@stackframe/stack-shared 2.8.32 → 2.8.35

package/dist/utils/currencies.js

@@ -20,49 +20,11 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/utils/currencies.tsx
 var currencies_exports = {};
 __export(currencies_exports, {
-  SUPPORTED_CURRENCIES: () => SUPPORTED_CURRENCIES,
   moneyAmountToStripeUnits: () => moneyAmountToStripeUnits
 });
 module.exports = __toCommonJS(currencies_exports);
 var import_schema_fields = require("../schema-fields.js");
 var import_errors = require("./errors.js");
-var SUPPORTED_CURRENCIES = [
-  {
-    code: "USD",
-    decimals: 2,
-    stripeDecimals: 2
-  },
-  {
-    code: "EUR",
-    decimals: 2,
-    stripeDecimals: 2
-  },
-  {
-    code: "GBP",
-    decimals: 2,
-    stripeDecimals: 2
-  },
-  {
-    code: "JPY",
-    decimals: 0,
-    stripeDecimals: 0
-  },
-  {
-    code: "INR",
-    decimals: 2,
-    stripeDecimals: 2
-  },
-  {
-    code: "AUD",
-    decimals: 2,
-    stripeDecimals: 2
-  },
-  {
-    code: "CAD",
-    decimals: 2,
-    stripeDecimals: 2
-  }
-];
 function moneyAmountToStripeUnits(amount, currency) {
   const validated = (0, import_schema_fields.moneyAmountSchema)(currency).defined().validateSync(amount);
   if (currency.stripeDecimals !== currency.decimals) {
@@ -72,7 +34,6 @@ function moneyAmountToStripeUnits(amount, currency) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  SUPPORTED_CURRENCIES,
   moneyAmountToStripeUnits
 });
 //# sourceMappingURL=currencies.js.map

package/dist/utils/currencies.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/currencies.tsx"],"sourcesContent":["import { moneyAmountSchema } from \"../schema-fields\";\nimport { StackAssertionError } from \"./errors\";\n\nexport type Currency = {\n  code: Uppercase<string>,\n  decimals: number,\n  stripeDecimals: number,\n};\n\nexport type SupportedCurrency = (typeof SUPPORTED_CURRENCIES)[number];\nexport const SUPPORTED_CURRENCIES = [\n  {\n    code: 'USD',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n  {\n    code: 'EUR',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n  {\n    code: 'GBP',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n  {\n    code: 'JPY',\n    decimals: 0,\n    stripeDecimals: 0,\n  },\n  {\n    code: 'INR',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n  {\n    code: 'AUD',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n  {\n    code: 'CAD',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n] as const satisfies Currency[];\n\nexport type MoneyAmount = `${number}` | `${number}.${number}`;\n\nexport function moneyAmountToStripeUnits(amount: MoneyAmount, currency: Currency): number {\n  const validated = moneyAmountSchema(currency).defined().validateSync(amount);\n  if (currency.stripeDecimals !== currency.decimals) {\n    throw new StackAssertionError(\"unimplemented: TODO support different decimal configurations\");\n  }\n\n  return Number.parseInt(validated.replace('.', ''), 10);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BAAkC;AAClC,oBAAoC;AAS7B,IAAM,uBAAuB;AAAA,EAClC;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AACF;AAIO,SAAS,yBAAyB,QAAqB,UAA4B;AACxF,QAAM,gBAAY,wCAAkB,QAAQ,EAAE,QAAQ,EAAE,aAAa,MAAM;AAC3E,MAAI,SAAS,mBAAmB,SAAS,UAAU;AACjD,UAAM,IAAI,kCAAoB,8DAA8D;AAAA,EAC9F;AAEA,SAAO,OAAO,SAAS,UAAU,QAAQ,KAAK,EAAE,GAAG,EAAE;AACvD;","names":[]}
+{"version":3,"sources":["../../src/utils/currencies.tsx"],"sourcesContent":["import { moneyAmountSchema } from \"../schema-fields\";\nimport { SUPPORTED_CURRENCIES, type Currency, type MoneyAmount } from \"./currency-constants\";\nimport { StackAssertionError } from \"./errors\";\n\nexport type SupportedCurrency = (typeof SUPPORTED_CURRENCIES)[number];\n\nexport function moneyAmountToStripeUnits(amount: MoneyAmount, currency: Currency): number {\n  const validated = moneyAmountSchema(currency).defined().validateSync(amount);\n  if (currency.stripeDecimals !== currency.decimals) {\n    throw new StackAssertionError(\"unimplemented: TODO support different decimal configurations\");\n  }\n\n  return Number.parseInt(validated.replace('.', ''), 10);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BAAkC;AAElC,oBAAoC;AAI7B,SAAS,yBAAyB,QAAqB,UAA4B;AACxF,QAAM,gBAAY,wCAAkB,QAAQ,EAAE,QAAQ,EAAE,aAAa,MAAM;AAC3E,MAAI,SAAS,mBAAmB,SAAS,UAAU;AACjD,UAAM,IAAI,kCAAoB,8DAA8D;AAAA,EAC9F;AAEA,SAAO,OAAO,SAAS,UAAU,QAAQ,KAAK,EAAE,GAAG,EAAE;AACvD;","names":[]}

package/dist/utils/currency-constants.d.mts

@@ -0,0 +1,37 @@
+type MoneyAmount = `${number}` | `${number}.${number}`;
+type Currency = {
+    code: Uppercase<string>;
+    decimals: number;
+    stripeDecimals: number;
+};
+declare const SUPPORTED_CURRENCIES: [{
+    readonly code: "USD";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}, {
+    readonly code: "EUR";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}, {
+    readonly code: "GBP";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}, {
+    readonly code: "JPY";
+    readonly decimals: 0;
+    readonly stripeDecimals: 0;
+}, {
+    readonly code: "INR";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}, {
+    readonly code: "AUD";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}, {
+    readonly code: "CAD";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}];
+
+export { type Currency, type MoneyAmount, SUPPORTED_CURRENCIES };

package/dist/utils/currency-constants.d.ts

@@ -0,0 +1,37 @@
+type MoneyAmount = `${number}` | `${number}.${number}`;
+type Currency = {
+    code: Uppercase<string>;
+    decimals: number;
+    stripeDecimals: number;
+};
+declare const SUPPORTED_CURRENCIES: [{
+    readonly code: "USD";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}, {
+    readonly code: "EUR";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}, {
+    readonly code: "GBP";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}, {
+    readonly code: "JPY";
+    readonly decimals: 0;
+    readonly stripeDecimals: 0;
+}, {
+    readonly code: "INR";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}, {
+    readonly code: "AUD";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}, {
+    readonly code: "CAD";
+    readonly decimals: 2;
+    readonly stripeDecimals: 2;
+}];
+
+export { type Currency, type MoneyAmount, SUPPORTED_CURRENCIES };

package/dist/utils/currency-constants.js

@@ -0,0 +1,67 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/utils/currency-constants.tsx
+var currency_constants_exports = {};
+__export(currency_constants_exports, {
+  SUPPORTED_CURRENCIES: () => SUPPORTED_CURRENCIES
+});
+module.exports = __toCommonJS(currency_constants_exports);
+var SUPPORTED_CURRENCIES = [
+  {
+    code: "USD",
+    decimals: 2,
+    stripeDecimals: 2
+  },
+  {
+    code: "EUR",
+    decimals: 2,
+    stripeDecimals: 2
+  },
+  {
+    code: "GBP",
+    decimals: 2,
+    stripeDecimals: 2
+  },
+  {
+    code: "JPY",
+    decimals: 0,
+    stripeDecimals: 0
+  },
+  {
+    code: "INR",
+    decimals: 2,
+    stripeDecimals: 2
+  },
+  {
+    code: "AUD",
+    decimals: 2,
+    stripeDecimals: 2
+  },
+  {
+    code: "CAD",
+    decimals: 2,
+    stripeDecimals: 2
+  }
+];
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SUPPORTED_CURRENCIES
+});
+//# sourceMappingURL=currency-constants.js.map

package/dist/utils/currency-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/currency-constants.tsx"],"sourcesContent":["export type MoneyAmount = `${number}` | `${number}.${number}`;\n\nexport type Currency = {\n  code: Uppercase<string>,\n  decimals: number,\n  stripeDecimals: number,\n};\n\nexport const SUPPORTED_CURRENCIES = [\n  {\n    code: 'USD',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n  {\n    code: 'EUR',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n  {\n    code: 'GBP',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n  {\n    code: 'JPY',\n    decimals: 0,\n    stripeDecimals: 0,\n  },\n  {\n    code: 'INR',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n  {\n    code: 'AUD',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n  {\n    code: 'CAD',\n    decimals: 2,\n    stripeDecimals: 2,\n  },\n] as const satisfies Currency[];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQO,IAAM,uBAAuB;AAAA,EAClC;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,UAAU;AAAA,IACV,gBAAgB;AAAA,EAClB;AACF;","names":[]}

package/dist/utils/dates.d.mts

@@ -15,5 +15,7 @@ type Interval = [number, 'millisecond' | 'second' | 'minute' | 'hour' | 'day' |
 type DayInterval = [number, 'day' | 'week' | 'month' | 'year'];
 declare function subtractInterval(date: Date, interval: Interval): Date;
 declare function addInterval(date: Date, interval: Interval): Date;
+declare const FAR_FUTURE_DATE: Date;
+declare function getIntervalsElapsed(anchor: Date, to: Date, repeat: DayInterval): number;
 
