@introspection-ai/recipes 0.23.0 → 0.25.0

package/dist/mcp-chunks/{webapi-BLTNWSB2.js → webapi-4GWO2UBA.js}

@@ -3,7 +3,7 @@ import {
   __export
 } from "./chunk-LRKZP7DJ.js";
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/buffer_utils.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 var strictDecoder = new TextDecoder("utf-8", { fatal: true });
@@ -49,7 +49,7 @@ function encode(string) {
   return bytes;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/crypto_key.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/crypto_key.js
 var unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 function checkUsage(key, usage) {
   if (usage && !key.usages.includes(usage)) {
@@ -79,7 +79,7 @@ function checkCryptoKey(key, expected, usage) {
   checkUsage(key, usage);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/invalid_key_input.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/invalid_key_input.js
 function message(msg, actual, ...types) {
   if (types.length > 2) {
     const last = types.pop();
@@ -103,7 +103,7 @@ function message(msg, actual, ...types) {
 var invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
 var withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/util/errors.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/util/errors.js
 var errors_exports = {};
 __export(errors_exports, {
   JOSEAlgNotAllowed: () => JOSEAlgNotAllowed,
@@ -223,7 +223,7 @@ var JWSSignatureVerificationFailed = class extends JOSEError {
   }
 };
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/is_key_like.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/is_key_like.js
 function assertCryptoKey(key) {
   if (!isCryptoKey(key)) {
     throw new Error("CryptoKey instance expected");
@@ -241,7 +241,7 @@ var isCryptoKey = (key) => {
 var isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
 var isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/content_encryption.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/content_encryption.js
 var generateCek = (enc) => crypto.getRandomValues(new Uint8Array(enc.cekBits >> 3));
 function checkCekLength(cek, expected) {
   const actual = cek.byteLength << 3;
@@ -290,23 +290,13 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag2, aad) {
   const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, "decrypt");
   const macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8));
   const expectedTag = await cbcHmacTag(macKey, macData, keySize);
-  let macCheckPassed;
   try {
-    macCheckPassed = await timingSafeEqual(tag2, expectedTag);
-  } catch {
-  }
-  if (!macCheckPassed) {
-    throw new JWEDecryptionFailed();
-  }
-  let plaintext;
-  try {
-    plaintext = new Uint8Array(await crypto.subtle.decrypt({ iv, name: "AES-CBC" }, encKey, ciphertext));
+    if (await timingSafeEqual(tag2, expectedTag)) {
+      return new Uint8Array(await crypto.subtle.decrypt({ iv, name: "AES-CBC" }, encKey, ciphertext));
+    }
   } catch {
   }
-  if (!plaintext) {
-    throw new JWEDecryptionFailed();
-  }
-  return plaintext;
+  throw new JWEDecryptionFailed();
 }
 async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
   const encKey = cek instanceof Uint8Array ? await crypto.subtle.importKey("raw", cek, "AES-GCM", false, [
@@ -361,6 +351,9 @@ async function decrypt(enc, cek, ciphertext, iv, tag2, aad) {
   if (!tag2) {
     throw new JWEInvalid("JWE Authentication Tag missing");
   }
+  if (!enc.cbc && tag2.length !== 16) {
+    throw new JWEInvalid("Invalid Authentication Tag length");
+  }
   checkIvLength(enc, iv);
   if (cek instanceof Uint8Array) {
     checkCekLength(cek, enc.cekBits);
@@ -368,14 +361,14 @@ async function decrypt(enc, cek, ciphertext, iv, tag2, aad) {
   return enc.cbc ? cbcDecrypt(enc, cek, ciphertext, iv, tag2, aad) : gcmDecrypt(enc, cek, ciphertext, iv, tag2, aad);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/util/base64url.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/util/base64url.js
 var base64url_exports = {};
 __export(base64url_exports, {
   decode: () => decode,
   encode: () => encode2
 });
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/base64.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/base64.js
 function encodeBase64(input) {
   if (Uint8Array.prototype.toBase64) {
     return input.toBase64();
@@ -399,7 +392,7 @@ function decodeBase64(encoded) {
   return bytes;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/util/base64url.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/util/base64url.js
 var invalid = "The input to be decoded is not correctly encoded.";
 function decode(input) {
   if (Uint8Array.fromBase64) {
@@ -436,20 +429,21 @@ function encode2(input) {
   return encodeBase64(unencoded).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/type_checks.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/type_checks.js
+function assertUint8Array(input, label) {
+  if (!(input instanceof Uint8Array)) {
+    throw new TypeError(`${label} must be an instance of Uint8Array`);
+  }
+}
 function isObject(input) {
   if (typeof input !== "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") {
     return false;
   }
   const prototype = Object.getPrototypeOf(input);
-  if (prototype === null) {
-    return true;
-  }
-  let proto = prototype;
-  while (Object.getPrototypeOf(proto) !== null) {
-    proto = Object.getPrototypeOf(proto);
-  }
-  return prototype === proto;
+  return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+function isJwkSet(input) {
+  return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);
 }
 function isDisjoint(...headers) {
   const parameters = /* @__PURE__ */ new Set();
@@ -465,15 +459,11 @@ function isDisjoint(...headers) {
   }
   return true;
 }
-var isJWK = (key) => isObject(key) && typeof key.kty === "string";
-var isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string");
-var isPublicJWK = (key) => key.kty !== "oct" && key.d === void 0 && key.priv === void 0;
-var isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/helpers.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/helpers.js
 var unprotected = /* @__PURE__ */ Symbol();
 function assertNotSet(value, name) {
-  if (value) {
+  if (value !== void 0) {
     throw new TypeError(`${name} can only be called once`);
   }
 }
@@ -508,7 +498,7 @@ function parseJoseHeader(b64, ErrorClass, message2) {
   return parsed;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/jwk_to_key.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/jwk_to_key.js
 async function jwkToKey(entry, jwk) {
   if (jwk.kty === "RSA" && "oth" in jwk && jwk.oth !== void 0) {
     throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
@@ -526,7 +516,27 @@ async function jwkToKey(entry, jwk) {
   return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/key.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/jwk_metadata.js
+function snapshotJwk(jwk) {
+  return { __proto__: null, ...jwk };
+}
+function normalizeJwk(jwk) {
+  const normalized = snapshotJwk(jwk);
+  if (normalized.ext !== void 0 && typeof normalized.ext !== "boolean") {
+    throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+  }
+  if (normalized.key_ops !== void 0) {
+    const value = normalized.key_ops;
+    const keyOps = Array.isArray(value) ? [...value] : void 0;
+    if (!keyOps || keyOps.some((operation) => typeof operation !== "string") || new Set(keyOps).size !== keyOps.length) {
+      throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+    }
+    normalized.key_ops = keyOps;
+  }
+  return normalized;
+}
+
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/key.js
 var tag = (key) => key[Symbol.toStringTag];
 var jwkMatchesOp = (entry, key, usage) => {
   const { alg } = entry;
@@ -551,12 +561,17 @@ function checkKeyType(entry, key, usage) {
   const privateKey = usage === "decrypt" || usage === "sign";
   if (secret && key instanceof Uint8Array)
     return [BYTES, key];
-  if (isJWK(key)) {
-    if (secret ? !isSecretJWK(key) : !(privateKey ? isPrivateJWK(key) : isPublicJWK(key))) {
+  if (isObject(key)) {
+    const normalized = normalizeJwk(key);
+    if (typeof normalized.kty !== "string") {
+      throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
+    }
+    const valid = secret ? normalized.kty === "oct" && typeof normalized.k === "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv === "string" || typeof normalized.d === "string" : normalized.d === void 0 && normalized.priv === void 0);
+    if (!valid) {
       throw new TypeError(secret ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present` : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
     }
-    jwkMatchesOp(entry, key, usage);
-    return [JWK, key];
+    jwkMatchesOp(entry, normalized, usage);
+    return [JWK, key, normalized];
   }
   if (!isKeyLike(key)) {
     throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
@@ -595,7 +610,7 @@ function cached(key, alg, value) {
     if (entry) {
       entry[alg] = value;
     } else {
-      cache.set(key, { __proto__: null, [alg]: value });
+      cache.set(key, { [alg]: value });
     }
   }
   return value ?? entry?.[alg];
@@ -620,8 +635,9 @@ async function prepareKey(entry, key, usage) {
       return tagged[1];
     case JWK: {
       const key2 = tagged[1];
-      if (key2.k) {
-        return decode(key2.k);
+      const normalized = tagged[2];
+      if (normalized.kty === "oct") {
+        return decode(normalized.k);
       }
       if (!Object.isFrozen(key2)) {
         const { key_ops } = key2;
@@ -629,7 +645,7 @@ async function prepareKey(entry, key, usage) {
           Object.freeze(key_ops);
         Object.freeze(key2);
       }
-      return handleJWK(key2, key2, entry);
+      return handleJWK(key2, normalized, entry);
     }
     case KEYOBJECT: {
       const keyObject = tagged[1];
@@ -644,7 +660,7 @@ async function prepareKey(entry, key, usage) {
   }
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/key_descriptor.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/key_descriptor.js
 function table(entries) {
   const out = { __proto__: null };
   for (const alg in entries) {
@@ -653,7 +669,7 @@ function table(entries) {
   return out;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/jwe_algorithms.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/jwe_algorithms.js
 var wrap = [
   ["encrypt", "wrapKey"],
   ["decrypt", "unwrapKey"]
@@ -760,7 +776,7 @@ function jweEncryption(enc) {
   return (typeof enc === "string" ? ENC[enc] : void 0) ?? unsupported("enc", "Encryption Algorithm");
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/key_management.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/key_management.js
 function checkEcdhCryptoKey(key, usage) {
   if (key.algorithm.name !== "ECDH" && key.algorithm.name !== "X25519") {
     throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");
@@ -855,7 +871,7 @@ function assertNoEncryptedKey(encryptedKey) {
   if (encryptedKey !== void 0)
     throw new JWEInvalid("Encountered unexpected JWE Encrypted Key");
 }
-async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, options) {
+async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, maxPBES2Count) {
   const entry = jweAlgorithm(alg);
   if (alg === "dir") {
     assertNoEncryptedKey(encryptedKey);
@@ -897,7 +913,7 @@ async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, opt
       assertEncryptedKey(encryptedKey);
       if (typeof joseHeader.p2c !== "number")
         throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-      const p2cLimit = options?.maxPBES2Count || 1e4;
+      const p2cLimit = maxPBES2Count || 1e4;
       if (joseHeader.p2c > p2cLimit)
         throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
