> =>\n    Promise.resolve().then(() => decodeSync(token));\n\n/**\n * Sign a JWT\n * @see(synchronous parameters)\n */\nexport const sign = (...args: Parameters<typeof signSync>): Promise<string> =>\n    Promise.resolve().then(() => signSync(...args));\n\n/**\n * Verify and validate a JWT\n * @throws { { reason: string; code: string } } if invalid\n */\nexport const verify = (...args: Parameters<typeof verifySync>): Promise<{\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string\n}> =>\n    Promise.resolve().then(() => {\n        const result = verifySync(...args);\n        if ('error' in result) {\n            throw result.error;\n        }\n        const {header, payload, signature} = result;\n        return {header, payload, signature};\n    });\n\nexport type JWT = JSONWebToken;\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n","import type {KeyObject} from 'crypto';\n\nimport {\n    type JWK as JWKType,\n    type JWKSResolver,\n    type JWKS as JSONWebKeySet,\n    exportJWK as exportJWKSYNC,\n    importJWK as importJWKSYNC,\n    toPublicJWK as toPublicJWKSYNC,\n    getJWKThumbprint as getJWKThumbprintSYNC,\n    JWKSToKeyObject as JWKSToKeyObjectSYNC,\n    normalizeJWKS as normalizeJWKSSYNC,\n    computeX5T as computeX5TSYNC,\n    fromWeb as fromWebSYNC\n} from './index.js';\n\n/**\n * Export a KeyObject to JWK\n * @param key\n */\nexport const exportJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => exportJWKSYNC(key));\n\n/**\n * Import a JWK to KeyObject\n * @param jwk\n */\nexport const importJWK = (jwk: JWKType): Promise<KeyObject> =>\n    Promise.resolve().then(() => importJWKSYNC(jwk));\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport const toPublicJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => toPublicJWKSYNC(key));\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport const getJWKThumbprint = (\n    jwk: JWKType,\n    hashAlg: 'sha256' = 'sha256'\n): Promise<string> =>\n    Promise.resolve().then(() => getJWKThumbprintSYNC(jwk, hashAlg));\n\n/**\n * Resolve a KeyObject from a JWKS (kid-based)\n * @param jwks\n * @param kid\n * @constructor\n */\nexport const JWKSToKeyObject = (\n    jwks: JSONWebKeySet,\n    kid?: string\n): Promise<KeyObject> =>\n    Promise.resolve().then(() => JWKSToKeyObjectSYNC(jwks, kid));\n\n/**\n * Normalize JWKS (auto-generate missing kid values)\n * @param jwks\n */\nexport const normalizeJWKS = (\n    jwks: JSONWebKeySet\n): Promise<JSONWebKeySet> =>\n    Promise.resolve().then(() => normalizeJWKSSYNC(jwks));\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport const computeX5T = (jwk: JWKType): Promise<string | undefined> =>\n    Promise.resolve().then(() => computeX5TSYNC(jwk));\n\n/**\n * Load and resolve JWKS from a remote endpoint\n * @param args\n */\nexport const fromWeb = (\n    ...args: Parameters<typeof fromWebSYNC>\n): Promise<JWKSResolver> =>\n    Promise.resolve().then(() => fromWebSYNC(...args));\n\n//namespaced exports\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n    computeX5T: computeX5T,\n};\n\n//namespaced exports\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS,\n    fromWeb,\n};\n"],"mappings":"kGAkBA,IAAa,EAAU,GACnB,QAAQ,QAAQ,CAAC,CAAC,SAAW,EAAA,OAAW,CAAK,CAAC,EAMrC,GAAQ,GAAG,IACpB,QAAQ,QAAQ,CAAC,CAAC,SAAW,EAAA,KAAS,GAAG,CAAI,CAAC,EAMrC,GAAU,GAAG,IAKtB,QAAQ,QAAQ,CAAC,CAAC,SAAW,CACzB,IAAM,EAAS,EAAA,OAAW,GAAG,CAAI,EACjC,GAAI,UAAW,EACX,MAAM,EAAO,MAEjB,GAAM,CAAC,SAAQ,UAAS,aAAa,EACrC,MAAO,CAAC,SAAQ,UAAS,WAAS,CACtC,CAAC,EAKQ,EAAM,CACf,OACA,SACA,SACA,WAAY,EAAA,kBAChB,EClCa,EAAa,GACtB,QAAQ,QAAQ,CAAC,CAAC,SAAW,EAAA,UAAc,CAAG,CAAC,EAMtC,EAAa,GACtB,QAAQ,QAAQ,CAAC,CAAC,SAAW,EAAA,UAAc,CAAG,CAAC,EAMtC,EAAe,GACxB,QAAQ,QAAQ,CAAC,CAAC,SAAW,EAAA,YAAgB,CAAG,CAAC,EAOxC,GACT,EACA,EAAoB,WAEpB,QAAQ,QAAQ,CAAC,CAAC,SAAW,EAAA,iBAAqB,EAAK,CAAO,CAAC,EAQtD,GACT,EACA,IAEA,QAAQ,QAAQ,CAAC,CAAC,SAAW,EAAA,gBAAoB,EAAM,CAAG,CAAC,EAMlD,EACT,GAEA,QAAQ,QAAQ,CAAC,CAAC,SAAW,EAAA,cAAkB,CAAI,CAAC,EAM3C,EAAc,GACvB,QAAQ,QAAQ,CAAC,CAAC,SAAW,EAAA,WAAe,CAAG,CAAC,EAMvC,GACT,GAAG,IAEH,QAAQ,QAAQ,CAAC,CAAC,SAAW,EAAA,QAAY,GAAG,CAAI,CAAC,EAGxC,EAAM,CACf,OAAQ,EACR,OAAQ,EACR,SAAU,EACV,WAAY,EACA,YAChB,EAGa,EAAO,CAChB,YAAa,EACb,UAAW,EACX,SACJ"}

package/dist/promises.js

@@ -1,44 +1,31 @@
