https://www.glamup.ai/_next/static/chunks/1866-a8c7805571b3316d.js

1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[1866],{20452:function(e,t,a){/**
2 * @license React
3 * use-sync-external-store-shim.production.min.js
4 *
5 * Copyright (c) Facebook, Inc. and its affiliates.
6 *
7 * This source code is licensed under the MIT license found in the
8 * LICENSE file in the root directory of this source tree.
9 */var i=a(2784),o="function"==typeof Object.is?Object.is:function(e,t){return e===t&&(0!==e||1/e==1/t)||e!=e&&t!=t},n=i.useState,s=i.useEffect,c=i.useLayoutEffect,l=i.useDebugValue;function r(e){var t=e.getSnapshot;e=e.value;try{var a=t();return!o(e,a)}catch(e){return!0}}var d="undefined"==typeof window||void 0===window.document||void 0===window.document.createElement?function(e,t){return t()}:function(e,t){var a=t(),i=n({inst:{value:a,getSnapshot:t}}),o=i[0].inst,d=i[1];return c(function(){o.value=a,o.getSnapshot=t,r(o)&&d({inst:o})},[e,a,t]),s(function(){return r(o)&&d({inst:o}),e(function(){r(o)&&d({inst:o})})},[e]),l(a),a};t.useSyncExternalStore=void 0!==i.useSyncExternalStore?i.useSyncExternalStore:d},43100:function(e,t,a){e.exports=a(20452)},40620:function(e,t,a){a.d(t,{Us:function(){return createRemoteJWKSet},t5:function(){return decodeJwt},_f:function(){return jwtVerify}});let i=new TextEncoder,o=new TextDecoder,base64url_decodeBase64=e=>{let t=atob(e),a=new Uint8Array(t.length);for(let e=0;e<t.length;e++)a[e]=t.charCodeAt(e);return a},decode=e=>{let t=e;t instanceof Uint8Array&&(t=o.decode(t)),t=t.replace(/-/g,"+").replace(/_/g,"/").replace(/\s/g,"");try{return base64url_decodeBase64(t)}catch(e){throw TypeError("The input to be decoded is not correctly encoded.")}};let JOSEError=class JOSEError extends Error{static get code(){return"ERR_JOSE_GENERIC"}constructor(e){var t;super(e),this.code="ERR_JOSE_GENERIC",this.name=this.constructor.name,null===(t=Error.captureStackTrace)||void 0===t||t.call(Error,this,this.constructor)}};let errors_JWTClaimValidationFailed=class errors_JWTClaimValidationFailed extends JOSEError{static get code(){return"ERR_JWT_CLAIM_VALIDATION_FAILED"}constructor(e,t="unspecified",a="unspecified"){super(e),this.code="ERR_JWT_CLAIM_VALIDATION_FAILED",this.claim=t,this.reason=a}};let JWTExpired=class JWTExpired extends JOSEError{static get code(){return"ERR_JWT_EXPIRED"}constructor(e,t="unspecified",a="unspecified"){super(e),this.code="ERR_JWT_EXPIRED",this.claim=t,this.reason=a}};let errors_JOSEAlgNotAllowed=class errors_JOSEAlgNotAllowed extends JOSEError{constructor(){super(...arguments),this.code="ERR_JOSE_ALG_NOT_ALLOWED"}static get code(){return"ERR_JOSE_ALG_NOT_ALLOWED"}};let errors_JOSENotSupported=class errors_JOSENotSupported extends JOSEError{constructor(){super(...arguments),this.code="ERR_JOSE_NOT_SUPPORTED"}static get code(){return"ERR_JOSE_NOT_SUPPORTED"}};let errors_JWSInvalid=class errors_JWSInvalid extends JOSEError{constructor(){super(...arguments),this.code="ERR_JWS_INVALID"}static get code(){return"ERR_JWS_INVALID"}};let errors_JWTInvalid=class errors_JWTInvalid extends JOSEError{constructor(){super(...arguments),this.code="ERR_JWT_INVALID"}static get code(){return"ERR_JWT_INVALID"}};let JWKSInvalid=class JWKSInvalid extends JOSEError{constructor(){super(...arguments),this.code="ERR_JWKS_INVALID"}static get code(){return"ERR_JWKS_INVALID"}};let JWKSNoMatchingKey=class JWKSNoMatchingKey extends JOSEError{constructor(){super(...arguments),this.code="ERR_JWKS_NO_MATCHING_KEY",this.message="no