@sourceregistry/node-jwt 1.5.11 → 1.6.0

package/dist/index.js

@@ -1,23 +1,754 @@
-import { A as e, J as t, a as o, b as r, c as i, S as J, d as W, e as m, f as K, g as l, h as g, i as p, j as b, k as c, n, l as u, s as S, t as d, v as h } from "./index-BJnjMyHr.js";
-export {
-  e as AutodetectAlgorithm,
-  t as JWK,
-  o as JWKS,
-  r as JWKSToKeyObject,
-  i as JWT,
-  J as SignatureAlgorithm,
-  W as SupportedAlgorithms,
-  m as base64Url,
-  K as computeX5T,
-  l as decode,
-  g as exportJWK,
-  p as fromWeb,
-  b as getJWKThumbprint,
-  c as importJWK,
-  n as normalizeJWK,
-  u as normalizeJWKS,
-  S as sign,
-  d as toPublicJWK,
-  h as verify
+import e, { createHash as t, createHmac as n, createPrivateKey as r, createPublicKey as i, createSecretKey as a, createSign as o, createVerify as s, sign as c, timingSafeEqual as l, verify as u } from "crypto";
+//#region src/jwt/index.ts
+var d = {
+	encode: (e) => Buffer.from(e).toString("base64url"),
+	decode: (e) => Buffer.from(e, "base64url").toString()
+}, f = (e, t) => e.length === t.length && l(Buffer.from(e), Buffer.from(t)), p = /^[A-Za-z0-9_-]+$/;
+function m(e) {
+	return typeof e == "object" && !!e && !Array.isArray(e);
+}
+function h(e) {
+	return typeof e == "number" && Number.isFinite(e);
+}
+function g(e) {
+	return Array.isArray(e) && e.every((e) => typeof e == "string");
+}
+function _(e) {
+	let t = [
+		{
+			claim: "iss",
+			valid: e.iss === void 0 || typeof e.iss == "string",
+			expected: "string"
+		},
+		{
+			claim: "sub",
+			valid: e.sub === void 0 || typeof e.sub == "string",
+			expected: "string"
+		},
+		{
+			claim: "jti",
+			valid: e.jti === void 0 || typeof e.jti == "string",
+			expected: "string"
+		},
+		{
+			claim: "sid",
+			valid: e.sid === void 0 || typeof e.sid == "string",
+			expected: "string"
+		},
+		{
+			claim: "iat",
+			valid: e.iat === void 0 || h(e.iat),
+			expected: "number"
+		},
+		{
+			claim: "exp",
+			valid: e.exp === void 0 || h(e.exp),
+			expected: "number"
+		},
+		{
+			claim: "nbf",
+			valid: e.nbf === void 0 || h(e.nbf),
+			expected: "number"
+		}
+	];
+	for (let e of t) if (!e.valid) return {
+		reason: `Invalid "${e.claim}" claim: expected ${e.expected}`,
+		code: "INVALID_CLAIM"
+	};
+	return e.aud !== void 0 && !(typeof e.aud == "string" || g(e.aud)) ? {
+		reason: "Invalid \"aud\" claim: expected string or string[]",
+		code: "INVALID_CLAIM"
+	} : null;
+}
+function v(e) {
+	if (e.signatureFormat !== void 0 && e.signatureFormat !== "der" && e.signatureFormat !== "jose") return {
+		reason: "Invalid signatureFormat option: expected \"der\" or \"jose\"",
+		code: "INVALID_OPTIONS"
+	};
+	if (e.clockSkew !== void 0 && (!h(e.clockSkew) || e.clockSkew < 0)) return {
+		reason: "Invalid clockSkew option: expected a non-negative finite number",
+		code: "INVALID_OPTIONS"
+	};
+	if (e.maxTokenAge !== void 0 && (!h(e.maxTokenAge) || e.maxTokenAge < 0)) return {
+		reason: "Invalid maxTokenAge option: expected a non-negative finite number",
+		code: "INVALID_OPTIONS"
+	};
+	if (e.ignoreExpiration !== void 0 && typeof e.ignoreExpiration != "boolean") return {
+		reason: "Invalid ignoreExpiration option: expected boolean",
+		code: "INVALID_OPTIONS"
+	};