-import { S as n, g as i, v as m, s as c, f as a, j as l, t as h, k as p, h as K, i as W, l as J, b as v } from "./index-Cp1eA1Xq.js";
-import { d as q } from "./index-Cp1eA1Xq.js";
-import "crypto";
-const P = (e) => Promise.resolve().then(() => i(e)), u = (...e) => Promise.resolve().then(() => c(...e)), b = (...e) => Promise.resolve().then(() => {
-  const o = m(...e);
-  if ("error" in o)
-    throw o.error;
-  const { header: t, payload: r, signature: s } = o;
-  return { header: t, payload: r, signature: s };
-}), O = {
-  sign: u,
-  verify: b,
-  decode: P,
-  algorithms: n
-}, $ = (e) => Promise.resolve().then(() => K(e)), g = (e) => Promise.resolve().then(() => p(e)), d = (e) => Promise.resolve().then(() => h(e)), f = (e, o = "sha256") => Promise.resolve().then(() => l(e, o)), S = (e, o) => Promise.resolve().then(() => v(e, o)), T = (e) => Promise.resolve().then(() => J(e)), y = (e) => Promise.resolve().then(() => a(e)), x = (...e) => Promise.resolve().then(() => W(...e)), A = {
-  export: $,
-  import: g,
-  toPublic: d,
-  thumbprint: f,
-  computeX5T: y
-}, X = {
-  toKeyObject: S,
-  normalize: T,
-  fromWeb: x
+import { JWKSToKeyObject as e, SignatureAlgorithm as t, SupportedAlgorithms as n, computeX5T as r, decode as i, exportJWK as a, fromWeb as o, getJWKThumbprint as s, importJWK as c, normalizeJWKS as l, sign as u, toPublicJWK as d, verify as f } from "./index.js";
+//#region src/jwt/promises.ts
+var p = (e) => Promise.resolve().then(() => i(e)), m = (...e) => Promise.resolve().then(() => u(...e)), h = (...e) => Promise.resolve().then(() => {
+	let t = f(...e);
+	if ("error" in t) throw t.error;
+	let { header: n, payload: r, signature: i } = t;
+	return {
+		header: n,
+		payload: r,
+		signature: i
+	};
+}), g = {
+	sign: m,
+	verify: h,
+	decode: p,
+	algorithms: t
+}, _ = (e) => Promise.resolve().then(() => a(e)), v = (e) => Promise.resolve().then(() => c(e)), y = (e) => Promise.resolve().then(() => d(e)), b = (e, t = "sha256") => Promise.resolve().then(() => s(e, t)), x = (t, n) => Promise.resolve().then(() => e(t, n)), S = (e) => Promise.resolve().then(() => l(e)), C = (e) => Promise.resolve().then(() => r(e)), w = (...e) => Promise.resolve().then(() => o(...e)), T = {
+	export: _,
+	import: v,
+	toPublic: y,
+	thumbprint: b,
+	computeX5T: C
+}, E = {
+	toKeyObject: x,
+	normalize: S,
+	fromWeb: w
 };
-export {
-  A as JWK,
-  X as JWKS,
-  S as JWKSToKeyObject,
-  O as JWT,
-  n as SignatureAlgorithm,
-  q as SupportedAlgorithms,
-  y as computeX5T,
-  P as decode,
-  $ as exportJWK,
-  x as fromWeb,
-  f as getJWKThumbprint,
-  g as importJWK,
-  T as normalizeJWKS,
-  u as sign,
-  d as toPublicJWK,
-  b as verify
-};
-//# sourceMappingURL=promises.js.map
+//#endregion
+export { T as JWK, E as JWKS, x as JWKSToKeyObject, g as JWT, t as SignatureAlgorithm, n as SupportedAlgorithms, C as computeX5T, p as decode, _ as exportJWK, w as fromWeb, b as getJWKThumbprint, v as importJWK, S as normalizeJWKS, m as sign, y as toPublicJWK, h as verify };
+
+//# sourceMappingURL=promises.js.map

package/dist/promises.js.map

@@ -1 +1 @@
-{"version":3,"file":"promises.js","sources":["../src/jwt/promises.ts","../src/jwks/promises.ts"],"sourcesContent":["import {\n    type JWT as JSONWebToken,\n    decode as decodeSync,\n    sign as signSync,\n    verify as verifySync,\n    JWTPayload,\n    JWTHeader,\n    SignatureAlgorithm\n} from '../index.js';\n\nexport {\n    type SupportedAlgorithm, SupportedAlgorithms, SignatureAlgorithm, type JWTHeader, type JWTPayload\n} from '../index.js';\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): Promise<JSONWebToken> =>\n    Promise.resolve().then(() => decodeSync(token));\n\n/**\n * Sign a JWT\n * @see(synchronous parameters)\n */\nexport const sign = (...args: Parameters<typeof signSync>): Promise<string> =>\n    Promise.resolve().then(() => signSync(...args));\n\n/**\n * Verify and validate a JWT\n * @throws { { reason: string; code: string } } if invalid\n */\nexport const verify = (...args: Parameters<typeof verifySync>): Promise<{\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string\n}> =>\n    Promise.resolve().then(() => {\n        const result = verifySync(...args);\n        if ('error' in result) {\n            throw result.error;\n        }\n        const {header, payload, signature} = result;\n        