hono 4.13.8 → 4.13.10

package/dist/utils/jwt/jws.js

@@ -1,192 +1,133 @@
-// src/utils/jwt/jws.ts
-import { getRuntimeKey } from "../../helper/adapter/index.js";
 import { decodeBase64 } from "../encode.js";
-import { CryptoKeyUsage, JwtAlgorithmNotImplemented } from "./types.js";
+import { getRuntimeKey } from "../../helper/adapter/index.js";
+import { JwtAlgorithmNotImplemented } from "./types.js";
 import { utf8Encoder } from "./utf8.js";
+//#region src/utils/jwt/jws.ts
+/**
+* @module
+* JSON Web Signature (JWS)
+* https://datatracker.ietf.org/doc/html/rfc7515
+*/
 async function signing(privateKey, alg, data) {
-  const algorithm = getKeyAlgorithm(alg);
-  const cryptoKey = await importPrivateKey(privateKey, algorithm);
-  return await crypto.subtle.sign(algorithm, cryptoKey, data);
+	const algorithm = getKeyAlgorithm(alg);
+	const cryptoKey = await importPrivateKey(privateKey, algorithm);
+	return await crypto.subtle.sign(algorithm, cryptoKey, data);
 }
 async function verifying(publicKey, alg, signature, data) {
-  const algorithm = getKeyAlgorithm(alg);
-  const cryptoKey = await importPublicKey(publicKey, algorithm);
-  return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+	const algorithm = getKeyAlgorithm(alg);
+	const cryptoKey = await importPublicKey(publicKey, algorithm);
+	return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
 }
 function pemToBinary(pem) {
-  return decodeBase64(pem.replace(/-+(BEGIN|END).*?-+/g, "").replace(/\s/g, ""));
+	return decodeBase64(pem.replace(/-+(BEGIN|END).*?-+/g, "").replace(/\s/g, ""));
 }
 async function importPrivateKey(key, alg) {
-  if (!crypto.subtle || !crypto.subtle.importKey) {
-    throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");
-  }
-  if (isCryptoKey(key)) {
-    if (key.type !== "private" && key.type !== "secret") {
-      throw new Error(
-        `unexpected key type: CryptoKey.type is ${key.type}, expected private or secret`
-      );
-    }
-    return key;
-  }
-  const usages = [CryptoKeyUsage.Sign];
-  if (typeof key === "object") {
-    return await crypto.subtle.importKey("jwk", key, alg, false, usages);
-  }
-  if (key.includes("PRIVATE")) {
-    return await crypto.subtle.importKey("pkcs8", pemToBinary(key), alg, false, usages);
-  }
-  return await crypto.subtle.importKey("raw", utf8Encoder.encode(key), alg, false, usages);
+	if (!crypto.subtle || !crypto.subtle.importKey) throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");
+	if (isCryptoKey(key)) {
+		if (key.type !== "private" && key.type !== "secret") throw new Error(`unexpected key type: CryptoKey.type is ${key.type}, expected private or secret`);
+		return key;
+	}
+	const usages = ["sign"];
+	if (typeof key === "object") return await crypto.subtle.importKey("jwk", key, alg, false, usages);
+	if (key.includes("PRIVATE")) return await crypto.subtle.importKey("pkcs8", pemToBinary(key), alg, false, usages);
+	return await crypto.subtle.importKey("raw", utf8Encoder.encode(key), alg, false, usages);
 }
 async function importPublicKey(key, alg) {
-  if (!crypto.subtle || !crypto.subtle.importKey) {
-    throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");
-  }
-  if (isCryptoKey(key)) {
-    if (key.type === "public" || key.type === "secret") {
-      return key;
-    }
-    key = await exportPublicJwkFrom(key);
-  }
-  if (typeof key === "string" && key.includes("PRIVATE")) {
-    const privateKey = await crypto.subtle.importKey("pkcs8", pemToBinary(key), alg, true, [
-      CryptoKeyUsage.Sign
-    ]);
-    key = await exportPublicJwkFrom(privateKey);
-  }
-  const usages = [CryptoKeyUsage.Verify];
-  if (typeof key === "object") {
