unjwt 0.8.3 → 0.8.5

package/dist/_chunks/libs/unsecure.mjs

@@ -11,294 +11,28 @@ const textEncoder = /* @__PURE__ */ new TextEncoder();
 function describeValue(value) {
 	if (value === null) return "null";
 	if (typeof value !== "object") return typeof value;
-	return value.constructor?.name ?? "object";
+	const name = value.constructor?.name;
+	return typeof name === "string" && /^[A-Za-z_$][\w$]{0,63}$/.test(name) ? name : "object";
 }
 /* @__NO_SIDE_EFFECTS__ */
-function toBytes(value, label) {
-	if (typeof value === "string") return textEncoder.encode(value);
-	if (ArrayBuffer.isView(value)) return value instanceof Uint8Array ? value : new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
-	if (value instanceof ArrayBuffer || typeof SharedArrayBuffer !== "undefined" && value instanceof SharedArrayBuffer) return new Uint8Array(value);
-	throw new UnsecureError("INVALID_TYPE", `${label}: expected a string, ArrayBuffer or ArrayBuffer view, got ${/* @__PURE__ */ describeValue(value)}.`);
-}
-const textDecoder = /* @__PURE__ */ new TextDecoder("utf-8", { ignoreBOM: true });
-const _fatalDecoder = /* @__PURE__ */ new TextDecoder("utf-8", {
-	ignoreBOM: true,
-	fatal: true
-});
-/* @__NO_SIDE_EFFECTS__ */
-function _wholeBuffer(bytes) {
-	return bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength ? bytes : bytes.slice();
-}
-const _LATIN1_CHUNK = 32768;
-/* @__NO_SIDE_EFFECTS__ */
-function _latin1(bytes) {
-	if (bytes.length <= _LATIN1_CHUNK) return String.fromCharCode(...bytes);
-	let text = "";
-	for (let i = 0; i < bytes.length; i += _LATIN1_CHUNK) text += String.fromCharCode(...bytes.subarray(i, i + _LATIN1_CHUNK));
-	return text;
-}
-function _assertData(input, label) {
-	if (typeof input !== "string" && !/* @__PURE__ */ _isBytes(input)) throw new UnsecureError("INVALID_TYPE", `${label}: expected a string or Uint8Array, got ${/* @__PURE__ */ describeValue(input)}.`);
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _isBytes(input) {
-	return ArrayBuffer.isView(input) && input instanceof Uint8Array;
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _parsePrep(input, options) {
-	const isBytes = /* @__PURE__ */ _isBytes(input);
-	const returnAs = options?.returnAs ?? (isBytes ? "uint8array" : "string");
-	return {
-		text: isBytes ? /* @__PURE__ */ _latin1(input) : input,
-		wantString: returnAs === "string"
-	};
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _parseFinalize(bytes, wantString, strict, label) {
-	if (!wantString) return bytes;
-	if (!strict) return textDecoder.decode(bytes);
-	try {
-		return _fatalDecoder.decode(bytes);
-	} catch {
-		throw /* @__PURE__ */ _malformed(label, "decoded bytes are not valid UTF-8.");
-	}
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _malformed(label, detail) {
-	return new UnsecureError("MALFORMED", `${label}: ${detail}`);
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _tailBits(rem, bits) {
-	if (rem === 0) return 0;
-	const leftover = rem * bits % 8;
-	return leftover >= bits ? -1 : leftover;
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _strictBody(text, table, shape, label, padding) {
-	let end = text.length;
-	while (end > 0 && text.charCodeAt(end - 1) === 61) end--;
-	const padFound = text.length - end;
-	for (let i = 0; i < end; i++) {
-		const c = text.charCodeAt(i);
-		if ((c < 128 ? table[c] : -1) < 0) throw /* @__PURE__ */ _malformed(label, `invalid ${shape.name} character ${JSON.stringify(text[i])} at index ${i}.`);
-	}
-	const rem = end % shape.group;
-	const tail = /* @__PURE__ */ _tailBits(rem, shape.bits);