return {header, payload, signature};\n    });\n\nexport type JWT = JSONWebToken;\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n","import type {KeyObject} from 'crypto';\n\nimport {\n    type JWK as JWKType,\n    type JWKSResolver,\n    type JWKS as JSONWebKeySet,\n    exportJWK as exportJWKSYNC,\n    importJWK as importJWKSYNC,\n    toPublicJWK as toPublicJWKSYNC,\n    getJWKThumbprint as getJWKThumbprintSYNC,\n    JWKSToKeyObject as JWKSToKeyObjectSYNC,\n    normalizeJWKS as normalizeJWKSSYNC,\n    computeX5T as computeX5TSYNC,\n    fromWeb as fromWebSYNC\n} from './index.js';\n\n/**\n * Export a KeyObject to JWK\n * @param key\n */\nexport const exportJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => exportJWKSYNC(key));\n\n/**\n * Import a JWK to KeyObject\n * @param jwk\n */\nexport const importJWK = (jwk: JWKType): Promise<KeyObject> =>\n    Promise.resolve().then(() => importJWKSYNC(jwk));\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport const toPublicJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => toPublicJWKSYNC(key));\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport const getJWKThumbprint = (\n    jwk: JWKType,\n    hashAlg: 'sha256' = 'sha256'\n): Promise<string> =>\n    Promise.resolve().then(() => getJWKThumbprintSYNC(jwk, hashAlg));\n\n/**\n * Resolve a KeyObject from a JWKS (kid-based)\n * @param jwks\n * @param kid\n * @constructor\n */\nexport const JWKSToKeyObject = (\n    jwks: JSONWebKeySet,\n    kid?: string\n): Promise<KeyObject> =>\n    Promise.resolve().then(() => JWKSToKeyObjectSYNC(jwks, kid));\n\n/**\n * Normalize JWKS (auto-generate missing kid values)\n * @param jwks\n */\nexport const normalizeJWKS = (\n    jwks: JSONWebKeySet\n): Promise<JSONWebKeySet> =>\n    Promise.resolve().then(() => normalizeJWKSSYNC(jwks));\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport const computeX5T = (jwk: JWKType): Promise<string | undefined> =>\n    Promise.resolve().then(() => computeX5TSYNC(jwk));\n\n/**\n * Load and resolve JWKS from a remote endpoint\n * @param args\n */\nexport const fromWeb = (\n    ...args: Parameters<typeof fromWebSYNC>\n): Promise<JWKSResolver> =>\n    Promise.resolve().then(() => fromWebSYNC(...args));\n\n//namespaced exports\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n    computeX5T: computeX5T,\n};\n\n//namespaced exports\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS,\n    fromWeb,\n};\n"],"names":["decode","token","decodeSync","sign","args","signSync","verify","result","verifySync","header","payload","signature","JWT","SignatureAlgorithm","exportJWK","key","exportJWKSYNC","importJWK","jwk","importJWKSYNC","toPublicJWK","toPublicJWKSYNC","getJWKThumbprint","hashAlg","getJWKThumbprintSYNC","JWKSToKeyObject","jwks","kid","JWKSToKeyObjectSYNC","normalizeJWKS","normalizeJWKSSYNC","computeX5T","computeX5TSYNC","fromWeb","fromWebSYNC","JWK","JWKS"],"mappings":";;;AAkBO,MAAMA,IAAS,CAACC,MACnB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAWD,CAAK,CAAC,GAMrCE,IAAO,IAAIC,MACpB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAS,GAAGD,CAAI,CAAC,GAMrCE,IAAS,IAAIF,MAKtB,QAAQ,QAAA,EAAU,KAAK,MAAM;AACzB,QAAMG,IAASC,EAAW,GAAGJ,CAAI;AACjC,MAAI,WAAWG;AACX,UAAMA,EAAO;AAEjB,QAAM,EAAC,QAAAE,GAAQ,SAAAC,GAAS,WAAAC,EAAA,IAAaJ;AACrC,SAAO,EAAC,QAAAE,GAAQ,SAAAC,GAAS,WAAAC,EAAA;AAC7B,CAAC,GAKQC,IAAM;AAAA,EACf,MAAAT;AAAA,EACA,QAAAG;AAAA,EACA,QAAAN;AAAA,EACA,YAAYa;AAChB,GClCaC,IAAY,CAACC,MACtB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAcD,CAAG,CAAC,GAMtCE,IAAY,CAACC,MACtB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAcD,CAAG,CAAC,GAMtCE,IAAc,CAACL,MACxB,QAAQ,QAAA,EAAU,KAAK,MAAMM,EAAgBN,CAAG,CAAC,GAOxCO,IAAmB,CAC5BJ,GACAK,IAAoB,aAEpB,QAAQ,QAAA,EAAU,KAAK,MAAMC,EAAqBN,GAAKK,CAAO,CAAC,GAQtDE,IAAkB,CAC3BC,GACAC,MAEA,QAAQ,UAAU,KAAK,MAAMC,EAAoBF,GAAMC,CAAG,CAAC,GAMlDE,IAAgB,CACzBH,MAEA,QAAQ,QAAA,EAAU,KAAK,MAAMI,EAAkBJ,CAAI,CAAC,GAM3CK,IAAa,CAACb,MACvB,QAAQ,QAAA,EAAU,KAAK,MAAMc,EAAed,CAAG,CAAC,GAMvCe,IAAU,IAChB7B,MAEH,QAAQ,QAAA,EAAU,KAAK,MAAM8B,EAAY,GAAG9B,CAAI,CAAC,GAGxC+B,IAAM;AAAA,EACf,QAAQrB;AAAA,EACR,QAAQG;AAAA,EACR,UAAUG;AAAA,EACV,YAAYE;AAAA,EACZ,YAAAS;AACJ,GAGaK,IAAO;AAAA,EAChB,aAAaX;AAAA,EACb,WAAWI;AAAA,EACX,SAAAI;AACJ;"}
