@meshagent/meshagent-ts-auth 0.49.1 → 0.51.0

package/dist/browser/ma-auth.global.js

@@ -52,7 +52,6 @@ meshagent.auth = (() => {
   var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
   var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
   var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
-  var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
 
   // ../node_modules/@kayahr/text-encoding/data/big5.cp.js
   var big5_cp_default;
@@ -3121,14 +3120,18 @@ meshagent.auth = (() => {
     msecs ?? (msecs = Date.now());
     nsecs ?? (nsecs = 0);
     clockseq ?? (clockseq = (rnds[8] << 8 | rnds[9]) & 16383);
-    node ?? (node = rnds.slice(10, 16));
+    if (node == null) {
+      node = rnds.slice(10, 16);
+      node[0] |= 1;
+    }
     msecs += 122192928e5;
-    const tl = ((msecs & 268435455) * 1e4 + nsecs) % 4294967296;
+    const t = (msecs & 268435455) * 1e4 + nsecs;
+    const tl = t >>> 0;
     buf[offset++] = tl >>> 24 & 255;
     buf[offset++] = tl >>> 16 & 255;
     buf[offset++] = tl >>> 8 & 255;
     buf[offset++] = tl & 255;
-    const tmh = msecs / 4294967296 * 1e4 & 268435455;
+    const tmh = (msecs / 268435456 | 0) * 625 + (t / 4294967296 | 0) & 268435455;
     buf[offset++] = tmh >>> 8 & 255;
     buf[offset++] = tmh & 255;
     buf[offset++] = tmh >>> 24 & 15 | 16;
@@ -3553,7 +3556,7 @@ meshagent.auth = (() => {
     state.msecs ?? (state.msecs = -Infinity);
     state.seq ?? (state.seq = 0);
     if (now > state.msecs) {
-      state.seq = rnds[6] << 23 | rnds[7] << 16 | rnds[8] << 8 | rnds[9];
+      state.seq = v7Sequence(rnds);
       state.msecs = now;
     } else {
       state.seq = state.seq + 1 | 0;
@@ -3576,7 +3579,7 @@ meshagent.auth = (() => {
       }
     }
     msecs ?? (msecs = Date.now());
-    seq ?? (seq = rnds[6] * 127 << 24 | rnds[7] << 16 | rnds[8] << 8 | rnds[9]);
+    seq ?? (seq = v7Sequence(rnds));
     buf[offset++] = msecs / 1099511627776 & 255;
     buf[offset++] = msecs / 4294967296 & 255;
     buf[offset++] = msecs / 16777216 & 255;
@@ -3595,6 +3598,9 @@ meshagent.auth = (() => {
     buf[offset++] = rnds[15];
     return buf;
   }
+  function v7Sequence(rnds) {
+    return (rnds[6] & 127) << 24 | rnds[7] << 16 | rnds[8] << 8 | rnds[9];
+  }
   var _state2, v7_default;
   var init_v7 = __esm({
     "../node_modules/uuid/dist/v7.js"() {
@@ -36468,23 +36474,13 @@ return true;`);
     const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, "decrypt");
     const macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8));
     const expectedTag = await cbcHmacTag(macKey, macData, keySize);
-    let macCheckPassed;
     try {
-      macCheckPassed = await timingSafeEqual(tag2, expectedTag);
-    } catch {
-    }
-    if (!macCheckPassed) {
-      throw new JWEDecryptionFailed();
-    }
-    let plaintext;
-    try {
-      plaintext = new Uint8Array(await crypto.subtle.decrypt({ iv, name: "AES-CBC" }, encKey, ciphertext));
+      if (await timingSafeEqual(tag2, expectedTag)) {
+        return new Uint8Array(await crypto.subtle.decrypt({ iv, name: "AES-CBC" }, encKey, ciphertext));
+      }
     } catch {
     }
-    if (!plaintext) {
-      throw new JWEDecryptionFailed();
-    }
-    return plaintext;
+    throw new JWEDecryptionFailed();
   }
   async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
     const encKey = cek instanceof Uint8Array ? await crypto.subtle.importKey("raw", cek, "AES-GCM", false, [
@@ -36539,6 +36535,9 @@ return true;`);
     if (!tag2) {
       throw new JWEInvalid("JWE Authentication Tag missing");
     }
+    if (!enc.cbc && tag2.length !== 16) {
+      throw new JWEInvalid("Invalid Authentication Tag length");
+    }
     checkIvLength(enc, iv);
     if (cek instanceof Uint8Array) {
       checkCekLength(cek, enc.cekBits);
@@ -36636,19 +36635,20 @@ return true;`);
   });
 
   // ../node_modules/jose/dist/webapi/lib/type_checks.js
+  function assertUint8Array(input, label) {
+    if (!(input instanceof Uint8Array)) {
+      throw new TypeError(`${label} must be an instance of Uint8Array`);
+    }
+  }
   function isObject(input) {
     if (typeof input !== "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") {
       return false;
     }
     const prototype = Object.getPrototypeOf(input);
-    if (prototype === null) {
-      return true;
-    }
-    let proto = prototype;
-    while (Object.getPrototypeOf(proto) !== null) {
-      proto = Object.getPrototypeOf(proto);
-    }
-    return prototype === proto;
+    return prototype === null || Object.getPrototypeOf(prototype) === null;
+  }
+  function isJwkSet(input) {
+    return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);
   }
   function isDisjoint(...headers) {
     const parameters = /* @__PURE__ */ new Set();
@@ -36664,19 +36664,14 @@ return true;`);
     }
     return true;
   }
-  var isJWK, isPrivateJWK, isPublicJWK, isSecretJWK;
   var init_type_checks = __esm({
     "../node_modules/jose/dist/webapi/lib/type_checks.js"() {
-      isJWK = (key) => isObject(key) && typeof key.kty === "string";
-      isPrivateJWK = (key) => key.kty !== "oct" && (key.kty === "AKP" && typeof key.priv === "string" || typeof key.d === "string");
-      isPublicJWK = (key) => key.kty !== "oct" && key.d === void 0 && key.priv === void 0;
-      isSecretJWK = (key) => key.kty === "oct" && typeof key.k === "string";
     }
   });
 
   // ../node_modules/jose/dist/webapi/lib/helpers.js
   function assertNotSet(value, name) {
-    if (value) {
+    if (value !== void 0) {
       throw new TypeError(`${name} can only be called once`);
     }
   }
@@ -36743,18 +36738,47 @@ return true;`);
     }
   });
 