-	if (tail < 0) throw /* @__PURE__ */ _malformed(label, `${end} ${shape.name} symbols cannot encode whole bytes.`);
-	const padNeeded = rem === 0 ? 0 : shape.group - rem;
-	if (padFound > 0) {
-		if (padNeeded === 0 || padding === false) throw /* @__PURE__ */ _malformed(label, `unexpected "=" padding.`);
-		if (padFound !== padNeeded) throw /* @__PURE__ */ _malformed(label, `expected ${padNeeded} "=" padding characters, found ${padFound}.`);
-	} else if (padding === true && padNeeded > 0) throw /* @__PURE__ */ _malformed(label, `expected ${padNeeded} "=" padding characters, found 0.`);
-	if (tail > 0 && (table[text.charCodeAt(end - 1)] & (1 << tail) - 1) !== 0) throw /* @__PURE__ */ _malformed(label, `the last ${shape.name} symbol sets bits past the final byte.`);
-	return end === text.length ? text : text.slice(0, end);
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _symbols(text, table) {
-	const values = new Uint8Array(text.length);
-	let n = 0;
-	for (let i = 0; i < text.length; i++) {
-		const c = text.charCodeAt(i);
-		const v = c < 128 ? table[c] : -1;
-		if (v >= 0) values[n++] = v;
-	}
-	return n === values.length ? values : values.subarray(0, n);
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _looseCount(n, shape) {
-	let count = n;
-	while (count > 0 && /* @__PURE__ */ _tailBits(count % shape.group, shape.bits) < 0) count--;
-	return count;
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _decodeSymbols(values, count, bits) {
-	const out = new Uint8Array(count * bits >>> 3);
-	let acc = 0;
-	let held = 0;
-	let j = 0;
-	for (let i = 0; i < count; i++) {
-		acc = acc << bits | values[i];
-		held += bits;
-		if (held >= 8) {
-			held -= 8;
-			out[j++] = acc >>> held & 255;
-		}
-	}
-	return out;
-}
-const _ON_HEAP_MAX = 64;
-const _Buffer = /* @__PURE__ */ (() => {
-	try {
-		return globalThis.Buffer;
-	} catch {
-		return;
-	}
-})();
-const _hasBuffer = /* @__PURE__ */ (() => typeof _Buffer?.from === "function")();
-/* @__NO_SIDE_EFFECTS__ */
-function _toBuffer(bytes) {
-	return bytes.byteLength <= _ON_HEAP_MAX ? _Buffer.from(bytes) : _Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-}
-const _nativeToBase64 = /* @__PURE__ */ (() => typeof Uint8Array.prototype.toBase64 === "function")();
-const _nativeFromBase64 = /* @__PURE__ */ (() => typeof Uint8Array.fromBase64 === "function")();
-const _B64_SHAPE = {
-	bits: 6,
-	group: 4,
-	name: "base64"
-};
-const _B64_DIGITS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-/* @__NO_SIDE_EFFECTS__ */
-function _b64Table(pairs) {
-	const t = (/* @__PURE__ */ new Int16Array(128)).fill(-1);
-	for (let i = 0; i < 62; i++) t[_B64_DIGITS.charCodeAt(i)] = i;
-	for (let i = 0; i < pairs.length; i += 2) {
-		t[pairs.charCodeAt(i)] = 62;
-		t[pairs.charCodeAt(i + 1)] = 63;
-	}
-	return t;
-}
-const _B64_TABLE_STD = /* @__PURE__ */ _b64Table("+/");
-const _B64_TABLE_URL = /* @__PURE__ */ _b64Table("-_");
-/* @__NO_SIDE_EFFECTS__ */
-function _unpad(s) {
-	let end = s.length;
-	while (end > 0 && s.charCodeAt(end - 1) === 61) end--;
-	return end === s.length ? s : s.slice(0, end);
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _padTo4(s) {
-	const rem = s.length % 4;
-	return rem === 0 ? s : s + "=".repeat(4 - rem);
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _encodeBase64(bytes, alphabet, padding) {
-	const url = alphabet === "base64url";
-	if (_hasBuffer) {
-		const s = (/* @__PURE__ */ _toBuffer(bytes)).toString(url ? "base64url" : "base64");
-		if (url) return padding ? /* @__PURE__ */ _padTo4(s) : s;
-		return padding ? s : /* @__PURE__ */ _unpad(s);
-	}
-	if (_nativeToBase64) return (/* @__PURE__ */ _wholeBuffer(bytes)).toBase64({
-		alphabet,
