@sourceregistry/node-jwt 1.5.11 → 1.6.0

package/dist/index-BJnjMyHr.js

@@ -1,803 +0,0 @@
-import B, { verify as Y, sign as Z, createVerify as V, createSign as U, createHmac as R, createPrivateKey as C, createPublicKey as N, createSecretKey as w, timingSafeEqual as Q, createHash as H } from "crypto";
-const O = {
-  encode: (e) => Buffer.from(e).toString("base64url"),
-  decode: (e) => Buffer.from(e, "base64url").toString()
-}, ee = (e, t) => e.length !== t.length ? !1 : Q(Buffer.from(e), Buffer.from(t)), K = /^[A-Za-z0-9_-]+$/;
-function W(e) {
-  return typeof e == "object" && e !== null && !Array.isArray(e);
-}
-function x(e) {
-  return typeof e == "number" && Number.isFinite(e);
-}
-function D(e) {
-  return Array.isArray(e) && e.every((t) => typeof t == "string");
-}
-function re(e) {
-  const t = [
-    { claim: "iss", valid: e.iss === void 0 || typeof e.iss == "string", expected: "string" },
-    { claim: "sub", valid: e.sub === void 0 || typeof e.sub == "string", expected: "string" },
-    { claim: "jti", valid: e.jti === void 0 || typeof e.jti == "string", expected: "string" },
-    { claim: "sid", valid: e.sid === void 0 || typeof e.sid == "string", expected: "string" },
-    { claim: "iat", valid: e.iat === void 0 || x(e.iat), expected: "number" },
-    { claim: "exp", valid: e.exp === void 0 || x(e.exp), expected: "number" },
-    { claim: "nbf", valid: e.nbf === void 0 || x(e.nbf), expected: "number" }
-  ];
-  for (const r of t)
-    if (!r.valid)
-      return {
-        reason: `Invalid "${r.claim}" claim: expected ${r.expected}`,
-        code: "INVALID_CLAIM"
-      };
-  return e.aud !== void 0 && !(typeof e.aud == "string" || D(e.aud)) ? {
-    reason: 'Invalid "aud" claim: expected string or string[]',
-    code: "INVALID_CLAIM"
-  } : null;
-}
-function te(e) {
-  if (e.signatureFormat !== void 0 && e.signatureFormat !== "der" && e.signatureFormat !== "jose")
-    return {
-      reason: 'Invalid signatureFormat option: expected "der" or "jose"',
-      code: "INVALID_OPTIONS"
-    };
-  if (e.clockSkew !== void 0 && (!x(e.clockSkew) || e.clockSkew < 0))
-    return {
-      reason: "Invalid clockSkew option: expected a non-negative finite number",
-      code: "INVALID_OPTIONS"
-    };
-  if (e.maxTokenAge !== void 0 && (!x(e.maxTokenAge) || e.maxTokenAge < 0))
-    return {
-      reason: "Invalid maxTokenAge option: expected a non-negative finite number",
-      code: "INVALID_OPTIONS"
-    };
-  if (e.ignoreExpiration !== void 0 && typeof e.ignoreExpiration != "boolean")
-    return {
-      reason: "Invalid ignoreExpiration option: expected boolean",
-      code: "INVALID_OPTIONS"
-    };
-  if (e.issuer !== void 0 && typeof e.issuer != "string")
-    return {
-      reason: "Invalid issuer option: expected string",
-      code: "INVALID_OPTIONS"
-    };
-  if (e.subject !== void 0 && typeof e.subject != "string")
-    return {
-      reason: "Invalid subject option: expected string",
-      code: "INVALID_OPTIONS"
-    };
-  if (e.jwtId !== void 0 && typeof e.jwtId != "string")
-    return {
-      reason: "Invalid jwtId option: expected string",
-      code: "INVALID_OPTIONS"
-    };
-  if (e.audience !== void 0 && !(typeof e.audience == "string" || D(e.audience)))
-    return {
-      reason: "Invalid audience option: expected string or string[]",
-      code: "INVALID_OPTIONS"
-    };
-  if (e.algorithms !== void 0) {
