@sourceregistry/node-jwt 1.5.9 → 1.5.11

package/dist/{index-Cp1eA1Xq.js → index-BJnjMyHr.js}

@@ -1,26 +1,26 @@
-import _, { verify as z, sign as X, createVerify as R, createSign as L, createHmac as B, createPrivateKey as V, createSecretKey as U, timingSafeEqual as Y, createHash as j, createPublicKey as H } from "crypto";
-const x = {
+import B, { verify as Y, sign as Z, createVerify as V, createSign as U, createHmac as R, createPrivateKey as C, createPublicKey as N, createSecretKey as w, timingSafeEqual as Q, createHash as H } from "crypto";
+const O = {
   encode: (e) => Buffer.from(e).toString("base64url"),
   decode: (e) => Buffer.from(e, "base64url").toString()
-}, Z = (e, t) => e.length !== t.length ? !1 : Y(Buffer.from(e), Buffer.from(t)), O = /^[A-Za-z0-9_-]+$/;
-function $(e) {
+}, ee = (e, t) => e.length !== t.length ? !1 : Q(Buffer.from(e), Buffer.from(t)), K = /^[A-Za-z0-9_-]+$/;
+function W(e) {
   return typeof e == "object" && e !== null && !Array.isArray(e);
 }
-function w(e) {
+function x(e) {
   return typeof e == "number" && Number.isFinite(e);
 }
-function N(e) {
+function D(e) {
   return Array.isArray(e) && e.every((t) => typeof t == "string");
 }
-function Q(e) {
+function re(e) {
   const t = [
     { claim: "iss", valid: e.iss === void 0 || typeof e.iss == "string", expected: "string" },
     { claim: "sub", valid: e.sub === void 0 || typeof e.sub == "string", expected: "string" },
     { claim: "jti", valid: e.jti === void 0 || typeof e.jti == "string", expected: "string" },
     { claim: "sid", valid: e.sid === void 0 || typeof e.sid == "string", expected: "string" },
-    { claim: "iat", valid: e.iat === void 0 || w(e.iat), expected: "number" },
-    { claim: "exp", valid: e.exp === void 0 || w(e.exp), expected: "number" },
-    { claim: "nbf", valid: e.nbf === void 0 || w(e.nbf), expected: "number" }
+    { claim: "iat", valid: e.iat === void 0 || x(e.iat), expected: "number" },
+    { claim: "exp", valid: e.exp === void 0 || x(e.exp), expected: "number" },
+    { claim: "nbf", valid: e.nbf === void 0 || x(e.nbf), expected: "number" }
   ];
   for (const r of t)
     if (!r.valid)
@@ -28,27 +28,32 @@ function Q(e) {
         reason: `Invalid "${r.claim}" claim: expected ${r.expected}`,
         code: "INVALID_CLAIM"
       };
-  return e.aud !== void 0 && !(typeof e.aud == "string" || N(e.aud)) ? {
+  return e.aud !== void 0 && !(typeof e.aud == "string" || D(e.aud)) ? {
     reason: 'Invalid "aud" claim: expected string or string[]',
     code: "INVALID_CLAIM"
   } : null;
 }
-function ee(e) {
+function te(e) {
   if (e.signatureFormat !== void 0 && e.signatureFormat !== "der" && e.signatureFormat !== "jose")
     return {
       reason: 'Invalid signatureFormat option: expected "der" or "jose"',
       code: "INVALID_OPTIONS"
     };
-  if (e.clockSkew !== void 0 && (!w(e.clockSkew) || e.clockSkew < 0))
+  if (e.clockSkew !== void 0 && (!x(e.clockSkew) || e.clockSkew < 0))
     return {
       reason: "Invalid clockSkew option: expected a non-negative finite number",
       code: "INVALID_OPTIONS"
     };
-  if (e.maxTokenAge !== void 0 && (!w(e.maxTokenAge) || e.maxTokenAge < 0))
+  if (e.maxTokenAge !== void 0 && (!x(e.maxTokenAge) || e.maxTokenAge < 0))
     return {
       reason: "Invalid maxTokenAge option: expected a non-negative finite number",
       code: "INVALID_OPTIONS"
     };
+  if (e.ignoreExpiration !== void 0 && typeof e.ignoreExpiration != "boolean")
+    return {
+      reason: "Invalid ignoreExpiration option: expected boolean",
+      code: "INVALID_OPTIONS"
+    };
   if (e.issuer !== void 0 && typeof e.issuer != "string")
     return {
       reason: "Invalid issuer option: expected string",
@@ -64,18 +69,18 @@ function ee(e) {
       reason: "Invalid jwtId option: expected string",
       code: "INVALID_OPTIONS"
     };
-  if (e.audience !== void 0 && !(typeof e.audience == "string" || N(e.audience)))
+  if (e.audience !== void 0 && !(typeof e.audience == "string" || D(e.audience)))
     return {
