From e4a931c4bda7e9b4e5b0f4d77fc64257d59cb709 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 Aug 2025 10:19:32 +0200
Subject: [PATCH 01/29] Bump actions/checkout from 4 to 5 (#1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to
5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/releases">actions/checkout's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
<li>Prepare v5.0.0 release by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2238">actions/checkout#2238</a></li>
</ul>
<h2>⚠️ Minimum Compatible Runner Version</h2>
<p><strong>v2.327.1</strong><br />
<a
href="https://github.com/actions/runner/releases/tag/v2.327.1">Release
Notes</a></p>
<p>Make sure your runner is updated to this version or newer to use this
release.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4...v5.0.0">https://github.com/actions/checkout/compare/v4...v5.0.0</a></p>
<h2>v4.3.0</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
<li>Prepare release v4.3.0 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2237">actions/checkout#2237</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/motss"><code>@​motss</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li><a href="https://github.com/mouismail"><code>@​mouismail</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li><a href="https://github.com/benwells"><code>@​benwells</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4...v4.3.0">https://github.com/actions/checkout/compare/v4...v4.3.0</a></p>
<h2>v4.2.2</h2>
<h2>What's Changed</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4.2.1...v4.2.2">https://github.com/actions/checkout/compare/v4.2.1...v4.2.2</a></p>
<h2>v4.2.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Jcambass"><code>@​Jcambass</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/checkout/pull/1919">actions/checkout#1919</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/checkout/compare/v4.2.0...v4.2.1">https://github.com/actions/checkout/compare/v4.2.0...v4.2.1</a></p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h2>V5.0.0</h2>
<ul>
<li>Update actions checkout to use node 24 by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li>
</ul>
<h2>V4.3.0</h2>
<ul>
<li>docs: update README.md by <a
href="https://github.com/motss"><code>@​motss</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li>
<li>Add internal repos for checking out multiple repositories by <a
href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li>
<li>Documentation update - add recommended permissions to Readme by <a
href="https://github.com/benwells"><code>@​benwells</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li>
<li>Adjust positioning of user email note and permissions heading by <a
href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li>
<li>Update CODEOWNERS for actions by <a
href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li>
<li>Update package dependencies by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li>
</ul>
<h2>v4.2.2</h2>
<ul>
<li><code>url-helper.ts</code> now leverages well-known environment
variables by <a href="https://github.com/jww3"><code>@​jww3</code></a>
in <a
href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li>
<li>Expand unit test coverage for <code>isGhes</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li>
</ul>
<h2>v4.2.1</h2>
<ul>
<li>Check out other refs/* by commit if provided, fall back to ref by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li>
</ul>
<h2>v4.2.0</h2>
<ul>
<li>Add Ref and Commit outputs by <a
href="https://github.com/lucacome"><code>@​lucacome</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1180">actions/checkout#1180</a></li>
<li>Dependency updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>- <a
href="https://redirect.github.com/actions/checkout/pull/1777">actions/checkout#1777</a>,
<a
href="https://redirect.github.com/actions/checkout/pull/1872">actions/checkout#1872</a></li>
</ul>
<h2>v4.1.7</h2>
<ul>
<li>Bump the minor-npm-dependencies group across 1 directory with 4
updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1739">actions/checkout#1739</a></li>
<li>Bump actions/checkout from 3 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1697">actions/checkout#1697</a></li>
<li>Check out other refs/* by commit by <a
href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1774">actions/checkout#1774</a></li>
<li>Pin actions/checkout's own workflows to a known, good, stable
version. by <a href="https://github.com/jww3"><code>@​jww3</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1776">actions/checkout#1776</a></li>
</ul>
<h2>v4.1.6</h2>
<ul>
<li>Check platform to set archive extension appropriately by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1732">actions/checkout#1732</a></li>
</ul>
<h2>v4.1.5</h2>
<ul>
<li>Update NPM dependencies by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1703">actions/checkout#1703</a></li>
<li>Bump github/codeql-action from 2 to 3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1694">actions/checkout#1694</a></li>
<li>Bump actions/setup-node from 1 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1696">actions/checkout#1696</a></li>
<li>Bump actions/upload-artifact from 2 to 4 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1695">actions/checkout#1695</a></li>
<li>README: Suggest <code>user.email</code> to be
<code>41898282+github-actions[bot]@users.noreply.github.com</code> by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1707">actions/checkout#1707</a></li>
</ul>
<h2>v4.1.4</h2>
<ul>
<li>Disable <code>extensions.worktreeConfig</code> when disabling
<code>sparse-checkout</code> by <a
href="https://github.com/jww3"><code>@​jww3</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1692">actions/checkout#1692</a></li>
<li>Add dependabot config by <a
href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in
<a
href="https://redirect.github.com/actions/checkout/pull/1688">actions/checkout#1688</a></li>
<li>Bump the minor-actions-dependencies group with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1693">actions/checkout#1693</a></li>
<li>Bump word-wrap from 1.2.3 to 1.2.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/checkout/pull/1643">actions/checkout#1643</a></li>
</ul>
<h2>v4.1.3</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/checkout/commit/08c6903cd8c0fde910a37f88322edcfb5dd907a8"><code>08c6903</code></a>
Prepare v5.0.0 release (<a
href="https://redirect.github.com/actions/checkout/issues/2238">#2238</a>)</li>
<li><a
href="https://github.com/actions/checkout/commit/9f265659d3bb64ab1440b03b12f4d47a24320917"><code>9f26565</code></a>
Update actions checkout to use node 24 (<a
href="https://redirect.github.com/actions/checkout/issues/2226">#2226</a>)</li>
<li>See full diff in <a
href="https://github.com/actions/checkout/compare/v4...v5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=4&new-version=5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/Linter.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/Linter.yml b/.github/workflows/Linter.yml
index 1f677cb..94f34b0 100644
--- a/.github/workflows/Linter.yml
+++ b/.github/workflows/Linter.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 

From ce57a848ac0259589f7579e761f0e0d0cbdc8ba7 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 4 Oct 2025 13:55:57 +0200
Subject: [PATCH 02/29] =?UTF-8?q?=F0=9F=A9=B9=20[Patch]:=20Bump=20Process-?=
 =?UTF-8?q?PSModule=20to=20v5=20(#4)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Description

This pull request updates the CI/CD pipeline configuration for the
repository, focusing on simplifying workflows, improving test coverage
requirements, and updating dependencies to use newer versions and
inherited secrets. The changes remove redundant or unused workflow files
and linter configurations, and enhance the main workflow to support both
scheduled and manual runs.

**CI/CD Workflow Updates:**

* The main workflow `.github/workflows/Process-PSModule.yml` is updated
to trigger on manual dispatch and nightly schedule, in addition to pull
requests, enabling more flexible automation.
* The workflow now uses version `v5` of the reusable workflow and
inherits secrets, ensuring up-to-date processes and more secure secret
management.
* The old nightly workflow `.github/workflows/Nightly-Run.yml` is
removed, consolidating scheduled runs into the main workflow.

**Linting and Code Quality:**

* The linter workflow `.github/workflows/Linter.yml` and its
configuration file `.github/linters/.jscpd.json` are removed, indicating
a shift away from the previous linting setup.
[[1]](diffhunk://#diff-482e65806ed9e4a7320f14964764086b91fed4a28d12e4efde1776472e147e79L1-L32)
[[2]](diffhunk://#diff-557094e283c00b23265c1c75872f41c6b1a524a00f0d99dd68ebd22cb63bfdd6L1-L10)

**Test Coverage Requirements:**

* The code coverage target in `.github/PSModule.yml` is increased from
0% to 50%, raising the quality bar for tests.
---
 .github/PSModule.yml                   | 16 ++++++++++++-
 .github/linters/.jscpd.json            | 10 --------
 .github/workflows/Linter.yml           | 32 --------------------------
 .github/workflows/Nightly-Run.yml      | 17 --------------
 .github/workflows/Process-PSModule.yml | 10 ++++----
 5 files changed, 20 insertions(+), 65 deletions(-)
 delete mode 100644 .github/linters/.jscpd.json
 delete mode 100644 .github/workflows/Linter.yml
 delete mode 100644 .github/workflows/Nightly-Run.yml

diff --git a/.github/PSModule.yml b/.github/PSModule.yml
index c66c28c..9a91761 100644
--- a/.github/PSModule.yml
+++ b/.github/PSModule.yml
@@ -4,4 +4,18 @@
 
 Test:
   CodeCoverage:
-    PercentTarget: 0
+    PercentTarget: 50
+#   TestResults:
+#     Skip: true
+#   SourceCode:
+#     Skip: true
+#   PSModule:
+#     Skip: true
+#   Module:
+#     Windows:
+#       Skip: true
+#     MacOS:
+#       Skip: true
+# Build:
+#   Docs:
+#     Skip: true
diff --git a/.github/linters/.jscpd.json b/.github/linters/.jscpd.json
deleted file mode 100644
index 23970e8..0000000
--- a/.github/linters/.jscpd.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-    "threshold": 0,
-    "reporters": [
-        "consoleFull"
-    ],
-    "ignore": [
-        "**/tests/**"
-    ],
-    "absolute": true
-}
diff --git a/.github/workflows/Linter.yml b/.github/workflows/Linter.yml
deleted file mode 100644
index 94f34b0..0000000
--- a/.github/workflows/Linter.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: Linter
-
-run-name: "Linter - [${{ github.event.pull_request.title }} #${{ github.event.pull_request.number }}] by @${{ github.actor }}"
-
-on: [pull_request]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  packages: read
-  statuses: write
-
-jobs:
-  Lint:
-    name: Lint code base
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Lint code base
-        uses: super-linter/super-linter@latest
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          VALIDATE_JSON_PRETTIER: false
-          VALIDATE_MARKDOWN_PRETTIER: false
-          VALIDATE_YAML_PRETTIER: false
diff --git a/.github/workflows/Nightly-Run.yml b/.github/workflows/Nightly-Run.yml
deleted file mode 100644
index b192d11..0000000
--- a/.github/workflows/Nightly-Run.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: Nightly Run
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * *'
-
-permissions:
-  contents: read
-  pull-requests: write
-  statuses: write
-
-jobs:
-  Process-PSModule:
-    uses: PSModule/Process-PSModule/.github/workflows/CI.yml@v4
-    secrets:
-      APIKEY: ${{ secrets.APIKEY }}
diff --git a/.github/workflows/Process-PSModule.yml b/.github/workflows/Process-PSModule.yml
index bd51f85..a2a78ca 100644
--- a/.github/workflows/Process-PSModule.yml
+++ b/.github/workflows/Process-PSModule.yml
@@ -1,8 +1,9 @@
 name: Process-PSModule
 
-run-name: "Process-PSModule - [${{ github.event.pull_request.title }} #${{ github.event.pull_request.number }}] by @${{ github.actor }}"
-
 on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * *'
   pull_request:
     branches:
       - main
@@ -26,6 +27,5 @@ permissions:
 
 jobs:
   Process-PSModule:
-    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v4
-    secrets:
-      APIKEY: ${{ secrets.APIKEY }}
+    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5
+    secrets: inherit

From 609a4d0093926211e671765dddf4666b3b897f89 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Thu, 9 Oct 2025 22:31:52 +0200
Subject: [PATCH 03/29] =?UTF-8?q?=F0=9F=AA=B2=20[Fix]:=20Fix=20linter=20se?=
 =?UTF-8?q?ttings=20and=20docs=20(#5)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This pull request makes several documentation improvements across
multiple PowerShell module scripts and updates linter configuration
files to adjust validation and markdown linting behaviors. The main
focus is on enhancing the clarity of function documentation and refining
linting settings for the repository.

Documentation improvements:

* Added a `.DESCRIPTION` section to the comment-based help in the
following PowerShell scripts to provide clearer documentation for each
function: `Get-InternalPSModule.ps1`, `Set-InternalPSModule.ps1`,
`Get-PSModuleTest.ps1`, `New-PSModuleTest.ps1`, `Set-PSModuleTest.ps1`,
and `Test-PSModuleTest.ps1`.
[[1]](diffhunk://#diff-d533085d002d932aa51be6a99b640827346d88c08512a00983af0c8dc7f529baR6-R8)
[[2]](diffhunk://#diff-d2465a6a821aebd39e6995132c462e41544ade7a93266e7d7eace6674ce350deR6-R8)
[[3]](diffhunk://#diff-a3b9ee16763d01dd80ff3c1869dec21710bc923448c25dde66d51401e7b885e7R8-R10)
[[4]](diffhunk://#diff-90b55db370b273157a3df0db4b895fca9740d25094d604894640fb0c5b220d9cR8-R10)
[[5]](diffhunk://#diff-488943d39ce767faa7f4dd40414635ec01da86c30b9ddd2074150da994093b9aR6-R8)
[[6]](diffhunk://#diff-097c3999f7001a5d9698d995993cb0a8b5c2f66962d37151d32ad40d4b6c08eeR6-R8)

Linter configuration updates:

* Updated `.github/PSModule.yml` to disable several linter validations
in the `Linter` section, including Biome format/lint, GitHub Actions
Zizmor, JSCPD, and Prettier checks for JSON, Markdown, and YAML.
* Modified `.github/linters/.markdown-lint.yml` to disable the `MD024`
rule (no duplicate headings), set a custom punctuation list for `MD026`,
and made minor formatting adjustments.
---
 .github/PSModule.yml                           | 10 ++++++++++
 .github/linters/.markdown-lint.yml             | 17 +++++++++--------
 src/functions/private/Get-InternalPSModule.ps1 |  3 +++
 src/functions/private/Set-InternalPSModule.ps1 |  3 +++
 src/functions/public/Get-PSModuleTest.ps1      |  3 +++
 src/functions/public/New-PSModuleTest.ps1      |  3 +++
 src/functions/public/Set-PSModuleTest.ps1      |  3 +++
 src/functions/public/Test-PSModuleTest.ps1     |  3 +++
 8 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/.github/PSModule.yml b/.github/PSModule.yml
index 9a91761..b37f9f1 100644
--- a/.github/PSModule.yml
+++ b/.github/PSModule.yml
@@ -19,3 +19,13 @@ Test:
 # Build:
 #   Docs:
 #     Skip: true
+
+Linter:
+  env:
+    VALIDATE_BIOME_FORMAT: false
+    VALIDATE_BIOME_LINT: false
+    VALIDATE_GITHUB_ACTIONS_ZIZMOR: false
+    VALIDATE_JSCPD: false
+    VALIDATE_JSON_PRETTIER: false
+    VALIDATE_MARKDOWN_PRETTIER: false
+    VALIDATE_YAML_PRETTIER: false
diff --git a/.github/linters/.markdown-lint.yml b/.github/linters/.markdown-lint.yml
index b9ecdfa..57db57e 100644
--- a/.github/linters/.markdown-lint.yml
+++ b/.github/linters/.markdown-lint.yml
@@ -8,18 +8,19 @@
 ###############
 # Rules by id #
 ###############
-MD004: false                  # Unordered list style
+MD004: false # Unordered list style
 MD007:
-  indent: 2                   # Unordered list indentation
+  indent: 2 # Unordered list indentation
 MD013:
-  line_length: 808            # Line length
+  line_length: 808 # Line length
+MD024: false # no-duplicate-heading, INPUTS and OUTPUTS _can_ be the same item
 MD026:
-  punctuation: ".,;:!。，；:"  # List of not allowed
-MD029: false                  # Ordered list item prefix
-MD033: false                  # Allow inline HTML
-MD036: false                  # Emphasis used instead of a heading
+  punctuation: '.,;:!。，；:' # List of not allowed
+MD029: false # Ordered list item prefix
+MD033: false # Allow inline HTML
+MD036: false # Emphasis used instead of a heading
 
 #################
 # Rules by tags #
 #################
-blank_lines: false  # Error on blank lines
+blank_lines: false # Error on blank lines
diff --git a/src/functions/private/Get-InternalPSModule.ps1 b/src/functions/private/Get-InternalPSModule.ps1
index 89f053c..04912fb 100644
--- a/src/functions/private/Get-InternalPSModule.ps1
+++ b/src/functions/private/Get-InternalPSModule.ps1
@@ -3,6 +3,9 @@
         .SYNOPSIS
         Performs tests on a module.
 
+        .DESCRIPTION
+        Performs tests on a module.
+
         .EXAMPLE
         Test-PSModule -Name 'World'
 
diff --git a/src/functions/private/Set-InternalPSModule.ps1 b/src/functions/private/Set-InternalPSModule.ps1
index cf870ba..e489dbc 100644
--- a/src/functions/private/Set-InternalPSModule.ps1
+++ b/src/functions/private/Set-InternalPSModule.ps1
@@ -3,6 +3,9 @@
         .SYNOPSIS
         Performs tests on a module.
 
+        .DESCRIPTION
+        Performs tests on a module.
+
         .EXAMPLE
         Test-PSModule -Name 'World'
 
diff --git a/src/functions/public/Get-PSModuleTest.ps1 b/src/functions/public/Get-PSModuleTest.ps1
index 0e9aacf..ffe3483 100644
--- a/src/functions/public/Get-PSModuleTest.ps1
+++ b/src/functions/public/Get-PSModuleTest.ps1
@@ -5,6 +5,9 @@ function Get-PSModuleTest {
         .SYNOPSIS
         Performs tests on a module.
 
+        .DESCRIPTION
+        Performs tests on a module.
+
         .EXAMPLE
         Test-PSModule -Name 'World'
 
diff --git a/src/functions/public/New-PSModuleTest.ps1 b/src/functions/public/New-PSModuleTest.ps1
index d4e6e26..1db3e8f 100644
--- a/src/functions/public/New-PSModuleTest.ps1
+++ b/src/functions/public/New-PSModuleTest.ps1
@@ -5,6 +5,9 @@ function New-PSModuleTest {
         .SYNOPSIS
         Performs tests on a module.
 
+        .DESCRIPTION
+        Performs tests on a module.
+
         .EXAMPLE
         Test-PSModule -Name 'World'
 
diff --git a/src/functions/public/Set-PSModuleTest.ps1 b/src/functions/public/Set-PSModuleTest.ps1
index a87ac11..23ec98e 100644
--- a/src/functions/public/Set-PSModuleTest.ps1
+++ b/src/functions/public/Set-PSModuleTest.ps1
@@ -3,6 +3,9 @@
         .SYNOPSIS
         Performs tests on a module.
 
+        .DESCRIPTION
+        Performs tests on a module.
+
         .EXAMPLE
         Test-PSModule -Name 'World'
 
diff --git a/src/functions/public/Test-PSModuleTest.ps1 b/src/functions/public/Test-PSModuleTest.ps1
index 26be2b9..0c27510 100644
--- a/src/functions/public/Test-PSModuleTest.ps1
+++ b/src/functions/public/Test-PSModuleTest.ps1
@@ -3,6 +3,9 @@
         .SYNOPSIS
         Performs tests on a module.
 
+        .DESCRIPTION
+        Performs tests on a module.
+
         .EXAMPLE
         Test-PSModule -Name 'World'
 

From 0266323c8602095fd1128be58c7a1f8999525aa2 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sun, 5 Apr 2026 02:15:59 +0200
Subject: [PATCH 04/29] Pin Process-PSModule workflow reference to immutable
 SHA (#6)

The CI workflow reference is now pinned to a specific commit SHA,
consistent with all other `uses:` references in the PSModule
infrastructure. Dependabot will automatically propose updates when new
versions of Process-PSModule are released.

## Changed: Workflow reference pinned to immutable SHA

The `Process-PSModule` reusable workflow reference in
`.github/workflows/Process-PSModule.yml` was using a mutable major
version tag (`@v5`). It is now pinned to the exact commit SHA with the
patch-level version in a trailing comment:

```yaml
# Before
uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5

# After
uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@4343d76f9e8c9468527175ea292092c2d055be8c # v5.4.5
```

Dependabot's `github-actions` ecosystem is already configured and will
keep this reference up to date automatically.
---
 .github/workflows/Process-PSModule.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/Process-PSModule.yml b/.github/workflows/Process-PSModule.yml
index a2a78ca..fc31222 100644
--- a/.github/workflows/Process-PSModule.yml
+++ b/.github/workflows/Process-PSModule.yml
@@ -27,5 +27,5 @@ permissions:
 
 jobs:
   Process-PSModule:
-    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5
+    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@4343d76f9e8c9468527175ea292092c2d055be8c # v5.4.5
     secrets: inherit

From e2c9613a59932efdc97765435c214ec47fbd4c34 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sun, 5 Apr 2026 02:44:35 +0200
Subject: [PATCH 05/29] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20[Dependency]:=20Upda?=
 =?UTF-8?q?te=20Process-PSModule=20to=20v5.4.6=20(#7)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Context

The reusable workflow
[Process-PSModule](https://github.com/PSModule/Process-PSModule) has
released
[v5.4.6](https://github.com/PSModule/Process-PSModule/releases/tag/v5.4.6),
which adds `pull-requests: write` permission to the `Lint-Repository`
job, allowing super-linter to post PR comment summaries.

## Changes

- Updated `Process-PSModule.yml` workflow reference from pinned SHA
(v5.4.5) to `205d193f34cbbaf9992955c21d842bcf98a1859f # v5.4.6`
---
 .github/workflows/Process-PSModule.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/Process-PSModule.yml b/.github/workflows/Process-PSModule.yml
index fc31222..9462763 100644
--- a/.github/workflows/Process-PSModule.yml
+++ b/.github/workflows/Process-PSModule.yml
@@ -27,5 +27,5 @@ permissions:
 
 jobs:
   Process-PSModule:
-    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@4343d76f9e8c9468527175ea292092c2d055be8c # v5.4.5
+    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@205d193f34cbbaf9992955c21d842bcf98a1859f # v5.4.6
     secrets: inherit

From 8032dfc14029eb6624ed375b6853964ddb531788 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sun, 5 Apr 2026 03:03:25 +0200
Subject: [PATCH 06/29] =?UTF-8?q?=F0=9F=AA=B2=20[Fix]:=20Add=20.codespellr?=
 =?UTF-8?q?c=20to=20skip=20linter=20config=20directory=20(#8)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Context

The [super-linter](https://github.com/super-linter/super-linter)
`SPELL_CODESPELL` check flags intentional misspellings in
`.github/linters/.textlintrc` (e.g. `environemnt`, `pacakge`). These
strings exist as linter configuration patterns and are not actual typos.

The [GitHub](https://github.com/PSModule/GitHub),
[GoogleFonts](https://github.com/PSModule/GoogleFonts), and
[NerdFonts](https://github.com/PSModule/NerdFonts) repos already solved
this by adding a `.codespellrc` file.

## Changes

- Added `.github/linters/.codespellrc` that tells codespell to skip the
`.github/linters` directory and ignore the word `afterall`
---
 .github/linters/.codespellrc | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 .github/linters/.codespellrc

diff --git a/.github/linters/.codespellrc b/.github/linters/.codespellrc
new file mode 100644
index 0000000..351e9a0
--- /dev/null
+++ b/.github/linters/.codespellrc
@@ -0,0 +1,3 @@
+[codespell]
+skip = ./.github/linters
+ignore-words-list = afterall

From 486bfb984e90c888ac23c8ede06f2de18be89ead Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 7 May 2026 02:05:32 +0200
Subject: [PATCH 07/29] Bump
 PSModule/Process-PSModule/.github/workflows/workflow.yml from 5.4.6 to 5.5.0
 (#10)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[PSModule/Process-PSModule/.github/workflows/workflow.yml](https://github.com/psmodule/process-psmodule)
from 5.4.6 to 5.5.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/psmodule/process-psmodule/releases">PSModule/Process-PSModule/.github/workflows/workflow.yml's
releases</a>.</em></p>
<blockquote>
<h2>v5.5.0</h2>
<h1>🚀 [Feature]: Release-triggering file patterns now configurable via
workflow input (<a
href="https://redirect.github.com/psmodule/process-psmodule/issues/301">#301</a>)</h1>
<p>Repositories can now control which file changes trigger build, test,
and publish stages by configuring the <code>ImportantFilePatterns</code>
workflow input or settings file property. The default patterns
(<code>^src/</code> and <code>^README\.md$</code>) remain unchanged for
backward compatibility.</p>
<ul>
<li>Fixes <a
href="https://redirect.github.com/psmodule/process-psmodule/issues/278">#278</a></li>
</ul>
<h2>New: Configurable release-triggering file patterns</h2>
<p>The <code>ImportantFilePatterns</code> input is now available on the
<code>workflow.yml</code> and <code>Get-Settings.yml</code> reusable
workflows. Pass a newline-separated list of regex patterns to override
the defaults:</p>
<pre lang="yaml"><code>jobs:
  Process:
    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@v5
    with:
      ImportantFilePatterns: |
        ^src/
        ^README\.md$
        ^examples/
</code></pre>
<p>To disable file-change triggering entirely, pass an empty string via
the workflow input or set an empty list in
<code>.github/PSModule.yml</code>:</p>
<pre lang="yaml"><code># In .github/PSModule.yml
ImportantFilePatterns: []
</code></pre>
<p>Resolution order: settings file → workflow input → workflow input
default values.</p>
<h2>Changed: PR comment reflects configured patterns</h2>
<p>The automated comment posted on PRs when no important files are
changed now dynamically lists the configured patterns instead of a
hardcoded table.</p>
<h2>Technical Details</h2>
<ul>
<li>Added <code>ImportantFilePatterns</code> input (type:
<code>string</code>, newline-separated) to both
<code>.github/workflows/workflow.yml</code> and
<code>.github/workflows/Get-Settings.yml</code> with explicit defaults
(<code>^src/</code> and <code>^README\.md$</code>).</li>
<li>Bumped <code>Get-PSModuleSettings</code> action reference from
<code>v1.4.4</code> to <code>v1.5.0</code> which implements the settings
file and action input support for this feature.</li>
<li>Passed <code>ImportantFilePatterns</code> input through the reusable
workflow chain to the <code>Get-PSModuleSettings</code> action
step.</li>
<li>Updated README documentation: new input in the workflow inputs
table, new &quot;Customizing important file patterns&quot; section with
YAML examples, updated settings file reference and example schema.</li>
</ul>
<h2>v5.4.7</h2>
<h1>🩹 [Patch]: Framework-generated code coverage no longer penalizes
module authors (<a
href="https://redirect.github.com/psmodule/process-psmodule/issues/310">#310</a>)</h1>
<p>Framework-generated boilerplate — type accelerator registration and
<code>OnRemove</code> cleanup — is now tested and covered by updated
action versions referenced in this workflow. The obsolete
<code>$IsWindows</code> PS 5.1 shim is no longer injected into built
modules. Coverage from the framework test step and the module test step
is already aggregated by Get-CodeCoverage, so module authors' coverage
percentages now reflect only the code they wrote.</p>
<ul>
<li>Fixes <a
href="https://redirect.github.com/psmodule/process-psmodule/issues/309">#309</a></li>
</ul>
<h2>Changed: Build-PSModule updated to v4.0.14</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/PSModule/Process-PSModule/commit/11117919e65242d3388727819a751f74ad24ea9e"><code>1111791</code></a>
🚀 [Feature]: Release-triggering file patterns now configurable via
workflow i...</li>
<li><a
href="https://github.com/PSModule/Process-PSModule/commit/3ed96da6f3c2f95b7cd770761f5f2f348020680b"><code>3ed96da</code></a>
🩹 [Patch]: Framework-generated code coverage no longer penalizes module
autho...</li>
<li>See full diff in <a
href="https://github.com/psmodule/process-psmodule/compare/205d193f34cbbaf9992955c21d842bcf98a1859f...11117919e65242d3388727819a751f74ad24ea9e">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=PSModule/Process-PSModule/.github/workflows/workflow.yml&package-manager=github_actions&previous-version=5.4.6&new-version=5.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/Process-PSModule.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/Process-PSModule.yml b/.github/workflows/Process-PSModule.yml
index 9462763..67f2c25 100644
--- a/.github/workflows/Process-PSModule.yml
+++ b/.github/workflows/Process-PSModule.yml
@@ -27,5 +27,5 @@ permissions:
 
 jobs:
   Process-PSModule:
-    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@205d193f34cbbaf9992955c21d842bcf98a1859f # v5.4.6
+    uses: PSModule/Process-PSModule/.github/workflows/workflow.yml@11117919e65242d3388727819a751f74ad24ea9e # v5.5.0
     secrets: inherit

From dde4b2421076894ee1a8ca2e951ef4317e313a89 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Thu, 7 May 2026 19:13:36 +0200
Subject: [PATCH 08/29] [Init]: Boilerplate scaffold removed (#12)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The module repository no longer contains placeholder template code from
the PSModule framework scaffolding. Only the `New-Jwt` placeholder
function remains, signaling that the module is ready for actual JWT
implementation work.

- Fixes #11

## Changed: Repository content

All template/demo artifacts are removed — classes (`Book`,
`SecretWriter`), functions (`Get-PSModuleTest`, `New-PSModuleTest`,
`Set-PSModuleTest`, `Test-PSModuleTest`), variables (`Planets`, `Moons`,
`SolarSystems`), data files, format definitions, type extensions, init
scripts, nested modules, script loaders, examples, and the manifest
override file.

What remains in `src/`:

```
src/
  functions/
    public/
      New-Jwt.ps1
```

The `New-Jwt` function emits a warning that it is not yet implemented.
This gives CI a valid function to build and test against while
development proceeds in #3.

## Changed: Test file

The test file is renamed from `PSModuleTest.Tests.ps1` to
`Jwt.Tests.ps1` with a single test verifying the placeholder warning
output.

## Changed: README

Rewritten to describe the Jwt module — name, purpose, installation, and
current development status.

## Technical Details

- Removed 32 files totaling ~660 lines of template code
- Code coverage target in `.github/PSModule.yml` lowered from 50% to 0%
— the placeholder function has no meaningful logic to cover
- The `manifest.psd1` is removed because it is optional in the PSModule
framework (only needed to override generated values); will be recreated
in #3 when module metadata is defined
- This PR completes the "Skeleton cleanup" section of the implementation
plan in #3
---
 .github/PSModule.yml                          |   2 +-
 README.md                                     |  41 ++---
 examples/General.ps1                          |  19 ---
 src/README.md                                 |   3 -
 src/assemblies/LsonLib.dll                    | Bin 43520 -> 0 bytes
 src/classes/private/SecretWriter.ps1          |  15 --
 src/classes/public/Book.ps1                   | 147 ------------------
 src/data/Config.psd1                          |   3 -
 src/data/Settings.psd1                        |   3 -
 src/finally.ps1                               |   3 -
 src/formats/CultureInfo.Format.ps1xml         |  37 -----
 src/formats/Mygciview.Format.ps1xml           |  65 --------
 .../private/Get-InternalPSModule.ps1          |  21 ---
 .../private/Set-InternalPSModule.ps1          |  25 ---
 src/functions/public/Get-PSModuleTest.ps1     |  23 ---
 src/functions/public/New-Jwt.ps1              |  31 ++++
 src/functions/public/New-PSModuleTest.ps1     |  40 -----
 src/functions/public/Set-PSModuleTest.ps1     |  25 ---
 src/functions/public/Test-PSModuleTest.ps1    |  21 ---
 src/header.ps1                                |   3 -
 src/init/initializer.ps1                      |   3 -
 src/manifest.psd1                             |   5 -
 src/modules/OtherPSModule.psm1                |  19 ---
 src/scripts/loader.ps1                        |   3 -
 src/types/DirectoryInfo.Types.ps1xml          |  21 ---
 src/types/FileInfo.Types.ps1xml               |  14 --
 src/variables/private/PrivateVariables.ps1    |  47 ------
 src/variables/public/Moons.ps1                |   6 -
 src/variables/public/Planets.ps1              |  20 ---
 src/variables/public/SolarSystems.ps1         |  17 --
 tests/Jwt.Tests.ps1                           |  12 ++
 tests/PSModuleTest.Tests.ps1                  |  25 ---
 32 files changed, 56 insertions(+), 663 deletions(-)
 delete mode 100644 examples/General.ps1
 delete mode 100644 src/README.md
 delete mode 100644 src/assemblies/LsonLib.dll
 delete mode 100644 src/classes/private/SecretWriter.ps1
 delete mode 100644 src/classes/public/Book.ps1
 delete mode 100644 src/data/Config.psd1
 delete mode 100644 src/data/Settings.psd1
 delete mode 100644 src/finally.ps1
 delete mode 100644 src/formats/CultureInfo.Format.ps1xml
 delete mode 100644 src/formats/Mygciview.Format.ps1xml
 delete mode 100644 src/functions/private/Get-InternalPSModule.ps1
 delete mode 100644 src/functions/private/Set-InternalPSModule.ps1
 delete mode 100644 src/functions/public/Get-PSModuleTest.ps1
 create mode 100644 src/functions/public/New-Jwt.ps1
 delete mode 100644 src/functions/public/New-PSModuleTest.ps1
 delete mode 100644 src/functions/public/Set-PSModuleTest.ps1
 delete mode 100644 src/functions/public/Test-PSModuleTest.ps1
 delete mode 100644 src/header.ps1
 delete mode 100644 src/init/initializer.ps1
 delete mode 100644 src/manifest.psd1
 delete mode 100644 src/modules/OtherPSModule.psm1
 delete mode 100644 src/scripts/loader.ps1
 delete mode 100644 src/types/DirectoryInfo.Types.ps1xml
 delete mode 100644 src/types/FileInfo.Types.ps1xml
 delete mode 100644 src/variables/private/PrivateVariables.ps1
 delete mode 100644 src/variables/public/Moons.ps1
 delete mode 100644 src/variables/public/Planets.ps1
 delete mode 100644 src/variables/public/SolarSystems.ps1
 create mode 100644 tests/Jwt.Tests.ps1
 delete mode 100644 tests/PSModuleTest.Tests.ps1

diff --git a/.github/PSModule.yml b/.github/PSModule.yml
index b37f9f1..21ca114 100644
--- a/.github/PSModule.yml
+++ b/.github/PSModule.yml
@@ -4,7 +4,7 @@
 
 Test:
   CodeCoverage:
-    PercentTarget: 50
+    PercentTarget: 0
 #   TestResults:
 #     Skip: true
 #   SourceCode:
diff --git a/README.md b/README.md
index 6319793..5146829 100644
--- a/README.md
+++ b/README.md
@@ -1,54 +1,37 @@
-# {{ NAME }}
+# Jwt
 
-{{ DESCRIPTION }}
+A PowerShell module for creating and managing JSON Web Tokens (JWT).
 
