@suveren/gateway 0.7.6 → 0.8.0

package/node_modules/jose/dist/webapi/lib/jws_verify.js

@@ -1,139 +1,94 @@
-import { verify } from './signing.js';
-import { jwsAlgorithm } from './jws_algorithms.js';
-import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../util/errors.js';
-import { concat, decoder, encoder, encode } from './buffer_utils.js';
-import { decodeBase64url, encodeBase64url, parseJoseHeader } from './helpers.js';
-import { isDisjoint, isObject } from './type_checks.js';
-import { validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from './options.js';
-import { prepareKey } from './key.js';
-export function snapshotJws(jws, sharedPayload) {
-    const encodedProtected = jws.protected;
-    const inputHeader = jws.header;
-    const header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
-    let payload = sharedPayload ? sharedPayload[0] : jws.payload;
-    if (!sharedPayload && payload instanceof Uint8Array) {
-        payload = new Uint8Array(payload);
-    }
-    const signature = jws.signature;
-    const snapshot = { payload, signature };
-    if (encodedProtected !== undefined)
-        snapshot.protected = encodedProtected;
-    if (inputHeader !== undefined)
-        snapshot.header = header;
-    return snapshot;
+import { verify } from "./signing.js";
+import { jwsAlgorithm } from "./jws_algorithms.js";
+import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from "../util/errors.js";
+import { concat, decoder, encoder, encode } from "./buffer_utils.js";
+import { decodeBase64url, encodeBase64url, parseJoseHeader } from "./helpers.js";
+import { isDisjoint, isObject } from "./type_checks.js";
+import { validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from "./options.js";
+import { prepareKey } from "./key.js";
+function snapshotJws(jws, sharedPayload) {
+  const encodedProtected = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
+  let payload = sharedPayload ? sharedPayload[0] : jws.payload;
+  !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));
+  const signature = jws.signature, snapshot = { payload, signature };
+  return encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), snapshot;
 }
-export function verifyResult(jws, verified) {
-    const [payload, parsedProt, , key, resolvedKey] = verified;
-    const result = { payload };
-    if (jws.protected !== undefined) {
-        result.protectedHeader = parsedProt;
-    }
-    if (jws.header !== undefined) {
-        result.unprotectedHeader = jws.header;
-    }
-    if (resolvedKey) {
-        return { ...result, key };
-    }
-    return result;
+function verifyResult(jws, verified) {
+  const [payload, parsedProt, , key, resolvedKey] = verified, result = { payload };
+  return jws.protected !== void 0 && (result.protectedHeader = parsedProt), jws.header !== void 0 && (result.unprotectedHeader = jws.header), resolvedKey ? { ...result, key } : result;
 }
-export function prepareVerify(options) {
-    return [options && validateAlgorithms('algorithms', options.algorithms), options?.crit];
+function prepareVerify(options) {
+  return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-export function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === undefined
-    ? {}
-    : parseJoseHeader(encodedProtected, JWSInvalid, 'JWS Protected Header is invalid')) {
-    return parsedProtected;
+function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid")) {
+  return parsedProtected;
 }
 function validateJwsHeaders(parsedProt, joseHeader, shared) {
-    const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
-    const alg = joseHeader.alg;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    if (shared[0] && !shared[0].has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-    }
-    return [b64, alg];
+  const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), alg = joseHeader.alg;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  if (shared[0] && !shared[0].has(alg))
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  return [b64, alg];
 }
-export function parseJwsHeaders(encodedProtected, header, shared, parsedProtected) {
-    const parsedProt = parseProtectedHeader(encodedProtected, parsedProtected);
-    let joseHeader;
-    if (header !== undefined) {
-        if (!isDisjoint(parsedProt, header)) {
-            throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
-        }
-        joseHeader = { ...parsedProt, ...header };
-    }
-    else {
-        joseHeader = parsedProt;
-    }
