@sourceregistry/node-jwt 1.5.7 → 1.5.8

package/dist/{index-CRVBqFI5.js → index-Cp1eA1Xq.js}

@@ -1,15 +1,15 @@
-import J, { verify as z, sign as X, createVerify as $, createSign as W, createHmac as P, createPrivateKey as R, createSecretKey as V, timingSafeEqual as Y, createHash as L, createPublicKey as U } from "crypto";
+import _, { verify as z, sign as X, createVerify as R, createSign as L, createHmac as B, createPrivateKey as V, createSecretKey as U, timingSafeEqual as Y, createHash as j, createPublicKey as H } from "crypto";
 const x = {
   encode: (e) => Buffer.from(e).toString("base64url"),
   decode: (e) => Buffer.from(e, "base64url").toString()
-}, Z = (e, t) => e.length !== t.length ? !1 : Y(Buffer.from(e), Buffer.from(t)), N = /^[A-Za-z0-9_-]+$/;
-function _(e) {
+}, Z = (e, t) => e.length !== t.length ? !1 : Y(Buffer.from(e), Buffer.from(t)), O = /^[A-Za-z0-9_-]+$/;
+function $(e) {
   return typeof e == "object" && e !== null && !Array.isArray(e);
 }
 function w(e) {
   return typeof e == "number" && Number.isFinite(e);
 }
-function j(e) {
+function N(e) {
   return Array.isArray(e) && e.every((t) => typeof t == "string");
 }
 function Q(e) {
@@ -28,7 +28,7 @@ function Q(e) {
         reason: `Invalid "${r.claim}" claim: expected ${r.expected}`,
         code: "INVALID_CLAIM"
       };
-  return e.aud !== void 0 && !(typeof e.aud == "string" || j(e.aud)) ? {
+  return e.aud !== void 0 && !(typeof e.aud == "string" || N(e.aud)) ? {
     reason: 'Invalid "aud" claim: expected string or string[]',
     code: "INVALID_CLAIM"
   } : null;
@@ -64,7 +64,7 @@ function ee(e) {
       reason: "Invalid jwtId option: expected string",
       code: "INVALID_OPTIONS"
     };
-  if (e.audience !== void 0 && !(typeof e.audience == "string" || j(e.audience)))
+  if (e.audience !== void 0 && !(typeof e.audience == "string" || N(e.audience)))
     return {
       reason: "Invalid audience option: expected string or string[]",
       code: "INVALID_OPTIONS"
@@ -75,7 +75,7 @@ function ee(e) {
         reason: "Invalid algorithms option: expected an array",
         code: "INVALID_OPTIONS"
       };
-    const t = e.algorithms.find((r) => !(r in m));
+    const t = e.algorithms.find((r) => !(r in v));
     if (t)
       return {
         reason: `Invalid algorithms option: unsupported algorithm "${t}"`,
@@ -84,6 +84,15 @@ function ee(e) {
   }
   return null;
 }
+function re(e) {
+  return e.crit !== void 0 ? !N(e.crit) || e.crit.length === 0 ? {
+    reason: 'Invalid "crit" header: expected non-empty string[]',
+    code: "INVALID_HEADER"
+  } : {
+    reason: `Unsupported critical header parameters: ${e.crit.join(", ")}`,
+    code: "UNSUPPORTED_CRITICAL_HEADER"
+  } : null;
+}
 function C(e) {
   switch (e) {
     case "ES256":
@@ -101,83 +110,83 @@ function C(e) {
       throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`);
   }
 }
-function re(e, t) {
+function te(e, t) {
   let r = 0;
   if (e[r++] !== 48) throw new Error("Invalid DER ECDSA signature");
   let n = e[r++];
   if (n & 128) {
-    const v = n & 127;
+    const d = n & 127;
     n = 0;
-    for (let g = 0; g < v; g++) n = n << 8 | e[r++];
+    for (let y = 0; y < d; y++) n = n << 8 | e[r++];
   }
   if (e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (r)");
-  const i = e[r++];
-  let o = e.subarray(r, r + i);
-  if (r += i, e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (s)");
   const a = e[r++];
-  let s = e.subarray(r, r + a);
-  for (; o.length > t / 2 && o[0] === 0; ) o = o.subarray(1);
-  for (; s.length > t / 2 && s[0] === 0; ) s = s.subarray(1);
-  const l = Buffer.concat([Buffer.alloc(t / 2 - o.length, 0), o]), c = Buffer.concat([Buffer.alloc(t / 2 - s.length, 0), s]);
-  return Buffer.concat([l, c]);
+  let c = e.subarray(r, r + a);