+	if (e.issuer !== void 0 && typeof e.issuer != "string") return {
+		reason: "Invalid issuer option: expected string",
+		code: "INVALID_OPTIONS"
+	};
+	if (e.subject !== void 0 && typeof e.subject != "string") return {
+		reason: "Invalid subject option: expected string",
+		code: "INVALID_OPTIONS"
+	};
+	if (e.jwtId !== void 0 && typeof e.jwtId != "string") return {
+		reason: "Invalid jwtId option: expected string",
+		code: "INVALID_OPTIONS"
+	};
+	if (e.audience !== void 0 && !(typeof e.audience == "string" || g(e.audience))) return {
+		reason: "Invalid audience option: expected string or string[]",
+		code: "INVALID_OPTIONS"
+	};
+	if (e.algorithms !== void 0) {
+		if (!Array.isArray(e.algorithms) || e.algorithms.length === 0) return {
+			reason: "Invalid algorithms option: expected a non-empty array",
+			code: "INVALID_OPTIONS"
+		};
+		let t = e.algorithms.find((e) => !(e in D));
+		if (t) return {
+			reason: `Invalid algorithms option: unsupported algorithm "${t}"`,
+			code: "INVALID_OPTIONS"
+		};
+	}
+	if (e.tokenTypes !== void 0) {
+		if (!Array.isArray(e.tokenTypes) || e.tokenTypes.length === 0 || !g(e.tokenTypes)) return {
+			reason: "Invalid tokenTypes option: expected a non-empty string[]",
+			code: "INVALID_OPTIONS"
+		};
+		if (e.tokenTypes.some((e) => e.length === 0)) return {
+			reason: "Invalid tokenTypes option: token types must not be empty",
+			code: "INVALID_OPTIONS"
+		};
+	}
+	return null;
+}
+function y(e) {
+	return e.crit === void 0 ? null : !g(e.crit) || e.crit.length === 0 ? {
+		reason: "Invalid \"crit\" header: expected non-empty string[]",
+		code: "INVALID_HEADER"
+	} : {
+		reason: `Unsupported critical header parameters: ${e.crit.join(", ")}`,
+		code: "UNSUPPORTED_CRITICAL_HEADER"
+	};
+}
+function b(e) {
+	switch (e) {
+		case "ES256":
+		case "ES256K": return 64;
+		case "ES384": return 96;
+		case "ES512": return 132;
+		/* c8 ignore next 2 */
+		default: throw Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`);
+	}
+}
+function x(e, t) {
+	let n = 0;
+	if (e[n++] !== 48) throw Error("Invalid DER ECDSA signature");
+	let r = e[n++];
+	if (r & 128) {
+		let t = r & 127;
+		r = 0;
+		for (let i = 0; i < t; i++) r = r << 8 | e[n++];
+	}
+	if (e[n++] !== 2) throw Error("Invalid DER ECDSA signature (r)");
+	let i = e[n++], a = e.subarray(n, n + i);
+	if (n += i, e[n++] !== 2) throw Error("Invalid DER ECDSA signature (s)");
+	let o = e[n++], s = e.subarray(n, n + o);
+	for (; a.length > t / 2 && a[0] === 0;) a = a.subarray(1);
+	for (; s.length > t / 2 && s[0] === 0;) s = s.subarray(1);
+	let c = Buffer.concat([Buffer.alloc(t / 2 - a.length, 0), a]), l = Buffer.concat([Buffer.alloc(t / 2 - s.length, 0), s]);
+	return Buffer.concat([c, l]);
+}
+function S(e) {
+	let t = e.length / 2, n = e.subarray(0, t), r = e.subarray(t);
+	for (; n.length > 1 && n[0] === 0 && !(n[1] & 128);) n = n.subarray(1);
+	for (; r.length > 1 && r[0] === 0 && !(r[1] & 128);) r = r.subarray(1);
+	n[0] & 128 && (n = Buffer.concat([Buffer.from([0]), n])), r[0] & 128 && (r = Buffer.concat([Buffer.from([0]), r]));
+	let i = Buffer.concat([Buffer.from([2, n.length]), n]), a = Buffer.concat([Buffer.from([2, r.length]), r]), o = i.length + a.length, s;
+	if (o < 128) s = Buffer.from([o]);
+	else {
+		let e = [], t = o;