       reason: "Invalid audience option: expected string or string[]",
       code: "INVALID_OPTIONS"
     };
   if (e.algorithms !== void 0) {
-    if (!Array.isArray(e.algorithms))
+    if (!Array.isArray(e.algorithms) || e.algorithms.length === 0)
       return {
-        reason: "Invalid algorithms option: expected an array",
+        reason: "Invalid algorithms option: expected a non-empty array",
         code: "INVALID_OPTIONS"
       };
-    const t = e.algorithms.find((r) => !(r in v));
+    const t = e.algorithms.find((r) => !(r in p));
     if (t)
       return {
         reason: `Invalid algorithms option: unsupported algorithm "${t}"`,
@@ -84,8 +89,8 @@ function ee(e) {
   }
   return null;
 }
-function re(e) {
-  return e.crit !== void 0 ? !N(e.crit) || e.crit.length === 0 ? {
+function ne(e) {
+  return e.crit !== void 0 ? !D(e.crit) || e.crit.length === 0 ? {
     reason: 'Invalid "crit" header: expected non-empty string[]',
     code: "INVALID_HEADER"
   } : {
@@ -93,7 +98,7 @@ function re(e) {
     code: "UNSUPPORTED_CRITICAL_HEADER"
   } : null;
 }
-function C(e) {
+function j(e) {
   switch (e) {
     case "ES256":
     case "ES256K":
@@ -110,87 +115,87 @@ function C(e) {
       throw new Error(`Unsupported ECDSA alg for JOSE conversion: ${e}`);
   }
 }
-function te(e, t) {
+function ie(e, t) {
   let r = 0;
   if (e[r++] !== 48) throw new Error("Invalid DER ECDSA signature");
   let n = e[r++];
   if (n & 128) {
     const d = n & 127;
     n = 0;
-    for (let y = 0; y < d; y++) n = n << 8 | e[r++];
+    for (let g = 0; g < d; g++) n = n << 8 | e[r++];
   }
   if (e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (r)");
   const a = e[r++];
-  let c = e.subarray(r, r + a);
+  let o = e.subarray(r, r + a);
   if (r += a, e[r++] !== 2) throw new Error("Invalid DER ECDSA signature (s)");
-  const s = e[r++];
-  let i = e.subarray(r, r + s);
-  for (; c.length > t / 2 && c[0] === 0; ) c = c.subarray(1);
-  for (; i.length > t / 2 && i[0] === 0; ) i = i.subarray(1);
-  const g = Buffer.concat([Buffer.alloc(t / 2 - c.length, 0), c]), u = Buffer.concat([Buffer.alloc(t / 2 - i.length, 0), i]);
-  return Buffer.concat([g, u]);
+  const i = e[r++];
+  let s = e.subarray(r, r + i);
+  for (; o.length > t / 2 && o[0] === 0; ) o = o.subarray(1);
+  for (; s.length > t / 2 && s[0] === 0; ) s = s.subarray(1);
+  const y = Buffer.concat([Buffer.alloc(t / 2 - o.length, 0), o]), f = Buffer.concat([Buffer.alloc(t / 2 - s.length, 0), s]);
+  return Buffer.concat([y, f]);
 }
-function W(e) {
+function L(e) {
   const t = e.length / 2;
   let r = e.subarray(0, t), n = e.subarray(t);
   for (; r.length > 1 && r[0] === 0 && (r[1] & 128) === 0; ) r = r.subarray(1);
   for (; n.length > 1 && n[0] === 0 && (n[1] & 128) === 0; ) n = n.subarray(1);
   r[0] & 128 && (r = Buffer.concat([Buffer.from([0]), r])), n[0] & 128 && (n = Buffer.concat([Buffer.from([0]), n]));
-  const a = Buffer.concat([Buffer.from([2, r.length]), r]), c = Buffer.concat([Buffer.from([2, n.length]), n]), s = a.length + c.length;
-  let i;
-  if (s < 128)
-    i = Buffer.from([s]);
+  const a = Buffer.concat([Buffer.from([2, r.length]), r]), o = Buffer.concat([Buffer.from([2, n.length]), n]), i = a.length + o.length;
+  let s;
+  if (i < 128)
+    s = Buffer.from([i]);
   else {
-    const g = [];
-    let u = s;
-    for (; u > 0; )
-      g.unshift(u & 255), u >>= 8;
-    i = Buffer.from([128 | g.length, ...g]);
+    const y = [];
+    let f = i;
+    for (; f > 0; )
+      y.unshift(f & 255), f >>= 8;
+    s = Buffer.from([128 | y.length, ...y]);
   }
-  return Buffer.concat([Buffer.from([48]), i, a, c]);
+  return Buffer.concat([Buffer.from([48]), s, a, o]);
 }
-function K(e) {
+function k(e) {
   return e === "ES256" || e === "ES384" || e === "ES512" || e === "ES256K";
 }
-const D = (e) => ({
-  sign: (t, r) => B(e, r).update(t).digest("base64url"),
+const P = (e) => ({
+  sign: (t, r) => R(e, r).update(t).digest("base64url"),
   verify: (t, r, n) => {
-    const a = B(e, r).update(t).digest("base64url");
