@sourceregistry/node-jwt 1.5.2 → 1.5.4

package/dist/index-tE21mX91.js

@@ -0,0 +1,814 @@
+import E, { verify as F, sign as G, createVerify as A, createSign as b, createHmac as w, timingSafeEqual as q, createPrivateKey as J, createSecretKey as R, createHash as $, createPublicKey as L } from "crypto";
+const P = {
+  encode: (e) => Buffer.from(e).toString("base64url"),
+  decode: (e) => Buffer.from(e, "base64url").toString()
+}, k = (e, t) => e.length !== t.length ? !1 : q(Buffer.from(e), Buffer.from(t)), D = /^[A-Za-z0-9_-]+$/;
+function _(e) {
+  return typeof e == "object" && e !== null && !Array.isArray(e);
+}
+function N(e) {
+  return typeof e == "number" && Number.isFinite(e);
+}
+function W(e) {
+  return Array.isArray(e) && e.every((t) => typeof t == "string");
+}
+function z(e) {
+  const t = [
+    { claim: "iss", valid: e.iss === void 0 || typeof e.iss == "string", expected: "string" },
+    { claim: "sub", valid: e.sub === void 0 || typeof e.sub == "string", expected: "string" },
+    { claim: "jti", valid: e.jti === void 0 || typeof e.jti == "string", expected: "string" },
+    { claim: "sid", valid: e.sid === void 0 || typeof e.sid == "string", expected: "string" },
+    { claim: "iat", valid: e.iat === void 0 || N(e.iat), expected: "number" },
+    { claim: "exp", valid: e.exp === void 0 || N(e.exp), expected: "number" },
+    { claim: "nbf", valid: e.nbf === void 0 || N(e.nbf), expected: "number" }
+  ];
+  for (const r of t)
+    if (!r.valid)
+      return {
+        reason: `Invalid "${r.claim}" claim: expected ${r.expected}`,
+        code: "INVALID_CLAIM"
+      };
+  return e.aud !== void 0 && !(typeof e.aud == "string" || W(e.aud)) ? {
+    reason: 'Invalid "aud" claim: expected string or string[]',
+    code: "INVALID_CLAIM"
+  } : null;
+}
+function X(e) {
+  if (e.signatureFormat !== void 0 && e.signatureFormat !== "der" && e.signatureFormat !== "jose")
+    return {
+      reason: 'Invalid signatureFormat option: expected "der" or "jose"',
+      code: "INVALID_OPTIONS"
+    };
+  if (e.clockSkew !== void 0 && (!N(e.clockSkew) || e.clockSkew < 0))
+    return {
+      reason: "Invalid clockSkew option: expected a non-negative finite number",
+      code: "INVALID_OPTIONS"
+    };
+  if (e.maxTokenAge !== void 0 && (!N(e.maxTokenAge) || e.maxTokenAge < 0))
+    return {
+      reason: "Invalid maxTokenAge option: expected a non-negative finite number",
+      code: "INVALID_OPTIONS"
+    };
+  if (e.issuer !== void 0 && typeof e.issuer != "string")
+    return {
+      reason: "Invalid issuer option: expected string",
+      code: "INVALID_OPTIONS"
+    };
+  if (e.subject !== void 0 && typeof e.subject != "string")
+    return {
+      reason: "Invalid subject option: expected string",
+      code: "INVALID_OPTIONS"
+    };
+  if (e.jwtId !== void 0 && typeof e.jwtId != "string")
+    return {
+      reason: "Invalid jwtId option: expected string",
+      code: "INVALID_OPTIONS"
+    };
+  if (e.audience !== void 0 && !(typeof e.audience == "string" || W(e.audience)))
+    return {
+      reason: "Invalid audience option: expected string or string[]",
+      code: "INVALID_OPTIONS"
+    };
+  if (e.algorithms !== void 0) {
+    if (!Array.isArray(e.algorithms))
+      return {
+        reason: "Invalid algorithms option: expected an array",
+        code: "INVALID_OPTIONS"
+      };
+    const t = e.algorithms.find((r) => !(r in m));
+    if (t)
+      return {
+        reason: `Invalid algorithms option: unsupported algorithm "${t}"`,