+		for (; t > 0;) e.unshift(t & 255), t >>= 8;
+		s = Buffer.from([128 | e.length, ...e]);
+	}
+	return Buffer.concat([
+		Buffer.from([48]),
+		s,
+		i,
+		a
+	]);
+}
+function C(e) {
+	return e === "ES256" || e === "ES384" || e === "ES512" || e === "ES256K";
+}
+var w = (e) => ({
+	sign: (t, r) => n(e, r).update(t).digest("base64url"),
+	verify: (t, r, i) => f(n(e, r).update(t).digest("base64url"), i)
+}), T = (e) => ({
+	sign: (t, n) => o(e).update(t).end().sign(n).toString("base64url"),
+	verify: (t, n, r) => {
+		try {
+			return s(e).update(t).end().verify(n, Buffer.from(r, "base64url"));
+		} catch {
+			return !1;
+		}
+	}
+}), E = (t, n) => ({
+	sign: (r, i) => o(t).update(r).end().sign({
+		key: i,
+		padding: e.constants.RSA_PKCS1_PSS_PADDING,
+		saltLength: n
+	}).toString("base64url"),
+	verify: (r, i, a) => {
+		try {
+			return s(t).update(r).end().verify({
+				key: i,
+				padding: e.constants.RSA_PKCS1_PSS_PADDING,
+				saltLength: n
+			}, Buffer.from(a, "base64url"));
+		} catch {
+			return !1;
+		}
+	}
+}), D = {
+	HS256: w("sha256"),
+	HS384: w("sha384"),
+	HS512: w("sha512"),
+	RS256: T("RSA-SHA256"),
+	RS384: T("RSA-SHA384"),
+	RS512: T("RSA-SHA512"),
+	ES256: T("SHA256"),
+	ES384: T("SHA384"),
+	ES512: T("SHA512"),
+	ES256K: T("SHA256"),
+	PS256: E("RSA-SHA256", 32),
+	PS384: E("RSA-SHA384", 48),
+	PS512: E("RSA-SHA512", 64),
+	EdDSA: {
+		sign: (e, t) => c(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, t).toString("base64url"),
+		verify: (e, t, n) => {
+			try {
+				return u(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, t, Buffer.from(n, "base64url"));
+			} catch {
+				return !1;
+			}
+		}
+	}
+}, O = Object.keys(D);
+function k(e) {
+	if (e.type === "secret") return "HS256";
+	if (e.type !== "private") throw Error("Only private or symmetric keys can be used to sign JWTs");
+	let t = e.asymmetricKeyType, n = e.asymmetricKeyDetails;
+	switch (t) {
+		case "rsa": return "RS256";
+		case "rsa-pss": {
+			let e = (n == null ? void 0 : n.hashAlgorithm) ?? "sha256";
+			switch (e) {
+				case "sha256": return "PS256";
+				case "sha384": return "PS384";
+				case "sha512": return "PS512";
+				default: throw Error(`Unsupported RSA-PSS hash algorithm: ${e}`);
+			}
+		}
+		case "ec": {
+			let e = n == null ? void 0 : n.namedCurve;
+			switch (e) {
+				case "P-256":
+				case "prime256v1": return "ES256";
+				case "P-384":
+				case "secp384r1": return "ES384";
+				case "P-521":
+				case "secp521r1": return "ES512";
+				case "secp256k1": return "ES256K";
+				default: throw Error(`Unsupported EC curve: ${e}`);
+			}
+		}
+		case "ed25519": return "EdDSA";
+		default: throw Error(`Unsupported asymmetric key type: ${t}`);
+	}
+}
+function A(e, t) {
+	if (typeof e == "object" && "type" in e) return e;
+	try {
+		return t === "sign" ? r(e) : i(e);
+	} catch {
+		if (t === "sign") {
+			try {
+				i(e);
+			} catch {
+				if (typeof e == "string") return a(Buffer.from(e, "utf8"));
+				if (Buffer.isBuffer(e)) return a(e);
+				throw Error("Unsupported key type");
+			}
+			throw Error("A public key cannot be used to sign JWTs");
+		}
+		if (typeof e == "string") return a(Buffer.from(e, "utf8"));
+		if (Buffer.isBuffer(e)) return a(e);
+		throw Error("Unsupported key type");