applicable key found in the JSON Web Key Set"}static get code(){return"ERR_JWKS_NO_MATCHING_KEY"}};let JWKSMultipleMatchingKeys=class JWKSMultipleMatchingKeys extends JOSEError{constructor(){super(...arguments),this.code="ERR_JWKS_MULTIPLE_MATCHING_KEYS",this.message="multiple matching keys found in the JSON Web Key Set"}static get code(){return"ERR_JWKS_MULTIPLE_MATCHING_KEYS"}};let JWKSTimeout=class JWKSTimeout extends JOSEError{constructor(){super(...arguments),this.code="ERR_JWKS_TIMEOUT",this.message="request timed out"}static get code(){return"ERR_JWKS_TIMEOUT"}};let errors_JWSSignatureVerificationFailed=class errors_JWSSignatureVerificationFailed extends JOSEError{constructor(){super(...arguments),this.code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED",this.message="signature verification failed"}static get code(){return"ERR_JWS_SIGNATURE_VERIFICATION_FAILED"}};var n=crypto;let webcrypto_isCryptoKey=e=>e instanceof CryptoKey;n.getRandomValues.bind(n);let parse=async e=>{var t,a;if(!e.alg)throw TypeError('"alg" argument is required when "jwk.alg" is not present');let{algorithm:i,keyUsages:o}=function(e){let t,a;

9switch(e.kty){case"oct":switch(e.alg){case"HS256":case"HS384":case"HS512":t={name:"HMAC",hash:`SHA-${e.alg.slice(-3)}`},a=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":throw new errors_JOSENotSupported(`${e.alg} keys cannot be imported as CryptoKey instances`);case"A128GCM":case"A192GCM":case"A256GCM":case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":t={name:"AES-GCM"},a=["encrypt","decrypt"];break;case"A128KW":case"A192KW":case"A256KW":t={name:"AES-KW"},a=["wrapKey","unwrapKey"];break;case"PBES2-HS256+A128KW":case"PBES2-HS384+A192KW":case"PBES2-HS512+A256KW":t={name:"PBKDF2"},a=["deriveBits"];break;default:throw new errors_JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"RSA":switch(e.alg){case"PS256":case"PS384":case"PS512":t={name:"RSA-PSS",hash:`SHA-${e.alg.slice(-3)}`},a=e.d?["sign"]:["verify"];break;case"RS256":case"RS384":case"RS512":t={name:"RSASSA-PKCS1-v1_5",hash:`SHA-${e.alg.slice(-3)}`},a=e.d?["sign"]:["verify"];break;case"RSA-OAEP":case"RSA-OAEP-256":case"RSA-OAEP-384":case"RSA-OAEP-512":t={name:"RSA-OAEP",hash:`SHA-${parseInt(e.alg.slice(-3),10)||1}`},a=e.d?["decrypt","unwrapKey"]:["encrypt","wrapKey"];break;default:throw new errors_JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"EC":switch(e.alg){case"ES256":t={name:"ECDSA",namedCurve:"P-256"},a=e.d?["sign"]:["verify"];break;case"ES384":t={name:"ECDSA",namedCurve:"P-384"},a=e.d?["sign"]:["verify"];break;case"ES512":t={name:"ECDSA",namedCurve:"P-521"},a=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:"ECDH",namedCurve:e.crv},a=e.d?["deriveBits"]:[];break;default:throw new errors_JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;case"OKP":switch(e.alg){case"EdDSA":t={name:e.crv},a=e.d?["sign"]:["verify"];break;case"ECDH-ES":case"ECDH-ES+A128KW":case"ECDH-ES+A192KW":case"ECDH-ES+A256KW":t={name:e.crv},a=e.d?["deriveBits"]:[];break;default:throw new errors_JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}break;default:throw new errors_JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value')}return{algorithm:t,keyUsages:a}}(e),s=[i,null!==(t=e.ext)&&void 0!==t&&t,null!==(a=e.key_ops)&&void 0!==a?a:o];if("PBKDF2"===i.name)return n.subtle.importKey("raw",decode(e.k),...s);let c={...e};return delete c.alg,delete c.use,n.subtle.importKey("jwk",c,...s)};function is_object_isObject(e){if(!