-    return await crypto.subtle.importKey("jwk", key, alg, false, usages);
-  }
-  if (key.includes("PUBLIC")) {
-    return await crypto.subtle.importKey("spki", pemToBinary(key), alg, false, usages);
-  }
-  return await crypto.subtle.importKey("raw", utf8Encoder.encode(key), alg, false, usages);
+	if (!crypto.subtle || !crypto.subtle.importKey) throw new Error("`crypto.subtle.importKey` is undefined. JWT auth middleware requires it.");
+	if (isCryptoKey(key)) {
+		if (key.type === "public" || key.type === "secret") return key;
+		key = await exportPublicJwkFrom(key);
+	}
+	if (typeof key === "string" && key.includes("PRIVATE")) key = await exportPublicJwkFrom(await crypto.subtle.importKey("pkcs8", pemToBinary(key), alg, true, ["sign"]));
+	const usages = ["verify"];
+	if (typeof key === "object") return await crypto.subtle.importKey("jwk", key, alg, false, usages);
+	if (key.includes("PUBLIC")) return await crypto.subtle.importKey("spki", pemToBinary(key), alg, false, usages);
+	return await crypto.subtle.importKey("raw", utf8Encoder.encode(key), alg, false, usages);
 }
 async function exportPublicJwkFrom(privateKey) {
-  if (privateKey.type !== "private") {
-    throw new Error(`unexpected key type: ${privateKey.type}`);
-  }
-  if (!privateKey.extractable) {
-    throw new Error("unexpected private key is unextractable");
-  }
-  const jwk = await crypto.subtle.exportKey("jwk", privateKey);
-  const { kty } = jwk;
-  const { alg, e, n } = jwk;
-  const { crv, x, y } = jwk;
-  return { kty, alg, e, n, crv, x, y, key_ops: [CryptoKeyUsage.Verify] };
+	if (privateKey.type !== "private") throw new Error(`unexpected key type: ${privateKey.type}`);
+	if (!privateKey.extractable) throw new Error("unexpected private key is unextractable");
+	const jwk = await crypto.subtle.exportKey("jwk", privateKey);
+	const { kty } = jwk;
+	const { alg, e, n } = jwk;
+	const { crv, x, y } = jwk;
+	return {
+		kty,
+		alg,
+		e,
+		n,
+		crv,
+		x,
+		y,
+		key_ops: ["verify"]
+	};
 }
 function getKeyAlgorithm(name) {
-  switch (name) {
-    case "HS256":
-      return {
-        name: "HMAC",
-        hash: {
-          name: "SHA-256"
-        }
-      };
-    case "HS384":
-      return {
-        name: "HMAC",
-        hash: {
-          name: "SHA-384"
-        }
-      };
-    case "HS512":
-      return {
-        name: "HMAC",
-        hash: {
-          name: "SHA-512"
-        }
-      };
-    case "RS256":
-      return {
-        name: "RSASSA-PKCS1-v1_5",
-        hash: {
-          name: "SHA-256"
-        }
-      };
-    case "RS384":
-      return {
-        name: "RSASSA-PKCS1-v1_5",
-        hash: {
-          name: "SHA-384"
-        }
-      };
-    case "RS512":
-      return {
-        name: "RSASSA-PKCS1-v1_5",
-        hash: {
-          name: "SHA-512"
-        }
-      };
-    case "PS256":
-      return {
-        name: "RSA-PSS",
-        hash: {
-          name: "SHA-256"
-        },
-        saltLength: 32
-        // 256 >> 3
-      };
-    case "PS384":
-      return {
-        name: "RSA-PSS",
-        hash: {
-          name: "SHA-384"
-        },
-        saltLength: 48
-        // 384 >> 3
-      };
-    case "PS512":
-      return {
-        name: "RSA-PSS",
-        hash: {
-          name: "SHA-512"
-        },
-        saltLength: 64
-        // 512 >> 3,
-      };
-    case "ES256":
-      return {
-        name: "ECDSA",
-        hash: {
-          name: "SHA-256"
-        },
-        namedCurve: "P-256"
-      };
-    case "ES384":
-      return {
-        name: "ECDSA",
-        hash: {
-          name: "SHA-384"
-        },
-        namedCurve: "P-384"