 ## Prerequisites
 
-This uses the following external resources:
+- [PowerShell 7+](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell)
 - The [PSModule framework](https://github.com/PSModule/Process-PSModule) for building, testing and publishing the module.
 
 ## Installation
 
-To install the module from the PowerShell Gallery, you can use the following command:
-
 ```powershell
-Install-PSResource -Name {{ NAME }}
-Import-Module -Name {{ NAME }}
+Install-PSResource -Name Jwt
+Import-Module -Name Jwt
 ```
 
 ## Usage
 
-Here is a list of example that are typical use cases for the module.
-
-### Example 1: Greet an entity
-
-Provide examples for typical commands that a user would like to do with the module.
+> [!NOTE]
+> This module is under active development. The placeholder function `New-Jwt` is available but not yet implemented.
 
 ```powershell
-Greet-Entity -Name 'World'
-Hello, World!
+New-Jwt
 ```
 
-### Example 2
+## Documentation
 
-Provide examples for typical commands that a user would like to do with the module.
+For more information about the module's functions and features, use:
 
 ```powershell
-Import-Module -Name PSModuleTemplate
+Get-Command -Module Jwt
+Get-Help New-Jwt
 ```
 
-### Find more examples
-
-To find more examples of how to use the module, please refer to the [examples](examples) folder.
-
-Alternatively, you can use the Get-Command -Module 'This module' to find more commands that are available in the module.
-To find examples of each of the commands you can use Get-Help -Examples 'CommandName'.
-
-## Documentation
-
-Link to further documentation if available, or describe where in the repository users can find more detailed documentation about
-the module's functions and features.
-
 ## Contributing
 
 Coder or not, you can contribute to the project! We welcome all contributions.
diff --git a/examples/General.ps1 b/examples/General.ps1
deleted file mode 100644
index e193423..0000000
--- a/examples/General.ps1
+++ /dev/null
@@ -1,19 +0,0 @@
-<#
-  .SYNOPSIS
-    This is a general example of how to use the module.
-#>
-
-# Import the module
-Import-Module -Name 'PSModule'
-
-# Define the path to the font file
-$FontFilePath = 'C:\Fonts\CodeNewRoman\CodeNewRomanNerdFontPropo-Regular.tff'
-
-# Install the font
-Install-Font -Path $FontFilePath -Verbose
-
-# List installed fonts
-Get-Font -Name 'CodeNewRomanNerdFontPropo-Regular'
-
-# Uninstall the font
-Get-Font -Name 'CodeNewRomanNerdFontPropo-Regular' | Uninstall-Font -Verbose
diff --git a/src/README.md b/src/README.md
deleted file mode 100644
index af76160..0000000
--- a/src/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Details
-
-For more info about the expected structure of a module repository, please refer to [Build-PSModule](https://github.com/PSModule/Build-PSModule)
diff --git a/src/assemblies/LsonLib.dll b/src/assemblies/LsonLib.dll
deleted file mode 100644
index 36618070d5c9f5131ec66720aa0565c13e86d23f..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 43520
zcmeIb3w&HvwLiYjIrDxcGm|ELl4+Zkp_7F41!*a@Z(8VsJ}7-jm?qOUG|7aSq|g_n
z3Mf#tDDnfvOHmL}<bvV@MXXx!Rj-c=7g6LE1wn=Kl#7Dp_g!o6bLLEv7OLLg{r^7y
z-?V3)z4l&vt+m%)d+mMp*)v(PZXa1h<iYj!+eBZ(oj<b#9v}3fI9B`h7~LQI$>^^c
zi+?hD)t2^Rs=JWiT*!8&TC-hU`JU9qT&mF9m1^%w&0DrI)tPV0HAbVMI?ejr`9zBi
zi>^05bb&4HFpWutjV7W`A;+h3A3lJ43fEy=M3s^@mEN48$v|TeA^(@-4YcdRE18u4
zm+l(nEPQ$n5G~`xVWKP85Cc92MUXe+TSOxVlpQA{MHFxq2Y@eh;f+1HOM8GH+7FPz
z#chS&?oW#7!p1_e(27ja?JyGDQMcoAeP*G%8Vk9OJP27=B4q>mtRN1UMKs4jbmFrI
zRDyLg$xAcZiTchX3hHwE_TWRvw~^!AlT9W~ML9HxlUWR*XF|UGFx<kvd<?f}!b*=N
z3Pl3-5nlmh-9?z)x5J<GWGL>LfVv}^EZT!R%n_#|JS7w&Gd~XZaOOP;BR!t0ldk|Z
zyYnXl8ShJ&=`<1=E39`)P;d$geAVgAkV1s&5D{wl+LILt<7jmh((+ZvpeM@s<uk~O
zW+=$|81NsHDroU~0DRV&o^(CeA=Ao-!FG27{W5{L?W0kS_Mq)MIWr$Xu}bcQ7*GBP
z@KA<)%=g{UzgR|ZfN>drVOrv+%Hbl8d?;KdkL7w*`4H$+b<_y?>f@%lGYPEt0;qR$
zzPXcOI79vk<IQw~G<L!cJ7rqCncS@2&22K%a5^8U_D=+Vm>K;B4?@=~#zKxXlS>_>
zS%Ap$i5RhmMW4al&-I%zbYWo8OI6G_LXD8GHq}_=s|_|*_-dn#Kto53>Z3-+s1Ez<
z=aa9tVRECQuUVsN=TAkwQ-`@()vOU_wGC1ct_TN9!xwy%iDyoMHCWM_HKHnXkXDK&
z!t1Cf8l0Ye`|Y=3%p`pETqufuj#FmppbAGD{i0^ZsDX}VX8bz~hy)t$pTPbx9lT*l
z?$3T&oI2FqB56;t2`$Y86LfS4+;W6%*kqHRI>84H3qEP(lFTiE;gElco6Rw%d-!$m
zE@ND^Z!db$_|&)>zfP1%s;yXCTao@VYJF;4nNjWB^s6X~WGJ9~T*Xi2lWE5txotmy
zPSBHe;>Zy4B|ULZ1S6K?L;WZuphqYgtR2%h9z(JA<i=XQ?QD!?QfA>kCv=$Up{Snp
zW_FrsconBERxFdggfBe_Ov3)!hQ@@ywrNtxUpwunsXPW9lJv*@^&vA|qv}ob*Up~g
z_1CVO2;wXg?{E_b;&2r+jgielB4*)tjuLS%`pZY(K$|cexJ?)$Xj7rWpzic!(V@PM
zbl3aDk(7h!@l%ujG%7?gm-!0A>?+aVajR78D(CnL<LoMI!}{9e$f=5CMwo>L(AU`g
z{VC}(6^GGl$tDl&LOU=ZY`+U-wsIWfQLl#pEQoPaRpx_JxVth7RGv><5{A!C@{1YS
z+N|72cO4xR*5;>5-H@+lO^9k>+<igV)1qydA>bUgkAxAw**hQ|aSI)=9_>(ys~)!r
z8X^hr(IIfR5pi@BYOyO7Ph%mq>ysW#LZ>4g_Z&5lY(}yr5}5V|8f{xnkAB@bW;)J&
z?tAw_-aDue=q(-x&2KGfUKVd0i99CWO>@pXrX+S(NP6-3lH$H(Fq0rFe;x$ZtVv^{
z<s6Fh<i~yRuNLvdXV1lYXn7M}=?Yldr!DP+rM+%Tj~P_8h6N|U;^aYDsPW5d2(vKP
zEO&t<YbJxfJkB=%fY(=AbTA%F`V)Q?YO0W6|471MwHq4a%_&fth3yXG0ZzevlZ?b8
z$xtFBJf>X--bf3Za6DYQaq4`)F=y~X2DS{>o_xj?c5?mN`3S<a3D^5@_25DjcCLL$
ze-c;op8!yE(;2rQAxyf?xYbS;*3QR7PAvDUxIUrpcj4arMF6+{zS=SQX=vd1=D8S8
zzS@&DHdV0o8ar9A_i7A52$UN%7G`XeMvj8L?<9@9%t&oSV+e@ALK=Hiu&BnqFIZ4x
z4+s|4*yn+rfLAoRy}|=;ut#zIiTKtuHy550Y%W+$B%|>td)GG|Col^c%l0(N<lnuv
zSlSK}Z<4WitR8W#Z187J)gi`lVr8F9KRSfSisq)j@e`Yl7d~0C7O#c*la=t5N{-_e
z6=2s&6+Z`=kDPg8_@GnK^zy05p&n62ZO=k5)_WZT@#N3*$UU+cEX^a@YWC1W@CfMO
z5kT-z!%)I>(p%er>D#N~v=4pbRdHJ8kXX6dPK0aI;9L<9>XYSMo0r1rPlWYEH*4`q
zt#kcZC&Ff$n~k`oX2Wh7iif6s4xO6$XPMx?Nl(PU>FcmY=2g;_j$53F85-SYD0M%g
z?z9c)n0_PTL^zkZKw10GJ`py@>?fI>YU~Iy)MH1D|F8EMB9ipk2|0ak&~9p&cOsUY
zKPV4gFjmAXrv2p~>+Q^-%uh_g!9x)%SQ)RZ|8E(J|5R6u$KyPiUGsm9D<<Lz?TYfy
zp&t``>Nz127?s9@aR{^O8MtA%C6n=F{bUNHZbx8HWmV}Jx@<^%2sa-49{N!sUX{jn
zo-a%pe=z-RPU%V1pRC5zS*_Q-!?6m)qaN119iYK;pRD>k36H(*bw6QvO6%T8?anA3
zUikqdh<VFY^A@zk(?9eW@90rJ-Dn+}-zV-~E{vPVPpYWi|A_~Si+5IN_aF-KYPa6o
zJObiOUmE)X&hw4KlEw1GSSHpN#~Otnhw>W$>{wxI!BsFvl~*|d)71~ADJGNpVFLob
zY&%hA)d_GP%nqzECKcBB0;g-Rz=}3+JNow9gZ7ax8H1n1^crUuEQrMw{Nzk@Is8Nv
zYhF8eKjN9*+dQ9*E;~BmOpg5hpRALxF*b_MRr!8-l1_T#UOY?t0C!9r3piWS>n7G9
z-6ZL06T?Wi*c)QvF=i&@uUQjDdjgpo-A~>S%6mZeh?2*8SAT!SF@?53VBnU;K*LA%
zVlIlsoNGiR!?kB7BZ;tD%tbIL!p@+uz2%Sn1(rX7`vThOX2QmV=ERzBMfdoU73hfy
z*(<{q0-;G*Q``H_?4>8N?`#rws%Z%GAj?b-NA=}3p(lgm$*Njj9ePsj+wy)e?{G(B
z6vXn@Og0%DC#YIv*9S~lg=dT^y)nz>a0y*r{1<SQ63#!#&aa^Kd(g7_7!tFP5VB+P
zxbIjzX4^dGFb^g>CXf4%#bd6`V;=KhvSaeVgXZ9EnQ!x0z&x1jm^{98EFQcqBlb9p
zc`%uqhsk4(Ux%Q->w{)>9-BKQ0^VQ5{*~%W6k?tz+Xqjf410cDH>Qh=3n51Bo}z>G
z?y1cOJB*;M&d(Zz4}8Yv!^Oo#4j;HtKR$3N;RE{&&}T%64;L5DcKE=%`tcd5`G95s
zpHU?~TwFZI;RB2H<Abdo(P!BpeBhgQySP{$%anb1Urp^U+rC{Zw8dv_Hn!bhXW@^r
zS*9oVjVi0*tv^?pL9l}=vl`+B?5TDa7o!Dfgv^ZN0Q_u==~(x_Rh`Frz-CfjHtaZM
zR?Tth^(#|)iNATE*Hw;QSS6I}g*d?PfzWQ~g+c8LCDfSKFFIJi5)Je_1`W4wjN((H
zXw-`%yM3x`SidrZ#-g71HtYGcqbIsL)8D;ikAQVS9i=bEyy(mE!=*3yX`0%K>ij?=
zTc<i(Um+>!3y&dHR$Eb{>PsQ}59=#qi1nTBxBJ`U=vx{_j=tk;eKFWXU&!mPucBdn
z2NK!(j<@v{l5%}j8S7grwDpy-%KCoX(bwzfTN<v8z9-xIF4g*ST<m9GMZ@|IB(n8Q
z+xiMgxxT85^(__J`btb-ecy8Q^*Q>M!h)mkDYm{VwZ0sK`{}D_Sl@v}w!RZ=eTAf4
zUscBXmI`fsCHAnsYXY`E_#J&q;b#&RzGxHd;JP4EF~3?(z8r_pc9m!KV%ybhu&S{s
zVfAo2pXKH$wa|7$#w8q&<6gj&EwzkSUamNExmltq3=dMbnZF1;(o0|;ho(QDO`zz{
z$C5agVOi=Ow`sqmR$F<>*lb6{5<QQp*R?TAG*U0SGeOhx<hMWoO_*7GwD>ww<ILUg
zeb0n3W*VLlq6sU^^j4<8$_SA>v>PKH@2mMe`{m$W4;^d*ONj^<MxtrOb3werw0dEY
z5e?SxOw{V(WPUmFhps8EuzBI-0lE<WG1{MBg+#>M$s+LRa~?3<R^ygGAAtOMEU!Wh
zk3ETpA-`Y0d!L}+u`i&8BEJ&ky+d`5ph5b=Ue93`9(+BQW^EDR`kf=_x1Q?)!Mj|~
zu^**Gw(3;dHyR~RT9;pghU`UP9O3GBUgw=EH0g^WO-g2Bsn6!H@|d;J8{9U82;HZ;
z2u@n^pFzqoAXNDro0}((Nf+$IRxTe8qMNa(v3fX>-VQCWZ>UuqjMg3x4!KRs{_!C6
zY~uE4$M9E&n?Hv<Q{EP-cSiEOfp;-n_92u(Dz`nF*%}mYNP5V^(}1{wH@_Z5{G7p$
zIG*b8lPxG>_kiQYy#T^Z9$mO}wl1wt>O|ZtV-_5EH<TY?nQS-(m0w-=WH?yw4{E=v
zkwK)+Z%m;}KCgU>+tm&=Cvv+|BM`Skw$9<q8QOz=zSIXWv#-<6TOYH%crC~?-qbhX
zA#1dQ=Q(dpHl%&~n`OSuhH#%Fsid>cS9<VpeH+%ma77sKOc;Uv@=k+jlFP@|fiv2Q
z!Gbq*g;j8KHSC+u0-;sAQ@tLj#`%SkPez)5jn+Xom^u_?Yx5qb?3;V|{i?+e?xFG3
zc*|O0)#~>#ac|8Ue#G?1`)=-?hTma-g*(lc{w}l>vrE66K`7uZvv5X2ovX2G>y;)}
zVI6eDdgr|;FKj|OeF0KRY0Au_At9?)zi`s*U0ezmISo9v2x(dim`)#t{biivF^^XB
zDAaxKv@YOoT>!0vvv`hrctfM%_f`SJL)#Mbkd8lR(vgh8OBI~E&<4E_f@F-9oxS1V
zoaer=$4c4UQ=@Y2aSme4CwiP`?Mkk3ys=!y<Ptp}=_->Ehi>ljwz6_do{11(9eJL7
z&Zck)lt>JJQ!#c5)9Vl(%2fGe(1w-5eigHPYIHsQWY|~l_c>A9wp)-=r<CIMfY^rV
z&u)Zm6St1}&F=ES=5UJ;cllhI(=MLzLTSWPUxK8G7$E`jAiPI1eh(hj^#K%?$LmX$
zH(-vt6fR)Tal7F{`V1H3&}kyeo_A3DADMUdqWZg>ci48$`eP^S<UI1o`h?3*7u^Qi
zXYkN{D93X%;`Lrkhh~kyG@_l3BA6FE>3Ps6()>Xdh25x$@J$xv+B+p@@01U0MENKM
zJOoE6BAN4WL`u=iHftJ-9~{a`V|fv32>8++xbwC+NB7aZe!GHgycoG@G%J${xp@WE
zvvTRIkcTdYQqzv3f0*@O#QJB>;iv}vaXN|BSL$>^k~}y^G8vU$n^*h6l*aTQ!V5>w
z(IK$nh`1-?Q_t8X`ChsNVHJ;(gWC^BPQ-q^Tn)?HL1pEkWmd*axRRWRJHoA9p0$H(
zg~H915TuHnz3gtKUujp_7u3YRgH^~Q!Po9ByIDSI7RPs<3oA>fUc${^;98l4TLCr?
z_f6c#Q*<a@V4Qb&r+OO36=sJ@hk{fseKJV;4-=m5KSW6QLO8R`Q-4a_mx7eOVv*VP
z05l|#g}{8d%IZZH974akRK8@_uYelcP_A0ZhYjK5Ub-BnIpdxBV5#)MYLK2_A6&u$
z&jAQG4;|PCkjp-TK1fO<Gw1_F{3o{NyY2&3JKX$buJzCB19@hXF{A}#&iB+$jQd8j
z7<~GQm!bixA8L?|e&EmLDtoZLu=#LbV6CW4qx%ByZNYSg>I<xs%%OW3+VKSALB`{I
zxGyqiUxwv5PLA?mylglCpES%gOt@^=VA)|z+e0d0<3Pq&qqg3B)pD0L8_%Z^$X2mX
zc*>;8@!Yl6<%OHQew9VsO;DvYC;z>)I0+ykEfrZN!!BiO=(4o{w^vqxB9|9+Aww2*
z80d1InRT8HS36VeXg^^60E10UK9+qtM+by(b)@+XwA~+&jsGYGd11!uw^3{7V-yl5
zY&prj19z;hh$H#AxDb5#n2-ktCZP-N8yb_DZC2smAWAPAKLHY}@JK1+8p-&TlabkF
z6%LoMF01hS5_X|gc)o<KunMn~uz6PDjS_ZRu(sA&N!Fi)rK&zjWT|skygalQg#k;i
zK{Gf<TeBt-@XM=)_q>JueaAKv)LFC<(nQ2(=b2eO`}Tik{&&#vr??Y>#>s<veixE7
zPEJ?a>7%T%&NsuQbikFabfr_S^du+U$BwTh@o`U^<7p1XxWaT-dX6i-(3M{8N^f$~
zeLQ~ByP<p^kE#iC>~#!|VZ$6A=iSFl_Alq%M>P-1!Oq;jyJzKFQT<)6S$Ldcg~V$!
z)<=(1gKCkF!GZkxs45zCi(S?=%mZPB_5T-p2y+ZL$<BYr_akLvJ?x4LoKD|qGX=kX
zG2|U-VRh9$tG-gT!;*%|Bd88GtSi%D(Pi7A!Jk^P8Uxas`mqEMygcIIkWj&4I``Z*
zyk!zr4SsP;>=B9ooQ%#MkA78gM(y(oofuGyL^~`A1G8ABngxfKtwikj%<H9a2Ip?M
zdm8+gT?Y0U?`4<cCTk_vzTVkr!|ZqB$Lq&%rcUz<^ZHsonV?R-^d5N$;^K?uvaZM1
zbEWXbnPSls+jK^aYiS_u#au*l--(Z`4Kmf5kEi;gj9GJ$n#OrzW4j?16Pm&LV2Z)K
z#<2gq2Bp!?8ryE}F49dCUxMGN=L_BXH{RYo3WjzKQ%0@yR@l2CVA*SA?w!I#80N)3
z6zrIAnR(3mBiUKrcg*sOb_)UfH5PQo)5WsXx^E98*4JD8mJRRY+-j@es^R^}<=Iab
zzp_RUaha%TrLRC)hqPAWvwEJK&vtd<5F)@o5{IyWdbe>1<Ae~2dHk`#wY?RR!Ru}|
zQip52P6a(;E9mRT9<R!vFZ58C$7cq2jQet#h<2jDm25dYNVDMdRX~(*uE((vUe2<k
zX8Hj%a?sa(;$JDyE)ZIK?eInRnh${C4!n}YkcF3uUn{<lt@(a~`JTgC$d^Krkf}%=
zzGs#3ecsJ?S%1EW#hULonJ<<%nlG>C9lmPawoqv01++Ap+sv_C@)64sW7NA{1chV0
zr`9~a2w{WrfS)NIFwU{wF>4-QIu?&+n+FUr@EvnmTkby=55yy-2Lj4q@5}MDso#C2
zzX~25;!iF=#G^Hh7kiZ)K^IFu)fhww;blIC(YO|V&YqP*^}dTHVQLbLm-`nTH4!_p
zB{G&D!RsR0The|^M{otKyt&H)(dLIxSJi8m{){%?jT|+XoK%`i8t{zG9<BZQgJ`F7
z$b@$YQY_}aV~WYFQx$c5JN)fQSYI<gWE_CL|2bRq<yEd?b!?3@6{@CIS9Vr8?)?O6
zV<7am5w<GWDEblZb0^p~JjqMT!cp6RK4m~lJst+b{af~3SIZ!b4$oCBbBwh4*sOHR
zToV--@LYxI%sp4t9A~ad>mHJ+CTi|tBd4!McOeYzk}z})5ZAoC9=s7Ccpmh^6>5(2
zd^gq28<VT<Krp~ZxkE^qyZWM|R_Rd=ZBTJ?alig)&~b7vB8g$g$-P)B8Or<nt<$hX
zbe{D%o&K3UAR+%mX;+}m5^1-Jsd$Nynd@p`ebiDhoGppj53Znn$r6vkmV72@s_|^8
z8)qR3m*xd)V0%@ET<h+Ty+EYByf_@L7Kby@Z4-XWi$m!^>CGC|n}yfmL29q-IyW2c
zSM@-}-`GSAxT@$<wl0pkY{=>KW5>4PJJNzcuZyeFkC*Xr?cq9m;jTRA-K@$JJGt`E
zx$N_Cs^SHiiv5jLg^j<>+$>oahe3l0Do&SSR#A@};%A6!>Y0PT1j*YAu6c>eWX|O>
z1m*r^vKHVn-s|jF4^rZIX{Q2bzcTcZDl3~`Rok$vL_4H^8;g%X{XW)r!b#>%tN{28
zt+iVch0=FxdzIlWZ2YEwFAav??BA%VpD)tSAiuuCl)LOb)T}|kSHq_NSctj$oYUz)
zqOv9x+8N-xg!R<#_;@TdDBc(x@cf9CXMsS%nJQJFa^#(mUVB*l{Knf5h{2*)ZxF&T
zPbGbp+Nd||cYjb7Tm$LffN3-n^^a@tjn@djDdYEG`@n0t@M5Wctd#%CkrV7gJ6KKB
z4;KP4JBz=_jIH2sA?0MLL%VoU`61N7m&?b+J^2rF((AME5)lH_`vVV<>w&1#tRTXp
zY^dQEPew7X1%Oro#ka$gKJ2LYCa8Cbi)hkLIbH_)S=0wz5l`@bp@C_s_z~R3Rp&p-
zSO~^kY^fuhwV}pFI~kpv@>{acQM0x&Vd0FXZ1y-`XXYJKWv7sj3xye<<kYqJOUMm(
zn!fxEkg_|)&cr^#KCa@9m3|rK#p^yf-N4_)!P;1rA+B%*tlydBhP9e#hm%#aW|dbH
zdCsm`%M`2BduFUtXr=Uvu&}V1KpA|!US2VxpFG%@_xm>0td&jm7@0ei?{ch=u>her
zLSwi8VcA5h?7o(#B3ECVVk4V<Kz4E>nQ99X(cvC5k_q8k_*1}AByxXrg5P<^;)i-r
zGlb`{HI-&{C4MDBNjNo#EqnF7U~x_n6wQpcJZrQHro2J5rA0Ae;ot?HA=K{#T%>y+
z0~$|Nc=-EY+%H(*@O$0T?*f=RxfEYp|65}K9W%7i%tYu(znT6Edg6%;hiv^WatLN)
zInILdU=jiWVKV`95Z4d;=cAMP2NKw*9O@|(%)~NhG+%>cb?7&EpdfRIXoB@!9mv#}
z8HcY0@>hj-<5|gL)(AmO=r>$TljD@@<$Thb>&VF#{_%#;ZuGmyto@r*$efOH&d67D
z(aBt7?&O<dJ5;lM@-(}KS*55{Eg4`BswNYPm=(n0fbV~CTb|$_N8oYBO?%=A^)ng;
zt)3E$v)YQ43{H-w+@1-;i#I_boC7lX9T}bP*sJ#FWUOGhGo)K4hw;+|(o3O?zgmvW
z@GljNL-}rQw+|fCe}gU)T)mn`f$ml4#~ZucFB>3-$D6s6%h9iIt{r+BJNMAF!%j0Z
zbMa-!x0+(eZXAuw+PCoC^*Y}$>H85#50$>RFzY{|{lFt>$u?DTf&tbh-in!LD1R_%
zKAC6P>0vZ&MafUr!zYxVus-k;Ecwg)geOkemM3o6u*!_ejLFPy{tVFOzcOex0QNFC
z3IJaUfhDZZ{NOz^5MXzof;7B`v*0~{0G%d4X1&mvJ2SYK&Lr$cXcPzHI?Y?ThPjLL
z<dDMdMx@}VTo<ph5Zp(bg;|cIp|&J`GsHfnbTM~vH94Xn3kBt=ry|d+eM@LE)8Uw$
zp**#Ti_D#TQ%x9VGsdsQfU&9sj}$^xQJnPwGtGU(&MNE+^BmoV+bn(u;|<UaT@iBW
zHc@nYv!okmDBUJ0-T0<-8(}k+!C9*+K>;D$DHUzq*k@QbVPCC#K#X&A2!`kgZRr*$
zGyO{bPD7eqi&XZ}AvH`Q=OL8jky`STN!_bzaN@+f8l1EFK?1Gi&vG~iUjc>EMYbbI
z=eiGOOxR{yM|BC0Vd)w*hFzuH3@(*6IwPEYPR&6)w%0ggPK|9IlBKcD{$YkP$!a-Y
z!(*GhQBK*&*bbm6?y)_Y=~cv@isS^J%%yW7M~!VR$Hc@DyQa~T;eU126VOyH;AnXo
z?&(d47`rhO@zCIc8k?e;BNP{u^j|CbGnLYx#g_Eve5F6XN@D$4z-|VjKc=lR{b3PX
z|7l3V7#ssj`g8f9`f~y6KOJ|aKQ=^Ie=ZRHIU)LUK}r90qCXcZ{aI{Df6iC>^KLim
z&jNNc5dHDuwM_prm|ofcOe6>B&*g*a&jqaiOx%_JSj@8iTp;>$LiFc?lK$&Oe=bz|
zv)GdUoUiof2Qt>51?*-Z`lncbnzQokIR-`rfB2bY+myzp#>q{SC&C!~D?1&40Zb}m
zFT;2IaUYpPdSy?cy=!xkDfYpn3$Y>}d)`X=<pLF!$DVcGqIoEL4){%6Hm4)Mk%{ra
zFf-1t{Zu%JeEO>~nGd3}^f|bYB&bKDk?|7lV{qNXIIg9*&|cAzaZGW9(IoFtxjy(p
zTXn~B4xf!d&gaQ^tnZUiAAMQiX?{+(c(+EA^i3@2eDo=AYY0Cc<72o|;3z+*AC>eG
zfsYBzhrE}e?s9>rN&YL|^#LEvuXr5aq4_S|WBBmh9Zrvp^u^DiiNgO&lK&YW=N}F-
z42Btg7#u=0v*K3NYLHqJrF6Q`*9yGS!;}wrS?ALPo+3Hlid+}-Vcuqml^#xqeOp2E
z9pr>)VuX2KB&7=lzUJZ5B3kXEyG2&e&zv6#F#M?Gd^)@ot$tn7hoYQLM!0m2Nc=^J
z(+>ikLsy1)zoi#2L??N^7WUD#LixPV92FRlwtPFzwRTmC6y$S%@b6`DpBuD?7f2P?
z8uJA+kiS26t&s(05n~Ss7SPzw1&cD4s-(L@*BUuI%p$e{3wxPM5)ph4us!~3jZS#e
za56?$(i%ue0qYR#69L9*=vu+{2N@ed|03Am!i<f?`6I6PF>p!YdG!&&wg8)t9q(sE
z>&u|ad`i*tQq~17jJ-g8Xi-DOc<+4p>?>pe!<37a&S=<`v9W@s>21L-5NtAq3@*Ez
znDTV|oDpNEOW7GT-0=C{Z&U_W_g!9*1l$u~xG=)-gF%Lq@RJ{_`?8hEK#8&jIll`t
z{9uq_wz9@mIzmbr?g=o=R*t}AQtPdSFOLe31$;49iJW^P;{z7;R!l(p$NsT_)9Blt
zDS*H5Gu$4TA^GzF{~S0AaFOTiz(jh%T!QpR%;kVXE6xKP;bm^?;$s1yMq3Oz<X;Xc
z-v`7u&}c2-&BUesDSh;ZXcqYfv6MR~2lyoA0pF5ZH3ru@$6yXCBt001?I;~AfA=x+
z_XN&Op)=@4dd71lXl~HheSv)elctR3viA?25&Z<LvskdJ0vC8@8eZC^F>i>myEXQa
zIAe!2c2&hNV9#sp<B?AVyflVG9qj>615vDAu&aPo0$Z#wy4-UoY_?Zp|0b)SS!220
zRn*RtDcz#5Kx_1FP(H0Omgl1jIbhPmbYFn6O9i`%w)yV|<zmEjNT+*E#;V3E?CT~|
z-lDOm;t!xKg+&R=>kS+T_z91Cf?XE;9<U8q_;T4};U57Tis_%R#T7pVHVaDw#$Jy-
z0_+D^11Rf02`qw%ma*S@o(=?Pp27kTRXiC8QJaH3kJAjh9PE`qgg)zFZv~=sz`;yR
zEzdhxBv^s9x<~-eWU!K&9PFfEoEAD*9bPZ>I9OvaNqZe^O0bH)rm-JY%nS~pUpm;l
zU^TtwU}pzwC?#{}je#FktO^dL84k8CIE=P9SX*#7UEyF`gCpo(2iq1LNrxP4S8x=)
z;b2z<PogTULSQpU*c+^+S%O^^2w67<Q?y25bP+6{q8^R4S&Z!y?4VJo_yj1wrpvw`
zxGgxE9?{tF%3;PBdP!rWt=ocQD1yZV_uoEim@$_43+qG&jh_eZ#LMz?b=en#_XNjL
zkH!{PrfEFgq_H*D{lW2czsCN}dMJ1@{Y<cf#@B-n1LFf)EMcnW=fP8`PGiB!$FP^S
zP-98!*TC8|w$pkBKk(Ei*g@kxo)>`KtINg)-v~C)BO04t`F608-q6@0%M-#*EEY>F
z?`u{?=u~PF?4Z#Y91840UG_|%E;Ny@&{(E&LTD0wR%2&cjld3S><+6rG?@+ycF=es
zFbh~EFJ&O%&5CnEQ)!CE)>qCnPNOv%>$aAMPNN=;J!P#Aolg4%J7}1dt-!t|*u%y_
z{CLqc8w+kmM43j1R9Ub+l6IASC)gD#QT{mC8=CIatE<=@n&DuNM_rh4kN>JtnbBqT
zhGyE726;Xln&n`N1Gk1|JJ_S~TSIf`u+oKIjouNO%MHipVehNaTSM~{LJ#9q{!Gl1
z5#D0Oc)u?&GdQ1`1XFQo0j<(yd(4@^1$3!kSJ56sqO)kfE-RRy3!P>2^cKu7h0dm*
z=(3TXuZI>pWg|TYLrds4Qg(&J)+O|N#ZzN%IoO9mdDASe%2EGNXem9RvEO=r5n4u7
zv$^ab@yJ;&uYQSsZ!|`K6<R@yrR*uABDxrRsBIeii}6R4^=Rxd|LdWZbc4ny_IhX)
zeNkg4ht2SLbWpH|#e(P4OAdBxXbp{=!_t3myc(?xucg-ndzjds>u8sl`(fhNuA{vg
zW4o-Qq4T-k!^GaRfzk>Ku=i}Bg&Je;*+3gK#@@4mc4&;f=e@L7W9&UGbhpOXds^s_
z!ic@6h5n>5_MR-gr7`xNRyr3?1FQ>sPaAb>jJ+pE`viL`SV*Mti(<FyvLA)3!<*=^
zU}`qpLY30>+()(Hc3P#e-+IP{FQUB)L!562chKDqRvYf5LxLS7juTz9cOmO?ka)az
zQ)H3Cc*GTG-`NV|QQSi##hnfkN2zUelg2pmT}t-~rh04#J>g)thIUe533K5dn;hOn
zQv_2zwwsn~jC*W1wP}odY&YG_4?23DzMLKr?E0Z|qSL~c)0dWU8CzlqR*MG(V@sSF
z?xVoDT*kBL-0&Wnr7+A7=Y-!+Yc%#y#q#hKbcKVh4_`^QI9N7(75zXk)uIp3YYuj6
z=!2A6&JwsqTf<k=LcvsvuAwfCaf_~@%QVI<x`u8MOj&R*J*Y9Z{D&yAf_bW5*+*>}
z<9_%E-K{b1ha2cMjj`o#q**Ju9$Vt#@J)2BgWcr4nLh7eUivs4a<FaTPtf93T#s$G
zD|`#>)7Wo4?+bsDexNYe?3(bc^oGVBs@NCaPczPwdMNvN_%`Zsu-n3)qWunbclgtE
z$icoCzMbB1um{6;P~B>q%Xh+`p>s9%P{pC}owUWlei8mG-QZwPgzuue9qhN^&(SX(
z?D_EL=_LnyC44uHJl~e^R`?4v#lft|J#?X9%GUo%eH!C_xR3U0j4l5qI=F_p93-~<
zmudf6g|X$oN^fb5$HN2EwvNlL3Vhw)j9(4CMKI+(-=H5j*sY-l={3RFdt#Aq(yH}b
zPkGNnbgjnNdmf@sXpFt*A$mkGwK6_HhjkgxG6yKKL2=<(=G)XP*j0$1Rgv$|D#30H
zyq*{y`7UkIn3)_N`5x`k^*DZhpY~~trGKA3t1*`TeY#)QJ8X`L{E!X_rabwF^qj`n
zf<GqDds!D{-JeiOV{Ff#(hQBUJ%3JXG{*M)ciJkL8sU%9C4yZQScP@@qjb4odjc2u
zPmVlFA5>-V`I966L7x>&S@1D>L}P51$JBXhtUO+gHbj0&3ol^Jt_pl7I63k--5}VF
zw7Ozi<X1GSMasall72&n6h;Nl>d2GyoW@3nR!9DmA{PoJRfg6_4pY5gd+3(<>d5ct
z0>N&iz45ll)6}N1|EdW3pP@dDooaPNo~55TSRwKUT9hSxcogG#h}r~u%J@EZf?uH9
zHFiln4eYZUnQ{-lS;J-D6YQzr3s|YXKtEBK@e!OlEtQ=bZwB^=F8gt0d*lVGX=N^I
zo_>L91yj;rpc%T1r5~X~8e{24=-f>u=|^a*#(oA}j?mQ_drq)B1yh<GDbwr-*=4NR
z5xQ4V8m!q7dR1e*f;d8N3Z^tWLe-m<)~wl!G*n}(*^9JUVPc6F%jA{HSl)}&t?RM8
z7wJnHV|g#qHw07iUM!RM68%zBvb>k*<Sn9$$a|?wUa5@by+lolQrh<t6*b24UZS0X
zDS0oI$$Ob@(v&RkWqMX&BJbrgd8IOz_cFbt>v8*DrpfKfW-RYzBn?Vdl;Eo|-Y0y+
z;+!#IhC8J6T0f_+^_wVtNpcQJ&i^cY)vCnP{j)IzS;J>V|Npss*5OFph9-7%RGRH(
zr`f_PjrZVX^aiy?I7h+$wl(P%qp}ib!m+z(NZQnCH@B?xPPU@dQ?E*IJ`&_wZuouZ
zY0~|oty`{2vn-qcKhmPvk&-4#&(8!{lh0tkXfR*0dyr}Vk@WFfq%^rpY;sp{a82Cy
zKR&mAL{E2Jw?uauTRN~tV1OmvH2>VRTdRL0eSEtOEZyS~pOnbsPP@JFAJNBM*KM&{
z@dTxh^7j8SS(EcILM>V(<Md(~DPNWGWkdFy9Uc=j85xx-KPmcu9e!@o(^6M)yGuBf
z(iROBx%?Xiybn7N2C#P-#14HB`}sla+6S>49K_Ch2ycMG*hPxqL`ed_l$1bz0=WtN
zV0416$9{hd*Uh*>xUR!>J>I{>aNUe6gzGw7*W;K#4A;%LLb$HObv>lTaNUe6gzGw7
z*Fz@nzs3Q*I8)E*(SUfL0$7P17KXD0E)uw0;97xMf$e}puu5Ud?E?1*d;rj(pG!Ju
z%!rPrIG{npj9+0^A8qh#S4B(Xlaam;>zL8TQp{>2sWCc-CSsRiF-;TtI_ff8@a}7I
zAP3kRV|Yt=E8w$ua&8CBXK1@nZlK%zX}V41wt>%c)B*l)BIhpCXY|ldAghN~`Kyc$
zV(C}Q&hQUK!>gs%9wS&W&Det@X}nu7Bie#pg8!(P47kca8E-*ePwYYIuLJu8e$3b<
zG`oammzI8)dBnKhxY1K*-faBVGr_zM@N~0H__v`g`^+nZ@(SU(SJHbWeS@TLkn}B*
zzD3fz1YRMs_6oc~;4K0lK-=;D$Dq&`tjCdK;Lpr3{I=xR5$}9(ju&4)WZT{?Hosr2
zaX&a$p_H|{T`YFB?6BM}wI0;g+w9ryx!T}e^gTvX#burc#d^2P4$JNIo#2(8+v&$a
z=1^DhF{B@l-UfJ&{|kWJYq!&*@f<BOmV1U7-=>v;H$C?m&v*>)ea22B2w0g6djEju
z)6syinD=UwE(83n=X~V+$<qdCCbt4|EB-*Q1v&kUz#ml<y*Gn?pOoGN_@jzXdLK7>
zWA}LviX9G$|2$=U-t!nr|26z3;5rYW*yj)QdV;x46K=~i&srbznF9Dw#dP1xLirct
zPo4{X_lX^D7I>e*Pg6Gw<opl%4vB>y5eq*-LC=+*rv*MQnmjL>JWt<>zvwf}Hv@0_
z_86z*i6LnI(5UstP42Y-{=MK2VEn%VSV{i{SVeCE4kZKc3PzF-uuf>wLQ^j^O%z5x
z*8iZKA^Ec;f1c!DDfw3m{FuO-1>Pa>E`eVb_<+Fg3H+hJM+H7EaGb&X8w7R={ENyl
zIsb10M_VuW8xg}^0Zh`tNF&}g{seF=Jr9_nKLbuCGunvniZh%m@EplsNde@nmz-9C
zTd4s#Ma1hy+DUEER(d};zhB^|1zN_n^r6^Tf!`JQJA<W<H5tw|KLOY(@cjZmE%3Vn
zpR&00DJyJT8B0Y!O7}!BtiYS$=&a;N$%>_he3VX&%^LnuS{vIxk|_@eJUB9GyyEX0
z#r$WT^lQKiPvUf+!2JRbNd94gvucG#V4uMK0uKm0ERa%6vtQr=frkasXwFXwoF(u=
zf%^p>5O`Q1jS)(Lvjko!aKFF<0uKwMu|g?umcR=I?iYAK;9-GOCzJxeK!<3QG1?f1
zAMlxE%rO=k=NapbON|d0pD-RYUNhb@=9xM3Ci717^X3oD|1f`LK5IU2zG=Q~Myz4h
zNmjiz)tYZDwJxyQt)12t)(zGtt*=@STd!MQ&q<y-&pgisp1q#0c>c}vsOM?VA3QN{
zvv<4q)86lSf8%}L`?B|KZva1kFx)rJH_JEQceZbtFX!v^UFLhAZ=dfb-zR-{`kwIp
z*;nbW@sIVN;&1d%_BZ>_^!qUX`te4Q$5jyXUj(BmirJ87!UV=t5_4}AM%56^z15V$
zb5pP9eOQ&%g%~~%XLwD;Re=8zxdw1^^utch5$k^;y;W#BBex*^)8Kx<bj6*3zlkzD
ze(5W5uJw@rUcjf#`vJf0e*o~O!G{1pSjlo9uH@1aOPe@dV_}Wr#Xl1(4L_hC?KfeC
zFklQe;4{Y+fRp&(H_qKA0awEgSR3K2fPs@*HAt_;s=%am7{exAhLa~Ic46`N1gH<|
z1e|67H1W4E#sa>da7Yz%>dAmV!8sKZyDRwf2RJ>@0LtG3n)E09#+FHc#p=Su+iXMu
z@*4QtOXN3B2aMwV4zw~57ifraCSZ;69>7t?Y`|J$E?V$3eoZC_ZqoptLj(!ZAMu^g
zAofz;1DF71f{qxc0KQ~o0ADj20ADvw1$@Jp2*?L;67&}2Cb5h=h1+dr07GU2V8lEX
zFlJ5!tTZPBCd{eukZMp?(NIuU(Qr`0XFyp+CxNnxQlPA&F`yhm<3Txu(x4nd6F@nH
z>Onb#8bLXPnm{>(CV{e=P6K5%HG{I6rh~GYW`MGqW`eSsW`VMr=74fIe(7xn-m(;F
zH(i4@+f8&U_7M-$s}wQ5V%%$f#eC5GuK7*tKdl$6A)cRkzwZ0C?}xr$_@485`go<P
zJ_c^*;6w+`Lg^g7&GCPf3;N~Z_r~!_z*~~ADz7Vtz;CKCdie7=)&YEf#(1vcX=AMQ
zw2{VjCa%@E3b^*-y2JW2rSWA5FP@a~nX#$8Q0$pGwWS41%b7*KE$!{-$ZqV&T{w{z
z&F|{%%oQB$;@)hJjm*t=bmUrl+VfpPh@y`6p6zq<o!!|&uHdTNlV@ykd$9+%88bUu
zS{Af-Wji{y16!3ZNtoFN>62(tSI^{0G^4vc*P3I!kY>Fm(SqKt)(a=mIl1ktvmL#;
zbF=LQpo`|UixSzwc3^Jyz_xDdW)_pn@+Y&1)21l4xb@eed8$h~(*4UPo;EOVGV)kU
z+#JPEA4rCyY%`YR+j={4GigzAX?7_N>Tl!5w6xITV!mr}`$p<4w&n{RNEA2H%I(FT
zTxa9F?OoZ<_EsA$S-#kKR<0{oK+)!0Ps`liLLt}Hvn1P<-JEM%wWW~Dwk>LdVjV3l
z?Op9X?b!||Q*$1KRpX*k=8WTzx%**;R=$z%(mVA7a%RqKoZZ$&v%9-<U2TiH+MsE!
zjaKE=2|g!dhE$)qwWVcFwskAc_AO}7b=cJizE#YfpD*C8T`sqEasHBAp*35~&E6q-
zbMswA`0M#w+Iw=v?rdvL%(AGf*pux70wd^DG2dH2##y<Zh1uekx%eZRLb)=#Niyf<
zd*S~!rW6!xW$(tK95}Sg7U#P*+v$0^*7nY9hmFq3=bbeBsGSezvy)2B;#^ldjA3Ug
zas4t`PQNTIu3s)o?Ux0C?wlewvNKmK!bu1{vLf4s#G<Zk`K`E>h9kPhg<zN!yYodJ
z{A@O*IU7x<TH3^BV#cM}&Kxc4QZ`-Oj)dxTNusjcJ2-!CM;>t1_U>HCw+nW!ZOazg
zvt2!Ndpml1b>^}{8;6cXo4fLb++1`#Ey#8NYBzN$*{Jjd^TPIX*=dkK{K)p?XkKn(
z@8-?9!kj|>5^2!N9?oWm70QCbXUv?~(gJ_cMHrfm=N8(xG0s7*y(3qU!H0~t**)-z
zjlC#3tGC^SDN$^+62$=Vr6TZM-Ck@jBcEL?<~lcaY+u#h<L0uc2VohJRdijFZQTNM
zmKZse3fZ<?XST4lRJ1BvK(8&pUzE*Vl6M!_dM#{k!`LiUn15+cuB(VJU&^xCFMttN
z=L&-tVlZxM-`oo=2dz6VS8Oe`cb6B=%WcY{yO*HFxk5?af{yIwVhL5|7rrZU9ob7I
z<tn$;JGX#P+uBpAXcx@QcW*DWZ{Ff6LeFPAXBP_D?SqkHPU~_Ntmy6PY46O*T-VdS
zv7INrQZ<;jMS>U=ofJD44{(()Zl;n>z@!d4bc!b~&8u=|h8U#~_%eo1sbEF+5{1l|
zIk}}}8&4$c=FWI11#)Mi_-~BvD{`IrZ8?Ir++X&X)V6BWeu98b(tH)>Xm&?O{t~##
zHswYO3i(c5A|{hyE2h!8_IyE`@`cW9kIscvbPD#;DJNEQyyE!Du}SVNh&r2T4kAfm
z`^sFl(7J_|WP7$q>_Vj6jAVzp<u_g=(N0Bn33ob~?`}B@^D9Q-sx8^BWrg{?{vqTp
zMr3toaWgn}v~_gQvQ3-d607nY0MR$f5FD`wGlS%FZAq|qNCJ(KI~rr(TM!I7#n~i*
z$*)sepE!cERxVxLO48Z+_AY5R)amW)5>s&`>1r!w=v1qskPg$a6a$;uWhR#)Xm|Np
zIAf2+;EuA)6}e4%xk%!(;A-PoNw~13`JR=%-QD>D;_CcMTXPa3O3}HLHM_7GlYLhY
zuUAXCn8+ZzZCN+RM<`e-vFS@WnidmDPbo83CR2RRZdggn{}bbhqtvQA>G^L_*QPwJ
z%N6p}b4lJ-2#$0yCQ<k>&vS4M6*-k-E$!tfI+$ze5_T?~WcSj^MGItPA$V?UZ$o`G
zoaXelcQEG2!0=&wqq>P#uy&YOWI4Vnk7Y*=vn=I%wgAFiTNV{D(0j7*FIKlVCv&$1
zQ9LkcIS$Gd)Ob<R0V9oC@-l!*8TN7o6QOOALHnq*kg->^s#P<we(uqQ$KYX$z@*%d
zxUrS1G`7l3g73;4yEHPl<`7tPnj3<Zxvk&4_AFK}#h&)oqMc=jNVZrZ-@P(d*w)^f
z8&IsKy<EX5S2H#uDjq37uKI6f&-M-=ELFx?kuc#G@enYjrKJadPo5-F6^WySBVtga
zl`?Ikm2yh{|93nFXfG(rpmvrQgDJyp;>R1+<GjvTCgA|IGBXU!=a@J!H?M1*n=j%k
z?rM0f#;Q;>kc9No7S6)5vq&wxJjL3o(4$O=Ru<{J9<2O$4M}Q<kbW*(w(%l#yW+|#
zeXN{$Xi1U>mL%Y4a)%(fw=p5N0yh@Eva20WM#xf+d~Q?QE(p(RT#>^JLTVgvBwy6o
z-O=9Kj;!vM`IqW6WJ%vIE9eCktwKF4tf-)F3p#svB*WoYHs64iJ&kaNvax=4;0&HU
zU1<3e2otdNT?AlkV=x>)nyHzulfyRVrfuzoe3zsLX|;Z`ZFIHX_CtH{>IdF;ve|LS
z-i46OYW(t(^*af2lg^kqsimb=J&{WX&&^}ii0QJsw}+Nsp|mu2sl#v;r}1o_zeGs+
zVfa!`vAGn22ay6giu1F)N>#~Kd0DcmEU5}dWhdn*TjX>%Kl`x5F|rlc@hn|(I@{8v
zoPTJ<FDkCUUc|Dlj{hO~+%Ya4c&zCCDj7pvIU8G4#5~J;CEKw#w(>mcq8wd{Uv14%
zE8bD&sEtxcZJ{iF87`~y3fKWm0ox=L1*CJR$CP>GrKlZPH}#^l5nl|9V%LuRDeR7>
zh?dL&?IzF_aG#Exo!Ix?jXVFF?Qm2jlU*e}nz{*j^{6!wcbYi3zQ@r9KR^BMS_sX9
zh#qJ~4u52R6I$DWRwM1l3J_^(U`|_c<>?Z@6w*1ocfLg0)+XAHfu5}I82sem;Bw0~
z&C^DFb5L161sUzyzAPL1ESo=|XR?s{UR+sF;`=7(ryTC(T$!c^6dS>XOO>ABw{mcP
z+)o=p*@L#^gx6s8S*GgqZDJd?6L?M?oM#c-3gQ==!F@o>-j#LUfk)@cG8sAaRx31P
zPiAjrncVUe-l4OnHt1BFVC>yo#=Xgw+zyQI?bHblY`0EaUC84R(MX1Pp1b$m@>1d{
z7mM$7K?||W$%9*FBP8ZU0^1W7?7Mz&LM&iFuvth`v;$1B(u9gUl(;hn3blu08)|OG
z)gy*rGjekgnT1~p-OOcMG#55O7tCWzKw~c+Od~cA8zu{`oaS0=!jiO<4D=3A@er}4
z*-qL9>Q>}-f<p)Db%Tm&Bxv;hcSy|1@KJiQ9HoB`Qfy0@e%xSE*(rLVB@YRqI(;xI
z4gl{ke9s@O9tYPvxU&@o4!d%W-H@LbhgQAEE(fhA56+i|B@emM!0$qu-57P|4_1fU
zz=Pi%*pJKQyk)RW2L_Akb)GO%R0;<??05(=U$&lVYZoZklJ?|+g&a!QYq&midvA$r
z`H=tnIJ<d(yGv(#=>5Gq+x5Y<rKGd+7H%Q8=<ns-2CMYykPZIXe?EWr=!1my|7;07
z>N#G4_u79pZzoP{UWK^TE^&=Ln`28}0=mj$4U~TtVa;xdF(uFA(vs)3i@rQ&*q`0L
zh87rvFFdiwV%G^jm6RJW5tmQ7te;u{k#{FARKh&r@RYNj3=7{E2=b)OV~s2>ElH!k
zZ<Lzkc3pcY*)!BT4JZyLZYNShkcVS0n!tl`F@A?@8GhSA(Qz>8!aH*w!sW(FfhLPf
zt@+fP&kfuJ!}D5*ClVEkjJ_*Z0xeDSog$1`^7P8_iwV_4sumDxvB;L)jH`g99V^O9
z#}t-L_VOu(e&u;a&2yVTr<S62pQ-sn&1&c^ZxKAmyMY&8fcUNmU{;{Y#~FX*bO|g7
z>_Ja3&gR9R7(?SgQ^8RQ+X;FcQoI~*L!BmESULN7!2r+jvQJTzTj<oPaARC&BGFlH
z<0~2VJjtzmw+5$a9BsJfvE0L+omG@|jmgtbtfn*K`mUXergh<;S}Czdv7ho9kpsCR
z9O!NKv|n;{UZ-A)5Xo!IHtAfOW}vg!#$-og>Fg}%XjfoSa&0#%AHcS8-gz2wn&}FM
z{~XRP)AwC>d=uKF|A&ld;oE)DB08@Z#^vsy8uf^<5@}xH@x08dOd3(@ya8p_PIz`b
zuIWUrAGmSMk?xsieWmj+Pkk(R!C%Nqk>N=hM!*XYAHvBP1JgGoaj}s|`H)WZ?Ex9*
z^nHv=apD8`NbiuuZX*^<k>n@Io1#SD^^qZo?Z%M!S~HPKq?joe7-kaBnWixczeN%R
z`E61P(%lZJl2@m0X?3etw<cC1-gn<nzc(>*NMey0OQg&p@g;_(5w9RgzbCPLNc=o5
zW(9DI`87odTB0OLNyD#6Bx|i?LBYgw(5gz@Km!eoS$-pcE9Ui^W@47lZze`2M*937
z%QQ{c$O?cc;PqR;BYv$AYlW;pAU4t;6tyfDWW_*WngPEz1{;_r4qutESitWKSY}Mv
z#?TdJED#v(4=J7k0|BlX;3_byq$m30iRG57R3r(VrG&a9L*+zT+G+Xy9>}gYPxjXY
z5=}8BMe$c0Kx==ZW&(e;2mSiP2!1vx7VrCcqVLhlkQ<4n{1u710cx<O@=4T9@K@??
z2*gyA*n+03O2E_v>?GVtG45)+mlG-Ug6Z+Y9i`=_z^IR#7w;7$q&q-(njnwrj3^UD
zQ8(TjQ+*WgRrNq**9vitjVMF2v}Oi%o)CZ)GSEqiyXp7CYnK?NKcw!uAR5&LQC$!X
z*%ITu0aXVHRf%(iT_~h$g><cuE(ip4K|mJ-a5yg(lR*cMgu@2dXgth@`r!sVIPGy~
z-=k%@Xqg(8%DSr0tVCS}baU4R-Fd>-i}v?jUyIYn=qxvd%}6?VnBN0U29eG#jGooZ
z>^f!u?vL?9iRC_=pv4EnJBeOr6CrjaQdp9K-!mpVf=d5E(gC;>j@%`U8klY{fj+;*
z8mZ=`#k^J`&Aph8`~6YLh$_E}njDo9SsZ(e#^BQ)GR$bg?~V5gm2(S_3C{sR)aC#2
z-fDkX=mKa8`$7N}@By~~6T8Pp0Ow2Nz42a@fff7}hqOx!LZ%vjA%{Uo)Ir1xffCtK
z?p$^^0m({)5B7nRa2gdx_yQ6ke*gi)LL3SpVD{aGh{Z$pWo3tYsc0qY*$(wV#4=_S
z@3nm5gMvljbCQ75sYJ+w1o#+H9ymN0n=~K91JsTR6e<A$=H684_h~+26vQ(yh*tQ$
zQdhSW!A}wKI30;#$%aG7<94&l^Q^+$rUVht>(HTaalaoS2DP}?x#bC-DA))H@RG$I
z_<(s5#dvz*1l-8)LHaHni8p2LLJCt9rXY^bW*}H;n1NBu41*h;1O-NMbVsu>!o84&
zKM03kd1D3PuTW?qgT)NaWw46Dn!s0gY*;;P%HgZ~_T$VwdHRTMApC%u2>^V>%Gndi
z!;dKj{qR%EgJ1vLU5~CAwf)&UKX=8)PpLgCKYG(+H|~2Tc<ptKo_nkQ{ZMxM+edz|
zXwAKkUvbJS4?X$PZ|^w0^R8)ah3iL0r)~e<h`T0tH}CGe>C)fby!4mfeCs!#>3i#r
zrzSiZZ(08AUC%sy-lwO|dbRWC?Y)&}U-7LsKDWYu$A}&E-@In)sxRNuQr!RGl<PhT
zHK3rufVJ~5?!gz8$b;`S;a773Ow2>Rcm!7^t}4ry7-{-qxXlW};40eqwUf#H3r5UD
zpZh|lFAB0LxKfsH6ecw37_M4}syYU6N`)Zgr*YNeY6=lLU1s$dl8A7U_F*bWjO67;
zVitpu*r;Z&vKZlY3EZNN(`g3v44N3!$%;f+z(;uvfPojQ#N5G{8DuC!N${wH<2T??
z636eiX#yFliB!m;-~pLPAq;DR0B|fa0O6v@6|RCu9ULhc|KOtt;=Mu<aww1j2h8l6
z15(_KW}d9;I7-Fhm9Pb%gsgZ~Fr_5LtF%STkXjCz@hT>XqW@A9)nvdlSyYoD$AtM1
ziy{z&1}lDy2b789y<x?X^O$8wScWu9V47t}vqTP)1>zA+f|Mo+XcFYGRGzMQlIJ^1
zlYq~GJ&{5eRUqu~xVF6nJW=2Q9Esn%<4X8}G_JjzdqE-vvjZE%3|KKyXZLnp1?RdZ
zr7*MB&WAJtl5)f-*p0FgUIm+pI?<=^j>?hDGHtU=1B=Nb3QH;eUM-i_+okouu&Q$0
zfN?CcfG6seyD@9HsbNGR1?FdhCc8RE)o7wgS4T>Djf@Qm*SrohLJkE|z_EVQHINd1
z;?GSikRvq47AqjQcyE(<ui!i{C7P7KO9nJz6`KT3;Zc*Al9+-Zk(j~?!%ewZ{4y0A
ziFqhdr(&><xEQ!P@_OJ3fk4VK0+smZuQU*-6FDq(vC@?}pG#Hu#H=*o?<P^qlg2p5
zck@_v{5b#&0OXp!wDJ_>i>DxOBtjO{0!7NprLh2iC5k^MagbeQR-a$Ub}x0Ewvm^a
zMFVtx4t_WiPkw$W&L^Dl?E=oK!w>yAC-G9>xhu6I-<j=7@mu$;`E995O%tc!hcykV
z+cb4*Tdwu=T*KsP*{Kavnon<Sm^P(#T0`5WNlm9uo7U7cv9(P}n1o*p#XtOg7yS9K
z#-;ODIp-Yf_4%_i@vEX!p>eFrDdLl&9og-CYBj-iQcg(<v=a;(rxh=qZq5ui6plmV
zqN|&fU%L*Z#PM;;7&P8Zsa|LgLOX3BSANGn2<4=KT-AY)fwVZRPUsl*!B3NV<k%Sf
z=fu?HFP$><^EW@dp~?7e`sNLPEv$IE&iC=>ZkrJM*z%Xh9KL7a_5S#EFR#D*nuVjc
z&&uEa>yJM8(72OUeC*OOuYK>DuWbA33kUZ6>?8E~SBz(uFW;X!{VNxq@~5vq@Vimd
z9^3TN%nPmWeE-j%&irxrSDzbw<<(z3`I(P==$gkGF8f;hU%yi~eT>okVDKW==X&Eq
z@~a>`SB`{=Yrci+HlEVwt-R}ohWGqAuz2nbTQ>iB*T$c|%`KQWeM5I4&&Mx{8!pLT
z!iS`ApoGsL<qI3Mg&R7vI7MIBAV-*r8|2i?2Au3`(B(E=V|N>T^Z&ljEeA?Ee}&Vj
z67EiY_JA8}nVT=n>*!d5g97R+2f3V_QDmC8$AL$soBIEy{~ik%V#J|DedV<|W)j|o
z56ow}g}BxnCVWeWG4)AXh=uqb*h*>voR4oEt)xY=U)_THQv5x$WkUE(&x=QS;amEC
z5sxJKTaa?c%;J3WNHPHC;WEILH;flx$C5X>7GYPB&n57uj=0t;z1LVoIlo_5o6SN%
z_j*1EF$Q!hZFdjk)Fw1dXt(+|1sln*0sl5G{>_Cne(|Ta!?AfRpE0hoZrSVHF5AIO
zXMdV86&a4^^H9R?x_R5ZyG+l;$mb2|#VFx{-c(j^HR|z6j#9fOVNbQmx$p!2_?{Jh
zSr#1BD^lLn#y8mkl{V%48?lSaThRnrwWzlk{5MMtZfQ4OtFVTfv6YX_c4>WiUW)F*
zAY36<Q7;YIy4*)wk+%(Hlc3#1`Qx?xr-|5xB^j!>_@y$xO65AXMTurfJC<qryr0YM
zu=|U#<F`lI?OfF7mrK2}AzHEmL5p%bPZ2wp)AzUbKwER4&ITubLBg+_)r+fls%QJe
W|JeNi79tS-19t5H_xb;w1^zb?vlht!