+  if (r += a, e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (s)");
+  const s = e[r++];
+  let i = e.subarray(r, r + s);
+  for (; c.length > t / 2 && c[0] === 0; ) c = c.subarray(1);
+  for (; i.length > t / 2 && i[0] === 0; ) i = i.subarray(1);
+  const g = Buffer.concat([Buffer.alloc(t / 2 - c.length, 0), c]), u = Buffer.concat([Buffer.alloc(t / 2 - i.length, 0), i]);
+  return Buffer.concat([g, u]);
 }
-function B(e) {
+function W(e) {
   const t = e.length / 2;
   let r = e.subarray(0, t), n = e.subarray(t);
   for (; r.length > 1 && r[0] === 0 && (r[1] & 128) === 0; ) r = r.subarray(1);
   for (; n.length > 1 && n[0] === 0 && (n[1] & 128) === 0; ) n = n.subarray(1);
   r[0] & 128 && (r = Buffer.concat([Buffer.from([0]), r])), n[0] & 128 && (n = Buffer.concat([Buffer.from([0]), n]));
-  const i = Buffer.concat([Buffer.from([2, r.length]), r]), o = Buffer.concat([Buffer.from([2, n.length]), n]), a = i.length + o.length;
-  let s;
-  if (a < 128)
-    s = Buffer.from([a]);
+  const a = Buffer.concat([Buffer.from([2, r.length]), r]), c = Buffer.concat([Buffer.from([2, n.length]), n]), s = a.length + c.length;
+  let i;
+  if (s < 128)
+    i = Buffer.from([s]);
   else {
-    const l = [];
-    let c = a;
-    for (; c > 0; )
-      l.unshift(c & 255), c >>= 8;
-    s = Buffer.from([128 | l.length, ...l]);
+    const g = [];
+    let u = s;
+    for (; u > 0; )
+      g.unshift(u & 255), u >>= 8;
+    i = Buffer.from([128 | g.length, ...g]);
   }
-  return Buffer.concat([Buffer.from([48]), s, i, o]);
+  return Buffer.concat([Buffer.from([48]), i, a, c]);
 }
-function H(e) {
+function K(e) {
   return e === "ES256" || e === "ES384" || e === "ES512" || e === "ES256K";
 }
-const O = (e) => ({
-  sign: (t, r) => P(e, r).update(t).digest("base64url"),
+const D = (e) => ({
+  sign: (t, r) => B(e, r).update(t).digest("base64url"),
   verify: (t, r, n) => {
-    const i = P(e, r).update(t).digest("base64url");
-    return Z(i, n);
+    const a = B(e, r).update(t).digest("base64url");
+    return Z(a, n);
   }
-}), b = (e) => ({
-  sign: (t, r) => W(e).update(t).end().sign(r).toString("base64url"),
+}), p = (e) => ({
+  sign: (t, r) => L(e).update(t).end().sign(r).toString("base64url"),
   verify: (t, r, n) => {
     try {
-      return $(e).update(t).end().verify(r, Buffer.from(n, "base64url"));
+      return R(e).update(t).end().verify(r, Buffer.from(n, "base64url"));
     } catch {
       return !1;
     }
   }
 }), k = (e, t) => ({
-  sign: (r, n) => W(e).update(r).end().sign({
+  sign: (r, n) => L(e).update(r).end().sign({
     //@ts-ignore
     key: n,
-    padding: J.constants.RSA_PKCS1_PSS_PADDING,
+    padding: _.constants.RSA_PKCS1_PSS_PADDING,
     saltLength: t
   }).toString("base64url"),
-  verify: (r, n, i) => {
+  verify: (r, n, a) => {
     try {
-      return $(e).update(r).end().verify({
+      return R(e).update(r).end().verify({
         //@ts-ignore
         key: n,
-        padding: J.constants.RSA_PKCS1_PSS_PADDING,
+        padding: _.constants.RSA_PKCS1_PSS_PADDING,
         saltLength: t
-      }, Buffer.from(i, "base64url"));
+      }, Buffer.from(a, "base64url"));
     } catch {
       return !1;
     }
   }
-}), te = {
+}), ne = {
   sign: (e, t) => X(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, t).toString("base64url"),
   verify: (e, t, r) => {
     try {
@@ -191,26 +200,26 @@ const O = (e) => ({
       return !1;
     }
   }
-}, m = {
+}, v = {
   // HMAC
-  HS256: O("sha256"),
-  HS384: O("sha384"),
-  HS512: O("sha512"),
+  HS256: D("sha256"),
+  HS384: D("sha384"),
+  HS512: D("sha512"),
   // RSA (DER-encoded signatures, base64url)
-  RS256: b("RSA-SHA256"),
-  RS384: b("RSA-SHA384"),
-  RS512: b("RSA-SHA512"),
-  // ECDSA (DER-encoded by default — no dsaEncoding!)