-    if (!Array.isArray(e.algorithms) || e.algorithms.length === 0)
-      return {
-        reason: "Invalid algorithms option: expected a non-empty array",
-        code: "INVALID_OPTIONS"
-      };
-    const t = e.algorithms.find((r) => !(r in p));
-    if (t)
-      return {
-        reason: `Invalid algorithms option: unsupported algorithm "${t}"`,
-        code: "INVALID_OPTIONS"
-      };
-  }
-  return null;
-}
-function ne(e) {
-  return e.crit !== void 0 ? !D(e.crit) || e.crit.length === 0 ? {
-    reason: 'Invalid "crit" header: expected non-empty string[]',
-    code: "INVALID_HEADER"
-  } : {
-    reason: `Unsupported critical header parameters: ${e.crit.join(", ")}`,
-    code: "UNSUPPORTED_CRITICAL_HEADER"
-  } : null;
-}
-function j(e) {
-  switch (e) {
-    case "ES256":
-    case "ES256K":
-      return 64;
-    // 32 + 32
-    case "ES384":
-      return 96;
-    // 48 + 48
-    case "ES512":
-      return 132;
-    // 66 + 66 (P-521)
-    /* c8 ignore next 2 */
-    default:
-      throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`);
-  }
-}
-function ie(e, t) {
-  let r = 0;
-  if (e[r++] !== 48) throw new Error("Invalid DER ECDSA signature");
-  let n = e[r++];
-  if (n & 128) {
-    const d = n & 127;
-    n = 0;
-    for (let g = 0; g < d; g++) n = n << 8 | e[r++];
-  }
-  if (e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (r)");
-  const a = e[r++];
-  let o = e.subarray(r, r + a);
-  if (r += a, e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (s)");
-  const i = e[r++];
-  let s = e.subarray(r, r + i);
-  for (; o.length > t / 2 && o[0] === 0; ) o = o.subarray(1);
-  for (; s.length > t / 2 && s[0] === 0; ) s = s.subarray(1);
-  const y = Buffer.concat([Buffer.alloc(t / 2 - o.length, 0), o]), f = Buffer.concat([Buffer.alloc(t / 2 - s.length, 0), s]);
-  return Buffer.concat([y, f]);
-}
-function L(e) {
-  const t = e.length / 2;
-  let r = e.subarray(0, t), n = e.subarray(t);
-  for (; r.length > 1 && r[0] === 0 && (r[1] & 128) === 0; ) r = r.subarray(1);
-  for (; n.length > 1 && n[0] === 0 && (n[1] & 128) === 0; ) n = n.subarray(1);
-  r[0] & 128 && (r = Buffer.concat([Buffer.from([0]), r])), n[0] & 128 && (n = Buffer.concat([Buffer.from([0]), n]));
-  const a = Buffer.concat([Buffer.from([2, r.length]), r]), o = Buffer.concat([Buffer.from([2, n.length]), n]), i = a.length + o.length;
-  let s;
-  if (i < 128)
-    s = Buffer.from([i]);
-  else {
-    const y = [];
-    let f = i;
-    for (; f > 0; )
-      y.unshift(f & 255), f >>= 8;
-    s = Buffer.from([128 | y.length, ...y]);
-  }
-  return Buffer.concat([Buffer.from([48]), s, a, o]);
-}
-function k(e) {
-  return e === "ES256" || e === "ES384" || e === "ES512" || e === "ES256K";
-}
-const P = (e) => ({
-  sign: (t, r) => R(e, r).update(t).digest("base64url"),
-  verify: (t, r, n) => {
-    const a = R(e, r).update(t).digest("base64url");
-    return ee(a, n);
-  }
-}), E = (e) => ({
-  sign: (t, r) => U(e).update(t).end().sign(r).toString("base64url"),
-  verify: (t, r, n) => {
-    try {
-      return V(e).update(t).end().verify(r, Buffer.from(n, "base64url"));
-    } catch {
-      return !1;
-    }
-  }
-}), _ = (e, t) => ({
-  sign: (r, n) => U(e).update(r).end().sign({
-    //@ts-ignore
-    key: n,
-    padding: B.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: t
-  }).toString("base64url"),
-  verify: (r, n, a) => {
-    try {
-      return V(e).update(r).end().verify({
-        //@ts-ignore