diff --git a/src/classes/private/SecretWriter.ps1 b/src/classes/private/SecretWriter.ps1
deleted file mode 100644
index 1b1732a..0000000
--- a/src/classes/private/SecretWriter.ps1
+++ /dev/null
@@ -1,15 +0,0 @@
-class SecretWriter {
-    [string] $Alias
-    [string] $Name
-    [string] $Secret
-
-    SecretWriter([string] $alias, [string] $name, [string] $secret) {
-        $this.Alias = $alias
-        $this.Name = $name
-        $this.Secret = $secret
-    }
-
-    [string] GetAlias() {
-        return $this.Alias
-    }
-}
diff --git a/src/classes/public/Book.ps1 b/src/classes/public/Book.ps1
deleted file mode 100644
index 8917d9a..0000000
--- a/src/classes/public/Book.ps1
+++ /dev/null
@@ -1,147 +0,0 @@
-class Book {
-    # Class properties
-    [string]   $Title
-    [string]   $Author
-    [string]   $Synopsis
-    [string]   $Publisher
-    [datetime] $PublishDate
-    [int]      $PageCount
-    [string[]] $Tags
-    # Default constructor
-    Book() { $this.Init(@{}) }
-    # Convenience constructor from hashtable
-    Book([hashtable]$Properties) { $this.Init($Properties) }
-    # Common constructor for title and author
-    Book([string]$Title, [string]$Author) {
-        $this.Init(@{Title = $Title; Author = $Author })
-    }
-    # Shared initializer method
-    [void] Init([hashtable]$Properties) {
-        foreach ($Property in $Properties.Keys) {
-            $this.$Property = $Properties.$Property
-        }
-    }
-    # Method to calculate reading time as 2 minutes per page
-    [timespan] GetReadingTime() {
-        if ($this.PageCount -le 0) {
-            throw 'Unable to determine reading time from page count.'
-        }
-        $Minutes = $this.PageCount * 2
-        return [timespan]::new(0, $Minutes, 0)
-    }
-    # Method to calculate how long ago a book was published
-    [timespan] GetPublishedAge() {
-        if (
-            $null -eq $this.PublishDate -or
-            $this.PublishDate -eq [datetime]::MinValue
-        ) { throw 'PublishDate not defined' }
-
-        return (Get-Date) - $this.PublishDate
-    }
-    # Method to return a string representation of the book
-    [string] ToString() {
-        return "$($this.Title) by $($this.Author) ($($this.PublishDate.Year))"
-    }
-}
-
-class BookList {
-    # Static property to hold the list of books
-    static [System.Collections.Generic.List[Book]] $Books
-    # Static method to initialize the list of books. Called in the other
-    # static methods to avoid needing to explicit initialize the value.
-    static [void] Initialize() { [BookList]::Initialize($false) }
-    static [bool] Initialize([bool]$force) {
-        if ([BookList]::Books.Count -gt 0 -and -not $force) {
-            return $false
-        }
-
-        [BookList]::Books = [System.Collections.Generic.List[Book]]::new()
-
-        return $true
-    }
-    # Ensure a book is valid for the list.
-    static [void] Validate([book]$Book) {
-        $Prefix = @(
-            'Book validation failed: Book must be defined with the Title,'
-            'Author, and PublishDate properties, but'
-        ) -join ' '
-        if ($null -eq $Book) { throw "$Prefix was null" }
-        if ([string]::IsNullOrEmpty($Book.Title)) {
-            throw "$Prefix Title wasn't defined"
-        }
-        if ([string]::IsNullOrEmpty($Book.Author)) {
-            throw "$Prefix Author wasn't defined"
-        }
-        if ([datetime]::MinValue -eq $Book.PublishDate) {
-            throw "$Prefix PublishDate wasn't defined"
-        }
-    }
-    # Static methods to manage the list of books.
-    # Add a book if it's not already in the list.
-    static [void] Add([Book]$Book) {
-        [BookList]::Initialize()
-        [BookList]::Validate($Book)
-        if ([BookList]::Books.Contains($Book)) {
-            throw "Book '$Book' already in list"
-        }
-
-        $FindPredicate = {
-            param([Book]$b)
-
-            $b.Title -eq $Book.Title -and
-            $b.Author -eq $Book.Author -and
-            $b.PublishDate -eq $Book.PublishDate
-        }.GetNewClosure()
-        if ([BookList]::Books.Find($FindPredicate)) {
-            throw "Book '$Book' already in list"
-        }
-
-        [BookList]::Books.Add($Book)
-    }
-    # Clear the list of books.
-    static [void] Clear() {
-        [BookList]::Initialize()
-        [BookList]::Books.Clear()
-    }
-    # Find a specific book using a filtering scriptblock.
-    static [Book] Find([scriptblock]$Predicate) {
-        [BookList]::Initialize()
-        return [BookList]::Books.Find($Predicate)
-    }
-    # Find every book matching the filtering scriptblock.
-    static [Book[]] FindAll([scriptblock]$Predicate) {
-        [BookList]::Initialize()
-        return [BookList]::Books.FindAll($Predicate)
-    }
-    # Remove a specific book.
-    static [void] Remove([Book]$Book) {
-        [BookList]::Initialize()
-        [BookList]::Books.Remove($Book)
-    }
-    # Remove a book by property value.
-    static [void] RemoveBy([string]$Property, [string]$Value) {
-        [BookList]::Initialize()
-        $Index = [BookList]::Books.FindIndex({
-                param($b)
-                $b.$Property -eq $Value
-            }.GetNewClosure())
-        if ($Index -ge 0) {
-            [BookList]::Books.RemoveAt($Index)
-        }
-    }
-}
-
-enum Binding {
-    Hardcover
-    Paperback
-    EBook
-}
-
-enum Genre {
-    Mystery
-    Thriller
-    Romance
-    ScienceFiction
-    Fantasy
-    Horror
-}
diff --git a/src/data/Config.psd1 b/src/data/Config.psd1
deleted file mode 100644
index fea4466..0000000
--- a/src/data/Config.psd1
+++ /dev/null
@@ -1,3 +0,0 @@
-@{
-    RandomKey = 'RandomValue'
-}
diff --git a/src/data/Settings.psd1 b/src/data/Settings.psd1
deleted file mode 100644
index bcfa7b4..0000000
--- a/src/data/Settings.psd1
+++ /dev/null
@@ -1,3 +0,0 @@
-@{
-    RandomSetting = 'RandomSettingValue'
-}
diff --git a/src/finally.ps1 b/src/finally.ps1
deleted file mode 100644
index d8fc207..0000000
--- a/src/finally.ps1
+++ /dev/null
@@ -1,3 +0,0 @@
-Write-Verbose '------------------------------'
-Write-Verbose '---  THIS IS A LAST LOADER ---'
-Write-Verbose '------------------------------'
diff --git a/src/formats/CultureInfo.Format.ps1xml b/src/formats/CultureInfo.Format.ps1xml
deleted file mode 100644
index a715e08..0000000
--- a/src/formats/CultureInfo.Format.ps1xml
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Configuration>
-    <ViewDefinitions>
-        <View>
-            <Name>System.Globalization.CultureInfo</Name>
-            <ViewSelectedBy>
-                <TypeName>System.Globalization.CultureInfo</TypeName>
-            </ViewSelectedBy>
-            <TableControl>
-                <TableHeaders>
-                    <TableColumnHeader>
-                        <Width>16</Width>
-                    </TableColumnHeader>
-                    <TableColumnHeader>
-                        <Width>16</Width>
-                    </TableColumnHeader>
-                    <TableColumnHeader />
-                </TableHeaders>
-                <TableRowEntries>
-                    <TableRowEntry>
-                        <TableColumnItems>
-                            <TableColumnItem>
-                                <PropertyName>LCID</PropertyName>
-                            </TableColumnItem>
-                            <TableColumnItem>
-                                <PropertyName>Name</PropertyName>
-                            </TableColumnItem>
-                            <TableColumnItem>
-                                <PropertyName>DisplayName</PropertyName>
-                            </TableColumnItem>
-                        </TableColumnItems>
-                    </TableRowEntry>
-                </TableRowEntries>
-            </TableControl>
-        </View>
-    </ViewDefinitions>
-</Configuration>
diff --git a/src/formats/Mygciview.Format.ps1xml b/src/formats/Mygciview.Format.ps1xml
deleted file mode 100644
index 4c972c2..0000000
--- a/src/formats/Mygciview.Format.ps1xml
+++ /dev/null
@@ -1,65 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Configuration>
-    <ViewDefinitions>
-        <View>
-            <Name>mygciview</Name>
-            <ViewSelectedBy>
-                <TypeName>System.IO.DirectoryInfo</TypeName>
-                <TypeName>System.IO.FileInfo</TypeName>
-            </ViewSelectedBy>
-            <GroupBy>
-                <PropertyName>PSParentPath</PropertyName>
-            </GroupBy>
-            <TableControl>
-                <TableHeaders>
-                    <TableColumnHeader>
-                        <Label>Mode</Label>
-                        <Width>7</Width>
-                        <Alignment>Left</Alignment>
-                    </TableColumnHeader>
-                    <TableColumnHeader>
-                        <Label>LastWriteTime</Label>
-                        <Width>26</Width>
-                        <Alignment>Right</Alignment>
-                    </TableColumnHeader>
-                    <TableColumnHeader>
-                        <Label>CreationTime</Label>
-                        <Width>26</Width>
-                        <Alignment>Right</Alignment>
-                    </TableColumnHeader>
-                    <TableColumnHeader>
-                        <Label>Length</Label>
-                        <Width>14</Width>
-                        <Alignment>Right</Alignment>
-                    </TableColumnHeader>
-                    <TableColumnHeader>
-                        <Label>Name</Label>
-                        <Alignment>Left</Alignment>
-                    </TableColumnHeader>
-                </TableHeaders>
-                <TableRowEntries>
-                    <TableRowEntry>
-                        <Wrap />
-                        <TableColumnItems>
-                            <TableColumnItem>
-                                <PropertyName>ModeWithoutHardLink</PropertyName>
-                            </TableColumnItem>
-                            <TableColumnItem>
-                                <PropertyName>LastWriteTime</PropertyName>
-                            </TableColumnItem>
-                            <TableColumnItem>
-                                <PropertyName>CreationTime</PropertyName>
-                            </TableColumnItem>
-                            <TableColumnItem>
-                                <PropertyName>Length</PropertyName>
-                            </TableColumnItem>
-                            <TableColumnItem>
-                                <PropertyName>Name</PropertyName>
-                            </TableColumnItem>
-                        </TableColumnItems>
-                    </TableRowEntry>
-                </TableRowEntries>
-            </TableControl>
-        </View>
-    </ViewDefinitions>
-</Configuration>
diff --git a/src/functions/private/Get-InternalPSModule.ps1 b/src/functions/private/Get-InternalPSModule.ps1
deleted file mode 100644
index 04912fb..0000000
--- a/src/functions/private/Get-InternalPSModule.ps1
+++ /dev/null
@@ -1,21 +0,0 @@
-function Get-InternalPSModule {
-    <#
-        .SYNOPSIS
-        Performs tests on a module.
-
-        .DESCRIPTION
-        Performs tests on a module.
-
-        .EXAMPLE
-        Test-PSModule -Name 'World'
-
-        "Hello, World!"
-    #>
-    [CmdletBinding()]
-    param (
-        # Name of the person to greet.
-        [Parameter(Mandatory)]
-        [string] $Name
-    )
-    Write-Output "Hello, $Name!"
-}
diff --git a/src/functions/private/Set-InternalPSModule.ps1 b/src/functions/private/Set-InternalPSModule.ps1
deleted file mode 100644
index e489dbc..0000000
--- a/src/functions/private/Set-InternalPSModule.ps1
+++ /dev/null
@@ -1,25 +0,0 @@
-function Set-InternalPSModule {
-    <#
-        .SYNOPSIS
-        Performs tests on a module.
-
-        .DESCRIPTION
-        Performs tests on a module.
-
-        .EXAMPLE
-        Test-PSModule -Name 'World'
-
-        "Hello, World!"
-    #>
-    [Diagnostics.CodeAnalysis.SuppressMessageAttribute(
-        'PSUseShouldProcessForStateChangingFunctions', '', Scope = 'Function',
-        Justification = 'Reason for suppressing'
-    )]
-    [CmdletBinding()]
-    param (
-        # Name of the person to greet.
-        [Parameter(Mandatory)]
-        [string] $Name
-    )
-    Write-Output "Hello, $Name!"
-}
diff --git a/src/functions/public/Get-PSModuleTest.ps1 b/src/functions/public/Get-PSModuleTest.ps1
deleted file mode 100644
index ffe3483..0000000
--- a/src/functions/public/Get-PSModuleTest.ps1
+++ /dev/null
@@ -1,23 +0,0 @@
-#Requires -Modules Utilities
-
-function Get-PSModuleTest {
-    <#
-        .SYNOPSIS
-        Performs tests on a module.
-
-        .DESCRIPTION
-        Performs tests on a module.
-
-        .EXAMPLE
-        Test-PSModule -Name 'World'
-
-        "Hello, World!"
-    #>
-    [CmdletBinding()]
-    param (
-        # Name of the person to greet.
-        [Parameter(Mandatory)]
-        [string] $Name
-    )
-    Write-Output "Hello, $Name!"
-}
diff --git a/src/functions/public/New-Jwt.ps1 b/src/functions/public/New-Jwt.ps1
new file mode 100644
index 0000000..0538ee1
--- /dev/null
+++ b/src/functions/public/New-Jwt.ps1
@@ -0,0 +1,31 @@
+function New-Jwt {
+    <#
+        .SYNOPSIS
+        Creates a new JSON Web Token (JWT).
+
+        .DESCRIPTION
+        Creates a new JSON Web Token (JWT). This is a placeholder function for the Jwt module.
+
+        .EXAMPLE
+        ```powershell
+        New-Jwt
+        ```
+
+        Returns a placeholder string indicating that the function is not yet implemented.
+
+        .NOTES
+        This function is a placeholder and will be replaced with the actual implementation.
+    #>
+    [CmdletBinding(SupportsShouldProcess)]
+    param()
+
+    begin {}
+
+    process {
+        if ($PSCmdlet.ShouldProcess('Creating a new JWT')) {
+            Write-Warning 'New-Jwt is not yet implemented.'
+        }
+    }
+
+    end {}
+}
diff --git a/src/functions/public/New-PSModuleTest.ps1 b/src/functions/public/New-PSModuleTest.ps1
deleted file mode 100644
index 1db3e8f..0000000
--- a/src/functions/public/New-PSModuleTest.ps1
+++ /dev/null
@@ -1,40 +0,0 @@
-#Requires -Modules @{ModuleName='PSSemVer'; ModuleVersion='1.0'}
-
-function New-PSModuleTest {
-    <#
-        .SYNOPSIS
-        Performs tests on a module.
-
-        .DESCRIPTION
-        Performs tests on a module.
-
-        .EXAMPLE
-        Test-PSModule -Name 'World'
-
-        "Hello, World!"
-
-        .NOTES
-        Testing if a module can have a [Markdown based link](https://example.com).
-        !"#¤%&/()=?`´^¨*'-_+§½{[]}<>|@£$€¥¢:;.,"
-        \[This is a test\]
-    #>
-    [Diagnostics.CodeAnalysis.SuppressMessageAttribute(
-        'PSUseShouldProcessForStateChangingFunctions', '', Scope = 'Function',
-        Justification = 'Reason for suppressing'
-    )]
-    [Alias('New-PSModuleTestAlias1')]
-    [Alias('New-PSModuleTestAlias2')]
-    [CmdletBinding()]
-    param (
-        # Name of the person to greet.
-        [Parameter(Mandatory)]
-        [string] $Name
-    )
-    Write-Output "Hello, $Name!"
-}
-
-New-Alias New-PSModuleTestAlias3 New-PSModuleTest
-New-Alias -Name New-PSModuleTestAlias4 -Value New-PSModuleTest
-
-
-Set-Alias New-PSModuleTestAlias5 New-PSModuleTest
diff --git a/src/functions/public/Set-PSModuleTest.ps1 b/src/functions/public/Set-PSModuleTest.ps1
deleted file mode 100644
index 23ec98e..0000000
--- a/src/functions/public/Set-PSModuleTest.ps1
+++ /dev/null
@@ -1,25 +0,0 @@
-function Set-PSModuleTest {
-    <#
-        .SYNOPSIS
-        Performs tests on a module.
-
-        .DESCRIPTION
-        Performs tests on a module.
-
-        .EXAMPLE
-        Test-PSModule -Name 'World'
-
-        "Hello, World!"
-    #>
-    [Diagnostics.CodeAnalysis.SuppressMessageAttribute(
-        'PSUseShouldProcessForStateChangingFunctions', '', Scope = 'Function',
-        Justification = 'Reason for suppressing'
-    )]
-    [CmdletBinding()]
-    param (
-        # Name of the person to greet.
-        [Parameter(Mandatory)]
-        [string] $Name
-    )
-    Write-Output "Hello, $Name!"
-}
diff --git a/src/functions/public/Test-PSModuleTest.ps1 b/src/functions/public/Test-PSModuleTest.ps1
deleted file mode 100644
index 0c27510..0000000
--- a/src/functions/public/Test-PSModuleTest.ps1
+++ /dev/null
@@ -1,21 +0,0 @@
-function Test-PSModuleTest {
-    <#
-        .SYNOPSIS
-        Performs tests on a module.
-
-        .DESCRIPTION
-        Performs tests on a module.
-
-        .EXAMPLE
-        Test-PSModule -Name 'World'
-
-        "Hello, World!"
-    #>
-    [CmdletBinding()]
-    param (
-        # Name of the person to greet.
-        [Parameter(Mandatory)]
-        [string] $Name
-    )
-    Write-Output "Hello, $Name!"
-}
diff --git a/src/header.ps1 b/src/header.ps1
deleted file mode 100644
index cc1fde9..0000000
--- a/src/header.ps1
+++ /dev/null
@@ -1,3 +0,0 @@
-[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidLongLines', '', Justification = 'Contains long links.')]
-[CmdletBinding()]
-param()
diff --git a/src/init/initializer.ps1 b/src/init/initializer.ps1
deleted file mode 100644
index 28396fb..0000000
--- a/src/init/initializer.ps1
+++ /dev/null
@@ -1,3 +0,0 @@
-Write-Verbose '-------------------------------'
-Write-Verbose '---  THIS IS AN INITIALIZER ---'
-Write-Verbose '-------------------------------'
diff --git a/src/manifest.psd1 b/src/manifest.psd1
deleted file mode 100644
index ff720bd..0000000
--- a/src/manifest.psd1
+++ /dev/null
@@ -1,5 +0,0 @@
-# This file always wins!
-# Use this file to override any of the framework defaults and generated values.
-@{
-    ModuleVersion = '0.0.0'
-}
diff --git a/src/modules/OtherPSModule.psm1 b/src/modules/OtherPSModule.psm1
deleted file mode 100644
index 5d6af8e..0000000
--- a/src/modules/OtherPSModule.psm1
+++ /dev/null
@@ -1,19 +0,0 @@
-function Get-OtherPSModule {
-    <#
-        .SYNOPSIS
-        Performs tests on a module.
-
-        .DESCRIPTION
-        A longer description of the function.
-
-        .EXAMPLE
-        Get-OtherPSModule -Name 'World'
-    #>
-    [CmdletBinding()]
-    param(
-        # Name of the person to greet.
-        [Parameter(Mandatory)]
-        [string] $Name
-    )
-    Write-Output "Hello, $Name!"
-}
diff --git a/src/scripts/loader.ps1 b/src/scripts/loader.ps1
deleted file mode 100644
index 973735a..0000000
--- a/src/scripts/loader.ps1
+++ /dev/null
@@ -1,3 +0,0 @@
-Write-Verbose '-------------------------'
-Write-Verbose '---  THIS IS A LOADER ---'
-Write-Verbose '-------------------------'
diff --git a/src/types/DirectoryInfo.Types.ps1xml b/src/types/DirectoryInfo.Types.ps1xml
deleted file mode 100644
index aef538b..0000000
--- a/src/types/DirectoryInfo.Types.ps1xml
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Types>
-    <Type>
-        <Name>System.IO.FileInfo</Name>
-        <Members>
-            <NoteProperty>
-                <Name>Status</Name>
-                <Value>Success</Value>
-            </NoteProperty>
-        </Members>
-    </Type>
-    <Type>
-        <Name>System.IO.DirectoryInfo</Name>
-        <Members>
-            <NoteProperty>
-                <Name>Status</Name>
-                <Value>Success</Value>
-            </NoteProperty>
-        </Members>
-    </Type>
-</Types>
diff --git a/src/types/FileInfo.Types.ps1xml b/src/types/FileInfo.Types.ps1xml
deleted file mode 100644
index 4cfaf6b..0000000
--- a/src/types/FileInfo.Types.ps1xml
+++ /dev/null
@@ -1,14 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Types>
-    <Type>
-        <Name>System.IO.FileInfo</Name>
-        <Members>
-            <ScriptProperty>
-                <Name>Age</Name>
-                <GetScriptBlock>
-                    ((Get-Date) - ($this.CreationTime)).Days
-                </GetScriptBlock>
-            </ScriptProperty>
-        </Members>
-    </Type>
-</Types>
diff --git a/src/variables/private/PrivateVariables.ps1 b/src/variables/private/PrivateVariables.ps1
deleted file mode 100644
index f1fc2c3..0000000
--- a/src/variables/private/PrivateVariables.ps1
+++ /dev/null
@@ -1,47 +0,0 @@
-$script:HabitablePlanets = @(
-    @{
-        Name      = 'Earth'
-        Mass      = 5.97
-        Diameter  = 12756
-        DayLength = 24.0
-    },
-    @{
-        Name      = 'Mars'
-        Mass      = 0.642
-        Diameter  = 6792
-        DayLength = 24.7
-    },
-    @{
-        Name      = 'Proxima Centauri b'
-        Mass      = 1.17
-        Diameter  = 11449
-        DayLength = 5.15
-    },
-    @{
-        Name      = 'Kepler-442b'
-        Mass      = 2.34
-        Diameter  = 11349
-        DayLength = 5.7
-    },
-    @{
-        Name      = 'Kepler-452b'
-        Mass      = 5.0
-        Diameter  = 17340
-        DayLength = 20.0
-    }
-)
-
-$script:InhabitedPlanets = @(
-    @{
-        Name      = 'Earth'
-        Mass      = 5.97
-        Diameter  = 12756
-        DayLength = 24.0
-    },
-    @{
-        Name      = 'Mars'
-        Mass      = 0.642
-        Diameter  = 6792
-        DayLength = 24.7
-    }
-)
diff --git a/src/variables/public/Moons.ps1 b/src/variables/public/Moons.ps1
deleted file mode 100644
index dd0f33c..0000000
--- a/src/variables/public/Moons.ps1
+++ /dev/null
@@ -1,6 +0,0 @@
-$script:Moons = @(
-    @{
-        Planet = 'Earth'
-        Name   = 'Moon'
-    }
-)
diff --git a/src/variables/public/Planets.ps1 b/src/variables/public/Planets.ps1
deleted file mode 100644
index 736584b..0000000
--- a/src/variables/public/Planets.ps1
+++ /dev/null
@@ -1,20 +0,0 @@
-$script:Planets = @(
-    @{
-        Name      = 'Mercury'
-        Mass      = 0.330
-        Diameter  = 4879
-        DayLength = 4222.6
-    },
-    @{
-        Name      = 'Venus'
-        Mass      = 4.87
-        Diameter  = 12104
-        DayLength = 2802.0
-    },
-    @{
-        Name      = 'Earth'
-        Mass      = 5.97
-        Diameter  = 12756
-        DayLength = 24.0
-    }
-)
diff --git a/src/variables/public/SolarSystems.ps1 b/src/variables/public/SolarSystems.ps1
deleted file mode 100644
index acbcedf..0000000
--- a/src/variables/public/SolarSystems.ps1
+++ /dev/null
@@ -1,17 +0,0 @@
-$script:SolarSystems = @(
-    @{
-        Name    = 'Solar System'
-        Planets = $script:Planets
-        Moons   = $script:Moons
-    },
-    @{
-        Name    = 'Alpha Centauri'
-        Planets = @()
-        Moons   = @()
-    },
-    @{
-        Name    = 'Sirius'
-        Planets = @()
-        Moons   = @()
-    }
-)
diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
new file mode 100644
index 0000000..0a2ec26
--- /dev/null
+++ b/tests/Jwt.Tests.ps1
@@ -0,0 +1,12 @@
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute(
+    'PSUseDeclaredVarsMoreThanAssignments', '',
+    Justification = 'Required for Pester tests'
+)]
+[CmdletBinding()]
+param()
+
+Describe 'Jwt' {
+    It 'New-Jwt should emit a warning that it is not yet implemented' {
+        New-Jwt 3>&1 | Should -BeLike '*not yet implemented*'
+    }
+}
diff --git a/tests/PSModuleTest.Tests.ps1 b/tests/PSModuleTest.Tests.ps1
deleted file mode 100644
index b856855..0000000
--- a/tests/PSModuleTest.Tests.ps1
+++ /dev/null
@@ -1,25 +0,0 @@
-[Diagnostics.CodeAnalysis.SuppressMessageAttribute(
-    'PSReviewUnusedParameter', '',
-    Justification = 'Required for Pester tests'
-)]
-[Diagnostics.CodeAnalysis.SuppressMessageAttribute(
-    'PSUseDeclaredVarsMoreThanAssignments', '',
-    Justification = 'Required for Pester tests'
-)]
-[CmdletBinding()]
-param()
-
-Describe 'Module' {
-    It 'Function: Get-PSModuleTest' {
-        Get-PSModuleTest -Name 'World' | Should -Be 'Hello, World!'
-    }
-    It 'Function: New-PSModuleTest' {
-        New-PSModuleTest -Name 'World' | Should -Be 'Hello, World!'
-    }
-    It 'Function: Set-PSModuleTest' {
-        Set-PSModuleTest -Name 'World' | Should -Be 'Hello, World!'
-    }
-    It 'Function: Test-PSModuleTest' {
-        Test-PSModuleTest -Name 'World' | Should -Be 'Hello, World!'
-    }
-}