+  // ../node_modules/jose/dist/webapi/lib/jwk_metadata.js
+  function snapshotJwk(jwk) {
+    return { __proto__: null, ...jwk };
+  }
+  function normalizeJwk(jwk) {
+    const normalized = snapshotJwk(jwk);
+    if (normalized.ext !== void 0 && typeof normalized.ext !== "boolean") {
+      throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+    }
+    if (normalized.key_ops !== void 0) {
+      const value = normalized.key_ops;
+      const keyOps = Array.isArray(value) ? [...value] : void 0;
+      if (!keyOps || keyOps.some((operation) => typeof operation !== "string") || new Set(keyOps).size !== keyOps.length) {
+        throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+      }
+      normalized.key_ops = keyOps;
+    }
+    return normalized;
+  }
+  var init_jwk_metadata = __esm({
+    "../node_modules/jose/dist/webapi/lib/jwk_metadata.js"() {
+    }
+  });
+
   // ../node_modules/jose/dist/webapi/lib/key.js
   function checkKeyType(entry, key, usage) {
     const { alg, secret } = entry;
     const privateKey = usage === "decrypt" || usage === "sign";
     if (secret && key instanceof Uint8Array)
       return [BYTES, key];
-    if (isJWK(key)) {
-      if (secret ? !isSecretJWK(key) : !(privateKey ? isPrivateJWK(key) : isPublicJWK(key))) {
+    if (isObject(key)) {
+      const normalized = normalizeJwk(key);
+      if (typeof normalized.kty !== "string") {
+        throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
+      }
+      const valid = secret ? normalized.kty === "oct" && typeof normalized.k === "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv === "string" || typeof normalized.d === "string" : normalized.d === void 0 && normalized.priv === void 0);
+      if (!valid) {
         throw new TypeError(secret ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present` : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
       }
-      jwkMatchesOp(entry, key, usage);
-      return [JWK, key];
+      jwkMatchesOp(entry, normalized, usage);
+      return [JWK, key, normalized];
     }
     if (!isKeyLike(key)) {
       throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
@@ -36782,7 +36806,7 @@ return true;`);
       if (entry) {
         entry[alg] = value;
       } else {
-        cache.set(key, { __proto__: null, [alg]: value });
+        cache.set(key, { [alg]: value });
       }
     }
     return value ?? entry?.[alg];
@@ -36795,8 +36819,9 @@ return true;`);
         return tagged[1];
       case JWK: {
         const key2 = tagged[1];
-        if (key2.k) {
-          return decode(key2.k);
+        const normalized = tagged[2];
+        if (normalized.kty === "oct") {
+          return decode(normalized.k);
         }
         if (!Object.isFrozen(key2)) {
           const { key_ops } = key2;
@@ -36804,7 +36829,7 @@ return true;`);
             Object.freeze(key_ops);
           Object.freeze(key2);
         }
-        return handleJWK(key2, key2, entry);
+        return handleJWK(key2, normalized, entry);
       }
       case KEYOBJECT: {
         const keyObject = tagged[1];
@@ -36826,6 +36851,7 @@ return true;`);
       init_type_checks();
       init_base64url();
       init_jwk_to_key();
+      init_jwk_metadata();
       tag = (key) => key[Symbol.toStringTag];
       jwkMatchesOp = (entry, key, usage) => {
         const { alg } = entry;
@@ -37092,7 +37118,7 @@ return true;`);
     if (encryptedKey !== void 0)
       throw new JWEInvalid("Encountered unexpected JWE Encrypted Key");
   }
-  async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, options) {
+  async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, maxPBES2Count) {
     const entry = jweAlgorithm(alg);
     if (alg === "dir") {
       assertNoEncryptedKey(encryptedKey);
@@ -37134,7 +37160,7 @@ return true;`);
         assertEncryptedKey(encryptedKey);
         if (typeof joseHeader.p2c !== "number")
           throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-        const p2cLimit = options?.maxPBES2Count || 1e4;
+        const p2cLimit = maxPBES2Count || 1e4;
         if (joseHeader.p2c > p2cLimit)
           throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
         if (typeof joseHeader.p2s !== "string")
@@ -37172,8 +37198,14 @@ return true;`);
       case "ECDH": {
         assertEcdhKey(key);
         const { apu, apv } = providedParameters;
+        if (apu !== void 0) {
+          assertUint8Array(apu, '"apu"');
+        }
+        if (apv !== void 0) {
+          assertUint8Array(apv, '"apv"');
+        }
         let ephemeralKey;
-        if (providedParameters.epk) {
+        if (providedParameters.epk !== void 0) {
           ephemeralKey = await prepareKey(entry, providedParameters.epk, "decrypt");
         } else {
           ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, true, ["deriveBits"])).privateKey;
@@ -37291,16 +37323,49 @@ return true;`);
     }
     return protectedHeader.crit;
   }
+  function validateB64(protectedHeader, extensions) {
+    if (extensions.includes("b64")) {
+      const b64 = protectedHeader.b64;
+      if (typeof b64 !== "boolean") {
+        throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+      }
+      return b64;
+    }
+    return true;
+  }
+  function serializeJoseHeader(Err, header) {
+    let serialized;
+    let parsed;
+    try {
+      serialized = JSON.stringify(header);
+      parsed = JSON.parse(serialized);
+    } catch (cause) {
+      throw new Err("JOSE Header is not valid JSON", { cause });
+    }
+    if (!isObject(parsed)) {
+      throw new Err("JOSE Header is not a JSON object");
+    }
+    return [parsed, serialized];
+  }
   var JWS_RECOGNIZED, JWE_RECOGNIZED;
   var init_options = __esm({
     "../node_modules/jose/dist/webapi/lib/options.js"() {
       init_errors();
+      init_type_checks();
       JWS_RECOGNIZED = { __proto__: null, b64: true };
       JWE_RECOGNIZED = { __proto__: null };
     }
   });
 
   // ../node_modules/jose/dist/webapi/lib/deflate.js
+  function validateZip(joseHeader, protectedHeader) {
+    if (joseHeader.zip !== void 0 && joseHeader.zip !== "DEF") {
+      throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
+    }
+    if (joseHeader.zip !== void 0 && !protectedHeader?.zip) {
+      throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
+    }
+  }
   function supported(name) {
     if (typeof globalThis[name] === "undefined") {
       throw new JOSENotSupported(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${name} API.`);
@@ -37355,34 +37420,71 @@ return true;`);
   });
 
