hono 4.13.9 → 4.13.11

package/dist/cjs/utils/jwt/jwt.js

@@ -1,220 +1,136 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var jwt_exports = {};
-__export(jwt_exports, {
-  decode: () => decode,
-  decodeHeader: () => decodeHeader,
-  isTokenHeader: () => isTokenHeader,
-  sign: () => sign,
-  verify: () => verify,
-  verifyWithJwks: () => verifyWithJwks
-});
-module.exports = __toCommonJS(jwt_exports);
-var import_encode = require("../../utils/encode");
-var import_jwa = require("./jwa");
-var import_jws = require("./jws");
-var import_types = require("./types");
-var import_utf8 = require("./utf8");
-const encodeJwtPart = (part) => (0, import_encode.encodeBase64Url)(import_utf8.utf8Encoder.encode(JSON.stringify(part)).buffer).replace(/=/g, "");
-const encodeSignaturePart = (buf) => (0, import_encode.encodeBase64Url)(buf).replace(/=/g, "");
-const decodeJwtPart = (part) => JSON.parse(import_utf8.utf8Decoder.decode((0, import_encode.decodeBase64Url)(part)));
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_utils_encode = require("../encode.js");
+const require_utils_jwt_jwa = require("./jwa.js");
+const require_utils_jwt_types = require("./types.js");
+const require_utils_jwt_utf8 = require("./utf8.js");
+const require_utils_jwt_jws = require("./jws.js");
+//#region src/utils/jwt/jwt.ts
+/**
+* @module
+* JSON Web Token (JWT)
+* https://datatracker.ietf.org/doc/html/rfc7519
+*/
+const encodeJwtPart = (part) => require_utils_encode.encodeBase64Url(require_utils_jwt_utf8.utf8Encoder.encode(JSON.stringify(part)).buffer).replace(/=/g, "");
+const encodeSignaturePart = (buf) => require_utils_encode.encodeBase64Url(buf).replace(/=/g, "");
+const decodeJwtPart = (part) => JSON.parse(require_utils_jwt_utf8.utf8Decoder.decode(require_utils_encode.decodeBase64Url(part)));
 function isTokenHeader(obj) {
-  if (typeof obj === "object" && obj !== null) {
-    const objWithAlg = obj;
-    return "alg" in objWithAlg && Object.values(import_jwa.AlgorithmTypes).includes(objWithAlg.alg) && (!("typ" in objWithAlg) || objWithAlg.typ === "JWT");
-  }
-  return false;
+	if (typeof obj === "object" && obj !== null) {
+		const objWithAlg = obj;
+		return "alg" in objWithAlg && Object.values(require_utils_jwt_jwa.AlgorithmTypes).includes(objWithAlg.alg) && (!("typ" in objWithAlg) || objWithAlg.typ === "JWT");
+	}
+	return false;
 }
 const sign = async (payload, privateKey, alg = "HS256") => {
-  const encodedPayload = encodeJwtPart(payload);
-  let encodedHeader;
-  if (typeof privateKey === "object" && "alg" in privateKey) {
-    alg = privateKey.alg;
-    encodedHeader = encodeJwtPart({ alg, typ: "JWT", kid: privateKey.kid });
-  } else {
-    encodedHeader = encodeJwtPart({ alg, typ: "JWT" });
-  }
-  const partialToken = `${encodedHeader}.${encodedPayload}`;
-  const signaturePart = await (0, import_jws.signing)(privateKey, alg, import_utf8.utf8Encoder.encode(partialToken));
-  const signature = encodeSignaturePart(signaturePart);
-  return `${partialToken}.${signature}`;
+	const encodedPayload = encodeJwtPart(payload);
+	let encodedHeader;
+	if (typeof privateKey === "object" && "alg" in privateKey) {
+		alg = privateKey.alg;
+		encodedHeader = encodeJwtPart({
+			alg,
+			typ: "JWT",
+			kid: privateKey.kid
+		});
+	} else encodedHeader = encodeJwtPart({
+		alg,
+		typ: "JWT"
+	});
+	const partialToken = `${encodedHeader}.${encodedPayload}`;
+	const signaturePart = await require_utils_jwt_jws.signing(privateKey, alg, require_utils_jwt_utf8.utf8Encoder.encode(partialToken));