-    return Z(a, n);
+    const a = R(e, r).update(t).digest("base64url");
+    return ee(a, n);
   }
-}), p = (e) => ({
-  sign: (t, r) => L(e).update(t).end().sign(r).toString("base64url"),
+}), E = (e) => ({
+  sign: (t, r) => U(e).update(t).end().sign(r).toString("base64url"),
   verify: (t, r, n) => {
     try {
-      return R(e).update(t).end().verify(r, Buffer.from(n, "base64url"));
+      return V(e).update(t).end().verify(r, Buffer.from(n, "base64url"));
     } catch {
       return !1;
     }
   }
-}), k = (e, t) => ({
-  sign: (r, n) => L(e).update(r).end().sign({
+}), _ = (e, t) => ({
+  sign: (r, n) => U(e).update(r).end().sign({
     //@ts-ignore
     key: n,
-    padding: _.constants.RSA_PKCS1_PSS_PADDING,
+    padding: B.constants.RSA_PKCS1_PSS_PADDING,
     saltLength: t
   }).toString("base64url"),
   verify: (r, n, a) => {
     try {
-      return R(e).update(r).end().verify({
+      return V(e).update(r).end().verify({
         //@ts-ignore
         key: n,
-        padding: _.constants.RSA_PKCS1_PSS_PADDING,
+        padding: B.constants.RSA_PKCS1_PSS_PADDING,
         saltLength: t
       }, Buffer.from(a, "base64url"));
     } catch {
       return !1;
     }
   }
-}), ne = {
-  sign: (e, t) => X(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, t).toString("base64url"),
+}), ae = {
+  sign: (e, t) => Z(null, typeof e == "string" ? Buffer.from(e, "utf8") : e, t).toString("base64url"),
   verify: (e, t, r) => {
     try {
-      return z(
+      return Y(
         null,
         typeof e == "string" ? Buffer.from(e, "utf8") : e,
         t,
@@ -200,26 +205,26 @@ const D = (e) => ({
       return !1;
     }
   }
-}, v = {
+}, p = {
   // HMAC
-  HS256: D("sha256"),
-  HS384: D("sha384"),
-  HS512: D("sha512"),
+  HS256: P("sha256"),
+  HS384: P("sha384"),
+  HS512: P("sha512"),
   // RSA (DER-encoded signatures, base64url)
-  RS256: p("RSA-SHA256"),
-  RS384: p("RSA-SHA384"),
-  RS512: p("RSA-SHA512"),
+  RS256: E("RSA-SHA256"),
+  RS384: E("RSA-SHA384"),
+  RS512: E("RSA-SHA512"),
   // ECDSA (Node/OpenSSL emits DER; sign() converts to JOSE by default for JWTs)
-  ES256: p("SHA256"),
-  ES384: p("SHA384"),
-  ES512: p("SHA512"),
-  ES256K: p("SHA256"),
-  PS256: k("RSA-SHA256", 32),
-  PS384: k("RSA-SHA384", 48),
-  PS512: k("RSA-SHA512", 64),
-  EdDSA: ne
-}, he = Object.keys(v);
-function ie(e) {
+  ES256: E("SHA256"),
+  ES384: E("SHA384"),
+  ES512: E("SHA512"),
+  ES256K: E("SHA256"),
+  PS256: _("RSA-SHA256", 32),
+  PS384: _("RSA-SHA384", 48),
+  PS512: _("RSA-SHA512", 64),
+  EdDSA: ae
+}, ge = Object.keys(p);
+function se(e) {
   if (e.type === "secret") return "HS256";
   if (e.type !== "private") throw new Error("Only private or symmetric keys can be used to sign JWTs");
   const t = e.asymmetricKeyType, r = e.asymmetricKeyDetails;
@@ -263,57 +268,105 @@ function ie(e) {
       throw new Error(`Unsupported asymmetric key type: ${t}`);
   }
 }
-function ae(e) {
+function M(e, t) {
   if (typeof e == "object" && "type" in e) return e;
   try {
-    return V(e);
+    return t === "sign" ? C(e) : N(e);
   } catch {
-    const t = typeof e == "string" ? Buffer.from(e, "utf8") : Buffer.isBuffer(e) ? e : (() => {
-      throw new Error("Unsupported key type");
-    })();
-    return U(t);
+    if (t === "sign") {
+      try {
+        N(e);
+      } catch {
+        if (typeof e == "string") return w(Buffer.from(e, "utf8"));
+        if (Buffer.isBuffer(e)) return w(e);
+        throw new Error("Unsupported key type");
+      }
+      throw new Error("A public key cannot be used to sign JWTs");
+    }
+    if (typeof e == "string") return w(Buffer.from(e, "utf8"));
+    if (Buffer.isBuffer(e)) return w(e);
+    throw new Error("Unsupported key type");
+  }
+}
+function q(e, t, r) {
+  var a;
+  if (t.startsWith("HS")) {
+    if (e.type !== "secret") throw new Error(`${t} requires a symmetric secret key`);
+    return;
+  }
+  if (r === "sign" && e.type !== "private")
+    throw new Error(`${t} requires a private key for signing`);