-		omitPadding: !padding
-	});
-	let binary = "";
-	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
-	let s = btoa(binary);
-	if (url) s = s.replace(/\+/g, "-").replace(/\//g, "_");
-	return padding ? s : /* @__PURE__ */ _unpad(s);
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _decodeCanonical(padded, symbols) {
-	if (_hasBuffer) return new Uint8Array(_Buffer.from(padded, "base64"));
-	if (_nativeFromBase64) return Uint8Array.fromBase64(padded);
-	return /* @__PURE__ */ _decodeSymbols(/* @__PURE__ */ _symbols(padded, _B64_TABLE_STD), symbols, 6);
-}
-/* @__NO_SIDE_EFFECTS__ */
-function _decodeBase64(text, alphabet, loose, label, padding) {
-	const url = alphabet === "base64url";
-	let body;
-	if (loose) {
-		const clean = text.replace(/-/g, "+").replace(/_/g, "/").replace(/[^A-Za-z0-9+/]/g, "");
-		body = clean.slice(0, /* @__PURE__ */ _looseCount(clean.length, _B64_SHAPE));
-	} else {
-		const strict = /* @__PURE__ */ _strictBody(text, url ? _B64_TABLE_URL : _B64_TABLE_STD, _B64_SHAPE, label, padding);
-		body = url ? strict.replace(/-/g, "+").replace(/_/g, "/") : strict;
-	}
-	const rem = body.length % 4;
-	return /* @__PURE__ */ _decodeCanonical(rem === 0 ? body : body + (rem === 2 ? "==" : "="), body.length);
-}
-/* @__NO_SIDE_EFFECTS__ */
-function base64Stringify(data, options) {
-	const alphabet = options?.alphabet ?? "base64";
-	const padding = options?.padding ?? alphabet !== "base64url";
-	return /* @__PURE__ */ _encodeBase64(/* @__PURE__ */ toBytes(data, "Base64.stringify"), alphabet, padding);
-}
-/* @__NO_SIDE_EFFECTS__ */
-function base64Parse(input, options) {
-	_assertData(input, "Base64.parse");
-	const { text, wantString } = /* @__PURE__ */ _parsePrep(input, options);
-	if (!text) return wantString ? "" : /* @__PURE__ */ new Uint8Array(0);
-	const alphabet = options?.alphabet ?? "base64";
-	const loose = options?.loose ?? false;
-	return /* @__PURE__ */ _parseFinalize(/* @__PURE__ */ _decodeBase64(text, alphabet, loose, "Base64.parse", options?.padding), wantString, !loose, "Base64.parse");
+function ownOptions(options) {
+	return options === void 0 || options === null ? NO_OPTIONS : Object.assign(Object.create(null), options);
 }
+const NO_OPTIONS = /* @__PURE__ */ Object.freeze(Object.create(null));
 /* @__NO_SIDE_EFFECTS__ */
 function showValue(value) {
 	if (typeof value === "number" || typeof value === "boolean") return String(value);
 	if (typeof value === "string") return JSON.stringify(value);
 	return /* @__PURE__ */ describeValue(value);
 }
-function assertInteger(source, name, value, min, max = Number.MAX_SAFE_INTEGER) {
+function assertInteger(value, name, source, min, max = Number.MAX_SAFE_INTEGER) {
 	if (Number.isSafeInteger(value) && value >= min && value <= max) return;
 	throw new UnsecureError("OUT_OF_RANGE", `${source}: ${name} must be ${max === Number.MAX_SAFE_INTEGER ? `an integer >= ${min}` : `an integer between ${min} and ${max}`}, got ${/* @__PURE__ */ showValue(value)}.`);
 }
-const SHARED_POOL_BYTES = 4096;
-const _MAX_FILL = 65536;
-/* @__NO_SIDE_EFFECTS__ */
-function createEntropyPool(size) {
-	let bytes;
-	let words;
-	let offset = size;
-	function refill() {
-		if (bytes === void 0) {
-			const buffer = new ArrayBuffer(size);
-			bytes = new Uint8Array(buffer);
-			words = new Uint32Array(buffer);
-		}
-		crypto.getRandomValues(bytes);
-		offset = 0;
-	}
-	function nextUint32() {
-		offset = offset + 3 & -4;
-		if (offset >= size) refill();
-		const value = words[offset >>> 2];
-		offset += 4;
-		return value;
-	}
-	function fill(target) {
-		const length = target.length;
-		if (length === 0) return target;