       if (typeof joseHeader.p2s !== "string")
@@ -935,8 +951,14 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
     case "ECDH": {
       assertEcdhKey(key);
       const { apu, apv } = providedParameters;
+      if (apu !== void 0) {
+        assertUint8Array(apu, '"apu"');
+      }
+      if (apv !== void 0) {
+        assertUint8Array(apv, '"apv"');
+      }
       let ephemeralKey;
-      if (providedParameters.epk) {
+      if (providedParameters.epk !== void 0) {
         ephemeralKey = await prepareKey(entry, providedParameters.epk, "decrypt");
       } else {
         ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, true, ["deriveBits"])).privateKey;
@@ -999,7 +1021,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
   return [cek, encryptedKey, parameters];
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/options.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/options.js
 var JWS_RECOGNIZED = { __proto__: null, b64: true };
 var JWE_RECOGNIZED = { __proto__: null };
 function validateAlgorithms(option, algorithms) {
@@ -1041,8 +1063,40 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
   }
   return protectedHeader.crit;
 }
+function validateB64(protectedHeader, extensions) {
+  if (extensions.includes("b64")) {
+    const b64 = protectedHeader.b64;
+    if (typeof b64 !== "boolean") {
+      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+    }
+    return b64;
+  }
+  return true;
+}
+function serializeJoseHeader(Err, header) {
+  let serialized;
+  let parsed;
+  try {
+    serialized = JSON.stringify(header);
+    parsed = JSON.parse(serialized);
+  } catch (cause) {
+    throw new Err("JOSE Header is not valid JSON", { cause });
+  }
+  if (!isObject(parsed)) {
+    throw new Err("JOSE Header is not a JSON object");
+  }
+  return [parsed, serialized];
+}
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/deflate.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/deflate.js
+function validateZip(joseHeader, protectedHeader) {
+  if (joseHeader.zip !== void 0 && joseHeader.zip !== "DEF") {
+    throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
+  }
+  if (joseHeader.zip !== void 0 && !protectedHeader?.zip) {
+    throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
+  }
+}
 function supported(name) {
   if (typeof globalThis[name] === "undefined") {
     throw new JOSENotSupported(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${name} API.`);
@@ -1090,35 +1144,72 @@ async function decompress(input, maxLength) {
   return concat(...chunks);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/jwe_decrypt.js
-function checkShared(jwe) {
-  const { ciphertext, protected: encodedProtected, unprotected: unprotected2 } = jwe;
-  if (jwe.iv !== void 0 && typeof jwe.iv !== "string") {
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/jwe_decrypt.js
+function snapshotSharedJWE(jwe) {
+  const { aad, ciphertext, iv, protected: encodedProtected, tag: tag2, unprotected: unprotected2 } = jwe;
+  if (iv !== void 0 && typeof iv !== "string") {
     throw new JWEInvalid("JWE Initialization Vector incorrect type");
   }
   if (typeof ciphertext !== "string") {
     throw new JWEInvalid("JWE Ciphertext missing or incorrect type");
   }
-  if (jwe.tag !== void 0 && typeof jwe.tag !== "string") {
+  if (tag2 !== void 0 && typeof tag2 !== "string") {
     throw new JWEInvalid("JWE Authentication Tag incorrect type");
   }
   if (encodedProtected !== void 0 && typeof encodedProtected !== "string") {
     throw new JWEInvalid("JWE Protected Header incorrect type");
   }
-  if (jwe.aad !== void 0 && typeof jwe.aad !== "string") {
+  if (aad !== void 0 && (typeof aad !== "string" || !aad)) {
     throw new JWEInvalid("JWE AAD incorrect type");
   }
   if (unprotected2 !== void 0 && !isObject(unprotected2)) {
     throw new JWEInvalid("JWE Shared Unprotected Header incorrect type");
   }
+  return {
+    aad,
+    ciphertext,
+    iv,
+    protected: encodedProtected,
+    tag: tag2,
+    unprotected: unprotected2 === void 0 ? void 0 : { ...unprotected2 }
+  };
+}
+function snapshotRecipientJWE(recipient) {
+  let header;
+  let headerAlg;
+  try {
+    const { header: inputHeader } = recipient;
+    if (isObject(inputHeader)) {
+      headerAlg = inputHeader.alg;
+      const parameters = Object.keys(inputHeader);
+      if (!parameters.includes("alg"))
+        headerAlg = void 0;
+      header = Object.fromEntries(parameters.map((parameter) => [
+        parameter,
+        parameter === "alg" ? headerAlg : inputHeader[parameter]
+      ]));
+    } else {
+      header = inputHeader;
+    }
+  } catch (error) {
+    return [void 0, headerAlg, error];
+  }
+  try {
+    const { encrypted_key: encryptedKey } = recipient;
+    return [{ encrypted_key: encryptedKey, header }, headerAlg];
+  } catch (error) {
+    return [void 0, headerAlg, error];
+  }
 }
 function checkRecipient(jwe) {
   const { encrypted_key: encryptedKey, header } = jwe;
   if (encryptedKey !== void 0 && typeof encryptedKey !== "string") {
     throw new JWEInvalid("JWE Encrypted Key incorrect type");
   }
-  if (header !== void 0 && !isObject(header)) {
-    throw new JWEInvalid("JWE Per-Recipient Unprotected Header incorrect type");
+  if (header !== void 0) {
+    if (!isObject(header)) {
+      throw new JWEInvalid("JWE Per-Recipient Unprotected Header incorrect type");
+    }
   }
   if (jwe.protected === void 0 && header === void 0 && jwe.unprotected === void 0) {
     throw new JWEInvalid("JOSE Header missing");
@@ -1127,7 +1218,7 @@ function checkRecipient(jwe) {
 function shareJWE(jwe) {
   const { protected: encodedProtected, ciphertext, iv, tag: tag2, aad } = jwe;
   let parsedProt;
-  if (encodedProtected) {
+  if (encodedProtected !== void 0) {
     parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, "JWE Protected Header is invalid");
   }
   const protectedHeader = encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array();
@@ -1164,13 +1255,14 @@ function prepareDecrypt(options) {
   return [
     options && validateAlgorithms("keyManagementAlgorithms", options.keyManagementAlgorithms),
     options && validateAlgorithms("contentEncryptionAlgorithms", options.contentEncryptionAlgorithms),
-    options
+    options?.crit,
+    options?.maxPBES2Count,
+    options?.maxDecompressedLength
   ];
 }
 async function decryptRecipient(jwe, token, shared, key) {
-  const [keyManagementAlgorithms, contentEncryptionAlgorithms, options] = shared;
-  const [parsedProt, ciphertext, iv, tag2, additionalData] = token;
-  const { encrypted_key: encodedKey, header, unprotected: unprotected2 } = jwe;
+  const [parsedProt] = token;
+  const { header, unprotected: unprotected2 } = jwe;
   let joseHeader;
   if (header !== void 0 || unprotected2 !== void 0) {
     if (!isDisjoint(parsedProt, header, unprotected2)) {
@@ -1180,13 +1272,14 @@ async function decryptRecipient(jwe, token, shared, key) {
   } else {
     joseHeader = parsedProt ?? {};
   }
-  validateCrit(JWEInvalid, JWE_RECOGNIZED, options?.crit, parsedProt, joseHeader);
-  if (joseHeader.zip !== void 0 && joseHeader.zip !== "DEF") {
-    throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
-  }
-  if (joseHeader.zip !== void 0 && !parsedProt?.zip) {
-    throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
-  }
+  return decryptRecipientCore(jwe, token, shared, key, joseHeader);
+}
+async function decryptRecipientCore(jwe, token, shared, key, joseHeader) {
+  const [keyManagementAlgorithms, contentEncryptionAlgorithms, crit, maxPBES2Count, maxDecompressedLength] = shared;
+  const [parsedProt, ciphertext, iv, tag2, additionalData] = token;
+  const { encrypted_key: encodedKey } = jwe;
+  validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, parsedProt, joseHeader);
+  validateZip(joseHeader, parsedProt);
   const { alg, enc } = joseHeader;
   if (typeof alg !== "string" || !alg) {
     throw new JWEInvalid("missing JWE Algorithm (alg) in JWE Header");
@@ -1214,7 +1307,10 @@ async function decryptRecipient(jwe, token, shared, key) {
   const k = await prepareKey(alg === "dir" ? encEntry : algEntry, key, "decrypt");
   let cek;
   try {
-    cek = await decryptKeyManagement(alg, encEntry, k, encryptedKey, joseHeader, options);
+    cek = await decryptKeyManagement(alg, encEntry, k, encryptedKey, joseHeader, maxPBES2Count);
+    if (encodedKey !== void 0 && cek instanceof Uint8Array && cek.byteLength << 3 !== encEntry.cekBits) {
+      cek = generateCek(encEntry);
+    }
   } catch (err) {
     if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
       throw err;
@@ -1223,14 +1319,14 @@ async function decryptRecipient(jwe, token, shared, key) {
   }
   let plaintext = await decrypt(encEntry, cek, ciphertext, iv, tag2, additionalData);
   if (joseHeader.zip === "DEF") {
-    const maxDecompressedLength = options?.maxDecompressedLength ?? 25e4;
-    if (maxDecompressedLength === 0) {
+    const decompressionLimit = maxDecompressedLength ?? 25e4;
+    if (decompressionLimit === 0) {
       throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
     }
-    if (maxDecompressedLength !== Infinity && (!Number.isSafeInteger(maxDecompressedLength) || maxDecompressedLength < 1)) {
+    if (decompressionLimit !== Infinity && (!Number.isSafeInteger(decompressionLimit) || decompressionLimit < 1)) {
       throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");
     }
-    plaintext = await decompress(plaintext, maxDecompressedLength).catch((cause) => {
+    plaintext = await decompress(plaintext, decompressionLimit).catch((cause) => {
       if (cause instanceof JWEInvalid)
         throw cause;
       throw new JWEInvalid("Failed to decompress plaintext", { cause });
@@ -1252,16 +1348,26 @@ async function decryptCompact(jwe, shared, key) {
   if (length !== 5) {
     throw new JWEInvalid("Invalid Compact JWE");
   }
-  return decryptJWE({
+  const flattened = {
     ciphertext,
     iv: iv || void 0,
     protected: protectedHeader,
     tag: tag2 || void 0,
     encrypted_key: encryptedKey || void 0
-  }, shared, key);
+  };
+  const parsedProt = parseJoseHeader(protectedHeader, JWEInvalid, "JWE Protected Header is invalid");
+  const protectedBytes = encode(protectedHeader);
+  const token = [
+    parsedProt,
+    decodeBase64url(ciphertext, "ciphertext", JWEInvalid),
+    iv ? decodeBase64url(iv, "iv", JWEInvalid) : void 0,
+    tag2 ? decodeBase64url(tag2, "tag", JWEInvalid) : void 0,
+    protectedBytes
+  ];
+  return decryptRecipientCore(flattened, token, shared, key, parsedProt);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwe/compact/decrypt.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwe/compact/decrypt.js
 async function compactDecrypt(jwe, key, options) {
   const decrypted = await decryptCompact(jwe, prepareDecrypt(options), key);
   const result = { plaintext: decrypted[0], protectedHeader: decrypted[1] };
@@ -1271,56 +1377,60 @@ async function compactDecrypt(jwe, key, options) {
   return result;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
 async function flattenedDecrypt(jwe, key, options) {
   if (!isObject(jwe)) {
     throw new JWEInvalid("Flattened JWE must be an object");
   }
-  checkShared(jwe);
-  checkRecipient(jwe);
-  return decryptResult(jwe, await decryptJWE(jwe, prepareDecrypt(options), key));
+  const shared = snapshotSharedJWE(jwe);
+  const [recipient, , error] = snapshotRecipientJWE(jwe);
+  if (!recipient)
+    throw error;
+  const snapshot = { ...shared, ...recipient };
+  checkRecipient(snapshot);
+  return decryptResult(snapshot, await decryptJWE(snapshot, prepareDecrypt(options), key));
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwe/general/decrypt.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwe/general/decrypt.js