   // ../node_modules/jose/dist/webapi/lib/jwe_decrypt.js
-  function checkShared(jwe) {
-    const { ciphertext, protected: encodedProtected, unprotected: unprotected2 } = jwe;
-    if (jwe.iv !== void 0 && typeof jwe.iv !== "string") {
+  function snapshotSharedJWE(jwe) {
+    const { aad, ciphertext, iv, protected: encodedProtected, tag: tag2, unprotected: unprotected2 } = jwe;
+    if (iv !== void 0 && typeof iv !== "string") {
       throw new JWEInvalid("JWE Initialization Vector incorrect type");
     }
     if (typeof ciphertext !== "string") {
       throw new JWEInvalid("JWE Ciphertext missing or incorrect type");
     }
-    if (jwe.tag !== void 0 && typeof jwe.tag !== "string") {
+    if (tag2 !== void 0 && typeof tag2 !== "string") {
       throw new JWEInvalid("JWE Authentication Tag incorrect type");
     }
     if (encodedProtected !== void 0 && typeof encodedProtected !== "string") {
       throw new JWEInvalid("JWE Protected Header incorrect type");
     }
-    if (jwe.aad !== void 0 && typeof jwe.aad !== "string") {
+    if (aad !== void 0 && (typeof aad !== "string" || !aad)) {
       throw new JWEInvalid("JWE AAD incorrect type");
     }
     if (unprotected2 !== void 0 && !isObject(unprotected2)) {
       throw new JWEInvalid("JWE Shared Unprotected Header incorrect type");
     }
+    return {
+      aad,
+      ciphertext,
+      iv,
+      protected: encodedProtected,
+      tag: tag2,
+      unprotected: unprotected2 === void 0 ? void 0 : { ...unprotected2 }
+    };
+  }
+  function snapshotRecipientJWE(recipient) {
+    let header;
+    let headerAlg;
+    try {
+      const { header: inputHeader } = recipient;
+      if (isObject(inputHeader)) {
+        headerAlg = inputHeader.alg;
+        const parameters = Object.keys(inputHeader);
+        if (!parameters.includes("alg"))
+          headerAlg = void 0;
+        header = Object.fromEntries(parameters.map((parameter) => [
+          parameter,
+          parameter === "alg" ? headerAlg : inputHeader[parameter]
+        ]));
+      } else {
+        header = inputHeader;
+      }
+    } catch (error) {
+      return [void 0, headerAlg, error];
+    }
+    try {
+      const { encrypted_key: encryptedKey } = recipient;
+      return [{ encrypted_key: encryptedKey, header }, headerAlg];
+    } catch (error) {
+      return [void 0, headerAlg, error];
+    }
   }
   function checkRecipient(jwe) {
     const { encrypted_key: encryptedKey, header } = jwe;
     if (encryptedKey !== void 0 && typeof encryptedKey !== "string") {
       throw new JWEInvalid("JWE Encrypted Key incorrect type");
     }
-    if (header !== void 0 && !isObject(header)) {
-      throw new JWEInvalid("JWE Per-Recipient Unprotected Header incorrect type");
+    if (header !== void 0) {
+      if (!isObject(header)) {
+        throw new JWEInvalid("JWE Per-Recipient Unprotected Header incorrect type");
+      }
     }
     if (jwe.protected === void 0 && header === void 0 && jwe.unprotected === void 0) {
       throw new JWEInvalid("JOSE Header missing");
@@ -37391,7 +37493,7 @@ return true;`);
   function shareJWE(jwe) {
     const { protected: encodedProtected, ciphertext, iv, tag: tag2, aad } = jwe;
     let parsedProt;
-    if (encodedProtected) {
+    if (encodedProtected !== void 0) {
       parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, "JWE Protected Header is invalid");
     }
     const protectedHeader = encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array();
@@ -37428,13 +37530,14 @@ return true;`);
     return [
       options && validateAlgorithms("keyManagementAlgorithms", options.keyManagementAlgorithms),
       options && validateAlgorithms("contentEncryptionAlgorithms", options.contentEncryptionAlgorithms),
-      options
+      options?.crit,
+      options?.maxPBES2Count,
+      options?.maxDecompressedLength
     ];
   }
   async function decryptRecipient(jwe, token, shared, key) {
-    const [keyManagementAlgorithms, contentEncryptionAlgorithms, options] = shared;
-    const [parsedProt, ciphertext, iv, tag2, additionalData] = token;
-    const { encrypted_key: encodedKey, header, unprotected: unprotected2 } = jwe;
+    const [parsedProt] = token;
+    const { header, unprotected: unprotected2 } = jwe;
     let joseHeader;
     if (header !== void 0 || unprotected2 !== void 0) {
       if (!isDisjoint(parsedProt, header, unprotected2)) {
@@ -37444,13 +37547,14 @@ return true;`);
     } else {
       joseHeader = parsedProt ?? {};
     }
-    validateCrit(JWEInvalid, JWE_RECOGNIZED, options?.crit, parsedProt, joseHeader);
-    if (joseHeader.zip !== void 0 && joseHeader.zip !== "DEF") {
-      throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
-    }
-    if (joseHeader.zip !== void 0 && !parsedProt?.zip) {
-      throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
-    }
+    return decryptRecipientCore(jwe, token, shared, key, joseHeader);
+  }
+  async function decryptRecipientCore(jwe, token, shared, key, joseHeader) {
+    const [keyManagementAlgorithms, contentEncryptionAlgorithms, crit, maxPBES2Count, maxDecompressedLength] = shared;
+    const [parsedProt, ciphertext, iv, tag2, additionalData] = token;
+    const { encrypted_key: encodedKey } = jwe;
+    validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, parsedProt, joseHeader);
+    validateZip(joseHeader, parsedProt);
     const { alg, enc } = joseHeader;
     if (typeof alg !== "string" || !alg) {
       throw new JWEInvalid("missing JWE Algorithm (alg) in JWE Header");
@@ -37478,7 +37582,10 @@ return true;`);
     const k = await prepareKey(alg === "dir" ? encEntry : algEntry, key, "decrypt");
     let cek;
     try {
-      cek = await decryptKeyManagement(alg, encEntry, k, encryptedKey, joseHeader, options);
+      cek = await decryptKeyManagement(alg, encEntry, k, encryptedKey, joseHeader, maxPBES2Count);
+      if (encodedKey !== void 0 && cek instanceof Uint8Array && cek.byteLength << 3 !== encEntry.cekBits) {
+        cek = generateCek(encEntry);
+      }
     } catch (err) {
       if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
         throw err;
@@ -37487,14 +37594,14 @@ return true;`);
     }
     let plaintext = await decrypt(encEntry, cek, ciphertext, iv, tag2, additionalData);
     if (joseHeader.zip === "DEF") {
-      const maxDecompressedLength = options?.maxDecompressedLength ?? 25e4;
-      if (maxDecompressedLength === 0) {
+      const decompressionLimit = maxDecompressedLength ?? 25e4;
+      if (decompressionLimit === 0) {
         throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
       }
-      if (maxDecompressedLength !== Infinity && (!Number.isSafeInteger(maxDecompressedLength) || maxDecompressedLength < 1)) {
+      if (decompressionLimit !== Infinity && (!Number.isSafeInteger(decompressionLimit) || decompressionLimit < 1)) {
         throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");
       }
-      plaintext = await decompress(plaintext, maxDecompressedLength).catch((cause) => {
+      plaintext = await decompress(plaintext, decompressionLimit).catch((cause) => {
         if (cause instanceof JWEInvalid)
           throw cause;
         throw new JWEInvalid("Failed to decompress plaintext", { cause });
@@ -37516,13 +37623,23 @@ return true;`);
     if (length !== 5) {
       throw new JWEInvalid("Invalid Compact JWE");
     }
-    return decryptJWE({
+    const flattened = {
       ciphertext,
       iv: iv || void 0,
       protected: protectedHeader,
       tag: tag2 || void 0,
       encrypted_key: encryptedKey || void 0
-    }, shared, key);
+    };
+    const parsedProt = parseJoseHeader(protectedHeader, JWEInvalid, "JWE Protected Header is invalid");
+    const protectedBytes = encode(protectedHeader);
+    const token = [
+      parsedProt,
+      decodeBase64url(ciphertext, "ciphertext", JWEInvalid),
+      iv ? decodeBase64url(iv, "iv", JWEInvalid) : void 0,
+      tag2 ? decodeBase64url(tag2, "tag", JWEInvalid) : void 0,
+      protectedBytes
+    ];
+    return decryptRecipientCore(flattened, token, shared, key, parsedProt);
   }
   var init_jwe_decrypt = __esm({
     "../node_modules/jose/dist/webapi/lib/jwe_decrypt.js"() {
@@ -37559,9 +37676,13 @@ return true;`);
     if (!isObject(jwe)) {
       throw new JWEInvalid("Flattened JWE must be an object");
     }
-    checkShared(jwe);
-    checkRecipient(jwe);
-    return decryptResult(jwe, await decryptJWE(jwe, prepareDecrypt(options), key));
+    const shared = snapshotSharedJWE(jwe);
+    const [recipient, , error] = snapshotRecipientJWE(jwe);
+    if (!recipient)
+      throw error;
+    const snapshot = { ...shared, ...recipient };
+    checkRecipient(snapshot);
+    return decryptResult(snapshot, await decryptJWE(snapshot, prepareDecrypt(options), key));
   }
   var init_decrypt2 = __esm({
     "../node_modules/jose/dist/webapi/jwe/flattened/decrypt.js"() {
@@ -37576,41 +37697,41 @@ return true;`);
     if (!isObject(jwe)) {
       throw new JWEInvalid("General JWE must be an object");
     }
-    if (!Array.isArray(jwe.recipients) || !jwe.recipients.every(isObject)) {
+    const inputRecipients = jwe.recipients;
+    if (!Array.isArray(inputRecipients)) {
       throw new JWEInvalid("JWE Recipients missing or incorrect type");
     }
-    if (!jwe.recipients.length) {
+    const recipients = Array.from(inputRecipients);
+    if (!recipients.every(isObject)) {
+      throw new JWEInvalid("JWE Recipients missing or incorrect type");
+    }
+    if (!recipients.length) {
       throw new JWEInvalid("JWE Recipients has no members");
     }
     let shared;
+    let sharedJwe;
     let token;
     try {
-      checkShared(jwe);
       shared = prepareDecrypt(options);
-      token = shareJWE(jwe);
+      sharedJwe = snapshotSharedJWE(jwe);
+      token = shareJWE(sharedJwe);
     } catch {
       throw new JWEDecryptionFailed();
     }
-    if (jwe.recipients.length > 1) {
-      for (const { header } of jwe.recipients) {
-        const alg = token[0]?.alg ?? header?.alg ?? jwe.unprotected?.alg;
+    const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
+    if (recipients.length > 1) {
+      for (const [, headerAlg] of recipientSnapshots) {
+        const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg;
         if (alg === "dir" || alg === "ECDH-ES") {
           throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
         }
       }
     }
-    for (const recipient of jwe.recipients) {
+    for (const [recipient] of recipientSnapshots) {
+      if (!recipient)
+        continue;
       try {
-        const flattened = {
-          aad: jwe.aad,
-          ciphertext: jwe.ciphertext,
-          encrypted_key: recipient.encrypted_key,
-          header: recipient.header,
-          iv: jwe.iv,
-          protected: jwe.protected,
-          tag: jwe.tag,
-          unprotected: jwe.unprotected
-        };
+        const flattened = { ...sharedJwe, ...recipient };
         checkRecipient(flattened);
         return decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
       } catch {
@@ -37627,23 +37748,46 @@ return true;`);
   });
 