("object"==typeof e&&null!==e)||"[object Object]"!==Object.prototype.toString.call(e))return!1;if(null===Object.getPrototypeOf(e))return!0;let t=e;for(;null!==Object.getPrototypeOf(t);)t=Object.getPrototypeOf(t);return Object.getPrototypeOf(e)===t}async function import_importJWK(e,t,a){var i;if(!is_object_isObject(e))throw TypeError("JWK must be an object");switch(t||(t=e.alg),e.kty){case"oct":if("string"!=typeof e.k||!e.k)throw TypeError('missing "k" (Key Value) Parameter value');if(null!=a||(a=!0!==e.ext),a)return parse({...e,alg:t,ext:null!==(i=e.ext)&&void 0!==i&&i});return decode(e.k);case"RSA":if(void 0!==e.oth)throw new errors_JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');case"EC":case"OKP":return parse({...e,alg:t});default:throw new errors_JOSENotSupported('Unsupported "kty" (Key Type) Parameter value')}}var validate_crit=function(e,t,a,i,o){let n;if(void 0!==o.crit&&void 0===i.crit)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!i||void 0===i.crit)return new Set;if(!Array.isArray(i.crit)||0===i.crit.length||i.crit.some(e=>"string"!=typeof e||0===e.length))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');for(let s of(n=void 0!==a?new Map([...Object.entries(a),...t.entries()]):t,i.crit)){if(!n.has(s))throw new errors_JOSENotSupported(`Extension Header Parameter "${s}" is not recognized`);if(void 0===o[s])throw new e(`Extension Header Parameter "${s}" is missing`);if(n.get(s)&&void 0===i[s])throw new e(`Extension Header Parameter "${s}" MUST be integrity protected`)}return new Set(i.crit)};Symbol();var check_key_length=(e,t)=>{if(e.startsWith("RS")||e.startsWith("PS")){let{modulusLength:a}=t.algorithm;if("number"!=typeof a||a<2048)throw TypeError(`${e}

9 requires key modulusLength to be 2048 bits or larger`)}};function unusable(e,t="algorithm.name"){return TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`)}function isAlgorithm(e,t){return e.name===t}function getHashLength(e){return parseInt(e.name.slice(4),10)}function message(e,t,...a){if(a.length>2){let t=a.pop();e+=`one of type ${a.join(", ")}, or ${t}.`}else 2===a.length?e+=`one of type ${a[0]} or ${a[1]}.`:e+=`of type ${a[0]}.`;return null==t?e+=` Received ${t}`:"function"==typeof t&&t.name?e+=` Received function ${t.name}`:"object"==typeof t&&null!=t&&t.constructor&&t.constructor.name&&(e+=` Received an instance of ${t.constructor.name}`),e}var invalid_key_input=(e,...t)=>message("Key must be ",e,...t);function withAlg(e,t,...a){return message(`Key for the ${e} algorithm must be `,t,...a)}var is_key_like=e=>webcrypto_isCryptoKey(e);let s=["CryptoKey"],verify=async(e,t,a,i)=>{let o=await function(e,t,a){if(webcrypto_isCryptoKey(t))return!function(e,t,...a){switch(t){case"HS256":case"HS384":case"HS512":{if(!isAlgorithm(e.algorithm,"HMAC"))throw unusable("HMAC");let a=parseInt(t.slice(2),10),i=getHashLength(e.algorithm.hash);if(i!==a)throw unusable(`SHA-${a}`,"algorithm.hash");break}case"RS256":case"RS384":case"RS512":{if(!isAlgorithm(e.algorithm,"RSASSA-PKCS1-v1_5"))throw unusable("RSASSA-PKCS1-v1_5");let a=parseInt(t.slice(2),10),i=getHashLength(e.algorithm.hash);if(i!==a)throw unusable(`SHA-${a}`,"algorithm.hash");break}