-export { type DayInterval, type Interval, addInterval, fromNow, fromNowDetailed, getInputDatetimeLocalString, isWeekend, subtractInterval };
+export { type DayInterval, FAR_FUTURE_DATE, type Interval, addInterval, fromNow, fromNowDetailed, getInputDatetimeLocalString, getIntervalsElapsed, isWeekend, subtractInterval };

package/dist/utils/dates.d.ts

@@ -15,5 +15,7 @@ type Interval = [number, 'millisecond' | 'second' | 'minute' | 'hour' | 'day' |
 type DayInterval = [number, 'day' | 'week' | 'month' | 'year'];
 declare function subtractInterval(date: Date, interval: Interval): Date;
 declare function addInterval(date: Date, interval: Interval): Date;
+declare const FAR_FUTURE_DATE: Date;
+declare function getIntervalsElapsed(anchor: Date, to: Date, repeat: DayInterval): number;
 
-export { type DayInterval, type Interval, addInterval, fromNow, fromNowDetailed, getInputDatetimeLocalString, isWeekend, subtractInterval };
+export { type DayInterval, FAR_FUTURE_DATE, type Interval, addInterval, fromNow, fromNowDetailed, getInputDatetimeLocalString, getIntervalsElapsed, isWeekend, subtractInterval };

package/dist/utils/dates.js

@@ -20,10 +20,12 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/utils/dates.tsx
 var dates_exports = {};
 __export(dates_exports, {
+  FAR_FUTURE_DATE: () => FAR_FUTURE_DATE,
   addInterval: () => addInterval,
   fromNow: () => fromNow,
   fromNowDetailed: () => fromNowDetailed,
   getInputDatetimeLocalString: () => getInputDatetimeLocalString,
+  getIntervalsElapsed: () => getIntervalsElapsed,
   isWeekend: () => isWeekend,
   subtractInterval: () => subtractInterval
 });
@@ -136,12 +138,42 @@ function subtractInterval(date, interval) {
 function addInterval(date, interval) {
   return applyInterval(date, 1, interval);
 }
+var FAR_FUTURE_DATE = /* @__PURE__ */ new Date(864e13);
+function getMsPerDayIntervalUnit(unit) {
+  if (unit === "day") {
+    return 24 * 60 * 60 * 1e3;
+  }
+  return 7 * 24 * 60 * 60 * 1e3;
+}
+function getIntervalsElapsed(anchor, to, repeat) {
+  const [amount, unit] = repeat;
+  if (to <= anchor) return 0;
+  if (unit === "day" || unit === "week") {
+    const msPerUnit = getMsPerDayIntervalUnit(unit);
+    const diffMs = to.getTime() - anchor.getTime();
+    return Math.floor(diffMs / (msPerUnit * amount));
+  }
+  if (["month", "year"].includes(unit)) {
+    let count = 0;
+    let current = new Date(anchor);
+    for (; ; ) {
+      const next = addInterval(new Date(current), [amount, unit]);
+      if (next > to) break;
+      current = next;
+      count += 1;
+    }
+    return count;
+  }
+  return 0;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  FAR_FUTURE_DATE,
   addInterval,
   fromNow,
   fromNowDetailed,
   getInputDatetimeLocalString,
+  getIntervalsElapsed,
   isWeekend,
   subtractInterval
 });

