@explyt/ai-agent 0.1.0-rc.1 → 0.1.3

package/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -1,197 +1,146 @@
-import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';
-import { encoder, strictDecoder } from './buffer_utils.js';
-import { isObject } from './type_checks.js';
-const epoch = (date) => Math.floor(date.getTime() / 1000);
-const multipliers = {
-    s: 1,
-    m: 60,
-    h: 3600,
-    d: 86400,
-    w: 604800,
-    y: 31557600,
-};
-const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
-const checkFailed = 'check_failed';
-export function secs(str) {
-    const matched = REGEX.exec(str);
-    if (!matched || (matched[4] && matched[1])) {
-        throw new TypeError('Invalid time period format');
-    }
-    const value = parseFloat(matched[2]);
-    const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-    if (matched[1] === '-' || matched[4] === 'ago') {
-        return -numericDate;
-    }
-    return numericDate;
+import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "../util/errors.js";
+import { encoder, strictDecoder } from "./buffer_utils.js";
+import { isObject } from "./validate.js";
+const epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {
+  s: 1,
+  m: 60,
+  h: 3600,
+  d: 86400,
+  w: 604800,
+  y: 31557600
+}, REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = "check_failed";
+function invalidDuration() {
+  throw new TypeError("Invalid time period format");
+}
+function secs(str) {
+  typeof str != "string" && invalidDuration();
+  const matched = REGEX.exec(str);
+  (!matched || matched[4] && matched[1]) && invalidDuration();
+  const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
 }
 function validateInput(label, input) {
-    if (!Number.isFinite(input)) {
-        throw new TypeError(`Invalid ${label} input`);
-    }
-    return input;
+  if (!Number.isFinite(input))
+    throw new TypeError(`Invalid ${label} input`);
+  return input;
+}
+function validateStringClaim(claim, value) {
+  if (typeof value != "string")
+    throw new TypeError(`"${claim}" claim must be a string`);
+}
+function validateAudienceClaim(value) {
+  if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string")))
+    throw new TypeError('"aud" claim must be a string or an array of strings');
 }
 function numericDate(value, label) {
-    if (typeof value === 'number')
-        return validateInput(label, value);
-    if (value instanceof Date)
-        return validateInput(label, epoch(value));
-    return epoch(new Date()) + secs(value);
+  return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
 }
 const normalizeTyp = (value) => {
-    if (value.includes('/')) {
-        return value.toLowerCase();
-    }
-    return `application/${value.toLowerCase()}`;
-};
-const checkAudiencePresence = (audPayload, audOption) => {
-    if (typeof audPayload === 'string') {
-        return audOption.includes(audPayload);
-    }
-    if (Array.isArray(audPayload)) {
-        return audOption.some((aud) => audPayload.includes(aud));
-    }
-    return false;
-};
-function validateNumericDate(payload, claim, required = false) {
-    const value = payload[claim];
-    if (value === undefined && !required)
-        return undefined;
-    if (typeof value !== 'number') {
-        throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, 'invalid');
-    }
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
+}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;
+function validateNumericDate(payload, claim, required = !1) {
+  const value = payload[claim];
+  if (!(value === void 0 && !required)) {
+    if (typeof value != "number")
+      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
     return value;
+  }
 }
 function unexpectedClaim(payload, claim) {
-    throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+  throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
+}
+function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+  let payload;
+  try {
+    payload = JSON.parse(strictDecoder.decode(encodedPayload));
+  } catch {
+  }
+  if (!isObject(payload))
+    throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
+  const { typ } = options;
+  if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
+    throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