+	}
+}
+function j(e, t, n) {
+	if (t.startsWith("HS")) {
+		if (e.type !== "secret") throw Error(`${t} requires a symmetric secret key`);
+		return;
+	}
+	if (n === "sign" && e.type !== "private") throw Error(`${t} requires a private key for signing`);
+	if (n === "verify" && e.type !== "public" && e.type !== "private") throw Error(`${t} requires a public or private key for verification`);
+	let r = e.asymmetricKeyType;
+	if (t.startsWith("RS") && r !== "rsa") throw Error(`${t} requires an RSA key`);
+	if (t.startsWith("PS") && r !== "rsa" && r !== "rsa-pss") throw Error(`${t} requires an RSA or RSA-PSS key`);
+	if (t === "EdDSA" && r !== "ed25519") throw Error("EdDSA requires an Ed25519 key");
+	if (C(t)) {
+		var i;
+		let n = (i = e.asymmetricKeyDetails) == null ? void 0 : i.namedCurve, a = [];
+		switch (t) {
+			case "ES256":
+				a = ["P-256", "prime256v1"];
+				break;
+			case "ES384":
+				a = ["P-384", "secp384r1"];
+				break;
+			case "ES512":
+				a = ["P-521", "secp521r1"];
+				break;
+			case "ES256K": a = ["secp256k1"];
+		}
+		if (r !== "ec" || !a.includes(n ?? "")) throw Error(`${t} requires its matching EC curve`);
+	}
+}
+var M = (e) => {
+	let t = e.split(".");
+	if (t.length !== 3) throw Error("Invalid JWT: must contain exactly 3 parts separated by \".\"");
+	let [n, r, i] = t;
+	if (!n || !r || !i) throw Error("Invalid JWT: empty part detected");
+	if (!p.test(n) || !p.test(r) || !p.test(i)) throw Error("Invalid JWT: non-base64url characters detected");
+	try {
+		let e = JSON.parse(d.decode(n)), t = JSON.parse(d.decode(r));
+		if (!m(e) || !m(t)) throw Error("header and payload must be JSON objects");
+		let a = e, o = t;
+		if (typeof a.alg != "string" || a.alg.length === 0) throw Error("header.alg must be a non-empty string");
+		if (a.typ !== void 0 && typeof a.typ != "string") throw Error("header.typ must be a string");
+		if (a.kid !== void 0 && typeof a.kid != "string") throw Error("header.kid must be a string");
+		if (a.crit !== void 0 && (!g(a.crit) || a.crit.length === 0)) throw Error("header.crit must be a non-empty string[]");
+		return {
+			header: a,
+			payload: o,
+			signature: i
+		};
+	} catch (e) {
+		throw Error(`Invalid JWT: malformed header or payload (${e.message})`);
+	}
+}, N = (e, t, n = {}) => {
+	let r = A(t, "sign"), i = n.alg ?? k(r), a = n.signatureFormat ?? (C(i) ? "jose" : "der"), o = n.typ ?? "JWT";
+	if (!(i in D)) throw Error(`Unsupported algorithm: ${i}`);
+	j(r, i, "sign");
+	let s = {
+		alg: i,
+		typ: o
+	};
+	n.kid && (s.kid = n.kid);
+	let c = d.encode(JSON.stringify(s)), l = d.encode(JSON.stringify(e)), u = `${c}.${l}`, f = D[i].sign(u, r);
+	return a === "jose" && C(i) && (f = x(Buffer.from(f, "base64url"), b(i)).toString("base64url")), `${c}.${l}.${f}`;
+}, P = (e, t, n = {}) => {
+	let r = v(n);
+	if (r) return {
+		valid: !1,
+		error: r
+	};
+	let i;
+	try {
+		i = M(e);
+	} catch (e) {
+		return {
+			valid: !1,
+			error: {
+				reason: e.message,
+				code: "INVALID_TOKEN"
+			}
+		};
+	}
+	let { header: a, payload: o, signature: s } = i, c = y(a);
+	if (c) return {
+		valid: !1,
+		error: c
+	};
+	let l = _(o);
+	if (l) return {
+		valid: !1,
+		error: l
+	};
+	let u = a.alg;
+	if (!(u in D)) return {
+		valid: !1,