package/dist/utils/dates.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/dates.tsx"],"sourcesContent":["import { intervalSchema } from \"../schema-fields\";\nimport { StackAssertionError } from \"./errors\";\nimport { remainder } from \"./math\";\n\nexport function isWeekend(date: Date): boolean {\n  return date.getDay() === 0 || date.getDay() === 6;\n}\n\nundefined?.test(\"isWeekend\", ({ expect }) => {\n  // Sunday (day 0)\n  expect(isWeekend(new Date(2023, 0, 1))).toBe(true);\n  // Saturday (day 6)\n  expect(isWeekend(new Date(2023, 0, 7))).toBe(true);\n  // Monday (day 1)\n  expect(isWeekend(new Date(2023, 0, 2))).toBe(false);\n  // Friday (day 5)\n  expect(isWeekend(new Date(2023, 0, 6))).toBe(false);\n});\n\nconst agoUnits = [\n  [60, 'second'],\n  [60, 'minute'],\n  [24, 'hour'],\n  [7, 'day'],\n  [5, 'week'],\n] as const;\n\nexport function fromNow(date: Date): string {\n  return fromNowDetailed(date).result;\n}\n\nundefined?.test(\"fromNow\", ({ expect }) => {\n  // Set a fixed date for testing\n  const fixedDate = new Date(\"2023-01-15T12:00:00.000Z\");\n\n  // Use Vitest's fake timers\n  undefined?.vi.useFakeTimers();\n  undefined?.vi.setSystemTime(fixedDate);\n\n  // Test past times\n  expect(fromNow(new Date(\"2023-01-15T11:59:50.000Z\"))).toBe(\"just now\");\n  expect(fromNow(new Date(\"2023-01-15T11:59:00.000Z\"))).toBe(\"1 minute ago\");\n  expect(fromNow(new Date(\"2023-01-15T11:00:00.000Z\"))).toBe(\"1 hour ago\");\n  expect(fromNow(new Date(\"2023-01-14T12:00:00.000Z\"))).toBe(\"1 day ago\");\n  expect(fromNow(new Date(\"2023-01-08T12:00:00.000Z\"))).toBe(\"1 week ago\");\n\n  // Test future times\n  expect(fromNow(new Date(\"2023-01-15T12:00:10.000Z\"))).toBe(\"just now\");\n  expect(fromNow(new Date(\"2023-01-15T12:01:00.000Z\"))).toBe(\"in 1 minute\");\n  expect(fromNow(new Date(\"2023-01-15T13:00:00.000Z\"))).toBe(\"in 1 hour\");\n  expect(fromNow(new Date(\"2023-01-16T12:00:00.000Z\"))).toBe(\"in 1 day\");\n  expect(fromNow(new Date(\"2023-01-22T12:00:00.000Z\"))).toBe(\"in 1 week\");\n\n  // Test very old dates (should use date format)\n  expect(fromNow(new Date(\"2022-01-15T12:00:00.000Z\"))).toMatch(/Jan 15, 2022/);\n\n  // Restore real timers\n  undefined?.vi.useRealTimers();\n});\n\nexport function fromNowDetailed(date: Date): {\n  result: string,\n  /**\n   * May be Infinity if the result will never change.\n   */\n  secondsUntilChange: number,\n} {\n  if (!(date instanceof Date)) {\n    throw new Error(`fromNow only accepts Date objects (received: ${date})`);\n  }\n\n  const now = new Date();\n  const elapsed = now.getTime() - date.getTime();\n\n  let remainingInUnit = Math.abs(elapsed) / 1000;\n  if (remainingInUnit < 15) {\n    return {\n      result: 'just now',\n      secondsUntilChange: 15 - remainingInUnit,\n    };\n  }\n  let unitInSeconds = 1;\n  for (const [nextUnitSize, unitName] of agoUnits) {\n    const rounded = Math.round(remainingInUnit);\n    if (rounded < nextUnitSize) {\n      if (elapsed < 0) {\n        return {\n          result: `in ${rounded} ${unitName}${rounded === 1 ? '' : 's'}`,\n          secondsUntilChange: remainder((remainingInUnit - rounded + 0.5) * unitInSeconds, unitInSeconds),\n        };\n      } else {\n        return {\n          result: `${rounded} ${unitName}${rounded === 1 ? '' : 's'} ago`,\n          secondsUntilChange: remainder((rounded - remainingInUnit - 0.5) * unitInSeconds, unitInSeconds),\n        };\n      }\n    }\n    unitInSeconds *= nextUnitSize;\n    remainingInUnit /= nextUnitSize;\n  }\n\n  return {\n    result: date.toLocaleDateString('en-US', { year: 'numeric', month: 'short', day: 'numeric' }),\n    secondsUntilChange: Infinity,\n  };\n}\n\n/**\n * Returns a string representation of the given date in the format expected by the `datetime-local` input type.\n */\nexport function getInputDatetimeLocalString(date: Date): string {\n  date = new Date(date);\n  date.setMinutes(date.getMinutes() - date.getTimezoneOffset());\n  return date.toISOString().slice(0, 19);\n}\n\nundefined?.test(\"getInputDatetimeLocalString\", ({ expect }) => {\n  // Use Vitest's fake timers to ensure consistent timezone behavior\n  undefined?.vi.useFakeTimers();\n\n  // Test with a specific date\n  const mockDate = new Date(\"2023-01-15T12:30:45.000Z\");\n  const result = getInputDatetimeLocalString(mockDate);\n\n  // The result should be in the format YYYY-MM-DDTHH:MM:SS\n  expect(result).toMatch(/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$/);\n\n  // Test with different dates\n  const dates = [\n    new Date(\"2023-01-01T00:00:00.000Z\"),\n    new Date(\"2023-06-15T23:59:59.000Z\"),\n    new Date(\"2023-12-31T12:34:56.000Z\"),\n  ];\n\n  for (const date of dates) {\n    const result = getInputDatetimeLocalString(date);\n    expect(result).toMatch(/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$/);\n  }\n\n  // Restore real timers\n  undefined?.vi.useRealTimers();\n});\n\n\nexport type Interval = [number, 'millisecond' | 'second' | 'minute' | 'hour' | 'day' | 'week' | 'month' | 'year'];\nexport type DayInterval = [number, 'day' | 'week' | 'month' | 'year'];\n\nfunction applyInterval(date: Date, times: number, interval: Interval): Date {\n  if (!intervalSchema.isValidSync(interval)) {\n    throw new StackAssertionError(`Invalid interval`, { interval });\n  }\n  const [amount, unit] = interval;\n  switch (unit) {\n    case 'millisecond': {\n      date.setMilliseconds(date.getMilliseconds() + amount * times);\n      break;\n    }\n    case 'second': {\n      date.setSeconds(date.getSeconds() + amount * times);\n      break;\n    }\n    case 'minute': {\n      date.setMinutes(date.getMinutes() + amount * times);\n      break;\n    }\n    case 'hour': {\n      date.setHours(date.getHours() + amount * times);\n      break;\n    }\n    case 'day': {\n      date.setDate(date.getDate() + amount * times);\n      break;\n    }\n    case 'week': {\n      date.setDate(date.getDate() + amount * times * 7);\n      break;\n    }\n    case 'month': {\n      date.setMonth(date.getMonth() + amount * times);\n      break;\n    }\n    case 'year': {\n      date.setFullYear(date.getFullYear() + amount * times);\n      break;\n    }\n    default: {\n      throw new StackAssertionError(`Invalid interval despite schema validation`, { interval });\n    }\n  }\n  return date;\n}\n\nexport function subtractInterval(date: Date, interval: Interval): Date {\n  return applyInterval(date, -1, interval);\n}\n\nexport function addInterval(date: Date, interval: Interval): Date {\n  return applyInterval(date, 1, interval);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BAA+B;AAC/B,oBAAoC;AACpC,kBAA0B;AAEnB,SAAS,UAAU,MAAqB;AAC7C,SAAO,KAAK,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM;AAClD;AAaA,IAAM,WAAW;AAAA,EACf,CAAC,IAAI,QAAQ;AAAA,EACb,CAAC,IAAI,QAAQ;AAAA,EACb,CAAC,IAAI,MAAM;AAAA,EACX,CAAC,GAAG,KAAK;AAAA,EACT,CAAC,GAAG,MAAM;AACZ;AAEO,SAAS,QAAQ,MAAoB;AAC1C,SAAO,gBAAgB,IAAI,EAAE;AAC/B;AA+BO,SAAS,gBAAgB,MAM9B;AACA,MAAI,EAAE,gBAAgB,OAAO;AAC3B,UAAM,IAAI,MAAM,gDAAgD,IAAI,GAAG;AAAA,EACzE;AAEA,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,UAAU,IAAI,QAAQ,IAAI,KAAK,QAAQ;AAE7C,MAAI,kBAAkB,KAAK,IAAI,OAAO,IAAI;AAC1C,MAAI,kBAAkB,IAAI;AACxB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,oBAAoB,KAAK;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,gBAAgB;AACpB,aAAW,CAAC,cAAc,QAAQ,KAAK,UAAU;AAC/C,UAAM,UAAU,KAAK,MAAM,eAAe;AAC1C,QAAI,UAAU,cAAc;AAC1B,UAAI,UAAU,GAAG;AACf,eAAO;AAAA,UACL,QAAQ,MAAM,OAAO,IAAI,QAAQ,GAAG,YAAY,IAAI,KAAK,GAAG;AAAA,UAC5D,wBAAoB,wBAAW,kBAAkB,UAAU,OAAO,eAAe,aAAa;AAAA,QAChG;AAAA,MACF,OAAO;AACL,eAAO;AAAA,UACL,QAAQ,GAAG,OAAO,IAAI,QAAQ,GAAG,YAAY,IAAI,KAAK,GAAG;AAAA,UACzD,wBAAoB,wBAAW,UAAU,kBAAkB,OAAO,eAAe,aAAa;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AACA,qBAAiB;AACjB,uBAAmB;AAAA,EACrB;AAEA,SAAO;AAAA,IACL,QAAQ,KAAK,mBAAmB,SAAS,EAAE,MAAM,WAAW,OAAO,SAAS,KAAK,UAAU,CAAC;AAAA,IAC5F,oBAAoB;AAAA,EACtB;AACF;AAKO,SAAS,4BAA4B,MAAoB;AAC9D,SAAO,IAAI,KAAK,IAAI;AACpB,OAAK,WAAW,KAAK,WAAW,IAAI,KAAK,kBAAkB,CAAC;AAC5D,SAAO,KAAK,YAAY,EAAE,MAAM,GAAG,EAAE;AACvC;AAiCA,SAAS,cAAc,MAAY,OAAe,UAA0B;AAC1E,MAAI,CAAC,oCAAe,YAAY,QAAQ,GAAG;AACzC,UAAM,IAAI,kCAAoB,oBAAoB,EAAE,SAAS,CAAC;AAAA,EAChE;AACA,QAAM,CAAC,QAAQ,IAAI,IAAI;AACvB,UAAQ,MAAM;AAAA,IACZ,KAAK,eAAe;AAClB,WAAK,gBAAgB,KAAK,gBAAgB,IAAI,SAAS,KAAK;AAC5D;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,WAAK,WAAW,KAAK,WAAW,IAAI,SAAS,KAAK;AAClD;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,WAAK,WAAW,KAAK,WAAW,IAAI,SAAS,KAAK;AAClD;AAAA,IACF;AAAA,IACA,KAAK,QAAQ;AACX,WAAK,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK;AAC9C;AAAA,IACF;AAAA,IACA,KAAK,OAAO;AACV,WAAK,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK;AAC5C;AAAA,IACF;AAAA,IACA,KAAK,QAAQ;AACX,WAAK,QAAQ,KAAK,QAAQ,IAAI,SAAS,QAAQ,CAAC;AAChD;AAAA,IACF;AAAA,IACA,KAAK,SAAS;AACZ,WAAK,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK;AAC9C;AAAA,IACF;AAAA,IACA,KAAK,QAAQ;AACX,WAAK,YAAY,KAAK,YAAY,IAAI,SAAS,KAAK;AACpD;AAAA,IACF;AAAA,IACA,SAAS;AACP,YAAM,IAAI,kCAAoB,8CAA8C,EAAE,SAAS,CAAC;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,MAAY,UAA0B;AACrE,SAAO,cAAc,MAAM,IAAI,QAAQ;AACzC;AAEO,SAAS,YAAY,MAAY,UAA0B;AAChE,SAAO,cAAc,MAAM,GAAG,QAAQ;AACxC;","names":[]}