-  ES256: b("SHA256"),
-  ES384: b("SHA384"),
-  ES512: b("SHA512"),
-  ES256K: b("SHA256"),
+  RS256: p("RSA-SHA256"),
+  RS384: p("RSA-SHA384"),
+  RS512: p("RSA-SHA512"),
+  // ECDSA (Node/OpenSSL emits DER; sign() converts to JOSE by default for JWTs)
+  ES256: p("SHA256"),
+  ES384: p("SHA384"),
+  ES512: p("SHA512"),
+  ES256K: p("SHA256"),
   PS256: k("RSA-SHA256", 32),
   PS384: k("RSA-SHA384", 48),
   PS512: k("RSA-SHA512", 64),
-  EdDSA: te
-}, ge = Object.keys(m);
-function ne(e) {
+  EdDSA: ne
+}, he = Object.keys(v);
+function ie(e) {
   if (e.type === "secret") return "HS256";
   if (e.type !== "private") throw new Error("Only private or symmetric keys can be used to sign JWTs");
   const t = e.asymmetricKeyType, r = e.asymmetricKeyDetails;
@@ -218,7 +227,7 @@ function ne(e) {
     case "rsa":
       return "RS256";
     case "rsa-pss": {
-      const n = r?.hashAlgorithm ?? "sha256";
+      const n = (r == null ? void 0 : r.hashAlgorithm) ?? "sha256";
       switch (n) {
         case "sha256":
           return "PS256";
@@ -231,7 +240,7 @@ function ne(e) {
       }
     }
     case "ec": {
-      const n = r?.namedCurve;
+      const n = r == null ? void 0 : r.namedCurve;
       switch (n) {
         case "P-256":
         case "prime256v1":
@@ -254,139 +263,147 @@ function ne(e) {
       throw new Error(`Unsupported asymmetric key type: ${t}`);
   }
 }
-function ie(e) {
+function ae(e) {
   if (typeof e == "object" && "type" in e) return e;
   try {
-    return R(e);
+    return V(e);
   } catch {
     const t = typeof e == "string" ? Buffer.from(e, "utf8") : Buffer.isBuffer(e) ? e : (() => {
       throw new Error("Unsupported key type");
     })();
-    return V(t);
+    return U(t);
   }
 }
 const M = (e) => {
   const t = e.split(".");
   if (t.length !== 3)
     throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');
-  const [r, n, i] = t;
-  if (!r || !n || !i)
+  const [r, n, a] = t;
+  if (!r || !n || !a)
     throw new Error("Invalid JWT: empty part detected");
-  if (!N.test(r) || !N.test(n) || !N.test(i))
+  if (!O.test(r) || !O.test(n) || !O.test(a))
     throw new Error("Invalid JWT: non-base64url characters detected");
   try {
-    const o = JSON.parse(x.decode(r)), a = JSON.parse(x.decode(n));
-    if (!_(o) || !_(a))
+    const c = JSON.parse(x.decode(r)), s = JSON.parse(x.decode(n));
+    if (!$(c) || !$(s))
       throw new Error("header and payload must be JSON objects");
-    const s = o, l = a;
-    if (typeof s.alg != "string" || s.alg.length === 0)
+    const i = c, g = s;
+    if (typeof i.alg != "string" || i.alg.length === 0)
       throw new Error("header.alg must be a non-empty string");
-    if (s.typ !== void 0 && typeof s.typ != "string")
+    if (i.typ !== void 0 && typeof i.typ != "string")
       throw new Error("header.typ must be a string");
-    if (s.kid !== void 0 && typeof s.kid != "string")
+    if (i.kid !== void 0 && typeof i.kid != "string")
       throw new Error("header.kid must be a string");
-    return { header: s, payload: l, signature: i };
-  } catch (o) {
-    throw new Error(`Invalid JWT: malformed header or payload (${o.message})`);
-  }
-}, ae = (e, t, r = {}) => {
-  const n = ie(t), i = r.alg ?? ne(n), o = r.signatureFormat ?? "der", a = r.typ ?? "JWT";
-  if (!(i in m)) throw new Error(`Unsupported algorithm: ${i}`);