-        key: n,
-        padding: B.constants.RSA_PKCS1_PSS_PADDING,
-        saltLength: t
-      }, Buffer.from(a, "base64url"));
-    } catch {
-      return !1;
-    }
-  }
-}), ae = {
-  sign: (e, t) => Z(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, t).toString("base64url"),
-  verify: (e, t, r) => {
-    try {
-      return Y(
-        null,
-        typeof e == "string" ? Buffer.from(e, "utf8") : e,
-        t,
-        Buffer.from(r, "base64url")
-      );
-    } catch {
-      return !1;
-    }
-  }
-}, p = {
-  // HMAC
-  HS256: P("sha256"),
-  HS384: P("sha384"),
-  HS512: P("sha512"),
-  // RSA (DER-encoded signatures, base64url)
-  RS256: E("RSA-SHA256"),
-  RS384: E("RSA-SHA384"),
-  RS512: E("RSA-SHA512"),
-  // ECDSA (Node/OpenSSL emits DER; sign() converts to JOSE by default for JWTs)
-  ES256: E("SHA256"),
-  ES384: E("SHA384"),
-  ES512: E("SHA512"),
-  ES256K: E("SHA256"),
-  PS256: _("RSA-SHA256", 32),
-  PS384: _("RSA-SHA384", 48),
-  PS512: _("RSA-SHA512", 64),
-  EdDSA: ae
-}, ge = Object.keys(p);
-function se(e) {
-  if (e.type === "secret") return "HS256";
-  if (e.type !== "private") throw new Error("Only private or symmetric keys can be used to sign JWTs");
-  const t = e.asymmetricKeyType, r = e.asymmetricKeyDetails;
-  switch (t) {
-    case "rsa":
-      return "RS256";
-    case "rsa-pss": {
-      const n = (r == null ? void 0 : r.hashAlgorithm) ?? "sha256";
-      switch (n) {
-        case "sha256":
-          return "PS256";
-        case "sha384":
-          return "PS384";
-        case "sha512":
-          return "PS512";
-        default:
-          throw new Error(`Unsupported RSA-PSS hash algorithm: ${n}`);
-      }
-    }
-    case "ec": {
-      const n = r == null ? void 0 : r.namedCurve;
-      switch (n) {
-        case "P-256":
-        case "prime256v1":
-          return "ES256";
-        case "P-384":
-        case "secp384r1":
-          return "ES384";
-        case "P-521":
-        case "secp521r1":
-          return "ES512";
-        case "secp256k1":
-          return "ES256K";
-        default:
-          throw new Error(`Unsupported EC curve: ${n}`);
-      }
-    }
-    case "ed25519":
-      return "EdDSA";
-    default:
-      throw new Error(`Unsupported asymmetric key type: ${t}`);
-  }
-}
-function M(e, t) {
-  if (typeof e == "object" && "type" in e) return e;
-  try {
-    return t === "sign" ? C(e) : N(e);
-  } catch {
-    if (t === "sign") {
-      try {
-        N(e);
-      } catch {
-        if (typeof e == "string") return w(Buffer.from(e, "utf8"));
-        if (Buffer.isBuffer(e)) return w(e);
-        throw new Error("Unsupported key type");
-      }
-      throw new Error("A public key cannot be used to sign JWTs");
-    }
-    if (typeof e == "string") return w(Buffer.from(e, "utf8"));
-    if (Buffer.isBuffer(e)) return w(e);
-    throw new Error("Unsupported key type");
-  }
-}
-function q(e, t, r) {
-  var a;
-  if (t.startsWith("HS")) {
-    if (e.type !== "secret") throw new Error(`${t} requires a symmetric secret key`);
-    return;
-  }
-  if (r === "sign" && e.type !== "private")
-    throw new Error(`${t} requires a private key for signing`);
-  if (r === "verify" && e.type !== "public" && e.type !== "private")
-    throw new Error(`${t} requires a public or private key for verification`);
-  const n = e.asymmetricKeyType;
-  if (t.startsWith("RS") && n !== "rsa")