+  if (r === "verify" && e.type !== "public" && e.type !== "private")
+    throw new Error(`${t} requires a public or private key for verification`);
+  const n = e.asymmetricKeyType;
+  if (t.startsWith("RS") && n !== "rsa")
+    throw new Error(`${t} requires an RSA key`);
+  if (t.startsWith("PS") && n !== "rsa" && n !== "rsa-pss")
+    throw new Error(`${t} requires an RSA or RSA-PSS key`);
+  if (t === "EdDSA" && n !== "ed25519")
+    throw new Error("EdDSA requires an Ed25519 key");
+  if (k(t)) {
+    const o = (a = e.asymmetricKeyDetails) == null ? void 0 : a.namedCurve;
+    let i = [];
+    switch (t) {
+      case "ES256":
+        i = ["P-256", "prime256v1"];
+        break;
+      case "ES384":
+        i = ["P-384", "secp384r1"];
+        break;
+      case "ES512":
+        i = ["P-521", "secp521r1"];
+        break;
+      case "ES256K":
+        i = ["secp256k1"];
+        break;
+    }
+    if (n !== "ec" || !i.includes(o ?? ""))
+      throw new Error(`${t} requires its matching EC curve`);
   }
 }
-const M = (e) => {
+const F = (e) => {
   const t = e.split(".");
   if (t.length !== 3)
     throw new Error('Invalid JWT: must contain exactly 3 parts separated by "."');
   const [r, n, a] = t;
   if (!r || !n || !a)
     throw new Error("Invalid JWT: empty part detected");
-  if (!O.test(r) || !O.test(n) || !O.test(a))
+  if (!K.test(r) || !K.test(n) || !K.test(a))
     throw new Error("Invalid JWT: non-base64url characters detected");
   try {
-    const c = JSON.parse(x.decode(r)), s = JSON.parse(x.decode(n));
-    if (!$(c) || !$(s))
+    const o = JSON.parse(O.decode(r)), i = JSON.parse(O.decode(n));
+    if (!W(o) || !W(i))
       throw new Error("header and payload must be JSON objects");
-    const i = c, g = s;
-    if (typeof i.alg != "string" || i.alg.length === 0)
+    const s = o, y = i;
+    if (typeof s.alg != "string" || s.alg.length === 0)
       throw new Error("header.alg must be a non-empty string");
-    if (i.typ !== void 0 && typeof i.typ != "string")
+    if (s.typ !== void 0 && typeof s.typ != "string")
       throw new Error("header.typ must be a string");
-    if (i.kid !== void 0 && typeof i.kid != "string")
+    if (s.kid !== void 0 && typeof s.kid != "string")
       throw new Error("header.kid must be a string");
-    if (i.crit !== void 0 && (!N(i.crit) || i.crit.length === 0))
+    if (s.crit !== void 0 && (!D(s.crit) || s.crit.length === 0))
       throw new Error("header.crit must be a non-empty string[]");
-    return { header: i, payload: g, signature: a };
-  } catch (c) {
-    throw new Error(`Invalid JWT: malformed header or payload (${c.message})`);
-  }
-}, se = (e, t, r = {}) => {
-  const n = ae(t), a = r.alg ?? ie(n), c = r.signatureFormat ?? (K(a) ? "jose" : "der"), s = r.typ ?? "JWT";
-  if (!(a in v)) throw new Error(`Unsupported algorithm: ${a}`);
-  const i = { alg: a, typ: s };
-  r.kid && (i.kid = r.kid);
-  const g = x.encode(JSON.stringify(i)), u = x.encode(JSON.stringify(e)), d = `${g}.${u}`;
-  let y = v[a].sign(d, t);
-  if (c === "jose" && K(a)) {
-    const b = Buffer.from(y, "base64url");
-    y = te(b, C(a)).toString("base64url");
+    return { header: s, payload: y, signature: a };
+  } catch (o) {
+    throw new Error(`Invalid JWT: malformed header or payload (${o.message})`);
   }
-  return `${g}.${u}.${y}`;
 }, oe = (e, t, r = {}) => {
-  const n = ee(r);
+  const n = M(t, "sign"), a = r.alg ?? se(n), o = r.signatureFormat ?? (k(a) ? "jose" : "der"), i = r.typ ?? "JWT";
+  if (!(a in p)) throw new Error(`Unsupported algorithm: ${a}`);
+  q(n, a, "sign");
+  const s = { alg: a, typ: i };
+  r.kid && (s.kid = r.kid);
+  const y = O.encode(JSON.stringify(s)), f = O.encode(JSON.stringify(e)), d = `${y}.${f}`;
+  let g = p[a].sign(d, n);
+  if (o === "jose" && k(a)) {
+    const A = Buffer.from(g, "base64url");
+    g = ie(A, j(a)).toString("base64url");
+  }
+  return `${y}.${f}.${g}`;
+}, ce = (e, t, r = {}) => {
+  const n = te(r);
   if (n)
     return {
       valid: !1,