-      };
-    case "ES512":
-      return {
-        name: "ECDSA",
-        hash: {
-          name: "SHA-512"
-        },
-        namedCurve: "P-521"
-      };
-    case "EdDSA":
-      return {
-        name: "Ed25519",
-        namedCurve: "Ed25519"
-      };
-    default:
-      throw new JwtAlgorithmNotImplemented(name);
-  }
+	switch (name) {
+		case "HS256": return {
+			name: "HMAC",
+			hash: { name: "SHA-256" }
+		};
+		case "HS384": return {
+			name: "HMAC",
+			hash: { name: "SHA-384" }
+		};
+		case "HS512": return {
+			name: "HMAC",
+			hash: { name: "SHA-512" }
+		};
+		case "RS256": return {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: { name: "SHA-256" }
+		};
+		case "RS384": return {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: { name: "SHA-384" }
+		};
+		case "RS512": return {
+			name: "RSASSA-PKCS1-v1_5",
+			hash: { name: "SHA-512" }
+		};
+		case "PS256": return {
+			name: "RSA-PSS",
+			hash: { name: "SHA-256" },
+			saltLength: 32
+		};
+		case "PS384": return {
+			name: "RSA-PSS",
+			hash: { name: "SHA-384" },
+			saltLength: 48
+		};
+		case "PS512": return {
+			name: "RSA-PSS",
+			hash: { name: "SHA-512" },
+			saltLength: 64
+		};
+		case "ES256": return {
+			name: "ECDSA",
+			hash: { name: "SHA-256" },
+			namedCurve: "P-256"
+		};
+		case "ES384": return {
+			name: "ECDSA",
+			hash: { name: "SHA-384" },
+			namedCurve: "P-384"
+		};
+		case "ES512": return {
+			name: "ECDSA",
+			hash: { name: "SHA-512" },
+			namedCurve: "P-521"
+		};
+		case "EdDSA": return {
+			name: "Ed25519",
+			namedCurve: "Ed25519"
+		};
+		default: throw new JwtAlgorithmNotImplemented(name);
+	}
 }
 function isCryptoKey(key) {
-  const runtime = getRuntimeKey();
-  if (runtime === "node" && !!crypto.webcrypto) {
-    return key instanceof crypto.webcrypto.CryptoKey;
-  }
-  return key instanceof CryptoKey;
+	if (getRuntimeKey() === "node" && !!crypto.webcrypto) return key instanceof crypto.webcrypto.CryptoKey;
+	return key instanceof CryptoKey;
 }
-export {
-  signing,
-  verifying
-};
+//#endregion
+export { signing, verifying };

package/dist/utils/jwt/jwt.js

@@ -1,207 +1,130 @@
-// src/utils/jwt/jwt.ts
-import { decodeBase64Url, encodeBase64Url } from "../../utils/encode.js";
+import { decodeBase64Url, encodeBase64Url } from "../encode.js";
 import { AlgorithmTypes } from "./jwa.js";
-import { signing, verifying } from "./jws.js";
-import {
-  JwtAlgorithmMismatch,
-  JwtAlgorithmNotAllowed,
-  JwtAlgorithmRequired,
-  JwtHeaderInvalid,
-  JwtHeaderRequiresKid,
-  JwtPayloadRequiresAud,
-  JwtSymmetricAlgorithmNotAllowed,
-  JwtTokenAudience,
-  JwtTokenExpired,
-  JwtTokenInvalid,
-  JwtTokenIssuedAt,
-  JwtTokenIssuer,
-  JwtTokenNotBefore,
-  JwtTokenSignatureMismatched
-} from "./types.js";
+import { JwtAlgorithmMismatch, JwtAlgorithmNotAllowed, JwtAlgorithmRequired, JwtHeaderInvalid, JwtHeaderRequiresKid, JwtPayloadRequiresAud, JwtSymmetricAlgorithmNotAllowed, JwtTokenAudience, JwtTokenExpired, JwtTokenInvalid, JwtTokenIssuedAt, JwtTokenIssuer, JwtTokenNotBefore, JwtTokenSignatureMismatched } from "./types.js";
 import { utf8Decoder, utf8Encoder } from "./utf8.js";
-var encodeJwtPart = (part) => encodeBase64Url(utf8Encoder.encode(JSON.stringify(part)).buffer).replace(/=/g, "");
-var encodeSignaturePart = (buf) => encodeBase64Url(buf).replace(/=/g, "");
-var decodeJwtPart = (part) => JSON.parse(utf8Decoder.decode(decodeBase64Url(part)));
+import { signing, verifying } from "./jws.js";
+//#region src/utils/jwt/jwt.ts
+/**
+* @module
+* JSON Web Token (JWT)
+* https://datatracker.ietf.org/doc/html/rfc7519
+*/