+        code: "INVALID_OPTIONS"
+      };
+  }
+  return null;
+}
+function H(e) {
+  switch (e) {
+    case "ES256":
+    case "ES256K":
+      return 64;
+    // 32 + 32
+    case "ES384":
+      return 96;
+    // 48 + 48
+    case "ES512":
+      return 132;
+    // 66 + 66 (P-521)
+    /* c8 ignore next 2 */
+    default:
+      throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`);
+  }
+}
+function Y(e, t) {
+  let r = 0;
+  if (e[r++] !== 48) throw new Error("Invalid DER ECDSA signature");
+  let n = e[r++];
+  if (n & 128) {
+    const v = n & 127;
+    n = 0;
+    for (let y = 0; y < v; y++) n = n << 8 | e[r++];
+  }
+  if (e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (r)");
+  const o = e[r++];
+  let c = e.subarray(r, r + o);
+  if (r += o, e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (s)");
+  const i = e[r++];
+  let s = e.subarray(r, r + i);
+  for (; c.length > t / 2 && c[0] === 0; ) c = c.subarray(1);
+  for (; s.length > t / 2 && s[0] === 0; ) s = s.subarray(1);
+  const l = Buffer.concat([Buffer.alloc(t / 2 - c.length, 0), c]), f = Buffer.concat([Buffer.alloc(t / 2 - s.length, 0), s]);
+  return Buffer.concat([l, f]);
+}
+function B(e) {
+  const t = e.length / 2;
+  let r = e.subarray(0, t), n = e.subarray(t);
+  for (; r.length > 1 && r[0] === 0 && (r[1] & 128) === 0; ) r = r.subarray(1);
+  for (; n.length > 1 && n[0] === 0 && (n[1] & 128) === 0; ) n = n.subarray(1);
+  r[0] & 128 && (r = Buffer.concat([Buffer.from([0]), r])), n[0] & 128 && (n = Buffer.concat([Buffer.from([0]), n]));
+  const o = Buffer.concat([Buffer.from([2, r.length]), r]), c = Buffer.concat([Buffer.from([2, n.length]), n]), i = o.length + c.length;
+  let s;
+  if (i < 128)
+    s = Buffer.from([i]);
+  else {
+    const l = [];
+    let f = i;
+    for (; f > 0; )
+      l.unshift(f & 255), f >>= 8;
+    s = Buffer.from([128 | l.length, ...l]);
+  }
+  return Buffer.concat([Buffer.from([48]), s, o, c]);
+}
+function V(e) {
+  return e === "ES256" || e === "ES384" || e === "ES512" || e === "ES256K";
+}
+const m = {
+  // HMAC
+  HS256: {
+    sign: (e, t) => w("sha256", t).update(e).digest("base64url"),
+    verify: (e, t, r) => {
+      const n = w("sha256", t).update(e).digest("base64url");
+      return k(n, r);
+    }
+  },
+  HS384: {
+    sign: (e, t) => w("sha384", t).update(e).digest("base64url"),
+    verify: (e, t, r) => {
+      const n = w("sha384", t).update(e).digest("base64url");
+      return k(n, r);
+    }
+  },
+  HS512: {
+    sign: (e, t) => w("sha512", t).update(e).digest("base64url"),
+    verify: (e, t, r) => {
+      const n = w("sha512", t).update(e).digest("base64url");
+      return k(n, r);
+    }
+  },
+  // RSA (DER-encoded signatures, base64url)
+  RS256: {
+    sign: (e, t) => b("RSA-SHA256").update(e).end().sign(t).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return A("RSA-SHA256").update(e).end().verify(t, Buffer.from(r, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  RS384: {
+    sign: (e, t) => b("RSA-SHA384").update(e).end().sign(t).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return A("RSA-SHA384").update(e).end().verify(t, Buffer.from(r, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  RS512: {
+    sign: (e, t) => b("RSA-SHA512").update(e).end().sign(t).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return A("RSA-SHA512").update(e).end().verify(t, Buffer.from(r, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  // ECDSA (DER-encoded by default — no dsaEncoding!)