-    throw new Error(`${t} requires an RSA key`);
-  if (t.startsWith("PS") && n !== "rsa" && n !== "rsa-pss")
-    throw new Error(`${t} requires an RSA or RSA-PSS key`);
-  if (t === "EdDSA" && n !== "ed25519")
-    throw new Error("EdDSA requires an Ed25519 key");
-  if (k(t)) {
-    const o = (a = e.asymmetricKeyDetails) == null ? void 0 : a.namedCurve;
-    let i = [];
-    switch (t) {
-      case "ES256":
-        i = ["P-256", "prime256v1"];
-        break;
-      case "ES384":
-        i = ["P-384", "secp384r1"];
-        break;
-      case "ES512":
-        i = ["P-521", "secp521r1"];
-        break;
-      case "ES256K":
-        i = ["secp256k1"];
-        break;
-    }
-    if (n !== "ec" || !i.includes(o ?? ""))
-      throw new Error(`${t} requires its matching EC curve`);
-  }
-}
-const F = (e) => {
-  const t = e.split(".");
-  if (t.length !== 3)
-    throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');
-  const [r, n, a] = t;
-  if (!r || !n || !a)
-    throw new Error("Invalid JWT: empty part detected");
-  if (!K.test(r) || !K.test(n) || !K.test(a))
-    throw new Error("Invalid JWT: non-base64url characters detected");
-  try {
-    const o = JSON.parse(O.decode(r)), i = JSON.parse(O.decode(n));
-    if (!W(o) || !W(i))
-      throw new Error("header and payload must be JSON objects");
-    const s = o, y = i;
-    if (typeof s.alg != "string" || s.alg.length === 0)
-      throw new Error("header.alg must be a non-empty string");
-    if (s.typ !== void 0 && typeof s.typ != "string")
-      throw new Error("header.typ must be a string");
-    if (s.kid !== void 0 && typeof s.kid != "string")
-      throw new Error("header.kid must be a string");
-    if (s.crit !== void 0 && (!D(s.crit) || s.crit.length === 0))
-      throw new Error("header.crit must be a non-empty string[]");
-    return { header: s, payload: y, signature: a };
-  } catch (o) {
-    throw new Error(`Invalid JWT: malformed header or payload (${o.message})`);
-  }
-}, oe = (e, t, r = {}) => {
-  const n = M(t, "sign"), a = r.alg ?? se(n), o = r.signatureFormat ?? (k(a) ? "jose" : "der"), i = r.typ ?? "JWT";
-  if (!(a in p)) throw new Error(`Unsupported algorithm: ${a}`);
-  q(n, a, "sign");
-  const s = { alg: a, typ: i };
-  r.kid && (s.kid = r.kid);
-  const y = O.encode(JSON.stringify(s)), f = O.encode(JSON.stringify(e)), d = `${y}.${f}`;
-  let g = p[a].sign(d, n);
-  if (o === "jose" && k(a)) {
-    const A = Buffer.from(g, "base64url");
-    g = ie(A, j(a)).toString("base64url");
-  }
-  return `${y}.${f}.${g}`;
-}, ce = (e, t, r = {}) => {
-  const n = te(r);
-  if (n)
-    return {
-      valid: !1,
-      error: n
-    };
-  let a;
-  try {
-    a = F(e);
-  } catch (c) {
-    return {
-      valid: !1,
-      error: {
-        reason: c.message,
-        code: "INVALID_TOKEN"
-      }
-    };
-  }
-  const { header: o, payload: i, signature: s } = a, y = ne(o);
-  if (y)
-    return {
-      valid: !1,
-      error: y
-    };
-  const f = re(i);
-  if (f)
-    return {
-      valid: !1,
-      error: f
-    };
-  const d = o.alg;
-  if (!(d in p))
-    return {
-      valid: !1,
-      error: {
-        reason: `Unsupported or unknown algorithm: ${o.alg}`,
-        code: "INVALID_ALGORITHM"
-      }
-    };
-  if (r.algorithms && r.algorithms.length > 0 && !r.algorithms.includes(d))
-    return {
-      valid: !1,
-      error: {
-        reason: `Algorithm "${d}" is not in the allowed algorithms list`,