+		error: {
+			reason: `Unsupported or unknown algorithm: ${a.alg}`,
+			code: "INVALID_ALGORITHM"
+		}
+	};
+	if (n.algorithms && n.algorithms.length > 0 && !n.algorithms.includes(u)) return {
+		valid: !1,
+		error: {
+			reason: `Algorithm "${u}" is not in the allowed algorithms list`,
+			code: "ALGORITHM_NOT_ALLOWED"
+		}
+	};
+	let d = n.tokenTypes ?? ["JWT"];
+	if (a.typ !== void 0 && !d.includes(a.typ)) return {
+		valid: !1,
+		error: {
+			reason: `Invalid token type: expected one of ${d.map((e) => `'${e}'`).join(", ")}, got '${a.typ}'`,
+			code: "INVALID_TYPE"
+		}
+	};
+	let [f, p] = e.split("."), m = `${f}.${p}`, h;
+	try {
+		h = A(t, "verify"), j(h, u, "verify");
+	} catch (e) {
+		return {
+			valid: !1,
+			error: {
+				reason: e.message,
+				code: "KEY_ALGORITHM_MISMATCH"
+			}
+		};
+	}
+	if (C(u)) {
+		let e = n.signatureFormat, t;
+		if (e === "jose") try {
+			let e = S(Buffer.from(s, "base64url")).toString("base64url");
+			t = D[u].verify(m, h, e);
+		} catch {
+			t = !1;
+		}
+		else if (e === "der") t = D[u].verify(m, h, s);
+		else if (t = D[u].verify(m, h, s), !t) try {
+			let e = Buffer.from(s, "base64url");
+			if (e.length === b(u)) {
+				let n = S(e).toString("base64url");
+				t = D[u].verify(m, h, n);
+			}
+		} catch {}
+		if (!t) return {
+			valid: !1,
+			error: {
+				reason: "Signature verification failed",
+				code: "INVALID_SIGNATURE"
+			}
+		};
+	} else {
+		let e = !1;
+		try {
+			e = D[u].verify(m, h, s);
+		} catch {
+			e = !1;
+		}
+		if (!e) return {
+			valid: !1,
+			error: {
+				reason: "Signature verification failed",
+				code: "INVALID_SIGNATURE"
+			}
+		};
+	}
+	let g = Math.floor(Date.now() / 1e3), x = n.clockSkew ?? 0;
+	if (!n.ignoreExpiration && o.exp !== void 0 && g > o.exp + x) return {
+		valid: !1,
+		error: {
+			reason: "Token expired",
+			code: "TOKEN_EXPIRED"
+		}
+	};
+	if (o.nbf !== void 0 && g + x < o.nbf) return {
+		valid: !1,
+		error: {
+			reason: "Token not yet valid",
+			code: "TOKEN_NOT_ACTIVE"
+		}
+	};
+	if (o.iat !== void 0 && g + x < o.iat) return {
+		valid: !1,
+		error: {
+			reason: "Token issued in the future",
+			code: "TOKEN_FUTURE_ISSUED"
+		}
+	};
+	if (n.maxTokenAge !== void 0 && o.iat === void 0) return {
+		valid: !1,
+		error: {
+			reason: "Token missing required issued-at claim (\"iat\")",
+			code: "MISSING_IAT"
+		}
+	};
+	if (n.maxTokenAge !== void 0 && o.iat !== void 0) {
+		let e = g - o.iat;
+		if (e > n.maxTokenAge) return {
+			valid: !1,
+			error: {
+				reason: `Token age (${e}s) exceeds maximum allowed age (${n.maxTokenAge}s)`,
+				code: "TOKEN_TOO_OLD"
+			}
+		};
+	}
+	if (n.issuer !== void 0) {
+		if (o.iss === void 0) return {
+			valid: !1,
+			error: {
+				reason: "Token missing required issuer claim (\"iss\")",
+				code: "MISSING_ISSUER"
+			}
+		};
+		if (n.issuer !== o.iss) return {
+			valid: !1,
+			error: {
+				reason: `Invalid token issuer: expected "${n.issuer}", got "${o.iss}"`,
+				code: "INVALID_ISSUER"
+			}
+		};
+	}
+	if (n.subject !== void 0) {
+		if (o.sub === void 0) return {
+			valid: !1,
+			error: {
+				reason: "Token missing required subject claim (\"sub\")",
+				code: "MISSING_SUBJECT"
+			}
+		};
+		if (n.subject !== o.sub) return {