+  ES256: {
+    sign: (e, t) => b("SHA256").update(e).end().sign(t).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return A("SHA256").update(e).end().verify(t, Buffer.from(r, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  ES384: {
+    sign: (e, t) => b("SHA384").update(e).end().sign(t).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return A("SHA384").update(e).end().verify(t, Buffer.from(r, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  ES512: {
+    sign: (e, t) => b("SHA512").update(e).end().sign(t).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return A("SHA512").update(e).end().verify(t, Buffer.from(r, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  ES256K: {
+    sign: (e, t) => b("SHA256").update(e).end().sign(t).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return A("SHA256").update(e).end().verify(t, Buffer.from(r, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  PS256: {
+    sign: (e, t) => b("RSA-SHA256").update(e).end().sign({
+      //@ts-ignore
+      key: t,
+      padding: E.constants.RSA_PKCS1_PSS_PADDING,
+      saltLength: 32
+    }).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return A("RSA-SHA256").update(e).end().verify({
+          //@ts-ignore
+          key: t,
+          padding: E.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: 32
+        }, Buffer.from(r, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  PS384: {
+    sign: (e, t) => b("RSA-SHA384").update(e).end().sign({
+      //@ts-ignore
+      key: t,
+      padding: E.constants.RSA_PKCS1_PSS_PADDING,
+      saltLength: 48
+    }).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return A("RSA-SHA384").update(e).end().verify({
+          //@ts-ignore
+          key: t,
+          padding: E.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: 48
+        }, Buffer.from(r, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  PS512: {
+    sign: (e, t) => b("RSA-SHA512").update(e).end().sign({
+      //@ts-ignore
+      key: t,
+      padding: E.constants.RSA_PKCS1_PSS_PADDING,
+      saltLength: 64
+    }).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return A("RSA-SHA512").update(e).end().verify({
+          //@ts-ignore
+          key: t,
+          padding: E.constants.RSA_PKCS1_PSS_PADDING,
+          saltLength: 64
+        }, Buffer.from(r, "base64url"));
+      } catch {
+        return !1;
+      }
+    }
+  },
+  EdDSA: {
+    sign: (e, t) => G(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, t).toString("base64url"),
+    verify: (e, t, r) => {
+      try {
+        return F(
+          null,
+          typeof e == "string" ? Buffer.from(e, "utf8") : e,
+          t,
+          Buffer.from(r, "base64url")
+        );
+      } catch {
+        return !1;
+      }
+    }
+  }
+}, ce = Object.keys(m);
+function Z(e) {
+  if (e.type === "secret") return "HS256";
+  if (e.type !== "private") throw new Error("Only private or symmetric keys can be used to sign JWTs");
+  const t = e.asymmetricKeyType, r = e.asymmetricKeyDetails;
+  switch (t) {
+    case "rsa":
+      return "RS256";
+    case "rsa-pss": {
+      const n = r?.hashAlgorithm ?? "sha256";
+      switch (n) {
+        case "sha256":
+          return "PS256";
+        case "sha384":
+          return "PS384";