-		if (length > 64) {
-			if (length <= _MAX_FILL) crypto.getRandomValues(target);
-			else for (let start = 0; start < length; start += _MAX_FILL) crypto.getRandomValues(target.subarray(start, Math.min(start + _MAX_FILL, length)));
-			return target;
-		}
-		if (offset + length > size) refill();
-		const slot = bytes.subarray(offset, offset + length);
-		target.set(slot);
-		slot.fill(0);
-		offset += length;
-		return target;
-	}
-	function reset(now = false) {
-		bytes?.fill(0);
-		bytes = words = void 0;
-		offset = size;
-		if (now) refill();
-	}
-	_onSnapshotRestore(reset);
-	return {
-		nextUint32,
-		fill,
-		reset
-	};
-}
-const sharedPool = /* @__PURE__ */ createEntropyPool(SHARED_POOL_BYTES);
-function _onSnapshotRestore(callback) {
-	try {
-		const proc = globalThis.process;
-		if (typeof proc?.getBuiltinModule !== "function") return;
-		const snapshot = proc.getBuiltinModule("node:v8")?.startupSnapshot;
-		if (snapshot?.isBuildingSnapshot()) snapshot.addDeserializeCallback(callback);
-	} catch {}
-}
-const MAX_RANDOM_BYTES = 2 ** 31 - 1;
-/* @__NO_SIDE_EFFECTS__ */
-function secureRandomBytes(length) {
-	assertInteger("secureRandomBytes", "length", length, 0, MAX_RANDOM_BYTES);
-	return sharedPool.fill(new Uint8Array(length));
-}
+const textDecoder = /* @__PURE__ */ new TextDecoder("utf-8", /* @__PURE__ */ ownOptions({
+	ignoreBOM: true,
+	fatal: false
+}));
 /* @__NO_SIDE_EFFECTS__ */
 function safeJsonParse(json) {
 	let parsed;
@@ -317,9 +51,14 @@ function sanitizeObject(obj) {
 	return obj;
 }
 /* @__NO_SIDE_EFFECTS__ */
-function sanitizeObjectCopy(obj) {
-	if (!/* @__PURE__ */ _isCopyable(obj)) return obj;
-	return _sanitizeCopy(obj, /* @__PURE__ */ new WeakMap());
+function sanitizeObjectCopy(obj, options) {
+	const trusted = /* @__PURE__ */ _allowlist((/* @__PURE__ */ ownOptions(options)).allowlist);
+	if (obj === null || typeof obj !== "object") return obj;
+	if (!/* @__PURE__ */ _isCopyable(obj)) {
+		if (/* @__PURE__ */ _isTrusted(obj, trusted)) return obj;
+		throw /* @__PURE__ */ _notCopyable(obj);
+	}
+	return _sanitizeCopy(obj, trusted, /* @__PURE__ */ new WeakMap());
 }
 /* @__NO_SIDE_EFFECTS__ */
 function _isDangerousKey(key) {
@@ -329,20 +68,7 @@ function _sanitizeInPlace(root, seen) {
 	seen.add(root);
 	const stack = [root];
 	while (stack.length > 0) {
-		const current = stack.pop();
-		if (Array.isArray(current)) {
-			for (let i = 0; i < current.length; i++) {
-				const descriptor = Object.getOwnPropertyDescriptor(current, i);
-				if (descriptor === void 0 || !("value" in descriptor)) continue;
-				const v = descriptor.value;
-				if (v !== null && typeof v === "object" && !seen.has(v)) {
-					seen.add(v);
-					stack.push(v);
-				}
-			}
-			continue;
-		}
-		const record = current;
+		const record = stack.pop();
 		const keys = Object.getOwnPropertyNames(record);
 		for (let i = 0; i < keys.length; i++) {
 			const key = keys[i];
@@ -360,16 +86,45 @@ function _sanitizeInPlace(root, seen) {
 		}
 	}
 }
+const _OBJECT_SOURCE = /* @__PURE__ */ Function.prototype.toString.call(Object);
 /* @__NO_SIDE_EFFECTS__ */
 function _isPlainObject(value) {
 	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
+	if (proto === null || proto === Object.prototype) return true;
+	if (Object.getPrototypeOf(proto) !== null) return false;
+	const ctor = Object.getOwnPropertyDescriptor(proto, "constructor");
+	return ctor !== void 0 && "value" in ctor && typeof ctor.value === "function" && Function.prototype.toString.call(ctor.value) === _OBJECT_SOURCE;
 }
 /* @__NO_SIDE_EFFECTS__ */
 function _isCopyable(value) {