9case"PS256":case"PS384":case"PS512":{if(!isAlgorithm(e.algorithm,"RSA-PSS"))throw unusable("RSA-PSS");let a=parseInt(t.slice(2),10),i=getHashLength(e.algorithm.hash);if(i!==a)throw unusable(`SHA-${a}`,"algorithm.hash");break}case"EdDSA":if("Ed25519"!==e.algorithm.name&&"Ed448"!==e.algorithm.name)throw unusable("Ed25519 or Ed448");break;case"ES256":case"ES384":case"ES512":{if(!isAlgorithm(e.algorithm,"ECDSA"))throw unusable("ECDSA");let a=function(e){switch(e){case"ES256":return"P-256";case"ES384":return"P-384";case"ES512":return"P-521";default:throw Error("unreachable")}}(t),i=e.algorithm.namedCurve;if(i!==a)throw unusable(a,"algorithm.namedCurve");break}default:throw TypeError("CryptoKey does not support this operation")}!function(e,t){if(t.length&&!t.some(t=>e.usages.includes(t))){let e="CryptoKey does not support this operation, its usages must include ";if(t.length>2){let a=t.pop();e+=`one of ${t.join(", ")}, or ${a}.`}else 2===t.length?e+=`one of ${t[0]} or ${t[1]}.`:e+=`${t[0]}.`;throw TypeError(e)}}(e,a)}(t,e,a),t;if(t instanceof Uint8Array){if(!e.startsWith("HS"))throw TypeError(invalid_key_input(t,...s));return n.subtle.importKey("raw",t,{hash:`SHA-${e.slice(-3)}`,name:"HMAC"},!1,[a])}throw TypeError(invalid_key_input(t,...s,"Uint8Array"))}(e,t,"verify");check_key_length(e,o);let c=function(e,t){let a=`SHA-${e.slice(-3)}`;switch(e){case"HS256":case"HS384":case"HS512":return{hash:a,name:"HMAC"};case"PS256":case"PS384":case"PS512":return{hash:a,name:"RSA-PSS",saltLength:e.slice(-3)>>3};case"RS256":case"RS384":case"RS512":return{hash:a,name:"RSASSA-PKCS1-v1_5"};case"ES256":case"ES384":case"ES512":return{hash:a,name:"ECDSA",namedCurve:t.namedCurve};case"EdDSA":return{name:t.name};default:throw new errors_JOSENotSupported(`alg ${e} is not supported either by JOSE or your javascript runtime`)}}(e,o.algorithm);try{return await n.subtle.verify(c,o,a,i)}catch(e){return!1}};var is_disjoint=(...e)=>{let t;let a=e.filter(Boolean);if(0===a.length||1===a.length)return!0;for(let e of a){let a=Object.keys(e);if(!t||0===t.size){t=new Set(a);continue}for(let e of a){if(t.has(e))return!1;t.add(e)}}return!0};let symmetricTypeCheck=(e,t)=>{if(!(t instanceof Uint8Array)){if(!is_key_like(t))throw TypeError(withAlg(e,t,...s,"Uint8Array"));if("secret"!==t.type)throw TypeError(`${s.join(" or ")} instances for symmetric algorithms must be of type "secret"`)}},asymmetricTypeCheck=(e,t,a)=>{if(!is_key_like(t))throw TypeError(withAlg(e,t,...s));if("secret"===t.type)throw TypeError(`${s.join(" or ")} instances for asymmetric algorithms must not be of type "secret"`);if("sign"===a&&"public"===t.type)throw TypeError(`${s.join(" or ")} instances for asymmetric algorithm signing must be of type "private"`);if("decrypt"===a&&"public"===t.type)throw TypeError(`${s.join(" or ")} instances for asymmetric algorithm decryption must be of type "private"`);if(t.algorithm&&"verify"===a&&"private"===t.type)throw TypeError(`${s.join(" or ")} instances for asymmetric algorithm verifying must be of type "public"`);if(t.algorithm&&"encrypt"===a&&"private"===t.type)throw TypeError(`${s.join(" or ")} instances for asymmetric algorithm encryption must be of type "public"`)};var check_key_type=(e,t,a)=>{let i=e.startsWith("HS")||"dir"===e||e.startsWith("PBES2")||/^A\d{3}(?:GCM)?KW$/.test(e);i?symmetricTypeCheck(e,t):asymmetricTypeCheck(e,t,a)},validate_algorithms=(e,t)=>{if(void 0!==t&&(!Array.isArray(t)||t.some(e=>"string"!=typeof e)))throw TypeError(`"${e}" option must be an array of strings`);if(t)return new Set(t)};async function verify_flattenedVerify(e,t,a){var n;let s;if(!is_object_isObject(e))throw new errors_JWSInvalid("Flattened JWS must be an object");if(void 0===e.protected&&void 0===e.header)throw new errors_JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');if(void 0!==e.protected&&"string"!=typeof e.protected)throw new errors_JWSInvalid("JWS Protected Header incorrect type");if(void 0===e.payload)throw new errors_JWSInvalid("JWS Payload missing");if("string"!=typeof e.signature)throw new errors_JWSInvalid("JWS Signature missing or incorrect type");if(void 0!==e.header&&!is_object_isObject(e.header))throw new errors_JWSInvalid("JWS 