-  const s = { alg: i, typ: a };
-  r.kid && (s.kid = r.kid);
-  const l = x.encode(JSON.stringify(s)), c = x.encode(JSON.stringify(e)), v = `${l}.${c}`;
-  let g = m[i].sign(v, t);
-  if (o === "jose" && H(i)) {
-    const y = Buffer.from(g, "base64url");
-    g = re(y, C(i)).toString("base64url");
+    if (i.crit !== void 0 && (!N(i.crit) || i.crit.length === 0))
+      throw new Error("header.crit must be a non-empty string[]");
+    return { header: i, payload: g, signature: a };
+  } catch (c) {
+    throw new Error(`Invalid JWT: malformed header or payload (${c.message})`);
   }
-  return `${l}.${c}.${g}`;
 }, se = (e, t, r = {}) => {
+  const n = ae(t), a = r.alg ?? ie(n), c = r.signatureFormat ?? (K(a) ? "jose" : "der"), s = r.typ ?? "JWT";
+  if (!(a in v)) throw new Error(`Unsupported algorithm: ${a}`);
+  const i = { alg: a, typ: s };
+  r.kid && (i.kid = r.kid);
+  const g = x.encode(JSON.stringify(i)), u = x.encode(JSON.stringify(e)), d = `${g}.${u}`;
+  let y = v[a].sign(d, t);
+  if (c === "jose" && K(a)) {
+    const b = Buffer.from(y, "base64url");
+    y = te(b, C(a)).toString("base64url");
+  }
+  return `${g}.${u}.${y}`;
+}, oe = (e, t, r = {}) => {
   const n = ee(r);
   if (n)
     return {
       valid: !1,
       error: n
     };
-  let i;
+  let a;
   try {
-    i = M(e);
-  } catch (f) {
+    a = M(e);
+  } catch (o) {
     return {
       valid: !1,
       error: {
-        reason: f.message,
+        reason: o.message,
         code: "INVALID_TOKEN"
       }
     };
   }
-  const { header: o, payload: a, signature: s } = i, l = Q(a);
-  if (l)
+  const { header: c, payload: s, signature: i } = a, g = re(c);
+  if (g)
     return {
       valid: !1,
-      error: l
+      error: g
     };
-  const c = o.alg;
-  if (!(c in m))
+  const u = Q(s);
+  if (u)
+    return {
+      valid: !1,
+      error: u
+    };
+  const d = c.alg;
+  if (!(d in v))
     return {
       valid: !1,
       error: {
-        reason: `Unsupported or unknown algorithm: ${o.alg}`,
+        reason: `Unsupported or unknown algorithm: ${c.alg}`,
         code: "INVALID_ALGORITHM"
       }
     };
-  if (r.algorithms && r.algorithms.length > 0 && !r.algorithms.includes(c))
+  if (r.algorithms && r.algorithms.length > 0 && !r.algorithms.includes(d))
     return {
       valid: !1,
       error: {
-        reason: `Algorithm "${c}" is not in the allowed algorithms list`,
+        reason: `Algorithm "${d}" is not in the allowed algorithms list`,
         code: "ALGORITHM_NOT_ALLOWED"
       }
     };
-  if (o.typ !== void 0 && o.typ !== "JWT")
+  if (c.typ !== void 0 && c.typ !== "JWT")
     return {
       valid: !1,
       error: {
-        reason: `Invalid token type: expected 'JWT', got '${o.typ}'`,
+        reason: `Invalid token type: expected 'JWT', got '${c.typ}'`,
         code: "INVALID_TYPE"
       }
     };
-  const [v, g] = e.split("."), y = `${v}.${g}`;
-  if (H(c)) {
-    const f = r.signatureFormat;
-    let u;
-    if (f === "jose")
+  const [y, b] = e.split("."), S = `${y}.${b}`;
+  if (K(d)) {
+    const o = r.signatureFormat;
+    let f;
+    if (o === "jose")
       try {
-        const d = Buffer.from(s, "base64url"), h = B(d).toString("base64url");
-        u = m[c].verify(y, t, h);
+        const h = Buffer.from(i, "base64url"), m = W(h).toString("base64url");
+        f = v[d].verify(S, t, m);