+  const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+  maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+  for (const claim of new Set(presenceCheck.reverse()))
+    if (!Object.hasOwn(payload, claim))
+      throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
+  issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
+  const { clockTolerance } = options;
+  let tolerance = 0;
+  if (typeof clockTolerance == "string")
+    tolerance = secs(clockTolerance);
+  else if (clockTolerance !== void 0) {
+    if (typeof clockTolerance != "number")
+      throw new TypeError("Invalid clockTolerance option type");
+    tolerance = clockTolerance;
+  }
+  validateInput("clockTolerance option", tolerance);
+  const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+  if (nbf !== void 0 && nbf > now + tolerance)
+    throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
+  const exp = validateNumericDate(payload, "exp");
+  if (exp !== void 0 && exp <= now - tolerance)
+    throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
+  if (maxTokenAge !== void 0) {
+    const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+    if (age - tolerance > max)
+      throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
+    if (age < -tolerance)
+      throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
+  }
+  return payload;
+}
+let producerPayloads;
+function producerPayload(producer) {
+  return producerPayloads.get(producer);
 }
-export function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
-    let payload;
-    try {
-        payload = JSON.parse(strictDecoder.decode(encodedPayload));
-    }
-    catch {
-    }
-    if (!isObject(payload)) {
-        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
-    }
-    const { typ } = options;
-    if (typ &&
-        (typeof protectedHeader.typ !== 'string' ||
-            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', checkFailed);
-    }
-    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
-    const presenceCheck = [...requiredClaims];
-    if (maxTokenAge !== undefined)
-        presenceCheck.push('iat');
-    if (audience !== undefined)
-        presenceCheck.push('aud');
-    if (subject !== undefined)
-        presenceCheck.push('sub');
-    if (issuer !== undefined)
-        presenceCheck.push('iss');
-    for (const claim of new Set(presenceCheck.reverse())) {
-        if (!Object.hasOwn(payload, claim)) {
-            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
-        }
-    }
-    if (issuer !== undefined &&
-        !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        unexpectedClaim(payload, 'iss');
-    }
-    if (subject !== undefined && payload.sub !== subject) {
-        unexpectedClaim(payload, 'sub');
-    }
-    if (audience !== undefined &&
-        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        unexpectedClaim(payload, 'aud');
-    }
-    const { clockTolerance } = options;
-    let tolerance = 0;
-    if (typeof clockTolerance === 'string') {
-        tolerance = secs(clockTolerance);
-    }
-    else if (clockTolerance !== undefined) {
-        if (typeof clockTolerance !== 'number') {
-            throw new TypeError('Invalid clockTolerance option type');
-        }
-        tolerance = clockTolerance;
-    }
-    validateInput('clockTolerance option', tolerance);
-    const { currentDate } = options;
-    const now = validateInput('currentDate option', epoch(currentDate || new Date()));
-    const iat = validateNumericDate(payload, 'iat', maxTokenAge !== undefined);
-    const nbf = validateNumericDate(payload, 'nbf');
-    if (nbf !== undefined) {
-        if (nbf > now + tolerance) {
-            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', checkFailed);
-        }
-    }
-    const exp = validateNumericDate(payload, 'exp');
-    if (exp !== undefined) {
-        if (exp <= now - tolerance) {
-            throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', checkFailed);
-        }
-    }
-    if (maxTokenAge !== undefined) {
-        const age = now - iat;
-        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
-        if (age - tolerance > max) {
-            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', checkFailed);
-        }
-        if (age < 0 - tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', checkFailed);
-        }
-    }
-    return payload;