9Unprotected Header incorrect type");let c={};if(e.protected)try{let t=decode(e.protected);c=JSON.parse(o.decode(t))}catch(e){throw new errors_JWSInvalid("JWS Protected Header is invalid")}if(!is_disjoint(c,e.header))throw new errors_JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");let l={...c,...e.header},d=validate_crit(errors_JWSInvalid,new Map([["b64",!0]]),null==a?void 0:a.crit,c,l),u=!0;if(d.has("b64")&&"boolean"!=typeof(u=c.b64))throw new errors_JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:h}=l;if("string"!=typeof h||!h)throw new errors_JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');let p=a&&validate_algorithms("algorithms",a.algorithms);if(p&&!p.has(h))throw new errors_JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');if(u){if("string"!=typeof e.payload)throw new errors_JWSInvalid("JWS Payload must be a string")}else if("string"!=typeof e.payload&&!(e.payload instanceof Uint8Array))throw new errors_JWSInvalid("JWS Payload must be a string or an Uint8Array instance");let f=!1;"function"==typeof t&&(t=await t(c,e),f=!0),check_key_type(h,t,"verify");let y=function(...e){let t=e.reduce((e,{length:t})=>e+t,0),a=new Uint8Array(t),i=0;return e.forEach(e=>{a.set(e,i),i+=e.length}),a}(i.encode(null!==(n=e.protected)&&void 0!==n?n:""),i.encode("."),"string"==typeof e.payload?i.encode(e.payload):e.payload),S=decode(e.signature),m=await verify(h,t,S,y);if(!m)throw new errors_JWSSignatureVerificationFailed;s=u?decode(e.payload):"string"==typeof e.payload?i.encode(e.payload):e.payload;let w={payload:s};return(void 0!==e.protected&&(w.protectedHeader=c),void 0!==e.header&&(w.unprotectedHeader=e.header),f)?{...w,key:t}:w}async function compactVerify(e,t,a){if(e instanceof Uint8Array&&(e=o.decode(e)),"string"!=typeof e)throw new errors_JWSInvalid("Compact JWS must be a string or Uint8Array");let{0:i,1:n,2:s,length:c}=e.split(".");if(3!==c)throw new errors_JWSInvalid("Invalid Compact JWS");let l=await verify_flattenedVerify({payload:n,protected:i,signature:s},t,a),d={payload:l.payload,protectedHeader:l.protectedHeader};return"function"==typeof t?{...d,key:l.key}:d}var lib_epoch=e=>Math.floor(e.getTime()/1e3);let c=604800,l=31557600,d=/^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i;var lib_secs=e=>{let t=d.exec(e);if(!t)throw TypeError("Invalid time period format");let a=parseFloat(t[1]),i=t[2].toLowerCase();switch(i){case"sec":case"secs":case"second":case"seconds":case"s":return Math.round(a);case"minute":case"minutes":case"min":case"mins":case"m":return Math.round(60*a);case"hour":case"hours":case"hr":case"hrs":case"h":return Math.round(3600*a);case"day":case"days":case"d":return Math.round(86400*a);case"week":case"weeks":case"w":return Math.round(a*c);default:return Math.round(a*l)}};let normalizeTyp=e=>e.toLowerCase().replace(/^application\//,""),checkAudiencePresence=(e,t)=>"string"==typeof e?t.includes(e):!!Array.isArray(e)&&t.some(Set.prototype.has.bind(new Set(e)));var jwt_claims_set=(e,t,a={})=>{let i,n;let{typ:s}=a;if(s&&("string"!=typeof e.typ||normalizeTyp(e.typ)!