-        code: "ALGORITHM_NOT_ALLOWED"
-      }
-    };
-  if (o.typ !== void 0 && o.typ !== "JWT")
-    return {
-      valid: !1,
-      error: {
-        reason: `Invalid token type: expected 'JWT', got '${o.typ}'`,
-        code: "INVALID_TYPE"
-      }
-    };
-  const [g, A] = e.split("."), I = `${g}.${A}`;
-  let m;
-  try {
-    m = M(t, "verify"), q(m, d, "verify");
-  } catch (c) {
-    return {
-      valid: !1,
-      error: {
-        reason: c.message,
-        code: "KEY_ALGORITHM_MISMATCH"
-      }
-    };
-  }
-  if (k(d)) {
-    const c = r.signatureFormat;
-    let l;
-    if (c === "jose")
-      try {
-        const v = Buffer.from(s, "base64url"), S = L(v).toString("base64url");
-        l = p[d].verify(I, m, S);
-      } catch {
-        l = !1;
-      }
-    else if (c === "der")
-      l = p[d].verify(I, m, s);
-    else if (l = p[d].verify(I, m, s), !l)
-      try {
-        const v = Buffer.from(s, "base64url");
-        if (v.length === j(d)) {
-          const S = L(v).toString("base64url");
-          l = p[d].verify(I, m, S);
-        }
-      } catch {
-      }
-    if (!l)
-      return { valid: !1, error: { reason: "Signature verification failed", code: "INVALID_SIGNATURE" } };
-  } else {
-    let c = !1;
-    try {
-      c = p[d].verify(I, m, s);
-    } catch {
-      c = !1;
-    }
-    if (!c)
-      return { valid: !1, error: { reason: "Signature verification failed", code: "INVALID_SIGNATURE" } };
-  }
-  const h = Math.floor(Date.now() / 1e3), u = r.clockSkew ?? 0;
-  if (!r.ignoreExpiration && i.exp !== void 0 && h > i.exp + u)
-    return {
-      valid: !1,
-      error: {
-        reason: "Token expired",
-        code: "TOKEN_EXPIRED"
-      }
-    };
-  if (i.nbf !== void 0 && h + u < i.nbf)
-    return {
-      valid: !1,
-      error: {
-        reason: "Token not yet valid",
-        code: "TOKEN_NOT_ACTIVE"
-      }
-    };
-  if (i.iat !== void 0 && h + u < i.iat)
-    return {
-      valid: !1,
-      error: {
-        reason: "Token issued in the future",
-        code: "TOKEN_FUTURE_ISSUED"
-      }
-    };
-  if (r.maxTokenAge !== void 0 && i.iat === void 0)
-    return {
-      valid: !1,
-      error: {
-        reason: 'Token missing required issued-at claim ("iat")',
-        code: "MISSING_IAT"
-      }
-    };
-  if (r.maxTokenAge !== void 0 && i.iat !== void 0) {
-    const c = h - i.iat;
-    if (c > r.maxTokenAge)
-      return {
-        valid: !1,
-        error: {
-          reason: `Token age (${c}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,
-          code: "TOKEN_TOO_OLD"
-        }
-      };
-  }
-  if (r.issuer !== void 0) {
-    if (i.iss === void 0)
-      return {
-        valid: !1,
-        error: {
-          reason: 'Token missing required issuer claim ("iss")',
-          code: "MISSING_ISSUER"
-        }
-      };
-    if (r.issuer !== i.iss)
-      return {
-        valid: !1,
-        error: {
-          reason: `Invalid token issuer: expected "${r.issuer}", got "${i.iss}"`,
-          code: "INVALID_ISSUER"
-        }
-      };
-  }
-  if (r.subject !== void 0) {
-    if (i.sub === void 0)
-      return {
-        valid: !1,
-        error: {
-          reason: 'Token missing required subject claim ("sub")',
-          code: "MISSING_SUBJECT"
-        }
-      };
-    if (r.subject !== i.sub)
-      return {
-        valid: !1,
-        error: {