+function jwtData(producer) {
+  const payload = producerPayload(producer);
+  for (const claim of ["iat", "nbf", "exp"]) {
+    const value = payload[claim];
+    if (typeof value == "number" && !Number.isFinite(value))
+      throw new TypeError(`"${claim}" claim must be a finite number`);
+  }
+  return encoder.encode(JSON.stringify(payload));
+}
+function jwtClaim(producer, claim) {
+  return producerPayload(producer)[claim];
 }
-export class JWTClaimsBuilder {
-    #payload;
-    constructor(payload) {
-        if (!isObject(payload)) {
-            throw new TypeError('JWT Claims Set MUST be an object');
-        }
-        this.#payload = structuredClone(payload);
-    }
-    data() {
-        return encoder.encode(JSON.stringify(this.#payload));
-    }
-    get iss() {
-        return this.#payload.iss;
-    }
-    set iss(value) {
-        this.#payload.iss = value;
-    }
-    get sub() {
-        return this.#payload.sub;
-    }
-    set sub(value) {
-        this.#payload.sub = value;
-    }
-    get aud() {
-        return this.#payload.aud;
-    }
-    set aud(value) {
-        this.#payload.aud = value;
-    }
-    set jti(value) {
-        this.#payload.jti = value;
-    }
-    set nbf(value) {
-        this.#payload.nbf = numericDate(value, 'setNotBefore');
-    }
-    set exp(value) {
-        this.#payload.exp = numericDate(value, 'setExpirationTime');
-    }
-    set iat(value) {
-        if (value === undefined) {
-            this.#payload.iat = epoch(new Date());
-        }
-        else if (typeof value === 'string') {
-            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
-        }
-        else {
-            this.#payload.iat = numericDate(value, 'setIssuedAt');
-        }
-    }
+class JWTClaimsBuilder {
+  constructor(payload = {}) {
+    if (!isObject(payload))
+      throw new TypeError("JWT Claims Set MUST be an object");
+    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
+  }
+  setIssuer(value) {
+    return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
+  }
+  setSubject(value) {
+    return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
+  }
+  setAudience(value) {
+    return validateAudienceClaim(value), producerPayload(this).aud = value, this;
+  }
+  setJti(value) {
+    return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
+  }
+  setNotBefore(value) {
+    return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
+  }
+  setExpirationTime(value) {
+    return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
+  }
+  setIssuedAt(value) {
+    const payload = producerPayload(this);
+    return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
+  }
 }
+export {
+  JWTClaimsBuilder,
+  jwtClaim,
+  jwtData,
+  secs,
+  validateClaimsSet
+};

package/node_modules/jose/dist/webapi/lib/key.js

@@ -1,132 +1,155 @@
-import { withAlg as invalidKeyInput } from './invalid_key_input.js';
-import { isKeyLike, isCryptoKey } from './is_key_like.js';
-import * as jwk from './type_checks.js';
-import { decode } from '../util/base64url.js';
-import { jwkToKey } from './jwk_to_key.js';
-const tag = (key) => key[Symbol.toStringTag];
-const jwkMatchesOp = (entry, key, usage) => {
-    const { alg } = entry;
-    if (key.use !== undefined) {
-        const expected = usage === 'sign' || usage === 'verify' ? 'sig' : 'enc';
-        if (key.use !== expected) {
-            throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-        }
-    }
-    if (key.alg !== undefined && key.alg !== alg) {
-        throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-    }
-    if (Array.isArray(key.key_ops)) {
-        const expectedKeyOp = usage === 'encrypt' || usage === 'decrypt' ? entry.ops?.[usage === 'encrypt' ? 0 : 1] : usage;
-        if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) {
-            throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-        }
-    }
+import { isObject } from "./validate.js";
+import { decode } from "../util/base64url.js";
+import { JOSENotSupported } from "../util/errors.js";
+const tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {
+  const { alg } = entry;
+  if (key.use !== void 0) {
+    const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
+    if (key.use !== expected)
+      throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
+  }