==normalizeTyp(s)))throw new errors_JWTClaimValidationFailed('unexpected "typ" JWT header value',"typ","check_failed");try{i=JSON.parse(o.decode(t))}catch(e){}if(!is_object_isObject(i))throw new errors_JWTInvalid("JWT Claims Set must be a top-level JSON object");let{requiredClaims:c=[],issuer:l,subject:d,audience:u,maxTokenAge:h}=a;for(let e of(void 0!==h&&c.push("iat"),void 0!==u&&c.push("aud"),void 0!==d&&c.push("sub"),void 0!==l&&c.push("iss"),new Set(c.reverse())))if(!(e in i))throw new errors_JWTClaimValidationFailed(`missing required "${e}" claim`,e,"missing");if(l&&!(Array.isArray(l)?l:[l]).includes(i.iss))throw new errors_JWTClaimValidationFailed('unexpected "iss" claim value',"iss","check_failed");if(d&&i.sub!==d)throw new errors_JWTClaimValidationFailed('unexpected "sub" claim value',"sub","check_failed");if(u&&!checkAudiencePresence(i.aud,"string"==typeof u?[u]:u))throw new errors_JWTClaimValidationFailed('unexpected "aud" claim value',"aud","check_failed");switch(typeof a.clockTolerance){case"string":n=lib_secs(a.clockTolerance);break;case"number":n=a.clockTolerance;break;case"undefined":n=0;break;default:throw TypeError("Invalid clockTolerance option type")}let{currentDate:p}=a,f=lib_epoch(p||new Date);if((void 0!==i.iat||h)&&"number"!=typeof i.iat)throw new errors_JWTClaimValidationFailed('"iat" claim must be a number',"iat","invali

9d");if(void 0!==i.nbf){if("number"!=typeof i.nbf)throw new errors_JWTClaimValidationFailed('"nbf" claim must be a number',"nbf","invalid");if(i.nbf>f+n)throw new errors_JWTClaimValidationFailed('"nbf" claim timestamp check failed',"nbf","check_failed")}if(void 0!==i.exp){if("number"!=typeof i.exp)throw new errors_JWTClaimValidationFailed('"exp" claim must be a number',"exp","invalid");if(i.exp<=f-n)throw new JWTExpired('"exp" claim timestamp check failed',"exp","check_failed")}if(h){let e=f-i.iat,t="number"==typeof h?h:lib_secs(h);if(e-n>t)throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)',"iat","check_failed");if(e<0-n)throw new errors_JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)',"iat","check_failed")}return i};async function jwtVerify(e,t,a){var i;let o=await compactVerify(e,t,a);if((null===(i=o.protectedHeader.crit)||void 0===i?void 0:i.includes("b64"))&&!1===o.protectedHeader.b64)throw new errors_JWTInvalid("JWTs MUST NOT use unencoded payload");let n=jwt_claims_set(o.protectedHeader,o.payload,a),s={payload:n,protectedHeader:o.protectedHeader};return"function"==typeof t?{...s,key:o.key}:s}function isJWKSLike(e){return e&&"object"==typeof e&&Array.isArray(e.keys)&&e.keys.every(isJWKLike)}function isJWKLike(e){return is_object_isObject(e)}let LocalJWKSet=class LocalJWKSet{constructor(e){if(this._cached=new WeakMap,!isJWKSLike(e))throw new JWKSInvalid("JSON Web Key Set malformed");this._jwks="function"==typeof structuredClone?structuredClone(e):JSON.parse(JSON.stringify(e))}async getKey(e,t){let{alg:a,kid:i}={...e,...null==t?void 0:t.header},o=function(e){switch("string"==typeof e&&e.slice(0,2)){case"RS":case"PS":return"RSA";case"ES":return"EC";case"Ed":return"OKP";default:throw new errors_JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set')}}(a),n=this._jwks.keys.filter(e=>{let t=o===e.kty;if(t&&"string"==typeof i&&(t=i===e.kid),t&&"string"==typeof e.alg&&(t=a===e.alg),t&&"string"==typeof e.use&&(t="sig"===e.use),t&&Array.isArray(e.key_ops)&&(t=e.key_ops.includes("verify")),t&&"EdDSA"===a&&(t="Ed25519"===e.crv||"Ed448"===e.crv),t)switch(a){case"ES256":t="P-256"===e.crv;break;case"ES256K":t="secp256k1"===e.crv;break;case"ES384":t="P-384"===e.crv;break;case"ES512":t="P-521"===e.crv}return t}),{0:s,length:c}=n;if(0===c)throw new JWKSNoMatchingKey;if(1!