import { decoder } from "../lib/buffer_utils.mjs";
import { decode } from "./base64url.mjs";
import { JWTInvalid } from "./errors.mjs";
import is_object_default from "../lib/is_object.mjs";

//#region ../../node_modules/jose/dist/webapi/util/decode_jwt.js
function decodeJwt(jwt) {
	if (typeof jwt !== "string") throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
	const { 1: payload, length } = jwt.split(".");
	if (length === 5) throw new JWTInvalid("Only JWTs using Compact JWS serialization can be decoded");
	if (length !== 3) throw new JWTInvalid("Invalid JWT");
	if (!payload) throw new JWTInvalid("JWTs must contain a payload");
	let decoded;
	try {
		decoded = decode(payload);
	} catch {
		throw new JWTInvalid("Failed to base64url decode the payload");
	}
	let result;
	try {
		result = JSON.parse(decoder.decode(decoded));
	} catch {
		throw new JWTInvalid("Failed to parse the decoded payload as JSON");
	}
	if (!is_object_default(result)) throw new JWTInvalid("Invalid JWT Claims Set");
	return result;
}

//#endregion
export { decodeJwt };
//# sourceMappingURL=decode_jwt.mjs.map