+	return `${partialToken}.${encodeSignaturePart(signaturePart)}`;
 };
 const verify = async (token, publicKey, algOrOptions) => {
-  if (!algOrOptions) {
-    throw new import_types.JwtAlgorithmRequired();
-  }
-  const {
-    alg,
-    iss,
-    nbf = true,
-    exp = true,
-    iat = true,
-    aud
-  } = typeof algOrOptions === "string" ? { alg: algOrOptions } : algOrOptions;
-  if (!alg) {
-    throw new import_types.JwtAlgorithmRequired();
-  }
-  const tokenParts = token.split(".");
-  if (tokenParts.length !== 3) {
-    throw new import_types.JwtTokenInvalid(token);
-  }
-  const { header, payload } = decode(token);
-  if (!isTokenHeader(header)) {
-    throw new import_types.JwtHeaderInvalid(header);
-  }
-  if (header.alg !== alg) {
-    throw new import_types.JwtAlgorithmMismatch(alg, header.alg);
-  }
-  const now = Math.floor(Date.now() / 1e3);
-  if (nbf && payload.nbf !== void 0) {
-    if (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > now) {
-      throw new import_types.JwtTokenNotBefore(token);
-    }
-  }
-  if (exp && payload.exp !== void 0) {
-    if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= now) {
-      throw new import_types.JwtTokenExpired(token);
-    }
-  }
-  if (iat && payload.iat !== void 0) {
-    if (typeof payload.iat !== "number" || !Number.isFinite(payload.iat) || now < payload.iat) {
-      throw new import_types.JwtTokenIssuedAt(now, payload.iat);
-    }
-  }
-  if (iss) {
-    if (!payload.iss) {
-      throw new import_types.JwtTokenIssuer(iss, null);
-    }
-    if (typeof iss === "string" && payload.iss !== iss) {
-      throw new import_types.JwtTokenIssuer(iss, payload.iss);
-    }
-    if (iss instanceof RegExp && !iss.test(payload.iss)) {
-      throw new import_types.JwtTokenIssuer(iss, payload.iss);
-    }
-  }
-  if (aud) {
-    if (!payload.aud) {
-      throw new import_types.JwtPayloadRequiresAud(payload);
-    }
-    const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
-    const matched = audiences.some(
-      (payloadAud) => aud instanceof RegExp ? aud.test(payloadAud) : typeof aud === "string" ? payloadAud === aud : Array.isArray(aud) && aud.includes(payloadAud)
-    );
-    if (!matched) {
-      throw new import_types.JwtTokenAudience(aud, payload.aud);
-    }
-  }
-  const headerPayload = token.substring(0, token.lastIndexOf("."));
-  let signature;
-  try {
-    signature = (0, import_encode.decodeBase64Url)(tokenParts[2]);
-  } catch {
-    throw new import_types.JwtTokenInvalid(token);
-  }
-  const verified = await (0, import_jws.verifying)(publicKey, alg, signature, import_utf8.utf8Encoder.encode(headerPayload));
-  if (!verified) {
-    throw new import_types.JwtTokenSignatureMismatched(token);
-  }
-  return payload;
+	if (!algOrOptions) throw new require_utils_jwt_types.JwtAlgorithmRequired();
+	const { alg, iss, nbf = true, exp = true, iat = true, aud } = typeof algOrOptions === "string" ? { alg: algOrOptions } : algOrOptions;
+	if (!alg) throw new require_utils_jwt_types.JwtAlgorithmRequired();
+	const tokenParts = token.split(".");
+	if (tokenParts.length !== 3) throw new require_utils_jwt_types.JwtTokenInvalid(token);
+	const { header, payload } = decode(token);
+	if (!isTokenHeader(header)) throw new require_utils_jwt_types.JwtHeaderInvalid(header);
+	if (header.alg !== alg) throw new require_utils_jwt_types.JwtAlgorithmMismatch(alg, header.alg);