-          reason: `Invalid token subject: expected "${r.subject}", got "${i.sub}"`,
-          code: "INVALID_SUBJECT"
-        }
-      };
-  }
-  if (r.audience !== void 0) {
-    const c = i.aud;
-    if (c === void 0)
-      return {
-        valid: !1,
-        error: {
-          reason: 'Token missing required audience claim ("aud")',
-          code: "MISSING_AUDIENCE"
-        }
-      };
-    const l = Array.isArray(r.audience) ? r.audience : [r.audience], v = Array.isArray(c) ? c : [c];
-    if (!l.some((b) => v.includes(b)))
-      return {
-        valid: !1,
-        error: {
-          reason: "Audience claim mismatch",
-          code: "INVALID_AUDIENCE"
-        }
-      };
-  }
-  if (r.jwtId !== void 0) {
-    if (i.jti === void 0)
-      return {
-        valid: !1,
-        error: {
-          reason: 'Token missing required JWT ID claim ("jti")',
-          code: "MISSING_JTI"
-        }
-      };
-    if (r.jwtId !== i.jti)
-      return {
-        valid: !1,
-        error: {
-          reason: `Invalid JWT ID: expected "${r.jwtId}", got "${i.jti}"`,
-          code: "INVALID_JTI"
-        }
-      };
-  }
-  return { valid: !0, header: o, payload: i, signature: s };
-}, me = {
-  sign: oe,
-  verify: ce,
-  decode: F,
-  algorithms: p
-};
-function fe(e) {
-  if (!e || typeof e != "object") throw new Error("Invalid KeyObject");
-  return e.export({ format: "jwk" });
-}
-function $(e) {
-  if (!e || typeof e != "object") throw new Error("Invalid JWK");
-  switch (e.kty) {
-    case "oct": {
-      if (!("k" in e) || typeof e.k != "string")
-        throw new Error('Invalid oct JWK: missing "k"');
-      return w(Buffer.from(e.k, "base64url"));
-    }
-    case "RSA":
-    case "EC":
-    case "OKP":
-      return "d" in e && typeof e.d == "string" ? C({ format: "jwk", key: e }) : N({ format: "jwk", key: e });
-    default:
-      throw new Error(`Unsupported JWK key type: ${e.kty}`);
-  }
-}
-function ue(e) {
-  if (!e || typeof e != "object")
-    throw new Error("Invalid KeyObject");
-  const r = (e.type === "private" ? N(e) : e).export({ format: "jwk" });
-  return delete r.d, delete r.p, delete r.q, delete r.dp, delete r.dq, delete r.qi, r;
-}
-function G(e, t = "sha256") {
-  if (!e || typeof e != "object")
-    throw new Error("Invalid JWK");
-  let r;
-  switch (e.kty) {
-    case "RSA":
-      r = { e: e.e, kty: e.kty, n: e.n };
-      break;
-    case "EC":
-      r = { crv: e.crv, kty: e.kty, x: e.x, y: e.y };
-      break;
-    case "OKP":
-      r = { crv: e.crv, kty: e.kty, x: e.x };
-      break;
-    case "oct":
-      r = { k: e.k, kty: e.kty };
-      break;
-    default:
-      throw new Error(`Unsupported JWK key type: ${e.kty}`);
-  }
-  const n = JSON.stringify(
-    Object.keys(r).sort().reduce((a, o) => (a[o] = r[o], a), {})
-  );
-  return H(t).update(n).digest("base64url");
-}
-function de(e) {
-  var t;
-  if ((t = e.x5c) != null && t.length)
-    return H("sha1").update(Buffer.from(e.x5c[0], "base64")).digest("base64url");
-}
-const ve = {
-  export: fe,
-  import: $,
-  toPublic: ue,
-  thumbprint: G
-};
-function le(e, t) {
-  if (!e || !Array.isArray(e.keys)) throw new Error("Invalid JWKS");
-  let r;
-  if (t && (r = e.keys.find((n) => n.kid === t)), !r && e.keys.length === 1 && (r = e.keys[0]), !r) throw new Error("Key not found in JWKS");
-  return $(r);
-}
-function J(e) {
-  return {
-    keys: T(...e.keys)
-  };
-}
-function T(...e) {
-  return e.map((t) => {