 async function generalDecrypt(jwe, key, options) {
   if (!isObject(jwe)) {
     throw new JWEInvalid("General JWE must be an object");
   }
-  if (!Array.isArray(jwe.recipients) || !jwe.recipients.every(isObject)) {
+  const inputRecipients = jwe.recipients;
+  if (!Array.isArray(inputRecipients)) {
+    throw new JWEInvalid("JWE Recipients missing or incorrect type");
+  }
+  const recipients = Array.from(inputRecipients);
+  if (!recipients.every(isObject)) {
     throw new JWEInvalid("JWE Recipients missing or incorrect type");
   }
-  if (!jwe.recipients.length) {
+  if (!recipients.length) {
     throw new JWEInvalid("JWE Recipients has no members");
   }
   let shared;
+  let sharedJwe;
   let token;
   try {
-    checkShared(jwe);
     shared = prepareDecrypt(options);
-    token = shareJWE(jwe);
+    sharedJwe = snapshotSharedJWE(jwe);
+    token = shareJWE(sharedJwe);
   } catch {
     throw new JWEDecryptionFailed();
   }
-  if (jwe.recipients.length > 1) {
-    for (const { header } of jwe.recipients) {
-      const alg = token[0]?.alg ?? header?.alg ?? jwe.unprotected?.alg;
+  const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
+  if (recipients.length > 1) {
+    for (const [, headerAlg] of recipientSnapshots) {
+      const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg;
       if (alg === "dir" || alg === "ECDH-ES") {
         throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
       }
     }
   }
-  for (const recipient of jwe.recipients) {
+  for (const [recipient] of recipientSnapshots) {
+    if (!recipient)
+      continue;
     try {
-      const flattened = {
-        aad: jwe.aad,
-        ciphertext: jwe.ciphertext,
-        encrypted_key: recipient.encrypted_key,
-        header: recipient.header,
-        iv: jwe.iv,
-        protected: jwe.protected,
-        tag: jwe.tag,
-        unprotected: jwe.unprotected
-      };
+      const flattened = { ...sharedJwe, ...recipient };
       checkRecipient(flattened);
       return decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
     } catch {
@@ -1329,27 +1439,47 @@ async function generalDecrypt(jwe, key, options) {
   throw new JWEDecryptionFailed();
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/jwe_encrypt.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/jwe_encrypt.js
 function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
   if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) {
     throw new JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");
   }
 }
 function checkEncryptHeaders(input) {
-  const [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, , , , , crit] = input;
+  let [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, aad, cek, iv, keyManagementParameters, crit] = input;
+  if (aad !== void 0) {
+    assertUint8Array(aad, "JWE Additional Authenticated Data");
+  }
+  if (cek !== void 0) {
+    assertUint8Array(cek, "JWE Content Encryption Key");
+  }
+  if (iv !== void 0) {
+    assertUint8Array(iv, "JWE Initialization Vector");
+  }
+  if (protectedHeader !== void 0) {
+    protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0];
+    input[1] = protectedHeader;
+  }
+  if (unprotectedHeader !== void 0) {
+    unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0];
+    input[2] = unprotectedHeader;
+  }
+  if (sharedUnprotectedHeader !== void 0) {
+    sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0];
+    input[3] = sharedUnprotectedHeader;
+  }
+  if (keyManagementParameters !== void 0 && !isObject(keyManagementParameters)) {
+    throw new TypeError("JWE Key Management Parameters must be an object");
+  }
   checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
   const joseHeader = {
     ...protectedHeader,
     ...unprotectedHeader,
     ...sharedUnprotectedHeader
   };
+  validateCritDuplicates(JWEInvalid, protectedHeader);
   validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader);
-  if (joseHeader.zip !== void 0 && joseHeader.zip !== "DEF") {
-    throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
-  }
-  if (joseHeader.zip !== void 0 && !protectedHeader?.zip) {
-    throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
-  }
+  validateZip(joseHeader, protectedHeader);
   const { alg, enc } = joseHeader;
   if (typeof alg !== "string" || !alg) {
     throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
@@ -1428,81 +1558,18 @@ async function encryptJWE(input, checked, key) {
   }
   return jwe;
 }
-async function createJWE(input, key) {
-  return encryptJWE(input, checkEncryptHeaders(input), key);
-}
-
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
-var FlattenedEncrypt = class {
-  #plaintext;
-  #protectedHeader;
-  #sharedUnprotectedHeader;
-  #unprotectedHeader;
-  #aad;
-  #cek;
-  #iv;
-  #keyManagementParameters;
-  constructor(plaintext) {
-    if (!(plaintext instanceof Uint8Array)) {
-      throw new TypeError("plaintext must be an instance of Uint8Array");
-    }
-    this.#plaintext = plaintext;
-  }
-  setKeyManagementParameters(parameters) {
-    assertNotSet(this.#keyManagementParameters, "setKeyManagementParameters");
-    this.#keyManagementParameters = parameters;
-    return this;
-  }
-  setProtectedHeader(protectedHeader) {
-    assertNotSet(this.#protectedHeader, "setProtectedHeader");
-    this.#protectedHeader = protectedHeader;
-    return this;
-  }
-  setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-    assertNotSet(this.#sharedUnprotectedHeader, "setSharedUnprotectedHeader");
-    this.#sharedUnprotectedHeader = sharedUnprotectedHeader;
-    return this;
-  }
-  setUnprotectedHeader(unprotectedHeader) {
-    assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader");
-    this.#unprotectedHeader = unprotectedHeader;
-    return this;
-  }
-  setAdditionalAuthenticatedData(aad) {
-    this.#aad = aad;
-    return this;
-  }
-  setContentEncryptionKey(cek) {
-    assertNotSet(this.#cek, "setContentEncryptionKey");
-    this.#cek = cek;
-    return this;
+async function createJWE(input, key, options) {
+  if (!input[1] && !input[2] && !input[3]) {
+    throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");
   }
-  setInitializationVector(iv) {
-    assertNotSet(this.#iv, "setInitializationVector");
-    this.#iv = iv;
-    return this;
-  }
-  async encrypt(key, options) {
-    if (!this.#protectedHeader && !this.#unprotectedHeader && !this.#sharedUnprotectedHeader) {
-      throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");
-    }
-    validateCritDuplicates(JWEInvalid, this.#protectedHeader);
-    return createJWE([
-      this.#plaintext,
-      this.#protectedHeader,
-      this.#unprotectedHeader,
-      this.#sharedUnprotectedHeader,
-      this.#aad,
-      this.#cek,
-      this.#iv,
-      this.#keyManagementParameters,
-      options?.crit,
-      options ? unprotected in options : false
-    ], key);
+  if (options !== void 0) {
+    input[8] = options?.crit;
+    input[9] = options ? unprotected in options : false;
   }
-};
+  return encryptJWE(input, checkEncryptHeaders(input), key);
+}
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwe/general/encrypt.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwe/general/encrypt.js
 var IndividualRecipient = class {
   #parent;
   state;
@@ -1573,13 +1640,21 @@ var GeneralEncrypt = class {
     if (!this.#recipients.length) {
       throw new JWEInvalid("at least one recipient must be added");
     }
-    if (!(this.#plaintext instanceof Uint8Array)) {
-      throw new TypeError("plaintext must be an instance of Uint8Array");
-    }
+    assertUint8Array(this.#plaintext, "plaintext");
     if (this.#recipients.length === 1) {
-      const [recipient] = this.#recipients;
-      const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state;
-      const flattened = await new FlattenedEncrypt(this.#plaintext).setAdditionalAuthenticatedData(this.#aad).setProtectedHeader(this.#protectedHeader).setSharedUnprotectedHeader(this.#unprotectedHeader).setUnprotectedHeader(unprotectedHeader).setKeyManagementParameters(keyManagementParameters).encrypt(key, { crit });
+      const [unprotectedHeader, keyManagementParameters, key, crit] = this.#recipients[0].state;
+      const flattened = await createJWE([
+        this.#plaintext,
+        this.#protectedHeader,
+        unprotectedHeader,
+        this.#unprotectedHeader,
+        this.#aad,
+        void 0,
+        void 0,
+        keyManagementParameters,
+        crit,
+        false
+      ], key);
       const jwe2 = {
         ciphertext: flattened.ciphertext,
         iv: flattened.iv,
@@ -1591,8 +1666,9 @@ var GeneralEncrypt = class {
       copyOptionalMembers(flattened, jwe2, jwe2.recipients[0]);
       return jwe2;
     }
-    validateCritDuplicates(JWEInvalid, this.#protectedHeader);
     let enc;
+    let protectedHeader = this.#protectedHeader;
+    let sharedUnprotectedHeader = this.#unprotectedHeader;
     const inputs = [];
     const checked = [];
     for (let i = 0; i < this.#recipients.length; i++) {
@@ -1600,9 +1676,9 @@ var GeneralEncrypt = class {
       const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
       const input = [
         this.#plaintext,
-        this.#protectedHeader,
+        protectedHeader,
         unprotectedHeader,
-        this.#unprotectedHeader,
+        sharedUnprotectedHeader,
         this.#aad,
         void 0,
         void 0,
@@ -1613,6 +1689,10 @@ var GeneralEncrypt = class {
       const headers = checkEncryptHeaders(input);
       inputs.push(input);
       checked.push(headers);
+      if (i === 0) {
+        protectedHeader = input[1];
+        sharedUnprotectedHeader = input[3];
+      }
       if (headers[1] === "dir" || headers[1] === "ECDH-ES") {
         throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
       }
@@ -1629,7 +1709,7 @@ var GeneralEncrypt = class {
     };
     for (let i = 0; i < this.#recipients.length; i++) {
       const recipient = this.#recipients[i];
-      const [unprotectedHeader, keyManagementParameters, key] = recipient.state;
+      const [, keyManagementParameters, key] = recipient.state;
       const target = {};
       jwe.recipients.push(target);
       if (i === 0) {
@@ -1643,13 +1723,14 @@ var GeneralEncrypt = class {
         continue;
       }
       const [, alg, , encEntry] = checked[i];
+      const unprotectedHeader = inputs[i][2];
       const k = await prepareKey(jweAlgorithm(alg), key, "encrypt");
       const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
       target.encrypted_key = encode2(encryptedKey);
       if (unprotectedHeader || parameters) {
         const header = { ...unprotectedHeader, ...parameters };
         if (parameters)
-          checkDisjoint(this.#protectedHeader, header, this.#unprotectedHeader);
+          checkDisjoint(inputs[i][1], header, inputs[i][3]);
         target.header = header;
       }
     }
@@ -1657,7 +1738,7 @@ var GeneralEncrypt = class {
   }
 };
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/signing.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/signing.js
 async function getSigKey(entry, key, usage) {
   if (key instanceof Uint8Array) {
     return crypto.subtle.importKey("raw", key, entry.subtle, false, [
@@ -1683,7 +1764,7 @@ async function verify(entry, key, signature, data) {
   }
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/jws_algorithms.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/jws_algorithms.js
 var sig = [["verify"], ["sign"]];
 function hmac(bits) {
   const subtle = { name: "HMAC", hash: `SHA-${bits}` };
@@ -1756,7 +1837,23 @@ function jwsAlgorithm(alg) {
   return entry;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/jws_verify.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/jws_verify.js