+{"version":3,"file":"promises.js","names":[],"sources":["../src/jwt/promises.ts","../src/jwks/promises.ts"],"sourcesContent":["import {\n    type JWT as JSONWebToken,\n    decode as decodeSync,\n    sign as signSync,\n    verify as verifySync,\n    JWTPayload,\n    JWTHeader,\n    SignatureAlgorithm\n} from '../index.js';\n\nexport {\n    type SupportedAlgorithm, SupportedAlgorithms, SignatureAlgorithm, type JWTHeader, type JWTPayload\n} from '../index.js';\n\n/**\n * Decode a JWT string into its parts (without verification)\n * @param token\n */\nexport const decode = (token: string): Promise<JSONWebToken> =>\n    Promise.resolve().then(() => decodeSync(token));\n\n/**\n * Sign a JWT\n * @see(synchronous parameters)\n */\nexport const sign = (...args: Parameters<typeof signSync>): Promise<string> =>\n    Promise.resolve().then(() => signSync(...args));\n\n/**\n * Verify and validate a JWT\n * @throws { { reason: string; code: string } } if invalid\n */\nexport const verify = (...args: Parameters<typeof verifySync>): Promise<{\n    header: JWTHeader;\n    payload: JWTPayload;\n    signature: string\n}> =>\n    Promise.resolve().then(() => {\n        const result = verifySync(...args);\n        if ('error' in result) {\n            throw result.error;\n        }\n        const {header, payload, signature} = result;\n        return {header, payload, signature};\n    });\n\nexport type JWT = JSONWebToken;\n\n//namespace export\nexport const JWT = {\n    sign,\n    verify,\n    decode,\n    algorithms: SignatureAlgorithm\n};\n","import type {KeyObject} from 'crypto';\n\nimport {\n    type JWK as JWKType,\n    type JWKSResolver,\n    type JWKS as JSONWebKeySet,\n    exportJWK as exportJWKSYNC,\n    importJWK as importJWKSYNC,\n    toPublicJWK as toPublicJWKSYNC,\n    getJWKThumbprint as getJWKThumbprintSYNC,\n    JWKSToKeyObject as JWKSToKeyObjectSYNC,\n    normalizeJWKS as normalizeJWKSSYNC,\n    computeX5T as computeX5TSYNC,\n    fromWeb as fromWebSYNC\n} from './index.js';\n\n/**\n * Export a KeyObject to JWK\n * @param key\n */\nexport const exportJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => exportJWKSYNC(key));\n\n/**\n * Import a JWK to KeyObject\n * @param jwk\n */\nexport const importJWK = (jwk: JWKType): Promise<KeyObject> =>\n    Promise.resolve().then(() => importJWKSYNC(jwk));\n\n/**\n * Export public-only JWK\n * @param key\n */\nexport const toPublicJWK = (key: KeyObject): Promise<JWKType> =>\n    Promise.resolve().then(() => toPublicJWKSYNC(key));\n\n/**\n * RFC 7638 JWK thumbprint\n * @param jwk\n * @param hashAlg\n */\nexport const getJWKThumbprint = (\n    jwk: JWKType,\n    hashAlg: 'sha256' = 'sha256'\n): Promise<string> =>\n    Promise.resolve().then(() => getJWKThumbprintSYNC(jwk, hashAlg));\n\n/**\n * Resolve a KeyObject from a JWKS (kid-based)\n * @param jwks\n * @param kid\n * @constructor\n */\nexport const JWKSToKeyObject = (\n    jwks: JSONWebKeySet,\n    kid?: string\n): Promise<KeyObject> =>\n    Promise.resolve().then(() => JWKSToKeyObjectSYNC(jwks, kid));\n\n/**\n * Normalize JWKS (auto-generate missing kid values)\n * @param jwks\n */\nexport const normalizeJWKS = (\n    jwks: JSONWebKeySet\n): Promise<JSONWebKeySet> =>\n    Promise.resolve().then(() => normalizeJWKSSYNC(jwks));\n\n/**\n * Compute x5t (SHA-1) from first cert in x5c if not set\n * @param jwk\n */\nexport const computeX5T = (jwk: JWKType): Promise<string | undefined> =>\n    Promise.resolve().then(() => computeX5TSYNC(jwk));\n\n/**\n * Load and resolve JWKS from a remote endpoint\n * @param args\n */\nexport const fromWeb = (\n    ...args: Parameters<typeof fromWebSYNC>\n): Promise<JWKSResolver> =>\n    Promise.resolve().then(() => fromWebSYNC(...args));\n\n//namespaced exports\nexport const JWK = {\n    export: exportJWK,\n    import: importJWK,\n    toPublic: toPublicJWK,\n    thumbprint: getJWKThumbprint,\n    computeX5T: computeX5T,\n};\n\n//namespaced exports\nexport const JWKS = {\n    toKeyObject: JWKSToKeyObject,\n    normalize: normalizeJWKS,\n    