+        case "sha512":
+          return "PS512";
+        default:
+          throw new Error(`Unsupported RSA-PSS hash algorithm: ${n}`);
+      }
+    }
+    case "ec": {
+      const n = r?.namedCurve;
+      switch (n) {
+        case "P-256":
+        case "prime256v1":
+          return "ES256";
+        case "P-384":
+        case "secp384r1":
+          return "ES384";
+        case "P-521":
+        case "secp521r1":
+          return "ES512";
+        case "secp256k1":
+          return "ES256K";
+        default:
+          throw new Error(`Unsupported EC curve: ${n}`);
+      }
+    }
+    case "ed25519":
+      return "EdDSA";
+    default:
+      throw new Error(`Unsupported asymmetric key type: ${t}`);
+  }
+}
+function Q(e) {
+  if (typeof e == "object" && "type" in e) return e;
+  try {
+    return J(e);
+  } catch {
+    const t = typeof e == "string" ? Buffer.from(e, "utf8") : Buffer.isBuffer(e) ? e : (() => {
+      throw new Error("Unsupported key type");
+    })();
+    return R(t);
+  }
+}
+const C = (e) => {
+  const t = e.split(".");
+  if (t.length !== 3)
+    throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');
+  const [r, n, o] = t;
+  if (!r || !n || !o)
+    throw new Error("Invalid JWT: empty part detected");
+  if (!D.test(r) || !D.test(n) || !D.test(o))
+    throw new Error("Invalid JWT: non-base64url characters detected");
+  try {
+    const c = JSON.parse(P.decode(r)), i = JSON.parse(P.decode(n));
+    if (!_(c) || !_(i))
+      throw new Error("header and payload must be JSON objects");
+    const s = c, l = i;
+    if (typeof s.alg != "string" || s.alg.length === 0)
+      throw new Error("header.alg must be a non-empty string");
+    if (s.typ !== void 0 && typeof s.typ != "string")
+      throw new Error("header.typ must be a string");
+    if (s.kid !== void 0 && typeof s.kid != "string")
+      throw new Error("header.kid must be a string");
+    return { header: s, payload: l, signature: o };
+  } catch (c) {
+    throw new Error(`Invalid JWT: malformed header or payload (${c.message})`);
+  }
+}, ee = (e, t, r = {}) => {
+  const n = Q(t), o = r.alg ?? Z(n), c = r.signatureFormat ?? "der", i = r.typ ?? "JWT";
+  if (!(o in m)) throw new Error(`Unsupported algorithm: ${o}`);
+  const s = { alg: o, typ: i };
+  r.kid && (s.kid = r.kid);
+  const l = P.encode(JSON.stringify(s)), f = P.encode(JSON.stringify(e)), v = `${l}.${f}`;
+  let y = m[o].sign(v, t);
+  if (c === "jose" && V(o)) {
+    const h = Buffer.from(y, "base64url");
+    y = Y(h, H(o)).toString("base64url");
+  }
+  return `${l}.${f}.${y}`;
+}, re = (e, t, r = {}) => {
+  const n = X(r);
+  if (n)
+    return {
+      valid: !1,
+      error: n
+    };
+  let o;
+  try {
+    o = C(e);
+  } catch (a) {
+    return {
+      valid: !1,
+      error: {
+        reason: a.message,
+        code: "INVALID_TOKEN"
+      }
+    };
+  }
+  const { header: c, payload: i, signature: s } = o, l = z(i);
+  if (l)
+    return {
+      valid: !1,
+      error: l
+    };
+  const f = c.alg;
+  if (!(f in m))
+    return {
+      valid: !1,
+      error: {
+        reason: `Unsupported or unknown algorithm: ${c.alg}`,
+        code: "INVALID_ALGORITHM"
+      }
+    };
+  if (r.algorithms && r.algorithms.length > 0 && !r.algorithms.includes(f))
+    return {
+      valid: !1,