+function snapshotJws(jws, sharedPayload) {
+  const encodedProtected = jws.protected;
+  const inputHeader = jws.header;
+  const header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
+  let payload = sharedPayload ? sharedPayload[0] : jws.payload;
+  if (!sharedPayload && payload instanceof Uint8Array) {
+    payload = new Uint8Array(payload);
+  }
+  const signature = jws.signature;
+  const snapshot = { payload, signature };
+  if (encodedProtected !== void 0)
+    snapshot.protected = encodedProtected;
+  if (inputHeader !== void 0)
+    snapshot.header = header;
+  return snapshot;
+}
 function verifyResult(jws, verified) {
   const [payload, parsedProt, , key, resolvedKey] = verified;
   const result = { payload };
@@ -1774,12 +1871,22 @@ function verifyResult(jws, verified) {
 function prepareVerify(options) {
   return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
 }
-async function verifySignature(jws, shared, key) {
-  const { protected: encodedProtected, header, payload: inputPayload } = jws;
-  let parsedProt = {};
-  if (encodedProtected) {
-    parsedProt = parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid")) {
+  return parsedProtected;
+}
+function validateJwsHeaders(parsedProt, joseHeader, shared) {
+  const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
+  const alg = joseHeader.alg;
+  if (typeof alg !== "string" || !alg) {
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  }
+  if (shared[0] && !shared[0].has(alg)) {
+    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
   }
+  return [b64, alg];
+}
+function parseJwsHeaders(encodedProtected, header, shared, parsedProtected) {
+  const parsedProt = parseProtectedHeader(encodedProtected, parsedProtected);
   let joseHeader;
   if (header !== void 0) {
     if (!isDisjoint(parsedProt, header)) {
@@ -1789,50 +1896,51 @@ async function verifySignature(jws, shared, key) {
   } else {
     joseHeader = parsedProt;
   }
-  const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader);
-  let b64 = true;
-  if (extensions.includes("b64")) {
-    b64 = parsedProt.b64;
-    if (typeof b64 !== "boolean") {
-      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-    }
-  }
-  const { alg } = joseHeader;
-  if (typeof alg !== "string" || !alg) {
-    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  }
-  if (shared[0] && !shared[0].has(alg)) {
-    throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+  return [parsedProt, joseHeader, ...validateJwsHeaders(parsedProt, joseHeader, shared)];
+}
+function encodeJsonUnencodedPayload(payload) {
+  const invalid2 = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
+  if (invalid2 !== void 0) {
+    throw new JWSInvalid(new RegExp("\\p{Cs}", "u").test(invalid2) ? "JWS Payload must be a well-formed Unicode string" : "JWS Payload must not contain unassigned Unicode code points");
   }
-  if (b64) {
-    if (typeof inputPayload !== "string") {
-      throw new JWSInvalid("JWS Payload must be a string");
-    }
-  } else if (typeof inputPayload !== "string" && !(inputPayload instanceof Uint8Array)) {
-    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+  return encoder.encode(payload);
+}
+function encodeCompactUnencodedPayload(payload) {
+  try {
+    return encode(payload);
+  } catch {
+    throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
   }
+}
+async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
   let resolvedKey = false;
   if (typeof key === "function") {
     key = await key(parsedProt, jws);
     resolvedKey = true;
   }
+  const b64 = typeof signingPayload === "string";
   const entry = jwsAlgorithm(alg);
-  const data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof inputPayload === "string" ? b64 ? shared[2] ??= encodeBase64url(inputPayload, "payload", JWSInvalid) : encoder.encode(inputPayload) : inputPayload);
+  const data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), b64 ? shared[2] ??= encodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload);
   const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
   const k = await prepareKey(entry, key, "verify");
-  const verified = await verify(entry, k, signature, data);
-  if (!verified) {
+  if (!await verify(entry, k, signature, data)) {
     throw new JWSSignatureVerificationFailed();
   }
-  let payload;
+  const payload = b64 ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload;
+  return [payload, parsedProt, b64, k, resolvedKey];
+}
+async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+  const { protected: encodedProtected, header, payload: inputPayload } = jws;
+  const [parsedProt, , b64, alg] = parseJwsHeaders(encodedProtected, header, shared, parsedProtected);
   if (b64) {
-    payload = decodeBase64url(inputPayload, "payload", JWSInvalid);
-  } else if (typeof inputPayload === "string") {
-    payload = encoder.encode(inputPayload);
-  } else {
-    payload = inputPayload;
+    if (typeof inputPayload !== "string") {
+      throw new JWSInvalid("JWS Payload must be a string");
+    }
+  } else if (typeof inputPayload !== "string" && !(inputPayload instanceof Uint8Array)) {
+    throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
   }
-  return [payload, parsedProt, b64, k, resolvedKey];
+  const signingPayload = b64 || typeof inputPayload !== "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+  return verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload);
 }
 async function verifyCompact(jws, shared, key) {
   if (jws instanceof Uint8Array) {
@@ -1845,10 +1953,14 @@ async function verifyCompact(jws, shared, key) {
   if (length !== 3) {
     throw new JWSInvalid("Invalid Compact JWS");
   }
-  return verifySignature({ payload, protected: protectedHeader, signature }, shared, key);
+  const compactJws = { payload, protected: protectedHeader, signature };
+  const parsedProt = parseProtectedHeader(protectedHeader);
+  const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
+  const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
+  return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jws/compact/verify.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jws/compact/verify.js
 async function compactVerify(jws, key, options) {
   const verified = await verifyCompact(jws, prepareVerify(options), key);
   const result = { payload: verified[0], protectedHeader: verified[1] };
@@ -1858,71 +1970,93 @@ async function compactVerify(jws, key, options) {
   return result;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jws/flattened/verify.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jws/flattened/verify.js
 async function flattenedVerify(jws, key, options) {
   if (!isObject(jws)) {
     throw new JWSInvalid("Flattened JWS must be an object");
   }
-  if (jws.protected === void 0 && jws.header === void 0) {
+  const snapshot = snapshotJws(jws);
+  if (snapshot.protected === void 0 && snapshot.header === void 0) {
     throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
   }
-  if (jws.protected !== void 0 && typeof jws.protected !== "string") {
+  if (snapshot.protected !== void 0 && typeof snapshot.protected !== "string") {
     throw new JWSInvalid("JWS Protected Header incorrect type");
   }
-  if (jws.payload === void 0) {
+  if (snapshot.payload === void 0) {
     throw new JWSInvalid("JWS Payload missing");
   }
-  if (typeof jws.signature !== "string") {
+  if (typeof snapshot.signature !== "string") {
     throw new JWSInvalid("JWS Signature missing or incorrect type");
   }
-  if (jws.header !== void 0 && !isObject(jws.header)) {
+  if (snapshot.header !== void 0 && !isObject(snapshot.header)) {
     throw new JWSInvalid("JWS Unprotected Header incorrect type");
   }
-  return verifyResult(jws, await verifySignature(jws, prepareVerify(options), key));
+  return verifyResult(snapshot, await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload));
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jws/general/verify.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jws/general/verify.js
+function snapshotSignature(signature, payload) {
+  try {
+    const jws = snapshotJws(signature, [payload]);
+    const { protected: encodedProtected, header, signature: encodedSignature } = jws;
+    if (encodedProtected === void 0 && header === void 0)
+      return void 0;
+    if (encodedProtected !== void 0 && typeof encodedProtected !== "string")
+      return void 0;
+    if (typeof encodedSignature !== "string")
+      return void 0;
+    if (header !== void 0 && !isObject(header))
+      return void 0;
+    const protectedHeader = parseProtectedHeader(encodedProtected);
+    const { b64, crit } = protectedHeader;
+    return [
+      jws,
+      protectedHeader,
+      Array.isArray(crit) && crit.includes("b64") ? typeof b64 === "boolean" ? b64 ? 1 : 2 : 0 : 1
+    ];
+  } catch {
+    return void 0;
+  }
+}
 async function generalVerify(jws, key, options) {
   if (!isObject(jws)) {
     throw new JWSInvalid("General JWS must be an object");
   }
-  const { signatures, payload } = jws;
-  if (!Array.isArray(signatures) || !signatures.every(isObject)) {
+  const { signatures, payload: inputPayload } = jws;
+  if (!Array.isArray(signatures)) {
+    throw new JWSInvalid("JWS Signatures missing or incorrect type");
+  }
+  const signatureEntries = Array.from(signatures);
+  if (!signatureEntries.every(isObject)) {
     throw new JWSInvalid("JWS Signatures missing or incorrect type");
   }
   let shared;
   try {
-    if (payload === void 0)
+    if (inputPayload === void 0)
       throw new Error();
     shared = prepareVerify(options);
   } catch {
     throw new JWSSignatureVerificationFailed();
   }
-  for (const signature of signatures) {
+  const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload;
+  const candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
+  let modes = 0;
+  for (const [, , mode] of candidates) {
+    modes |= mode;
+    if (modes === 3) {
+      throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
+    }
+  }
+  for (const candidate of candidates) {
     try {
-      const { protected: encodedProtected, header, signature: encodedSignature } = signature;
-      if (encodedProtected === void 0 && header === void 0)
-        throw new Error();
-      if (encodedProtected !== void 0 && typeof encodedProtected !== "string") {
-        throw new Error();
-      }
-      if (typeof encodedSignature !== "string")
-        throw new Error();
-      if (header !== void 0 && !isObject(header))
-        throw new Error();
-      return verifyResult(signature, await verifySignature({
-        header,
-        payload,
-        protected: encodedProtected,
-        signature: encodedSignature
-      }, shared, key));
+      return verifyResult(candidate[0], await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]));
     } catch {
     }
   }
   throw new JWSSignatureVerificationFailed();
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/jwt_claims_set.js
 var epoch = (date) => Math.floor(date.getTime() / 1e3);
 var multipliers = {
   s: 1,
@@ -1934,13 +2068,22 @@ var multipliers = {
 };
 var REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
 var checkFailed = "check_failed";
+function invalidDuration() {
+  throw new TypeError("Invalid time period format");
+}
 function secs(str) {
+  if (typeof str !== "string") {
+    invalidDuration();
+  }
   const matched = REGEX.exec(str);
   if (!matched || matched[4] && matched[1]) {
-    throw new TypeError("Invalid time period format");
+    invalidDuration();
   }
   const value = parseFloat(matched[2]);
   const numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+  if (!Number.isFinite(numericDate2)) {
+    invalidDuration();
+  }
   if (matched[1] === "-" || matched[4] === "ago") {