   // ../node_modules/jose/dist/webapi/lib/jwe_encrypt.js
-  function checkEncryptHeaders(input) {
-    const [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, , , , , crit] = input;
+  function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
     if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) {
       throw new JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");
     }
+  }
+  function checkEncryptHeaders(input) {
+    let [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, aad, cek, iv, keyManagementParameters, crit] = input;
+    if (aad !== void 0) {
+      assertUint8Array(aad, "JWE Additional Authenticated Data");
+    }
+    if (cek !== void 0) {
+      assertUint8Array(cek, "JWE Content Encryption Key");
+    }
+    if (iv !== void 0) {
+      assertUint8Array(iv, "JWE Initialization Vector");
+    }
+    if (protectedHeader !== void 0) {
+      protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0];
+      input[1] = protectedHeader;
+    }
+    if (unprotectedHeader !== void 0) {
+      unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0];
+      input[2] = unprotectedHeader;
+    }
+    if (sharedUnprotectedHeader !== void 0) {
+      sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0];
+      input[3] = sharedUnprotectedHeader;
+    }
+    if (keyManagementParameters !== void 0 && !isObject(keyManagementParameters)) {
+      throw new TypeError("JWE Key Management Parameters must be an object");
+    }
+    checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     const joseHeader = {
       ...protectedHeader,
       ...unprotectedHeader,
       ...sharedUnprotectedHeader
     };
+    validateCritDuplicates(JWEInvalid, protectedHeader);
     validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader);
-    if (joseHeader.zip !== void 0 && joseHeader.zip !== "DEF") {
-      throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
-    }
-    if (joseHeader.zip !== void 0 && !protectedHeader?.zip) {
-      throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
-    }
+    validateZip(joseHeader, protectedHeader);
     const { alg, enc } = joseHeader;
     if (typeof alg !== "string" || !alg) {
       throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
@@ -37670,6 +37814,7 @@ return true;`);
       } else {
         protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters;
       }
+      checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     }
     let protectedHeaderS;
     let protectedHeaderB;
@@ -37721,7 +37866,14 @@ return true;`);
     }
     return jwe;
   }
-  async function createJWE(input, key) {
+  async function createJWE(input, key, options) {
+    if (!input[1] && !input[2] && !input[3]) {
+      throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");
+    }
+    if (options !== void 0) {
+      input[8] = options?.crit;
+      input[9] = options ? unprotected in options : false;
+    }
     return encryptJWE(input, checkEncryptHeaders(input), key);
   }
   var init_jwe_encrypt = __esm({
@@ -37736,93 +37888,7 @@ return true;`);
       init_key();
       init_jwe_algorithms();
       init_deflate();
-    }
-  });
-
-  // ../node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
-  var _plaintext, _protectedHeader, _sharedUnprotectedHeader, _unprotectedHeader, _aad, _cek, _iv, _keyManagementParameters, FlattenedEncrypt;
-  var init_encrypt = __esm({
-    "../node_modules/jose/dist/webapi/jwe/flattened/encrypt.js"() {
       init_helpers();
-      init_errors();
-      init_jwe_encrypt();
-      init_options();
-      FlattenedEncrypt = class {
-        constructor(plaintext) {
-          __privateAdd(this, _plaintext);
-          __privateAdd(this, _protectedHeader);
-          __privateAdd(this, _sharedUnprotectedHeader);
-          __privateAdd(this, _unprotectedHeader);
-          __privateAdd(this, _aad);
-          __privateAdd(this, _cek);
-          __privateAdd(this, _iv);
-          __privateAdd(this, _keyManagementParameters);
-          if (!(plaintext instanceof Uint8Array)) {
-            throw new TypeError("plaintext must be an instance of Uint8Array");
-          }
-          __privateSet(this, _plaintext, plaintext);
-        }
-        setKeyManagementParameters(parameters) {
-          assertNotSet(__privateGet(this, _keyManagementParameters), "setKeyManagementParameters");
-          __privateSet(this, _keyManagementParameters, parameters);
-          return this;
-        }
-        setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader), "setProtectedHeader");
-          __privateSet(this, _protectedHeader, protectedHeader);
-          return this;
-        }
-        setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-          assertNotSet(__privateGet(this, _sharedUnprotectedHeader), "setSharedUnprotectedHeader");
-          __privateSet(this, _sharedUnprotectedHeader, sharedUnprotectedHeader);
-          return this;
-        }
-        setUnprotectedHeader(unprotectedHeader) {
-          assertNotSet(__privateGet(this, _unprotectedHeader), "setUnprotectedHeader");
-          __privateSet(this, _unprotectedHeader, unprotectedHeader);
-          return this;
-        }
-        setAdditionalAuthenticatedData(aad) {
-          __privateSet(this, _aad, aad);
-          return this;
-        }
-        setContentEncryptionKey(cek) {
-          assertNotSet(__privateGet(this, _cek), "setContentEncryptionKey");
-          __privateSet(this, _cek, cek);
-          return this;
-        }
-        setInitializationVector(iv) {
-          assertNotSet(__privateGet(this, _iv), "setInitializationVector");
-          __privateSet(this, _iv, iv);
-          return this;
-        }
-        async encrypt(key, options) {
-          if (!__privateGet(this, _protectedHeader) && !__privateGet(this, _unprotectedHeader) && !__privateGet(this, _sharedUnprotectedHeader)) {
-            throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");
-          }
-          validateCritDuplicates(JWEInvalid, __privateGet(this, _protectedHeader));
-          return createJWE([
-            __privateGet(this, _plaintext),
-            __privateGet(this, _protectedHeader),
-            __privateGet(this, _unprotectedHeader),
-            __privateGet(this, _sharedUnprotectedHeader),
-            __privateGet(this, _aad),
-            __privateGet(this, _cek),
-            __privateGet(this, _iv),
-            __privateGet(this, _keyManagementParameters),
-            options?.crit,
-            options ? unprotected in options : false
-          ], key);
-        }
-      };
-      _plaintext = new WeakMap();
-      _protectedHeader = new WeakMap();
-      _sharedUnprotectedHeader = new WeakMap();
-      _unprotectedHeader = new WeakMap();
-      _aad = new WeakMap();
-      _cek = new WeakMap();
-      _iv = new WeakMap();
-      _keyManagementParameters = new WeakMap();
     }
   });
 