+const encodeJwtPart = (part) => encodeBase64Url(utf8Encoder.encode(JSON.stringify(part)).buffer).replace(/=/g, "");
+const encodeSignaturePart = (buf) => encodeBase64Url(buf).replace(/=/g, "");
+const decodeJwtPart = (part) => JSON.parse(utf8Decoder.decode(decodeBase64Url(part)));
 function isTokenHeader(obj) {
-  if (typeof obj === "object" && obj !== null) {
-    const objWithAlg = obj;
-    return "alg" in objWithAlg && Object.values(AlgorithmTypes).includes(objWithAlg.alg) && (!("typ" in objWithAlg) || objWithAlg.typ === "JWT");
-  }
-  return false;
+	if (typeof obj === "object" && obj !== null) {
+		const objWithAlg = obj;
+		return "alg" in objWithAlg && Object.values(AlgorithmTypes).includes(objWithAlg.alg) && (!("typ" in objWithAlg) || objWithAlg.typ === "JWT");
+	}
+	return false;
 }
-var sign = async (payload, privateKey, alg = "HS256") => {
-  const encodedPayload = encodeJwtPart(payload);
-  let encodedHeader;
-  if (typeof privateKey === "object" && "alg" in privateKey) {
-    alg = privateKey.alg;
-    encodedHeader = encodeJwtPart({ alg, typ: "JWT", kid: privateKey.kid });
-  } else {
-    encodedHeader = encodeJwtPart({ alg, typ: "JWT" });
-  }
-  const partialToken = `${encodedHeader}.${encodedPayload}`;
-  const signaturePart = await signing(privateKey, alg, utf8Encoder.encode(partialToken));
-  const signature = encodeSignaturePart(signaturePart);
-  return `${partialToken}.${signature}`;
+const sign = async (payload, privateKey, alg = "HS256") => {
+	const encodedPayload = encodeJwtPart(payload);
+	let encodedHeader;
+	if (typeof privateKey === "object" && "alg" in privateKey) {
+		alg = privateKey.alg;
+		encodedHeader = encodeJwtPart({
+			alg,
+			typ: "JWT",
+			kid: privateKey.kid
+		});
+	} else encodedHeader = encodeJwtPart({
+		alg,
+		typ: "JWT"
+	});
+	const partialToken = `${encodedHeader}.${encodedPayload}`;
+	const signaturePart = await signing(privateKey, alg, utf8Encoder.encode(partialToken));
+	return `${partialToken}.${encodeSignaturePart(signaturePart)}`;
 };
-var verify = async (token, publicKey, algOrOptions) => {
-  if (!algOrOptions) {
-    throw new JwtAlgorithmRequired();
-  }
-  const {
-    alg,
-    iss,
-    nbf = true,
-    exp = true,
-    iat = true,
-    aud
-  } = typeof algOrOptions === "string" ? { alg: algOrOptions } : algOrOptions;
-  if (!alg) {
-    throw new JwtAlgorithmRequired();
-  }
-  const tokenParts = token.split(".");
-  if (tokenParts.length !== 3) {
-    throw new JwtTokenInvalid(token);
-  }
-  const { header, payload } = decode(token);
-  if (!isTokenHeader(header)) {
-    throw new JwtHeaderInvalid(header);
-  }
-  if (header.alg !== alg) {
-    throw new JwtAlgorithmMismatch(alg, header.alg);
-  }
-  const now = Math.floor(Date.now() / 1e3);
-  if (nbf && payload.nbf !== void 0) {
-    if (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > now) {
-      throw new JwtTokenNotBefore(token);
-    }
-  }
-  if (exp && payload.exp !== void 0) {
-    if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= now) {
-      throw new JwtTokenExpired(token);
-    }
-  }
-  if (iat && payload.iat !== void 0) {
-    if (typeof payload.iat !== "number" || !Number.isFinite(payload.iat) || now < payload.iat) {
-      throw new JwtTokenIssuedAt(now, payload.iat);
-    }
-  }
-  if (iss) {
-    if (!payload.iss) {
-      throw new JwtTokenIssuer(iss, null);
-    }
-    if (typeof iss === "string" && payload.iss !== iss) {
-      throw new JwtTokenIssuer(iss, payload.iss);
-    }
-    if (iss instanceof RegExp && !iss.test(payload.iss)) {
-      throw new JwtTokenIssuer(iss, payload.iss);
-    }
-  }
-  if (aud) {
-    if (!payload.aud) {