fromWeb,\n};\n"],"mappings":";;AAkBA,IAAa,KAAU,MACnB,QAAQ,QAAQ,CAAC,CAAC,WAAW,EAAW,CAAK,CAAC,GAMrC,KAAQ,GAAG,MACpB,QAAQ,QAAQ,CAAC,CAAC,WAAW,EAAS,GAAG,CAAI,CAAC,GAMrC,KAAU,GAAG,MAKtB,QAAQ,QAAQ,CAAC,CAAC,WAAW;CACzB,IAAM,IAAS,EAAW,GAAG,CAAI;CACjC,IAAI,WAAW,GACX,MAAM,EAAO;CAEjB,IAAM,EAAC,WAAQ,YAAS,iBAAa;CACrC,OAAO;EAAC;EAAQ;EAAS;CAAS;AACtC,CAAC,GAKQ,IAAM;CACf;CACA;CACA;CACA,YAAY;AAChB,GClCa,KAAa,MACtB,QAAQ,QAAQ,CAAC,CAAC,WAAW,EAAc,CAAG,CAAC,GAMtC,KAAa,MACtB,QAAQ,QAAQ,CAAC,CAAC,WAAW,EAAc,CAAG,CAAC,GAMtC,KAAe,MACxB,QAAQ,QAAQ,CAAC,CAAC,WAAW,EAAgB,CAAG,CAAC,GAOxC,KACT,GACA,IAAoB,aAEpB,QAAQ,QAAQ,CAAC,CAAC,WAAW,EAAqB,GAAK,CAAO,CAAC,GAQtD,KACT,GACA,MAEA,QAAQ,QAAQ,CAAC,CAAC,WAAW,EAAoB,GAAM,CAAG,CAAC,GAMlD,KACT,MAEA,QAAQ,QAAQ,CAAC,CAAC,WAAW,EAAkB,CAAI,CAAC,GAM3C,KAAc,MACvB,QAAQ,QAAQ,CAAC,CAAC,WAAW,EAAe,CAAG,CAAC,GAMvC,KACT,GAAG,MAEH,QAAQ,QAAQ,CAAC,CAAC,WAAW,EAAY,GAAG,CAAI,CAAC,GAGxC,IAAM;CACf,QAAQ;CACR,QAAQ;CACR,UAAU;CACV,YAAY;CACA;AAChB,GAGa,IAAO;CAChB,aAAa;CACb,WAAW;CACX;AACJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/node-jwt",
-  "version": "1.5.10",
+  "version": "1.6.0",
   "description": "A lightweight, zero-dependency TypeScript library for creating, verifying and decoding JSON Web Tokens (JWT).",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -63,15 +63,15 @@
     "@semantic-release/commit-analyzer": "^13.0.1",
     "@semantic-release/git": "^10.0.1",
     "@semantic-release/npm": "^13.1.5",
-    "@semantic-release/release-notes-generator": "^14.0.3",
-    "@sourceregistry/semantic-release-jsr": "^1.0.1",
-    "@types/node": "^25.3.3",
-    "@vitest/coverage-v8": "^4.0.18",
-    "@vitest/ui": "^4.0.18",
-    "typedoc": "^0.28.17",
-    "typescript": "^5.9.3",
-    "vite": "^7.3.1",
-    "vite-plugin-dts": "^4.5.4",
+    "@semantic-release/release-notes-generator": "^14.1.1",
+    "@sourceregistry/semantic-release-jsr": "^1.1.1",
+    "@types/node": "^26.4.0",
+    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/ui": "^4.1.11",
+    "typedoc": "^0.28.20",
+    "typescript": "^6.0.3",
+    "vite": "^8.2.2",
+    "vite-plugin-dts": "^5.0.3",
     "vitest": "^4.0.18"
   },
   "release": {

package/dist/index-CaEvPIqc.cjs

@@ -1,2 +0,0 @@
-"use strict";const l=require("crypto"),K={encode:e=>Buffer.from(e).toString("base64url"),decode:e=>Buffer.from(e,"base64url").toString()},X=(e,t)=>e.length!==t.length?!1:l.timingSafeEqual(Buffer.from(e),Buffer.from(t)),D=/^[A-Za-z0-9_-]+$/;function $(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function T(e){return typeof e=="number"&&Number.isFinite(e)}function O(e){return Array.isArray(e)&&e.every(t=>typeof t=="string")}function Y(e){const t=[{claim:"iss",valid:e.iss===void 0||typeof e.iss=="string",expected:"string"},{claim:"sub",valid:e.sub===void 0||typeof e.sub=="string",expected:"string"},{claim:"jti",valid:e.jti===void 0||typeof e.jti=="string",expected:"string"},{claim:"sid",valid:e.sid===void 0||typeof e.sid=="string",expected:"string"},{claim:"iat",valid:e.iat===void 0||T(e.iat),expected:"number"},{claim:"exp",valid:e.exp===void 0||T(e.exp),expected:"number"},{claim:"nbf",valid:e.nbf===void 0||T(e.nbf),expected:"number"}];for(const r of t)if(!r.valid)return{reason:`Invalid "${r.claim}" claim: expected ${r.expected}`,code:"INVALID_CLAIM"};return e.aud!==void 0&&!(typeof e.aud=="string"||O(e.aud))?{reason:'Invalid "aud" claim: expected string or string[]',code:"INVALID_CLAIM"}:null}function Z(e){if(e.signatureFormat!==void 0&&e.signatureFormat!=="der"&&e.signatureFormat!=="jose")return{reason:'Invalid signatureFormat option: expected "der" or "jose"',code:"INVALID_OPTIONS"};if(e.clockSkew!==void 0&&(!T(e.clockSkew)||e.clockSkew<0))return{reason:"Invalid clockSkew option: expected a non-negative finite number",code:"INVALID_OPTIONS"};if(e.maxTokenAge!==void 0&&(!T(e.maxTokenAge)||e.maxTokenAge<0))return{reason:"Invalid maxTokenAge option: expected a non-negative finite number",code:"INVALID_OPTIONS"};if(e.issuer!==void 0&&typeof e.issuer!="string")return{reason:"Invalid issuer option: expected string",code:"INVALID_OPTIONS"};if(e.subject!==void 0&&typeof e.subject!="string")return{reason:"Invalid subject option: expected string",code:"INVALID_OPTIONS"};if(e.jwtId!==void 0&&typeof e.jwtId!="string")return{reason:"Invalid jwtId option: expected string",code:"INVALID_OPTIONS"};if(e.audience!==void 0&&!(typeof e.audience=="string"||O(e.audience)))return{reason:"Invalid audience option: expected string or string[]",code:"INVALID_OPTIONS"};if(e.algorithms!==void 0){if(!Array.isArray(e.algorithms))return{reason:"Invalid algorithms option: expected an array",code:"INVALID_OPTIONS"};const t=e.algorithms.find(r=>!