@@ -321,34 +374,34 @@ const M = (e) => {
     };
   let a;
   try {
-    a = M(e);
-  } catch (o) {
+    a = F(e);
+  } catch (c) {
     return {
       valid: !1,
       error: {
-        reason: o.message,
+        reason: c.message,
         code: "INVALID_TOKEN"
       }
     };
   }
-  const { header: c, payload: s, signature: i } = a, g = re(c);
-  if (g)
+  const { header: o, payload: i, signature: s } = a, y = ne(o);
+  if (y)
     return {
       valid: !1,
-      error: g
+      error: y
     };
-  const u = Q(s);
-  if (u)
+  const f = re(i);
+  if (f)
     return {
       valid: !1,
-      error: u
+      error: f
     };
-  const d = c.alg;
-  if (!(d in v))
+  const d = o.alg;
+  if (!(d in p))
     return {
       valid: !1,
       error: {
-        reason: `Unsupported or unknown algorithm: ${c.alg}`,
+        reason: `Unsupported or unknown algorithm: ${o.alg}`,
         code: "INVALID_ALGORITHM"
       }
     };
@@ -360,50 +413,62 @@ const M = (e) => {
         code: "ALGORITHM_NOT_ALLOWED"
       }
     };
-  if (c.typ !== void 0 && c.typ !== "JWT")
+  if (o.typ !== void 0 && o.typ !== "JWT")
     return {
       valid: !1,
       error: {
-        reason: `Invalid token type: expected 'JWT', got '${c.typ}'`,
+        reason: `Invalid token type: expected 'JWT', got '${o.typ}'`,
         code: "INVALID_TYPE"
       }
     };
-  const [y, b] = e.split("."), S = `${y}.${b}`;
-  if (K(d)) {
-    const o = r.signatureFormat;
-    let f;
-    if (o === "jose")
+  const [g, A] = e.split("."), I = `${g}.${A}`;
+  let m;
+  try {
+    m = M(t, "verify"), q(m, d, "verify");
+  } catch (c) {
+    return {
+      valid: !1,
+      error: {
+        reason: c.message,
+        code: "KEY_ALGORITHM_MISMATCH"
+      }
+    };
+  }
+  if (k(d)) {
+    const c = r.signatureFormat;
+    let l;
+    if (c === "jose")
       try {
-        const h = Buffer.from(i, "base64url"), m = W(h).toString("base64url");
-        f = v[d].verify(S, t, m);
+        const v = Buffer.from(s, "base64url"), S = L(v).toString("base64url");
+        l = p[d].verify(I, m, S);
       } catch {
-        f = !1;
+        l = !1;
       }
-    else if (o === "der")
-      f = v[d].verify(S, t, i);
-    else if (f = v[d].verify(S, t, i), !f)
+    else if (c === "der")
+      l = p[d].verify(I, m, s);
+    else if (l = p[d].verify(I, m, s), !l)
       try {
-        const h = Buffer.from(i, "base64url");
-        if (h.length === C(d)) {
-          const m = W(h).toString("base64url");
-          f = v[d].verify(S, t, m);
+        const v = Buffer.from(s, "base64url");
+        if (v.length === j(d)) {
+          const S = L(v).toString("base64url");
+          l = p[d].verify(I, m, S);
         }
       } catch {
       }
-    if (!f)
+    if (!l)
       return { valid: !1, error: { reason: "Signature verification failed", code: "INVALID_SIGNATURE" } };
   } else {
-    let o = !1;
+    let c = !1;
     try {
-      o = v[d].verify(S, t, i);
+      c = p[d].verify(I, m, s);
     } catch {
-      o = !1;
+      c = !1;
     }
-    if (!o)
+    if (!c)
       return { valid: !1, error: { reason: "Signature verification failed", code: "INVALID_SIGNATURE" } };
   }
-  const I = Math.floor(Date.now() / 1e3), l = r.clockSkew ?? 0;
-  if (!r.ignoreExpiration && s.exp !== void 0 && I > s.exp + l)
+  const h = Math.floor(Date.now() / 1e3), u = r.clockSkew ?? 0;
+  if (!r.ignoreExpiration && i.exp !== void 0 && h > i.exp + u)
     return {
       valid: !1,
       error: {
@@ -411,7 +476,7 @@ const M = (e) => {
         code: "TOKEN_EXPIRED"
       }
     };
-  if (s.nbf !== void 0 && I + l < s.nbf)
+  if (i.nbf !== void 0 && h + u < i.nbf)
     return {
       valid: !1,
       error: {
@@ -419,7 +484,7 @@ const M = (e) => {
         code: "TOKEN_NOT_ACTIVE"
       }
     };
-  if (s.iat !== void 0 && I + l < s.iat)
+  if (i.iat !== void 0 && h + u < i.iat)
     return {
       valid: !1,
       error: {
@@ -427,19 +492,27 @@ const M = (e) => {
         code: "TOKEN_FUTURE_ISSUED"
       }
     };