+  if (key.alg !== void 0 && key.alg !== alg)
+    throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
+  if (Array.isArray(key.key_ops)) {
+    const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
+    if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
+      throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
+  }
 };
-export function checkKeyType(entry, key, usage) {
-    const { alg, secret } = entry;
-    const privateKey = usage === 'decrypt' || usage === 'sign';
-    if (secret && key instanceof Uint8Array)
-        return [BYTES, key];
-    if (jwk.isJWK(key)) {
-        if (secret ? !jwk.isSecretJWK(key) : !(privateKey ? jwk.isPrivateJWK(key) : jwk.isPublicJWK(key))) {
-            throw new TypeError(secret
-                ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`
-                : `JSON Web Key for this operation must be a ${privateKey ? 'private' : 'public'} JWK`);
-        }
-        jwkMatchesOp(entry, key, usage);
-        return [JWK, key];
-    }
-    if (!isKeyLike(key)) {
-        throw new TypeError(secret
-            ? invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array')
-            : invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
-    }
-    if (secret) {
-        if (key.type !== 'secret') {
-            throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
-        }
+async function prepareKey(entry, key, usage) {
+  const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+  if (secret && key instanceof Uint8Array)
+    return key;
+  let normalized, keyObject;
+  if (isObject(key)) {
+    if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
+      throw invalidKeyType(alg, key, secret);
+    if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
+      throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+    if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
+      return decode(normalized.k);
+    if (!Object.isFrozen(key)) {
+      const { key_ops } = key;
+      Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
     }
-    else {
-        if (key.type === 'secret') {
-            throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
-        }
-        const expectedType = privateKey ? 'private' : 'public';
-        if ((key.type === 'public' || key.type === 'private') && key.type !== expectedType) {
-            const operation = usage === 'sign'
-                ? 'signing'
-                : usage === 'verify'
-                    ? 'verifying'
-                    : `${usage.slice(0, -1)}tion`;
-            throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`);
-        }
-    }
-    return isCryptoKey(key) ? [CRYPTO, key] : [KEYOBJECT, key];
+  } else {
+    if (!isKeyLike(key))
+      throw invalidKeyType(alg, key, secret);
+    const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+    if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
+      throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+    if (isCryptoKey(key))
+      return key;
+    if (keyObject = key, keyObject.type === "secret")
+      return keyObject.export();
+  }
+  cache ||= /* @__PURE__ */ new WeakMap();
+  const cacheKey = key;
+  let cached = cache.get(cacheKey);
+  if (cached?.[alg])
+    return cached[alg];
+  if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+    const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
+    return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+  }
+  return normalized ??= keyObject.export({ format: "jwk" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
 }
-const BYTES = 0;
-const CRYPTO = 1;
-const KEYOBJECT = 2;
-const JWK = 3;
 let cache;
 const nist = {
-    __proto__: null,
-    prime256v1: 'P-256',
-    secp384r1: 'P-384',
-    secp521r1: 'P-521',
+  __proto__: null,
+  prime256v1: "P-256",
+  secp384r1: "P-384",
+  secp521r1: "P-521"
 };
-function cached(key, alg, value) {
-    cache ||= new WeakMap();
-    const entry = cache.get(key);
-    if (value) {
-        if (entry) {
-            entry[alg] = value;
-        }
-        else {
-            cache.set(key, { __proto__: null, [alg]: value });
-        }
-    }
-    return value ?? entry?.[alg];
+function assertCryptoKey(key) {
+  if (!isCryptoKey(key))
+    throw new Error("CryptoKey instance expected");
 }
-const handleJWK = async (key, jwk, entry) => cached(key, entry.alg) ??