     return -numericDate2;
   }
@@ -1952,6 +2095,16 @@ function validateInput(label, input) {
   }
   return input;
 }
+function validateStringClaim(claim, value) {
+  if (typeof value !== "string") {
+    throw new TypeError(`"${claim}" claim must be a string`);
+  }
+}
+function validateAudienceClaim(value) {
+  if (typeof value !== "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member !== "string"))) {
+    throw new TypeError('"aud" claim must be a string or an array of strings');
+  }
+}
 function numericDate(value, label) {
   if (typeof value === "number")
     return validateInput(label, value);
@@ -1960,10 +2113,8 @@ function numericDate(value, label) {
   return epoch(/* @__PURE__ */ new Date()) + secs(value);
 }
 var normalizeTyp = (value) => {
-  if (value.includes("/")) {
-    return value.toLowerCase();
-  }
-  return `application/${value.toLowerCase()}`;
+  const normalized = value.toLowerCase();
+  return value.includes("/") ? normalized : `application/${normalized}`;
 };
 var checkAudiencePresence = (audPayload, audOption) => {
   if (typeof audPayload === "string") {
@@ -1996,7 +2147,7 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
     throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
   }
   const { typ } = options;
-  if (typ && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+  if (typ !== void 0 && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
     throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
   }
   const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
@@ -2035,7 +2186,7 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
   }
   validateInput("clockTolerance option", tolerance);
   const { currentDate } = options;
-  const now = validateInput("currentDate option", epoch(currentDate || /* @__PURE__ */ new Date()));
+  const now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate));
   const iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0);
   const nbf = validateNumericDate(payload, "nbf");
   if (nbf !== void 0) {
@@ -2051,66 +2202,83 @@ function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
   }
   if (maxTokenAge !== void 0) {
     const age = now - iat;
-    const max = typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge);
+    const max = validateInput("maxTokenAge option", typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge));
     if (age - tolerance > max) {
       throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
     }
-    if (age < 0 - tolerance) {
+    if (age < -tolerance) {
       throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
     }
   }
   return payload;
 }
+var producerPayloads;
+function producerPayload(producer) {
+  return producerPayloads.get(producer);
+}
+function jwtData(producer) {
+  const payload = producerPayload(producer);
+  for (const claim of ["iat", "nbf", "exp"]) {
+    const value = payload[claim];
+    if (typeof value === "number" && !Number.isFinite(value)) {
+      throw new TypeError(`"${claim}" claim must be a finite number`);
+    }
+  }
+  return encoder.encode(JSON.stringify(payload));
+}
+function jwtClaim(producer, claim) {
+  return producerPayload(producer)[claim];
+}
 var JWTClaimsBuilder = class {
-  #payload;
-  constructor(payload) {
+  constructor(payload = {}) {
     if (!isObject(payload)) {
       throw new TypeError("JWT Claims Set MUST be an object");
     }
-    this.#payload = structuredClone(payload);
-  }
-  data() {
-    return encoder.encode(JSON.stringify(this.#payload));
-  }
-  get iss() {
-    return this.#payload.iss;
-  }
-  set iss(value) {
-    this.#payload.iss = value;
-  }
-  get sub() {
-    return this.#payload.sub;
+    ;
+    (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));
   }
-  set sub(value) {
-    this.#payload.sub = value;
+  setIssuer(value) {
+    validateStringClaim("iss", value);
+    producerPayload(this).iss = value;
+    return this;
   }
-  get aud() {
-    return this.#payload.aud;
+  setSubject(value) {
+    validateStringClaim("sub", value);
+    producerPayload(this).sub = value;
+    return this;
   }
-  set aud(value) {
-    this.#payload.aud = value;
+  setAudience(value) {
+    validateAudienceClaim(value);
+    producerPayload(this).aud = value;
+    return this;
   }
-  set jti(value) {
-    this.#payload.jti = value;
+  setJti(value) {
+    validateStringClaim("jti", value);
+    producerPayload(this).jti = value;
+    return this;
   }
-  set nbf(value) {
-    this.#payload.nbf = numericDate(value, "setNotBefore");
+  setNotBefore(value) {
+    producerPayload(this).nbf = numericDate(value, "setNotBefore");
+    return this;
   }
-  set exp(value) {
-    this.#payload.exp = numericDate(value, "setExpirationTime");
+  setExpirationTime(value) {
+    producerPayload(this).exp = numericDate(value, "setExpirationTime");
+    return this;
   }
-  set iat(value) {
+  setIssuedAt(value) {
+    const payload = producerPayload(this);
     if (value === void 0) {
-      this.#payload.iat = epoch(/* @__PURE__ */ new Date());
+      payload.iat = epoch(/* @__PURE__ */ new Date());
     } else if (typeof value === "string") {
-      this.#payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value));
+      payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value));
     } else {
-      this.#payload.iat = numericDate(value, "setIssuedAt");
+      payload.iat = numericDate(value, "setIssuedAt");
     }
+    return this;
   }
 };
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwt/verify.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwt/verify.js
 async function jwtVerify(jwt, key, options) {
   const verified = await verifyCompact(jwt, prepareVerify(options), key);
   if (!verified[2]) {
@@ -2124,19 +2292,15 @@ async function jwtVerify(jwt, key, options) {
   return result;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwt/decrypt.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwt/decrypt.js
 async function jwtDecrypt(jwt, key, options) {
   const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key);
   const protectedHeader = decrypted[1];
   const payload = validateClaimsSet(protectedHeader, decrypted[0], options);
-  if (protectedHeader.iss !== void 0 && protectedHeader.iss !== payload.iss) {
-    throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, "iss", "mismatch");
-  }
-  if (protectedHeader.sub !== void 0 && protectedHeader.sub !== payload.sub) {
-    throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, "sub", "mismatch");
-  }
-  if (protectedHeader.aud !== void 0 && JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-    throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, "aud", "mismatch");
+  for (const claim of ["iss", "sub", "aud"]) {
+    if (protectedHeader[claim] !== void 0 && (claim === "aud" ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud) : protectedHeader[claim] !== payload[claim])) {
+      throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, "mismatch");
+    }
   }
   const result = { payload, protectedHeader };
   if (typeof key === "function") {
@@ -2145,40 +2309,148 @@ async function jwtDecrypt(jwt, key, options) {
   return result;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwe/compact/encrypt.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwe/compact/encrypt.js
 var CompactEncrypt = class {
-  #flattened;
-  constructor(plaintext) {
-    this.#flattened = new FlattenedEncrypt(plaintext);
-  }
-  setContentEncryptionKey(cek) {
-    this.#flattened.setContentEncryptionKey(cek);
-    return this;
+  #plaintext;
+  #protectedHeader;
+  #cek;
+  #iv;
+  #keyManagementParameters;
+  constructor(plaintext) {
+    assertUint8Array(plaintext, "plaintext");
+    this.#plaintext = plaintext;
+  }
+  setContentEncryptionKey(cek) {
+    assertNotSet(this.#cek, "setContentEncryptionKey");
+    this.#cek = cek;
+    return this;
   }
   setInitializationVector(iv) {
-    this.#flattened.setInitializationVector(iv);
+    assertNotSet(this.#iv, "setInitializationVector");
+    this.#iv = iv;
     return this;
   }
   setProtectedHeader(protectedHeader) {
-    this.#flattened.setProtectedHeader(protectedHeader);
+    assertNotSet(this.#protectedHeader, "setProtectedHeader");
+    this.#protectedHeader = protectedHeader;
     return this;
   }
   setKeyManagementParameters(parameters) {
-    this.#flattened.setKeyManagementParameters(parameters);
+    assertNotSet(this.#keyManagementParameters, "setKeyManagementParameters");
+    this.#keyManagementParameters = parameters;
     return this;
   }
   async encrypt(key, options) {
-    const jwe = await this.#flattened.encrypt(key, options);
+    const jwe = await createJWE([
+      this.#plaintext,
+      this.#protectedHeader,
+      void 0,
+      void 0,
+      void 0,
+      this.#cek,
+      this.#iv,
+      this.#keyManagementParameters,
+      void 0,
+      false
+    ], key, options);
     return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
   }
 };
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/jws_sign.js
-function unencodedPayload(protectedHeader) {
-  return protectedHeader?.b64 === false && Array.isArray(protectedHeader.crit) && protectedHeader.crit.includes("b64");
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
+var FlattenedEncrypt = class {
+  #plaintext;
+  #protectedHeader;
+  #sharedUnprotectedHeader;
+  #unprotectedHeader;
+  #aad;
+  #cek;
+  #iv;
+  #keyManagementParameters;
+  constructor(plaintext) {
+    assertUint8Array(plaintext, "plaintext");
+    this.#plaintext = plaintext;
+  }
+  setKeyManagementParameters(parameters) {
+    assertNotSet(this.#keyManagementParameters, "setKeyManagementParameters");
+    this.#keyManagementParameters = parameters;
+    return this;
+  }
+  setProtectedHeader(protectedHeader) {
+    assertNotSet(this.#protectedHeader, "setProtectedHeader");
+    this.#protectedHeader = protectedHeader;
+    return this;
+  }
+  setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+    assertNotSet(this.#sharedUnprotectedHeader, "setSharedUnprotectedHeader");
+    this.#sharedUnprotectedHeader = sharedUnprotectedHeader;
+    return this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader");
+    this.#unprotectedHeader = unprotectedHeader;
+    return this;
+  }
+  setAdditionalAuthenticatedData(aad) {
+    this.#aad = aad;
+    return this;
+  }
+  setContentEncryptionKey(cek) {
+    assertNotSet(this.#cek, "setContentEncryptionKey");
+    this.#cek = cek;
+    return this;
+  }
+  setInitializationVector(iv) {
+    assertNotSet(this.#iv, "setInitializationVector");
+    this.#iv = iv;
+    return this;
+  }
+  async encrypt(key, options) {
+    return createJWE([
+      this.#plaintext,
+      this.#protectedHeader,
+      this.#unprotectedHeader,
+      this.#sharedUnprotectedHeader,
+      this.#aad,
+      this.#cek,
+      this.#iv,
+      this.#keyManagementParameters,
+      void 0,
+      false
+    ], key, options);
+  }
+};
+
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/jws_sign.js
+function serializeProtectedHeader(protectedHeader) {
+  if (protectedHeader === void 0)
+    return [void 0, ""];
+  const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+  return [normalized[0], encode2(normalized[1])];
+}
+function validateSignatureHeader(protectedHeader, joseHeader, crit) {
+  validateCritDuplicates(JWSInvalid, protectedHeader);
+  return validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+}
+function signatureAlgorithm(joseHeader) {
+  const alg = joseHeader.alg;
+  if (typeof alg !== "string" || !alg) {
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  }
+  return jwsAlgorithm(alg);
+}
+async function signSignature(protectedHeader, payload, entry, key) {
+  const data = concat(encode(protectedHeader), encode("."), payload);