-    return [parsedProt, joseHeader, ...validateJwsHeaders(parsedProt, joseHeader, shared)];
+function parseJwsHeaders(encodedProtected, header, shared, parsedProtected) {
+  const parsedProt = parseProtectedHeader(encodedProtected, parsedProtected);
+  let joseHeader;
+  if (header !== void 0) {
+    if (!isDisjoint(parsedProt, header))
+      throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+    joseHeader = { ...parsedProt, ...header };
+  } else
+    joseHeader = parsedProt;
+  return [parsedProt, joseHeader, ...validateJwsHeaders(parsedProt, joseHeader, shared)];
 }
-export function encodeJsonUnencodedPayload(payload) {
-    const invalid = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
-    if (invalid !== undefined) {
-        throw new JWSInvalid(/\p{Cs}/u.test(invalid)
-            ? 'JWS Payload must be a well-formed Unicode string'
-            : 'JWS Payload must not contain unassigned Unicode code points');
-    }
-    return encoder.encode(payload);
+function encodeJsonUnencodedPayload(payload) {
+  const invalid = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
+  if (invalid !== void 0)
+    throw new JWSInvalid(/\p{Cs}/u.test(invalid) ? "JWS Payload must be a well-formed Unicode string" : "JWS Payload must not contain unassigned Unicode code points");
+  return encoder.encode(payload);
 }
 function encodeCompactUnencodedPayload(payload) {
-    try {
-        return encode(payload);
-    }
-    catch {
-        throw new JWSInvalid('JWS Compact Serialization payload must use only ASCII characters');
-    }
+  try {
+    return encode(payload);
+  } catch {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
+  }
 }
 async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
-    let resolvedKey = false;
-    if (typeof key === 'function') {
-        key = await key(parsedProt, jws);
-        resolvedKey = true;
-    }
-    const b64 = typeof signingPayload === 'string';
-    const entry = jwsAlgorithm(alg);
-    const data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array(), encode('.'), b64
-        ?
-            (shared[2] ??= encodeBase64url(signingPayload, 'payload', JWSInvalid))
-        : signingPayload);
-    const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);
-    const k = await prepareKey(entry, key, 'verify');
-    if (!(await verify(entry, k, signature, data))) {
-        throw new JWSSignatureVerificationFailed();
-    }
-    const payload = b64 ? decodeBase64url(signingPayload, 'payload', JWSInvalid) : signingPayload;
-    return [payload, parsedProt, b64, k, resolvedKey];
+  let resolvedKey = !1;
+  typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = !0);
+  const b64 = typeof signingPayload == "string", entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), b64 ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify");
+  if (!await verify(entry, k, signature, data))
+    throw new JWSSignatureVerificationFailed();
+  return [b64 ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload, parsedProt, b64, k, resolvedKey];
 }
-export async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-    const { protected: encodedProtected, header, payload: inputPayload } = jws;
-    const [parsedProt, , b64, alg] = parseJwsHeaders(encodedProtected, header, shared, parsedProtected);
-    if (b64) {
-        if (typeof inputPayload !== 'string') {
-            throw new JWSInvalid('JWS Payload must be a string');
-        }
-    }
-    else if (typeof inputPayload !== 'string' && !(inputPayload instanceof Uint8Array)) {
-        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
-    }
-    const signingPayload = b64 || typeof inputPayload !== 'string' ? inputPayload : encodeUnencodedPayload(inputPayload);
-    return verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload);
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+  const { protected: encodedProtected, header, payload: inputPayload } = jws, [parsedProt, , b64, alg] = parseJwsHeaders(encodedProtected, header, shared, parsedProtected);
+  if (b64) {
+    if (typeof inputPayload != "string")
+      throw new JWSInvalid("JWS Payload must be a string");
+  } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
+    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+  return verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload);
 }
-export async function verifyCompact(jws, shared, key) {
-    if (jws instanceof Uint8Array) {
-        jws = decoder.decode(jws);
-    }
-    if (typeof jws !== 'string') {
-        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');