@@ -37838,19 +37904,18 @@ return true;`);
     if (header)
       recipient.header = header;
   }
-  var _parent, IndividualRecipient, _plaintext2, _recipients, _protectedHeader2, _unprotectedHeader2, _aad2, GeneralEncrypt;
-  var init_encrypt2 = __esm({
+  var _parent, IndividualRecipient, _plaintext, _recipients, _protectedHeader, _unprotectedHeader, _aad, GeneralEncrypt;
+  var init_encrypt = __esm({
     "../node_modules/jose/dist/webapi/jwe/general/encrypt.js"() {
-      init_encrypt();
       init_helpers();
       init_errors();
       init_content_encryption();
       init_key_management();
       init_base64url();
-      init_options();
       init_jwe_encrypt();
       init_key();
       init_jwe_algorithms();
+      init_type_checks();
       IndividualRecipient = class {
         constructor(enc, key, crit) {
           __privateAdd(this, _parent);
@@ -37881,12 +37946,12 @@ return true;`);
       _parent = new WeakMap();
       GeneralEncrypt = class {
         constructor(plaintext) {
-          __privateAdd(this, _plaintext2);
+          __privateAdd(this, _plaintext);
           __privateAdd(this, _recipients, []);
-          __privateAdd(this, _protectedHeader2);
-          __privateAdd(this, _unprotectedHeader2);
-          __privateAdd(this, _aad2);
-          __privateSet(this, _plaintext2, plaintext);
+          __privateAdd(this, _protectedHeader);
+          __privateAdd(this, _unprotectedHeader);
+          __privateAdd(this, _aad);
+          __privateSet(this, _plaintext, plaintext);
         }
         addRecipient(key, options) {
           const recipient = new IndividualRecipient(this, key, options?.crit);
@@ -37894,30 +37959,38 @@ return true;`);
           return recipient;
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader2), "setProtectedHeader");
-          __privateSet(this, _protectedHeader2, protectedHeader);
+          assertNotSet(__privateGet(this, _protectedHeader), "setProtectedHeader");
+          __privateSet(this, _protectedHeader, protectedHeader);
           return this;
         }
         setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-          assertNotSet(__privateGet(this, _unprotectedHeader2), "setSharedUnprotectedHeader");
-          __privateSet(this, _unprotectedHeader2, sharedUnprotectedHeader);
+          assertNotSet(__privateGet(this, _unprotectedHeader), "setSharedUnprotectedHeader");
+          __privateSet(this, _unprotectedHeader, sharedUnprotectedHeader);
           return this;
         }
         setAdditionalAuthenticatedData(aad) {
-          __privateSet(this, _aad2, aad);
+          __privateSet(this, _aad, aad);
           return this;
         }
         async encrypt() {
           if (!__privateGet(this, _recipients).length) {
             throw new JWEInvalid("at least one recipient must be added");
           }
-          if (!(__privateGet(this, _plaintext2) instanceof Uint8Array)) {
-            throw new TypeError("plaintext must be an instance of Uint8Array");
-          }
+          assertUint8Array(__privateGet(this, _plaintext), "plaintext");
           if (__privateGet(this, _recipients).length === 1) {
-            const [recipient] = __privateGet(this, _recipients);
-            const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state;
-            const flattened = await new FlattenedEncrypt(__privateGet(this, _plaintext2)).setAdditionalAuthenticatedData(__privateGet(this, _aad2)).setProtectedHeader(__privateGet(this, _protectedHeader2)).setSharedUnprotectedHeader(__privateGet(this, _unprotectedHeader2)).setUnprotectedHeader(unprotectedHeader).setKeyManagementParameters(keyManagementParameters).encrypt(key, { crit });
+            const [unprotectedHeader, keyManagementParameters, key, crit] = __privateGet(this, _recipients)[0].state;
+            const flattened = await createJWE([
+              __privateGet(this, _plaintext),
+              __privateGet(this, _protectedHeader),
+              unprotectedHeader,
+              __privateGet(this, _unprotectedHeader),
+              __privateGet(this, _aad),
+              void 0,
+              void 0,
+              keyManagementParameters,
+              crit,
+              false
+            ], key);
             const jwe2 = {
               ciphertext: flattened.ciphertext,
               iv: flattened.iv,
@@ -37929,19 +38002,20 @@ return true;`);
             copyOptionalMembers(flattened, jwe2, jwe2.recipients[0]);
             return jwe2;
           }
-          validateCritDuplicates(JWEInvalid, __privateGet(this, _protectedHeader2));
           let enc;
+          let protectedHeader = __privateGet(this, _protectedHeader);
+          let sharedUnprotectedHeader = __privateGet(this, _unprotectedHeader);
           const inputs = [];
           const checked = [];
           for (let i = 0; i < __privateGet(this, _recipients).length; i++) {
             const recipient = __privateGet(this, _recipients)[i];
             const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
             const input = [
-              __privateGet(this, _plaintext2),
-              __privateGet(this, _protectedHeader2),
+              __privateGet(this, _plaintext),
+              protectedHeader,
               unprotectedHeader,
-              __privateGet(this, _unprotectedHeader2),
-              __privateGet(this, _aad2),
+              sharedUnprotectedHeader,
+              __privateGet(this, _aad),
               void 0,
               void 0,
               keyManagementParameters,
@@ -37951,6 +38025,10 @@ return true;`);
             const headers = checkEncryptHeaders(input);
             inputs.push(input);
             checked.push(headers);
+            if (i === 0) {
+              protectedHeader = input[1];
+              sharedUnprotectedHeader = input[3];
+            }
             if (headers[1] === "dir" || headers[1] === "ECDH-ES") {
               throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
             }
@@ -37967,7 +38045,7 @@ return true;`);
           };
           for (let i = 0; i < __privateGet(this, _recipients).length; i++) {
             const recipient = __privateGet(this, _recipients)[i];
-            const [unprotectedHeader, keyManagementParameters, key] = recipient.state;
+            const [, keyManagementParameters, key] = recipient.state;
             const target = {};
             jwe.recipients.push(target);
             if (i === 0) {
@@ -37981,20 +38059,25 @@ return true;`);
               continue;
             }
             const [, alg, , encEntry] = checked[i];
+            const unprotectedHeader = inputs[i][2];
             const k = await prepareKey(jweAlgorithm(alg), key, "encrypt");
             const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
             target.encrypted_key = encode2(encryptedKey);
-            if (unprotectedHeader || parameters)
-              target.header = { ...unprotectedHeader, ...parameters };
+            if (unprotectedHeader || parameters) {
+              const header = { ...unprotectedHeader, ...parameters };
+              if (parameters)
+                checkDisjoint(inputs[i][1], header, inputs[i][3]);
+              target.header = header;
+            }
           }
           return jwe;
         }
       };
-      _plaintext2 = new WeakMap();
+      _plaintext = new WeakMap();
       _recipients = new WeakMap();
-      _protectedHeader2 = new WeakMap();
-      _unprotectedHeader2 = new WeakMap();
-      _aad2 = new WeakMap();
+      _protectedHeader = new WeakMap();
+      _unprotectedHeader = new WeakMap();
+      _aad = new WeakMap();
     }
   });
 