+  const k = await prepareKey(entry, key, "sign");
+  return encode2(await sign(entry, k, data));
 }
-async function createSignature(input, key) {
-  const { protectedHeader, unprotectedHeader } = input;
+async function createSignature(input, key, assertB64) {
+  let { protectedHeader, unprotectedHeader } = input;
+  let protectedHeaderString;
+  [protectedHeader, protectedHeaderString] = serializeProtectedHeader(protectedHeader);
+  if (unprotectedHeader !== void 0) {
+    unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0];
+  }
   if (!protectedHeader && !unprotectedHeader) {
     throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
   }
@@ -2186,20 +2458,9 @@ async function createSignature(input, key) {
     throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
   }
   const joseHeader = { ...protectedHeader, ...unprotectedHeader };
-  validateCritDuplicates(JWSInvalid, protectedHeader);
-  const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, input.crit, protectedHeader, joseHeader);
-  let b64 = true;
-  if (extensions.includes("b64")) {
-    b64 = protectedHeader.b64;
-    if (typeof b64 !== "boolean") {
-      throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-    }
-  }
-  const { alg } = joseHeader;
-  if (typeof alg !== "string" || !alg) {
-    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-  }
-  const entry = jwsAlgorithm(alg);
+  const b64 = validateSignatureHeader(protectedHeader, joseHeader, input.crit);
+  assertB64?.(b64);
+  const entry = signatureAlgorithm(joseHeader);
   let payloadS;
   let payloadB;
   if (b64) {
@@ -2212,20 +2473,8 @@ async function createSignature(input, key) {
     payloadB = input.payload;
     payloadS = "";
   }
-  let protectedHeaderString;
-  let protectedHeaderBytes;
-  if (protectedHeader) {
-    protectedHeaderString = encode2(JSON.stringify(protectedHeader));
-    protectedHeaderBytes = encode(protectedHeaderString);
-  } else {
-    protectedHeaderString = "";
-    protectedHeaderBytes = new Uint8Array();
-  }
-  const data = concat(protectedHeaderBytes, encode("."), payloadB);
-  const k = await prepareKey(entry, key, "sign");
-  const signature = await sign(entry, k, data);
   const jws = {
-    signature: encode2(signature),
+    signature: await signSignature(protectedHeaderString, payloadB, entry, key),
     payload: payloadS
   };
   if (protectedHeader) {
@@ -2234,10 +2483,45 @@ async function createSignature(input, key) {
   if (unprotectedHeader) {
     jws.header = unprotectedHeader;
   }
-  return jws;
+  return [jws, b64];
+}
+async function createCompactSignature(payload, inputProtectedHeader, inputCrit, key, rejectUnencoded) {
+  const [protectedHeader, protectedHeaderString] = serializeProtectedHeader(inputProtectedHeader);
+  if (!protectedHeader) {
+    throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+  }
+  const b64 = validateSignatureHeader(protectedHeader, protectedHeader, inputCrit);
+  if (!b64)
+    rejectUnencoded();
+  const entry = signatureAlgorithm(protectedHeader);
+  const encodedPayload = encode2(payload);
+  const signature = await signSignature(protectedHeaderString, encode(encodedPayload), entry, key);
+  return `${protectedHeaderString}.${encodedPayload}.${signature}`;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jws/flattened/sign.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jws/compact/sign.js
+var CompactSign = class {
+  #payload;
+  #protectedHeader;
+  constructor(payload) {
+    if (!(payload instanceof Uint8Array)) {
+      throw new TypeError("payload must be an instance of Uint8Array");
+    }
+    this.#payload = payload;
+  }
+  setProtectedHeader(protectedHeader) {
+    assertNotSet(this.#protectedHeader, "setProtectedHeader");
+    this.#protectedHeader = protectedHeader;
+    return this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(this.#payload, this.#protectedHeader, options?.crit, key, () => {
+      throw new TypeError("use the flattened module for creating JWS with b64: false");
+    });
+  }
+};
+
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jws/flattened/sign.js
 var FlattenedSign = class {
   #payload;
   #protectedHeader;
@@ -2259,37 +2543,17 @@ var FlattenedSign = class {
     return this;
   }
   async sign(key, options) {
-    return createSignature({
+    const [jws] = await createSignature({
       payload: this.#payload,
       protectedHeader: this.#protectedHeader,
       unprotectedHeader: this.#unprotectedHeader,
       crit: options?.crit
     }, key);
+    return jws;
   }
 };
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jws/compact/sign.js
-var CompactSign = class {
-  #flattened;
-  #protectedHeader;
-  constructor(payload) {
-    this.#flattened = new FlattenedSign(payload);
-  }
-  setProtectedHeader(protectedHeader) {
-    this.#flattened.setProtectedHeader(protectedHeader);
-    this.#protectedHeader = protectedHeader;
-    return this;
-  }
-  async sign(key, options) {
-    if (unencodedPayload(this.#protectedHeader)) {
-      throw new TypeError("use the flattened module for creating JWS with b64: false");
-    }
-    const jws = await this.#flattened.sign(key, options);
-    return `${jws.protected}.${jws.payload}.${jws.signature}`;
-  }
-};
-
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jws/general/sign.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jws/general/sign.js
 var IndividualSignature = class {
   #parent;
   state;
@@ -2340,19 +2604,21 @@ var GeneralSign = class {
       payload: ""
     };
     const encoded = [];
+    let b64;
     for (let i = 0; i < this.#signatures.length; i++) {
       const signature = this.#signatures[i];
       const [protectedHeader, unprotectedHeader, key, crit] = signature.state;
-      const { payload, ...rest } = await createSignature({
+      const [{ payload, ...rest }, signatureB64] = await createSignature({
         payload: this.#payload,
         protectedHeader,
         unprotectedHeader,
         crit,
         encoded
       }, key);
-      if (i === 0) {
+      if (b64 === void 0) {
+        b64 = signatureB64;
         jws.payload = payload;
-      } else if (jws.payload !== payload) {
+      } else if (b64 !== signatureB64) {
         throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
       }
       jws.signatures.push(rest);
@@ -2361,57 +2627,25 @@ var GeneralSign = class {
   }
 };
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwt/sign.js
-var SignJWT = class {
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwt/sign.js
+var SignJWT_base = JWTClaimsBuilder;
+var SignJWT = class extends SignJWT_base {
   #protectedHeader;
-  #jwt;
-  constructor(payload = {}) {
-    this.#jwt = new JWTClaimsBuilder(payload);
-  }
-  setIssuer(issuer) {
-    this.#jwt.iss = issuer;
-    return this;
-  }
-  setSubject(subject) {
-    this.#jwt.sub = subject;
-    return this;
-  }
-  setAudience(audience) {
-    this.#jwt.aud = audience;
-    return this;
-  }
-  setJti(jwtId) {
-    this.#jwt.jti = jwtId;
-    return this;
-  }
-  setNotBefore(input) {
-    this.#jwt.nbf = input;
-    return this;
-  }
-  setExpirationTime(input) {
-    this.#jwt.exp = input;
-    return this;
-  }
-  setIssuedAt(input) {
-    this.#jwt.iat = input;
-    return this;
-  }
   setProtectedHeader(protectedHeader) {
+    assertNotSet(this.#protectedHeader, "setProtectedHeader");
     this.#protectedHeader = protectedHeader;
     return this;
   }
   async sign(key, options) {
-    const sig2 = new CompactSign(this.#jwt.data());
-    sig2.setProtectedHeader(this.#protectedHeader);
-    if (unencodedPayload(this.#protectedHeader)) {
+    return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
       throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-    }
-    return sig2.sign(key, options);
+    });
   }
 };
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwt/encrypt.js
-var EncryptJWT = class {
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwt/encrypt.js
+var EncryptJWT_base = JWTClaimsBuilder;
+var EncryptJWT = class extends EncryptJWT_base {
   #cek;
   #iv;
   #keyManagementParameters;
@@ -2419,38 +2653,6 @@ var EncryptJWT = class {
   #replicateIssuerAsHeader;
   #replicateSubjectAsHeader;
   #replicateAudienceAsHeader;
-  #jwt;
-  constructor(payload = {}) {
-    this.#jwt = new JWTClaimsBuilder(payload);
-  }
-  setIssuer(issuer) {
-    this.#jwt.iss = issuer;
-    return this;
-  }
-  setSubject(subject) {
-    this.#jwt.sub = subject;
-    return this;
-  }
-  setAudience(audience) {
-    this.#jwt.aud = audience;
-    return this;
-  }
-  setJti(jwtId) {
-    this.#jwt.jti = jwtId;
-    return this;
-  }
-  setNotBefore(input) {
-    this.#jwt.nbf = input;
-    return this;
-  }
-  setExpirationTime(input) {
-    this.#jwt.exp = input;
-    return this;
-  }
-  setIssuedAt(input) {
-    this.#jwt.iat = input;
-    return this;
-  }
   setProtectedHeader(protectedHeader) {
     assertNotSet(this.#protectedHeader, "setProtectedHeader");
     this.#protectedHeader = protectedHeader;
@@ -2484,30 +2686,32 @@ var EncryptJWT = class {
     return this;
   }
   async encrypt(key, options) {
-    const enc = new CompactEncrypt(this.#jwt.data());
+    const plaintext = jwtData(this);
     if (this.#protectedHeader && (this.#replicateIssuerAsHeader || this.#replicateSubjectAsHeader || this.#replicateAudienceAsHeader)) {
       this.#protectedHeader = {
         ...this.#protectedHeader,
-        iss: this.#replicateIssuerAsHeader ? this.#jwt.iss : void 0,
-        sub: this.#replicateSubjectAsHeader ? this.#jwt.sub : void 0,
-        aud: this.#replicateAudienceAsHeader ? this.#jwt.aud : void 0
+        iss: this.#replicateIssuerAsHeader ? jwtClaim(this, "iss") : void 0,
+        sub: this.#replicateSubjectAsHeader ? jwtClaim(this, "sub") : void 0,
+        aud: this.#replicateAudienceAsHeader ? jwtClaim(this, "aud") : void 0
       };
     }
-    enc.setProtectedHeader(this.#protectedHeader);
-    if (this.#iv) {
-      enc.setInitializationVector(this.#iv);
-    }
-    if (this.#cek) {
-      enc.setContentEncryptionKey(this.#cek);
-    }
-    if (this.#keyManagementParameters) {
-      enc.setKeyManagementParameters(this.#keyManagementParameters);
-    }
-    return enc.encrypt(key, options);
+    const jwe = await createJWE([
+      plaintext,
+      this.#protectedHeader,
+      void 0,
+      void 0,
+      void 0,
+      this.#cek,
+      this.#iv,
+      this.#keyManagementParameters,
+      void 0,
+      false
+    ], key, options);
+    return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
   }
 };
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/key_algorithm.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/key_algorithm.js
 var algArgument = '"alg" (Algorithm)';
 function unsupportedAlg(source = 'JWK "alg" (Algorithm) Parameter') {
   throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
@@ -2516,7 +2720,15 @@ function keyAlgorithm(alg, source) {
   return (typeof alg === "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/lib/asn1.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/key_options.js
+function validateExtractableOption(extractable) {
+  if (extractable !== void 0 && typeof extractable !== "boolean") {
+    throw new TypeError('"extractable" option must be a boolean');
+  }
+  return extractable;
+}
+
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/lib/asn1.js
 var formatPEM = (b64, descriptor) => {
   const newlined = (b64.match(/.{1,64}/g) || []).join("\n");
   return `-----BEGIN ${descriptor}-----
@@ -2628,6 +2840,7 @@ var parseECAlgorithmIdentifier = (state) => {
   throw new Error("Unsupported named curve");
 };
 var genericImport = async (keyFormat, keyData, alg, options) => {
+  const extractable = validateExtractableOption(options?.extractable);