-    }
-    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');
-    if (length !== 3) {
-        throw new JWSInvalid('Invalid Compact JWS');
-    }
-    const compactJws = { payload, protected: protectedHeader, signature };
-    const parsedProt = parseProtectedHeader(protectedHeader);
-    const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
-    const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
-    return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
+async function verifyCompact(jws, shared, key) {
+  if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
+    throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
+  const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
+  if (length !== 3)
+    throw new JWSInvalid("Invalid Compact JWS");
+  const compactJws = { payload, protected: protectedHeader, signature }, parsedProt = parseProtectedHeader(protectedHeader), [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared), signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
+  return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
 }
+export {
+  encodeJsonUnencodedPayload,
+  parseJwsHeaders,
+  parseProtectedHeader,
+  prepareVerify,
+  snapshotJws,
+  verifyCompact,
+  verifyResult,
+  verifySignature
+};

package/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -1,232 +1,146 @@
-import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';
-import { encoder, strictDecoder } from './buffer_utils.js';
-import { isObject } from './type_checks.js';
-const epoch = (date) => Math.floor(date.getTime() / 1000);
-const multipliers = {
-    s: 1,
-    m: 60,
-    h: 3600,
-    d: 86400,
-    w: 604800,
-    y: 31557600,
-};
-const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
-const checkFailed = 'check_failed';
+import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "../util/errors.js";
+import { encoder, strictDecoder } from "./buffer_utils.js";
+import { isObject } from "./type_checks.js";
+const epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {
+  s: 1,
+  m: 60,
+  h: 3600,
+  d: 86400,
+  w: 604800,
+  y: 31557600
+}, REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = "check_failed";
 function invalidDuration() {
-    throw new TypeError('Invalid time period format');
+  throw new TypeError("Invalid time period format");
 }
-export function secs(str) {
-    if (typeof str !== 'string') {
-        invalidDuration();
-    }
-    const matched = REGEX.exec(str);
-    if (!matched || (matched[4] && matched[1])) {
-        invalidDuration();
-    }
-    const value = parseFloat(matched[2]);
-    const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-    if (!Number.isFinite(numericDate)) {
-        invalidDuration();
-    }
-    if (matched[1] === '-' || matched[4] === 'ago') {
-        return -numericDate;
-    }
-    return numericDate;
+function secs(str) {
+  typeof str != "string" && invalidDuration();
+  const matched = REGEX.exec(str);
+  (!matched || matched[4] && matched[1]) && invalidDuration();
+  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
 }
 function validateInput(label, input) {
-    if (!Number.isFinite(input)) {
-        throw new TypeError(`Invalid ${label} input`);
-    }
-    return input;
+  if (!Number.isFinite(input))
+    throw new TypeError(`Invalid ${label} input`);
+  return input;
 }
 function validateStringClaim(claim, value) {
-    if (typeof value !== 'string') {
-        throw new TypeError(`"${claim}" claim must be a string`);
-    }
+  if (typeof value != "string")
+    throw new TypeError(`"${claim}" claim must be a string`);
 }
 function validateAudienceClaim(value) {
-    if (typeof value !== 'string' &&
-        (!Array.isArray(value) || Array.from(value).some((member) => typeof member !== 'string'))) {
-        throw new TypeError('"aud" claim must be a string or an array of strings');
-    }
+  if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string")))
+    throw new TypeError('"aud" claim must be a string or an array of strings');
 }
 function numericDate(value, label) {
-    if (typeof value === 'number')
-        return validateInput(label, value);
-    if (value instanceof Date)
-        return validateInput(label, epoch(value));
-    return epoch(new Date()) + secs(value);
+  return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
 }
 const normalizeTyp = (value) => {
-    const normalized = value.toLowerCase();
-    return value.includes('/') ? normalized : `application/${normalized}`;
-};
-const checkAudiencePresence = (audPayload, audOption) => {