+	const now = Math.floor(Date.now() / 1e3);
+	if (nbf && payload.nbf !== void 0) {
+		if (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > now) throw new require_utils_jwt_types.JwtTokenNotBefore(token);
+	}
+	if (exp && payload.exp !== void 0) {
+		if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= now) throw new require_utils_jwt_types.JwtTokenExpired(token);
+	}
+	if (iat && payload.iat !== void 0) {
+		if (typeof payload.iat !== "number" || !Number.isFinite(payload.iat) || now < payload.iat) throw new require_utils_jwt_types.JwtTokenIssuedAt(now, payload.iat);
+	}
+	if (iss) {
+		if (!payload.iss) throw new require_utils_jwt_types.JwtTokenIssuer(iss, null);
+		if (typeof iss === "string" && payload.iss !== iss) throw new require_utils_jwt_types.JwtTokenIssuer(iss, payload.iss);
+		if (iss instanceof RegExp && !iss.test(payload.iss)) throw new require_utils_jwt_types.JwtTokenIssuer(iss, payload.iss);
+	}
+	if (aud) {
+		if (!payload.aud) throw new require_utils_jwt_types.JwtPayloadRequiresAud(payload);
+		if (!(Array.isArray(payload.aud) ? payload.aud : [payload.aud]).some((payloadAud) => aud instanceof RegExp ? aud.test(payloadAud) : typeof aud === "string" ? payloadAud === aud : Array.isArray(aud) && aud.includes(payloadAud))) throw new require_utils_jwt_types.JwtTokenAudience(aud, payload.aud);
+	}
+	const headerPayload = token.substring(0, token.lastIndexOf("."));
+	let signature;
+	try {
+		signature = require_utils_encode.decodeBase64Url(tokenParts[2]);
+	} catch {
+		throw new require_utils_jwt_types.JwtTokenInvalid(token);
+	}
+	if (!await require_utils_jwt_jws.verifying(publicKey, alg, signature, require_utils_jwt_utf8.utf8Encoder.encode(headerPayload))) throw new require_utils_jwt_types.JwtTokenSignatureMismatched(token);
+	return payload;
 };
 const symmetricAlgorithms = [
-  import_jwa.AlgorithmTypes.HS256,
-  import_jwa.AlgorithmTypes.HS384,
-  import_jwa.AlgorithmTypes.HS512
+	"HS256",
+	"HS384",
+	"HS512"
 ];
 const verifyWithJwks = async (token, options, init) => {
-  const verifyOpts = options.verification || {};
-  const header = decodeHeader(token);
-  if (!isTokenHeader(header)) {
-    throw new import_types.JwtHeaderInvalid(header);
-  }
-  if (!header.kid) {
-    throw new import_types.JwtHeaderRequiresKid(header);
-  }
-  if (symmetricAlgorithms.includes(header.alg)) {
-    throw new import_types.JwtSymmetricAlgorithmNotAllowed(header.alg);
-  }
-  if (!options.allowedAlgorithms.includes(header.alg)) {
-    throw new import_types.JwtAlgorithmNotAllowed(header.alg, options.allowedAlgorithms);
-  }
-  let verifyKeys = options.keys ? [...options.keys] : void 0;
-  if (options.jwks_uri) {
-    const response = await fetch(options.jwks_uri, init);
-    if (!response.ok) {
-      throw new Error(`failed to fetch JWKS from ${options.jwks_uri}`);
-    }
-    const data = await response.json();
-    if (!data.keys) {
-      throw new Error('invalid JWKS response. "keys" field is missing');
-    }
-    if (!Array.isArray(data.keys)) {
-      throw new Error('invalid JWKS response. "keys" field is not an array');
-    }
-    verifyKeys ??= [];
-    verifyKeys.push(...data.keys);
-  } else if (!verifyKeys) {
-    throw new Error('verifyWithJwks requires options for either "keys" or "jwks_uri" or both');
-  }
-  const matchingKey = verifyKeys.find((key) => key.kid === header.kid);
-  if (!matchingKey) {
-    throw new import_types.JwtTokenInvalid(token);
-  }