-  if (r.maxTokenAge !== void 0 && s.iat !== void 0) {
-    const o = I - s.iat;
-    if (o > r.maxTokenAge)
+  if (r.maxTokenAge !== void 0 && i.iat === void 0)
+    return {
+      valid: !1,
+      error: {
+        reason: 'Token missing required issued-at claim ("iat")',
+        code: "MISSING_IAT"
+      }
+    };
+  if (r.maxTokenAge !== void 0 && i.iat !== void 0) {
+    const c = h - i.iat;
+    if (c > r.maxTokenAge)
       return {
         valid: !1,
         error: {
-          reason: `Token age (${o}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,
+          reason: `Token age (${c}s) exceeds maximum allowed age (${r.maxTokenAge}s)`,
           code: "TOKEN_TOO_OLD"
         }
       };
   }
   if (r.issuer !== void 0) {
-    if (s.iss === void 0)
+    if (i.iss === void 0)
       return {
         valid: !1,
         error: {
@@ -447,17 +520,17 @@ const M = (e) => {
           code: "MISSING_ISSUER"
         }
       };
-    if (r.issuer !== s.iss)
+    if (r.issuer !== i.iss)
       return {
         valid: !1,
         error: {
-          reason: `Invalid token issuer: expected "${r.issuer}", got "${s.iss}"`,
+          reason: `Invalid token issuer: expected "${r.issuer}", got "${i.iss}"`,
           code: "INVALID_ISSUER"
         }
       };
   }
   if (r.subject !== void 0) {
-    if (s.sub === void 0)
+    if (i.sub === void 0)
       return {
         valid: !1,
         error: {
@@ -465,18 +538,18 @@ const M = (e) => {
           code: "MISSING_SUBJECT"
         }
       };
-    if (r.subject !== s.sub)
+    if (r.subject !== i.sub)
       return {
         valid: !1,
         error: {
-          reason: `Invalid token subject: expected "${r.subject}", got "${s.sub}"`,
+          reason: `Invalid token subject: expected "${r.subject}", got "${i.sub}"`,
           code: "INVALID_SUBJECT"
         }
       };
   }
   if (r.audience !== void 0) {
-    const o = s.aud;
-    if (o === void 0)
+    const c = i.aud;
+    if (c === void 0)
       return {
         valid: !1,
         error: {
@@ -484,8 +557,8 @@ const M = (e) => {
           code: "MISSING_AUDIENCE"
         }
       };
-    const f = Array.isArray(r.audience) ? r.audience : [r.audience], h = Array.isArray(o) ? o : [o];
-    if (!f.some((A) => h.includes(A)))
+    const l = Array.isArray(r.audience) ? r.audience : [r.audience], v = Array.isArray(c) ? c : [c];
+    if (!l.some((b) => v.includes(b)))
       return {
         valid: !1,
         error: {
@@ -495,7 +568,7 @@ const M = (e) => {
       };
   }
   if (r.jwtId !== void 0) {
-    if (s.jti === void 0)
+    if (i.jti === void 0)
       return {
         valid: !1,
         error: {
@@ -503,49 +576,49 @@ const M = (e) => {
           code: "MISSING_JTI"
         }
       };
-    if (r.jwtId !== s.jti)
+    if (r.jwtId !== i.jti)
       return {
         valid: !1,
         error: {
-          reason: `Invalid JWT ID: expected "${r.jwtId}", got "${s.jti}"`,
+          reason: `Invalid JWT ID: expected "${r.jwtId}", got "${i.jti}"`,
           code: "INVALID_JTI"
         }
       };
   }
-  return { valid: !0, header: c, payload: s, signature: i };
-}, ye = {
-  sign: se,
-  verify: oe,
-  decode: M,
-  algorithms: v
+  return { valid: !0, header: o, payload: i, signature: s };
+}, me = {
+  sign: oe,
+  verify: ce,
+  decode: F,
+  algorithms: p
 };
-function ce(e) {
+function fe(e) {
   if (!e || typeof e != "object") throw new Error("Invalid KeyObject");
   return e.export({ format: "jwk" });
 }
-function J(e) {
+function $(e) {
   if (!e || typeof e != "object") throw new Error("Invalid JWK");
   switch (e.kty) {
     case "oct": {
       if (!("k" in e) || typeof e.k != "string")
         throw new Error('Invalid oct JWK: missing "k"');
-      return U(Buffer.from(e.k, "base64url"));
+      return w(Buffer.from(e.k, "base64url"));
     }
     case "RSA":
     case "EC":
     case "OKP":
-      return "d" in e && typeof e.d == "string" ? V({ format: "jwk", key: e }) : H({ format: "jwk", key: e });