-      throw new JwtPayloadRequiresAud(payload);
-    }
-    const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
-    const matched = audiences.some(
-      (payloadAud) => aud instanceof RegExp ? aud.test(payloadAud) : typeof aud === "string" ? payloadAud === aud : Array.isArray(aud) && aud.includes(payloadAud)
-    );
-    if (!matched) {
-      throw new JwtTokenAudience(aud, payload.aud);
-    }
-  }
-  const headerPayload = token.substring(0, token.lastIndexOf("."));
-  const verified = await verifying(
-    publicKey,
-    alg,
-    decodeBase64Url(tokenParts[2]),
-    utf8Encoder.encode(headerPayload)
-  );
-  if (!verified) {
-    throw new JwtTokenSignatureMismatched(token);
-  }
-  return payload;
+const verify = async (token, publicKey, algOrOptions) => {
+	if (!algOrOptions) throw new JwtAlgorithmRequired();
+	const { alg, iss, nbf = true, exp = true, iat = true, aud } = typeof algOrOptions === "string" ? { alg: algOrOptions } : algOrOptions;
+	if (!alg) throw new JwtAlgorithmRequired();
+	const tokenParts = token.split(".");
+	if (tokenParts.length !== 3) throw new JwtTokenInvalid(token);
+	const { header, payload } = decode(token);
+	if (!isTokenHeader(header)) throw new JwtHeaderInvalid(header);
+	if (header.alg !== alg) throw new JwtAlgorithmMismatch(alg, header.alg);
+	const now = Math.floor(Date.now() / 1e3);
+	if (nbf && payload.nbf !== void 0) {
+		if (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > now) throw new JwtTokenNotBefore(token);
+	}
+	if (exp && payload.exp !== void 0) {
+		if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= now) throw new JwtTokenExpired(token);
+	}
+	if (iat && payload.iat !== void 0) {
+		if (typeof payload.iat !== "number" || !Number.isFinite(payload.iat) || now < payload.iat) throw new JwtTokenIssuedAt(now, payload.iat);
+	}
+	if (iss) {
+		if (!payload.iss) throw new JwtTokenIssuer(iss, null);
+		if (typeof iss === "string" && payload.iss !== iss) throw new JwtTokenIssuer(iss, payload.iss);
+		if (iss instanceof RegExp && !iss.test(payload.iss)) throw new JwtTokenIssuer(iss, payload.iss);
+	}
+	if (aud) {
+		if (!payload.aud) throw new JwtPayloadRequiresAud(payload);
+		if (!(Array.isArray(payload.aud) ? payload.aud : [payload.aud]).some((payloadAud) => aud instanceof RegExp ? aud.test(payloadAud) : typeof aud === "string" ? payloadAud === aud : Array.isArray(aud) && aud.includes(payloadAud))) throw new JwtTokenAudience(aud, payload.aud);
+	}
+	const headerPayload = token.substring(0, token.lastIndexOf("."));
+	let signature;
+	try {
+		signature = decodeBase64Url(tokenParts[2]);
+	} catch {
+		throw new JwtTokenInvalid(token);
+	}
+	if (!await verifying(publicKey, alg, signature, utf8Encoder.encode(headerPayload))) throw new JwtTokenSignatureMismatched(token);
+	return payload;
 };
-var symmetricAlgorithms = [
-  AlgorithmTypes.HS256,
-  AlgorithmTypes.HS384,
-  AlgorithmTypes.HS512
+const symmetricAlgorithms = [
+	"HS256",
+	"HS384",
+	"HS512"
 ];
-var verifyWithJwks = async (token, options, init) => {
-  const verifyOpts = options.verification || {};
-  const header = decodeHeader(token);
-  if (!isTokenHeader(header)) {
-    throw new JwtHeaderInvalid(header);
-  }
-  if (!header.kid) {
-    throw new JwtHeaderRequiresKid(header);
-  }
-  if (symmetricAlgorithms.includes(header.alg)) {
-    throw new JwtSymmetricAlgorithmNotAllowed(header.alg);
-  }
-  if (!options.allowedAlgorithms.includes(header.alg)) {
-    throw new JwtAlgorithmNotAllowed(header.alg, options.allowedAlgorithms);
-  }
-  let verifyKeys = options.keys ? [...options.keys] : void 0;
-  if (options.jwks_uri) {
-    const response = await fetch(options.jwks_uri, init);