   const entry = keyAlgorithm(alg, algArgument);
   if (entry.secret) {
     unsupportedAlg(algArgument);
@@ -2645,7 +2858,7 @@ var genericImport = async (keyFormat, keyData, alg, options) => {
   } else {
     algorithm = entry.subtle;
   }
-  return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
+  return crypto.subtle.importKey(keyFormat, keyData, algorithm, extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
 };
 var processPEMData = (pem, pattern) => {
   return decodeBase64(pem.replace(pattern, ""));
@@ -2661,7 +2874,10 @@ var fromSPKI = (pem, alg, options) => {
 function spkiFromX509(buf) {
   const state = createASN1State(buf);
   expectTag(state, 48, "Invalid certificate structure");
-  parseLength(state);
+  const certificateLength = parseLength(state);
+  if (certificateLength < 0 || state.pos + certificateLength > state.data.length) {
+    throw new Error("Unexpected end of ASN.1 input");
+  }
   expectTag(state, 48, "Invalid tbsCertificate structure");
   parseLength(state);
   if (buf[state.pos] === 160) {
@@ -2685,7 +2901,7 @@ var fromX509 = (pem, alg, options) => {
   return genericImport("spki", spki, alg, options);
 };
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/key/export.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/key/export.js
 function omitUndefinedProperties(jwk) {
   return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== void 0));
 }
@@ -2726,7 +2942,7 @@ function exportJWK(key) {
   return keyToJWK(key);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwk/thumbprint.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwk/thumbprint.js
 var check = (value, description) => {
   if (typeof value !== "string" || !value) {
     throw new JWKInvalid(`${description} missing or invalid`);
@@ -2734,10 +2950,13 @@ var check = (value, description) => {
 };
 async function calculateJwkThumbprint(key, digestAlgorithm) {
   let jwk;
-  if (isJWK(key)) {
-    jwk = key;
+  if (isObject(key)) {
+    jwk = snapshotJwk(key);
+    if (typeof jwk.kty !== "string") {
+      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+    }
   } else if (isKeyLike(key)) {
-    jwk = await exportJWK(key);
+    jwk = snapshotJwk(await exportJWK(key));
   } else {
     throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
   }
@@ -2769,7 +2988,9 @@ async function calculateJwkThumbprint(key, digestAlgorithm) {
       components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
       break;
     case "oct":
-      check(jwk.k, '"k" (Key Value) Parameter');
+      if (typeof jwk.k !== "string") {
+        throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+      }
       components = { k: jwk.k, kty: jwk.kty };
       break;
     default:
@@ -2784,7 +3005,7 @@ async function calculateJwkThumbprintUri(key, digestAlgorithm) {
   return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwk/embedded.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwk/embedded.js
 async function EmbeddedJWK(protectedHeader, token) {
   const joseHeader = {
     ...protectedHeader,
@@ -2793,93 +3014,92 @@ async function EmbeddedJWK(protectedHeader, token) {
   if (!isObject(joseHeader.jwk)) {
     throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
   }
+  let jwk;
+  try {
+    jwk = normalizeJwk(joseHeader.jwk);
+  } catch (cause) {
+    throw new JWSInvalid("Invalid Embedded JWK", { cause });
+  }
   const entry = jwsAlgorithm(joseHeader.alg);
-  const key = await jwkToKey(entry, { ...joseHeader.jwk, ext: true });
+  if (jwk.use !== void 0 && jwk.use !== "sig") {
+    throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
+  }
+  if (jwk.alg !== void 0 && jwk.alg !== entry.alg) {
+    throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
+  }
+  const key = await jwkToKey(entry, { ...jwk, ext: true });
   if (key.type !== "public") {
     throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
   }
   return key;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwks/local.js
-function signatureAlgorithm(alg) {
-  const entry = typeof alg === "string" ? JWS[alg] : void 0;
-  if (!entry || entry.secret) {
-    throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-  }
-  return entry;
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwks/local.js
+function isUsableJWK(jwk, entry, alg, kid) {
+  const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
+  const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+  return (ext === void 0 || typeof ext === "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation === "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid === "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
 }
-function isJWKSLike(jwks) {
-  if (!jwks || typeof jwks !== "object") {
-    return false;
+async function importWithAlgCache(cache2, jwk, entry) {
+  const cached2 = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk);
+  const { alg } = entry;
+  if (cached2[alg] === void 0) {
+    const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
+    if (key.type !== "public") {
+      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+    }
+    cached2[alg] = key;
   }
-  const { keys } = jwks;
-  return Array.isArray(keys) && keys.every(isObject);
+  return cached2[alg];
 }
-var LocalJWKSetImpl = class {
-  #jwks;
-  #cached = /* @__PURE__ */ new WeakMap();
-  constructor(jwks) {
-    if (!isJWKSLike(jwks)) {
-      throw new JWKSInvalid("JSON Web Key Set malformed");
-    }
-    this.#jwks = structuredClone(jwks);
+function createLocalJWKSet(jwks) {
+  let snapshot;
+  try {
+    snapshot = structuredClone(jwks);
+  } catch {
   }
-  jwks() {
-    return this.#jwks;
+  if (!isJwkSet(snapshot)) {
+    throw new JWKSInvalid("JSON Web Key Set malformed");
   }
-  async getKey(protectedHeader, token) {
+  const cached2 = /* @__PURE__ */ new WeakMap();
+  const localJWKSet = async (protectedHeader, token) => {
     const { alg, kid } = { ...protectedHeader, ...token?.header };
-    const entry = signatureAlgorithm(alg);
-    const candidates = this.#jwks.keys.filter((jwk2) => entry.kty.includes(jwk2.kty) && (typeof kid !== "string" || kid === jwk2.kid) && (!(typeof jwk2.alg === "string" || jwk2.kty === "AKP") || alg === jwk2.alg) && (typeof jwk2.use !== "string" || jwk2.use === "sig") && (!Array.isArray(jwk2.key_ops) || jwk2.key_ops.includes("verify")) && (!entry.crv || jwk2.crv === entry.crv));
+    const entry = typeof alg === "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret) {
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+    const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid));
     const { 0: jwk, length } = candidates;
-    if (length === 0) {
+    if (!length) {
       throw new JWKSNoMatchingKey();
     }
     if (length !== 1) {
       const error = new JWKSMultipleMatchingKeys();
-      const _cached = this.#cached;
       error[Symbol.asyncIterator] = async function* () {
         for (const jwk2 of candidates) {
           try {
-            yield await importWithAlgCache(_cached, jwk2, entry);
+            yield await importWithAlgCache(cached2, jwk2, entry);
           } catch {
           }
         }
       };
       throw error;
     }
-    return importWithAlgCache(this.#cached, jwk, entry);
-  }
-};
-async function importWithAlgCache(cache2, jwk, entry) {
-  const cached2 = cache2.get(jwk) || cache2.set(jwk, { __proto__: null }).get(jwk);
-  if (cached2[entry.alg] === void 0) {
-    const key = await jwkToKey(entry, { ...jwk, alg: entry.alg, ext: true });
-    if (key.type !== "public") {
-      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
-    }
-    cached2[entry.alg] = key;
-  }
-  return cached2[entry.alg];
-}
-function createLocalJWKSet(jwks) {
-  const set = new LocalJWKSetImpl(jwks);
-  const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-  Object.defineProperty(localJWKSet, "jwks", {
-    value: () => structuredClone(set.jwks())
+    return importWithAlgCache(cached2, jwk, entry);
+  };
+  return Object.defineProperty(localJWKSet, "jwks", {
+    value: () => structuredClone(snapshot)
   });
-  return localJWKSet;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwks/remote.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwks/remote.js
 function isCloudflareWorkers() {
   return typeof WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime !== "undefined" && EdgeRuntime === "vercel";
 }
 var USER_AGENT;
 if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
   const NAME = "jose";
-  const VERSION = "v6.2.9";
+  const VERSION = "v6.2.10";
   USER_AGENT = `${NAME}/${VERSION}`;
 }
 var customFetch = /* @__PURE__ */ Symbol();
@@ -2905,171 +3125,122 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   }
 }
 var jwksCache = /* @__PURE__ */ Symbol();
-function isFreshJwksCache(input, cacheMaxAge) {
-  if (typeof input !== "object" || input === null) {
-    return false;
-  }
-  if (!("uat" in input) || typeof input.uat !== "number" || Date.now() - input.uat >= cacheMaxAge) {
-    return false;
-  }
-  if (!("jwks" in input) || !isObject(input.jwks) || !Array.isArray(input.jwks.keys) || !Array.prototype.every.call(input.jwks.keys, isObject)) {
-    return false;
+function isFreshFor(timestamp, duration) {
+  return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
+}
+function validateDuration(value, fallback, option) {
+  if (Number.isNaN(value)) {
+    throw new TypeError(`"${option}" option must not be NaN`);
   }
-  return true;
+  return typeof value === "number" ? value : fallback;
 }
-var RemoteJWKSetImpl = class {
-  #url;
-  #timeoutDuration;
-  #cooldownDuration;
-  #cacheMaxAge;
-  #jwksTimestamp;
-  #pendingFetch;
-  #headers;
-  #customFetch;
-  #local;
-  #cache;
-  constructor(url, options) {
-    if (!(url instanceof URL)) {
-      throw new TypeError("url must be an instance of URL");
-    }
-    this.#url = new URL(url.href);
-    const opts = options ?? {};
-    this.#timeoutDuration = typeof opts.timeoutDuration === "number" ? opts.timeoutDuration : 5e3;
-    this.#cooldownDuration = typeof opts.cooldownDuration === "number" ? opts.cooldownDuration : 3e4;
-    this.#cacheMaxAge = typeof opts.cacheMaxAge === "number" ? opts.cacheMaxAge : 6e5;
-    this.#headers = new Headers(opts.headers);
-    if (USER_AGENT && !this.#headers.has("User-Agent")) {
-      this.#headers.set("User-Agent", USER_AGENT);
-    }
-    if (!this.#headers.has("accept")) {
-      this.#headers.set("accept", "application/json");
-      this.#headers.append("accept", "application/jwk-set+json");
-    }
-    this.#customFetch = opts[customFetch];
-    const cache2 = opts[jwksCache];
-    if (cache2 !== void 0) {
-      this.#cache = cache2;
-      if (isFreshJwksCache(cache2, this.#cacheMaxAge)) {
-        this.#jwksTimestamp = this.#cache.uat;
-        this.#local = createLocalJWKSet(this.#cache.jwks);
-      }
+function createRemoteJWKSet(url, options) {
+  if (!(url instanceof URL)) {
+    throw new TypeError("url must be an instance of URL");
+  }
+  const href = new URL(url.href).href;
+  const opts = options ?? {};
+  const timeoutOption = opts.timeoutDuration;
+  if (typeof timeoutOption === "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0)) {
+    throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+  }
+  const timeoutDuration = typeof timeoutOption === "number" ? timeoutOption : 5e3;
+  const cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration");
+  const cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge");
+  const headers = new Headers(opts.headers);
+  if (USER_AGENT && !headers.has("User-Agent")) {
+    headers.set("User-Agent", USER_AGENT);
+  }
+  if (!headers.has("accept")) {
+    headers.set("accept", "application/json, application/jwk-set+json");
+  }
+  const fetchImpl = opts[customFetch];