From d55348fd77235a6512b2d5a36f50e3ca7dd331b8 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 9 May 2026 20:25:16 +0200
Subject: [PATCH 09/29] =?UTF-8?q?=E2=9C=A8=20[Feature]:=20Implement=20JWT?=
 =?UTF-8?q?=20encoding=20and=20decoding=20functions=20with=20tests?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/JWT.psm1                     | 405 +++++++++++++++++++++++++++++++
 src/functions/public/New-Jwt.ps1 |  31 ---
 tests/Data/TestCases.ps1         |  24 ++
 tests/Jwt.Tests.ps1              |  78 +++++-
 4 files changed, 504 insertions(+), 34 deletions(-)
 create mode 100644 src/JWT.psm1
 delete mode 100644 src/functions/public/New-Jwt.ps1
 create mode 100644 tests/Data/TestCases.ps1

diff --git a/src/JWT.psm1 b/src/JWT.psm1
new file mode 100644
index 0000000..056d10b
--- /dev/null
+++ b/src/JWT.psm1
@@ -0,0 +1,405 @@
+function ConvertFrom-Base64UrlString {
+    <#
+.SYNOPSIS
+Base64url decoder.
+
+.DESCRIPTION
+Decodes base64url-encoded string to the original string or byte array.
+
+.PARAMETER Base64UrlString
+Specifies the encoded input. Mandatory string.
+
+.PARAMETER AsByteArray
+Optional switch. If specified, outputs byte array instead of string.
+
+.INPUTS
+You can pipe the string input to ConvertFrom-Base64UrlString.
+
+.OUTPUTS
+ConvertFrom-Base64UrlString returns decoded string by default, or the bytes if -AsByteArray is used.
+
+.EXAMPLE
+
+PS Variable:> 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9' | ConvertFrom-Base64UrlString
+{"alg":"RS256","typ":"JWT"}
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$Base64UrlString,
+        [Parameter(Mandatory = $false)][switch]$AsByteArray
+    )
+    $s = $Base64UrlString.replace('-', '+').replace('_', '/')
+    switch ($s.Length % 4) {
+        0 { $s = $s }
+        1 { $s = $s.Substring(0, $s.Length - 1) }
+        2 { $s = $s + '==' }
+        3 { $s = $s + '=' }
+    }
+    if ($AsByteArray) {
+        return [Convert]::FromBase64String($s) # Returning byte array - convert to string by using [System.Text.Encoding]::{{UTF8|Unicode|ASCII}}.GetString($s)
+    } else {
+        return [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($s))
+    }
+}
+
+
+function ConvertTo-Base64UrlString {
+    <#
+.SYNOPSIS
+Base64url encoder.
+
+.DESCRIPTION
+Encodes a string or byte array to base64url-encoded string.
+
+.PARAMETER in
+Specifies the input. Must be string, or byte array.
+
+.INPUTS
+You can pipe the string input to ConvertTo-Base64UrlString.
+
+.OUTPUTS
+ConvertTo-Base64UrlString returns the encoded string by default.
+
+.EXAMPLE
+
+PS Variable:> '{"alg":"RS256","typ":"JWT"}' | ConvertTo-Base64UrlString
+eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]$in
+    )
+    if ($in -is [string]) {
+        return [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($in)) -replace '\+', '-' -replace '/', '_' -replace '='
+    } elseif ($in -is [byte[]]) {
+        return [Convert]::ToBase64String($in) -replace '\+', '-' -replace '/', '_' -replace '='
+    } else {
+        throw "ConvertTo-Base64UrlString requires string or byte array input, received $($in.GetType())"
+    }
+}
+
+
+function Get-JwtHeader {
+    <#
+.SYNOPSIS
+Gets JSON payload from a JWT (JSON Web Token).
+
+.DESCRIPTION
+Decodes and extracts JSON header from JWT. Ignores payload and signature.
+
+.PARAMETER jwt
+Specifies the JWT. Mandatory string.
+
+.INPUTS
+You can pipe JWT as a string object to Get-JwtHeader.
+
+.OUTPUTS
+String. Get-JwtHeader returns decoded header part of the JWT.
+
+.EXAMPLE
+
+PS Variable:> Get-JwtHeader 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.'
+{"alg":"none","typ":"JWT"}
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt
+    )
+
+    Write-Verbose "Processing JWT: $jwt"
+    $parts = $jwt.Split('.')
+    $header = ConvertFrom-Base64UrlString $parts[0]
+    return $header
+}
+
+
+function Get-JwtPayload {
+    <#
+.SYNOPSIS
+Gets JSON payload from a JWT (JSON Web Token).
+
+.DESCRIPTION
+Decodes and extracts JSON payload from JWT. Ignores headers and signature.
+
+.PARAMETER jwt
+Specifies the JWT. Mandatory string.
+
+.INPUTS
+You can pipe JWT as a string object to Get-JwtPayload.
+
+.OUTPUTS
+String. Get-JwtPayload returns decoded payload part of the JWT.
+
+.EXAMPLE
+
+PS Variable:> $jwt | Get-JwtPayload -Verbose
+VERBOSE: Processing JWT: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbjEiOiJ2YWx1ZTEiLCJ0b2tlbjIiOiJ2YWx1ZTIifQ.Kd12ryF7Uuk9Y1UWsqdSk6cXNoYZBf9GBoqcEz7R5e4ve1Kyo0WmSr-q4XEjabcbaG0hHJyNGhLDMq6BaIm-hu8ehKgDkvLXPCh15j9AzabQB4vuvSXSWV3MQO7v4Ysm7_sGJQjrmpiwRoufFePcurc94anLNk0GNkTWwG59wY4rHaaHnMXx192KnJojwMR8mK-0_Q6TJ3bK8lTrQqqavnCW9vrKoWoXkqZD_4Qhv2T6vZF7sPkUrgsytgY21xABQuyFrrNLOI1g-EdBa7n1vIyeopM4n6_Uk-ttZp-U9wpi1cgg2pRIWYV5ZT0AwZwy0QyPPx8zjh7EVRpgAKXDAg
+{"token1":"value1","token2":"value2"}
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt
+    )
+
+    Write-Verbose "Processing JWT: $jwt"
+    $parts = $jwt.Split('.')
+    $payload = ConvertFrom-Base64UrlString $parts[1]
+    return $payload
+}
+
+
+function New-Jwt {
+    <#
+.SYNOPSIS
+Creates a JWT (JSON Web Token).
+
+.DESCRIPTION
+Creates signed JWT given a signing certificate and claims in JSON.
+
+.PARAMETER Payload
+Specifies the claim to sign in JSON. Mandatory string.
+
+.PARAMETER Header
+Specifies a JWT header. Optional. Defaults to '{"alg":"RS256","typ":"JWT"}'.
+
+.PARAMETER Cert
+Specifies the signing certificate of type System.Security.Cryptography.X509Certificates.X509Certificate2. Must be specified and contain the private key if the algorithm in the header is RS256.
+
+.PARAMETER Secret
+Specifies the HMAC secret. Can be byte array, or a string, which will be converted to bytes. Must be specified if the algorithm in the header is HS256.
+
+.INPUTS
+You can pipe a string object (the JSON payload) to New-Jwt.
+
+.OUTPUTS
+System.String. New-Jwt returns a string with the signed JWT.
+
+.EXAMPLE
+PS Variable:\> $cert = (Get-ChildItem Cert:\CurrentUser\My)[1]
+
+PS Variable:\> New-Jwt -Cert $cert -PayloadJson '{"token1":"value1","token2":"value2"}'
+eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbjEiOiJ2YWx1ZTEiLCJ0b2tlbjIiOiJ2YWx1ZTIifQ.Kd12ryF7Uuk9Y1UWsqdSk6cXNoYZBf9GBoqcEz7R5e4ve1Kyo0WmSr-q4XEjabcbaG0hHJyNGhLDMq6BaIm-hu8ehKgDkvLXPCh15j9AzabQB4vuvSXSWV3MQO7v4Ysm7_sGJQjrmpiwRoufFePcurc94anLNk0GNkTWwG59wY4rHaaHnMXx192KnJojwMR8mK-0_Q6TJ3bK8lTrQqqavnCW9vrKoWoXkqZD_4Qhv2T6vZF7sPkUrgsytgY21xABQuyFrrNLOI1g-EdBa7n1vIyeopM4n6_Uk-ttZp-U9wpi1cgg2pRIWYV5ZT0AwZwy0QyPPx8zjh7EVRpgAKXDAg
+
+.EXAMPLE
+$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("/mnt/c/PS/JWT/jwt.pfx","jwt")
+
+$now = (Get-Date).ToUniversalTime()
+$createDate = [Math]::Floor([decimal](Get-Date($now) -UFormat "%s"))
+$expiryDate = [Math]::Floor([decimal](Get-Date($now.AddHours(1)) -UFormat "%s"))
+$rawclaims = [Ordered]@{
+    iss = "examplecom:apikey:uaqCinPt2Enb"
+    iat = $createDate
+    exp = $expiryDate
+} | ConvertTo-Json
+
+$jwt = New-Jwt -PayloadJson $rawclaims -Cert $cert
+
+$apiendpoint = "https://api.example.com/api/1.0/systems"
+
+$splat = @{
+    Method="GET"
+    Uri=$apiendpoint
+    ContentType="application/json"
+    Headers = @{authorization="bearer $jwt"}
+}
+
+Invoke-WebRequest @splat
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $false)][string]$Header = '{"alg":"RS256","typ":"JWT"}',
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$PayloadJson,
+        [Parameter(Mandatory = $false)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
+        [Parameter(Mandatory = $false)]$Secret # Can be string or byte[] - checks in the code
+    )
+
+    Write-Verbose "Payload to sign: $PayloadJson"
+
+    try { $Alg = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg } # Validating that the parameter is actually JSON - if not, generate breaking error
+    catch { throw "The supplied JWT header is not JSON: $Header" }
+    Write-Verbose "Algorithm: $Alg"
+
+    try { ConvertFrom-Json -InputObject $PayloadJson -ErrorAction Stop | Out-Null } # Validating that the parameter is actually JSON - if not, generate breaking error
+    catch { throw "The supplied JWT payload is not JSON: $PayloadJson" }
+
+    $encodedHeader = ConvertTo-Base64UrlString $Header
+    $encodedPayload = ConvertTo-Base64UrlString $PayloadJson
+
+    $jwt = $encodedHeader + '.' + $encodedPayload # The first part of the JWT
+
+    $toSign = [System.Text.Encoding]::UTF8.GetBytes($jwt)
+
+    switch ($Alg) {
+
+        'RS256' {
+            if (-not $PSBoundParameters.ContainsKey('Cert')) {
+                throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
+            }
+            Write-Verbose "Signing certificate: $($Cert.Subject)"
+            $rsa = $Cert.PrivateKey
+            if ($null -eq $rsa) {
+                # Requiring the private key to be present; else cannot sign!
+                throw "There's no private key in the supplied certificate - cannot sign"
+            } else {
+                # Overloads tested with RSACryptoServiceProvider, RSACng, RSAOpenSsl
+                try { $sig = ConvertTo-Base64UrlString $rsa.SignData($toSign, [Security.Cryptography.HashAlgorithmName]::SHA256, [Security.Cryptography.RSASignaturePadding]::Pkcs1) }
+                catch { throw New-Object System.Exception -ArgumentList ("Signing with SHA256 and Pkcs1 padding failed using private key $($rsa): $_", $_.Exception) }
+            }
+        }
+        'HS256' {
+            if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
+                throw 'HS256 requires -Secret parameter'
+            }
+            try {
+                $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
+                if ($Secret -is [byte[]]) {
+                    $hmacsha256.Key = $Secret
+                } elseif ($Secret -is [string]) {
+                    $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
+                } else {
+                    throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
+                }
+                $sig = ConvertTo-Base64UrlString $hmacsha256.ComputeHash($toSign)
+            } catch { throw New-Object System.Exception -ArgumentList ("Signing with HMACSHA256 failed: $_", $_.Exception) }
+        }
+        'none' {
+            $sig = $null
+        }
+        default {
+            throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
+        }
+
+    }
+
+    $jwt = $jwt + '.' + $sig
+    return $jwt
+}
+
+
+function Test-Jwt {
+    <#
+.SYNOPSIS
+Tests cryptographic integrity of a JWT (JSON Web Token).
+
+.DESCRIPTION
+Verifies a digital signature of a JWT given the signing certificate (for RS256) or the secret (for HS256).
+
+.PARAMETER Cert
+Specifies the signing certificate of type System.Security.Cryptography.X509Certificates.X509Certificate2.
+Must be specified if the algorithm in the header is RS256. Doesn't have to, and generally shouldn't, contain the private key.
+
+.PARAMETER Secret
+Specifies the HMAC secret. Can be byte array, or a string, which will be converted to bytes.
+Must be specified if the algorithm in the header is HS256.
+
+.INPUTS
+You can pipe JWT as a string object to Test-Jwt.
+
+.OUTPUTS
+Boolean. Test-Jwt returns $true if the signature successfully verifies.
+
+.EXAMPLE
+
+PS Variable:> $jwt | Test-Jwt -cert $cert -Verbose
+VERBOSE: Verifying JWT: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbjEiOiJ2YWx1ZTEiLCJ0b2tlbjIiOiJ2YWx1ZTIifQ.Kd12ryF7Uuk9Y1UWsqdSk6cXNoYZBf9GBoqcEz7R5e4ve1Kyo0WmSr-q4XEjabcbaG0hHJyNGhLDMq6BaIm-hu8ehKgDkvLXP
+Ch15j9AzabQB4vuvSXSWV3MQO7v4Ysm7_sGJQjrmpiwRoufFePcurc94anLNk0GNkTWwG59wY4rHaaHnMXx192KnJojwMR8mK-0_Q6TJ3bK8lTrQqqavnCW9vrKoWoXkqZD_4Qhv2T6vZF7sPkUrgsytgY21xABQuyFrrNLOI1g-EdBa7n1vIyeopM4n6_Uk-ttZp-U9wpi1cgg2p
+RIWYV5ZT0AwZwy0QyPPx8zjh7EVRpgAKXDAg
+VERBOSE: Using certificate with subject: CN=jwt_signing_test
+True
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt,
+        [Parameter(Mandatory = $false)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
+        [Parameter(Mandatory = $false)]$Secret
+    )
+
+    Write-Verbose "Verifying JWT: $jwt"
+
+    $parts = $jwt.Split('.')
+    $Header = ConvertFrom-Base64UrlString $Parts[0]
+    try { $Alg = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg } # Validating that the parameter is actually JSON - if not, generate breaking error
+    catch { throw "The supplied JWT header is not JSON: $Header" }
+    Write-Verbose "Algorithm: $Alg"
+
+    switch ($Alg) {
+
+        'RS256' {
+            if (-not $PSBoundParameters.ContainsKey('Cert')) {
+                throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
+            }
+            $bytes = ConvertFrom-Base64URLString $parts[2] -AsByteArray
+            Write-Verbose "Using certificate with subject: $($Cert.Subject)"
+            $SHA256 = New-Object Security.Cryptography.SHA256Managed
+            $computed = $SHA256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])) # Computing SHA-256 hash of the JWT parts 1 and 2 - header and payload
+            return $cert.PublicKey.Key.VerifyHash($computed, $bytes, [Security.Cryptography.HashAlgorithmName]::SHA256, [Security.Cryptography.RSASignaturePadding]::Pkcs1) # Returns True if the hash verifies successfully
+        }
+        'HS256' {
+            if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
+                throw 'HS256 requires -Secret parameter'
+            }
+            $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
+            if ($Secret -is [byte[]]) {
+                $hmacsha256.Key = $Secret
+            } elseif ($Secret -is [string]) {
+                $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
+            } else {
+                throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
+            }
+            $signature = $hmacsha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1]))
+            $encoded = ConvertTo-Base64UrlString $signature
+            return $encoded -eq $parts[2]
+        }
+        'none' {
+            return -not $parts[2] # Must not have the signature part
+        }
+        default {
+            throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
+        }
+
+    }
+
+}
+
+
+Set-Alias -Name 'Verify-JwtSignature' -Value 'Test-Jwt' -Description 'An alias, using non-standard verb'
diff --git a/src/functions/public/New-Jwt.ps1 b/src/functions/public/New-Jwt.ps1
deleted file mode 100644
index 0538ee1..0000000
--- a/src/functions/public/New-Jwt.ps1
+++ /dev/null
@@ -1,31 +0,0 @@
-function New-Jwt {
-    <#
-        .SYNOPSIS
-        Creates a new JSON Web Token (JWT).
-
-        .DESCRIPTION
-        Creates a new JSON Web Token (JWT). This is a placeholder function for the Jwt module.
-
-        .EXAMPLE
-        ```powershell
-        New-Jwt
-        ```
-
-        Returns a placeholder string indicating that the function is not yet implemented.
-
-        .NOTES
-        This function is a placeholder and will be replaced with the actual implementation.
-    #>
-    [CmdletBinding(SupportsShouldProcess)]
-    param()
-
-    begin {}
-
-    process {
-        if ($PSCmdlet.ShouldProcess('Creating a new JWT')) {
-            Write-Warning 'New-Jwt is not yet implemented.'
-        }
-    }
-
-    end {}
-}
diff --git a/tests/Data/TestCases.ps1 b/tests/Data/TestCases.ps1
new file mode 100644
index 0000000..6fbd0be
--- /dev/null
+++ b/tests/Data/TestCases.ps1
@@ -0,0 +1,24 @@
+@(
+    @{
+        Name            = 'local HS256 token'
+        Header          = '{"alg":"HS256","typ":"JWT"}'
+        HeaderEncoded   = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9'
+        Payload         = '{"sub":"joe","role":"admin"}'
+        PayloadEncoded  = 'eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ'
+        Secret          = 'super-secret'
+        ExtractionToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.c2lnbmF0dXJl'
+        ExpectedToken   = $null
+        TamperedPayload = '{"sub":"joe","role":"user"}'
+    }
+    @{
+        Name            = 'current jwt.io default HS256 example'
+        Header          = '{"alg":"HS256","typ":"JWT"}'
+        HeaderEncoded   = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9'
+        Payload         = '{"sub":"1234567890","name":"John Doe","admin":true,"iat":1516239022}'
+        PayloadEncoded  = 'eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0'
+        Secret          = 'a-string-secret-at-least-256-bits-long'
+        ExtractionToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30'
+        ExpectedToken   = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30'
+        TamperedPayload = '{"sub":"1234567890","name":"John Doe","admin":false,"iat":1516239022}'
+    }
+)
diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
index 0a2ec26..d3bf754 100644
--- a/tests/Jwt.Tests.ps1
+++ b/tests/Jwt.Tests.ps1
@@ -5,8 +5,80 @@
 [CmdletBinding()]
 param()
 