+			valid: !1,
+			error: {
+				reason: `Invalid token subject: expected "${n.subject}", got "${o.sub}"`,
+				code: "INVALID_SUBJECT"
+			}
+		};
+	}
+	if (n.audience !== void 0) {
+		let e = o.aud;
+		if (e === void 0) return {
+			valid: !1,
+			error: {
+				reason: "Token missing required audience claim (\"aud\")",
+				code: "MISSING_AUDIENCE"
+			}
+		};
+		let t = Array.isArray(n.audience) ? n.audience : [n.audience], r = Array.isArray(e) ? e : [e];
+		if (!t.some((e) => r.includes(e))) return {
+			valid: !1,
+			error: {
+				reason: "Audience claim mismatch",
+				code: "INVALID_AUDIENCE"
+			}
+		};
+	}
+	if (n.jwtId !== void 0) {
+		if (o.jti === void 0) return {
+			valid: !1,
+			error: {
+				reason: "Token missing required JWT ID claim (\"jti\")",
+				code: "MISSING_JTI"
+			}
+		};
+		if (n.jwtId !== o.jti) return {
+			valid: !1,
+			error: {
+				reason: `Invalid JWT ID: expected "${n.jwtId}", got "${o.jti}"`,
+				code: "INVALID_JTI"
+			}
+		};
+	}
+	return {
+		valid: !0,
+		header: a,
+		payload: o,
+		signature: s
+	};
+}, F = {
+	sign: N,
+	verify: P,
+	decode: M,
+	algorithms: D
 };
-//# sourceMappingURL=index.js.map
+//#endregion
+//#region src/jwks/index.ts
+function I(e) {
+	if (!e || typeof e != "object") throw Error("Invalid KeyObject");
+	return e.export({ format: "jwk" });
+}
+function L(e) {
+	if (!e || typeof e != "object") throw Error("Invalid JWK");
+	switch (e.kty) {
+		case "oct":
+			if (!("k" in e) || typeof e.k != "string") throw Error("Invalid oct JWK: missing \"k\"");
+			return a(Buffer.from(e.k, "base64url"));
+		case "RSA":
+		case "EC":
+		case "OKP": return "d" in e && typeof e.d == "string" ? r({
+			format: "jwk",
+			key: e
+		}) : i({
+			format: "jwk",
+			key: e
+		});
+		default: throw Error(`Unsupported JWK key type: ${e.kty}`);
+	}
+}
+function R(e) {
+	if (!e || typeof e != "object") throw Error("Invalid KeyObject");
+	let t = (e.type === "private" ? i(e) : e).export({ format: "jwk" });
+	return delete t.d, delete t.p, delete t.q, delete t.dp, delete t.dq, delete t.qi, t;
+}
+function z(e, n = "sha256") {
+	if (!e || typeof e != "object") throw Error("Invalid JWK");
+	let r;
+	switch (e.kty) {
+		case "RSA":
+			r = {
+				e: e.e,
+				kty: e.kty,
+				n: e.n
+			};
+			break;
+		case "EC":
+			r = {
+				crv: e.crv,
+				kty: e.kty,
+				x: e.x,
+				y: e.y
+			};
+			break;
+		case "OKP":
+			r = {
+				crv: e.crv,
+				kty: e.kty,
+				x: e.x
+			};
+			break;
+		case "oct":
+			r = {
+				k: e.k,
+				kty: e.kty
+			};
+			break;
+		default: throw Error(`Unsupported JWK key type: ${e.kty}`);
+	}
+	let i = JSON.stringify(Object.keys(r).sort().reduce((e, t) => (e[t] = r[t], e), {}));
+	return t(n).update(i).digest("base64url");
+}
+function B(e) {
+	var n;
+	if ((n = e.x5c) != null && n.length) return t("sha1").update(Buffer.from(e.x5c[0], "base64")).digest("base64url");
+}
+var V = {
+	export: I,
+	import: L,
+	toPublic: R,
+	thumbprint: z
+};
+function H(e, t) {
+	if (!e || !Array.isArray(e.keys)) throw Error("Invalid JWKS");
+	let n;
+	if (t && (n = e.keys.find((e) => e.kid === t)), !n && e.keys.length === 1 && (n = e.keys[0]), !n) throw Error("Key not found in JWKS");
+	return L(n);
+}
+function U(e) {
+	return { keys: W(...e.keys) };
+}