-  if (matchingKey.alg && matchingKey.alg !== header.alg) {
-    throw new import_types.JwtAlgorithmMismatch(matchingKey.alg, header.alg);
-  }
-  return await verify(token, matchingKey, {
-    alg: header.alg,
-    ...verifyOpts
-  });
+	const verifyOpts = options.verification || {};
+	const header = decodeHeader(token);
+	if (!isTokenHeader(header)) throw new require_utils_jwt_types.JwtHeaderInvalid(header);
+	if (!header.kid) throw new require_utils_jwt_types.JwtHeaderRequiresKid(header);
+	if (symmetricAlgorithms.includes(header.alg)) throw new require_utils_jwt_types.JwtSymmetricAlgorithmNotAllowed(header.alg);
+	if (!options.allowedAlgorithms.includes(header.alg)) throw new require_utils_jwt_types.JwtAlgorithmNotAllowed(header.alg, options.allowedAlgorithms);
+	let verifyKeys = options.keys ? [...options.keys] : void 0;
+	if (options.jwks_uri) {
+		const response = await fetch(options.jwks_uri, init);
+		if (!response.ok) throw new Error(`failed to fetch JWKS from ${options.jwks_uri}`);
+		const data = await response.json();
+		if (!data.keys) throw new Error("invalid JWKS response. \"keys\" field is missing");
+		if (!Array.isArray(data.keys)) throw new Error("invalid JWKS response. \"keys\" field is not an array");
+		verifyKeys ??= [];
+		verifyKeys.push(...data.keys);
+	} else if (!verifyKeys) throw new Error("verifyWithJwks requires options for either \"keys\" or \"jwks_uri\" or both");
+	const matchingKey = verifyKeys.find((key) => key.kid === header.kid);
+	if (!matchingKey) throw new require_utils_jwt_types.JwtTokenInvalid(token);
+	if (matchingKey.alg && matchingKey.alg !== header.alg) throw new require_utils_jwt_types.JwtAlgorithmMismatch(matchingKey.alg, header.alg);
+	return await verify(token, matchingKey, {
+		alg: header.alg,
+		...verifyOpts
+	});
 };
 const decode = (token) => {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    throw new import_types.JwtTokenInvalid(token);
-  }
-  try {
-    const header = decodeJwtPart(parts[0]);
-    const payload = decodeJwtPart(parts[1]);
-    return {
-      header,
-      payload
-    };
-  } catch {
-    throw new import_types.JwtTokenInvalid(token);
-  }
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new require_utils_jwt_types.JwtTokenInvalid(token);
+	try {
+		return {
+			header: decodeJwtPart(parts[0]),
+			payload: decodeJwtPart(parts[1])
+		};
+	} catch {
+		throw new require_utils_jwt_types.JwtTokenInvalid(token);
+	}
 };
 const decodeHeader = (token) => {
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    throw new import_types.JwtTokenInvalid(token);
-  }
-  try {
-    return decodeJwtPart(parts[0]);
-  } catch {
-    throw new import_types.JwtTokenInvalid(token);
-  }
+	const parts = token.split(".");
+	if (parts.length !== 3) throw new require_utils_jwt_types.JwtTokenInvalid(token);
+	try {
+		return decodeJwtPart(parts[0]);
+	} catch {
+		throw new require_utils_jwt_types.JwtTokenInvalid(token);
+	}
 };
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  decode,
-  decodeHeader,
-  isTokenHeader,
-  sign,
-  verify,
-  verifyWithJwks
-});
+//#endregion
+exports.decode = decode;
+exports.decodeHeader = decodeHeader;
+exports.isTokenHeader = isTokenHeader;
+exports.sign = sign;
+exports.verify = verify;
+exports.verifyWithJwks = verifyWithJwks;

package/dist/cjs/utils/jwt/types.js

@@ -1,161 +1,124 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/utils/jwt/types.ts
+/**
+* @module
+* Type definitions for JWT utilities.