@@ -38110,6 +38193,22 @@ return true;`);
   });
 
   // ../node_modules/jose/dist/webapi/lib/jws_verify.js
+  function snapshotJws(jws, sharedPayload) {
+    const encodedProtected = jws.protected;
+    const inputHeader = jws.header;
+    const header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
+    let payload = sharedPayload ? sharedPayload[0] : jws.payload;
+    if (!sharedPayload && payload instanceof Uint8Array) {
+      payload = new Uint8Array(payload);
+    }
+    const signature = jws.signature;
+    const snapshot = { payload, signature };
+    if (encodedProtected !== void 0)
+      snapshot.protected = encodedProtected;
+    if (inputHeader !== void 0)
+      snapshot.header = header;
+    return snapshot;
+  }
   function verifyResult(jws, verified) {
     const [payload, parsedProt, , key, resolvedKey] = verified;
     const result = { payload };
@@ -38127,12 +38226,22 @@ return true;`);
   function prepareVerify(options) {
     return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
   }
-  async function verifySignature(jws, shared, key) {
-    const { protected: encodedProtected, header, payload: inputPayload } = jws;
-    let parsedProt = {};
-    if (encodedProtected) {
-      parsedProt = parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
+  function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid")) {
+    return parsedProtected;
+  }
+  function validateJwsHeaders(parsedProt, joseHeader, shared) {
+    const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
+    const alg = joseHeader.alg;
+    if (typeof alg !== "string" || !alg) {
+      throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    if (shared[0] && !shared[0].has(alg)) {
+      throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
     }
+    return [b64, alg];
+  }
+  function parseJwsHeaders(encodedProtected, header, shared, parsedProtected) {
+    const parsedProt = parseProtectedHeader(encodedProtected, parsedProtected);
     let joseHeader;
     if (header !== void 0) {
       if (!isDisjoint(parsedProt, header)) {
@@ -38142,50 +38251,51 @@ return true;`);
     } else {
       joseHeader = parsedProt;
     }
-    const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader);
-    let b64 = true;
-    if (extensions.includes("b64")) {
-      b64 = parsedProt.b64;
-      if (typeof b64 !== "boolean") {
-        throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-      }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== "string" || !alg) {
-      throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    if (shared[0] && !shared[0].has(alg)) {
-      throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+    return [parsedProt, joseHeader, ...validateJwsHeaders(parsedProt, joseHeader, shared)];
+  }
+  function encodeJsonUnencodedPayload(payload) {
+    const invalid2 = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
+    if (invalid2 !== void 0) {
+      throw new JWSInvalid(/\p{Cs}/u.test(invalid2) ? "JWS Payload must be a well-formed Unicode string" : "JWS Payload must not contain unassigned Unicode code points");
     }
-    if (b64) {
-      if (typeof inputPayload !== "string") {
-        throw new JWSInvalid("JWS Payload must be a string");
-      }
-    } else if (typeof inputPayload !== "string" && !(inputPayload instanceof Uint8Array)) {
-      throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+    return encoder.encode(payload);
+  }
+  function encodeCompactUnencodedPayload(payload) {
+    try {
+      return encode(payload);
+    } catch {
+      throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
     }
+  }
+  async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
     let resolvedKey = false;
     if (typeof key === "function") {
       key = await key(parsedProt, jws);
       resolvedKey = true;
     }
+    const b64 = typeof signingPayload === "string";
     const entry = jwsAlgorithm(alg);
-    const data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof inputPayload === "string" ? b64 ? shared[2] ?? (shared[2] = encodeBase64url(inputPayload, "payload", JWSInvalid)) : encoder.encode(inputPayload) : inputPayload);
+    const data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), b64 ? shared[2] ?? (shared[2] = encodeBase64url(signingPayload, "payload", JWSInvalid)) : signingPayload);
     const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
     const k = await prepareKey(entry, key, "verify");
-    const verified = await verify(entry, k, signature, data);
-    if (!verified) {
+    if (!await verify(entry, k, signature, data)) {
       throw new JWSSignatureVerificationFailed();
     }
-    let payload;
+    const payload = b64 ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload;
+    return [payload, parsedProt, b64, k, resolvedKey];
+  }
+  async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+    const { protected: encodedProtected, header, payload: inputPayload } = jws;
+    const [parsedProt, , b64, alg] = parseJwsHeaders(encodedProtected, header, shared, parsedProtected);
     if (b64) {
-      payload = decodeBase64url(inputPayload, "payload", JWSInvalid);
-    } else if (typeof inputPayload === "string") {
-      payload = encoder.encode(inputPayload);
-    } else {
-      payload = inputPayload;
+      if (typeof inputPayload !== "string") {
+        throw new JWSInvalid("JWS Payload must be a string");
+      }
+    } else if (typeof inputPayload !== "string" && !(inputPayload instanceof Uint8Array)) {
+      throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
     }
-    return [payload, parsedProt, b64, k, resolvedKey];
+    const signingPayload = b64 || typeof inputPayload !== "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+    return verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload);
   }
   async function verifyCompact(jws, shared, key) {
     if (jws instanceof Uint8Array) {
@@ -38198,7 +38308,11 @@ return true;`);
     if (length !== 3) {
       throw new JWSInvalid("Invalid Compact JWS");
     }
-    return verifySignature({ payload, protected: protectedHeader, signature }, shared, key);
+    const compactJws = { payload, protected: protectedHeader, signature };
+    const parsedProt = parseProtectedHeader(protectedHeader);
+    const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
+    const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
+    return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
   }
   var init_jws_verify = __esm({
     "../node_modules/jose/dist/webapi/lib/jws_verify.js"() {
@@ -38233,22 +38347,23 @@ return true;`);
     if (!isObject(jws)) {
       throw new JWSInvalid("Flattened JWS must be an object");
     }
-    if (jws.protected === void 0 && jws.header === void 0) {
+    const snapshot = snapshotJws(jws);
+    if (snapshot.protected === void 0 && snapshot.header === void 0) {
       throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
     }
-    if (jws.protected !== void 0 && typeof jws.protected !== "string") {
+    if (snapshot.protected !== void 0 && typeof snapshot.protected !== "string") {
       throw new JWSInvalid("JWS Protected Header incorrect type");
     }
-    if (jws.payload === void 0) {
+    if (snapshot.payload === void 0) {
       throw new JWSInvalid("JWS Payload missing");
     }
-    if (typeof jws.signature !== "string") {
+    if (typeof snapshot.signature !== "string") {
       throw new JWSInvalid("JWS Signature missing or incorrect type");
     }
-    if (jws.header !== void 0 && !isObject(jws.header)) {
+    if (snapshot.header !== void 0 && !isObject(snapshot.header)) {
       throw new JWSInvalid("JWS Unprotected Header incorrect type");
     }
-    return verifyResult(jws, await verifySignature(jws, prepareVerify(options), key));
+    return verifyResult(snapshot, await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload));
   }
   var init_verify2 = __esm({
     "../node_modules/jose/dist/webapi/jws/flattened/verify.js"() {
@@ -38259,40 +38374,61 @@ return true;`);
   });
 