+      return "d" in e && typeof e.d == "string" ? C({ format: "jwk", key: e }) : N({ format: "jwk", key: e });
     default:
       throw new Error(`Unsupported JWK key type: ${e.kty}`);
   }
 }
-function fe(e) {
+function ue(e) {
   if (!e || typeof e != "object")
     throw new Error("Invalid KeyObject");
-  const r = (e.type === "private" ? H(e) : e).export({ format: "jwk" });
+  const r = (e.type === "private" ? N(e) : e).export({ format: "jwk" });
   return delete r.d, delete r.p, delete r.q, delete r.dp, delete r.dq, delete r.qi, r;
 }
-function F(e, t = "sha256") {
+function G(e, t = "sha256") {
   if (!e || typeof e != "object")
     throw new Error("Invalid JWK");
   let r;
@@ -566,165 +639,165 @@ function F(e, t = "sha256") {
       throw new Error(`Unsupported JWK key type: ${e.kty}`);
   }
   const n = JSON.stringify(
-    Object.keys(r).sort().reduce((a, c) => (a[c] = r[c], a), {})
+    Object.keys(r).sort().reduce((a, o) => (a[o] = r[o], a), {})
   );
-  return j(t).update(n).digest("base64url");
+  return H(t).update(n).digest("base64url");
 }
-function ue(e) {
+function de(e) {
   var t;
   if ((t = e.x5c) != null && t.length)
-    return j("sha1").update(Buffer.from(e.x5c[0], "base64")).digest("base64url");
+    return H("sha1").update(Buffer.from(e.x5c[0], "base64")).digest("base64url");
 }
-const me = {
-  export: ce,
-  import: J,
-  toPublic: fe,
-  thumbprint: F
+const ve = {
+  export: fe,
+  import: $,
+  toPublic: ue,
+  thumbprint: G
 };
-function de(e, t) {
+function le(e, t) {
   if (!e || !Array.isArray(e.keys)) throw new Error("Invalid JWKS");
   let r;
   if (t && (r = e.keys.find((n) => n.kid === t)), !r && e.keys.length === 1 && (r = e.keys[0]), !r) throw new Error("Key not found in JWKS");
-  return J(r);
+  return $(r);
 }
-function P(e) {
+function J(e) {
   return {
-    keys: E(...e.keys)
+    keys: T(...e.keys)
   };
 }
-function E(...e) {
+function T(...e) {
   return e.map((t) => {
     const r = {
       ...t,
-      kid: t.kid ?? F(t),
-      x5t: t.x5t ?? ue(t)
+      kid: t.kid ?? G(t),
+      x5t: t.x5t ?? de(t)
     };
     return Object.defineProperty(r, "toKeyObject", {
       enumerable: !1,
       configurable: !1,
       writable: !1,
-      value: () => J(r)
+      value: () => $(r)
     }), r;
   });
 }
-const le = async (e, t = {}) => {
-  const r = typeof e == "string" ? e : e.toString(), n = t.fetch ?? globalThis.fetch, a = Math.max(0, t.ttl ?? 5 * 6e4), c = Math.max(0, t.timeoutMs ?? 5e3), s = "/.well-known/jwks.json";
+const he = async (e, t = {}) => {
+  const r = typeof e == "string" ? e : e.toString(), n = t.fetch ?? globalThis.fetch, a = Math.max(0, t.ttl ?? 5 * 6e4), o = Math.max(0, t.timeoutMs ?? 5e3), i = "/.well-known/jwks.json";
   if (!n)
     throw new Error("No fetch implementation available");
-  const i = (() => {
+  const s = (() => {
     if (t.endpointOverride) {
-      const l = t.endpointOverride;
+      const h = t.endpointOverride;
       try {
-        return new URL(l, r).toString();
+        return new URL(h, r).toString();
       } catch {
-        return l;
+        return h;
       }
     }
-    return t.overrideEndpointCheck || r.endsWith(s) ? r : `${r.replace(/\/+$/, "")}${s}`;
-  })(), g = (() => {
+    return t.overrideEndpointCheck || r.endsWith(i) ? r : `${r.replace(/\/+$/, "")}${i}`;
+  })(), y = (() => {
     if (t.cache) return t.cache;
-    let l;
+    let h;
     return {
-      get: () => l,
-      set: (o, f) => {
-        l = f;
+      get: () => h,
+      set: (u, c) => {
+        h = c;
       }
     };
   })();
-  let u, d = 0, y, b = 0;
-  const S = async (l) => {
-    if (y) return y;
-    y = (async () => {
-      const o = new AbortController();
-      let f;
-      c > 0 && (f = setTimeout(() => o.abort(), c));
-      let h;
+  let f, d = 0, g, A = 0;
+  const I = async (h) => {
+    if (g) return g;
+    g = (async () => {
+      const u = new AbortController();
+      let c;
+      o > 0 && (c = setTimeout(() => u.abort(), o));
+      let l;
       try {