+*/
+var JwtAlgorithmNotImplemented = class extends Error {
+	constructor(alg) {
+		super(`${alg} is not an implemented algorithm`);
+		this.name = "JwtAlgorithmNotImplemented";
+	}
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
+var JwtAlgorithmRequired = class extends Error {
+	constructor() {
+		super("JWT verification requires \"alg\" option to be specified");
+		this.name = "JwtAlgorithmRequired";
+	}
 };
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var types_exports = {};
-__export(types_exports, {
-  CryptoKeyUsage: () => CryptoKeyUsage,
-  JwtAlgorithmMismatch: () => JwtAlgorithmMismatch,
-  JwtAlgorithmNotAllowed: () => JwtAlgorithmNotAllowed,
-  JwtAlgorithmNotImplemented: () => JwtAlgorithmNotImplemented,
-  JwtAlgorithmRequired: () => JwtAlgorithmRequired,
-  JwtHeaderInvalid: () => JwtHeaderInvalid,
-  JwtHeaderRequiresKid: () => JwtHeaderRequiresKid,
-  JwtPayloadRequiresAud: () => JwtPayloadRequiresAud,
-  JwtSymmetricAlgorithmNotAllowed: () => JwtSymmetricAlgorithmNotAllowed,
-  JwtTokenAudience: () => JwtTokenAudience,
-  JwtTokenExpired: () => JwtTokenExpired,
-  JwtTokenInvalid: () => JwtTokenInvalid,
-  JwtTokenIssuedAt: () => JwtTokenIssuedAt,
-  JwtTokenIssuer: () => JwtTokenIssuer,
-  JwtTokenNotBefore: () => JwtTokenNotBefore,
-  JwtTokenSignatureMismatched: () => JwtTokenSignatureMismatched
-});
-module.exports = __toCommonJS(types_exports);
-class JwtAlgorithmNotImplemented extends Error {
-  constructor(alg) {
-    super(`${alg} is not an implemented algorithm`);
-    this.name = "JwtAlgorithmNotImplemented";
-  }
-}
-class JwtAlgorithmRequired extends Error {
-  constructor() {
-    super('JWT verification requires "alg" option to be specified');
-    this.name = "JwtAlgorithmRequired";
-  }
-}
-class JwtAlgorithmMismatch extends Error {
-  constructor(expected, actual) {
-    super(`JWT algorithm mismatch: expected "${expected}", got "${actual}"`);
-    this.name = "JwtAlgorithmMismatch";
-  }
-}
-class JwtTokenInvalid extends Error {
-  constructor(token) {
-    super(`invalid JWT token: ${token}`);
-    this.name = "JwtTokenInvalid";
-  }
-}
-class JwtTokenNotBefore extends Error {
-  constructor(token) {
-    super(`token (${token}) is being used before it's valid`);
-    this.name = "JwtTokenNotBefore";
-  }
-}
-class JwtTokenExpired extends Error {
-  constructor(token) {
-    super(`token (${token}) expired`);
-    this.name = "JwtTokenExpired";
-  }
-}
-class JwtTokenIssuedAt extends Error {
-  constructor(currentTimestamp, iat) {
-    super(
-      `Invalid "iat" claim, must be a valid number lower than "${currentTimestamp}" (iat: "${iat}")`
-    );
-    this.name = "JwtTokenIssuedAt";
-  }
-}
-class JwtTokenIssuer extends Error {
-  constructor(expected, iss) {
-    super(`expected issuer "${expected}", got ${iss ? `"${iss}"` : "none"} `);
-    this.name = "JwtTokenIssuer";
-  }
-}
-class JwtHeaderInvalid extends Error {
-  constructor(header) {
-    super(`jwt header is invalid: ${JSON.stringify(header)}`);