(r in v));if(t)return{reason:`Invalid algorithms option: unsupported algorithm "${t}"`,code:"INVALID_OPTIONS"}}return null}function Q(e){return e.crit!==void 0?!O(e.crit)||e.crit.length===0?{reason:'Invalid "crit" header: expected non-empty string[]',code:"INVALID_HEADER"}:{reason:`Unsupported critical header parameters: ${e.crit.join(", ")}`,code:"UNSUPPORTED_CRITICAL_HEADER"}:null}function V(e){switch(e){case"ES256":case"ES256K":return 64;case"ES384":return 96;case"ES512":return 132;default:throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`)}}function ee(e,t){let r=0;if(e[r++]!==48)throw new Error("Invalid DER ECDSA signature");let n=e[r++];if(n&128){const d=n&127;n=0;for(let m=0;m<d;m++)n=n<<8|e[r++]}if(e[r++]!==2)throw new Error("Invalid DER ECDSA signature (r)");const a=e[r++];let c=e.subarray(r,r+a);if(r+=a,e[r++]!==2)throw new Error("Invalid DER ECDSA signature (s)");const o=e[r++];let i=e.subarray(r,r+o);for(;c.length>t/2&&c[0]===0;)c=c.subarray(1);for(;i.length>t/2&&i[0]===0;)i=i.subarray(1);const h=Buffer.concat([Buffer.alloc(t/2-c.length,0),c]),u=Buffer.concat([Buffer.alloc(t/2-i.length,0),i]);return Buffer.concat([h,u])}function R(e){const t=e.length/2;let r=e.subarray(0,t),n=e.subarray(t);for(;r.length>1&&r[0]===0&&(r[1]&128)===0;)r=r.subarray(1);for(;n.length>1&&n[0]===0&&(n[1]&128)===0;)n=n.subarray(1);r[0]&128&&(r=Buffer.concat([Buffer.from([0]),r])),n[0]&128&&(n=Buffer.concat([Buffer.from([0]),n]));const a=Buffer.concat([Buffer.from([2,r.length]),r]),c=Buffer.concat([Buffer.from([2,n.length]),n]),o=a.length+c.length;let i;if(o<128)i=Buffer.from([o]);else{const h=[];let u=o;for(;u>0;)h.unshift(u&255),u>>=8;i=Buffer.from([128|h.length,...h])}return Buffer.concat([Buffer.from([48]),i,a,c])}function W(e){return e==="ES256"||e==="ES384"||e==="ES512"||e==="ES256K"}const P=e=>({sign:(t,r)=>l.createHmac(e,r).update(t).digest("base64url"),verify:(t,r,n)=>{const a=l.createHmac(e,r).update(t).digest("base64url");return X(a,n)}}),E=e=>({sign:(t,r)=>l.createSign(e).update(t).end().sign(r).toString("base64url"),verify:(t,r,n)=>{try{return l.createVerify(e).update(t).end().verify(r,Buffer.from(n,"base64url"))}catch{return!1}}}),k=(e,t)=>({sign:(r,n)=>l.createSign(e).update(r).end().sign({key:n,padding:l.constants.RSA_PKCS1_PSS_PADDING,saltLength:t}).toString("base64url"),verify:(r,n,a)=>{try{return l.createVerify(e).update(r).end().verify({key:n,padding:l.constants.RSA_PKCS1_PSS_PADDING,saltLength:t},Buffer.from(a,"base64url"))}catch{return!1}}}),re={sign:(e,t)=>l.sign(null,typeof e=="string"?Buffer.from(e,"utf8"):e,t).toString("base64url"),verify:(e,t,r)=>{try{return l.verify(null,typeof e=="string"?Buffer.from(e,"utf8"):e,t,Buffer.from(r,"base64url"))}catch{return!1}}},v={HS256:P("sha256"),HS384:P("sha384"),HS512:P("sha512"),RS256:E("RSA-SHA256"),RS384:E("RSA-SHA384"),RS512:E("RSA-SHA512"),ES256:E("SHA256"),ES384:E("SHA384"),ES512:E("SHA512"),ES256K:E("SHA256"),PS256:k("RSA-SHA256",32),PS384:k("RSA-SHA384",48),PS512:k("RSA-SHA512",64),EdDSA:re},te=Object.keys(v);function L(e){if(e.type==="secret")return"HS256";if(e.type!=="private")throw new Error("Only private or symmetric keys can be used to sign JWTs");const t=e.asymmetricKeyType,r=e.asymmetricKeyDetails;switch(t){case"rsa":return"RS256";case"rsa-pss":{const n=(r==null?void 0:r.hashAlgorithm)??"sha256";switch(n){case"sha256":return"PS256";case"sha384":return"PS384";case"sha512":return"PS512";default:throw new Error(`Unsupported RSA-PSS hash algorithm: ${n}`)}}case"ec":{const n=r==null?void 0:r.namedCurve;switch(n){case"P-256":case"prime256v1":return"ES256";case"P-384":case"secp384r1":return"ES384";case"P-521":case"secp521r1":return"ES512";case"secp256k1":return"ES256K";default:throw new Error(`Unsupported EC curve: ${n}`)}}case"ed25519":return"EdDSA";default:throw new Error(`Unsupported asymmetric key type: ${t}`)}}function ne(e){if(typeof e=="object"&&"type"in e)return e;try{return l.createPrivateKey(e)}catch{const t=typeof e=="string"?Buffer.from(e,"utf8"):Buffer.isBuffer(e)?e:(()=>{throw new Error("Unsupported key type")})();return l.createSecretKey(t)}}const _=e=>{const t=e.split(".");if(t.length!