   // ../node_modules/jose/dist/webapi/jws/general/verify.js
+  function snapshotSignature(signature, payload) {
+    try {
+      const jws = snapshotJws(signature, [payload]);
+      const { protected: encodedProtected, header, signature: encodedSignature } = jws;
+      if (encodedProtected === void 0 && header === void 0)
+        return void 0;
+      if (encodedProtected !== void 0 && typeof encodedProtected !== "string")
+        return void 0;
+      if (typeof encodedSignature !== "string")
+        return void 0;
+      if (header !== void 0 && !isObject(header))
+        return void 0;
+      const protectedHeader = parseProtectedHeader(encodedProtected);
+      const { b64, crit } = protectedHeader;
+      return [
+        jws,
+        protectedHeader,
+        Array.isArray(crit) && crit.includes("b64") ? typeof b64 === "boolean" ? b64 ? 1 : 2 : 0 : 1
+      ];
+    } catch {
+      return void 0;
+    }
+  }
   async function generalVerify(jws, key, options) {
     if (!isObject(jws)) {
       throw new JWSInvalid("General JWS must be an object");
     }
-    const { signatures, payload } = jws;
-    if (!Array.isArray(signatures) || !signatures.every(isObject)) {
+    const { signatures, payload: inputPayload } = jws;
+    if (!Array.isArray(signatures)) {
+      throw new JWSInvalid("JWS Signatures missing or incorrect type");
+    }
+    const signatureEntries = Array.from(signatures);
+    if (!signatureEntries.every(isObject)) {
       throw new JWSInvalid("JWS Signatures missing or incorrect type");
     }
     let shared;
     try {
-      if (payload === void 0)
+      if (inputPayload === void 0)
         throw new Error();
       shared = prepareVerify(options);
     } catch {
       throw new JWSSignatureVerificationFailed();
     }
-    for (const signature of signatures) {
+    const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload;
+    const candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
+    let modes = 0;
+    for (const [, , mode] of candidates) {
+      modes |= mode;
+      if (modes === 3) {
+        throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
+      }
+    }
+    for (const candidate of candidates) {
       try {
-        const { protected: encodedProtected, header, signature: encodedSignature } = signature;
-        if (encodedProtected === void 0 && header === void 0)
-          throw new Error();
-        if (encodedProtected !== void 0 && typeof encodedProtected !== "string") {
-          throw new Error();
-        }
-        if (typeof encodedSignature !== "string")
-          throw new Error();
-        if (header !== void 0 && !isObject(header))
-          throw new Error();
-        return verifyResult(signature, await verifySignature({
-          header,
-          payload,
-          protected: encodedProtected,
-          signature: encodedSignature
-        }, shared, key));
+        return verifyResult(candidate[0], await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]));
       } catch {
       }
     }
@@ -38307,13 +38443,22 @@ return true;`);
   });
 