-    this.name = "JwtHeaderInvalid";
-  }
-}
-class JwtHeaderRequiresKid extends Error {
-  constructor(header) {
-    super(`required "kid" in jwt header: ${JSON.stringify(header)}`);
-    this.name = "JwtHeaderRequiresKid";
-  }
-}
-class JwtSymmetricAlgorithmNotAllowed extends Error {
-  constructor(alg) {
-    super(`symmetric algorithm "${alg}" is not allowed for JWK verification`);
-    this.name = "JwtSymmetricAlgorithmNotAllowed";
-  }
-}
-class JwtAlgorithmNotAllowed extends Error {
-  constructor(alg, allowedAlgorithms) {
-    super(`algorithm "${alg}" is not in the allowed list: [${allowedAlgorithms.join(", ")}]`);
-    this.name = "JwtAlgorithmNotAllowed";
-  }
-}
-class JwtTokenSignatureMismatched extends Error {
-  constructor(token) {
-    super(`token(${token}) signature mismatched`);
-    this.name = "JwtTokenSignatureMismatched";
-  }
-}
-class JwtPayloadRequiresAud extends Error {
-  constructor(payload) {
-    super(`required "aud" in jwt payload: ${JSON.stringify(payload)}`);
-    this.name = "JwtPayloadRequiresAud";
-  }
-}
-class JwtTokenAudience extends Error {
-  constructor(expected, aud) {
-    super(
-      `expected audience "${Array.isArray(expected) ? expected.join(", ") : expected}", got "${aud}"`
-    );
-    this.name = "JwtTokenAudience";
-  }
-}
-var CryptoKeyUsage = /* @__PURE__ */ ((CryptoKeyUsage2) => {
-  CryptoKeyUsage2["Encrypt"] = "encrypt";
-  CryptoKeyUsage2["Decrypt"] = "decrypt";
-  CryptoKeyUsage2["Sign"] = "sign";
-  CryptoKeyUsage2["Verify"] = "verify";
-  CryptoKeyUsage2["DeriveKey"] = "deriveKey";
-  CryptoKeyUsage2["DeriveBits"] = "deriveBits";
-  CryptoKeyUsage2["WrapKey"] = "wrapKey";
-  CryptoKeyUsage2["UnwrapKey"] = "unwrapKey";
-  return CryptoKeyUsage2;
-})(CryptoKeyUsage || {});
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  CryptoKeyUsage,
-  JwtAlgorithmMismatch,
-  JwtAlgorithmNotAllowed,
-  JwtAlgorithmNotImplemented,
-  JwtAlgorithmRequired,
-  JwtHeaderInvalid,
-  JwtHeaderRequiresKid,
-  JwtPayloadRequiresAud,
-  JwtSymmetricAlgorithmNotAllowed,
-  JwtTokenAudience,
-  JwtTokenExpired,
-  JwtTokenInvalid,
-  JwtTokenIssuedAt,
-  JwtTokenIssuer,
-  JwtTokenNotBefore,
-  JwtTokenSignatureMismatched
-});
+var JwtAlgorithmMismatch = class extends Error {
+	constructor(expected, actual) {
+		super(`JWT algorithm mismatch: expected "${expected}", got "${actual}"`);
+		this.name = "JwtAlgorithmMismatch";
+	}
+};
+var JwtTokenInvalid = class extends Error {
+	constructor(token) {
+		super(`invalid JWT token: ${token}`);
+		this.name = "JwtTokenInvalid";
+	}
+};
+var JwtTokenNotBefore = class extends Error {
+	constructor(token) {
+		super(`token (${token}) is being used before it's valid`);
+		this.name = "JwtTokenNotBefore";
+	}
+};
+var JwtTokenExpired = class extends Error {
+	constructor(token) {
+		super(`token (${token}) expired`);
+		this.name = "JwtTokenExpired";
+	}
+};
+var JwtTokenIssuedAt = class extends Error {
+	constructor(currentTimestamp, iat) {
