import { jwtVerify, createRemoteJWKSet } from "jose";
let remoteKeyset;
function getRemoteKeyset(jwksUrl) {
  if (remoteKeyset === void 0) {
    remoteKeyset = createRemoteJWKSet(new URL(jwksUrl));
  }
  return remoteKeyset;
}
const tokenConfigOptions = (config) => {
  const tokenOptions = ["jwk", "secret", "jwksUrl"].filter(
    (key) => config[key] !== void 0
  );
  return tokenOptions;
};
async function verifyToken(config, token, verifyOptions) {
  if (config.jwk !== void 0) {
    return verifyTokenImpl(token, loadJwk(config.jwk), verifyOptions);
  }
  if (config.secret !== void 0) {
    return verifyTokenImpl(token, loadSecret(config.secret), verifyOptions);
  }
  if (config.jwksUrl !== void 0) {
    const remoteKeyset2 = getRemoteKeyset(config.jwksUrl);
    return (await jwtVerify(token, remoteKeyset2, verifyOptions)).payload;
  }
  throw new Error(
    "verifyToken was called but no auth options (one of: jwk, secret, jwksUrl) were configured."
  );
}
function loadJwk(jwkString) {
  return JSON.parse(jwkString);
}
function loadSecret(secret) {
  return new TextEncoder().encode(secret);
}
async function verifyTokenImpl(token, verifyKey, verifyOptions) {
  const { payload } = await jwtVerify(token, verifyKey, verifyOptions);
  return payload;
}
export {
  tokenConfigOptions,
  verifyToken
};
//# sourceMappingURL=jwt.js.map