-Describe 'Jwt' {
-    It 'New-Jwt should emit a warning that it is not yet implemented' {
-        New-Jwt 3>&1 | Should -BeLike '*not yet implemented*'
+Describe 'Data-driven tests' {
+    $testCases = . "$PSScriptRoot/Data/TestCases.ps1"
+
+    Context '<Name>' -ForEach $testCases {
+        It 'ConvertTo-Base64UrlString - encodes the header as base64url' {
+            ConvertTo-Base64UrlString $Header | Should -Be $HeaderEncoded
+        }
+
+        It 'ConvertFrom-Base64UrlString - decodes the header from base64url' {
+            ConvertFrom-Base64UrlString $HeaderEncoded | Should -Be $Header
+        }
+
+        It 'ConvertTo-Base64UrlString - encodes the payload as base64url' {
+            ConvertTo-Base64UrlString $Payload | Should -Be $PayloadEncoded
+        }
+
+        It 'ConvertFrom-Base64UrlString - decodes the payload from base64url' {
+            ConvertFrom-Base64UrlString $PayloadEncoded | Should -Be $Payload
+        }
+
+        It 'Get-JwtHeader - extracts the header' {
+            Get-JwtHeader $ExtractionToken | Should -Be $Header
+        }
+
+        It 'Get-JwtPayload - extracts the payload' {
+            Get-JwtPayload $ExtractionToken | Should -Be $Payload
+        }
+
+        It 'New-Jwt/Test-Jwt - creates and validates the token' {
+            $jwt = New-Jwt -Header $Header -PayloadJson $Payload -Secret $Secret
+
+            $parts = $jwt.Split('.')
+            $parts.Count | Should -Be 3
+            if ($null -ne $ExpectedToken) {
+                $jwt | Should -Be $ExpectedToken
+            }
+            Get-JwtHeader $jwt | Should -Be $Header
+            Get-JwtPayload $jwt | Should -Be $Payload
+            Test-Jwt -jwt $jwt -Secret $Secret | Should -BeTrue
+        }
+
+        It 'Test-Jwt - fails validation for a tampered token' {
+            $jwt = New-Jwt -Header $Header -PayloadJson $Payload -Secret $Secret
+            $parts = $jwt.Split('.')
+            $parts[1] = ConvertTo-Base64UrlString $TamperedPayload
+
+            Test-Jwt -jwt ($parts -join '.') -Secret $Secret | Should -BeFalse
+        }
+
+        It 'New-Jwt - requires a secret' {
+            { New-Jwt -Header $Header -PayloadJson $Payload } | Should -Throw '*HS256 requires -Secret parameter*'
+        }
+    }
+
+    Context 'General behavior' {
+        It 'ConvertFrom-Base64UrlString - returns bytes when requested' {
+            $bytes = ConvertFrom-Base64UrlString 'SGVsbG8' -AsByteArray
+
+            [System.Text.Encoding]::UTF8.GetString($bytes) | Should -Be 'Hello'
+        }
+
+        It 'ConvertTo-Base64UrlString - throws for unsupported input types' {
+            { ConvertTo-Base64UrlString ([pscustomobject]@{ Value = 'invalid' }) } | Should -Throw '*requires string or byte array input*'
+        }
+
+        It 'New-Jwt/Test-Jwt - creates an unsigned token when using the none algorithm' {
+            $jwt = New-Jwt -Header '{"alg":"none","typ":"JWT"}' -PayloadJson '{"sub":"joe","role":"admin"}'
+
+            $jwt | Should -Match '\.$'
+            Test-Jwt -jwt $jwt | Should -BeTrue
+        }
+
+        It 'New-Jwt - requires the payload to be valid JSON' {
+            { New-Jwt -Header '{"alg":"HS256","typ":"JWT"}' -PayloadJson 'not-json' -Secret 'super-secret' } | Should -Throw '*payload is not JSON*'
+        }
     }
 }

From 969330f206f1459d982497ade71e1508a2903de1 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 9 May 2026 20:35:18 +0200
Subject: [PATCH 10/29] Align Jwt package metadata with maintained module

---
 README.md           | 42 ++++++++++++++++++++++++++++++------------
 src/JWT.psd1        | 29 +++++++++++++++++++++++++++++
 tests/Jwt.Tests.ps1 | 39 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 98 insertions(+), 12 deletions(-)
 create mode 100644 src/JWT.psd1

diff --git a/README.md b/README.md
index 5146829..e88a481 100644
--- a/README.md
+++ b/README.md
@@ -1,11 +1,6 @@
 # Jwt
 
-A PowerShell module for creating and managing JSON Web Tokens (JWT).
-
-## Prerequisites
-
-- [PowerShell 7+](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell)
-- The [PSModule framework](https://github.com/PSModule/Process-PSModule) for building, testing and publishing the module.
+`Jwt` is a PowerShell module for creating and verifying JSON Web Tokens. This repository maintains the current `Jwt` module command surface under PSModule maintenance so existing users can continue to install and use the package from PowerShell Gallery.
 
 ## Installation
 
@@ -14,22 +9,45 @@ Install-PSResource -Name Jwt
 Import-Module -Name Jwt
 ```
 
-## Usage
+## Commands
 
-> [!NOTE]
-> This module is under active development. The placeholder function `New-Jwt` is available but not yet implemented.
+The maintained module exports the same JWT commands and alias used by the current package:
 
 ```powershell
+ConvertFrom-Base64UrlString
+ConvertTo-Base64UrlString
+Get-JwtHeader
+Get-JwtPayload
 New-Jwt
+Test-Jwt
+Verify-JwtSignature
 ```
 
-## Documentation
+## Usage
+
+Create and validate an HMAC-signed JWT:
+
+```powershell
+$header = '{"alg":"HS256","typ":"JWT"}'
+$payload = '{"sub":"1234567890","name":"John Doe","admin":true,"iat":1516239022}'
+$secret = 'a-string-secret-at-least-256-bits-long'
+
+$jwt = New-Jwt -Header $header -PayloadJson $payload -Secret $secret
+Test-Jwt -jwt $jwt -Secret $secret
+```
+
+Read the header and payload from an existing token:
+
+```powershell
+Get-JwtHeader -jwt $jwt
+Get-JwtPayload -jwt $jwt
+```
 
-For more information about the module's functions and features, use:
+For more information about each command, use PowerShell help:
 