==3)throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');const[r,n,a]=t;if(!r||!n||!a)throw new Error("Invalid JWT: empty part detected");if(!D.test(r)||!D.test(n)||!D.test(a))throw new Error("Invalid JWT: non-base64url characters detected");try{const c=JSON.parse(K.decode(r)),o=JSON.parse(K.decode(n));if(!$(c)||!$(o))throw new Error("header and payload must be JSON objects");const i=c,h=o;if(typeof i.alg!="string"||i.alg.length===0)throw new Error("header.alg must be a non-empty string");if(i.typ!==void 0&&typeof i.typ!="string")throw new Error("header.typ must be a string");if(i.kid!==void 0&&typeof i.kid!="string")throw new Error("header.kid must be a string");if(i.crit!==void 0&&(!O(i.crit)||i.crit.length===0))throw new Error("header.crit must be a non-empty string[]");return{header:i,payload:h,signature:a}}catch(c){throw new Error(`Invalid JWT: malformed header or payload (${c.message})`)}},U=(e,t,r={})=>{const n=ne(t),a=r.alg??L(n),c=r.signatureFormat??(W(a)?"jose":"der"),o=r.typ??"JWT";if(!(a in v))throw new Error(`Unsupported algorithm: ${a}`);const i={alg:a,typ:o};r.kid&&(i.kid=r.kid);const h=K.encode(JSON.stringify(i)),u=K.encode(JSON.stringify(e)),d=`${h}.${u}`;let m=v[a].sign(d,t);if(c==="jose"&&W(a)){const p=Buffer.from(m,"base64url");m=ee(p,V(a)).toString("base64url")}return`${h}.${u}.${m}`},j=(e,t,r={})=>{const n=Z(r);if(n)return{valid:!1,error:n};let a;try{a=_(e)}catch(s){return{valid:!1,error:{reason:s.message,code:"INVALID_TOKEN"}}}const{header:c,payload:o,signature:i}=a,h=Q(c);if(h)return{valid:!1,error:h};const u=Y(o);if(u)return{valid:!1,error:u};const d=c.alg;if(!(d in v))return{valid:!1,error:{reason:`Unsupported or unknown algorithm: ${c.alg}`,code:"INVALID_ALGORITHM"}};if(r.algorithms&&r.algorithms.length>0&&!r.algorithms.includes(d))return{valid:!1,error:{reason:`Algorithm "${d}" is not in the allowed algorithms list`,code:"ALGORITHM_NOT_ALLOWED"}};if(c.typ!==void 0&&c.typ!=="JWT")return{valid:!1,error:{reason:`Invalid token type: expected 'JWT', got '${c.typ}'`,code:"INVALID_TYPE"}};const[m,p]=e.split("."),I=`${m}.${p}`;if(W(d)){const s=r.signatureFormat;let f;if(s==="jose")try{const y=Buffer.from(i,"base64url"),S=R(y).toString("base64url");f=v[d].verify(I,t,S)}catch{f=!1}else if(s==="der")f=v[d].verify(I,t,i);else if(f=v[d].verify(I,t,i),!f)try{const y=Buffer.from(i,"base64url");if(y.length===V(d)){const S=R(y).toString("base64url");f=v[d].verify(I,t,S)}}catch{}if(!f)return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}}}else{let s=!1;try{s=v[d].verify(I,t,i)}catch{s=!1}if(!s)return{valid:!1,error:{reason:"Signature verification failed",code:"INVALID_SIGNATURE"}}}const A=Math.floor(Date.now()/1e3),g=r.clockSkew??0;if(!r.ignoreExpiration&&o.exp!==void 0&&A>o.exp+g)return{valid:!1,error:{reason:"Token expired",code:"TOKEN_EXPIRED"}};if(o.nbf!==void 0&&A+g<o.nbf)return{valid:!1,error:{reason:"Token not yet valid",code:"TOKEN_NOT_ACTIVE"}};if(o.iat!==void 0&&A+g<o.iat)return{valid:!1,error:{reason:"Token issued in the future",code:"TOKEN_FUTURE_ISSUED"}};if(r.maxTokenAge!==void 0&&o.iat!==void 0){const s=A-o.iat;if(s>r.maxTokenAge)return{valid:!1,error:{reason:`Token age (${s}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,code:"TOKEN_TOO_OLD"}}}if(r.issuer!==void 0){if(o.iss===void 0)return{valid:!1,error:{reason:'Token missing required issuer claim ("iss")',code:"MISSING_ISSUER"}};if(r.issuer!==o.iss)return{valid:!1,error:{reason:`Invalid token issuer: expected "${r.issuer}", got "${o.iss}"`,code:"INVALID_ISSUER"}}}if(r.subject!==void 0){if(o.sub===void 0)return{valid:!1,error:{reason:'Token missing required subject claim ("sub")',code:"MISSING_SUBJECT"}};if(r.subject!==o.sub)return{valid:!1,error:{reason:`Invalid token subject: expected "${r.subject}", got "${o.sub}"`,code:"INVALID_SUBJECT"}}}if(r.audience!==void 0){const s=o.aud;if(s===void 0)return{valid:!1,error:{reason:'Token missing required audience claim ("aud")',code:"MISSING_AUDIENCE"}};const f=Array.isArray(r.audience)?r.audience:[r.audience],y=Array.isArray(s)?s:[s];if(!f.some(b=>y.includes(b)))return{valid:!1,error:{reason:"Audience claim mismatch",code:"INVALID_AUDIENCE"}}}if(r.jwtId!==void 0){if(o.jti===void 0)return{valid:!1,error:{reason:'Token missing required JWT ID claim ("jti")',code:"MISSING_JTI"}};if(r.jwtId!