+{"version":3,"sources":["../../src/utils/dates.tsx"],"sourcesContent":["import { intervalSchema } from \"../schema-fields\";\nimport { StackAssertionError } from \"./errors\";\nimport { remainder } from \"./math\";\n\nexport function isWeekend(date: Date): boolean {\n  return date.getDay() === 0 || date.getDay() === 6;\n}\n\nundefined?.test(\"isWeekend\", ({ expect }) => {\n  // Sunday (day 0)\n  expect(isWeekend(new Date(2023, 0, 1))).toBe(true);\n  // Saturday (day 6)\n  expect(isWeekend(new Date(2023, 0, 7))).toBe(true);\n  // Monday (day 1)\n  expect(isWeekend(new Date(2023, 0, 2))).toBe(false);\n  // Friday (day 5)\n  expect(isWeekend(new Date(2023, 0, 6))).toBe(false);\n});\n\nconst agoUnits = [\n  [60, 'second'],\n  [60, 'minute'],\n  [24, 'hour'],\n  [7, 'day'],\n  [5, 'week'],\n] as const;\n\nexport function fromNow(date: Date): string {\n  return fromNowDetailed(date).result;\n}\n\nundefined?.test(\"fromNow\", ({ expect }) => {\n  // Set a fixed date for testing\n  const fixedDate = new Date(\"2023-01-15T12:00:00.000Z\");\n\n  // Use Vitest's fake timers\n  undefined?.vi.useFakeTimers();\n  undefined?.vi.setSystemTime(fixedDate);\n\n  // Test past times\n  expect(fromNow(new Date(\"2023-01-15T11:59:50.000Z\"))).toBe(\"just now\");\n  expect(fromNow(new Date(\"2023-01-15T11:59:00.000Z\"))).toBe(\"1 minute ago\");\n  expect(fromNow(new Date(\"2023-01-15T11:00:00.000Z\"))).toBe(\"1 hour ago\");\n  expect(fromNow(new Date(\"2023-01-14T12:00:00.000Z\"))).toBe(\"1 day ago\");\n  expect(fromNow(new Date(\"2023-01-08T12:00:00.000Z\"))).toBe(\"1 week ago\");\n\n  // Test future times\n  expect(fromNow(new Date(\"2023-01-15T12:00:10.000Z\"))).toBe(\"just now\");\n  expect(fromNow(new Date(\"2023-01-15T12:01:00.000Z\"))).toBe(\"in 1 minute\");\n  expect(fromNow(new Date(\"2023-01-15T13:00:00.000Z\"))).toBe(\"in 1 hour\");\n  expect(fromNow(new Date(\"2023-01-16T12:00:00.000Z\"))).toBe(\"in 1 day\");\n  expect(fromNow(new Date(\"2023-01-22T12:00:00.000Z\"))).toBe(\"in 1 week\");\n\n  // Test very old dates (should use date format)\n  expect(fromNow(new Date(\"2022-01-15T12:00:00.000Z\"))).toMatch(/Jan 15, 2022/);\n\n  // Restore real timers\n  undefined?.vi.useRealTimers();\n});\n\nexport function fromNowDetailed(date: Date): {\n  result: string,\n  /**\n   * May be Infinity if the result will never change.\n   */\n  secondsUntilChange: number,\n} {\n  if (!(date instanceof Date)) {\n    throw new Error(`fromNow only accepts Date objects (received: ${date})`);\n  }\n\n  const now = new Date();\n  const elapsed = now.getTime() - date.getTime();\n\n  let remainingInUnit = Math.abs(elapsed) / 1000;\n  if (remainingInUnit < 15) {\n    return {\n      result: 'just now',\n      secondsUntilChange: 15 - remainingInUnit,\n    };\n  }\n  let unitInSeconds = 1;\n  for (const [nextUnitSize, unitName] of agoUnits) {\n    const rounded = Math.round(remainingInUnit);\n    if (rounded < nextUnitSize) {\n      if (elapsed < 0) {\n        return {\n          result: `in ${rounded} ${unitName}${rounded === 1 ? '' : 's'}`,\n          secondsUntilChange: remainder((remainingInUnit - rounded + 0.5) * unitInSeconds, unitInSeconds),\n        };\n      } else {\n        return {\n          result: `${rounded} ${unitName}${rounded === 1 ? '' : 's'} ago`,\n          secondsUntilChange: remainder((rounded - remainingInUnit - 0.5) * unitInSeconds, unitInSeconds),\n        };\n      }\n    }\n    unitInSeconds *= nextUnitSize;\n    remainingInUnit /= nextUnitSize;\n  }\n\n  return {\n    result: date.toLocaleDateString('en-US', { year: 'numeric', month: 'short', day: 'numeric' }),\n    secondsUntilChange: Infinity,\n  };\n}\n\n/**\n * Returns a string representation of the given date in the format expected by the `datetime-local` input type.\n */\nexport function getInputDatetimeLocalString(date: Date): string {\n  date = new Date(date);\n  date.setMinutes(date.getMinutes() - date.getTimezoneOffset());\n  return date.toISOString().slice(0, 19);\n}\n\nundefined?.test(\"getInputDatetimeLocalString\", ({ expect }) => {\n  // Use Vitest's fake timers to ensure consistent timezone behavior\n  undefined?.vi.useFakeTimers();\n\n  // Test with a specific date\n  const mockDate = new Date(\"2023-01-15T12:30:45.000Z\");\n  const result = getInputDatetimeLocalString(mockDate);\n\n  // The result should be in the format YYYY-MM-DDTHH:MM:SS\n  expect(result).toMatch(/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$/);\n\n  // Test with different dates\n  const dates = [\n    new Date(\"2023-01-01T00:00:00.000Z\"),\n    new Date(\"2023-06-15T23:59:59.000Z\"),\n    new Date(\"2023-12-31T12:34:56.000Z\"),\n  ];\n\n  for (const date of dates) {\n    const result = getInputDatetimeLocalString(date);\n    expect(result).toMatch(/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$/);\n  }\n\n  // Restore real timers\n  undefined?.vi.useRealTimers();\n});\n\n\nexport type Interval = [number, 'millisecond' | 'second' | 'minute' | 'hour' | 'day' | 'week' | 'month' | 'year'];\nexport type DayInterval = [number, 'day' | 'week' | 'month' | 'year'];\n\nfunction applyInterval(date: Date, times: number, interval: Interval): Date {\n  if (!intervalSchema.isValidSync(interval)) {\n    throw new StackAssertionError(`Invalid interval`, { interval });\n  }\n  const [amount, unit] = interval;\n  switch (unit) {\n    case 'millisecond': {\n      date.setMilliseconds(date.getMilliseconds() + amount * times);\n      break;\n    }\n    case 'second': {\n      date.setSeconds(date.getSeconds() + amount * times);\n      break;\n    }\n    case 'minute': {\n      date.setMinutes(date.getMinutes() + amount * times);\n      break;\n    }\n    case 'hour': {\n      date.setHours(date.getHours() + amount * times);\n      break;\n    }\n    case 'day': {\n      date.setDate(date.getDate() + amount * times);\n      break;\n    }\n    case 'week': {\n      date.setDate(date.getDate() + amount * times * 7);\n      break;\n    }\n    case 'month': {\n      date.setMonth(date.getMonth() + amount * times);\n      break;\n    }\n    case 'year': {\n      date.setFullYear(date.getFullYear() + amount * times);\n      break;\n    }\n    default: {\n      throw new StackAssertionError(`Invalid interval despite schema validation`, { interval });\n    }\n  }\n  return date;\n}\n\nexport function subtractInterval(date: Date, interval: Interval): Date {\n  return applyInterval(date, -1, interval);\n}\n\nexport function addInterval(date: Date, interval: Interval): Date {\n  return applyInterval(date, 1, interval);\n}\n\nexport const FAR_FUTURE_DATE = new Date(8640000000000000); // 13 Sep 275760 00:00:00 UTC\n\nfunction getMsPerDayIntervalUnit(unit: 'day' | 'week'): number {\n  if (unit === 'day') {\n    return 24 * 60 * 60 * 1000;\n  }\n  return 7 * 24 * 60 * 60 * 1000;\n}\n\n\nexport function getIntervalsElapsed(anchor: Date, to: Date, repeat: DayInterval): number {\n  const [amount, unit] = repeat;\n  if (to <= anchor) return 0;\n  if (unit === 'day' || unit === 'week') {\n    const msPerUnit = getMsPerDayIntervalUnit(unit);\n    const diffMs = to.getTime() - anchor.getTime();\n    return Math.floor(diffMs / (msPerUnit * amount));\n  }\n  if ([\"month\", \"year\"].includes(unit)) {\n    let count = 0;\n    let current = new Date(anchor);\n    for (; ;) {\n      const next = addInterval(new Date(current), [amount, unit]);\n      if (next > to) break;\n      current = next;\n      count += 1;\n    }\n    return count;\n  }\n  return 0;\n}\n\nundefined?.test(\"getIntervalsElapsed\", ({ expect }) => {\n  const anchor = new Date('2025-01-01T00:00:00.000Z');\n  const to = new Date('2025-01-15T00:00:00.000Z');\n  expect(getIntervalsElapsed(anchor, to, [1, 'week'])).toBe(2);\n  expect(getIntervalsElapsed(anchor, to, [3, 'day'])).toBe(4);\n\n  const mAnchor = new Date('2023-01-31T00:00:00.000Z');\n  const mTo = new Date('2023-03-01T00:00:00.000Z');\n  expect(getIntervalsElapsed(mAnchor, mTo, [1, 'month'])).toBe(0);\n\n  const yAnchor = new Date('2020-01-01T00:00:00.000Z');\n  const yTo = new Date('2022-06-01T00:00:00.000Z');\n  expect(getIntervalsElapsed(yAnchor, yTo, [1, 'year'])).toBe(2);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,2BAA+B;AAC/B,oBAAoC;AACpC,kBAA0B;AAEnB,SAAS,UAAU,MAAqB;AAC7C,SAAO,KAAK,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM;AAClD;AAaA,IAAM,WAAW;AAAA,EACf,CAAC,IAAI,QAAQ;AAAA,EACb,CAAC,IAAI,QAAQ;AAAA,EACb,CAAC,IAAI,MAAM;AAAA,EACX,CAAC,GAAG,KAAK;AAAA,EACT,CAAC,GAAG,MAAM;AACZ;AAEO,SAAS,QAAQ,MAAoB;AAC1C,SAAO,gBAAgB,IAAI,EAAE;AAC/B;AA+BO,SAAS,gBAAgB,MAM9B;AACA,MAAI,EAAE,gBAAgB,OAAO;AAC3B,UAAM,IAAI,MAAM,gDAAgD,IAAI,GAAG;AAAA,EACzE;AAEA,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,UAAU,IAAI,QAAQ,IAAI,KAAK,QAAQ;AAE7C,MAAI,kBAAkB,KAAK,IAAI,OAAO,IAAI;AAC1C,MAAI,kBAAkB,IAAI;AACxB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,oBAAoB,KAAK;AAAA,IAC3B;AAAA,EACF;AACA,MAAI,gBAAgB;AACpB,aAAW,CAAC,cAAc,QAAQ,KAAK,UAAU;AAC/C,UAAM,UAAU,KAAK,MAAM,eAAe;AAC1C,QAAI,UAAU,cAAc;AAC1B,UAAI,UAAU,GAAG;AACf,eAAO;AAAA,UACL,QAAQ,MAAM,OAAO,IAAI,QAAQ,GAAG,YAAY,IAAI,KAAK,GAAG;AAAA,UAC5D,wBAAoB,wBAAW,kBAAkB,UAAU,OAAO,eAAe,aAAa;AAAA,QAChG;AAAA,MACF,OAAO;AACL,eAAO;AAAA,UACL,QAAQ,GAAG,OAAO,IAAI,QAAQ,GAAG,YAAY,IAAI,KAAK,GAAG;AAAA,UACzD,wBAAoB,wBAAW,UAAU,kBAAkB,OAAO,eAAe,aAAa;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AACA,qBAAiB;AACjB,uBAAmB;AAAA,EACrB;AAEA,SAAO;AAAA,IACL,QAAQ,KAAK,mBAAmB,SAAS,EAAE,MAAM,WAAW,OAAO,SAAS,KAAK,UAAU,CAAC;AAAA,IAC5F,oBAAoB;AAAA,EACtB;AACF;AAKO,SAAS,4BAA4B,MAAoB;AAC9D,SAAO,IAAI,KAAK,IAAI;AACpB,OAAK,WAAW,KAAK,WAAW,IAAI,KAAK,kBAAkB,CAAC;AAC5D,SAAO,KAAK,YAAY,EAAE,MAAM,GAAG,EAAE;AACvC;AAiCA,SAAS,cAAc,MAAY,OAAe,UAA0B;AAC1E,MAAI,CAAC,oCAAe,YAAY,QAAQ,GAAG;AACzC,UAAM,IAAI,kCAAoB,oBAAoB,EAAE,SAAS,CAAC;AAAA,EAChE;AACA,QAAM,CAAC,QAAQ,IAAI,IAAI;AACvB,UAAQ,MAAM;AAAA,IACZ,KAAK,eAAe;AAClB,WAAK,gBAAgB,KAAK,gBAAgB,IAAI,SAAS,KAAK;AAC5D;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,WAAK,WAAW,KAAK,WAAW,IAAI,SAAS,KAAK;AAClD;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,WAAK,WAAW,KAAK,WAAW,IAAI,SAAS,KAAK;AAClD;AAAA,IACF;AAAA,IACA,KAAK,QAAQ;AACX,WAAK,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK;AAC9C;AAAA,IACF;AAAA,IACA,KAAK,OAAO;AACV,WAAK,QAAQ,KAAK,QAAQ,IAAI,SAAS,KAAK;AAC5C;AAAA,IACF;AAAA,IACA,KAAK,QAAQ;AACX,WAAK,QAAQ,KAAK,QAAQ,IAAI,SAAS,QAAQ,CAAC;AAChD;AAAA,IACF;AAAA,IACA,KAAK,SAAS;AACZ,WAAK,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK;AAC9C;AAAA,IACF;AAAA,IACA,KAAK,QAAQ;AACX,WAAK,YAAY,KAAK,YAAY,IAAI,SAAS,KAAK;AACpD;AAAA,IACF;AAAA,IACA,SAAS;AACP,YAAM,IAAI,kCAAoB,8CAA8C,EAAE,SAAS,CAAC;AAAA,IAC1F;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,MAAY,UAA0B;AACrE,SAAO,cAAc,MAAM,IAAI,QAAQ;AACzC;AAEO,SAAS,YAAY,MAAY,UAA0B;AAChE,SAAO,cAAc,MAAM,GAAG,QAAQ;AACxC;AAEO,IAAM,kBAAkB,oBAAI,KAAK,MAAgB;AAExD,SAAS,wBAAwB,MAA8B;AAC7D,MAAI,SAAS,OAAO;AAClB,WAAO,KAAK,KAAK,KAAK;AAAA,EACxB;AACA,SAAO,IAAI,KAAK,KAAK,KAAK;AAC5B;AAGO,SAAS,oBAAoB,QAAc,IAAU,QAA6B;AACvF,QAAM,CAAC,QAAQ,IAAI,IAAI;AACvB,MAAI,MAAM,OAAQ,QAAO;AACzB,MAAI,SAAS,SAAS,SAAS,QAAQ;AACrC,UAAM,YAAY,wBAAwB,IAAI;AAC9C,UAAM,SAAS,GAAG,QAAQ,IAAI,OAAO,QAAQ;AAC7C,WAAO,KAAK,MAAM,UAAU,YAAY,OAAO;AAAA,EACjD;AACA,MAAI,CAAC,SAAS,MAAM,EAAE,SAAS,IAAI,GAAG;AACpC,QAAI,QAAQ;AACZ,QAAI,UAAU,IAAI,KAAK,MAAM;AAC7B,eAAU;AACR,YAAM,OAAO,YAAY,IAAI,KAAK,OAAO,GAAG,CAAC,QAAQ,IAAI,CAAC;AAC1D,UAAI,OAAO,GAAI;AACf,gBAAU;AACV,eAAS;AAAA,IACX;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/dist/utils/jwt.d.mts