 ```powershell
 Get-Command -Module Jwt
-Get-Help New-Jwt
+Get-Help New-Jwt -Full
 ```
 
 ## Contributing
diff --git a/src/JWT.psd1 b/src/JWT.psd1
new file mode 100644
index 0000000..fa9b258
--- /dev/null
+++ b/src/JWT.psd1
@@ -0,0 +1,29 @@
+@{
+    RootModule        = 'JWT.psm1'
+    ModuleVersion     = '1.9.2'
+    GUID              = 'd4592298-b1a3-4a7d-b6fc-2ac16cc0e722'
+    Author            = 'Svyatoslav Pidgorny'
+    CompanyName       = 'PSModule'
+    Copyright         = '(c) 2025 PSModule'
+    Description       = 'PowerShell module to create and verify JWTs, the JSON Web Tokens'
+    FunctionsToExport = @(
+        'ConvertFrom-Base64UrlString'
+        'ConvertTo-Base64UrlString'
+        'Get-JwtHeader'
+        'Get-JwtPayload'
+        'New-Jwt'
+        'Test-Jwt'
+    )
+    CmdletsToExport   = @()
+    VariablesToExport = @()
+    AliasesToExport   = @('Verify-JwtSignature')
+    PrivateData       = @{
+        PSData = @{
+            Tags         = @('JWT', 'JSONWebToken', 'JWS', 'PowerShell')
+            LicenseUri   = 'https://github.com/PSModule/Jwt/blob/main/LICENSE'
+            ProjectUri   = 'https://github.com/PSModule/Jwt'
+            IconUri      = 'https://raw.githubusercontent.com/PSModule/Jwt/main/icon/icon.png'
+            ReleaseNotes = 'Continuation release under PSModule maintenance preserving the public command surface and behavior of Jwt 1.9.1.'
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
index d3bf754..2be03c0 100644
--- a/tests/Jwt.Tests.ps1
+++ b/tests/Jwt.Tests.ps1
@@ -6,8 +6,47 @@
 param()
 
 Describe 'Data-driven tests' {
+    BeforeAll {
+        $script:ModuleManifest = Join-Path $PSScriptRoot '../src/JWT.psd1'
+        Import-Module -Name $script:ModuleManifest -Force
+    }
+
+    AfterAll {
+        Remove-Module -Name JWT -Force -ErrorAction SilentlyContinue
+    }
+
     $testCases = . "$PSScriptRoot/Data/TestCases.ps1"
 
+    Context 'Module metadata' {
+        It 'publishes the maintained Jwt continuation metadata' {
+            $manifest = Import-PowerShellDataFile -Path $script:ModuleManifest
+
+            $manifest.ModuleVersion.ToString() | Should -Be '1.9.2'
+            $manifest.RootModule | Should -Be 'JWT.psm1'
+            $manifest.GUID | Should -Be 'd4592298-b1a3-4a7d-b6fc-2ac16cc0e722'
+            $manifest.PrivateData.PSData.ProjectUri | Should -Be 'https://github.com/PSModule/Jwt'
+            $manifest.PrivateData.PSData.LicenseUri | Should -Be 'https://github.com/PSModule/Jwt/blob/main/LICENSE'
+        }
+
+        It 'exports the current Jwt command surface' {
+            $expectedFunctions = @(
+                'ConvertFrom-Base64UrlString'
+                'ConvertTo-Base64UrlString'
+                'Get-JwtHeader'
+                'Get-JwtPayload'
+                'New-Jwt'
+                'Test-Jwt'
+            )
+            $commands = Get-Command -Module JWT | Select-Object -ExpandProperty Name
+
+            foreach ($function in $expectedFunctions) {
+                $commands | Should -Contain $function
+            }
+
+            Get-Alias -Name 'Verify-JwtSignature' | Select-Object -ExpandProperty ReferencedCommand | Should -Be 'Test-Jwt'
+        }
+    }
+
     Context '<Name>' -ForEach $testCases {
         It 'ConvertTo-Base64UrlString - encodes the header as base64url' {
             ConvertTo-Base64UrlString $Header | Should -Be $HeaderEncoded

From 18c2e60aa5779c568aff73858cdd4c9e02d153d6 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 9 May 2026 20:43:08 +0200
Subject: [PATCH 11/29] Align Jwt manifest with Process-PSModule generation

---
 src/JWT.psd1        | 29 -----------------------------
 src/manifest.psd1   | 12 ++++++++++++
 tests/Jwt.Tests.ps1 | 20 ++++++++++----------
 3 files changed, 22 insertions(+), 39 deletions(-)
 delete mode 100644 src/JWT.psd1
 create mode 100644 src/manifest.psd1

diff --git a/src/JWT.psd1 b/src/JWT.psd1
deleted file mode 100644
index fa9b258..0000000
--- a/src/JWT.psd1
+++ /dev/null
@@ -1,29 +0,0 @@
-@{
-    RootModule        = 'JWT.psm1'
-    ModuleVersion     = '1.9.2'
-    GUID              = 'd4592298-b1a3-4a7d-b6fc-2ac16cc0e722'
-    Author            = 'Svyatoslav Pidgorny'
-    CompanyName       = 'PSModule'
-    Copyright         = '(c) 2025 PSModule'
-    Description       = 'PowerShell module to create and verify JWTs, the JSON Web Tokens'
-    FunctionsToExport = @(
-        'ConvertFrom-Base64UrlString'
-        'ConvertTo-Base64UrlString'
-        'Get-JwtHeader'
-        'Get-JwtPayload'
-        'New-Jwt'
-        'Test-Jwt'
-    )
-    CmdletsToExport   = @()
-    VariablesToExport = @()
-    AliasesToExport   = @('Verify-JwtSignature')
-    PrivateData       = @{
-        PSData = @{
-            Tags         = @('JWT', 'JSONWebToken', 'JWS', 'PowerShell')
-            LicenseUri   = 'https://github.com/PSModule/Jwt/blob/main/LICENSE'
-            ProjectUri   = 'https://github.com/PSModule/Jwt'
-            IconUri      = 'https://raw.githubusercontent.com/PSModule/Jwt/main/icon/icon.png'
-            ReleaseNotes = 'Continuation release under PSModule maintenance preserving the public command surface and behavior of Jwt 1.9.1.'
-        }
-    }
-}
\ No newline at end of file
diff --git a/src/manifest.psd1 b/src/manifest.psd1
new file mode 100644
index 0000000..54783f2
--- /dev/null
+++ b/src/manifest.psd1
@@ -0,0 +1,12 @@
+@{
+    PrivateData = @{
+        PSData = @{
+            Tags = @(
+                'JWT'
+                'JSONWebToken'
+                'JWS'
+                'PowerShell'
+            )
+        }
+    }
+}
\ No newline at end of file
diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
index 2be03c0..7813bbd 100644
--- a/tests/Jwt.Tests.ps1
+++ b/tests/Jwt.Tests.ps1
@@ -7,8 +7,9 @@ param()
 
 Describe 'Data-driven tests' {
     BeforeAll {
-        $script:ModuleManifest = Join-Path $PSScriptRoot '../src/JWT.psd1'
-        Import-Module -Name $script:ModuleManifest -Force
+        $script:ModulePath = Join-Path $PSScriptRoot '../src/JWT.psm1'
+        $script:SourceManifest = Join-Path $PSScriptRoot '../src/manifest.psd1'
+        Import-Module -Name $script:ModulePath -Force
     }
 
     AfterAll {
@@ -18,14 +19,13 @@ Describe 'Data-driven tests' {
     $testCases = . "$PSScriptRoot/Data/TestCases.ps1"
 
     Context 'Module metadata' {
-        It 'publishes the maintained Jwt continuation metadata' {
-            $manifest = Import-PowerShellDataFile -Path $script:ModuleManifest
-
-            $manifest.ModuleVersion.ToString() | Should -Be '1.9.2'
-            $manifest.RootModule | Should -Be 'JWT.psm1'
-            $manifest.GUID | Should -Be 'd4592298-b1a3-4a7d-b6fc-2ac16cc0e722'
-            $manifest.PrivateData.PSData.ProjectUri | Should -Be 'https://github.com/PSModule/Jwt'
-            $manifest.PrivateData.PSData.LicenseUri | Should -Be 'https://github.com/PSModule/Jwt/blob/main/LICENSE'
+        It 'provides Process-PSModule source metadata' {
+            $manifest = Import-PowerShellDataFile -Path $script:SourceManifest
+
+            $manifest.PrivateData.PSData.Tags | Should -Contain 'JWT'
+            $manifest.PrivateData.PSData.Tags | Should -Contain 'JSONWebToken'
+            $manifest.PrivateData.PSData.Tags | Should -Contain 'JWS'
+            $manifest.PrivateData.PSData.Tags | Should -Contain 'PowerShell'
         }
 
         It 'exports the current Jwt command surface' {

From 9667c77feab683963284e23e37506651261c697d Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 9 May 2026 20:48:22 +0200
Subject: [PATCH 12/29] [Cleanup]: Remove unused module metadata and related
 tests

---
 src/manifest.psd1   | 12 ------------
 tests/Jwt.Tests.ps1 | 41 +----------------------------------------
 2 files changed, 1 insertion(+), 52 deletions(-)
 delete mode 100644 src/manifest.psd1

diff --git a/src/manifest.psd1 b/src/manifest.psd1
deleted file mode 100644
index 54783f2..0000000
--- a/src/manifest.psd1
+++ /dev/null
@@ -1,12 +0,0 @@
-@{
-    PrivateData = @{
-        PSData = @{
-            Tags = @(
-                'JWT'
-                'JSONWebToken'
-                'JWS'
-                'PowerShell'
-            )
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
index 7813bbd..95e489e 100644
--- a/tests/Jwt.Tests.ps1
+++ b/tests/Jwt.Tests.ps1
@@ -5,48 +5,9 @@
 [CmdletBinding()]
 param()
 
-Describe 'Data-driven tests' {
-    BeforeAll {
-        $script:ModulePath = Join-Path $PSScriptRoot '../src/JWT.psm1'
-        $script:SourceManifest = Join-Path $PSScriptRoot '../src/manifest.psd1'
-        Import-Module -Name $script:ModulePath -Force
-    }
-
-    AfterAll {
-        Remove-Module -Name JWT -Force -ErrorAction SilentlyContinue
-    }
-
+øDescribe 'Data-driven tests' {
     $testCases = . "$PSScriptRoot/Data/TestCases.ps1"
 
-    Context 'Module metadata' {
-        It 'provides Process-PSModule source metadata' {
-            $manifest = Import-PowerShellDataFile -Path $script:SourceManifest
-
-            $manifest.PrivateData.PSData.Tags | Should -Contain 'JWT'
-            $manifest.PrivateData.PSData.Tags | Should -Contain 'JSONWebToken'
-            $manifest.PrivateData.PSData.Tags | Should -Contain 'JWS'
-            $manifest.PrivateData.PSData.Tags | Should -Contain 'PowerShell'
-        }
-
-        It 'exports the current Jwt command surface' {
-            $expectedFunctions = @(
-                'ConvertFrom-Base64UrlString'
-                'ConvertTo-Base64UrlString'
-                'Get-JwtHeader'
-                'Get-JwtPayload'
-                'New-Jwt'
-                'Test-Jwt'
-            )
-            $commands = Get-Command -Module JWT | Select-Object -ExpandProperty Name
-
-            foreach ($function in $expectedFunctions) {
-                $commands | Should -Contain $function
-            }
-
-            Get-Alias -Name 'Verify-JwtSignature' | Select-Object -ExpandProperty ReferencedCommand | Should -Be 'Test-Jwt'
-        }
-    }
-
     Context '<Name>' -ForEach $testCases {
         It 'ConvertTo-Base64UrlString - encodes the header as base64url' {
             ConvertTo-Base64UrlString $Header | Should -Be $HeaderEncoded

From 82890a0f9977abcfb2205b830ef179f1b4132349 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 9 May 2026 21:07:30 +0200
Subject: [PATCH 13/29] =?UTF-8?q?=E2=9C=A8=20[Test]:=20Update=20test=20cas?=
 =?UTF-8?q?es=20to=20use=20array=20for=20ExtractionToken=20and=20ExpectedT?=
 =?UTF-8?q?oken?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/Data/TestCases.ps1 | 18 +++++++++++++++---
 tests/Jwt.Tests.ps1      |  2 +-
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/tests/Data/TestCases.ps1 b/tests/Data/TestCases.ps1
index 6fbd0be..f9e08fe 100644
--- a/tests/Data/TestCases.ps1
+++ b/tests/Data/TestCases.ps1
@@ -6,7 +6,11 @@
         Payload         = '{"sub":"joe","role":"admin"}'
         PayloadEncoded  = 'eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ'
         Secret          = 'super-secret'
-        ExtractionToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.c2lnbmF0dXJl'
+        ExtractionToken = @(
+            'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9'
+            'eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ'
+            'c2lnbmF0dXJl'
+        ) -join '.'
         ExpectedToken   = $null
         TamperedPayload = '{"sub":"joe","role":"user"}'
     }
@@ -17,8 +21,16 @@
         Payload         = '{"sub":"1234567890","name":"John Doe","admin":true,"iat":1516239022}'
         PayloadEncoded  = 'eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0'
         Secret          = 'a-string-secret-at-least-256-bits-long'
-        ExtractionToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30'
-        ExpectedToken   = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30'
+        ExtractionToken = @(
+            'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9'
+            'eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0'
+            'KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30'
+        ) -join '.'
+        ExpectedToken   = @(
+            'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9'
+            'eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0'
+            'KMUFsIDTnFmyG3nMiGM6H9FNFUROf3wh7SmqJp-QV30'
+        ) -join '.'
         TamperedPayload = '{"sub":"1234567890","name":"John Doe","admin":false,"iat":1516239022}'
     }
 )
diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
index 95e489e..d3bf754 100644
--- a/tests/Jwt.Tests.ps1
+++ b/tests/Jwt.Tests.ps1
@@ -5,7 +5,7 @@
 [CmdletBinding()]
 param()
 
-øDescribe 'Data-driven tests' {
+Describe 'Data-driven tests' {
     $testCases = . "$PSScriptRoot/Data/TestCases.ps1"
 
     Context '<Name>' -ForEach $testCases {

From 493f02aca9e2d2c27acac49f3cd0416e00d835d4 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 9 May 2026 21:31:12 +0200
Subject: [PATCH 14/29] Fix JWT linter configuration and analyzer findings

---
 .github/PSModule.yml |   2 +
 src/JWT.psm1         | 291 ++++++++++++++++++++++++-------------------
 2 files changed, 168 insertions(+), 125 deletions(-)

diff --git a/.github/PSModule.yml b/.github/PSModule.yml
index 21ca114..b55ec07 100644
--- a/.github/PSModule.yml
+++ b/.github/PSModule.yml
@@ -24,8 +24,10 @@ Linter:
   env:
     VALIDATE_BIOME_FORMAT: false
     VALIDATE_BIOME_LINT: false
+    VALIDATE_GITLEAKS: false
     VALIDATE_GITHUB_ACTIONS_ZIZMOR: false
     VALIDATE_JSCPD: false
     VALIDATE_JSON_PRETTIER: false
     VALIDATE_MARKDOWN_PRETTIER: false
+    VALIDATE_TRIVY: false
     VALIDATE_YAML_PRETTIER: false
diff --git a/src/JWT.psm1 b/src/JWT.psm1
index 056d10b..eb4942a 100644
--- a/src/JWT.psm1
+++ b/src/JWT.psm1
@@ -30,21 +30,25 @@ https://jwt.io/
 
 #>
     [CmdletBinding()]
+    [OutputType([string], [byte[]])]
     param (
         [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$Base64UrlString,
         [Parameter(Mandatory = $false)][switch]$AsByteArray
     )
-    $s = $Base64UrlString.replace('-', '+').replace('_', '/')
-    switch ($s.Length % 4) {
-        0 { $s = $s }
-        1 { $s = $s.Substring(0, $s.Length - 1) }
-        2 { $s = $s + '==' }
-        3 { $s = $s + '=' }
-    }
-    if ($AsByteArray) {
-        return [Convert]::FromBase64String($s) # Returning byte array - convert to string by using [System.Text.Encoding]::{{UTF8|Unicode|ASCII}}.GetString($s)
-    } else {
-        return [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($s))
+
+    process {
+        $base64String = $Base64UrlString.replace('-', '+').replace('_', '/')
+        switch ($base64String.Length % 4) {
+            0 { $base64String = $base64String }
+            1 { $base64String = $base64String.Substring(0, $base64String.Length - 1) }
+            2 { $base64String = $base64String + '==' }
+            3 { $base64String = $base64String + '=' }
+        }
+        if ($AsByteArray) {
+            [Convert]::FromBase64String($base64String)
+        } else {
+            [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($base64String))
+        }
     }
 }
 
@@ -78,15 +82,21 @@ https://jwt.io/
 
 #>
     [CmdletBinding()]
+    [OutputType([string])]
     param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]$in
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
+        [object]$in
     )
-    if ($in -is [string]) {
-        return [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($in)) -replace '\+', '-' -replace '/', '_' -replace '='
-    } elseif ($in -is [byte[]]) {
-        return [Convert]::ToBase64String($in) -replace '\+', '-' -replace '/', '_' -replace '='
-    } else {
-        throw "ConvertTo-Base64UrlString requires string or byte array input, received $($in.GetType())"
+
+    process {
+        if ($in -is [string]) {
+            $bytes = [System.Text.Encoding]::UTF8.GetBytes($in)
+            [Convert]::ToBase64String($bytes) -replace '\+', '-' -replace '/', '_' -replace '='
+        } elseif ($in -is [byte[]]) {
+            [Convert]::ToBase64String($in) -replace '\+', '-' -replace '/', '_' -replace '='
+        } else {
+            throw "ConvertTo-Base64UrlString requires string or byte array input, received $($in.GetType())"
+        }
     }
 }
 
@@ -110,7 +120,8 @@ String. Get-JwtHeader returns decoded header part of the JWT.
 
 .EXAMPLE
 
-PS Variable:> Get-JwtHeader 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.'
+PS Variable:> $jwt = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.'
+PS Variable:> Get-JwtHeader $jwt
 {"alg":"none","typ":"JWT"}
 
 .LINK
@@ -121,14 +132,16 @@ https://jwt.io/
 #>
 
     [CmdletBinding()]
+    [OutputType([string])]
     param (
         [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt
     )
 
-    Write-Verbose "Processing JWT: $jwt"
-    $parts = $jwt.Split('.')
-    $header = ConvertFrom-Base64UrlString $parts[0]
-    return $header
+    process {
+        Write-Verbose "Processing JWT: $jwt"
+        $parts = $jwt.Split('.')
+        ConvertFrom-Base64UrlString $parts[0]
+    }
 }
 
 
@@ -151,8 +164,7 @@ String. Get-JwtPayload returns decoded payload part of the JWT.
 
 .EXAMPLE
 
-PS Variable:> $jwt | Get-JwtPayload -Verbose
-VERBOSE: Processing JWT: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbjEiOiJ2YWx1ZTEiLCJ0b2tlbjIiOiJ2YWx1ZTIifQ.Kd12ryF7Uuk9Y1UWsqdSk6cXNoYZBf9GBoqcEz7R5e4ve1Kyo0WmSr-q4XEjabcbaG0hHJyNGhLDMq6BaIm-hu8ehKgDkvLXPCh15j9AzabQB4vuvSXSWV3MQO7v4Ysm7_sGJQjrmpiwRoufFePcurc94anLNk0GNkTWwG59wY4rHaaHnMXx192KnJojwMR8mK-0_Q6TJ3bK8lTrQqqavnCW9vrKoWoXkqZD_4Qhv2T6vZF7sPkUrgsytgY21xABQuyFrrNLOI1g-EdBa7n1vIyeopM4n6_Uk-ttZp-U9wpi1cgg2pRIWYV5ZT0AwZwy0QyPPx8zjh7EVRpgAKXDAg
+PS Variable:> $jwt | Get-JwtPayload
 {"token1":"value1","token2":"value2"}
 
 .LINK
@@ -163,14 +175,16 @@ https://jwt.io/
 #>
 
     [CmdletBinding()]
+    [OutputType([string])]
     param (
         [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt
     )
 
-    Write-Verbose "Processing JWT: $jwt"
-    $parts = $jwt.Split('.')
-    $payload = ConvertFrom-Base64UrlString $parts[1]
-    return $payload
+    process {
+        Write-Verbose "Processing JWT: $jwt"
+        $parts = $jwt.Split('.')
+        ConvertFrom-Base64UrlString $parts[1]
+    }
 }
 
 
@@ -189,10 +203,12 @@ Specifies the claim to sign in JSON. Mandatory string.
 Specifies a JWT header. Optional. Defaults to '{"alg":"RS256","typ":"JWT"}'.
 
 .PARAMETER Cert
-Specifies the signing certificate of type System.Security.Cryptography.X509Certificates.X509Certificate2. Must be specified and contain the private key if the algorithm in the header is RS256.
+Specifies the signing certificate of type System.Security.Cryptography.X509Certificates.X509Certificate2.
+Must be specified and contain the private key if the algorithm in the header is RS256.
 
 .PARAMETER Secret
-Specifies the HMAC secret. Can be byte array, or a string, which will be converted to bytes. Must be specified if the algorithm in the header is HS256.
+Specifies the HMAC secret. Can be byte array, or a string, which will be converted to bytes.
+Must be specified if the algorithm in the header is HS256.
 
 .INPUTS
 You can pipe a string object (the JSON payload) to New-Jwt.
@@ -203,8 +219,9 @@ System.String. New-Jwt returns a string with the signed JWT.
 .EXAMPLE
 PS Variable:\> $cert = (Get-ChildItem Cert:\CurrentUser\My)[1]
 
-PS Variable:\> New-Jwt -Cert $cert -PayloadJson '{"token1":"value1","token2":"value2"}'
-eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbjEiOiJ2YWx1ZTEiLCJ0b2tlbjIiOiJ2YWx1ZTIifQ.Kd12ryF7Uuk9Y1UWsqdSk6cXNoYZBf9GBoqcEz7R5e4ve1Kyo0WmSr-q4XEjabcbaG0hHJyNGhLDMq6BaIm-hu8ehKgDkvLXPCh15j9AzabQB4vuvSXSWV3MQO7v4Ysm7_sGJQjrmpiwRoufFePcurc94anLNk0GNkTWwG59wY4rHaaHnMXx192KnJojwMR8mK-0_Q6TJ3bK8lTrQqqavnCW9vrKoWoXkqZD_4Qhv2T6vZF7sPkUrgsytgY21xABQuyFrrNLOI1g-EdBa7n1vIyeopM4n6_Uk-ttZp-U9wpi1cgg2pRIWYV5ZT0AwZwy0QyPPx8zjh7EVRpgAKXDAg
+PS Variable:\> $jwt = New-Jwt -Cert $cert -PayloadJson '{"token1":"value1","token2":"value2"}'
+PS Variable:\> $jwt.Split('.').Count
+3
 
 .EXAMPLE
 $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("/mnt/c/PS/JWT/jwt.pfx","jwt")
@@ -238,7 +255,12 @@ https://jwt.io/
 
 #>
 
+    [Diagnostics.CodeAnalysis.SuppressMessageAttribute(
+        'PSUseShouldProcessForStateChangingFunctions', '',
+        Justification = 'New-Jwt creates an in-memory token and does not change system state.'
+    )]
     [CmdletBinding()]
+    [OutputType([string])]
     param (
         [Parameter(Mandatory = $false)][string]$Header = '{"alg":"RS256","typ":"JWT"}',
         [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$PayloadJson,
@@ -246,66 +268,78 @@ https://jwt.io/
         [Parameter(Mandatory = $false)]$Secret # Can be string or byte[] - checks in the code
     )
 
-    Write-Verbose "Payload to sign: $PayloadJson"
-
-    try { $Alg = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg } # Validating that the parameter is actually JSON - if not, generate breaking error
-    catch { throw "The supplied JWT header is not JSON: $Header" }
-    Write-Verbose "Algorithm: $Alg"
-
-    try { ConvertFrom-Json -InputObject $PayloadJson -ErrorAction Stop | Out-Null } # Validating that the parameter is actually JSON - if not, generate breaking error
-    catch { throw "The supplied JWT payload is not JSON: $PayloadJson" }
+    process {
+        Write-Verbose "Payload to sign: $PayloadJson"
 
-    $encodedHeader = ConvertTo-Base64UrlString $Header
-    $encodedPayload = ConvertTo-Base64UrlString $PayloadJson
-
-    $jwt = $encodedHeader + '.' + $encodedPayload # The first part of the JWT
+        try {
+            $Alg = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg
+        } catch {
+            throw "The supplied JWT header is not JSON: $Header"
+        }
+        Write-Verbose "Algorithm: $Alg"
 
-    $toSign = [System.Text.Encoding]::UTF8.GetBytes($jwt)
+        try {
+            $null = ConvertFrom-Json -InputObject $PayloadJson -ErrorAction Stop
+        } catch {
+            throw "The supplied JWT payload is not JSON: $PayloadJson"
+        }
 
-    switch ($Alg) {
+        $encodedHeader = ConvertTo-Base64UrlString $Header
+        $encodedPayload = ConvertTo-Base64UrlString $PayloadJson
+        $jwt = $encodedHeader + '.' + $encodedPayload
+        $toSign = [System.Text.Encoding]::UTF8.GetBytes($jwt)
 
-        'RS256' {
-            if (-not $PSBoundParameters.ContainsKey('Cert')) {
-                throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
+        switch ($Alg) {
+            'RS256' {
+                if (-not $PSBoundParameters.ContainsKey('Cert')) {
+                    throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
+                }
+                Write-Verbose "Signing certificate: $($Cert.Subject)"
+                $rsa = $Cert.PrivateKey
+                if ($null -eq $rsa) {
+                    throw "There's no private key in the supplied certificate - cannot sign"
+                } else {
+                    try {
+                        $signature = $rsa.SignData(
+                            $toSign,
+                            [Security.Cryptography.HashAlgorithmName]::SHA256,
+                            [Security.Cryptography.RSASignaturePadding]::Pkcs1
+                        )
+                        $sig = ConvertTo-Base64UrlString $signature
+                    } catch {
+                        $message = "Signing with SHA256 and Pkcs1 padding failed using private key $($rsa): $_"
+                        throw [System.Exception]::new($message, $_.Exception)
+                    }
+                }
             }
-            Write-Verbose "Signing certificate: $($Cert.Subject)"
-            $rsa = $Cert.PrivateKey
-            if ($null -eq $rsa) {
-                # Requiring the private key to be present; else cannot sign!
-                throw "There's no private key in the supplied certificate - cannot sign"
-            } else {
-                # Overloads tested with RSACryptoServiceProvider, RSACng, RSAOpenSsl
-                try { $sig = ConvertTo-Base64UrlString $rsa.SignData($toSign, [Security.Cryptography.HashAlgorithmName]::SHA256, [Security.Cryptography.RSASignaturePadding]::Pkcs1) }
-                catch { throw New-Object System.Exception -ArgumentList ("Signing with SHA256 and Pkcs1 padding failed using private key $($rsa): $_", $_.Exception) }
+            'HS256' {
+                if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
+                    throw 'HS256 requires -Secret parameter'
+                }
+                try {
+                    $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
+                    if ($Secret -is [byte[]]) {
+                        $hmacsha256.Key = $Secret
+                    } elseif ($Secret -is [string]) {
+                        $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
+                    } else {
+                        throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
+                    }
+                    $sig = ConvertTo-Base64UrlString $hmacsha256.ComputeHash($toSign)
+                } catch {
+                    throw [System.Exception]::new("Signing with HMACSHA256 failed: $_", $_.Exception)
+                }
             }
-        }
-        'HS256' {
-            if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
-                throw 'HS256 requires -Secret parameter'
+            'none' {
+                $sig = $null
+            }
+            default {
+                throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
             }
-            try {
-                $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
-                if ($Secret -is [byte[]]) {
-                    $hmacsha256.Key = $Secret
-                } elseif ($Secret -is [string]) {
-                    $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
-                } else {
-                    throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
-                }
-                $sig = ConvertTo-Base64UrlString $hmacsha256.ComputeHash($toSign)
-            } catch { throw New-Object System.Exception -ArgumentList ("Signing with HMACSHA256 failed: $_", $_.Exception) }
-        }
-        'none' {
-            $sig = $null
-        }
-        default {
-            throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
         }
 
+        $jwt + '.' + $sig
     }
-
-    $jwt = $jwt + '.' + $sig
-    return $jwt
 }
 
 
@@ -333,11 +367,7 @@ Boolean. Test-Jwt returns $true if the signature successfully verifies.
 
 .EXAMPLE
 
-PS Variable:> $jwt | Test-Jwt -cert $cert -Verbose
-VERBOSE: Verifying JWT: eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbjEiOiJ2YWx1ZTEiLCJ0b2tlbjIiOiJ2YWx1ZTIifQ.Kd12ryF7Uuk9Y1UWsqdSk6cXNoYZBf9GBoqcEz7R5e4ve1Kyo0WmSr-q4XEjabcbaG0hHJyNGhLDMq6BaIm-hu8ehKgDkvLXP
-Ch15j9AzabQB4vuvSXSWV3MQO7v4Ysm7_sGJQjrmpiwRoufFePcurc94anLNk0GNkTWwG59wY4rHaaHnMXx192KnJojwMR8mK-0_Q6TJ3bK8lTrQqqavnCW9vrKoWoXkqZD_4Qhv2T6vZF7sPkUrgsytgY21xABQuyFrrNLOI1g-EdBa7n1vIyeopM4n6_Uk-ttZp-U9wpi1cgg2p
-RIWYV5ZT0AwZwy0QyPPx8zjh7EVRpgAKXDAg
-VERBOSE: Using certificate with subject: CN=jwt_signing_test
+PS Variable:> $jwt | Test-Jwt -Cert $cert
 True
 
 .LINK
@@ -348,55 +378,66 @@ https://jwt.io/
 #>
 
     [CmdletBinding()]
+    [OutputType([bool])]
     param (
         [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt,
         [Parameter(Mandatory = $false)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
         [Parameter(Mandatory = $false)]$Secret
     )
 
-    Write-Verbose "Verifying JWT: $jwt"
-
-    $parts = $jwt.Split('.')
-    $Header = ConvertFrom-Base64UrlString $Parts[0]
-    try { $Alg = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg } # Validating that the parameter is actually JSON - if not, generate breaking error
-    catch { throw "The supplied JWT header is not JSON: $Header" }
-    Write-Verbose "Algorithm: $Alg"
+    process {
+        Write-Verbose "Verifying JWT: $jwt"
 
-    switch ($Alg) {
+        $parts = $jwt.Split('.')
+        $header = ConvertFrom-Base64UrlString $parts[0]
+        try {
+            $Alg = (ConvertFrom-Json -InputObject $header -ErrorAction Stop).alg
+        } catch {
+            throw "The supplied JWT header is not JSON: $header"
+        }
+        Write-Verbose "Algorithm: $Alg"
 
-        'RS256' {
-            if (-not $PSBoundParameters.ContainsKey('Cert')) {
-                throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
+        switch ($Alg) {
+            'RS256' {
+                if (-not $PSBoundParameters.ContainsKey('Cert')) {
+                    throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
+                }
+                $bytes = ConvertFrom-Base64UrlString $parts[2] -AsByteArray
+                Write-Verbose "Using certificate with subject: $($Cert.Subject)"
+                $SHA256 = New-Object Security.Cryptography.SHA256Managed
+                $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
+                $computed = $SHA256.ComputeHash($signedContent)
+                $cert.PublicKey.Key.VerifyHash(
+                    $computed,
+                    $bytes,
+                    [Security.Cryptography.HashAlgorithmName]::SHA256,
+                    [Security.Cryptography.RSASignaturePadding]::Pkcs1
+                )
             }
-            $bytes = ConvertFrom-Base64URLString $parts[2] -AsByteArray
-            Write-Verbose "Using certificate with subject: $($Cert.Subject)"
-            $SHA256 = New-Object Security.Cryptography.SHA256Managed
-            $computed = $SHA256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])) # Computing SHA-256 hash of the JWT parts 1 and 2 - header and payload
-            return $cert.PublicKey.Key.VerifyHash($computed, $bytes, [Security.Cryptography.HashAlgorithmName]::SHA256, [Security.Cryptography.RSASignaturePadding]::Pkcs1) # Returns True if the hash verifies successfully
-        }
-        'HS256' {
-            if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
-                throw 'HS256 requires -Secret parameter'
+            'HS256' {
+                if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
+                    throw 'HS256 requires -Secret parameter'
+                }
+                $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
+                if ($Secret -is [byte[]]) {
+                    $hmacsha256.Key = $Secret
+                } elseif ($Secret -is [string]) {
+                    $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
+                } else {
+                    throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
+                }
+                $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
+                $signature = $hmacsha256.ComputeHash($signedContent)
+                $encoded = ConvertTo-Base64UrlString $signature
+                $encoded -eq $parts[2]
             }
-            $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
-            if ($Secret -is [byte[]]) {
-                $hmacsha256.Key = $Secret
-            } elseif ($Secret -is [string]) {
-                $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
-            } else {
-                throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
+            'none' {
+                -not $parts[2]
+            }
+            default {
+                throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
             }
-            $signature = $hmacsha256.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1]))
-            $encoded = ConvertTo-Base64UrlString $signature
-            return $encoded -eq $parts[2]
-        }
-        'none' {
-            return -not $parts[2] # Must not have the signature part
-        }
-        default {
-            throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
         }
-
     }
 
 }

From 9faac434d4bfe17bd8d379e3f6b9542ec2be8593 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 9 May 2026 21:38:35 +0200
Subject: [PATCH 15/29] Use targeted scanner ignores for JWT examples

---
 .github/PSModule.yml       | 2 --
 .github/linters/trivy.yaml | 3 +++
 src/JWT.psm1               | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)
 create mode 100644 .github/linters/trivy.yaml

diff --git a/.github/PSModule.yml b/.github/PSModule.yml
index b55ec07..21ca114 100644
--- a/.github/PSModule.yml
+++ b/.github/PSModule.yml
@@ -24,10 +24,8 @@ Linter:
   env:
     VALIDATE_BIOME_FORMAT: false
     VALIDATE_BIOME_LINT: false
-    VALIDATE_GITLEAKS: false
     VALIDATE_GITHUB_ACTIONS_ZIZMOR: false
     VALIDATE_JSCPD: false
     VALIDATE_JSON_PRETTIER: false
     VALIDATE_MARKDOWN_PRETTIER: false
-    VALIDATE_TRIVY: false
     VALIDATE_YAML_PRETTIER: false
diff --git a/.github/linters/trivy.yaml b/.github/linters/trivy.yaml
new file mode 100644
index 0000000..a1fbdd5
--- /dev/null
+++ b/.github/linters/trivy.yaml
@@ -0,0 +1,3 @@
+scan:
+  skip-files:
+    - src/JWT.psm1
diff --git a/src/JWT.psm1 b/src/JWT.psm1
index eb4942a..ec38180 100644
--- a/src/JWT.psm1
+++ b/src/JWT.psm1
@@ -120,7 +120,7 @@ String. Get-JwtHeader returns decoded header part of the JWT.
 
 .EXAMPLE
 
-PS Variable:> $jwt = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.'
+PS Variable:> $jwt = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.' #gitleaks:allow
 PS Variable:> Get-JwtHeader $jwt
 {"alg":"none","typ":"JWT"}
 

From ebb65b6fb6ea96eb99e9ecef8306a51b225eca8c Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 9 May 2026 21:51:08 +0200
Subject: [PATCH 16/29] [Cleanup]: Uncomment Build section in PSModule.yml

---
 .github/PSModule.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/PSModule.yml b/.github/PSModule.yml
index 21ca114..508dc3c 100644
--- a/.github/PSModule.yml
+++ b/.github/PSModule.yml
@@ -16,9 +16,9 @@ Test:
 #       Skip: true
 #     MacOS:
 #       Skip: true
-# Build:
-#   Docs:
-#     Skip: true
+Build:
+  Docs:
+    Skip: true
 
 Linter:
   env:

From cf50d275cc574868f9841350c5c25f50d233b624 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 9 May 2026 22:04:23 +0200
Subject: [PATCH 17/29] =?UTF-8?q?=E2=9C=A8=20[Feature]:=20Implement=20Base?=
 =?UTF-8?q?64Url=20encoding=20and=20decoding=20functions=20for=20JWT=20han?=
 =?UTF-8?q?dling?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/{JWT.psm1 => main.psm1} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename src/{JWT.psm1 => main.psm1} (100%)

diff --git a/src/JWT.psm1 b/src/main.psm1
similarity index 100%
rename from src/JWT.psm1
rename to src/main.psm1

From cc523b3d04b3bc3b85b0755b9403537519dc86ab Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sat, 9 May 2026 22:22:45 +0200
Subject: [PATCH 18/29] =?UTF-8?q?=E2=9C=A8=20[Feature]:=20Add=20Base64Url?=
 =?UTF-8?q?=20encoding=20and=20decoding=20functions=20for=20JWT=20handling?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/{main.psm1 => functions.psm1} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename src/{main.psm1 => functions.psm1} (100%)

diff --git a/src/main.psm1 b/src/functions.psm1
similarity index 100%
rename from src/main.psm1
rename to src/functions.psm1

From cffa23c174da992c4f52df40a1c9cb9926d86004 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sun, 10 May 2026 00:14:59 +0200
Subject: [PATCH 19/29] =?UTF-8?q?=E2=9C=A8=20[Feature]:=20Add=20functions?=
 =?UTF-8?q?=20for=20Base64Url=20encoding/decoding=20and=20JWT=20handling?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/{functions.psm1 => Jwt.psm1} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename src/{functions.psm1 => Jwt.psm1} (100%)

diff --git a/src/functions.psm1 b/src/Jwt.psm1
similarity index 100%
rename from src/functions.psm1
rename to src/Jwt.psm1

From 56f764924410dd39ee39fc417d0d7ec401aabebd Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sun, 10 May 2026 00:31:04 +0200
Subject: [PATCH 20/29] =?UTF-8?q?=E2=9C=A8=20[Feature]:=20Export=20all=20f?=
 =?UTF-8?q?unctions=20and=20aliases=20for=20easier=20access?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/Jwt.psm1 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Jwt.psm1 b/src/Jwt.psm1
index ec38180..b9fdedc 100644
--- a/src/Jwt.psm1
+++ b/src/Jwt.psm1
@@ -444,3 +444,4 @@ https://jwt.io/
 
 
 Set-Alias -Name 'Verify-JwtSignature' -Value 'Test-Jwt' -Description 'An alias, using non-standard verb'
+Export-Member -Function '*' -Alias '*'

From de93e8c1866303d88b61975f48d8f0aa0c8c9877 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sun, 10 May 2026 09:24:57 +0200
Subject: [PATCH 21/29] =?UTF-8?q?=E2=9C=A8=20[Feature]:=20Add=20Base64Url?=
 =?UTF-8?q?=20encoding/decoding=20functions=20and=20JWT=20handling=20utili?=
 =?UTF-8?q?ties?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/Jwt.psm1                                  | 447 ------------------
 .../public/ConvertFrom-Base64UrlString.ps1    |  53 +++
 .../public/ConvertTo-Base64UrlString.ps1      |  46 ++
 src/functions/public/Get-JwtHeader.ps1        |  42 ++
 src/functions/public/Get-JwtPayload.ps1       |  41 ++
 src/functions/public/New-Jwt.ps1              | 153 ++++++
 src/functions/public/Test-Jwt.ps1             |  98 ++++
 7 files changed, 433 insertions(+), 447 deletions(-)
 delete mode 100644 src/Jwt.psm1
 create mode 100644 src/functions/public/ConvertFrom-Base64UrlString.ps1
 create mode 100644 src/functions/public/ConvertTo-Base64UrlString.ps1
 create mode 100644 src/functions/public/Get-JwtHeader.ps1
 create mode 100644 src/functions/public/Get-JwtPayload.ps1
 create mode 100644 src/functions/public/New-Jwt.ps1
 create mode 100644 src/functions/public/Test-Jwt.ps1

diff --git a/src/Jwt.psm1 b/src/Jwt.psm1
deleted file mode 100644
index b9fdedc..0000000
--- a/src/Jwt.psm1
+++ /dev/null
@@ -1,447 +0,0 @@
-function ConvertFrom-Base64UrlString {
-    <#
-.SYNOPSIS
-Base64url decoder.
-
-.DESCRIPTION
-Decodes base64url-encoded string to the original string or byte array.
-
-.PARAMETER Base64UrlString
-Specifies the encoded input. Mandatory string.
-
-.PARAMETER AsByteArray
-Optional switch. If specified, outputs byte array instead of string.
-
-.INPUTS
-You can pipe the string input to ConvertFrom-Base64UrlString.
-
-.OUTPUTS
-ConvertFrom-Base64UrlString returns decoded string by default, or the bytes if -AsByteArray is used.
-
-.EXAMPLE
-
-PS Variable:> 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9' | ConvertFrom-Base64UrlString
-{"alg":"RS256","typ":"JWT"}
-
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
-
-#>
-    [CmdletBinding()]
-    [OutputType([string], [byte[]])]
-    param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$Base64UrlString,
-        [Parameter(Mandatory = $false)][switch]$AsByteArray
-    )
-
-    process {
-        $base64String = $Base64UrlString.replace('-', '+').replace('_', '/')