-    if (typeof audPayload === 'string') {
-        return audOption.includes(audPayload);
-    }
-    if (Array.isArray(audPayload)) {
-        return audOption.some((aud) => audPayload.includes(aud));
-    }
-    return false;
-};
-function validateNumericDate(payload, claim, required = false) {
-    const value = payload[claim];
-    if (value === undefined && !required)
-        return undefined;
-    if (typeof value !== 'number') {
-        throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, 'invalid');
-    }
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
+}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
+function validateNumericDate(payload, claim, required = !1) {
+  const value = payload[claim];
+  if (!(value === void 0 && !required)) {
+    if (typeof value != "number")
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
     return value;
+  }
 }
 function unexpectedClaim(payload, claim) {
-    throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
 }
-export function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-    let payload;
-    try {
-        payload = JSON.parse(strictDecoder.decode(encodedPayload));
-    }
-    catch {
-    }
-    if (!isObject(payload)) {
-        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
-    }
-    const { typ } = options;
-    if (typ !== undefined &&
-        (typeof protectedHeader.typ !== 'string' ||
-            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', checkFailed);
-    }
-    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
-    const presenceCheck = [...requiredClaims];
-    if (maxTokenAge !== undefined)
-        presenceCheck.push('iat');
-    if (audience !== undefined)
-        presenceCheck.push('aud');
-    if (subject !== undefined)
-        presenceCheck.push('sub');
-    if (issuer !== undefined)
-        presenceCheck.push('iss');
-    for (const claim of new Set(presenceCheck.reverse())) {
-        if (!Object.hasOwn(payload, claim)) {
-            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
-        }
-    }
-    if (issuer !== undefined &&
-        !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        unexpectedClaim(payload, 'iss');
-    }
-    if (subject !== undefined && payload.sub !== subject) {
-        unexpectedClaim(payload, 'sub');
-    }
-    if (audience !== undefined &&
-        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        unexpectedClaim(payload, 'aud');
-    }
-    const { clockTolerance } = options;
-    let tolerance = 0;
-    if (typeof clockTolerance === 'string') {
-        tolerance = secs(clockTolerance);
-    }
-    else if (clockTolerance !== undefined) {
-        if (typeof clockTolerance !== 'number') {
-            throw new TypeError('Invalid clockTolerance option type');
-        }
-        tolerance = clockTolerance;
-    }
-    validateInput('clockTolerance option', tolerance);
-    const { currentDate } = options;
-    const now = validateInput('currentDate option', epoch(currentDate === undefined ? new Date() : currentDate));
-    const iat = validateNumericDate(payload, 'iat', maxTokenAge !== undefined);
-    const nbf = validateNumericDate(payload, 'nbf');
-    if (nbf !== undefined) {
-        if (nbf > now + tolerance) {
-            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', checkFailed);
-        }
-    }
-    const exp = validateNumericDate(payload, 'exp');
-    if (exp !== undefined) {
-        if (exp <= now - tolerance) {
-            throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', checkFailed);
-        }
-    }
-    if (maxTokenAge !== undefined) {
-        const age = now - iat;
-        const max = validateInput('maxTokenAge option', typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge));
-        if (age - tolerance > max) {
-            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', checkFailed);
-        }
-        if (age < -tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', checkFailed);
-        }
-    }
-    return payload;
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+  let payload;
+  try {
+    payload = JSON.parse(strictDecoder.decode(encodedPayload));
+  } catch {
+  }
+  if (!isObject(payload))
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+  const { typ } = options;
+  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+  for (const claim of new Set(presenceCheck.reverse()))
+    if (!Object.hasOwn(payload, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+  const { clockTolerance } = options;