@@ -1,7 +1,5 @@
 import * as jose from 'jose';
 
-declare function legacySignGlobalJWT(issuer: string, payload: any, expirationTime?: string): Promise<string>;
-declare function legacyVerifyGlobalJWT(issuer: string, jwt: string): Promise<jose.JWTPayload>;
 declare function signJWT(options: {
     issuer: string;
     audience: string;
@@ -9,7 +7,7 @@ declare function signJWT(options: {
     expirationTime?: string;
 }): Promise<string>;
 declare function verifyJWT(options: {
-    issuer: string;
+    allowedIssuers: string[];
     jwt: string;
 }): Promise<jose.JWTPayload>;
 type PrivateJwk = {
@@ -21,7 +19,13 @@ type PrivateJwk = {
     x: string;
     y: string;
 };
-declare function getPrivateJwk(secret: string): Promise<PrivateJwk>;
+/**
+ * Returns a list of valid private JWKs for the given audience, with the first one taking precedence when signing new
+ * JWTs.
+ */
+declare function getPrivateJwks(options: {
+    audience: string;
+}): Promise<PrivateJwk[]>;
 type PublicJwk = {
     kty: "EC";
     alg: "ES256";
@@ -30,15 +34,11 @@ type PublicJwk = {
     x: string;
     y: string;
 };
-declare function getPublicJwkSet(secretOrPrivateJwk: string | PrivateJwk): Promise<{
+declare function getPublicJwkSet(privateJwks: PrivateJwk[]): Promise<{
     keys: PublicJwk[];
 }>;
-declare function getPerAudienceSecret(options: {
-    audience: string;
-    secret: string;
-}): string;
-declare function getKid(options: {
+declare function oldGetKid(options: {
     secret: string;
 }): string;
 
-export { type PrivateJwk, type PublicJwk, getKid, getPerAudienceSecret, getPrivateJwk, getPublicJwkSet, legacySignGlobalJWT, legacyVerifyGlobalJWT, signJWT, verifyJWT };
+export { type PrivateJwk, type PublicJwk, getPrivateJwks, getPublicJwkSet, oldGetKid, signJWT, verifyJWT };

package/dist/utils/jwt.d.ts

@@ -1,7 +1,5 @@
 import * as jose from 'jose';
 
-declare function legacySignGlobalJWT(issuer: string, payload: any, expirationTime?: string): Promise<string>;
-declare function legacyVerifyGlobalJWT(issuer: string, jwt: string): Promise<jose.JWTPayload>;
 declare function signJWT(options: {
     issuer: string;
     audience: string;
@@ -9,7 +7,7 @@ declare function signJWT(options: {
     expirationTime?: string;
 }): Promise<string>;
 declare function verifyJWT(options: {
-    issuer: string;
+    allowedIssuers: string[];
     jwt: string;
 }): Promise<jose.JWTPayload>;
 type PrivateJwk = {
@@ -21,7 +19,13 @@ type PrivateJwk = {
     x: string;
     y: string;
 };
-declare function getPrivateJwk(secret: string): Promise<PrivateJwk>;
+/**
+ * Returns a list of valid private JWKs for the given audience, with the first one taking precedence when signing new
+ * JWTs.
+ */
+declare function getPrivateJwks(options: {
+    audience: string;
+}): Promise<PrivateJwk[]>;
 type PublicJwk = {
     kty: "EC";
     alg: "ES256";
@@ -30,15 +34,11 @@ type PublicJwk = {
     x: string;
     y: string;
 };
-declare function getPublicJwkSet(secretOrPrivateJwk: string | PrivateJwk): Promise<{
+declare function getPublicJwkSet(privateJwks: PrivateJwk[]): Promise<{
     keys: PublicJwk[];
 }>;
-declare function getPerAudienceSecret(options: {
-    audience: string;
-    secret: string;
-}): string;
-declare function getKid(options: {
+declare function oldGetKid(options: {
     secret: string;
 }): string;
 
-export { type PrivateJwk, type PublicJwk, getKid, getPerAudienceSecret, getPrivateJwk, getPublicJwkSet, legacySignGlobalJWT, legacyVerifyGlobalJWT, signJWT, verifyJWT };
+export { type PrivateJwk, type PublicJwk, getPrivateJwks, getPublicJwkSet, oldGetKid, signJWT, verifyJWT };