-    if (!response.ok) {
-      throw new Error(`failed to fetch JWKS from ${options.jwks_uri}`);
-    }
-    const data = await response.json();
-    if (!data.keys) {
-      throw new Error('invalid JWKS response. "keys" field is missing');
-    }
-    if (!Array.isArray(data.keys)) {
-      throw new Error('invalid JWKS response. "keys" field is not an array');
-    }
-    verifyKeys ??= [];
-    verifyKeys.push(...data.keys);
-  } else if (!verifyKeys) {
-    throw new Error('verifyWithJwks requires options for either "keys" or "jwks_uri" or both');
-  }
-  const matchingKey = verifyKeys.find((key) => key.kid === header.kid);
-  if (!matchingKey) {
-    throw new JwtTokenInvalid(token);
-  }
-  if (matchingKey.alg && matchingKey.alg !== header.alg) {
-    throw new JwtAlgorithmMismatch(matchingKey.alg, header.alg);
-  }
-  return await verify(token, matchingKey, {
-    alg: header.alg,
-    ...verifyOpts
-  });
-};
-var decode = (token) => {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    throw new JwtTokenInvalid(token);
-  }
-  try {
-    const header = decodeJwtPart(parts[0]);
-    const payload = decodeJwtPart(parts[1]);
-    return {
-      header,
-      payload
-    };
-  } catch {
-    throw new JwtTokenInvalid(token);
-  }
+const verifyWithJwks = async (token, options, init) => {
+	const verifyOpts = options.verification || {};
+	const header = decodeHeader(token);
+	if (!isTokenHeader(header)) throw new JwtHeaderInvalid(header);
+	if (!header.kid) throw new JwtHeaderRequiresKid(header);
+	if (symmetricAlgorithms.includes(header.alg)) throw new JwtSymmetricAlgorithmNotAllowed(header.alg);
+	if (!options.allowedAlgorithms.includes(header.alg)) throw new JwtAlgorithmNotAllowed(header.alg, options.allowedAlgorithms);
+	let verifyKeys = options.keys ? [...options.keys] : void 0;
+	if (options.jwks_uri) {
+		const response = await fetch(options.jwks_uri, init);
+		if (!response.ok) throw new Error(`failed to fetch JWKS from ${options.jwks_uri}`);
+		const data = await response.json();
+		if (!data.keys) throw new Error("invalid JWKS response. \"keys\" field is missing");
+		if (!Array.isArray(data.keys)) throw new Error("invalid JWKS response. \"keys\" field is not an array");
+		verifyKeys ??= [];
+		verifyKeys.push(...data.keys);
+	} else if (!verifyKeys) throw new Error("verifyWithJwks requires options for either \"keys\" or \"jwks_uri\" or both");
+	const matchingKey = verifyKeys.find((key) => key.kid === header.kid);
+	if (!matchingKey) throw new JwtTokenInvalid(token);
+	if (matchingKey.alg && matchingKey.alg !== header.alg) throw new JwtAlgorithmMismatch(matchingKey.alg, header.alg);
+	return await verify(token, matchingKey, {
+		alg: header.alg,
+		...verifyOpts
+	});
 };
-var decodeHeader = (token) => {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    throw new JwtTokenInvalid(token);
-  }
-  try {
-    return decodeJwtPart(parts[0]);
-  } catch {
-    throw new JwtTokenInvalid(token);
-  }
+const decode = (token) => {
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new JwtTokenInvalid(token);
+	try {
+		return {
+			header: decodeJwtPart(parts[0]),
+			payload: decodeJwtPart(parts[1])
+		};
+	} catch {
+		throw new JwtTokenInvalid(token);
+	}
 };
-export {
-  decode,
-  decodeHeader,
-  isTokenHeader,
-  sign,
-  verify,
-  verifyWithJwks
+const decodeHeader = (token) => {
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new JwtTokenInvalid(token);
+	try {
+		return decodeJwtPart(parts[0]);
+	} catch {
+		throw new JwtTokenInvalid(token);
+	}
 };
+//#endregion
+export { decode, decodeHeader, isTokenHeader, sign, verify, verifyWithJwks };