       } catch {
-        u = !1;
+        f = !1;
       }
-    else if (f === "der")
-      u = m[c].verify(y, t, s);
-    else if (u = m[c].verify(y, t, s), !u)
+    else if (o === "der")
+      f = v[d].verify(S, t, i);
+    else if (f = v[d].verify(S, t, i), !f)
       try {
-        const d = Buffer.from(s, "base64url");
-        if (d.length === C(c)) {
-          const h = B(d).toString("base64url");
-          u = m[c].verify(y, t, h);
+        const h = Buffer.from(i, "base64url");
+        if (h.length === C(d)) {
+          const m = W(h).toString("base64url");
+          f = v[d].verify(S, t, m);
         }
       } catch {
       }
-    if (!u)
+    if (!f)
       return { valid: !1, error: { reason: "Signature verification failed", code: "INVALID_SIGNATURE" } };
   } else {
-    let f = !1;
+    let o = !1;
     try {
-      f = m[c].verify(y, t, s);
+      o = v[d].verify(S, t, i);
     } catch {
-      f = !1;
+      o = !1;
     }
-    if (!f)
+    if (!o)
       return { valid: !1, error: { reason: "Signature verification failed", code: "INVALID_SIGNATURE" } };
   }
-  const S = Math.floor(Date.now() / 1e3), I = r.clockSkew ?? 0;
-  if (!r.ignoreExpiration && a.exp !== void 0 && S > a.exp + I)
+  const I = Math.floor(Date.now() / 1e3), l = r.clockSkew ?? 0;
+  if (!r.ignoreExpiration && s.exp !== void 0 && I > s.exp + l)
     return {
       valid: !1,
       error: {
@@ -394,7 +411,7 @@ const M = (e) => {
         code: "TOKEN_EXPIRED"
       }
     };
-  if (a.nbf !== void 0 && S + I < a.nbf)
+  if (s.nbf !== void 0 && I + l < s.nbf)
     return {
       valid: !1,
       error: {
@@ -402,7 +419,7 @@ const M = (e) => {
         code: "TOKEN_NOT_ACTIVE"
       }
     };
-  if (a.iat !== void 0 && S + I < a.iat)
+  if (s.iat !== void 0 && I + l < s.iat)
     return {
       valid: !1,
       error: {
@@ -410,19 +427,19 @@ const M = (e) => {
         code: "TOKEN_FUTURE_ISSUED"
       }
     };
-  if (r.maxTokenAge !== void 0 && a.iat !== void 0) {
-    const f = S - a.iat;
-    if (f > r.maxTokenAge)
+  if (r.maxTokenAge !== void 0 && s.iat !== void 0) {
+    const o = I - s.iat;
+    if (o > r.maxTokenAge)
       return {
         valid: !1,
         error: {
-          reason: `Token age (${f}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,
+          reason: `Token age (${o}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,
           code: "TOKEN_TOO_OLD"
         }
       };
   }
   if (r.issuer !== void 0) {
-    if (a.iss === void 0)
+    if (s.iss === void 0)
       return {
         valid: !1,
         error: {
@@ -430,17 +447,17 @@ const M = (e) => {
           code: "MISSING_ISSUER"
         }
       };
-    if (r.issuer !== a.iss)
+    if (r.issuer !== s.iss)
       return {
         valid: !1,
         error: {
-          reason: `Invalid token issuer: expected "${r.issuer}", got "${a.iss}"`,
+          reason: `Invalid token issuer: expected "${r.issuer}", got "${s.iss}"`,
           code: "INVALID_ISSUER"
         }
       };
   }
   if (r.subject !== void 0) {
-    if (a.sub === void 0)
+    if (s.sub === void 0)
       return {
         valid: !1,
         error: {
@@ -448,18 +465,18 @@ const M = (e) => {
           code: "MISSING_SUBJECT"
         }
       };
-    if (r.subject !== a.sub)
+    if (r.subject !== s.sub)
       return {
         valid: !1,