+function W(...e) {
+	return e.map((e) => {
+		let t = {
+			...e,
+			kid: e.kid ?? z(e),
+			x5t: e.x5t ?? B(e)
+		};
+		return Object.defineProperty(t, "toKeyObject", {
+			enumerable: !1,
+			configurable: !1,
+			writable: !1,
+			value: () => L(t)
+		}), t;
+	});
+}
+var G = async (e, t = {}) => {
+	let n = typeof e == "string" ? e : e.toString(), r = t.fetch ?? globalThis.fetch, i = Math.max(0, t.ttl ?? 3e5), a = Math.max(0, t.timeoutMs ?? 5e3), o = "/.well-known/jwks.json";
+	if (!r) throw Error("No fetch implementation available");
+	let s = (() => {
+		if (t.endpointOverride) {
+			let e = t.endpointOverride;
+			try {
+				return new URL(e, n).toString();
+			} catch {
+				return e;
+			}
+		}
+		return t.overrideEndpointCheck || n.endsWith(o) ? n : `${n.replace(/\/+$/, "")}${o}`;
+	})(), c = (() => {
+		if (t.cache) return t.cache;
+		let e;
+		return {
+			get: () => e,
+			set: (t, n) => {
+				e = n;
+			}
+		};
+	})(), l, u = 0, d, f = 0, p = async (e) => {
+		if (d) return d;
+		d = (async () => {
+			let e = new AbortController(), t;
+			a > 0 && (t = setTimeout(() => e.abort(), a));
+			let n;
+			try {
+				n = await r(s, { signal: e.signal });
+			} catch (t) {
+				throw e.signal.aborted ? Error(`JWKS fetch timed out after ${a}ms`) : t;
+			} finally {
+				t && clearTimeout(t);
+			}
+			if (!n.ok) throw Error(`Failed to fetch JWKS: ${n.status} ${n.statusText}`);
+			let i = await n.json();
+			if (!i || typeof i != "object" || !Array.isArray(i.keys)) throw Error("Invalid JWKS");
+			return U(i);
+		})();
+		try {
+			let e = await d;
+			return l = e, await c.set(s, e), f = 0, i > 0 && (u = Date.now() + i), e;
+		} catch (t) {
+			if (!e || !l) throw t;
+			/* c8 ignore start - stale-on-failure is only reachable when ttl > 0 (auto-refresh path) */
+			if (f += 1, i > 0) {
+				let e = Math.min(Math.max(i, 3e4) * 2 ** (f - 1), 9e5);
+				u = Date.now() + e;
+			}
+			return console.warn(`JWKS refresh failed for "${s}", using stale cache.`, t), l;
+		} finally {
+			d = void 0;
+		}
+	};
+	l = await c.get(s), l ? (l = U(l), i > 0 && (u = Date.now() + i)) : l = await p(!1);
+	let m = {
+		async list() {
+			return i > 0 && Date.now() >= u && await p(!0), W(...l.keys);
+		},
+		async refresh() {
+			return await p(!1), m;
+		},
+		async key(e) {
+			let t = (await m.list()).find((t) => t.kid === e);
+			if (t) return W(t)[0];
+		},
+		async find(e) {
+			let t = await m.list(), n = Object.entries(e);
+			return n.length === 0 ? W(...t) : W(...t.filter((e) => n.every(([t, n]) => {
+				let r = e[t];
+				return Array.isArray(n) ? Array.isArray(r) && r.length === n.length && r.every((e, t) => e === n[t]) : r === n;
+			})));
+		},
+		async findFirst(e) {
+			return m.find(e).then(([e]) => e);
+		},
+		export() {
+			return l;
+		}
+	};
+	return m;
+}, K = {
+	toKeyObject: H,
+	normalize: U,
+	fromWeb: G
+};
+//#endregion
+export { k as AutodetectAlgorithm, V as JWK, K as JWKS, H as JWKSToKeyObject, F as JWT, D as SignatureAlgorithm, O as SupportedAlgorithms, d as base64Url, B as computeX5T, M as decode, I as exportJWK, G as fromWeb, z as getJWKThumbprint, L as importJWK, W as normalizeJWK, U as normalizeJWKS, N as sign, R as toPublicJWK, P as verify };
+
+//# sourceMappingURL=index.js.map