-    cached(key, entry.alg, await jwkToKey(entry, { ...jwk, alg: entry.alg }));
-const handleKeyObject = (keyObject, entry) => {
-    const hit = cached(keyObject, entry.alg);
-    if (hit)
-        return hit;
-    const isPublic = keyObject.type === 'public';
-    const usages = entry.usages[isPublic ? 0 : 1];
-    const { asymmetricKeyType } = keyObject;
-    const crv = nist[keyObject.asymmetricKeyDetails?.namedCurve];
-    const params = entry.resolve?.({ crv, asymmetricKeyType }) ?? entry.subtle;
-    return cached(keyObject, entry.alg, keyObject.toCryptoKey(params, isPublic, usages));
-};
-export async function prepareKey(entry, key, usage) {
-    const tagged = checkKeyType(entry, key, usage);
-    switch (tagged[0]) {
-        case BYTES:
-        case CRYPTO:
-            return tagged[1];
-        case JWK: {
-            const key = tagged[1];
-            if (key.k) {
-                return decode(key.k);
-            }
-            if (!Object.isFrozen(key)) {
-                const { key_ops } = key;
-                if (Array.isArray(key_ops))
-                    Object.freeze(key_ops);
-                Object.freeze(key);
-            }
-            return handleJWK(key, key, entry);
-        }
-        case KEYOBJECT: {
-            const keyObject = tagged[1];
-            if (keyObject.type === 'secret') {
-                return keyObject.export();
-            }
-            if ('toCryptoKey' in keyObject && typeof keyObject.toCryptoKey === 'function') {
-                return handleKeyObject(keyObject, entry);
-            }
-            return handleJWK(keyObject, keyObject.export({ format: 'jwk' }), entry);
-        }
-    }
+const isCryptoKey = (key) => {
+  if (key?.[Symbol.toStringTag] === "CryptoKey")
+    return !0;
+  try {
+    return key instanceof CryptoKey;
+  } catch {
+    return !1;
+  }
+}, isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+function message(msg, actual, ...types) {
+  if (types.length > 2) {
+    const last = types.pop();
+    msg += `one of type ${types.join(", ")}, or ${last}.`;
+  } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+  return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+}
+const invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+function invalidKeyType(alg, actual, secret) {
+  const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
+  return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
 }
+const unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+function checkUsage(key, usage) {
+  if (usage && !key.usages.includes(usage))
+    throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+function checkModulusLength(alg, key) {
+  const { modulusLength } = key.algorithm;
+  if (typeof modulusLength != "number" || modulusLength < 2048)
+    throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+}
+function checkCryptoKey(key, expected, usage) {
+  const algorithm = key.algorithm;
+  if (algorithm.name !== expected.name)
+    throw unusable(expected.name);
+  if (expected.hash && algorithm.hash?.name !== expected.hash)
+    throw unusable(expected.hash, "algorithm.hash");
+  if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
+    throw unusable(expected.namedCurve, "algorithm.namedCurve");
+  if (expected.length !== void 0 && algorithm.length !== expected.length)
+    throw unusable(expected.length, "algorithm.length");
+  checkUsage(key, usage);
+}
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+function validateExtractableOption(extractable) {
+  if (extractable !== void 0 && typeof extractable != "boolean")
+    throw new TypeError('"extractable" option must be a boolean');
+  return extractable;
+}
+async function jwkToKey(entry, jwk, extractable) {
+  if (!entry.kty.includes(jwk.kty))
+    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+  const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+  return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+}
+async function rawKey(key, expected, usage, extractable = !1) {
+  return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
+}
+export {
+  assertCryptoKey,
+  checkCryptoKey,
+  checkModulusLength,
+  checkUsage,
+  invalidKeyInput,
+  isCryptoKey,
+  isKeyLike,
+  isKeyObject,
+  jwkToKey,
+  normalizeJwk,
+  prepareKey,
+  rawKey,
+  snapshotJwk,
+  validateExtractableOption
+};

package/node_modules/jose/dist/webapi/lib/key_algorithm.js

@@ -1,10 +1,15 @@
-import { JOSENotSupported } from '../util/errors.js';
-import { JWS } from './jws_algorithms.js';
-import { JWE } from './jwe_algorithms.js';
-export const algArgument = '"alg" (Algorithm)';
-export function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
-    throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
+import { JOSENotSupported } from "../util/errors.js";
+import { JWS } from "./jws_algorithms.js";
+import { JWE } from "./jwe_algorithms.js";
+const algArgument = '"alg" (Algorithm)';
+function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
+  throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
 }
-export function keyAlgorithm(alg, source) {
-    return (typeof alg === 'string' ? (JWS[alg] ?? JWE[alg]) : undefined) ?? unsupportedAlg(source);
+function keyAlgorithm(alg, source) {
+  return (typeof alg == "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
 }
+export {
+  algArgument,
+  keyAlgorithm,
+  unsupportedAlg
+};