package/dist/utils/jwt.js

@@ -30,12 +30,9 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/utils/jwt.tsx
 var jwt_exports = {};
 __export(jwt_exports, {
-  getKid: () => getKid,
-  getPerAudienceSecret: () => getPerAudienceSecret,
-  getPrivateJwk: () => getPrivateJwk,
+  getPrivateJwks: () => getPrivateJwks,
   getPublicJwkSet: () => getPublicJwkSet,
-  legacySignGlobalJWT: () => legacySignGlobalJWT,
-  legacyVerifyGlobalJWT: () => legacyVerifyGlobalJWT,
+  oldGetKid: () => oldGetKid,
   signJWT: () => signJWT,
   verifyJWT: () => verifyJWT
 });
@@ -45,42 +42,36 @@ var import_elliptic = __toESM(require("elliptic"));
 var jose = __toESM(require("jose"));
 var import_errors = require("jose/errors");
 var import_bytes = require("./bytes.js");
+var import_env = require("./env.js");
 var import_errors2 = require("./errors.js");
 var import_globals = require("./globals.js");
 var import_objects = require("./objects.js");
-var STACK_SERVER_SECRET = process.env.STACK_SERVER_SECRET ?? "";
-try {
-  jose.base64url.decode(STACK_SERVER_SECRET);
-} catch (e) {
-  throw new Error("STACK_SERVER_SECRET is not valid. Please use the generateKeys script to generate a new secret.");
-}
-async function legacySignGlobalJWT(issuer, payload, expirationTime = "5m") {
-  const privateJwk = await jose.importJWK(await getPrivateJwk(STACK_SERVER_SECRET));
-  return await new jose.SignJWT(payload).setProtectedHeader({ alg: "ES256" }).setIssuer(issuer).setIssuedAt().setExpirationTime(expirationTime).sign(privateJwk);
-}
-async function legacyVerifyGlobalJWT(issuer, jwt) {
-  const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet(STACK_SERVER_SECRET));
-  const verified = await jose.jwtVerify(jwt, jwkSet, { issuer });
-  return verified.payload;
+function getStackServerSecret() {
+  const STACK_SERVER_SECRET = (0, import_env.getEnvVariable)("STACK_SERVER_SECRET");
+  try {
+    jose.base64url.decode(STACK_SERVER_SECRET);
+  } catch (e) {
+    throw new import_errors2.StackAssertionError("STACK_SERVER_SECRET is not valid. Please use the generateKeys script to generate a new secret.", { cause: e });
+  }
+  return STACK_SERVER_SECRET;
 }
 async function signJWT(options) {
-  const secret = getPerAudienceSecret({ audience: options.audience, secret: STACK_SERVER_SECRET });
-  const kid = getKid({ secret });
-  const privateJwk = await jose.importJWK(await getPrivateJwk(secret));
-  return await new jose.SignJWT(options.payload).setProtectedHeader({ alg: "ES256", kid }).setIssuer(options.issuer).setIssuedAt().setAudience(options.audience).setExpirationTime(options.expirationTime || "5m").sign(privateJwk);
+  const privateJwks = await getPrivateJwks({ audience: options.audience });
+  const privateKey = await jose.importJWK(privateJwks[0]);
+  return await new jose.SignJWT(options.payload).setProtectedHeader({ alg: "ES256", kid: privateJwks[0].kid }).setIssuer(options.issuer).setIssuedAt().setAudience(options.audience).setExpirationTime(options.expirationTime || "5m").sign(privateKey);
 }
 async function verifyJWT(options) {
-  const audience = jose.decodeJwt(options.jwt).aud;
+  const decodedJwt = jose.decodeJwt(options.jwt);
+  const audience = decodedJwt.aud;
   if (!audience || typeof audience !== "string") {
     throw new import_errors.JOSEError("Invalid JWT audience");
   }
-  const secret = getPerAudienceSecret({ audience, secret: STACK_SERVER_SECRET });
-  const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet(secret));
-  const verified = await jose.jwtVerify(options.jwt, jwkSet, { issuer: options.issuer });
+  const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet(await getPrivateJwks({ audience })));
+  const verified = await jose.jwtVerify(options.jwt, jwkSet, { issuer: options.allowedIssuers });
   return verified.payload;
 }
-async function getPrivateJwk(secret) {
-  const secretHash = await import_globals.globalVar.crypto.subtle.digest("SHA-256", jose.base64url.decode(secret));
+async function getPrivateJwkFromDerivedSecret(derivedSecret, kid) {
+  const secretHash = await import_globals.globalVar.crypto.subtle.digest("SHA-256", jose.base64url.decode(derivedSecret));
   const priv = new Uint8Array(secretHash);
   const ec = new import_elliptic.default.ec("p256");
   const key = ec.keyFromPrivate(priv);
@@ -89,40 +80,51 @@ async function getPrivateJwk(secret) {
     kty: "EC",
     crv: "P-256",
     alg: "ES256",
-    kid: getKid({ secret }),
+    kid,
     d: (0, import_bytes.encodeBase64Url)(priv),
     x: (0, import_bytes.encodeBase64Url)(publicKey.getX().toBuffer()),
     y: (0, import_bytes.encodeBase64Url)(publicKey.getY().toBuffer())
   };
 }
-async function getPublicJwkSet(secretOrPrivateJwk) {
-  const privateJwk = typeof secretOrPrivateJwk === "string" ? await getPrivateJwk(secretOrPrivateJwk) : secretOrPrivateJwk;
-  const jwk = (0, import_objects.pick)(privateJwk, ["kty", "alg", "crv", "x", "y", "kid"]);
+async function getPrivateJwks(options) {
+  const getHashOfJwkInfo = (type) => jose.base64url.encode(
+    import_crypto.default.createHash("sha256").update(JSON.stringify([type, getStackServerSecret(), {
+      audience: options.audience
+    }])).digest()
+  );
+  const perAudienceSecret = getHashOfJwkInfo("stack-jwk-audience-secret");
+  const perAudienceKid = getHashOfJwkInfo("stack-jwk-kid").slice(0, 12);
+  const oldPerAudienceSecret = oldGetPerAudienceSecret({ audience: options.audience });
+  const oldPerAudienceKid = oldGetKid({ secret: oldPerAudienceSecret });
+  return [
+    // TODO next-release: make this not take precedence; then, in the release after that, remove it entirely
+    await getPrivateJwkFromDerivedSecret(oldPerAudienceSecret, oldPerAudienceKid),
+    await getPrivateJwkFromDerivedSecret(perAudienceSecret, perAudienceKid)
+  ];
+}
+async function getPublicJwkSet(privateJwks) {
   return {
-    keys: [jwk]
+    keys: privateJwks.map((jwk) => (0, import_objects.pick)(jwk, ["kty", "alg", "crv", "x", "y", "kid"]))
   };
 }
-function getPerAudienceSecret(options) {
+function oldGetPerAudienceSecret(options) {
   if (options.audience === "kid") {
     throw new import_errors2.StackAssertionError("You cannot use the 'kid' audience for a per-audience secret, see comment below in jwt.tsx");
   }
   return jose.base64url.encode(
-    import_crypto.default.createHash("sha256").update(JSON.stringify([options.secret, options.audience])).digest()
+    import_crypto.default.createHash("sha256").update(JSON.stringify([getStackServerSecret(), options.audience])).digest()
   );
 }
-function getKid(options) {
+function oldGetKid(options) {
   return jose.base64url.encode(
     import_crypto.default.createHash("sha256").update(JSON.stringify([options.secret, "kid"])).digest()
   ).slice(0, 12);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  getKid,
-  getPerAudienceSecret,
-  getPrivateJwk,
+  getPrivateJwks,
   getPublicJwkSet,
-  legacySignGlobalJWT,
-  legacyVerifyGlobalJWT,
+  oldGetKid,
   signJWT,
   verifyJWT
 });