-    const r = {
-      ...t,
-      kid: t.kid ?? G(t),
-      x5t: t.x5t ?? de(t)
-    };
-    return Object.defineProperty(r, "toKeyObject", {
-      enumerable: !1,
-      configurable: !1,
-      writable: !1,
-      value: () => $(r)
-    }), r;
-  });
-}
-const he = async (e, t = {}) => {
-  const r = typeof e == "string" ? e : e.toString(), n = t.fetch ?? globalThis.fetch, a = Math.max(0, t.ttl ?? 5 * 6e4), o = Math.max(0, t.timeoutMs ?? 5e3), i = "/.well-known/jwks.json";
-  if (!n)
-    throw new Error("No fetch implementation available");
-  const s = (() => {
-    if (t.endpointOverride) {
-      const h = t.endpointOverride;
-      try {
-        return new URL(h, r).toString();
-      } catch {
-        return h;
-      }
-    }
-    return t.overrideEndpointCheck || r.endsWith(i) ? r : `${r.replace(/\/+$/, "")}${i}`;
-  })(), y = (() => {
-    if (t.cache) return t.cache;
-    let h;
-    return {
-      get: () => h,
-      set: (u, c) => {
-        h = c;
-      }
-    };
-  })();
-  let f, d = 0, g, A = 0;
-  const I = async (h) => {
-    if (g) return g;
-    g = (async () => {
-      const u = new AbortController();
-      let c;
-      o > 0 && (c = setTimeout(() => u.abort(), o));
-      let l;
-      try {
-        l = await n(s, { signal: u.signal });
-      } catch (S) {
-        throw u.signal.aborted ? new Error(`JWKS fetch timed out after ${o}ms`) : S;
-      } finally {
-        c && clearTimeout(c);
-      }
-      if (!l.ok)
-        throw new Error(`Failed to fetch JWKS: ${l.status} ${l.statusText}`);
-      const v = await l.json();
-      if (!v || typeof v != "object" || !Array.isArray(v.keys))
-        throw new Error("Invalid JWKS");
-      return J(v);
-    })();
-    try {
-      const u = await g;
-      return f = u, await y.set(s, u), A = 0, a > 0 && (d = Date.now() + a), u;
-    } catch (u) {
-      if (!h || !f)
-        throw u;
-      if (A += 1, a > 0) {
-        const c = Math.min(
-          Math.max(a, 3e4) * Math.pow(2, A - 1),
-          9e5
-        );
-        d = Date.now() + c;
-      }
-      return console.warn(`JWKS refresh failed for "${s}", using stale cache.`, u), f;
-    } finally {
-      g = void 0;
-    }
-  };
-  f = await y.get(s), f ? (f = J(f), a > 0 && (d = Date.now() + a)) : f = await I(!1);
-  const m = {
-    async list() {
-      return a > 0 && Date.now() >= d && await I(!0), T(...f.keys);
-    },
-    async refresh() {
-      return await I(!1), m;
-    },
-    async key(h) {
-      const c = (await m.list()).find((l) => l.kid === h);
-      if (c)
-        return T(c)[0];
-    },
-    async find(h) {
-      const u = await m.list(), c = Object.entries(h);
-      return c.length === 0 ? T(...u) : T(...u.filter(
-        (l) => c.every(([v, S]) => {
-          const b = l[v];
-          return Array.isArray(S) ? Array.isArray(b) && b.length === S.length && b.every((z, X) => z === S[X]) : b === S;
-        })
-      ));
-    },
-    async findFirst(h) {
-      return m.find(h).then(([u]) => u);
-    },
-    export() {
-      return f;
-    }
-  };
-  return m;
-}, Se = {
-  toKeyObject: le,
-  normalize: J,
-  fromWeb: he
-};
-export {
-  se as A,
-  ve as J,
-  p as S,
-  Se as a,
-  le as b,
-  me as c,
-  ge as d,
-  O as e,
-  de as f,
-  F as g,
-  fe as h,
-  he as i,
-  G as j,
-  $ as k,
-  J as l,
-  T as n,
-  oe as s,
-  ue as t,
-  ce as v
-};
-//# sourceMappingURL=index-BJnjMyHr.js.map