+      error: {
+        reason: `Algorithm "${f}" is not in the allowed algorithms list`,
+        code: "ALGORITHM_NOT_ALLOWED"
+      }
+    };
+  if (c.typ !== void 0 && c.typ !== "JWT")
+    return {
+      valid: !1,
+      error: {
+        reason: `Invalid token type: expected 'JWT', got '${c.typ}'`,
+        code: "INVALID_TYPE"
+      }
+    };
+  const [v, y] = e.split("."), h = `${v}.${y}`;
+  if (V(f)) {
+    const a = r.signatureFormat;
+    let u;
+    if (a === "jose")
+      try {
+        const g = Buffer.from(s, "base64url"), S = B(g).toString("base64url");
+        u = m[f].verify(h, t, S);
+      } catch {
+        u = !1;
+      }
+    else if (a === "der")
+      u = m[f].verify(h, t, s);
+    else if (u = m[f].verify(h, t, s), !u)
+      try {
+        const g = Buffer.from(s, "base64url");
+        if (g.length === H(f)) {
+          const S = B(g).toString("base64url");
+          u = m[f].verify(h, t, S);
+        }
+      } catch {
+      }
+    if (!u)
+      return { valid: !1, error: { reason: "Signature verification failed", code: "INVALID_SIGNATURE" } };
+  } else {
+    let a = !1;
+    try {
+      a = m[f].verify(h, t, s);
+    } catch {
+      a = !1;
+    }
+    if (!a)
+      return { valid: !1, error: { reason: "Signature verification failed", code: "INVALID_SIGNATURE" } };
+  }
+  const p = Math.floor(Date.now() / 1e3), d = r.clockSkew ?? 0;
+  if (!r.ignoreExpiration && i.exp !== void 0 && p > i.exp + d)
+    return {
+      valid: !1,
+      error: {
+        reason: "Token expired",
+        code: "TOKEN_EXPIRED"
+      }
+    };
+  if (i.nbf !== void 0 && p + d < i.nbf)
+    return {
+      valid: !1,
+      error: {
+        reason: "Token not yet valid",
+        code: "TOKEN_NOT_ACTIVE"
+      }
+    };
+  if (i.iat !== void 0 && p + d < i.iat)
+    return {
+      valid: !1,
+      error: {
+        reason: "Token issued in the future",
+        code: "TOKEN_FUTURE_ISSUED"
+      }
+    };
+  if (r.maxTokenAge !== void 0 && i.iat !== void 0) {
+    const a = p - i.iat;
+    if (a > r.maxTokenAge)
+      return {
+        valid: !1,
+        error: {
+          reason: `Token age (${a}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,
+          code: "TOKEN_TOO_OLD"
+        }
+      };
+  }
+  if (r.issuer !== void 0) {
+    if (i.iss === void 0)
+      return {
+        valid: !1,
+        error: {
+          reason: 'Token missing required issuer claim ("iss")',
+          code: "MISSING_ISSUER"
+        }
+      };
+    if (r.issuer !== i.iss)
+      return {
+        valid: !1,
+        error: {
+          reason: `Invalid token issuer: expected "${r.issuer}", got "${i.iss}"`,
+          code: "INVALID_ISSUER"
+        }
+      };
+  }
+  if (r.subject !== void 0) {
+    if (i.sub === void 0)
+      return {
+        valid: !1,
+        error: {
+          reason: 'Token missing required subject claim ("sub")',
+          code: "MISSING_SUBJECT"
+        }
+      };
+    if (r.subject !== i.sub)
+      return {
+        valid: !1,
+        error: {
+          reason: `Invalid token subject: expected "${r.subject}", got "${i.sub}"`,
+          code: "INVALID_SUBJECT"
+        }
+      };
+  }
+  if (r.audience !== void 0) {
+    const a = i.aud;
+    if (a === void 0)
+      return {