+  let tolerance = 0;
+  if (typeof clockTolerance == "string")
+    tolerance = secs(clockTolerance);
+  else if (clockTolerance !== void 0) {
+    if (typeof clockTolerance != "number")
+      throw new TypeError("Invalid clockTolerance option type");
+    tolerance = clockTolerance;
+  }
+  validateInput("clockTolerance option", tolerance);
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+  if (nbf !== void 0 && nbf > now + tolerance)
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
+  const exp = validateNumericDate(payload, "exp");
+  if (exp !== void 0 && exp <= now - tolerance)
+    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+  if (maxTokenAge !== void 0) {
+    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max)
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+    if (age < -tolerance)
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+  }
+  return payload;
 }
 let producerPayloads;
 function producerPayload(producer) {
-    return producerPayloads.get(producer);
+  return producerPayloads.get(producer);
 }
-export function jwtData(producer) {
-    const payload = producerPayload(producer);
-    for (const claim of ['iat', 'nbf', 'exp']) {
-        const value = payload[claim];
-        if (typeof value === 'number' && !Number.isFinite(value)) {
-            throw new TypeError(`"${claim}" claim must be a finite number`);
-        }
-    }
-    return encoder.encode(JSON.stringify(payload));
+function jwtData(producer) {
+  const payload = producerPayload(producer);
+  for (const claim of ["iat", "nbf", "exp"]) {
+    const value = payload[claim];
+    if (typeof value == "number" && !Number.isFinite(value))
+      throw new TypeError(`"${claim}" claim must be a finite number`);
+  }
+  return encoder.encode(JSON.stringify(payload));
 }
-export function jwtClaim(producer, claim) {
-    return producerPayload(producer)[claim];
+function jwtClaim(producer, claim) {
+  return producerPayload(producer)[claim];
 }
-export class JWTClaimsBuilder {
-    constructor(payload = {}) {
-        if (!isObject(payload)) {
-            throw new TypeError('JWT Claims Set MUST be an object');
-        }
-        ;
-        (producerPayloads ||= new WeakMap()).set(this, structuredClone(payload));
-    }
-    setIssuer(value) {
-        validateStringClaim('iss', value);
-        producerPayload(this).iss = value;
-        return this;
-    }
-    setSubject(value) {
-        validateStringClaim('sub', value);
-        producerPayload(this).sub = value;
-        return this;
-    }
-    setAudience(value) {
-        validateAudienceClaim(value);
-        producerPayload(this).aud = value;
-        return this;
-    }
-    setJti(value) {
-        validateStringClaim('jti', value);
-        producerPayload(this).jti = value;
-        return this;
-    }
-    setNotBefore(value) {
-        producerPayload(this).nbf = numericDate(value, 'setNotBefore');
-        return this;
-    }
-    setExpirationTime(value) {
-        producerPayload(this).exp = numericDate(value, 'setExpirationTime');
-        return this;
-    }
-    setIssuedAt(value) {
-        const payload = producerPayload(this);
-        if (value === undefined) {
-            payload.iat = epoch(new Date());
-        }
-        else if (typeof value === 'string') {
-            payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
-        }
-        else {
-            payload.iat = numericDate(value, 'setIssuedAt');
-        }
-        return this;
-    }
+class JWTClaimsBuilder {
+  constructor(payload = {}) {
+    if (!isObject(payload))
+      throw new TypeError("JWT Claims Set MUST be an object");
+    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
+  }
+  setIssuer(value) {
+    return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
+  }
+  setSubject(value) {
+    return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
+  }
+  setAudience(value) {
+    return validateAudienceClaim(value), producerPayload(this).aud = value, this;
+  }
+  setJti(value) {
+    return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
+  }
+  setNotBefore(value) {
+    return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
+  }
+  setExpirationTime(value) {
+    return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
+  }
+  setIssuedAt(value) {
+    const payload = producerPayload(this);
+    return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
+  }
 }
+export {
+  JWTClaimsBuilder,
+  jwtClaim,
+  jwtData,
+  secs,
+  validateClaimsSet
+};