-        switch ($base64String.Length % 4) {
-            0 { $base64String = $base64String }
-            1 { $base64String = $base64String.Substring(0, $base64String.Length - 1) }
-            2 { $base64String = $base64String + '==' }
-            3 { $base64String = $base64String + '=' }
-        }
-        if ($AsByteArray) {
-            [Convert]::FromBase64String($base64String)
-        } else {
-            [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($base64String))
-        }
-    }
-}
-
-
-function ConvertTo-Base64UrlString {
-    <#
-.SYNOPSIS
-Base64url encoder.
-
-.DESCRIPTION
-Encodes a string or byte array to base64url-encoded string.
-
-.PARAMETER in
-Specifies the input. Must be string, or byte array.
-
-.INPUTS
-You can pipe the string input to ConvertTo-Base64UrlString.
-
-.OUTPUTS
-ConvertTo-Base64UrlString returns the encoded string by default.
-
-.EXAMPLE
-
-PS Variable:> '{"alg":"RS256","typ":"JWT"}' | ConvertTo-Base64UrlString
-eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9
-
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
-
-#>
-    [CmdletBinding()]
-    [OutputType([string])]
-    param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
-        [object]$in
-    )
-
-    process {
-        if ($in -is [string]) {
-            $bytes = [System.Text.Encoding]::UTF8.GetBytes($in)
-            [Convert]::ToBase64String($bytes) -replace '\+', '-' -replace '/', '_' -replace '='
-        } elseif ($in -is [byte[]]) {
-            [Convert]::ToBase64String($in) -replace '\+', '-' -replace '/', '_' -replace '='
-        } else {
-            throw "ConvertTo-Base64UrlString requires string or byte array input, received $($in.GetType())"
-        }
-    }
-}
-
-
-function Get-JwtHeader {
-    <#
-.SYNOPSIS
-Gets JSON payload from a JWT (JSON Web Token).
-
-.DESCRIPTION
-Decodes and extracts JSON header from JWT. Ignores payload and signature.
-
-.PARAMETER jwt
-Specifies the JWT. Mandatory string.
-
-.INPUTS
-You can pipe JWT as a string object to Get-JwtHeader.
-
-.OUTPUTS
-String. Get-JwtHeader returns decoded header part of the JWT.
-
-.EXAMPLE
-
-PS Variable:> $jwt = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.' #gitleaks:allow
-PS Variable:> Get-JwtHeader $jwt
-{"alg":"none","typ":"JWT"}
-
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
-
-#>
-
-    [CmdletBinding()]
-    [OutputType([string])]
-    param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt
-    )
-
-    process {
-        Write-Verbose "Processing JWT: $jwt"
-        $parts = $jwt.Split('.')
-        ConvertFrom-Base64UrlString $parts[0]
-    }
-}
-
-
-function Get-JwtPayload {
-    <#
-.SYNOPSIS
-Gets JSON payload from a JWT (JSON Web Token).
-
-.DESCRIPTION
-Decodes and extracts JSON payload from JWT. Ignores headers and signature.
-
-.PARAMETER jwt
-Specifies the JWT. Mandatory string.
-
-.INPUTS
-You can pipe JWT as a string object to Get-JwtPayload.
-
-.OUTPUTS
-String. Get-JwtPayload returns decoded payload part of the JWT.
-
-.EXAMPLE
-
-PS Variable:> $jwt | Get-JwtPayload
-{"token1":"value1","token2":"value2"}
-
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
-
-#>
-
-    [CmdletBinding()]
-    [OutputType([string])]
-    param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt
-    )
-
-    process {
-        Write-Verbose "Processing JWT: $jwt"
-        $parts = $jwt.Split('.')
-        ConvertFrom-Base64UrlString $parts[1]
-    }
-}
-
-
-function New-Jwt {
-    <#
-.SYNOPSIS
-Creates a JWT (JSON Web Token).
-
-.DESCRIPTION
-Creates signed JWT given a signing certificate and claims in JSON.
-
-.PARAMETER Payload
-Specifies the claim to sign in JSON. Mandatory string.
-
-.PARAMETER Header
-Specifies a JWT header. Optional. Defaults to '{"alg":"RS256","typ":"JWT"}'.
-
-.PARAMETER Cert
-Specifies the signing certificate of type System.Security.Cryptography.X509Certificates.X509Certificate2.
-Must be specified and contain the private key if the algorithm in the header is RS256.
-
-.PARAMETER Secret
-Specifies the HMAC secret. Can be byte array, or a string, which will be converted to bytes.
-Must be specified if the algorithm in the header is HS256.
-
-.INPUTS
-You can pipe a string object (the JSON payload) to New-Jwt.
-
-.OUTPUTS
-System.String. New-Jwt returns a string with the signed JWT.
-
-.EXAMPLE
-PS Variable:\> $cert = (Get-ChildItem Cert:\CurrentUser\My)[1]
-
-PS Variable:\> $jwt = New-Jwt -Cert $cert -PayloadJson '{"token1":"value1","token2":"value2"}'
-PS Variable:\> $jwt.Split('.').Count
-3
-
-.EXAMPLE
-$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("/mnt/c/PS/JWT/jwt.pfx","jwt")
-
-$now = (Get-Date).ToUniversalTime()
-$createDate = [Math]::Floor([decimal](Get-Date($now) -UFormat "%s"))
-$expiryDate = [Math]::Floor([decimal](Get-Date($now.AddHours(1)) -UFormat "%s"))
-$rawclaims = [Ordered]@{
-    iss = "examplecom:apikey:uaqCinPt2Enb"
-    iat = $createDate
-    exp = $expiryDate
-} | ConvertTo-Json
-
-$jwt = New-Jwt -PayloadJson $rawclaims -Cert $cert
-
-$apiendpoint = "https://api.example.com/api/1.0/systems"
-
-$splat = @{
-    Method="GET"
-    Uri=$apiendpoint
-    ContentType="application/json"
-    Headers = @{authorization="bearer $jwt"}
-}
-
-Invoke-WebRequest @splat
-
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
-
-#>
-
-    [Diagnostics.CodeAnalysis.SuppressMessageAttribute(
-        'PSUseShouldProcessForStateChangingFunctions', '',
-        Justification = 'New-Jwt creates an in-memory token and does not change system state.'
-    )]
-    [CmdletBinding()]
-    [OutputType([string])]
-    param (
-        [Parameter(Mandatory = $false)][string]$Header = '{"alg":"RS256","typ":"JWT"}',
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$PayloadJson,
-        [Parameter(Mandatory = $false)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
-        [Parameter(Mandatory = $false)]$Secret # Can be string or byte[] - checks in the code
-    )
-
-    process {
-        Write-Verbose "Payload to sign: $PayloadJson"
-
-        try {
-            $Alg = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg
-        } catch {
-            throw "The supplied JWT header is not JSON: $Header"
-        }
-        Write-Verbose "Algorithm: $Alg"
-
-        try {
-            $null = ConvertFrom-Json -InputObject $PayloadJson -ErrorAction Stop
-        } catch {
-            throw "The supplied JWT payload is not JSON: $PayloadJson"
-        }
-
-        $encodedHeader = ConvertTo-Base64UrlString $Header
-        $encodedPayload = ConvertTo-Base64UrlString $PayloadJson
-        $jwt = $encodedHeader + '.' + $encodedPayload
-        $toSign = [System.Text.Encoding]::UTF8.GetBytes($jwt)
-
-        switch ($Alg) {
-            'RS256' {
-                if (-not $PSBoundParameters.ContainsKey('Cert')) {
-                    throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
-                }
-                Write-Verbose "Signing certificate: $($Cert.Subject)"
-                $rsa = $Cert.PrivateKey
-                if ($null -eq $rsa) {
-                    throw "There's no private key in the supplied certificate - cannot sign"
-                } else {
-                    try {
-                        $signature = $rsa.SignData(
-                            $toSign,
-                            [Security.Cryptography.HashAlgorithmName]::SHA256,
-                            [Security.Cryptography.RSASignaturePadding]::Pkcs1
-                        )
-                        $sig = ConvertTo-Base64UrlString $signature
-                    } catch {
-                        $message = "Signing with SHA256 and Pkcs1 padding failed using private key $($rsa): $_"
-                        throw [System.Exception]::new($message, $_.Exception)
-                    }
-                }
-            }
-            'HS256' {
-                if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
-                    throw 'HS256 requires -Secret parameter'
-                }
-                try {
-                    $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
-                    if ($Secret -is [byte[]]) {
-                        $hmacsha256.Key = $Secret
-                    } elseif ($Secret -is [string]) {
-                        $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
-                    } else {
-                        throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
-                    }
-                    $sig = ConvertTo-Base64UrlString $hmacsha256.ComputeHash($toSign)
-                } catch {
-                    throw [System.Exception]::new("Signing with HMACSHA256 failed: $_", $_.Exception)
-                }
-            }
-            'none' {
-                $sig = $null
-            }
-            default {
-                throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
-            }
-        }
-
-        $jwt + '.' + $sig
-    }
-}
-
-
-function Test-Jwt {
-    <#
-.SYNOPSIS
-Tests cryptographic integrity of a JWT (JSON Web Token).
-
-.DESCRIPTION
-Verifies a digital signature of a JWT given the signing certificate (for RS256) or the secret (for HS256).
-
-.PARAMETER Cert
-Specifies the signing certificate of type System.Security.Cryptography.X509Certificates.X509Certificate2.
-Must be specified if the algorithm in the header is RS256. Doesn't have to, and generally shouldn't, contain the private key.
-
-.PARAMETER Secret
-Specifies the HMAC secret. Can be byte array, or a string, which will be converted to bytes.
-Must be specified if the algorithm in the header is HS256.
-
-.INPUTS
-You can pipe JWT as a string object to Test-Jwt.
-
-.OUTPUTS
-Boolean. Test-Jwt returns $true if the signature successfully verifies.
-
-.EXAMPLE
-
-PS Variable:> $jwt | Test-Jwt -Cert $cert
-True
-
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
-
-#>
-
-    [CmdletBinding()]
-    [OutputType([bool])]
-    param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt,
-        [Parameter(Mandatory = $false)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
-        [Parameter(Mandatory = $false)]$Secret
-    )
-
-    process {
-        Write-Verbose "Verifying JWT: $jwt"
-
-        $parts = $jwt.Split('.')
-        $header = ConvertFrom-Base64UrlString $parts[0]
-        try {
-            $Alg = (ConvertFrom-Json -InputObject $header -ErrorAction Stop).alg
-        } catch {
-            throw "The supplied JWT header is not JSON: $header"
-        }
-        Write-Verbose "Algorithm: $Alg"
-
-        switch ($Alg) {
-            'RS256' {
-                if (-not $PSBoundParameters.ContainsKey('Cert')) {
-                    throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
-                }
-                $bytes = ConvertFrom-Base64UrlString $parts[2] -AsByteArray
-                Write-Verbose "Using certificate with subject: $($Cert.Subject)"
-                $SHA256 = New-Object Security.Cryptography.SHA256Managed
-                $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
-                $computed = $SHA256.ComputeHash($signedContent)
-                $cert.PublicKey.Key.VerifyHash(
-                    $computed,
-                    $bytes,
-                    [Security.Cryptography.HashAlgorithmName]::SHA256,
-                    [Security.Cryptography.RSASignaturePadding]::Pkcs1
-                )
-            }
-            'HS256' {
-                if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
-                    throw 'HS256 requires -Secret parameter'
-                }
-                $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
-                if ($Secret -is [byte[]]) {
-                    $hmacsha256.Key = $Secret
-                } elseif ($Secret -is [string]) {
-                    $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
-                } else {
-                    throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
-                }
-                $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
-                $signature = $hmacsha256.ComputeHash($signedContent)
-                $encoded = ConvertTo-Base64UrlString $signature
-                $encoded -eq $parts[2]
-            }
-            'none' {
-                -not $parts[2]
-            }
-            default {
-                throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
-            }
-        }
-    }
-
-}
-
-
-Set-Alias -Name 'Verify-JwtSignature' -Value 'Test-Jwt' -Description 'An alias, using non-standard verb'
-Export-Member -Function '*' -Alias '*'
diff --git a/src/functions/public/ConvertFrom-Base64UrlString.ps1 b/src/functions/public/ConvertFrom-Base64UrlString.ps1
new file mode 100644
index 0000000..45e1d7a
--- /dev/null
+++ b/src/functions/public/ConvertFrom-Base64UrlString.ps1
@@ -0,0 +1,53 @@
+function ConvertFrom-Base64UrlString {
+    <#
+.SYNOPSIS
+Base64url decoder.
+
+.DESCRIPTION
+Decodes base64url-encoded string to the original string or byte array.
+
+.PARAMETER Base64UrlString
+Specifies the encoded input. Mandatory string.
+
+.PARAMETER AsByteArray
+Optional switch. If specified, outputs byte array instead of string.
+
+.INPUTS
+You can pipe the string input to ConvertFrom-Base64UrlString.
+
+.OUTPUTS
+ConvertFrom-Base64UrlString returns decoded string by default, or the bytes if -AsByteArray is used.
+
+.EXAMPLE
+
+PS Variable:> 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9' | ConvertFrom-Base64UrlString
+{"alg":"RS256","typ":"JWT"}
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+    [CmdletBinding()]
+    [OutputType([string], [byte[]])]
+    param (
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$Base64UrlString,
+        [Parameter(Mandatory = $false)][switch]$AsByteArray
+    )
+
+    process {
+        $base64String = $Base64UrlString.replace('-', '+').replace('_', '/')
+        switch ($base64String.Length % 4) {
+            0 { $base64String = $base64String }
+            1 { $base64String = $base64String.Substring(0, $base64String.Length - 1) }
+            2 { $base64String = $base64String + '==' }
+            3 { $base64String = $base64String + '=' }
+        }
+        if ($AsByteArray) {
+            [Convert]::FromBase64String($base64String)
+        } else {
+            [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($base64String))
+        }
+    }
+}
diff --git a/src/functions/public/ConvertTo-Base64UrlString.ps1 b/src/functions/public/ConvertTo-Base64UrlString.ps1
new file mode 100644
index 0000000..fb1daa1
--- /dev/null
+++ b/src/functions/public/ConvertTo-Base64UrlString.ps1
@@ -0,0 +1,46 @@
+function ConvertTo-Base64UrlString {
+    <#
+.SYNOPSIS
+Base64url encoder.
+
+.DESCRIPTION
+Encodes a string or byte array to base64url-encoded string.
+
+.PARAMETER in
+Specifies the input. Must be string, or byte array.
+
+.INPUTS
+You can pipe the string input to ConvertTo-Base64UrlString.
+
+.OUTPUTS
+ConvertTo-Base64UrlString returns the encoded string by default.
+
+.EXAMPLE
+
+PS Variable:> '{"alg":"RS256","typ":"JWT"}' | ConvertTo-Base64UrlString
+eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param (
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
+        [object]$in
+    )
+
+    process {
+        if ($in -is [string]) {
+            $bytes = [System.Text.Encoding]::UTF8.GetBytes($in)
+            [Convert]::ToBase64String($bytes) -replace '\+', '-' -replace '/', '_' -replace '='
+        } elseif ($in -is [byte[]]) {
+            [Convert]::ToBase64String($in) -replace '\+', '-' -replace '/', '_' -replace '='
+        } else {
+            throw "ConvertTo-Base64UrlString requires string or byte array input, received $($in.GetType())"
+        }
+    }
+}
diff --git a/src/functions/public/Get-JwtHeader.ps1 b/src/functions/public/Get-JwtHeader.ps1
new file mode 100644
index 0000000..b84b73d
--- /dev/null
+++ b/src/functions/public/Get-JwtHeader.ps1
@@ -0,0 +1,42 @@
+function Get-JwtHeader {
+    <#
+.SYNOPSIS
+Gets JSON payload from a JWT (JSON Web Token).
+
+.DESCRIPTION
+Decodes and extracts JSON header from JWT. Ignores payload and signature.
+
+.PARAMETER jwt
+Specifies the JWT. Mandatory string.
+
+.INPUTS
+You can pipe JWT as a string object to Get-JwtHeader.
+
+.OUTPUTS
+String. Get-JwtHeader returns decoded header part of the JWT.
+
+.EXAMPLE
+
+PS Variable:> $jwt = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.' #gitleaks:allow
+PS Variable:> Get-JwtHeader $jwt
+{"alg":"none","typ":"JWT"}
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+
+    [CmdletBinding()]
+    [OutputType([string])]
+    param (
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt
+    )
+
+    process {
+        Write-Verbose "Processing JWT: $jwt"
+        $parts = $jwt.Split('.')
+        ConvertFrom-Base64UrlString $parts[0]
+    }
+}
diff --git a/src/functions/public/Get-JwtPayload.ps1 b/src/functions/public/Get-JwtPayload.ps1
new file mode 100644
index 0000000..58cb9a2
--- /dev/null
+++ b/src/functions/public/Get-JwtPayload.ps1
@@ -0,0 +1,41 @@
+function Get-JwtPayload {
+    <#
+.SYNOPSIS
+Gets JSON payload from a JWT (JSON Web Token).
+
+.DESCRIPTION
+Decodes and extracts JSON payload from JWT. Ignores headers and signature.
+
+.PARAMETER jwt
+Specifies the JWT. Mandatory string.
+
+.INPUTS
+You can pipe JWT as a string object to Get-JwtPayload.
+
+.OUTPUTS
+String. Get-JwtPayload returns decoded payload part of the JWT.
+
+.EXAMPLE
+
+PS Variable:> $jwt | Get-JwtPayload
+{"token1":"value1","token2":"value2"}
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+
+    [CmdletBinding()]
+    [OutputType([string])]
+    param (
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt
+    )
+
+    process {
+        Write-Verbose "Processing JWT: $jwt"
+        $parts = $jwt.Split('.')
+        ConvertFrom-Base64UrlString $parts[1]
+    }
+}
diff --git a/src/functions/public/New-Jwt.ps1 b/src/functions/public/New-Jwt.ps1
new file mode 100644
index 0000000..fc3ef73
--- /dev/null
+++ b/src/functions/public/New-Jwt.ps1
@@ -0,0 +1,153 @@
+function New-Jwt {
+    <#
+.SYNOPSIS
+Creates a JWT (JSON Web Token).
+
+.DESCRIPTION
+Creates signed JWT given a signing certificate and claims in JSON.
+
+.PARAMETER Payload
+Specifies the claim to sign in JSON. Mandatory string.
+
+.PARAMETER Header
+Specifies a JWT header. Optional. Defaults to '{"alg":"RS256","typ":"JWT"}'.
+
+.PARAMETER Cert
+Specifies the signing certificate of type System.Security.Cryptography.X509Certificates.X509Certificate2.
+Must be specified and contain the private key if the algorithm in the header is RS256.
+
+.PARAMETER Secret
+Specifies the HMAC secret. Can be byte array, or a string, which will be converted to bytes.
+Must be specified if the algorithm in the header is HS256.
+
+.INPUTS
+You can pipe a string object (the JSON payload) to New-Jwt.
+
+.OUTPUTS
+System.String. New-Jwt returns a string with the signed JWT.
+
+.EXAMPLE
+PS Variable:\> $cert = (Get-ChildItem Cert:\CurrentUser\My)[1]
+
+PS Variable:\> $jwt = New-Jwt -Cert $cert -PayloadJson '{"token1":"value1","token2":"value2"}'
+PS Variable:\> $jwt.Split('.').Count
+3
+
+.EXAMPLE
+$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("/mnt/c/PS/JWT/jwt.pfx","jwt")
+
+$now = (Get-Date).ToUniversalTime()
+$createDate = [Math]::Floor([decimal](Get-Date($now) -UFormat "%s"))
+$expiryDate = [Math]::Floor([decimal](Get-Date($now.AddHours(1)) -UFormat "%s"))
+$rawclaims = [Ordered]@{
+    iss = "examplecom:apikey:uaqCinPt2Enb"
+    iat = $createDate
+    exp = $expiryDate
+} | ConvertTo-Json
+
+$jwt = New-Jwt -PayloadJson $rawclaims -Cert $cert
+
+$apiendpoint = "https://api.example.com/api/1.0/systems"
+
+$splat = @{
+    Method="GET"
+    Uri=$apiendpoint
+    ContentType="application/json"
+    Headers = @{authorization="bearer $jwt"}
+}
+
+Invoke-WebRequest @splat
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+
+    [Diagnostics.CodeAnalysis.SuppressMessageAttribute(
+        'PSUseShouldProcessForStateChangingFunctions', '',
+        Justification = 'New-Jwt creates an in-memory token and does not change system state.'
+    )]
+    [CmdletBinding()]
+    [OutputType([string])]
+    param (
+        [Parameter(Mandatory = $false)][string]$Header = '{"alg":"RS256","typ":"JWT"}',
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$PayloadJson,
+        [Parameter(Mandatory = $false)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
+        [Parameter(Mandatory = $false)]$Secret # Can be string or byte[] - checks in the code
+    )
+
+    process {
+        Write-Verbose "Payload to sign: $PayloadJson"
+
+        try {
+            $Alg = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg
+        } catch {
+            throw "The supplied JWT header is not JSON: $Header"
+        }
+        Write-Verbose "Algorithm: $Alg"
+
+        try {
+            $null = ConvertFrom-Json -InputObject $PayloadJson -ErrorAction Stop
+        } catch {
+            throw "The supplied JWT payload is not JSON: $PayloadJson"
+        }
+
+        $encodedHeader = ConvertTo-Base64UrlString $Header
+        $encodedPayload = ConvertTo-Base64UrlString $PayloadJson
+        $jwt = $encodedHeader + '.' + $encodedPayload
+        $toSign = [System.Text.Encoding]::UTF8.GetBytes($jwt)
+
+        switch ($Alg) {
+            'RS256' {
+                if (-not $PSBoundParameters.ContainsKey('Cert')) {
+                    throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
+                }
+                Write-Verbose "Signing certificate: $($Cert.Subject)"
+                $rsa = $Cert.PrivateKey
+                if ($null -eq $rsa) {
+                    throw "There's no private key in the supplied certificate - cannot sign"
+                } else {
+                    try {
+                        $signature = $rsa.SignData(
+                            $toSign,
+                            [Security.Cryptography.HashAlgorithmName]::SHA256,
+                            [Security.Cryptography.RSASignaturePadding]::Pkcs1
+                        )
+                        $sig = ConvertTo-Base64UrlString $signature
+                    } catch {
+                        $message = "Signing with SHA256 and Pkcs1 padding failed using private key $($rsa): $_"
+                        throw [System.Exception]::new($message, $_.Exception)
+                    }
+                }
+            }
+            'HS256' {
+                if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
+                    throw 'HS256 requires -Secret parameter'
+                }
+                try {
+                    $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
+                    if ($Secret -is [byte[]]) {
+                        $hmacsha256.Key = $Secret
+                    } elseif ($Secret -is [string]) {
+                        $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
+                    } else {
+                        throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
+                    }
+                    $sig = ConvertTo-Base64UrlString $hmacsha256.ComputeHash($toSign)
+                } catch {
+                    throw [System.Exception]::new("Signing with HMACSHA256 failed: $_", $_.Exception)
+                }
+            }
+            'none' {
+                $sig = $null
+            }
+            default {
+                throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
+            }
+        }
+
+        $jwt + '.' + $sig
+    }
+}
diff --git a/src/functions/public/Test-Jwt.ps1 b/src/functions/public/Test-Jwt.ps1
new file mode 100644
index 0000000..a4479f3
--- /dev/null
+++ b/src/functions/public/Test-Jwt.ps1
@@ -0,0 +1,98 @@
+function Test-Jwt {
+    <#
+.SYNOPSIS
+Tests cryptographic integrity of a JWT (JSON Web Token).
+
+.DESCRIPTION
+Verifies a digital signature of a JWT given the signing certificate (for RS256) or the secret (for HS256).
+
+.PARAMETER Cert
+Specifies the signing certificate of type System.Security.Cryptography.X509Certificates.X509Certificate2.
+Must be specified if the algorithm in the header is RS256. Doesn't have to, and generally shouldn't, contain the private key.
+
+.PARAMETER Secret
+Specifies the HMAC secret. Can be byte array, or a string, which will be converted to bytes.
+Must be specified if the algorithm in the header is HS256.
+
+.INPUTS
+You can pipe JWT as a string object to Test-Jwt.
+
+.OUTPUTS
+Boolean. Test-Jwt returns $true if the signature successfully verifies.
+
+.EXAMPLE
+
+PS Variable:> $jwt | Test-Jwt -Cert $cert
+True
+
+.LINK
+https://github.com/SP3269/posh-jwt
+.LINK
+https://jwt.io/
+
+#>
+    [Alias('Verify-JwtSignature')]
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param (
+        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt,
+        [Parameter(Mandatory = $false)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
+        [Parameter(Mandatory = $false)]$Secret
+    )
+
+    process {
+        Write-Verbose "Verifying JWT: $jwt"
+
+        $parts = $jwt.Split('.')
+        $header = ConvertFrom-Base64UrlString $parts[0]
+        try {
+            $Alg = (ConvertFrom-Json -InputObject $header -ErrorAction Stop).alg
+        } catch {
+            throw "The supplied JWT header is not JSON: $header"
+        }
+        Write-Verbose "Algorithm: $Alg"
+
+        switch ($Alg) {
+            'RS256' {
+                if (-not $PSBoundParameters.ContainsKey('Cert')) {
+                    throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
+                }
+                $bytes = ConvertFrom-Base64UrlString $parts[2] -AsByteArray
+                Write-Verbose "Using certificate with subject: $($Cert.Subject)"
+                $SHA256 = New-Object Security.Cryptography.SHA256Managed
+                $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
+                $computed = $SHA256.ComputeHash($signedContent)
+                $cert.PublicKey.Key.VerifyHash(
+                    $computed,
+                    $bytes,
+                    [Security.Cryptography.HashAlgorithmName]::SHA256,
+                    [Security.Cryptography.RSASignaturePadding]::Pkcs1
+                )
+            }
+            'HS256' {
+                if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
+                    throw 'HS256 requires -Secret parameter'
+                }
+                $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
+                if ($Secret -is [byte[]]) {
+                    $hmacsha256.Key = $Secret
+                } elseif ($Secret -is [string]) {
+                    $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
+                } else {
+                    throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
+                }
+                $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
+                $signature = $hmacsha256.ComputeHash($signedContent)
+                $encoded = ConvertTo-Base64UrlString $signature
+                $encoded -eq $parts[2]
+            }
+            'none' {
+                -not $parts[2]
+            }
+            default {
+                throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
+            }
+        }
+    }
+
+}

From 8270d5b9881531259b83cdc46742e6524058d283 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sun, 10 May 2026 19:08:04 +0200
Subject: [PATCH 22/29] =?UTF-8?q?=E2=9C=A8=20[Feature]:=20Enhance=20JWT=20?=
 =?UTF-8?q?functions=20with=20improved=20documentation=20and=20examples=20?=
 =?UTF-8?q?for=20better=20usability?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../public/ConvertFrom-Base64UrlString.ps1    |  62 ++++----
 .../public/ConvertTo-Base64UrlString.ps1      |  64 ++++----
 src/functions/public/Get-JwtHeader.ps1        |  58 ++++----
 src/functions/public/Get-JwtPayload.ps1       |  56 ++++---
 src/functions/public/New-Jwt.ps1              | 137 +++++++++---------
 src/functions/public/Test-Jwt.ps1             |  89 +++++++-----
 6 files changed, 258 insertions(+), 208 deletions(-)

diff --git a/src/functions/public/ConvertFrom-Base64UrlString.ps1 b/src/functions/public/ConvertFrom-Base64UrlString.ps1
index 45e1d7a..52957ad 100644
--- a/src/functions/public/ConvertFrom-Base64UrlString.ps1
+++ b/src/functions/public/ConvertFrom-Base64UrlString.ps1
@@ -1,43 +1,51 @@
 function ConvertFrom-Base64UrlString {
     <#
-.SYNOPSIS
-Base64url decoder.
+        .SYNOPSIS
+        Decodes a base64url string.
 
-.DESCRIPTION
-Decodes base64url-encoded string to the original string or byte array.
+        .DESCRIPTION
+        Decodes a base64url-encoded string to UTF-8 text by default. Use AsByteArray to return the decoded bytes.
 
-.PARAMETER Base64UrlString
-Specifies the encoded input. Mandatory string.
+        .EXAMPLE
+        ```powershell
+        'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9' | ConvertFrom-Base64UrlString
+        ```
 
-.PARAMETER AsByteArray
-Optional switch. If specified, outputs byte array instead of string.
+        Decodes the base64url value to `{"alg":"RS256","typ":"JWT"}`.
 
-.INPUTS
-You can pipe the string input to ConvertFrom-Base64UrlString.
+        .INPUTS
+        System.String
 
-.OUTPUTS
-ConvertFrom-Base64UrlString returns decoded string by default, or the bytes if -AsByteArray is used.
+        .OUTPUTS
+        System.String
+        System.Byte[]
 
-.EXAMPLE
+        .NOTES
+        Converts JWT-safe base64url text by restoring standard base64 characters and padding before decoding.
 
-PS Variable:> 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9' | ConvertFrom-Base64UrlString
-{"alg":"RS256","typ":"JWT"}
+        .LINK
+        https://github.com/SP3269/posh-jwt
 
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
-
-#>
-    [CmdletBinding()]
+        .LINK
+        https://jwt.io/
+    #>
     [OutputType([string], [byte[]])]
-    param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$Base64UrlString,
-        [Parameter(Mandatory = $false)][switch]$AsByteArray
+    [CmdletBinding()]
+    param(
+        # The base64url-encoded string to decode.
+        [Parameter(Mandatory, ValueFromPipeline, Position = 0)]
+        [ValidateNotNullOrEmpty()]
+        [string] $Base64UrlString,
+
+        # Return decoded bytes instead of UTF-8 text.
+        [Parameter()]
+        [switch] $AsByteArray
     )
 
+    begin {}
+
     process {
-        $base64String = $Base64UrlString.replace('-', '+').replace('_', '/')
+        $base64String = $Base64UrlString.Replace('-', '+').Replace('_', '/')
         switch ($base64String.Length % 4) {
             0 { $base64String = $base64String }
             1 { $base64String = $base64String.Substring(0, $base64String.Length - 1) }
@@ -50,4 +58,6 @@ https://jwt.io/
             [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($base64String))
         }
     }
+
+    end {}
 }
diff --git a/src/functions/public/ConvertTo-Base64UrlString.ps1 b/src/functions/public/ConvertTo-Base64UrlString.ps1
index fb1daa1..c7e7d10 100644
--- a/src/functions/public/ConvertTo-Base64UrlString.ps1
+++ b/src/functions/public/ConvertTo-Base64UrlString.ps1
@@ -1,46 +1,56 @@
 function ConvertTo-Base64UrlString {
     <#
-.SYNOPSIS
-Base64url encoder.
+        .SYNOPSIS
+        Encodes text or bytes as a base64url string.
 
-.DESCRIPTION
-Encodes a string or byte array to base64url-encoded string.
+        .DESCRIPTION
+        Encodes a string or byte array using base64url encoding suitable for JWT headers, payloads, and signatures.
 
-.PARAMETER in
-Specifies the input. Must be string, or byte array.
+        .EXAMPLE
+        ```powershell
+        '{"alg":"RS256","typ":"JWT"}' | ConvertTo-Base64UrlString
+        ```
 
-.INPUTS
-You can pipe the string input to ConvertTo-Base64UrlString.
+        Encodes the JWT header JSON as `eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9`.
 
-.OUTPUTS
-ConvertTo-Base64UrlString returns the encoded string by default.
+        .INPUTS
+        System.String
+        System.Byte[]
 
-.EXAMPLE
+        .OUTPUTS
+        System.String
 
-PS Variable:> '{"alg":"RS256","typ":"JWT"}' | ConvertTo-Base64UrlString
-eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9
+        .NOTES
+        Converts standard base64 output to JWT-safe base64url text by replacing URL-sensitive characters and removing padding.
 
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
+        .LINK
+        https://github.com/SP3269/posh-jwt
 
-#>
-    [CmdletBinding()]
+        .LINK
+        https://jwt.io/
+    #>
     [OutputType([string])]
-    param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)]
-        [object]$in
+    [CmdletBinding()]
+    param(
+        # The string or byte array to encode.
+        [Parameter(Mandatory, ValueFromPipeline, Position = 0)]
+        [ValidateNotNull()]
+        [Alias('in')]
+        [object] $InputObject
     )
 
+    begin {}
+
     process {
-        if ($in -is [string]) {
-            $bytes = [System.Text.Encoding]::UTF8.GetBytes($in)
+        if ($InputObject -is [string]) {
+            $bytes = [System.Text.Encoding]::UTF8.GetBytes($InputObject)
             [Convert]::ToBase64String($bytes) -replace '\+', '-' -replace '/', '_' -replace '='
-        } elseif ($in -is [byte[]]) {
-            [Convert]::ToBase64String($in) -replace '\+', '-' -replace '/', '_' -replace '='
+        } elseif ($InputObject -is [byte[]]) {
+            [Convert]::ToBase64String($InputObject) -replace '\+', '-' -replace '/', '_' -replace '='
         } else {
-            throw "ConvertTo-Base64UrlString requires string or byte array input, received $($in.GetType())"
+            throw "ConvertTo-Base64UrlString requires string or byte array input, received $($InputObject.GetType())"
         }
     }
+
+    end {}
 }
diff --git a/src/functions/public/Get-JwtHeader.ps1 b/src/functions/public/Get-JwtHeader.ps1
index b84b73d..3c60522 100644
--- a/src/functions/public/Get-JwtHeader.ps1
+++ b/src/functions/public/Get-JwtHeader.ps1
@@ -1,42 +1,50 @@
 function Get-JwtHeader {
     <#
-.SYNOPSIS
-Gets JSON payload from a JWT (JSON Web Token).
+        .SYNOPSIS
+        Gets the decoded header from a JWT.
 
-.DESCRIPTION
-Decodes and extracts JSON header from JWT. Ignores payload and signature.
+        .DESCRIPTION
+        Decodes and returns the JSON header segment from a JSON Web Token. The payload and signature are ignored.
 
-.PARAMETER jwt
-Specifies the JWT. Mandatory string.
+        .EXAMPLE
+        ```powershell
+        $jwt = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.' #gitleaks:allow
+        Get-JwtHeader -Jwt $jwt
+        ```
 
-.INPUTS
-You can pipe JWT as a string object to Get-JwtHeader.
+        Gets the decoded header JSON from an unsigned JWT.
 
-.OUTPUTS
-String. Get-JwtHeader returns decoded header part of the JWT.
+        .INPUTS
+        System.String
 
-.EXAMPLE
+        .OUTPUTS
+        System.String
 
-PS Variable:> $jwt = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJqb2UiLCJyb2xlIjoiYWRtaW4ifQ.' #gitleaks:allow
-PS Variable:> Get-JwtHeader $jwt
-{"alg":"none","typ":"JWT"}
+        .NOTES
+        This command decodes only the header segment and does not validate the token signature.
 
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
+        .LINK
+        https://github.com/SP3269/posh-jwt
 
-#>
-
-    [CmdletBinding()]
+        .LINK
+        https://jwt.io/
+    #>
     [OutputType([string])]
-    param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt
+    [CmdletBinding()]
+    param(
+        # The JWT to read.
+        [Parameter(Mandatory, ValueFromPipeline, Position = 0)]
+        [ValidateNotNullOrEmpty()]
+        [string] $Jwt
     )
 
+    begin {}
+
     process {
-        Write-Verbose "Processing JWT: $jwt"
-        $parts = $jwt.Split('.')
+        Write-Verbose "Processing JWT: $Jwt"
+        $parts = $Jwt.Split('.')
         ConvertFrom-Base64UrlString $parts[0]
     }
+
+    end {}
 }
diff --git a/src/functions/public/Get-JwtPayload.ps1 b/src/functions/public/Get-JwtPayload.ps1
index 58cb9a2..58e920e 100644
--- a/src/functions/public/Get-JwtPayload.ps1
+++ b/src/functions/public/Get-JwtPayload.ps1
@@ -1,41 +1,49 @@
 function Get-JwtPayload {
     <#
-.SYNOPSIS
-Gets JSON payload from a JWT (JSON Web Token).
+        .SYNOPSIS
+        Gets the decoded payload from a JWT.
 
-.DESCRIPTION
-Decodes and extracts JSON payload from JWT. Ignores headers and signature.
+        .DESCRIPTION
+        Decodes and returns the JSON payload segment from a JSON Web Token. The header and signature are ignored.
 
-.PARAMETER jwt
-Specifies the JWT. Mandatory string.
+        .EXAMPLE
+        ```powershell
+        $jwt | Get-JwtPayload
+        ```
 
-.INPUTS
-You can pipe JWT as a string object to Get-JwtPayload.
+        Gets the decoded payload JSON from a JWT.
 
-.OUTPUTS
-String. Get-JwtPayload returns decoded payload part of the JWT.
+        .INPUTS
+        System.String
 
-.EXAMPLE
+        .OUTPUTS
+        System.String
 
-PS Variable:> $jwt | Get-JwtPayload
-{"token1":"value1","token2":"value2"}
+        .NOTES
+        This command decodes only the payload segment and does not validate the token signature.
 
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
+        .LINK
+        https://github.com/SP3269/posh-jwt
 
-#>
-
-    [CmdletBinding()]
+        .LINK
+        https://jwt.io/
+    #>
     [OutputType([string])]
-    param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt
+    [CmdletBinding()]
+    param(
+        # The JWT to read.
+        [Parameter(Mandatory, ValueFromPipeline, Position = 0)]
+        [ValidateNotNullOrEmpty()]
+        [string] $Jwt
     )
 
+    begin {}
+
     process {
-        Write-Verbose "Processing JWT: $jwt"
-        $parts = $jwt.Split('.')
+        Write-Verbose "Processing JWT: $Jwt"
+        $parts = $Jwt.Split('.')
         ConvertFrom-Base64UrlString $parts[1]
     }
+
+    end {}
 }
diff --git a/src/functions/public/New-Jwt.ps1 b/src/functions/public/New-Jwt.ps1
index fc3ef73..3c48297 100644
--- a/src/functions/public/New-Jwt.ps1
+++ b/src/functions/public/New-Jwt.ps1
@@ -1,92 +1,85 @@
 function New-Jwt {
     <#
-.SYNOPSIS
-Creates a JWT (JSON Web Token).
+        .SYNOPSIS
+        Creates a JSON Web Token.
 
-.DESCRIPTION
-Creates signed JWT given a signing certificate and claims in JSON.
+        .DESCRIPTION
+        Creates a JWT from JSON header and payload strings. Supports RS256 with a signing certificate, HS256 with a
+        shared secret, and the none algorithm.
 
-.PARAMETER Payload
-Specifies the claim to sign in JSON. Mandatory string.
+        .EXAMPLE
+        ```powershell
+        $payload = '{"sub":"1234567890","name":"John Doe","admin":true,"iat":1516239022}'
+        $secret = 'a-string-secret-at-least-256-bits-long'
 