+        valid: !1,
+        error: {
+          reason: 'Token missing required audience claim ("aud")',
+          code: "MISSING_AUDIENCE"
+        }
+      };
+    const u = Array.isArray(r.audience) ? r.audience : [r.audience], g = Array.isArray(a) ? a : [a];
+    if (!u.some((I) => g.includes(I)))
+      return {
+        valid: !1,
+        error: {
+          reason: "Audience claim mismatch",
+          code: "INVALID_AUDIENCE"
+        }
+      };
+  }
+  if (r.jwtId !== void 0) {
+    if (i.jti === void 0)
+      return {
+        valid: !1,
+        error: {
+          reason: 'Token missing required JWT ID claim ("jti")',
+          code: "MISSING_JTI"
+        }
+      };
+    if (r.jwtId !== i.jti)
+      return {
+        valid: !1,
+        error: {
+          reason: `Invalid JWT ID: expected "${r.jwtId}", got "${i.jti}"`,
+          code: "INVALID_JTI"
+        }
+      };
+  }
+  return { valid: !0, header: c, payload: i, signature: s };
+}, fe = {
+  sign: ee,
+  verify: re,
+  decode: C,
+  algorithms: m
+};
+function te(e) {
+  if (!e || typeof e != "object") throw new Error("Invalid KeyObject");
+  return e.export({ format: "jwk" });
+}
+function K(e) {
+  if (!e || typeof e != "object") throw new Error("Invalid JWK");
+  switch (e.kty) {
+    case "oct": {
+      if (!("k" in e) || typeof e.k != "string")
+        throw new Error('Invalid oct JWK: missing "k"');
+      return R(Buffer.from(e.k, "base64url"));
+    }
+    case "RSA":
+    case "EC":
+    case "OKP":
+      return "d" in e && typeof e.d == "string" ? J({ format: "jwk", key: e }) : L({ format: "jwk", key: e });
+    default:
+      throw new Error(`Unsupported JWK key type: ${e.kty}`);
+  }
+}
+function ne(e) {
+  if (!e || typeof e != "object")
+    throw new Error("Invalid KeyObject");
+  const r = (e.type === "private" ? L(e) : e).export({ format: "jwk" });
+  return delete r.d, delete r.p, delete r.q, delete r.dp, delete r.dq, delete r.qi, r;
+}
+function U(e, t = "sha256") {
+  if (!e || typeof e != "object")
+    throw new Error("Invalid JWK");
+  let r;
+  switch (e.kty) {
+    case "RSA":
+      r = { e: e.e, kty: e.kty, n: e.n };
+      break;
+    case "EC":
+      r = { crv: e.crv, kty: e.kty, x: e.x, y: e.y };
+      break;
+    case "OKP":
+      r = { crv: e.crv, kty: e.kty, x: e.x };
+      break;
+    case "oct":
+      r = { k: e.k, kty: e.kty };
+      break;
+    default:
+      throw new Error(`Unsupported JWK key type: ${e.kty}`);
+  }
+  const n = JSON.stringify(
+    Object.keys(r).sort().reduce((o, c) => (o[c] = r[c], o), {})
+  );
+  return $(t).update(n).digest("base64url");
+}
+function ie(e) {
+  if (e.x5c?.length)
+    return $("sha1").update(Buffer.from(e.x5c[0], "base64")).digest("base64url");
+}
+const ue = {
+  export: te,
+  import: K,
+  toPublic: ne,
+  thumbprint: U
+};
+function ae(e, t) {
+  if (!e || !Array.isArray(e.keys)) throw new Error("Invalid JWKS");
+  let r;
+  if (t && (r = e.keys.find((n) => n.kid === t)), !r && e.keys.length === 1 && (r = e.keys[0]), !r) throw new Error("Key not found in JWKS");
+  return K(r);
+}
+function O(e) {
+  return {
+    keys: T(...e.keys)
+  };
+}
+function T(...e) {
+  return e.map((t) => {
+    const r = {
+      ...t,
+      kid: t.kid ?? U(t),
+      x5t: t.x5t ?? ie(t)
+    };