-        h = await n(i, { signal: o.signal });
-      } catch (A) {
-        throw o.signal.aborted ? new Error(`JWKS fetch timed out after ${c}ms`) : A;
+        l = await n(s, { signal: u.signal });
+      } catch (S) {
+        throw u.signal.aborted ? new Error(`JWKS fetch timed out after ${o}ms`) : S;
       } finally {
-        f && clearTimeout(f);
+        c && clearTimeout(c);
       }
-      if (!h.ok)
-        throw new Error(`Failed to fetch JWKS: ${h.status} ${h.statusText}`);
-      const m = await h.json();
-      if (!m || typeof m != "object" || !Array.isArray(m.keys))
+      if (!l.ok)
+        throw new Error(`Failed to fetch JWKS: ${l.status} ${l.statusText}`);
+      const v = await l.json();
+      if (!v || typeof v != "object" || !Array.isArray(v.keys))
         throw new Error("Invalid JWKS");
-      return P(m);
+      return J(v);
     })();
     try {
-      const o = await y;
-      return u = o, await g.set(i, o), b = 0, a > 0 && (d = Date.now() + a), o;
-    } catch (o) {
-      if (!l || !u)
-        throw o;
-      if (b += 1, a > 0) {
-        const f = Math.min(
-          Math.max(a, 3e4) * Math.pow(2, b - 1),
+      const u = await g;
+      return f = u, await y.set(s, u), A = 0, a > 0 && (d = Date.now() + a), u;
+    } catch (u) {
+      if (!h || !f)
+        throw u;
+      if (A += 1, a > 0) {
+        const c = Math.min(
+          Math.max(a, 3e4) * Math.pow(2, A - 1),
           9e5
         );
-        d = Date.now() + f;
+        d = Date.now() + c;
       }
-      return console.warn(`JWKS refresh failed for "${i}", using stale cache.`, o), u;
+      return console.warn(`JWKS refresh failed for "${s}", using stale cache.`, u), f;
     } finally {
-      y = void 0;
+      g = void 0;
     }
   };
-  u = await g.get(i), u ? (u = P(u), a > 0 && (d = Date.now() + a)) : u = await S(!1);
-  const I = {
+  f = await y.get(s), f ? (f = J(f), a > 0 && (d = Date.now() + a)) : f = await I(!1);
+  const m = {
     async list() {
-      return a > 0 && Date.now() >= d && await S(!0), E(...u.keys);
+      return a > 0 && Date.now() >= d && await I(!0), T(...f.keys);
     },
     async refresh() {
-      return await S(!1), I;
+      return await I(!1), m;
     },
-    async key(l) {
-      const f = (await I.list()).find((h) => h.kid === l);
-      if (f)
-        return E(f)[0];
+    async key(h) {
+      const c = (await m.list()).find((l) => l.kid === h);
+      if (c)
+        return T(c)[0];
     },
-    async find(l) {
-      const o = await I.list(), f = Object.entries(l);
-      return f.length === 0 ? E(...o) : E(...o.filter(
-        (h) => f.every(([m, A]) => {
-          const T = h[m];
-          return Array.isArray(A) ? Array.isArray(T) && T.length === A.length && T.every((G, q) => G === A[q]) : T === A;
+    async find(h) {
+      const u = await m.list(), c = Object.entries(h);
+      return c.length === 0 ? T(...u) : T(...u.filter(
+        (l) => c.every(([v, S]) => {
+          const b = l[v];
+          return Array.isArray(S) ? Array.isArray(b) && b.length === S.length && b.every((z, X) => z === S[X]) : b === S;
         })
       ));
     },
-    async findFirst(l) {
-      return I.find(l).then(([o]) => o);
+    async findFirst(h) {
+      return m.find(h).then(([u]) => u);
     },
     export() {
-      return u;
+      return f;
     }
   };
-  return I;
-}, ve = {
-  toKeyObject: de,
-  normalize: P,
-  fromWeb: le
+  return m;
+}, Se = {
+  toKeyObject: le,
+  normalize: J,
+  fromWeb: he
 };
 export {
-  ie as A,
-  me as J,
-  v as S,
-  ve as a,
-  de as b,
-  ye as c,
-  he as d,
-  x as e,
-  ue as f,
-  M as g,
-  ce as h,
-  le as i,
-  F as j,
-  J as k,
-  P as l,
-  E as n,
-  se as s,
-  fe as t,
-  oe as v
+  se as A,
+  ve as J,
+  p as S,
+  Se as a,
+  le as b,
+  me as c,
+  ge as d,
+  O as e,
+  de as f,
+  F as g,
+  fe as h,
+  he as i,
+  G as j,
+  $ as k,
+  J as l,
+  T as n,
+  oe as s,
+  ue as t,
+  ce as v
 };
-//# sourceMappingURL=index-Cp1eA1Xq.js.map
+//# sourceMappingURL=index-BJnjMyHr.js.map