+  const cache2 = opts[jwksCache];
+  let jwksTimestamp;
+  let pendingFetch;
+  let reloadSequence = 0;
+  let appliedSequence = 0;
+  let local;
+  if (cache2 && typeof cache2 === "object") {
+    const { uat, jwks } = cache2;
+    if (isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks)) {
+      jwksTimestamp = uat;
+      local = createLocalJWKSet(jwks);
+    }
+  }
+  const reload = async () => {
+    if (pendingFetch && isCloudflareWorkers()) {
+      pendingFetch = void 0;
+    }
+    if (!pendingFetch) {
+      const sequence = ++reloadSequence;
+      const current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+        const next = createLocalJWKSet(json);
+        if (sequence <= appliedSequence) {
+          return;
+        }
+        local = next;
+        const updatedAt = Date.now();
+        if (cache2) {
+          cache2.uat = updatedAt;
+          cache2.jwks = json;
+        }
+        jwksTimestamp = updatedAt;
+        appliedSequence = sequence;
+      }).finally(() => {
+        if (pendingFetch === current) {
+          pendingFetch = void 0;
+        }
+      });
     }
-  }
-  pendingFetch() {
-    return !!this.#pendingFetch;
-  }
-  #validFor(duration) {
-    return typeof this.#jwksTimestamp === "number" && Date.now() < this.#jwksTimestamp + duration;
-  }
-  coolingDown() {
-    return this.#validFor(this.#cooldownDuration);
-  }
-  fresh() {
-    return this.#validFor(this.#cacheMaxAge);
-  }
-  jwks() {
-    return this.#local?.jwks();
-  }
-  async getKey(protectedHeader, token) {
-    if (!this.#local || !this.fresh()) {
-      await this.reload();
+    await pendingFetch;
+  };
+  const remoteJWKSet = async (protectedHeader, token) => {
+    if (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) {
+      await reload();
     }
     try {
-      return await this.#local(protectedHeader, token);
+      return await local(protectedHeader, token);
     } catch (err) {
-      if (err instanceof JWKSNoMatchingKey) {
-        if (this.coolingDown() === false) {
-          await this.reload();
-          return this.#local(protectedHeader, token);
-        }
+      if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) {
+        await reload();
+        return local(protectedHeader, token);
       }
       throw err;
     }
-  }
-  async reload() {
-    if (this.#pendingFetch && isCloudflareWorkers()) {
-      this.#pendingFetch = void 0;
-    }
-    this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch).then((json) => {
-      this.#local = createLocalJWKSet(json);
-      if (this.#cache) {
-        this.#cache.uat = Date.now();
-        this.#cache.jwks = json;
-      }
-      this.#jwksTimestamp = Date.now();
-    }).finally(() => {
-      this.#pendingFetch = void 0;
-    });
-    await this.#pendingFetch;
-  }
-};
-function createRemoteJWKSet(url, options) {
-  const set = new RemoteJWKSetImpl(url, options);
-  const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-  Object.defineProperties(remoteJWKSet, {
+  };
+  return Object.defineProperties(remoteJWKSet, {
     coolingDown: {
-      get: () => set.coolingDown(),
+      get: () => isFreshFor(jwksTimestamp, cooldownDuration),
       enumerable: true
     },
     fresh: {
-      get: () => set.fresh(),
+      get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
       enumerable: true
     },
     reload: {
-      value: () => set.reload(),
+      value: reload,
       enumerable: true
     },
     reloading: {
-      get: () => set.pendingFetch(),
+      get: () => !!pendingFetch,
       enumerable: true
     },
     jwks: {
-      value: () => set.jwks(),
+      value: () => local?.jwks(),
       enumerable: true
     }
   });
-  return remoteJWKSet;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/jwt/unsecured.js
-var UnsecuredJWT = class {
-  #jwt;
-  constructor(payload = {}) {
-    this.#jwt = new JWTClaimsBuilder(payload);
-  }
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/jwt/unsecured.js
+var UnsecuredJWT_base = JWTClaimsBuilder;
+var UnsecuredJWT = class extends UnsecuredJWT_base {
   encode() {
     const header = encode2(JSON.stringify({ alg: "none" }));
-    const payload = encode2(this.#jwt.data());
+    const payload = encode2(jwtData(this));
     return `${header}.${payload}.`;
   }
-  setIssuer(issuer) {
-    this.#jwt.iss = issuer;
-    return this;
-  }
-  setSubject(subject) {
-    this.#jwt.sub = subject;
-    return this;
-  }
-  setAudience(audience) {
-    this.#jwt.aud = audience;
-    return this;
-  }
-  setJti(jwtId) {
-    this.#jwt.jti = jwtId;
-    return this;
-  }
-  setNotBefore(input) {
-    this.#jwt.nbf = input;
-    return this;
-  }
-  setExpirationTime(input) {
-    this.#jwt.exp = input;
-    return this;
-  }
-  setIssuedAt(input) {
-    this.#jwt.iat = input;
-    return this;
-  }
   static decode(jwt, options) {
     if (typeof jwt !== "string") {
       throw new JWTInvalid("Unsecured JWT must be a string");
@@ -3079,19 +3250,29 @@ var UnsecuredJWT = class {
       throw new JWTInvalid("Invalid Unsecured JWT");
     }
     let header;
+    let b64;
     try {
-      header = JSON.parse(strictDecoder.decode(decode(encodedHeader)));
-      if (header.alg !== "none")
-        throw new Error();
-    } catch {
+      header = parseJoseHeader(encodedHeader, JWSInvalid, "JWS Protected Header is invalid");
+      const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, void 0, header, header);
+      b64 = validateB64(header, extensions);
+    } catch (cause) {
+      if (!(cause instanceof JWSInvalid)) {
+        throw cause;
+      }
+      throw new JWTInvalid("Invalid Unsecured JWT", { cause });
+    }
+    if (header.alg !== "none") {
       throw new JWTInvalid("Invalid Unsecured JWT");
     }
+    if (!b64) {
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    }
     const payload = validateClaimsSet(header, decodeBase64url(encodedPayload, "payload", JWTInvalid), options);
     return { payload, header };
   }
 };
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/key/import.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/key/import.js
 async function importSPKI(spki, alg, options) {
   if (typeof spki !== "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0) {
     throw new TypeError('"spki" must be SPKI formatted string');
@@ -3114,37 +3295,39 @@ async function importJWK(jwk, alg, options) {
   if (!isObject(jwk)) {
     throw new TypeError("JWK must be an object");
   }
-  alg ??= jwk.alg;
-  const ext = options?.extractable ?? jwk.ext;
-  if (jwk.kty !== "oct" && !alg) {
+  const normalized = normalizeJwk(jwk);
+  const extractable = validateExtractableOption(options?.extractable);
+  const { alg: jwkAlg } = normalized;
+  alg ??= jwkAlg;
+  const ext = extractable ?? normalized.ext;
+  if (normalized.kty !== "oct" && !alg) {
     throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
   }
-  switch (jwk.kty) {
+  switch (normalized.kty) {
     case "oct":
-      if (typeof jwk.k !== "string" || !jwk.k) {
+      if (typeof normalized.k !== "string") {
         throw new TypeError('missing "k" (Key Value) Parameter value');
       }
-      return decode(jwk.k);
-    case "RSA":
-      return jwkToKey(keyAlgorithm(alg), { ...jwk, alg, ext });
+      return decode(normalized.k);
     case "AKP": {
-      if (typeof jwk.alg !== "string" || !jwk.alg) {
+      if (typeof jwkAlg !== "string" || !jwkAlg) {
         throw new TypeError('missing "alg" (Algorithm) Parameter value');
       }
-      if (alg !== void 0 && alg !== jwk.alg) {
+      if (alg !== jwkAlg) {
         throw new TypeError("JWK alg and alg option value mismatch");
       }
-      return jwkToKey(keyAlgorithm(jwk.alg), { ...jwk, ext });
+      return jwkToKey(keyAlgorithm(alg), { ...normalized, ext });
     }
+    case "RSA":
     case "EC":
     case "OKP":
-      return jwkToKey(keyAlgorithm(alg), { ...jwk, alg, ext });
+      return jwkToKey(keyAlgorithm(alg), { ...normalized, alg, ext });
     default:
       throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
   }
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/util/decode_protected_header.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/util/decode_protected_header.js
 function decodeProtectedHeader(token) {
   let protectedB64u;
   if (typeof token === "string") {
@@ -3167,7 +3350,7 @@ function decodeProtectedHeader(token) {
   return parseJoseHeader(protectedB64u, TypeError, invalid2);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/util/decode_jwt.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/util/decode_jwt.js
 function decodeJwt(jwt) {
   if (typeof jwt !== "string")
     throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
@@ -3195,15 +3378,16 @@ function decodeJwt(jwt) {
   return result;
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/key/generate_key_pair.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/key/generate_key_pair.js
 function getModulusLengthOption(options) {
   const modulusLength = options?.modulusLength ?? 2048;
-  if (typeof modulusLength !== "number" || modulusLength < 2048) {
+  if (typeof modulusLength !== "number" || !Number.isInteger(modulusLength) || modulusLength < 2048) {
     throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");
   }
   return modulusLength;
 }
 async function generateKeyPair(alg, options) {
+  const extractable = validateExtractableOption(options?.extractable);
   const entry = keyAlgorithm(alg, algArgument);
   if (entry.secret) {
     unsupportedAlg(algArgument);
@@ -3233,14 +3417,15 @@ async function generateKeyPair(alg, options) {
       modulusLength: getModulusLengthOption(options)
     } : entry.subtle;
   }
-  return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, [
+  return crypto.subtle.generateKey(algorithm, extractable ?? false, [
     ...entry.usages[1],
     ...entry.usages[0]
   ]);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/key/generate_secret.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/key/generate_secret.js
 async function generateSecret(alg, options) {
+  const extractable = validateExtractableOption(options?.extractable);
   let length;
   let algorithm;
   let keyUsages;
@@ -3248,19 +3433,18 @@ async function generateSecret(alg, options) {
     case "HS256":
     case "HS384":
     case "HS512":
-      length = parseInt(alg.slice(-3), 10);
+      length = +alg.slice(-3);
       algorithm = { name: "HMAC", hash: `SHA-${length}`, length };
       keyUsages = ["sign", "verify"];
       break;
     case "A128CBC-HS256":
     case "A192CBC-HS384":
     case "A256CBC-HS512":
-      length = parseInt(alg.slice(-3), 10);
-      return crypto.getRandomValues(new Uint8Array(length >> 3));
+      return crypto.getRandomValues(new Uint8Array(+alg.slice(-3) >> 3));
     case "A128KW":
     case "A192KW":
     case "A256KW":
-      length = parseInt(alg.slice(1, 4), 10);
+      length = +alg.slice(1, 4);
       algorithm = { name: "AES-KW", length };
       keyUsages = ["wrapKey", "unwrapKey"];
       break;
@@ -3270,17 +3454,17 @@ async function generateSecret(alg, options) {
     case "A128GCM":
     case "A192GCM":
     case "A256GCM":
-      length = parseInt(alg.slice(1, 4), 10);
+      length = +alg.slice(1, 4);
       algorithm = { name: "AES-GCM", length };
       keyUsages = ["encrypt", "decrypt"];
       break;
     default:
       unsupportedAlg(algArgument);
   }
-  return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
+  return crypto.subtle.generateKey(algorithm, extractable ?? false, keyUsages);
 }
 
-// node_modules/.pnpm/jose@6.2.9/node_modules/jose/dist/webapi/index.js
+// node_modules/.pnpm/jose@6.2.10/node_modules/jose/dist/webapi/index.js
 var cryptoRuntime = "WebCryptoAPI";
 export {
   CompactEncrypt,