package/dist/utils/jwt.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/jwt.tsx"],"sourcesContent":["import crypto from \"crypto\";\nimport elliptic from \"elliptic\";\nimport * as jose from \"jose\";\nimport { JOSEError } from \"jose/errors\";\nimport { encodeBase64Url } from \"./bytes\";\nimport { StackAssertionError } from \"./errors\";\nimport { globalVar } from \"./globals\";\nimport { pick } from \"./objects\";\n\nconst STACK_SERVER_SECRET = process.env.STACK_SERVER_SECRET ?? \"\";\ntry {\n  jose.base64url.decode(STACK_SERVER_SECRET);\n} catch (e) {\n  throw new Error(\"STACK_SERVER_SECRET is not valid. Please use the generateKeys script to generate a new secret.\");\n}\n\n// TODO: remove this after moving everyone to project specific JWTs\nexport async function legacySignGlobalJWT(issuer: string, payload: any, expirationTime = \"5m\") {\n  const privateJwk = await jose.importJWK(await getPrivateJwk(STACK_SERVER_SECRET));\n  return await new jose.SignJWT(payload)\n    .setProtectedHeader({ alg: \"ES256\" })\n    .setIssuer(issuer)\n    .setIssuedAt()\n    .setExpirationTime(expirationTime)\n    .sign(privateJwk);\n}\n\n// TODO: remove this after moving everyone to project specific JWTs\nexport async function legacyVerifyGlobalJWT(issuer: string, jwt: string) {\n  const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet(STACK_SERVER_SECRET));\n  const verified = await jose.jwtVerify(jwt, jwkSet, { issuer });\n  return verified.payload;\n}\n\nexport async function signJWT(options: {\n  issuer: string,\n  audience: string,\n  payload: any,\n  expirationTime?: string,\n}) {\n  const secret = getPerAudienceSecret({ audience: options.audience, secret: STACK_SERVER_SECRET });\n  const kid = getKid({ secret });\n  const privateJwk = await jose.importJWK(await getPrivateJwk(secret));\n  return await new jose.SignJWT(options.payload)\n    .setProtectedHeader({ alg: \"ES256\", kid })\n    .setIssuer(options.issuer)\n    .setIssuedAt()\n    .setAudience(options.audience)\n    .setExpirationTime(options.expirationTime || \"5m\")\n    .sign(privateJwk);\n}\n\nexport async function verifyJWT(options: {\n  issuer: string,\n  jwt: string,\n}) {\n  const audience = jose.decodeJwt(options.jwt).aud;\n  if (!audience || typeof audience !== \"string\") {\n    throw new JOSEError(\"Invalid JWT audience\");\n  }\n  const secret = getPerAudienceSecret({ audience, secret: STACK_SERVER_SECRET });\n  const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet(secret));\n  const verified = await jose.jwtVerify(options.jwt, jwkSet, { issuer: options.issuer });\n  return verified.payload;\n}\n\nexport type PrivateJwk = {\n  kty: \"EC\",\n  alg: \"ES256\",\n  crv: \"P-256\",\n  kid: string,\n  d: string,\n  x: string,\n  y: string,\n};\nexport async function getPrivateJwk(secret: string): Promise<PrivateJwk> {\n  const secretHash = await globalVar.crypto.subtle.digest(\"SHA-256\", jose.base64url.decode(secret));\n  const priv = new Uint8Array(secretHash);\n\n  const ec = new elliptic.ec('p256');\n  const key = ec.keyFromPrivate(priv);\n  const publicKey = key.getPublic();\n\n  return {\n    kty: 'EC',\n    crv: 'P-256',\n    alg: 'ES256',\n    kid: getKid({ secret }),\n    d: encodeBase64Url(priv),\n    x: encodeBase64Url(publicKey.getX().toBuffer()),\n    y: encodeBase64Url(publicKey.getY().toBuffer()),\n  };\n}\n\nexport type PublicJwk = {\n  kty: \"EC\",\n  alg: \"ES256\",\n  crv: \"P-256\",\n  kid: string,\n  x: string,\n  y: string,\n};\nexport async function getPublicJwkSet(secretOrPrivateJwk: string | PrivateJwk): Promise<{ keys: PublicJwk[] }> {\n  const privateJwk = typeof secretOrPrivateJwk === \"string\" ? await getPrivateJwk(secretOrPrivateJwk) : secretOrPrivateJwk;\n  const jwk = pick(privateJwk, [\"kty\", \"alg\", \"crv\", \"x\", \"y\", \"kid\"]);\n  return {\n    keys: [jwk],\n  };\n}\n\nexport function getPerAudienceSecret(options: {\n  audience: string,\n  secret: string,\n}) {\n  if (options.audience === \"kid\") {\n    throw new StackAssertionError(\"You cannot use the 'kid' audience for a per-audience secret, see comment below in jwt.tsx\");\n  }\n  return jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      // TODO we should prefix a string like \"stack-audience-secret\" before we hash so you can't use `getKid(...)` to get the secret for eg. the \"kid\" audience if the same secret value is used\n      // Sadly doing this modification is a bit annoying as we need to leave the old keys to be valid for a little longer\n      .update(JSON.stringify([options.secret, options.audience]))\n      .digest()\n  );\n};\n\nexport function getKid(options: {\n  secret: string,\n}) {\n  return jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      .update(JSON.stringify([options.secret, \"kid\"]))  // TODO see above in getPerAudienceSecret\n      .digest()\n  ).slice(0, 12);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAmB;AACnB,sBAAqB;AACrB,WAAsB;AACtB,oBAA0B;AAC1B,mBAAgC;AAChC,IAAAA,iBAAoC;AACpC,qBAA0B;AAC1B,qBAAqB;AAErB,IAAM,sBAAsB,QAAQ,IAAI,uBAAuB;AAC/D,IAAI;AACF,EAAK,eAAU,OAAO,mBAAmB;AAC3C,SAAS,GAAG;AACV,QAAM,IAAI,MAAM,gGAAgG;AAClH;AAGA,eAAsB,oBAAoB,QAAgB,SAAc,iBAAiB,MAAM;AAC7F,QAAM,aAAa,MAAW,eAAU,MAAM,cAAc,mBAAmB,CAAC;AAChF,SAAO,MAAM,IAAS,aAAQ,OAAO,EAClC,mBAAmB,EAAE,KAAK,QAAQ,CAAC,EACnC,UAAU,MAAM,EAChB,YAAY,EACZ,kBAAkB,cAAc,EAChC,KAAK,UAAU;AACpB;AAGA,eAAsB,sBAAsB,QAAgB,KAAa;AACvE,QAAM,SAAc,uBAAkB,MAAM,gBAAgB,mBAAmB,CAAC;AAChF,QAAM,WAAW,MAAW,eAAU,KAAK,QAAQ,EAAE,OAAO,CAAC;AAC7D,SAAO,SAAS;AAClB;AAEA,eAAsB,QAAQ,SAK3B;AACD,QAAM,SAAS,qBAAqB,EAAE,UAAU,QAAQ,UAAU,QAAQ,oBAAoB,CAAC;AAC/F,QAAM,MAAM,OAAO,EAAE,OAAO,CAAC;AAC7B,QAAM,aAAa,MAAW,eAAU,MAAM,cAAc,MAAM,CAAC;AACnE,SAAO,MAAM,IAAS,aAAQ,QAAQ,OAAO,EAC1C,mBAAmB,EAAE,KAAK,SAAS,IAAI,CAAC,EACxC,UAAU,QAAQ,MAAM,EACxB,YAAY,EACZ,YAAY,QAAQ,QAAQ,EAC5B,kBAAkB,QAAQ,kBAAkB,IAAI,EAChD,KAAK,UAAU;AACpB;AAEA,eAAsB,UAAU,SAG7B;AACD,QAAM,WAAgB,eAAU,QAAQ,GAAG,EAAE;AAC7C,MAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,UAAM,IAAI,wBAAU,sBAAsB;AAAA,EAC5C;AACA,QAAM,SAAS,qBAAqB,EAAE,UAAU,QAAQ,oBAAoB,CAAC;AAC7E,QAAM,SAAc,uBAAkB,MAAM,gBAAgB,MAAM,CAAC;AACnE,QAAM,WAAW,MAAW,eAAU,QAAQ,KAAK,QAAQ,EAAE,QAAQ,QAAQ,OAAO,CAAC;AACrF,SAAO,SAAS;AAClB;AAWA,eAAsB,cAAc,QAAqC;AACvE,QAAM,aAAa,MAAM,yBAAU,OAAO,OAAO,OAAO,WAAgB,eAAU,OAAO,MAAM,CAAC;AAChG,QAAM,OAAO,IAAI,WAAW,UAAU;AAEtC,QAAM,KAAK,IAAI,gBAAAC,QAAS,GAAG,MAAM;AACjC,QAAM,MAAM,GAAG,eAAe,IAAI;AAClC,QAAM,YAAY,IAAI,UAAU;AAEhC,SAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,OAAO,EAAE,OAAO,CAAC;AAAA,IACtB,OAAG,8BAAgB,IAAI;AAAA,IACvB,OAAG,8BAAgB,UAAU,KAAK,EAAE,SAAS,CAAC;AAAA,IAC9C,OAAG,8BAAgB,UAAU,KAAK,EAAE,SAAS,CAAC;AAAA,EAChD;AACF;AAUA,eAAsB,gBAAgB,oBAAyE;AAC7G,QAAM,aAAa,OAAO,uBAAuB,WAAW,MAAM,cAAc,kBAAkB,IAAI;AACtG,QAAM,UAAM,qBAAK,YAAY,CAAC,OAAO,OAAO,OAAO,KAAK,KAAK,KAAK,CAAC;AACnE,SAAO;AAAA,IACL,MAAM,CAAC,GAAG;AAAA,EACZ;AACF;AAEO,SAAS,qBAAqB,SAGlC;AACD,MAAI,QAAQ,aAAa,OAAO;AAC9B,UAAM,IAAI,mCAAoB,2FAA2F;AAAA,EAC3H;AACA,SAAY,eAAU;AAAA,IACpB,cAAAC,QACG,WAAW,QAAQ,EAGnB,OAAO,KAAK,UAAU,CAAC,QAAQ,QAAQ,QAAQ,QAAQ,CAAC,CAAC,EACzD,OAAO;AAAA,EACZ;AACF;AAEO,SAAS,OAAO,SAEpB;AACD,SAAY,eAAU;AAAA,IACpB,cAAAC,QACG,WAAW,QAAQ,EACnB,OAAO,KAAK,UAAU,CAAC,QAAQ,QAAQ,KAAK,CAAC,CAAC,EAC9C,OAAO;AAAA,EACZ,EAAE,MAAM,GAAG,EAAE;AACf;","names":["import_errors","elliptic","crypto","crypto"]}