 	return value !== null && typeof value === "object" && (Array.isArray(value) || /* @__PURE__ */ _isPlainObject(value));
 }
-function _sanitizeCopy(root, seen) {
+/* @__NO_SIDE_EFFECTS__ */
+function _allowlist(value) {
+	if (value === void 0) return [];
+	if (typeof value === "string" || typeof value[Symbol.iterator] !== "function") throw new UnsecureError("INVALID_TYPE", `sanitizeObjectCopy: allowlist must be an iterable of constructors, got ${/* @__PURE__ */ describeValue(value)}.`);
+	const list = [];
+	for (const entry of value) {
+		if (typeof entry !== "function") throw new UnsecureError("INVALID_TYPE", `sanitizeObjectCopy: allowlist entries must be constructors, got ${/* @__PURE__ */ describeValue(entry)}.`);
+		list.push(entry);
+	}
+	return list;
+}
+/* @__NO_SIDE_EFFECTS__ */
+function _isTrusted(value, trusted) {
+	for (let i = 0; i < trusted.length; i++) if (value instanceof trusted[i]) return true;
+	return false;
+}
+/* @__NO_SIDE_EFFECTS__ */
+function _notCopyable(value) {
+	return new UnsecureError("INVALID_TYPE", `sanitizeObjectCopy: cannot copy an instance of ${/* @__PURE__ */ describeValue(value)}; add it to allowlist, or use sanitizeObject().`);
+}
+/* @__NO_SIDE_EFFECTS__ */
+function _isIndex(key) {
+	const n = Number(key);
+	return n >>> 0 === n && n !== 4294967295 && String(n) === key;
+}
+function _sanitizeCopy(root, trusted, seen) {
 	const rootTarget = Array.isArray(root) ? [] : {};
 	seen.set(root, rootTarget);
 	const stack = [{
@@ -381,10 +136,13 @@ function _sanitizeCopy(root, seen) {
 		if (Array.isArray(source)) {
 			const out = target;
 			out.length = source.length;
-			for (let i = 0; i < source.length; i++) {
-				const descriptor = Object.getOwnPropertyDescriptor(source, i);
+			const names = Object.getOwnPropertyNames(source);
+			for (let i = 0; i < names.length; i++) {
+				const key = names[i];
+				if (!/* @__PURE__ */ _isIndex(key)) continue;
+				const descriptor = Object.getOwnPropertyDescriptor(source, key);
 				if (descriptor === void 0 || !("value" in descriptor)) continue;
-				out[i] = _copyValue(descriptor.value, seen, stack);
+				out[Number(key)] = _copyValue(descriptor.value, trusted, seen, stack);
 			}
 			continue;
 		}
@@ -396,13 +154,17 @@ function _sanitizeCopy(root, seen) {
 			if (/* @__PURE__ */ _isDangerousKey(key)) continue;
 			const descriptor = Object.getOwnPropertyDescriptor(record, key);
 			if (descriptor === void 0 || !("value" in descriptor)) continue;
-			out[key] = _copyValue(descriptor.value, seen, stack);
+			out[key] = _copyValue(descriptor.value, trusted, seen, stack);
 		}
 	}
 	return rootTarget;
 }
-function _copyValue(value, seen, stack) {
-	if (!/* @__PURE__ */ _isCopyable(value)) return value;
+function _copyValue(value, trusted, seen, stack) {
+	if (value === null || typeof value !== "object") return value;
+	if (!/* @__PURE__ */ _isCopyable(value)) {
+		if (/* @__PURE__ */ _isTrusted(value, trusted)) return value;
+		throw /* @__PURE__ */ _notCopyable(value);
+	}
 	const existing = seen.get(value);
 	if (existing !== void 0) return existing;
 	const target = Array.isArray(value) ? [] : {};
@@ -413,4 +175,88 @@ function _copyValue(value, seen, stack) {
 	});
 	return target;
 }
-export { UnsecureError, base64Parse, base64Stringify, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder };
+const SHARED_POOL_BYTES = 4096;
+const _MAX_FILL = 65536;
+function _random(target) {
+	try {
+		return crypto.getRandomValues(target);
+	} catch (error) {
+		throw new UnsecureError("PLATFORM", "the runtime's crypto.getRandomValues refused.", { cause: error });
+	}
+}
+function _direct(target) {
+	const length = target.length;