         error: {
-          reason: `Invalid token subject: expected "${r.subject}", got "${a.sub}"`,
+          reason: `Invalid token subject: expected "${r.subject}", got "${s.sub}"`,
           code: "INVALID_SUBJECT"
         }
       };
   }
   if (r.audience !== void 0) {
-    const f = a.aud;
-    if (f === void 0)
+    const o = s.aud;
+    if (o === void 0)
       return {
         valid: !1,
         error: {
@@ -467,8 +484,8 @@ const M = (e) => {
           code: "MISSING_AUDIENCE"
         }
       };
-    const u = Array.isArray(r.audience) ? r.audience : [r.audience], d = Array.isArray(f) ? f : [f];
-    if (!u.some((A) => d.includes(A)))
+    const f = Array.isArray(r.audience) ? r.audience : [r.audience], h = Array.isArray(o) ? o : [o];
+    if (!f.some((A) => h.includes(A)))
       return {
         valid: !1,
         error: {
@@ -478,7 +495,7 @@ const M = (e) => {
       };
   }
   if (r.jwtId !== void 0) {
-    if (a.jti === void 0)
+    if (s.jti === void 0)
       return {
         valid: !1,
         error: {
@@ -486,46 +503,46 @@ const M = (e) => {
           code: "MISSING_JTI"
         }
       };
-    if (r.jwtId !== a.jti)
+    if (r.jwtId !== s.jti)
       return {
         valid: !1,
         error: {
-          reason: `Invalid JWT ID: expected "${r.jwtId}", got "${a.jti}"`,
+          reason: `Invalid JWT ID: expected "${r.jwtId}", got "${s.jti}"`,
           code: "INVALID_JTI"
         }
       };
   }
-  return { valid: !0, header: o, payload: a, signature: s };
-}, he = {
-  sign: ae,
-  verify: se,
+  return { valid: !0, header: c, payload: s, signature: i };
+}, ye = {
+  sign: se,
+  verify: oe,
   decode: M,
-  algorithms: m
+  algorithms: v
 };
-function oe(e) {
+function ce(e) {
   if (!e || typeof e != "object") throw new Error("Invalid KeyObject");
   return e.export({ format: "jwk" });
 }
-function D(e) {
+function J(e) {
   if (!e || typeof e != "object") throw new Error("Invalid JWK");
   switch (e.kty) {
     case "oct": {
       if (!("k" in e) || typeof e.k != "string")
         throw new Error('Invalid oct JWK: missing "k"');
-      return V(Buffer.from(e.k, "base64url"));
+      return U(Buffer.from(e.k, "base64url"));
     }
     case "RSA":
     case "EC":
     case "OKP":
-      return "d" in e && typeof e.d == "string" ? R({ format: "jwk", key: e }) : U({ format: "jwk", key: e });
+      return "d" in e && typeof e.d == "string" ? V({ format: "jwk", key: e }) : H({ format: "jwk", key: e });
     default:
       throw new Error(`Unsupported JWK key type: ${e.kty}`);
   }
 }
-function ce(e) {
+function fe(e) {
   if (!e || typeof e != "object")
     throw new Error("Invalid KeyObject");
-  const r = (e.type === "private" ? U(e) : e).export({ format: "jwk" });
+  const r = (e.type === "private" ? H(e) : e).export({ format: "jwk" });
   return delete r.d, delete r.p, delete r.q, delete r.dp, delete r.dq, delete r.qi, r;
 }
 function F(e, t = "sha256") {
@@ -549,27 +566,28 @@ function F(e, t = "sha256") {
       throw new Error(`Unsupported JWK key type: ${e.kty}`);
   }
   const n = JSON.stringify(
-    Object.keys(r).sort().reduce((i, o) => (i[o] = r[o], i), {})
+    Object.keys(r).sort().reduce((a, c) => (a[c] = r[c], a), {})
   );
-  return L(t).update(n).digest("base64url");
+  return j(t).update(n).digest("base64url");
 }
-function fe(e) {