+    return Object.defineProperty(r, "toKeyObject", {
+      enumerable: !1,
+      configurable: !1,
+      writable: !1,
+      value: () => K(r)
+    }), r;
+  });
+}
+const se = async (e, t = {}) => {
+  const r = typeof e == "string" ? e : e.toString(), n = t.fetch ?? globalThis.fetch, o = Math.max(0, t.ttl ?? 5 * 6e4), c = Math.max(0, t.timeoutMs ?? 5e3), i = "/.well-known/jwks.json";
+  if (!n)
+    throw new Error("No fetch implementation available");
+  const s = (() => {
+    if (t.endpointOverride) {
+      const d = t.endpointOverride;
+      try {
+        return new URL(d, r).toString();
+      } catch {
+        return d;
+      }
+    }
+    return t.overrideEndpointCheck || r.endsWith(i) ? r : `${r.replace(/\/+$/, "")}${i}`;
+  })(), l = (() => {
+    if (t.cache) return t.cache;
+    let d;
+    return {
+      get: () => d,
+      set: (a, u) => {
+        d = u;
+      }
+    };
+  })();
+  let f, v = 0, y, h = 0;
+  const p = async (d) => {
+    if (y) return y;
+    y = (async () => {
+      const a = new AbortController();
+      let u;
+      c > 0 && (u = setTimeout(() => a.abort(), c));
+      let g;
+      try {
+        g = await n(s, { signal: a.signal });
+      } catch (I) {
+        throw a.signal.aborted ? new Error(`JWKS fetch timed out after ${c}ms`) : I;
+      } finally {
+        u && clearTimeout(u);
+      }
+      if (!g.ok)
+        throw new Error(`Failed to fetch JWKS: ${g.status} ${g.statusText}`);
+      const S = await g.json();
+      if (!S || typeof S != "object" || !Array.isArray(S.keys))
+        throw new Error("Invalid JWKS");
+      return O(S);
+    })();
+    try {
+      const a = await y;
+      return f = a, await l.set(s, a), h = 0, o > 0 && (v = Date.now() + o), a;
+    } catch (a) {
+      if (!d || !f)
+        throw a;
+      if (h += 1, o > 0) {
+        const u = Math.min(
+          Math.max(o, 3e4) * Math.pow(2, h - 1),
+          9e5
+        );
+        v = Date.now() + u;
+      }
+      return console.warn(`JWKS refresh failed for "${s}", using stale cache.`, a), f;
+    } finally {
+      y = void 0;
+    }
+  };
+  return f = await l.get(s), f ? (f = O(f), o > 0 && (v = Date.now() + o)) : f = await p(!1), {
+    async list() {
+      return o > 0 && Date.now() >= v && await p(!0), T(...f.keys);
+    },
+    async refresh() {
+      return await p(!1), this;
+    },
+    async key(d) {
+      const u = (await this.list()).find((g) => g.kid === d);
+      if (u)
+        return T(u)[0];
+    },
+    async find(d) {
+      const a = await this.list(), u = Object.entries(d);
+      return u.length === 0 ? T(...a) : T(...a.filter(
+        (g) => u.every(([S, I]) => {
+          const x = g[S];
+          return Array.isArray(I) ? Array.isArray(x) && x.length === I.length && x.every((j, M) => j === I[M]) : x === I;
+        })
+      ));
+    },
+    async findFirst(d) {
+      return this.find(d).then(([a]) => a);
+    },
+    export() {
+      return f;
+    }
+  };
+}, de = {
+  toKeyObject: ae,
+  normalize: O,
+  fromWeb: se
+};
+export {
+  Z as A,
+  ue as J,
+  m as S,
+  de as a,
+  ae as b,
+  fe as c,
+  ce as d,
+  P as e,
+  ie as f,
+  C as g,
+  te as h,
+  se as i,
+  U as j,
+  K as k,
+  O as l,
+  T as n,
+  ee as s,
+  ne as t,
+  re as v
+};
+//# sourceMappingURL=index-tE21mX91.js.map