==c){let e=new JWKSMultipleMatchingKeys,{_cached:t}=this;throw e[Symbol.asyncIterator]=async function*(){for(let e of n)try{yield await importWithAlgCache(t,e,a)}catch(e){continue}},e}return importWithAlgCache(this._cached,s,a)}};async function importWithAlgCache(e,t,a){let i=e.get(t)||e.set(t,{}).get(t);if(void 0===i[a]){let e=await import_importJWK({...t,ext:!0},a);if(e instanceof Uint8Array||"public"!==e.type)throw new JWKSInvalid("JSON Web Key Set members must be public keys");i[a]=e}return i[a]}let fetchJwks=async(e,t,a)=>{let i,o;let n=!1;"function"==typeof AbortController&&(i=new AbortController,o=setTimeout(()=>{n=!0,i.abort()},t));let s=await fetch(e.href,{signal:i?i.signal:void 0,redirect:"manual",headers:a.headers}).catch(e=>{if(n)throw new JWKSTimeout;throw e});if(void 0!==o&&clearTimeout(o),200!==s.status)throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await s.json()}catch(e){throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON")}};let RemoteJWKSet=class RemoteJWKSet extends LocalJWKSet{constructor(e,t){if(super({keys:[]}),this._jwks=void 0,!(e instanceof URL))throw TypeError("url must be an instance of URL");this._url=new URL(e.href),this._options={agent:null==t?void 0:t.agent,headers:null==t?void 0:t.headers},this._timeoutDuration="number"==typeof(null==t?void 0:t.timeoutDuration)?null==t?void 0:t.timeoutDuration:5e3,this._cooldownDuration="number"==typeof(null==t?void 0:t.cooldownDuration)?null==t?void 0:t.cooldownDuration:3e4,this._cacheMaxAge="number"==typeof(null==t?void 0:t.cacheMaxAge)?null==t?void 0:t.cacheMaxAge:6e5}coolingDown(){return"number"==typeof this._jwksTimestamp&&Date.now()<this._jwksTimestamp+this._cooldownDuration}fresh(){return"number"==typeof this._jwksTimestamp&&Date.now()<this._jwksTimestamp+this._cacheMaxAge}async getKey(e,t){this._jwks&&this.fresh()||await this.reload();try{return await super.getKey(e,t)}catch(a){if(a instanceof JWKSNoMatchingKey&&!1===this.coolingDown())return await this.reload(),super.getKey(e,t);throw a}}async reload(){this._pendingFetch&&("undefined"!=typeof WebSocketPair||"undefined"!=typeof navigator&&"Cloudflare-Workers"===navigator.userAgent||"undefined"!=typeof EdgeRuntime&&"vercel"===EdgeRuntime)&&(this._pe

9ndingFetch=void 0),this._pendingFetch||(this._pendingFetch=fetchJwks(this._url,this._timeoutDuration,this._options).then(e=>{if(!isJWKSLike(e))throw new JWKSInvalid("JSON Web Key Set malformed");this._jwks={keys:e.keys},this._jwksTimestamp=Date.now(),this._pendingFetch=void 0}).catch(e=>{throw this._pendingFetch=void 0,e})),await this._pendingFetch}};function createRemoteJWKSet(e,t){let a=new RemoteJWKSet(e,t);return async function(e,t){return a.getKey(e,t)}}function decodeJwt(e){let t,a;if("string"!=typeof e)throw new errors_JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");let{1:i,length:n}=e.split(".");if(5===n)throw new errors_JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");if(3!==n)throw new errors_JWTInvalid("Invalid JWT");if(!i)throw new errors_JWTInvalid("JWTs must contain a payload");try{t=decode(i)}catch(e){throw new errors_JWTInvalid("Failed to parse the base64url encoded payload")}try{a=JSON.parse(o.decode(t))}catch(e){throw new errors_JWTInvalid("Failed to parse the decoded payload as JSON")}if(!is_object_isObject(a))throw new errors_JWTInvalid("Invalid JWT Claims Set");return a}}}]);