-  if (e.x5c?.length)
-    return L("sha1").update(Buffer.from(e.x5c[0], "base64")).digest("base64url");
+function ue(e) {
+  var t;
+  if ((t = e.x5c) != null && t.length)
+    return j("sha1").update(Buffer.from(e.x5c[0], "base64")).digest("base64url");
 }
-const ye = {
-  export: oe,
-  import: D,
-  toPublic: ce,
+const me = {
+  export: ce,
+  import: J,
+  toPublic: fe,
   thumbprint: F
 };
-function ue(e, t) {
+function de(e, t) {
   if (!e || !Array.isArray(e.keys)) throw new Error("Invalid JWKS");
   let r;
   if (t && (r = e.keys.find((n) => n.kid === t)), !r && e.keys.length === 1 && (r = e.keys[0]), !r) throw new Error("Key not found in JWKS");
-  return D(r);
+  return J(r);
 }
-function K(e) {
+function P(e) {
   return {
     keys: E(...e.keys)
   };
@@ -579,134 +597,134 @@ function E(...e) {
     const r = {
       ...t,
       kid: t.kid ?? F(t),
-      x5t: t.x5t ?? fe(t)
+      x5t: t.x5t ?? ue(t)
     };
     return Object.defineProperty(r, "toKeyObject", {
       enumerable: !1,
       configurable: !1,
       writable: !1,
-      value: () => D(r)
+      value: () => J(r)
     }), r;
   });
 }
-const de = async (e, t = {}) => {
-  const r = typeof e == "string" ? e : e.toString(), n = t.fetch ?? globalThis.fetch, i = Math.max(0, t.ttl ?? 5 * 6e4), o = Math.max(0, t.timeoutMs ?? 5e3), a = "/.well-known/jwks.json";
+const le = async (e, t = {}) => {
+  const r = typeof e == "string" ? e : e.toString(), n = t.fetch ?? globalThis.fetch, a = Math.max(0, t.ttl ?? 5 * 6e4), c = Math.max(0, t.timeoutMs ?? 5e3), s = "/.well-known/jwks.json";
   if (!n)
     throw new Error("No fetch implementation available");
-  const s = (() => {
+  const i = (() => {
     if (t.endpointOverride) {
-      const f = t.endpointOverride;
+      const l = t.endpointOverride;
       try {
-        return new URL(f, r).toString();
+        return new URL(l, r).toString();
       } catch {
-        return f;
+        return l;
       }
     }
-    return t.overrideEndpointCheck || r.endsWith(a) ? r : `${r.replace(/\/+$/, "")}${a}`;
-  })(), l = (() => {
+    return t.overrideEndpointCheck || r.endsWith(s) ? r : `${r.replace(/\/+$/, "")}${s}`;
+  })(), g = (() => {
     if (t.cache) return t.cache;
-    let f;
+    let l;
     return {
-      get: () => f,
-      set: (u, d) => {
-        f = d;
+      get: () => l,
+      set: (o, f) => {
+        l = f;
       }
     };
   })();
-  let c, v = 0, g, y = 0;
-  const S = async (f) => {
-    if (g) return g;
-    g = (async () => {
-      const u = new AbortController();
-      let d;
-      o > 0 && (d = setTimeout(() => u.abort(), o));
+  let u, d = 0, y, b = 0;
+  const S = async (l) => {
+    if (y) return y;
+    y = (async () => {
+      const o = new AbortController();
+      let f;
+      c > 0 && (f = setTimeout(() => o.abort(), c));
       let h;
       try {
-        h = await n(s, { signal: u.signal });
-      } catch (p) {
-        throw u.signal.aborted ? new Error(`JWKS fetch timed out after ${o}ms`) : p;
+        h = await n(i, { signal: o.signal });
+      } catch (A) {
+        throw o.signal.aborted ? new Error(`JWKS fetch timed out after ${c}ms`) : A;
       } finally {
-        d && clearTimeout(d);
+        f && clearTimeout(f);
       }
       if (!h.ok)
         throw new Error(`Failed to fetch JWKS: ${h.status} ${h.statusText}`);