+	if (length <= _MAX_FILL) {
+		_random(target);
+		return;
+	}
+	for (let start = 0; start < length; start += _MAX_FILL) _random(target.subarray(start, Math.min(start + _MAX_FILL, length)));
+}
+/* @__NO_SIDE_EFFECTS__ */
+function _startupSnapshot() {
+	try {
+		const proc = globalThis.process;
+		if (typeof proc?.getBuiltinModule !== "function") return void 0;
+		return proc.getBuiltinModule("node:v8")?.startupSnapshot;
+	} catch {
+		return;
+	}
+}
+/* @__NO_SIDE_EFFECTS__ */
+function createEntropyPool(size) {
+	let bytes;
+	let words;
+	let offset = size;
+	const snapshot = /* @__PURE__ */ _startupSnapshot();
+	function refill() {
+		if (bytes === void 0) {
+			const buffer = new ArrayBuffer(size);
+			bytes = new Uint8Array(buffer);
+			words = new Uint32Array(buffer);
+		}
+		_random(bytes);
+		offset = 0;
+	}
+	function nextUint32() {
+		if (snapshot?.isBuildingSnapshot()) return _random(/* @__PURE__ */ new Uint32Array(1))[0];
+		offset = offset + 3 & -4;
+		if (offset >= size) refill();
+		const value = words[offset >>> 2];
+		offset += 4;
+		return value;
+	}
+	function fill(target) {
+		const length = target.length;
+		if (length === 0) return target;
+		if (length > 64 || snapshot?.isBuildingSnapshot()) {
+			_direct(target);
+			return target;
+		}
+		if (offset + length > size) refill();
+		const slot = bytes.subarray(offset, offset + length);
+		target.set(slot);
+		slot.fill(0);
+		offset += length;
+		return target;
+	}
+	function reset(now = false) {
+		bytes?.fill(0);
+		bytes = words = void 0;
+		offset = size;
+		if (now) refill();
+	}
+	if (snapshot?.isBuildingSnapshot()) snapshot.addDeserializeCallback(() => reset());
+	return {
+		nextUint32,
+		fill,
+		reset
+	};
+}
+const sharedPool = /* @__PURE__ */ createEntropyPool(SHARED_POOL_BYTES);
+const MAX_RANDOM_BYTES = 2 ** 31 - 1;
+/* @__NO_SIDE_EFFECTS__ */
+function secureRandomBytes(length) {
+	assertInteger(length, "length", "secureRandomBytes", 0, MAX_RANDOM_BYTES);
+	return sharedPool.fill(new Uint8Array(length));
+}
+export { UnsecureError, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder };

package/dist/_chunks/{_internal.d.mts → limits.d.mts}

@@ -1,5 +1,5 @@
 import { JOSELimits } from "./index.mjs";
-import "./index2.mjs";
+import "./index3.mjs";
 /**
  * Default per-call work limits: 16 signatures, 16 recipients, 8 JWK Set candidates,
  * and PBKDF2 iterations for four default-cost PBES2 attempts in total.

package/dist/_chunks/payload.mjs

@@ -0,0 +1,23 @@
+import { JWTError } from "../error.mjs";
+import { validateJwtClaims } from "./jwt.mjs";
+function validateClaimsIfJson(payload, mode, options) {
+	if (mode !== "json" || options.validateClaims === false) return;
+	validateJwtClaims(payload, options);
+}
+const PAYLOAD_MODES = /* @__PURE__ */ new Set([
+	"json",
+	"string",
+	"bytes"
+]);
+function resolvePayloadMode(options) {
+	const { payload, forceUint8Array, validateClaims } = options;
+	if (payload !== void 0 && !PAYLOAD_MODES.has(payload)) throw new JWTError("\"payload\" must be \"json\", \"string\" or \"bytes\".", "ERR_INVALID_OPTION");
+	let mode = payload ?? "json";
+	if (forceUint8Array !== void 0) {
+		if (payload === void 0) mode = forceUint8Array ? "bytes" : "json";
+		else if (forceUint8Array !== (payload === "bytes")) throw new JWTError("\"forceUint8Array\" contradicts \"payload\", pass \"payload\" alone.", "ERR_INVALID_OPTION");
+	}
+	if (validateClaims === true && mode !== "json") throw new JWTError("\"validateClaims\" requires payload: \"json\".", "ERR_INVALID_OPTION");
+	return mode;
+}
+export { resolvePayloadMode, validateClaimsIfJson };