+		super(`Invalid "iat" claim, must be a valid number lower than "${currentTimestamp}" (iat: "${iat}")`);
+		this.name = "JwtTokenIssuedAt";
+	}
+};
+var JwtTokenIssuer = class extends Error {
+	constructor(expected, iss) {
+		super(`expected issuer "${expected}", got ${iss ? `"${iss}"` : "none"} `);
+		this.name = "JwtTokenIssuer";
+	}
+};
+var JwtHeaderInvalid = class extends Error {
+	constructor(header) {
+		super(`jwt header is invalid: ${JSON.stringify(header)}`);
+		this.name = "JwtHeaderInvalid";
+	}
+};
+var JwtHeaderRequiresKid = class extends Error {
+	constructor(header) {
+		super(`required "kid" in jwt header: ${JSON.stringify(header)}`);
+		this.name = "JwtHeaderRequiresKid";
+	}
+};
+var JwtSymmetricAlgorithmNotAllowed = class extends Error {
+	constructor(alg) {
+		super(`symmetric algorithm "${alg}" is not allowed for JWK verification`);
+		this.name = "JwtSymmetricAlgorithmNotAllowed";
+	}
+};
+var JwtAlgorithmNotAllowed = class extends Error {
+	constructor(alg, allowedAlgorithms) {
+		super(`algorithm "${alg}" is not in the allowed list: [${allowedAlgorithms.join(", ")}]`);
+		this.name = "JwtAlgorithmNotAllowed";
+	}
+};
+var JwtTokenSignatureMismatched = class extends Error {
+	constructor(token) {
+		super(`token(${token}) signature mismatched`);
+		this.name = "JwtTokenSignatureMismatched";
+	}
+};
+var JwtPayloadRequiresAud = class extends Error {
+	constructor(payload) {
+		super(`required "aud" in jwt payload: ${JSON.stringify(payload)}`);
+		this.name = "JwtPayloadRequiresAud";
+	}
+};
+var JwtTokenAudience = class extends Error {
+	constructor(expected, aud) {
+		super(`expected audience "${Array.isArray(expected) ? expected.join(", ") : expected}", got "${aud}"`);
+		this.name = "JwtTokenAudience";
+	}
+};
+let CryptoKeyUsage = /* @__PURE__ */ function(CryptoKeyUsage) {
+	CryptoKeyUsage["Encrypt"] = "encrypt";
+	CryptoKeyUsage["Decrypt"] = "decrypt";
+	CryptoKeyUsage["Sign"] = "sign";
+	CryptoKeyUsage["Verify"] = "verify";
+	CryptoKeyUsage["DeriveKey"] = "deriveKey";
+	CryptoKeyUsage["DeriveBits"] = "deriveBits";
+	CryptoKeyUsage["WrapKey"] = "wrapKey";
+	CryptoKeyUsage["UnwrapKey"] = "unwrapKey";
+	return CryptoKeyUsage;
+}({});
+//#endregion
+exports.CryptoKeyUsage = CryptoKeyUsage;
+exports.JwtAlgorithmMismatch = JwtAlgorithmMismatch;
+exports.JwtAlgorithmNotAllowed = JwtAlgorithmNotAllowed;
+exports.JwtAlgorithmNotImplemented = JwtAlgorithmNotImplemented;
+exports.JwtAlgorithmRequired = JwtAlgorithmRequired;
+exports.JwtHeaderInvalid = JwtHeaderInvalid;
+exports.JwtHeaderRequiresKid = JwtHeaderRequiresKid;
+exports.JwtPayloadRequiresAud = JwtPayloadRequiresAud;
+exports.JwtSymmetricAlgorithmNotAllowed = JwtSymmetricAlgorithmNotAllowed;
+exports.JwtTokenAudience = JwtTokenAudience;
+exports.JwtTokenExpired = JwtTokenExpired;
+exports.JwtTokenInvalid = JwtTokenInvalid;
+exports.JwtTokenIssuedAt = JwtTokenIssuedAt;
+exports.JwtTokenIssuer = JwtTokenIssuer;
+exports.JwtTokenNotBefore = JwtTokenNotBefore;
+exports.JwtTokenSignatureMismatched = JwtTokenSignatureMismatched;