-      const A = await h.json();
-      if (!A || typeof A != "object" || !Array.isArray(A.keys))
+      const m = await h.json();
+      if (!m || typeof m != "object" || !Array.isArray(m.keys))
         throw new Error("Invalid JWKS");
-      return K(A);
+      return P(m);
     })();
     try {
-      const u = await g;
-      return c = u, await l.set(s, u), y = 0, i > 0 && (v = Date.now() + i), u;
-    } catch (u) {
-      if (!f || !c)
-        throw u;
-      if (y += 1, i > 0) {
-        const d = Math.min(
-          Math.max(i, 3e4) * Math.pow(2, y - 1),
+      const o = await y;
+      return u = o, await g.set(i, o), b = 0, a > 0 && (d = Date.now() + a), o;
+    } catch (o) {
+      if (!l || !u)
+        throw o;
+      if (b += 1, a > 0) {
+        const f = Math.min(
+          Math.max(a, 3e4) * Math.pow(2, b - 1),
           9e5
         );
-        v = Date.now() + d;
+        d = Date.now() + f;
       }
-      return console.warn(`JWKS refresh failed for "${s}", using stale cache.`, u), c;
+      return console.warn(`JWKS refresh failed for "${i}", using stale cache.`, o), u;
     } finally {
-      g = void 0;
+      y = void 0;
     }
   };
-  c = await l.get(s), c ? (c = K(c), i > 0 && (v = Date.now() + i)) : c = await S(!1);
+  u = await g.get(i), u ? (u = P(u), a > 0 && (d = Date.now() + a)) : u = await S(!1);
   const I = {
     async list() {
-      return i > 0 && Date.now() >= v && await S(!0), E(...c.keys);
+      return a > 0 && Date.now() >= d && await S(!0), E(...u.keys);
     },
     async refresh() {
       return await S(!1), I;
     },
-    async key(f) {
-      const d = (await I.list()).find((h) => h.kid === f);
-      if (d)
-        return E(d)[0];
+    async key(l) {
+      const f = (await I.list()).find((h) => h.kid === l);
+      if (f)
+        return E(f)[0];
     },
-    async find(f) {
-      const u = await I.list(), d = Object.entries(f);
-      return d.length === 0 ? E(...u) : E(...u.filter(
-        (h) => d.every(([A, p]) => {
-          const T = h[A];
-          return Array.isArray(p) ? Array.isArray(T) && T.length === p.length && T.every((G, q) => G === p[q]) : T === p;
+    async find(l) {
+      const o = await I.list(), f = Object.entries(l);
+      return f.length === 0 ? E(...o) : E(...o.filter(
+        (h) => f.every(([m, A]) => {
+          const T = h[m];
+          return Array.isArray(A) ? Array.isArray(T) && T.length === A.length && T.every((G, q) => G === A[q]) : T === A;
         })
       ));
     },
-    async findFirst(f) {
-      return I.find(f).then(([u]) => u);
+    async findFirst(l) {
+      return I.find(l).then(([o]) => o);
     },
     export() {
-      return c;
+      return u;
     }
   };
   return I;
-}, me = {
-  toKeyObject: ue,
-  normalize: K,
-  fromWeb: de
+}, ve = {
+  toKeyObject: de,
+  normalize: P,
+  fromWeb: le
 };
 export {
-  ne as A,
-  ye as J,
-  m as S,
-  me as a,
-  ue as b,
-  he as c,
-  ge as d,
+  ie as A,
+  me as J,
+  v as S,
+  ve as a,
+  de as b,
+  ye as c,
+  he as d,
   x as e,
-  fe as f,
+  ue as f,
   M as g,
-  oe as h,
-  de as i,
+  ce as h,
+  le as i,
   F as j,
-  D as k,
-  K as l,
+  J as k,
+  P as l,
   E as n,
-  ae as s,
-  ce as t,
-  se as v
+  se as s,
+  fe as t,
+  oe as v
 };
-//# sourceMappingURL=index-CRVBqFI5.js.map
+//# sourceMappingURL=index-Cp1eA1Xq.js.map