+{"version":3,"sources":["../../src/utils/jwt.tsx"],"sourcesContent":["import crypto from \"crypto\";\nimport elliptic from \"elliptic\";\nimport * as jose from \"jose\";\nimport { JOSEError } from \"jose/errors\";\nimport { encodeBase64Url } from \"./bytes\";\nimport { getEnvVariable } from \"./env\";\nimport { StackAssertionError } from \"./errors\";\nimport { globalVar } from \"./globals\";\nimport { pick } from \"./objects\";\n\nfunction getStackServerSecret() {\n  const STACK_SERVER_SECRET = getEnvVariable(\"STACK_SERVER_SECRET\");\n  try {\n    jose.base64url.decode(STACK_SERVER_SECRET);\n  } catch (e) {\n    throw new StackAssertionError(\"STACK_SERVER_SECRET is not valid. Please use the generateKeys script to generate a new secret.\", { cause: e });\n  }\n  return STACK_SERVER_SECRET;\n}\n\nexport async function signJWT(options: {\n  issuer: string,\n  audience: string,\n  payload: any,\n  expirationTime?: string,\n}) {\n  const privateJwks = await getPrivateJwks({ audience: options.audience });\n  const privateKey = await jose.importJWK(privateJwks[0]);\n\n  return await new jose.SignJWT(options.payload)\n    .setProtectedHeader({ alg: \"ES256\", kid: privateJwks[0].kid })\n    .setIssuer(options.issuer)\n    .setIssuedAt()\n    .setAudience(options.audience)\n    .setExpirationTime(options.expirationTime || \"5m\")\n    .sign(privateKey);\n}\n\nexport async function verifyJWT(options: {\n  allowedIssuers: string[],\n  jwt: string,\n}) {\n  const decodedJwt = jose.decodeJwt(options.jwt);\n  const audience = decodedJwt.aud;\n  if (!audience || typeof audience !== \"string\") {\n    throw new JOSEError(\"Invalid JWT audience\");\n  }\n\n  const jwkSet = jose.createLocalJWKSet(await getPublicJwkSet(await getPrivateJwks({ audience })));\n  const verified = await jose.jwtVerify(options.jwt, jwkSet, { issuer: options.allowedIssuers });\n  return verified.payload;\n}\n\nexport type PrivateJwk = {\n  kty: \"EC\",\n  alg: \"ES256\",\n  crv: \"P-256\",\n  kid: string,\n  d: string,\n  x: string,\n  y: string,\n};\nasync function getPrivateJwkFromDerivedSecret(derivedSecret: string, kid: string): Promise<PrivateJwk> {\n  const secretHash = await globalVar.crypto.subtle.digest(\"SHA-256\", jose.base64url.decode(derivedSecret));\n  const priv = new Uint8Array(secretHash);\n\n  const ec = new elliptic.ec('p256');\n  const key = ec.keyFromPrivate(priv);\n  const publicKey = key.getPublic();\n\n  return {\n    kty: 'EC',\n    crv: 'P-256',\n    alg: 'ES256',\n    kid: kid,\n    d: encodeBase64Url(priv),\n    x: encodeBase64Url(publicKey.getX().toBuffer()),\n    y: encodeBase64Url(publicKey.getY().toBuffer()),\n  };\n}\n\n/**\n * Returns a list of valid private JWKs for the given audience, with the first one taking precedence when signing new\n * JWTs.\n */\nexport async function getPrivateJwks(options: {\n  audience: string,\n}): Promise<PrivateJwk[]> {\n  const getHashOfJwkInfo = (type: string) => jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      .update(JSON.stringify([type, getStackServerSecret(), {\n        audience: options.audience,\n      }]))\n      .digest()\n  );\n  const perAudienceSecret = getHashOfJwkInfo(\"stack-jwk-audience-secret\");\n  const perAudienceKid = getHashOfJwkInfo(\"stack-jwk-kid\").slice(0, 12);\n\n  const oldPerAudienceSecret = oldGetPerAudienceSecret({ audience: options.audience });\n  const oldPerAudienceKid = oldGetKid({ secret: oldPerAudienceSecret });\n\n  return [\n    // TODO next-release: make this not take precedence; then, in the release after that, remove it entirely\n    await getPrivateJwkFromDerivedSecret(oldPerAudienceSecret, oldPerAudienceKid),\n\n    await getPrivateJwkFromDerivedSecret(perAudienceSecret, perAudienceKid),\n  ];\n}\n\nexport type PublicJwk = {\n  kty: \"EC\",\n  alg: \"ES256\",\n  crv: \"P-256\",\n  kid: string,\n  x: string,\n  y: string,\n};\nexport async function getPublicJwkSet(privateJwks: PrivateJwk[]): Promise<{ keys: PublicJwk[] }> {\n  return {\n    keys: privateJwks.map(jwk => pick(jwk, [\"kty\", \"alg\", \"crv\", \"x\", \"y\", \"kid\"])),\n  };\n}\n\nfunction oldGetPerAudienceSecret(options: {\n  audience: string,\n}) {\n  if (options.audience === \"kid\") {\n    throw new StackAssertionError(\"You cannot use the 'kid' audience for a per-audience secret, see comment below in jwt.tsx\");\n  }\n  return jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      // TODO we should prefix a string like \"stack-audience-secret\" before we hash so you can't use `getKid(...)` to get the secret for eg. the \"kid\" audience if the same secret value is used\n      // Sadly doing this modification is a bit annoying as we need to leave the old keys to be valid for a little longer\n      .update(JSON.stringify([getStackServerSecret(), options.audience]))\n      .digest()\n  );\n};\n\nexport function oldGetKid(options: {\n  secret: string,\n}) {\n  return jose.base64url.encode(\n    crypto\n      .createHash('sha256')\n      .update(JSON.stringify([options.secret, \"kid\"]))  // TODO see above in getPerAudienceSecret\n      .digest()\n  ).slice(0, 12);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAAmB;AACnB,sBAAqB;AACrB,WAAsB;AACtB,oBAA0B;AAC1B,mBAAgC;AAChC,iBAA+B;AAC/B,IAAAA,iBAAoC;AACpC,qBAA0B;AAC1B,qBAAqB;AAErB,SAAS,uBAAuB;AAC9B,QAAM,0BAAsB,2BAAe,qBAAqB;AAChE,MAAI;AACF,IAAK,eAAU,OAAO,mBAAmB;AAAA,EAC3C,SAAS,GAAG;AACV,UAAM,IAAI,mCAAoB,kGAAkG,EAAE,OAAO,EAAE,CAAC;AAAA,EAC9I;AACA,SAAO;AACT;AAEA,eAAsB,QAAQ,SAK3B;AACD,QAAM,cAAc,MAAM,eAAe,EAAE,UAAU,QAAQ,SAAS,CAAC;AACvE,QAAM,aAAa,MAAW,eAAU,YAAY,CAAC,CAAC;AAEtD,SAAO,MAAM,IAAS,aAAQ,QAAQ,OAAO,EAC1C,mBAAmB,EAAE,KAAK,SAAS,KAAK,YAAY,CAAC,EAAE,IAAI,CAAC,EAC5D,UAAU,QAAQ,MAAM,EACxB,YAAY,EACZ,YAAY,QAAQ,QAAQ,EAC5B,kBAAkB,QAAQ,kBAAkB,IAAI,EAChD,KAAK,UAAU;AACpB;AAEA,eAAsB,UAAU,SAG7B;AACD,QAAM,aAAkB,eAAU,QAAQ,GAAG;AAC7C,QAAM,WAAW,WAAW;AAC5B,MAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,UAAM,IAAI,wBAAU,sBAAsB;AAAA,EAC5C;AAEA,QAAM,SAAc,uBAAkB,MAAM,gBAAgB,MAAM,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;AAC/F,QAAM,WAAW,MAAW,eAAU,QAAQ,KAAK,QAAQ,EAAE,QAAQ,QAAQ,eAAe,CAAC;AAC7F,SAAO,SAAS;AAClB;AAWA,eAAe,+BAA+B,eAAuB,KAAkC;AACrG,QAAM,aAAa,MAAM,yBAAU,OAAO,OAAO,OAAO,WAAgB,eAAU,OAAO,aAAa,CAAC;AACvG,QAAM,OAAO,IAAI,WAAW,UAAU;AAEtC,QAAM,KAAK,IAAI,gBAAAC,QAAS,GAAG,MAAM;AACjC,QAAM,MAAM,GAAG,eAAe,IAAI;AAClC,QAAM,YAAY,IAAI,UAAU;AAEhC,SAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AAAA,IACA,OAAG,8BAAgB,IAAI;AAAA,IACvB,OAAG,8BAAgB,UAAU,KAAK,EAAE,SAAS,CAAC;AAAA,IAC9C,OAAG,8BAAgB,UAAU,KAAK,EAAE,SAAS,CAAC;AAAA,EAChD;AACF;AAMA,eAAsB,eAAe,SAEX;AACxB,QAAM,mBAAmB,CAAC,SAAsB,eAAU;AAAA,IACxD,cAAAC,QACG,WAAW,QAAQ,EACnB,OAAO,KAAK,UAAU,CAAC,MAAM,qBAAqB,GAAG;AAAA,MACpD,UAAU,QAAQ;AAAA,IACpB,CAAC,CAAC,CAAC,EACF,OAAO;AAAA,EACZ;AACA,QAAM,oBAAoB,iBAAiB,2BAA2B;AACtE,QAAM,iBAAiB,iBAAiB,eAAe,EAAE,MAAM,GAAG,EAAE;AAEpE,QAAM,uBAAuB,wBAAwB,EAAE,UAAU,QAAQ,SAAS,CAAC;AACnF,QAAM,oBAAoB,UAAU,EAAE,QAAQ,qBAAqB,CAAC;AAEpE,SAAO;AAAA;AAAA,IAEL,MAAM,+BAA+B,sBAAsB,iBAAiB;AAAA,IAE5E,MAAM,+BAA+B,mBAAmB,cAAc;AAAA,EACxE;AACF;AAUA,eAAsB,gBAAgB,aAA2D;AAC/F,SAAO;AAAA,IACL,MAAM,YAAY,IAAI,aAAO,qBAAK,KAAK,CAAC,OAAO,OAAO,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC;AAAA,EAChF;AACF;AAEA,SAAS,wBAAwB,SAE9B;AACD,MAAI,QAAQ,aAAa,OAAO;AAC9B,UAAM,IAAI,mCAAoB,2FAA2F;AAAA,EAC3H;AACA,SAAY,eAAU;AAAA,IACpB,cAAAA,QACG,WAAW,QAAQ,EAGnB,OAAO,KAAK,UAAU,CAAC,qBAAqB,GAAG,QAAQ,QAAQ,CAAC,CAAC,EACjE,OAAO;AAAA,EACZ;AACF;AAEO,SAAS,UAAU,SAEvB;AACD,SAAY,eAAU;AAAA,IACpB,cAAAC,QACG,WAAW,QAAQ,EACnB,OAAO,KAAK,UAAU,CAAC,QAAQ,QAAQ,KAAK,CAAC,CAAC,EAC9C,OAAO;AAAA,EACZ,EAAE,MAAM,GAAG,EAAE;AACf;","names":["import_errors","elliptic","crypto","crypto"]}

package/dist/utils/strings.js

@@ -232,6 +232,9 @@ ${currentIndent}`;
       if (ArrayBuffer.isView(value)) {
         return `${value.constructor.name}([${value.toString()}])`;
       }
+      if (value instanceof ArrayBuffer) {
+        return `ArrayBuffer [${new Uint8Array(value).toString()}]`;
+      }
       if (value instanceof Error) {
         let stack = value.stack ?? "";
         const toString = value.toString();