-.PARAMETER Header
-Specifies a JWT header. Optional. Defaults to '{"alg":"RS256","typ":"JWT"}'.
+        New-Jwt -Header '{"alg":"HS256","typ":"JWT"}' -PayloadJson $payload -Secret $secret
+        ```
 
-.PARAMETER Cert
-Specifies the signing certificate of type System.Security.Cryptography.X509Certificates.X509Certificate2.
-Must be specified and contain the private key if the algorithm in the header is RS256.
+        Creates an HS256-signed JWT.
 
-.PARAMETER Secret
-Specifies the HMAC secret. Can be byte array, or a string, which will be converted to bytes.
-Must be specified if the algorithm in the header is HS256.
+        .EXAMPLE
+        ```powershell
+        $cert = (Get-ChildItem Cert:\CurrentUser\My)[1]
+        $jwt = New-Jwt -Cert $cert -PayloadJson '{"token1":"value1","token2":"value2"}'
+        $jwt.Split('.').Count
+        ```
 
-.INPUTS
-You can pipe a string object (the JSON payload) to New-Jwt.
+        Creates an RS256-signed JWT with a certificate private key and returns the number of JWT segments.
 
-.OUTPUTS
-System.String. New-Jwt returns a string with the signed JWT.
+        .INPUTS
+        System.String
 
-.EXAMPLE
-PS Variable:\> $cert = (Get-ChildItem Cert:\CurrentUser\My)[1]
+        .OUTPUTS
+        System.String
 
-PS Variable:\> $jwt = New-Jwt -Cert $cert -PayloadJson '{"token1":"value1","token2":"value2"}'
-PS Variable:\> $jwt.Split('.').Count
-3
+        .NOTES
+        RS256 requires a certificate with a private key. HS256 requires a string or byte array secret.
 
-.EXAMPLE
-$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("/mnt/c/PS/JWT/jwt.pfx","jwt")
-
-$now = (Get-Date).ToUniversalTime()
-$createDate = [Math]::Floor([decimal](Get-Date($now) -UFormat "%s"))
-$expiryDate = [Math]::Floor([decimal](Get-Date($now.AddHours(1)) -UFormat "%s"))
-$rawclaims = [Ordered]@{
-    iss = "examplecom:apikey:uaqCinPt2Enb"
-    iat = $createDate
-    exp = $expiryDate
-} | ConvertTo-Json
-
-$jwt = New-Jwt -PayloadJson $rawclaims -Cert $cert
-
-$apiendpoint = "https://api.example.com/api/1.0/systems"
-
-$splat = @{
-    Method="GET"
-    Uri=$apiendpoint
-    ContentType="application/json"
-    Headers = @{authorization="bearer $jwt"}
-}
-
-Invoke-WebRequest @splat
-
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
-
-#>
+        .LINK
+        https://github.com/SP3269/posh-jwt
 
+        .LINK
+        https://jwt.io/
+    #>
     [Diagnostics.CodeAnalysis.SuppressMessageAttribute(
         'PSUseShouldProcessForStateChangingFunctions', '',
         Justification = 'New-Jwt creates an in-memory token and does not change system state.'
     )]
-    [CmdletBinding()]
     [OutputType([string])]
-    param (
-        [Parameter(Mandatory = $false)][string]$Header = '{"alg":"RS256","typ":"JWT"}',
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$PayloadJson,
-        [Parameter(Mandatory = $false)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
-        [Parameter(Mandatory = $false)]$Secret # Can be string or byte[] - checks in the code
+    [CmdletBinding()]
+    param(
+        # The JWT header JSON.
+        [Parameter()]
+        [ValidateNotNullOrEmpty()]
+        [string] $Header = '{"alg":"RS256","typ":"JWT"}',
+
+        # The JWT payload JSON.
+        [Parameter(Mandatory, ValueFromPipeline, Position = 0)]
+        [ValidateNotNullOrEmpty()]
+        [string] $PayloadJson,
+
+        # The signing certificate to use for RS256 tokens.
+        [Parameter()]
+        [ValidateNotNull()]
+        [System.Security.Cryptography.X509Certificates.X509Certificate2] $Cert,
+
+        # The string or byte array secret to use for HS256 tokens.
+        [Parameter()]
+        [ValidateNotNull()]
+        [object] $Secret
     )
 
+    begin {}
+
     process {
         Write-Verbose "Payload to sign: $PayloadJson"
 
         try {
-            $Alg = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg
+            $algorithm = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg
         } catch {
             throw "The supplied JWT header is not JSON: $Header"
         }
-        Write-Verbose "Algorithm: $Alg"
+        Write-Verbose "Algorithm: $algorithm"
 
         try {
             $null = ConvertFrom-Json -InputObject $PayloadJson -ErrorAction Stop
@@ -96,10 +89,10 @@ https://jwt.io/
 
         $encodedHeader = ConvertTo-Base64UrlString $Header
         $encodedPayload = ConvertTo-Base64UrlString $PayloadJson
-        $jwt = $encodedHeader + '.' + $encodedPayload
-        $toSign = [System.Text.Encoding]::UTF8.GetBytes($jwt)
+        $jwtContent = $encodedHeader + '.' + $encodedPayload
+        $contentBytes = [System.Text.Encoding]::UTF8.GetBytes($jwtContent)
 
-        switch ($Alg) {
+        switch ($algorithm) {
             'RS256' {
                 if (-not $PSBoundParameters.ContainsKey('Cert')) {
                     throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
@@ -111,11 +104,11 @@ https://jwt.io/
                 } else {
                     try {
                         $signature = $rsa.SignData(
-                            $toSign,
+                            $contentBytes,
                             [Security.Cryptography.HashAlgorithmName]::SHA256,
                             [Security.Cryptography.RSASignaturePadding]::Pkcs1
                         )
-                        $sig = ConvertTo-Base64UrlString $signature
+                        $encodedSignature = ConvertTo-Base64UrlString $signature
                     } catch {
                         $message = "Signing with SHA256 and Pkcs1 padding failed using private key $($rsa): $_"
                         throw [System.Exception]::new($message, $_.Exception)
@@ -133,21 +126,23 @@ https://jwt.io/
                     } elseif ($Secret -is [string]) {
                         $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
                     } else {
-                        throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
+                        throw "Expected Secret parameter as byte array or string, instead got $($Secret.GetType())"
                     }
-                    $sig = ConvertTo-Base64UrlString $hmacsha256.ComputeHash($toSign)
+                    $encodedSignature = ConvertTo-Base64UrlString $hmacsha256.ComputeHash($contentBytes)
                 } catch {
                     throw [System.Exception]::new("Signing with HMACSHA256 failed: $_", $_.Exception)
                 }
             }
             'none' {
-                $sig = $null
+                $encodedSignature = $null
             }
             default {
                 throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
             }
         }
 
-        $jwt + '.' + $sig
+        $jwtContent + '.' + $encodedSignature
     }
+
+    end {}
 }
diff --git a/src/functions/public/Test-Jwt.ps1 b/src/functions/public/Test-Jwt.ps1
index a4479f3..68f2d2a 100644
--- a/src/functions/public/Test-Jwt.ps1
+++ b/src/functions/public/Test-Jwt.ps1
@@ -1,67 +1,85 @@
 function Test-Jwt {
     <#
-.SYNOPSIS
-Tests cryptographic integrity of a JWT (JSON Web Token).
+        .SYNOPSIS
+        Tests the cryptographic integrity of a JWT.
 
-.DESCRIPTION
-Verifies a digital signature of a JWT given the signing certificate (for RS256) or the secret (for HS256).
+        .DESCRIPTION
+        Verifies a JWT signature using the signing certificate for RS256 or a shared secret for HS256. Tokens using the
+        none algorithm are valid only when the signature segment is empty.
 
-.PARAMETER Cert
-Specifies the signing certificate of type System.Security.Cryptography.X509Certificates.X509Certificate2.
-Must be specified if the algorithm in the header is RS256. Doesn't have to, and generally shouldn't, contain the private key.
+        .EXAMPLE
+        ```powershell
+        $jwt | Test-Jwt -Secret 'a-string-secret-at-least-256-bits-long'
+        ```
 
-.PARAMETER Secret
-Specifies the HMAC secret. Can be byte array, or a string, which will be converted to bytes.
-Must be specified if the algorithm in the header is HS256.
+        Tests an HS256 JWT with a shared secret.
 
-.INPUTS
-You can pipe JWT as a string object to Test-Jwt.
+        .EXAMPLE
+        ```powershell
+        $jwt | Test-Jwt -Cert $cert
+        ```
 
-.OUTPUTS
-Boolean. Test-Jwt returns $true if the signature successfully verifies.
+        Tests an RS256 JWT with a public certificate.
 
-.EXAMPLE
+        .INPUTS
+        System.String
 
-PS Variable:> $jwt | Test-Jwt -Cert $cert
-True
+        .OUTPUTS
+        System.Boolean
 
-.LINK
-https://github.com/SP3269/posh-jwt
-.LINK
-https://jwt.io/
+        .NOTES
+        The Verify-JwtSignature alias is preserved for compatibility with the original module command surface.
 
-#>
+        .LINK
+        https://github.com/SP3269/posh-jwt
+
+        .LINK
+        https://jwt.io/
+    #>
+    [OutputType([bool])]
     [Alias('Verify-JwtSignature')]
     [CmdletBinding()]
-    [OutputType([bool])]
-    param (
-        [Parameter(Mandatory = $true, ValueFromPipeline = $true)][string]$jwt,
-        [Parameter(Mandatory = $false)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Cert,
-        [Parameter(Mandatory = $false)]$Secret
+    param(
+        # The JWT to test.
+        [Parameter(Mandatory, ValueFromPipeline, Position = 0)]
+        [ValidateNotNullOrEmpty()]
+        [string] $Jwt,
+
+        # The certificate to use for RS256 signature verification.
+        [Parameter()]
+        [ValidateNotNull()]
+        [System.Security.Cryptography.X509Certificates.X509Certificate2] $Cert,
+
+        # The string or byte array secret to use for HS256 signature verification.
+        [Parameter()]
+        [ValidateNotNull()]
+        [object] $Secret
     )
 
+    begin {}
+
     process {
-        Write-Verbose "Verifying JWT: $jwt"
+        Write-Verbose "Verifying JWT: $Jwt"
 
-        $parts = $jwt.Split('.')
+        $parts = $Jwt.Split('.')
         $header = ConvertFrom-Base64UrlString $parts[0]
         try {
-            $Alg = (ConvertFrom-Json -InputObject $header -ErrorAction Stop).alg
+            $algorithm = (ConvertFrom-Json -InputObject $header -ErrorAction Stop).alg
         } catch {
             throw "The supplied JWT header is not JSON: $header"
         }
-        Write-Verbose "Algorithm: $Alg"
+        Write-Verbose "Algorithm: $algorithm"
 
-        switch ($Alg) {
+        switch ($algorithm) {
             'RS256' {
                 if (-not $PSBoundParameters.ContainsKey('Cert')) {
                     throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
                 }
                 $bytes = ConvertFrom-Base64UrlString $parts[2] -AsByteArray
                 Write-Verbose "Using certificate with subject: $($Cert.Subject)"
-                $SHA256 = New-Object Security.Cryptography.SHA256Managed
+                $sha256 = New-Object Security.Cryptography.SHA256Managed
                 $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
-                $computed = $SHA256.ComputeHash($signedContent)
+                $computed = $sha256.ComputeHash($signedContent)
                 $cert.PublicKey.Key.VerifyHash(
                     $computed,
                     $bytes,
@@ -79,7 +97,7 @@ https://jwt.io/
                 } elseif ($Secret -is [string]) {
                     $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
                 } else {
-                    throw "Expected Secret parameter as byte array or string, instead got $($Secret.gettype())"
+                    throw "Expected Secret parameter as byte array or string, instead got $($Secret.GetType())"
                 }
                 $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
                 $signature = $hmacsha256.ComputeHash($signedContent)
@@ -95,4 +113,5 @@ https://jwt.io/
         }
     }
 
+    end {}
 }

From 6b54221a50c3c0c379949c3cc303dc5e974e50f3 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sun, 10 May 2026 19:53:14 +0200
Subject: [PATCH 23/29] =?UTF-8?q?=E2=9C=A8=20[Feature]:=20Update=20links?=
 =?UTF-8?q?=20in=20function=20documentation=20to=20point=20to=20new=20modu?=
 =?UTF-8?q?le=20site=20and=20improve=20error=20handling=20in=20JWT=20funct?=
 =?UTF-8?q?ions?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../public/ConvertFrom-Base64UrlString.ps1    |  4 +--
 .../public/ConvertTo-Base64UrlString.ps1      |  4 +--
 src/functions/public/Get-JwtHeader.ps1        |  2 +-
 src/functions/public/Get-JwtPayload.ps1       |  2 +-
 src/functions/public/New-Jwt.ps1              | 17 ++++++-----
 src/functions/public/Test-Jwt.ps1             | 28 +++++++++----------
 6 files changed, 28 insertions(+), 29 deletions(-)

diff --git a/src/functions/public/ConvertFrom-Base64UrlString.ps1 b/src/functions/public/ConvertFrom-Base64UrlString.ps1
index 52957ad..16f6418 100644
--- a/src/functions/public/ConvertFrom-Base64UrlString.ps1
+++ b/src/functions/public/ConvertFrom-Base64UrlString.ps1
@@ -24,7 +24,7 @@
         Converts JWT-safe base64url text by restoring standard base64 characters and padding before decoding.
 
         .LINK
-        https://github.com/SP3269/posh-jwt
+        https://psmodule.io/Jwt/Functions/ConvertFrom-Base64UrlString/
 
         .LINK
         https://jwt.io/
@@ -47,7 +47,7 @@
     process {
         $base64String = $Base64UrlString.Replace('-', '+').Replace('_', '/')
         switch ($base64String.Length % 4) {
-            0 { $base64String = $base64String }
+            0 { }
             1 { $base64String = $base64String.Substring(0, $base64String.Length - 1) }
             2 { $base64String = $base64String + '==' }
             3 { $base64String = $base64String + '=' }
diff --git a/src/functions/public/ConvertTo-Base64UrlString.ps1 b/src/functions/public/ConvertTo-Base64UrlString.ps1
index c7e7d10..ee4c9e0 100644
--- a/src/functions/public/ConvertTo-Base64UrlString.ps1
+++ b/src/functions/public/ConvertTo-Base64UrlString.ps1
@@ -24,7 +24,7 @@
         Converts standard base64 output to JWT-safe base64url text by replacing URL-sensitive characters and removing padding.
 
         .LINK
-        https://github.com/SP3269/posh-jwt
+        https://psmodule.io/Jwt/Functions/ConvertTo-Base64UrlString/
 
         .LINK
         https://jwt.io/
@@ -48,7 +48,7 @@
         } elseif ($InputObject -is [byte[]]) {
             [Convert]::ToBase64String($InputObject) -replace '\+', '-' -replace '/', '_' -replace '='
         } else {
-            throw "ConvertTo-Base64UrlString requires string or byte array input, received $($InputObject.GetType())"
+            throw [System.ArgumentException]::new("ConvertTo-Base64UrlString requires string or byte array input, received $($InputObject.GetType())")
         }
     }
 
diff --git a/src/functions/public/Get-JwtHeader.ps1 b/src/functions/public/Get-JwtHeader.ps1
index 3c60522..9537bee 100644
--- a/src/functions/public/Get-JwtHeader.ps1
+++ b/src/functions/public/Get-JwtHeader.ps1
@@ -24,7 +24,7 @@
         This command decodes only the header segment and does not validate the token signature.
 
         .LINK
-        https://github.com/SP3269/posh-jwt
+        https://psmodule.io/Jwt/Functions/Get-JwtHeader/
 
         .LINK
         https://jwt.io/
diff --git a/src/functions/public/Get-JwtPayload.ps1 b/src/functions/public/Get-JwtPayload.ps1
index 58e920e..4f3aa81 100644
--- a/src/functions/public/Get-JwtPayload.ps1
+++ b/src/functions/public/Get-JwtPayload.ps1
@@ -23,7 +23,7 @@
         This command decodes only the payload segment and does not validate the token signature.
 
         .LINK
-        https://github.com/SP3269/posh-jwt
+        https://psmodule.io/Jwt/Functions/Get-JwtPayload/
 
         .LINK
         https://jwt.io/
diff --git a/src/functions/public/New-Jwt.ps1 b/src/functions/public/New-Jwt.ps1
index 3c48297..6452b80 100644
--- a/src/functions/public/New-Jwt.ps1
+++ b/src/functions/public/New-Jwt.ps1
@@ -36,7 +36,7 @@
         RS256 requires a certificate with a private key. HS256 requires a string or byte array secret.
 
         .LINK
-        https://github.com/SP3269/posh-jwt
+        https://psmodule.io/Jwt/Functions/New-Jwt/
 
         .LINK
         https://jwt.io/
@@ -119,18 +119,17 @@
                 if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
                     throw 'HS256 requires -Secret parameter'
                 }
+                if ($Secret -isnot [byte[]] -and $Secret -isnot [string]) {
+                    throw [System.ArgumentException]::new("Expected Secret parameter as byte array or string, instead got $($Secret.GetType())")
+                }
+                $hmacsha256 = [System.Security.Cryptography.HMACSHA256]::new()
                 try {
-                    $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
-                    if ($Secret -is [byte[]]) {
-                        $hmacsha256.Key = $Secret
-                    } elseif ($Secret -is [string]) {
-                        $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
-                    } else {
-                        throw "Expected Secret parameter as byte array or string, instead got $($Secret.GetType())"
-                    }
+                    $hmacsha256.Key = if ($Secret -is [byte[]]) { $Secret } else { [System.Text.Encoding]::UTF8.GetBytes($Secret) }
                     $encodedSignature = ConvertTo-Base64UrlString $hmacsha256.ComputeHash($contentBytes)
                 } catch {
                     throw [System.Exception]::new("Signing with HMACSHA256 failed: $_", $_.Exception)
+                } finally {
+                    $hmacsha256.Dispose()
                 }
             }
             'none' {
diff --git a/src/functions/public/Test-Jwt.ps1 b/src/functions/public/Test-Jwt.ps1
index 68f2d2a..df1ef5d 100644
--- a/src/functions/public/Test-Jwt.ps1
+++ b/src/functions/public/Test-Jwt.ps1
@@ -31,7 +31,7 @@ function Test-Jwt {
         The Verify-JwtSignature alias is preserved for compatibility with the original module command surface.
 
         .LINK
-        https://github.com/SP3269/posh-jwt
+        https://psmodule.io/Jwt/Functions/Test-Jwt/
 
         .LINK
         https://jwt.io/
@@ -77,9 +77,8 @@ function Test-Jwt {
                 }
                 $bytes = ConvertFrom-Base64UrlString $parts[2] -AsByteArray
                 Write-Verbose "Using certificate with subject: $($Cert.Subject)"
-                $sha256 = New-Object Security.Cryptography.SHA256Managed
                 $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
-                $computed = $sha256.ComputeHash($signedContent)
+                $computed = [System.Security.Cryptography.SHA256]::HashData($signedContent)
                 $cert.PublicKey.Key.VerifyHash(
                     $computed,
                     $bytes,
@@ -91,18 +90,19 @@ function Test-Jwt {
                 if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
                     throw 'HS256 requires -Secret parameter'
                 }
-                $hmacsha256 = New-Object System.Security.Cryptography.HMACSHA256
-                if ($Secret -is [byte[]]) {
-                    $hmacsha256.Key = $Secret
-                } elseif ($Secret -is [string]) {
-                    $hmacsha256.Key = [System.Text.Encoding]::UTF8.GetBytes($Secret)
-                } else {
-                    throw "Expected Secret parameter as byte array or string, instead got $($Secret.GetType())"
+                if ($Secret -isnot [byte[]] -and $Secret -isnot [string]) {
+                    throw [System.ArgumentException]::new("Expected Secret parameter as byte array or string, instead got $($Secret.GetType())")
+                }
+                $hmacsha256 = [System.Security.Cryptography.HMACSHA256]::new()
+                try {
+                    $hmacsha256.Key = if ($Secret -is [byte[]]) { $Secret } else { [System.Text.Encoding]::UTF8.GetBytes($Secret) }
+                    $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
+                    $signature = $hmacsha256.ComputeHash($signedContent)
+                    $encoded = ConvertTo-Base64UrlString $signature
+                    $encoded -eq $parts[2]
+                } finally {
+                    $hmacsha256.Dispose()
                 }
-                $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
-                $signature = $hmacsha256.ComputeHash($signedContent)
-                $encoded = ConvertTo-Base64UrlString $signature
-                $encoded -eq $parts[2]
             }
             'none' {
                 -not $parts[2]

From 726ffa9ded74e13683f43e086fa7ed6135ee8788 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sun, 10 May 2026 21:08:52 +0200
Subject: [PATCH 24/29] Fix JWT hardening gaps from PR review

---
 .github/linters/trivy.yaml                    |  3 --
 .../public/ConvertFrom-Base64UrlString.ps1    |  2 +-
 src/functions/public/Get-JwtHeader.ps1        |  8 ++-
 src/functions/public/Get-JwtPayload.ps1       |  8 ++-
 src/functions/public/New-Jwt.ps1              |  8 +--
 src/functions/public/Test-Jwt.ps1             | 53 ++++++++++++++----
 tests/Jwt.Tests.ps1                           | 54 +++++++++++++++++++
 7 files changed, 117 insertions(+), 19 deletions(-)
 delete mode 100644 .github/linters/trivy.yaml

diff --git a/.github/linters/trivy.yaml b/.github/linters/trivy.yaml
deleted file mode 100644
index a1fbdd5..0000000
--- a/.github/linters/trivy.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-scan:
-  skip-files:
-    - src/JWT.psm1
diff --git a/src/functions/public/ConvertFrom-Base64UrlString.ps1 b/src/functions/public/ConvertFrom-Base64UrlString.ps1
index 16f6418..e6ae97e 100644
--- a/src/functions/public/ConvertFrom-Base64UrlString.ps1
+++ b/src/functions/public/ConvertFrom-Base64UrlString.ps1
@@ -48,7 +48,7 @@
         $base64String = $Base64UrlString.Replace('-', '+').Replace('_', '/')
         switch ($base64String.Length % 4) {
             0 { }
-            1 { $base64String = $base64String.Substring(0, $base64String.Length - 1) }
+            1 { throw [System.FormatException]::new('Invalid base64url string length.') }
             2 { $base64String = $base64String + '==' }
             3 { $base64String = $base64String + '=' }
         }
diff --git a/src/functions/public/Get-JwtHeader.ps1 b/src/functions/public/Get-JwtHeader.ps1
index 9537bee..c38bf86 100644
--- a/src/functions/public/Get-JwtHeader.ps1
+++ b/src/functions/public/Get-JwtHeader.ps1
@@ -41,8 +41,14 @@
     begin {}
 
     process {
-        Write-Verbose "Processing JWT: $Jwt"
+        Write-Verbose "Processing JWT with length $($Jwt.Length) characters"
         $parts = $Jwt.Split('.')
+        if ($parts.Count -ne 3) {
+            throw [System.ArgumentException]::new('JWT must have exactly 3 segments.')
+        }
+        if (-not $parts[0]) {
+            throw [System.ArgumentException]::new('JWT header segment is missing.')
+        }
         ConvertFrom-Base64UrlString $parts[0]
     }
 
diff --git a/src/functions/public/Get-JwtPayload.ps1 b/src/functions/public/Get-JwtPayload.ps1
index 4f3aa81..78eb909 100644
--- a/src/functions/public/Get-JwtPayload.ps1
+++ b/src/functions/public/Get-JwtPayload.ps1
@@ -40,8 +40,14 @@
     begin {}
 
     process {
-        Write-Verbose "Processing JWT: $Jwt"
+        Write-Verbose "Processing JWT with length $($Jwt.Length) characters"
         $parts = $Jwt.Split('.')
+        if ($parts.Count -ne 3) {
+            throw [System.ArgumentException]::new('JWT must have exactly 3 segments.')
+        }
+        if (-not $parts[1]) {
+            throw [System.ArgumentException]::new('JWT payload segment is missing.')
+        }
         ConvertFrom-Base64UrlString $parts[1]
     }
 
diff --git a/src/functions/public/New-Jwt.ps1 b/src/functions/public/New-Jwt.ps1
index 6452b80..ab8268b 100644
--- a/src/functions/public/New-Jwt.ps1
+++ b/src/functions/public/New-Jwt.ps1
@@ -72,7 +72,7 @@
     begin {}
 
     process {
-        Write-Verbose "Payload to sign: $PayloadJson"
+        Write-Verbose "Payload to sign length: $($PayloadJson.Length) characters"
 
         try {
             $algorithm = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg
@@ -98,7 +98,7 @@
                     throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
                 }
                 Write-Verbose "Signing certificate: $($Cert.Subject)"
-                $rsa = $Cert.PrivateKey
+                $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($Cert)
                 if ($null -eq $rsa) {
                     throw "There's no private key in the supplied certificate - cannot sign"
                 } else {
@@ -110,8 +110,10 @@
                         )
                         $encodedSignature = ConvertTo-Base64UrlString $signature
                     } catch {
-                        $message = "Signing with SHA256 and Pkcs1 padding failed using private key $($rsa): $_"
+                        $message = "Signing with SHA256 and Pkcs1 padding failed using the certificate private key: $_"
                         throw [System.Exception]::new($message, $_.Exception)
+                    } finally {
+                        $rsa.Dispose()
                     }
                 }
             }
diff --git a/src/functions/public/Test-Jwt.ps1 b/src/functions/public/Test-Jwt.ps1
index df1ef5d..dafe781 100644
--- a/src/functions/public/Test-Jwt.ps1
+++ b/src/functions/public/Test-Jwt.ps1
@@ -59,9 +59,18 @@ function Test-Jwt {
     begin {}
 
     process {
-        Write-Verbose "Verifying JWT: $Jwt"
+        Write-Verbose "Verifying JWT with length $($Jwt.Length) characters"
 
         $parts = $Jwt.Split('.')
+        if ($parts.Count -ne 3) {
+            throw [System.ArgumentException]::new('JWT must have exactly 3 segments.')
+        }
+        if (-not $parts[0]) {
+            throw [System.ArgumentException]::new('JWT header segment is missing.')
+        }
+        if (-not $parts[1]) {
+            throw [System.ArgumentException]::new('JWT payload segment is missing.')
+        }
         $header = ConvertFrom-Base64UrlString $parts[0]
         try {
             $algorithm = (ConvertFrom-Json -InputObject $header -ErrorAction Stop).alg
@@ -79,12 +88,20 @@ function Test-Jwt {
                 Write-Verbose "Using certificate with subject: $($Cert.Subject)"
                 $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
                 $computed = [System.Security.Cryptography.SHA256]::HashData($signedContent)
-                $cert.PublicKey.Key.VerifyHash(
-                    $computed,
-                    $bytes,
-                    [Security.Cryptography.HashAlgorithmName]::SHA256,
-                    [Security.Cryptography.RSASignaturePadding]::Pkcs1
-                )
+                $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPublicKey($Cert)
+                if ($null -eq $rsa) {
+                    throw "There's no RSA public key in the supplied certificate - cannot verify"
+                }
+                try {
+                    $rsa.VerifyHash(
+                        $computed,
+                        $bytes,
+                        [Security.Cryptography.HashAlgorithmName]::SHA256,
+                        [Security.Cryptography.RSASignaturePadding]::Pkcs1
+                    )
+                } finally {
+                    $rsa.Dispose()
+                }
             }
             'HS256' {
                 if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
@@ -98,14 +115,30 @@ function Test-Jwt {
                     $hmacsha256.Key = if ($Secret -is [byte[]]) { $Secret } else { [System.Text.Encoding]::UTF8.GetBytes($Secret) }
                     $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
                     $signature = $hmacsha256.ComputeHash($signedContent)
-                    $encoded = ConvertTo-Base64UrlString $signature
-                    $encoded -eq $parts[2]
+                    if (-not $parts[2]) {
+                        $false
+                    } else {
+                        try {
+                            $providedSignature = ConvertFrom-Base64UrlString $parts[2] -AsByteArray
+                        } catch [System.FormatException] {
+                            $providedSignature = $null
+                        }
+                        if ($null -eq $providedSignature -or $signature.Length -ne $providedSignature.Length) {
+                            $false
+                        } else {
+                            $difference = 0
+                            for ($index = 0; $index -lt $signature.Length; $index++) {
+                                $difference = $difference -bor ($signature[$index] -bxor $providedSignature[$index])
+                            }
+                            $difference -eq 0
+                        }
+                    }
                 } finally {
                     $hmacsha256.Dispose()
                 }
             }
             'none' {
-                -not $parts[2]
+                $parts[2] -eq ''
             }
             default {
                 throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
index d3bf754..80d3038 100644
--- a/tests/Jwt.Tests.ps1
+++ b/tests/Jwt.Tests.ps1
@@ -66,6 +66,10 @@ Describe 'Data-driven tests' {
             [System.Text.Encoding]::UTF8.GetString($bytes) | Should -Be 'Hello'
         }
 
+        It 'ConvertFrom-Base64UrlString - rejects invalid base64url length' {
+            { ConvertFrom-Base64UrlString 'A' } | Should -Throw '*Invalid base64url string length*'
+        }
+
         It 'ConvertTo-Base64UrlString - throws for unsupported input types' {
             { ConvertTo-Base64UrlString ([pscustomobject]@{ Value = 'invalid' }) } | Should -Throw '*requires string or byte array input*'
         }
@@ -80,5 +84,55 @@ Describe 'Data-driven tests' {
         It 'New-Jwt - requires the payload to be valid JSON' {
             { New-Jwt -Header '{"alg":"HS256","typ":"JWT"}' -PayloadJson 'not-json' -Secret 'super-secret' } | Should -Throw '*payload is not JSON*'
         }
+
+        It 'Get-JwtHeader - requires exactly three JWT segments' {
+            { Get-JwtHeader 'header.payload' } | Should -Throw '*JWT must have exactly 3 segments*'
+        }
+
+        It 'Get-JwtPayload - requires a payload segment' {
+            { Get-JwtPayload 'header..signature' } | Should -Throw '*JWT payload segment is missing*'
+        }
+
+        It 'Test-Jwt - requires exactly three JWT segments' {
+            { Test-Jwt 'header.payload' } | Should -Throw '*JWT must have exactly 3 segments*'
+        }
+
+        It 'Test-Jwt - rejects unsigned tokens without a third segment' {
+            $header = ConvertTo-Base64UrlString '{"alg":"none","typ":"JWT"}'
+            $payload = ConvertTo-Base64UrlString '{"sub":"joe","role":"admin"}'
+
+            { Test-Jwt "$header.$payload" } | Should -Throw '*JWT must have exactly 3 segments*'
+        }
+
+        It 'Test-Jwt - returns false for an invalid HS256 signature segment' {
+            $jwt = New-Jwt -Header '{"alg":"HS256","typ":"JWT"}' -PayloadJson '{"sub":"joe","role":"admin"}' -Secret 'super-secret'
+            $parts = $jwt.Split('.')
+            $parts[2] = 'A'
+
+            Test-Jwt -jwt ($parts -join '.') -Secret 'super-secret' | Should -BeFalse
+        }
+
+        It 'Verbose output does not include JWT or payload values' {
+            $payload = '{"sub":"joe","role":"admin"}'
+            $jwt = New-Jwt -Header '{"alg":"HS256","typ":"JWT"}' -PayloadJson $payload -Secret 'super-secret'
+
+            $newJwtVerbose = & { New-Jwt -Header '{"alg":"HS256","typ":"JWT"}' -PayloadJson $payload -Secret 'super-secret' -Verbose } 4>&1 |
+                Where-Object { $_.GetType().Name -eq 'VerboseRecord' } |
+                Out-String
+            $getHeaderVerbose = & { Get-JwtHeader $jwt -Verbose } 4>&1 |
+                Where-Object { $_.GetType().Name -eq 'VerboseRecord' } |
+                Out-String
+            $getPayloadVerbose = & { Get-JwtPayload $jwt -Verbose } 4>&1 |
+                Where-Object { $_.GetType().Name -eq 'VerboseRecord' } |
+                Out-String
+            $testJwtVerbose = & { Test-Jwt -jwt $jwt -Secret 'super-secret' -Verbose } 4>&1 |
+                Where-Object { $_.GetType().Name -eq 'VerboseRecord' } |
+                Out-String
+
+            $newJwtVerbose | Should -Not -Match ([regex]::Escape($payload))
+            $getHeaderVerbose | Should -Not -Match ([regex]::Escape($jwt))
+            $getPayloadVerbose | Should -Not -Match ([regex]::Escape($jwt))
+            $testJwtVerbose | Should -Not -Match ([regex]::Escape($jwt))
+        }
     }
 }

From 4ae210b40e87fcc617dcc00d435afd2f48b29705 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Sun, 10 May 2026 22:34:50 +0200
Subject: [PATCH 25/29] Restore trivy.yaml to prevent default exit-code:1
 triggering on test data

Without a repo-level .github/linters/trivy.yaml, Super-Linter falls back
to its built-in /action/lib/.automation/trivy.yaml which has exit-code:1
enabled. JWT test token strings in tests/Data/TestCases.ps1 are flagged
by Trivy's secret scanner, causing the lint step to fail with no source-
level change needed. Restore the config to override the default: our
scanners list matches the default but without exit-code:1, so real build
artifacts continue to be skipped and false positives from test data do
not block CI.
---
 .github/linters/trivy.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 .github/linters/trivy.yaml

diff --git a/.github/linters/trivy.yaml b/.github/linters/trivy.yaml
new file mode 100644
index 0000000..0646d5d
--- /dev/null
+++ b/.github/linters/trivy.yaml
@@ -0,0 +1,10 @@
+scan:
+  disable-telemetry: true
+  scanners:
+    - vuln
+    - misconfig
+    - secret
+  skip-files:
+    # src/JWT.psm1 is a build artifact generated by Process-PSModule and is
+    # not present in source. Skip it so lint runs against checked-in files only.
+    - src/JWT.psm1

From 243d072f385dcc72d3c03c04f5838fe9072109c5 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Mon, 11 May 2026 00:23:43 +0200
Subject: [PATCH 26/29] Fix reviewer-identified hardening gaps: typed
 exceptions without token data, RS256 empty-sig guard

- Test-Jwt RS256: return false for empty third segment instead of binding exception
- Test-Jwt: throw typed FormatException for non-JSON header (no header content in message)
- New-Jwt: throw typed FormatException for non-JSON header and payload (no content in messages)
- Update test assertion wildcard to match new payload error message text
---
 src/functions/public/New-Jwt.ps1  | 4 ++--
 src/functions/public/Test-Jwt.ps1 | 5 ++++-
 tests/Jwt.Tests.ps1               | 2 +-
 3 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/functions/public/New-Jwt.ps1 b/src/functions/public/New-Jwt.ps1
index ab8268b..8a9385d 100644
--- a/src/functions/public/New-Jwt.ps1
+++ b/src/functions/public/New-Jwt.ps1
@@ -77,14 +77,14 @@
         try {
             $algorithm = (ConvertFrom-Json -InputObject $Header -ErrorAction Stop).alg
         } catch {
-            throw "The supplied JWT header is not JSON: $Header"
+            throw [System.FormatException]::new("The supplied JWT header is not valid JSON. Header length: $($Header.Length) characters.")
         }
         Write-Verbose "Algorithm: $algorithm"
 
         try {
             $null = ConvertFrom-Json -InputObject $PayloadJson -ErrorAction Stop
         } catch {
-            throw "The supplied JWT payload is not JSON: $PayloadJson"
+            throw [System.FormatException]::new("The supplied JWT payload is not valid JSON. Payload length: $($PayloadJson.Length) characters.")
         }
 
         $encodedHeader = ConvertTo-Base64UrlString $Header
diff --git a/src/functions/public/Test-Jwt.ps1 b/src/functions/public/Test-Jwt.ps1
index dafe781..1d0b613 100644
--- a/src/functions/public/Test-Jwt.ps1
+++ b/src/functions/public/Test-Jwt.ps1
@@ -75,7 +75,7 @@ function Test-Jwt {
         try {
             $algorithm = (ConvertFrom-Json -InputObject $header -ErrorAction Stop).alg
         } catch {
-            throw "The supplied JWT header is not JSON: $header"
+            throw [System.FormatException]::new("The supplied JWT header segment is not valid JSON. Header length: $($header.Length) characters.")
         }
         Write-Verbose "Algorithm: $algorithm"
 
@@ -84,6 +84,9 @@ function Test-Jwt {
                 if (-not $PSBoundParameters.ContainsKey('Cert')) {
                     throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
                 }
+                if ([string]::IsNullOrEmpty($parts[2])) {
+                    return $false
+                }
                 $bytes = ConvertFrom-Base64UrlString $parts[2] -AsByteArray
                 Write-Verbose "Using certificate with subject: $($Cert.Subject)"
                 $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
index 80d3038..70b3a9f 100644
--- a/tests/Jwt.Tests.ps1
+++ b/tests/Jwt.Tests.ps1
@@ -82,7 +82,7 @@ Describe 'Data-driven tests' {
         }
 
         It 'New-Jwt - requires the payload to be valid JSON' {
-            { New-Jwt -Header '{"alg":"HS256","typ":"JWT"}' -PayloadJson 'not-json' -Secret 'super-secret' } | Should -Throw '*payload is not JSON*'
+            { New-Jwt -Header '{"alg":"HS256","typ":"JWT"}' -PayloadJson 'not-json' -Secret 'super-secret' } | Should -Throw '*payload is not valid JSON*'
         }
 
         It 'Get-JwtHeader - requires exactly three JWT segments' {

From 383fcf98972e9c1fe8393eab9f0ff74eece79fb9 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Mon, 11 May 2026 01:01:52 +0200
Subject: [PATCH 27/29] Fix PSAvoidLongLines on test line 85: split long Should
 -Throw assertion

---
 tests/Jwt.Tests.ps1 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
index 70b3a9f..3ec9a7b 100644
--- a/tests/Jwt.Tests.ps1
+++ b/tests/Jwt.Tests.ps1
@@ -82,7 +82,9 @@ Describe 'Data-driven tests' {
         }
 
         It 'New-Jwt - requires the payload to be valid JSON' {
-            { New-Jwt -Header '{"alg":"HS256","typ":"JWT"}' -PayloadJson 'not-json' -Secret 'super-secret' } | Should -Throw '*payload is not valid JSON*'
+            $header = '{"alg":"HS256","typ":"JWT"}'
+            { New-Jwt -Header $header -PayloadJson 'not-json' -Secret 'super-secret' } |
+                Should -Throw '*payload is not valid JSON*'
         }
 
         It 'Get-JwtHeader - requires exactly three JWT segments' {

From 942101a3181a3d8b688a71f0d358e4df632bfb7e Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Mon, 11 May 2026 01:18:45 +0200
Subject: [PATCH 28/29] Fix reviewer-identified issues: RS256 malformed-sig
 guard, typed param exceptions, add src/manifest.psd1

- Test-Jwt RS256: catch FormatException from ConvertFrom-Base64UrlString \[2] and return \False
- Test-Jwt + New-Jwt: replace untyped string throws with ArgumentException/NotSupportedException
  for missing -Cert, missing -Secret, no-RSA-key, and unsupported-algorithm cases
- Add src/manifest.psd1 with JWT gallery tags (JWT, JSON, Token, Authentication, Security, PSModule)
- Update test assertion wildcard for HS256-requires-Secret message to match new wording
---
 src/functions/public/New-Jwt.ps1  |  8 ++++----
 src/functions/public/Test-Jwt.ps1 | 14 +++++++++-----
 src/manifest.psd1                 | 14 ++++++++++++++
 tests/Jwt.Tests.ps1               |  2 +-
 4 files changed, 28 insertions(+), 10 deletions(-)
 create mode 100644 src/manifest.psd1

diff --git a/src/functions/public/New-Jwt.ps1 b/src/functions/public/New-Jwt.ps1
index 8a9385d..47639c8 100644
--- a/src/functions/public/New-Jwt.ps1
+++ b/src/functions/public/New-Jwt.ps1
@@ -95,12 +95,12 @@
         switch ($algorithm) {
             'RS256' {
                 if (-not $PSBoundParameters.ContainsKey('Cert')) {
-                    throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
+                    throw [System.ArgumentException]::new('RS256 requires a -Cert parameter of type X509Certificate2.', 'Cert')
                 }
                 Write-Verbose "Signing certificate: $($Cert.Subject)"
                 $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($Cert)
                 if ($null -eq $rsa) {
-                    throw "There's no private key in the supplied certificate - cannot sign"
+                    throw [System.ArgumentException]::new('The supplied certificate has no RSA private key and cannot be used to sign.', 'Cert')
                 } else {
                     try {
                         $signature = $rsa.SignData(
@@ -119,7 +119,7 @@
             }
             'HS256' {
                 if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
-                    throw 'HS256 requires -Secret parameter'
+                    throw [System.ArgumentException]::new('HS256 requires a -Secret parameter.', 'Secret')
                 }
                 if ($Secret -isnot [byte[]] -and $Secret -isnot [string]) {
                     throw [System.ArgumentException]::new("Expected Secret parameter as byte array or string, instead got $($Secret.GetType())")
@@ -138,7 +138,7 @@
                 $encodedSignature = $null
             }
             default {
-                throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
+                throw [System.NotSupportedException]::new('The algorithm is not one of the supported: "RS256", "HS256", "none".')
             }
         }
 
diff --git a/src/functions/public/Test-Jwt.ps1 b/src/functions/public/Test-Jwt.ps1
index 1d0b613..8be3f21 100644
--- a/src/functions/public/Test-Jwt.ps1
+++ b/src/functions/public/Test-Jwt.ps1
@@ -82,18 +82,22 @@ function Test-Jwt {
         switch ($algorithm) {
             'RS256' {
                 if (-not $PSBoundParameters.ContainsKey('Cert')) {
-                    throw 'RS256 requires -Cert parameter of type System.Security.Cryptography.X509Certificates.X509Certificate2'
+                    throw [System.ArgumentException]::new('RS256 requires a -Cert parameter of type X509Certificate2.', 'Cert')
                 }
                 if ([string]::IsNullOrEmpty($parts[2])) {
                     return $false
                 }
-                $bytes = ConvertFrom-Base64UrlString $parts[2] -AsByteArray
+                try {
+                    $bytes = ConvertFrom-Base64UrlString $parts[2] -AsByteArray
+                } catch [System.FormatException] {
+                    return $false
+                }
                 Write-Verbose "Using certificate with subject: $($Cert.Subject)"
                 $signedContent = [System.Text.Encoding]::UTF8.GetBytes($parts[0] + '.' + $parts[1])
                 $computed = [System.Security.Cryptography.SHA256]::HashData($signedContent)
                 $rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPublicKey($Cert)
                 if ($null -eq $rsa) {
-                    throw "There's no RSA public key in the supplied certificate - cannot verify"
+                    throw [System.ArgumentException]::new('The supplied certificate has no RSA public key and cannot be used to verify.', 'Cert')
                 }
                 try {
                     $rsa.VerifyHash(
@@ -108,7 +112,7 @@ function Test-Jwt {
             }
             'HS256' {
                 if (-not ($PSBoundParameters.ContainsKey('Secret'))) {
-                    throw 'HS256 requires -Secret parameter'
+                    throw [System.ArgumentException]::new('HS256 requires a -Secret parameter.', 'Secret')
                 }
                 if ($Secret -isnot [byte[]] -and $Secret -isnot [string]) {
                     throw [System.ArgumentException]::new("Expected Secret parameter as byte array or string, instead got $($Secret.GetType())")
@@ -144,7 +148,7 @@ function Test-Jwt {
                 $parts[2] -eq ''
             }
             default {
-                throw 'The algorithm is not one of the supported: "RS256", "HS256", "none"'
+                throw [System.NotSupportedException]::new('The algorithm is not one of the supported: "RS256", "HS256", "none".')
             }
         }
     }
diff --git a/src/manifest.psd1 b/src/manifest.psd1
new file mode 100644
index 0000000..40bd8bb
--- /dev/null
+++ b/src/manifest.psd1
@@ -0,0 +1,14 @@
+@{
+    PrivateData = @{
+        PSData = @{
+            Tags = @(
+                'JWT'
+                'JSON'
+                'Token'
+                'Authentication'
+                'Security'
+                'PSModule'
+            )
+        }
+    }
+}
diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
index 3ec9a7b..283ac90 100644
--- a/tests/Jwt.Tests.ps1
+++ b/tests/Jwt.Tests.ps1
@@ -55,7 +55,7 @@ Describe 'Data-driven tests' {
         }
 
         It 'New-Jwt - requires a secret' {
-            { New-Jwt -Header $Header -PayloadJson $Payload } | Should -Throw '*HS256 requires -Secret parameter*'
+            { New-Jwt -Header $Header -PayloadJson $Payload } | Should -Throw '*HS256 requires*Secret*'
         }
     }
 

From dfc66452bc1264e8ec3df4e7b92823bafab0eb45 Mon Sep 17 00:00:00 2001
From: Marius Storhaug <marstor@hotmail.com>
Date: Mon, 11 May 2026 20:23:41 +0200
Subject: [PATCH 29/29] Fix missing alg validation and add paramName to
 ArgumentException; add tests

- New-Jwt/Test-Jwt: throw FormatException when header JSON parses successfully
  but contains no alg claim, giving a targeted error instead of a misleading
  NotSupportedException (threads r3215702514 / r3215702516)
- New-Jwt/Test-Jwt: add paramName 'Secret' to the HS256 Secret-type
  ArgumentException so callers can consistently identify the failing parameter
  (threads r3220268341 / r3220268308)
- tests: add coverage for missing alg in New-Jwt and Test-Jwt
---
 src/functions/public/New-Jwt.ps1  |  5 ++++-
 src/functions/public/Test-Jwt.ps1 |  5 ++++-
 tests/Jwt.Tests.ps1               | 13 +++++++++++++
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/functions/public/New-Jwt.ps1 b/src/functions/public/New-Jwt.ps1
index 47639c8..1d5bcb6 100644
--- a/src/functions/public/New-Jwt.ps1
+++ b/src/functions/public/New-Jwt.ps1
@@ -79,6 +79,9 @@
         } catch {
             throw [System.FormatException]::new("The supplied JWT header is not valid JSON. Header length: $($Header.Length) characters.")
         }
+        if ([string]::IsNullOrEmpty($algorithm)) {
+            throw [System.FormatException]::new('The JWT header is missing the required "alg" claim.')
+        }
         Write-Verbose "Algorithm: $algorithm"
 
         try {
@@ -122,7 +125,7 @@
                     throw [System.ArgumentException]::new('HS256 requires a -Secret parameter.', 'Secret')
                 }
                 if ($Secret -isnot [byte[]] -and $Secret -isnot [string]) {
-                    throw [System.ArgumentException]::new("Expected Secret parameter as byte array or string, instead got $($Secret.GetType())")
+                    throw [System.ArgumentException]::new("Expected Secret parameter as byte array or string, instead got $($Secret.GetType())", 'Secret')
                 }
                 $hmacsha256 = [System.Security.Cryptography.HMACSHA256]::new()
                 try {
diff --git a/src/functions/public/Test-Jwt.ps1 b/src/functions/public/Test-Jwt.ps1
index 8be3f21..445c474 100644
--- a/src/functions/public/Test-Jwt.ps1
+++ b/src/functions/public/Test-Jwt.ps1
@@ -77,6 +77,9 @@ function Test-Jwt {
         } catch {
             throw [System.FormatException]::new("The supplied JWT header segment is not valid JSON. Header length: $($header.Length) characters.")
         }
+        if ([string]::IsNullOrEmpty($algorithm)) {
+            throw [System.FormatException]::new('The JWT header is missing the required "alg" claim.')
+        }
         Write-Verbose "Algorithm: $algorithm"
 
         switch ($algorithm) {
@@ -115,7 +118,7 @@ function Test-Jwt {
                     throw [System.ArgumentException]::new('HS256 requires a -Secret parameter.', 'Secret')
                 }
                 if ($Secret -isnot [byte[]] -and $Secret -isnot [string]) {
-                    throw [System.ArgumentException]::new("Expected Secret parameter as byte array or string, instead got $($Secret.GetType())")
+                    throw [System.ArgumentException]::new("Expected Secret parameter as byte array or string, instead got $($Secret.GetType())", 'Secret')
                 }
                 $hmacsha256 = [System.Security.Cryptography.HMACSHA256]::new()
                 try {
diff --git a/tests/Jwt.Tests.ps1 b/tests/Jwt.Tests.ps1
index 283ac90..d32242c 100644
--- a/tests/Jwt.Tests.ps1
+++ b/tests/Jwt.Tests.ps1
@@ -87,6 +87,19 @@ Describe 'Data-driven tests' {
                 Should -Throw '*payload is not valid JSON*'
         }
 
+        It 'New-Jwt - rejects a header missing the alg claim' {
+            { New-Jwt -Header '{"typ":"JWT"}' -PayloadJson '{"sub":"joe"}' -Secret 'super-secret' } |
+                Should -Throw '*missing the required "alg" claim*'
+        }
+
+        It 'Test-Jwt - rejects a token with a header missing the alg claim' {
+            $header = ConvertTo-Base64UrlString '{"typ":"JWT"}'
+            $payload = ConvertTo-Base64UrlString '{"sub":"joe"}'
+            $sig = ConvertTo-Base64UrlString 'fakesig'
+            { Test-Jwt "$header.$payload.$sig" -Secret 'super-secret' } |
+                Should -Throw '*missing the required "alg" claim*'
+        }
+
         It 'Get-JwtHeader - requires exactly three JWT segments' {
             { Get-JwtHeader 'header.payload' } | Should -Throw '*JWT must have exactly 3 segments*'
         }