==o.jti)return{valid:!1,error:{reason:`Invalid JWT ID: expected "${r.jwtId}", got "${o.jti}"`,code:"INVALID_JTI"}}}return{valid:!0,header:c,payload:o,signature:i}},ie={sign:U,verify:j,decode:_,algorithms:v};function H(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");return e.export({format:"jwk"})}function J(e){if(!e||typeof e!="object")throw new Error("Invalid JWK");switch(e.kty){case"oct":{if(!("k"in e)||typeof e.k!="string")throw new Error('Invalid oct JWK: missing "k"');return l.createSecretKey(Buffer.from(e.k,"base64url"))}case"RSA":case"EC":case"OKP":return"d"in e&&typeof e.d=="string"?l.createPrivateKey({format:"jwk",key:e}):l.createPublicKey({format:"jwk",key:e});default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}}function C(e){if(!e||typeof e!="object")throw new Error("Invalid KeyObject");const r=(e.type==="private"?l.createPublicKey(e):e).export({format:"jwk"});return delete r.d,delete r.p,delete r.q,delete r.dp,delete r.dq,delete r.qi,r}function B(e,t="sha256"){if(!e||typeof e!="object")throw new Error("Invalid JWK");let r;switch(e.kty){case"RSA":r={e:e.e,kty:e.kty,n:e.n};break;case"EC":r={crv:e.crv,kty:e.kty,x:e.x,y:e.y};break;case"OKP":r={crv:e.crv,kty:e.kty,x:e.x};break;case"oct":r={k:e.k,kty:e.kty};break;default:throw new Error(`Unsupported JWK key type: ${e.kty}`)}const n=JSON.stringify(Object.keys(r).sort().reduce((a,c)=>(a[c]=r[c],a),{}));return l.createHash(t).update(n).digest("base64url")}function M(e){var t;if((t=e.x5c)!=null&&t.length)return l.createHash("sha1").update(Buffer.from(e.x5c[0],"base64")).digest("base64url")}const ae={export:H,import:J,toPublic:C,thumbprint:B};function F(e,t){if(!e||!Array.isArray(e.keys))throw new Error("Invalid JWKS");let r;if(t&&(r=e.keys.find(n=>n.kid===t)),!r&&e.keys.length===1&&(r=e.keys[0]),!r)throw new Error("Key not found in JWKS");return J(r)}function N(e){return{keys:w(...e.keys)}}function w(...e){return e.map(t=>{const r={...t,kid:t.kid??B(t),x5t:t.x5t??M(t)};return Object.defineProperty(r,"toKeyObject",{enumerable:!1,configurable:!1,writable:!1,value:()=>J(r)}),r})}const G=async(e,t={})=>{const r=typeof e=="string"?e:e.toString(),n=t.fetch??globalThis.fetch,a=Math.max(0,t.ttl??5*6e4),c=Math.max(0,t.timeoutMs??5e3),o="/.well-known/jwks.json";if(!n)throw new Error("No fetch implementation available");const i=(()=>{if(t.endpointOverride){const g=t.endpointOverride;try{return new URL(g,r).toString()}catch{return g}}return t.overrideEndpointCheck||r.endsWith(o)?r:`${r.replace(/\/+$/,"")}${o}`})(),h=(()=>{if(t.cache)return t.cache;let g;return{get:()=>g,set:(s,f)=>{g=f}}})();let u,d=0,m,p=0;const I=async g=>{if(m)return m;m=(async()=>{const s=new AbortController;let f;c>0&&(f=setTimeout(()=>s.abort(),c));let y;try{y=await n(i,{signal:s.signal})}catch(b){throw s.signal.aborted?new Error(`JWKS fetch timed out after ${c}ms`):b}finally{f&&clearTimeout(f)}if(!y.ok)throw new Error(`Failed to fetch JWKS: ${y.status} ${y.statusText}`);const S=await y.json();if(!S||typeof S!="object"||!Array.isArray(S.keys))throw new Error("Invalid JWKS");return N(S)})();try{const s=await m;return u=s,await h.set(i,s),p=0,a>0&&(d=Date.now()+a),s}catch(s){if(!g||!u)throw s;if(p+=1,a>0){const f=Math.min(Math.max(a,3e4)*Math.pow(2,p-1),9e5);d=Date.now()+f}return console.warn(`JWKS refresh failed for "${i}", using stale cache.`,s),u}finally{m=void 0}};u=await h.get(i),u?(u=N(u),a>0&&(d=Date.now()+a)):u=await I(!1);const A={async list(){return a>0&&Date.now()>=d&&await I(!0),w(...u.keys)},async refresh(){return await I(!1),A},async key(g){const f=(await A.list()).find(y=>y.kid===g);if(f)return w(f)[0]},async find(g){const s=await A.list(),f=Object.entries(g);return f.length===0?w(...s):w(...s.filter(y=>f.every(([S,b])=>{const x=y[S];return Array.isArray(b)?Array.isArray(x)&&x.length===b.length&&x.every((q,z)=>q===b[z]):x===b})))},async findFirst(g){return A.find(g).then(([s])=>s)},export(){return u}};return A},oe={toKeyObject:F,normalize:N,fromWeb:G};exports.AutodetectAlgorithm=L;exports.JWK=ae;exports.JWKS=oe;exports.JWKSToKeyObject=F;exports.JWT=ie;exports.SignatureAlgorithm=v;exports.SupportedAlgorithms=te;exports.base64Url=K;exports.computeX5T=M;exports.decode=_;exports.exportJWK=H;exports.fromWeb=G;exports.getJWKThumbprint=B;exports.importJWK=J;exports.normalizeJWK=w;exports.normalizeJWKS=N;exports.sign=U;exports.toPublicJWK=C;exports.verify=j;
-//# sourceMappingURL=index-CaEvPIqc.cjs.map