   // ../node_modules/jose/dist/webapi/lib/jwt_claims_set.js
+  function invalidDuration() {
+    throw new TypeError("Invalid time period format");
+  }
   function secs(str) {
+    if (typeof str !== "string") {
+      invalidDuration();
+    }
     const matched = REGEX.exec(str);
     if (!matched || matched[4] && matched[1]) {
-      throw new TypeError("Invalid time period format");
+      invalidDuration();
     }
     const value = parseFloat(matched[2]);
     const numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+    if (!Number.isFinite(numericDate2)) {
+      invalidDuration();
+    }
     if (matched[1] === "-" || matched[4] === "ago") {
       return -numericDate2;
     }
@@ -38325,6 +38470,16 @@ return true;`);
     }
     return input;
   }
+  function validateStringClaim(claim, value) {
+    if (typeof value !== "string") {
+      throw new TypeError(`"${claim}" claim must be a string`);
+    }
+  }
+  function validateAudienceClaim(value) {
+    if (typeof value !== "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member !== "string"))) {
+      throw new TypeError('"aud" claim must be a string or an array of strings');
+    }
+  }
   function numericDate(value, label) {
     if (typeof value === "number")
       return validateInput(label, value);
@@ -38354,7 +38509,7 @@ return true;`);
       throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
     }
     const { typ } = options;
-    if (typ && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+    if (typ !== void 0 && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
       throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
     }
     const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
@@ -38393,7 +38548,7 @@ return true;`);
     }
     validateInput("clockTolerance option", tolerance);
     const { currentDate } = options;
-    const now = validateInput("currentDate option", epoch(currentDate || /* @__PURE__ */ new Date()));
+    const now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate));
     const iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0);
     const nbf = validateNumericDate(payload, "nbf");
     if (nbf !== void 0) {
@@ -38409,17 +38564,33 @@ return true;`);
     }
     if (maxTokenAge !== void 0) {
       const age = now - iat;
-      const max = typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge);
+      const max = validateInput("maxTokenAge option", typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge));
       if (age - tolerance > max) {
         throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
       }
-      if (age < 0 - tolerance) {
+      if (age < -tolerance) {
         throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
       }
     }
     return payload;
   }
-  var epoch, multipliers, REGEX, checkFailed, normalizeTyp, checkAudiencePresence, _payload, JWTClaimsBuilder;
+  function producerPayload(producer) {
+    return producerPayloads.get(producer);
+  }
+  function jwtData(producer) {
+    const payload = producerPayload(producer);
+    for (const claim of ["iat", "nbf", "exp"]) {
+      const value = payload[claim];
+      if (typeof value === "number" && !Number.isFinite(value)) {
+        throw new TypeError(`"${claim}" claim must be a finite number`);
+      }
+    }
+    return encoder.encode(JSON.stringify(payload));
+  }
+  function jwtClaim(producer, claim) {
+    return producerPayload(producer)[claim];
+  }
+  var epoch, multipliers, REGEX, checkFailed, normalizeTyp, checkAudiencePresence, producerPayloads, JWTClaimsBuilder;
   var init_jwt_claims_set = __esm({
     "../node_modules/jose/dist/webapi/lib/jwt_claims_set.js"() {
       init_errors();
@@ -38437,10 +38608,8 @@ return true;`);
       REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
       checkFailed = "check_failed";
       normalizeTyp = (value) => {
-        if (value.includes("/")) {
-          return value.toLowerCase();
-        }
-        return `application/${value.toLowerCase()}`;
+        const normalized = value.toLowerCase();
+        return value.includes("/") ? normalized : `application/${normalized}`;
       };
       checkAudiencePresence = (audPayload, audOption) => {
         if (typeof audPayload === "string") {
@@ -38452,54 +38621,53 @@ return true;`);
         return false;
       };
       JWTClaimsBuilder = class {
-        constructor(payload) {
-          __privateAdd(this, _payload);
+        constructor(payload = {}) {
           if (!isObject(payload)) {
             throw new TypeError("JWT Claims Set MUST be an object");
           }
-          __privateSet(this, _payload, structuredClone(payload));
-        }
-        data() {
-          return encoder.encode(JSON.stringify(__privateGet(this, _payload)));
-        }
-        get iss() {
-          return __privateGet(this, _payload).iss;
-        }
-        set iss(value) {
-          __privateGet(this, _payload).iss = value;
-        }
-        get sub() {
-          return __privateGet(this, _payload).sub;
+          ;
+          (producerPayloads || (producerPayloads = /* @__PURE__ */ new WeakMap())).set(this, structuredClone(payload));
         }
-        set sub(value) {
-          __privateGet(this, _payload).sub = value;
+        setIssuer(value) {
+          validateStringClaim("iss", value);
+          producerPayload(this).iss = value;
+          return this;
         }
-        get aud() {
-          return __privateGet(this, _payload).aud;
+        setSubject(value) {
+          validateStringClaim("sub", value);
+          producerPayload(this).sub = value;
+          return this;
         }
-        set aud(value) {
-          __privateGet(this, _payload).aud = value;
+        setAudience(value) {
+          validateAudienceClaim(value);
+          producerPayload(this).aud = value;
+          return this;
         }
-        set jti(value) {
-          __privateGet(this, _payload).jti = value;
+        setJti(value) {
+          validateStringClaim("jti", value);
+          producerPayload(this).jti = value;
+          return this;
         }
-        set nbf(value) {
-          __privateGet(this, _payload).nbf = numericDate(value, "setNotBefore");
+        setNotBefore(value) {
+          producerPayload(this).nbf = numericDate(value, "setNotBefore");
+          return this;
         }
-        set exp(value) {
-          __privateGet(this, _payload).exp = numericDate(value, "setExpirationTime");
+        setExpirationTime(value) {
+          producerPayload(this).exp = numericDate(value, "setExpirationTime");
+          return this;
         }
-        set iat(value) {
+        setIssuedAt(value) {
+          const payload = producerPayload(this);
           if (value === void 0) {
-            __privateGet(this, _payload).iat = epoch(/* @__PURE__ */ new Date());
+            payload.iat = epoch(/* @__PURE__ */ new Date());
           } else if (typeof value === "string") {
-            __privateGet(this, _payload).iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value));
+            payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value));
           } else {
-            __privateGet(this, _payload).iat = numericDate(value, "setIssuedAt");
+            payload.iat = numericDate(value, "setIssuedAt");
           }
+          return this;
         }
       };
-      _payload = new WeakMap();
     }
   });
 
@@ -38529,14 +38697,10 @@ return true;`);
     const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key);
     const protectedHeader = decrypted[1];
     const payload = validateClaimsSet(protectedHeader, decrypted[0], options);
-    if (protectedHeader.iss !== void 0 && protectedHeader.iss !== payload.iss) {
-      throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, "iss", "mismatch");
-    }
-    if (protectedHeader.sub !== void 0 && protectedHeader.sub !== payload.sub) {
-      throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, "sub", "mismatch");
-    }
-    if (protectedHeader.aud !== void 0 && JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-      throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, "aud", "mismatch");
+    for (const claim of ["iss", "sub", "aud"]) {
+      if (protectedHeader[claim] !== void 0 && (claim === "aud" ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud) : protectedHeader[claim] !== payload[claim])) {
+        throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, "mismatch");
+      }
     }
     const result = { payload, protectedHeader };
     if (typeof key === "function") {
@@ -38553,46 +38717,176 @@ return true;`);
   });
 
   // ../node_modules/jose/dist/webapi/jwe/compact/encrypt.js
-  var _flattened, CompactEncrypt;
-  var init_encrypt3 = __esm({
+  var _plaintext2, _protectedHeader2, _cek, _iv, _keyManagementParameters, CompactEncrypt;
+  var init_encrypt2 = __esm({
     "../node_modules/jose/dist/webapi/jwe/compact/encrypt.js"() {
-      init_encrypt();
+      init_helpers();
+      init_type_checks();
+      init_jwe_encrypt();
       CompactEncrypt = class {
         constructor(plaintext) {
-          __privateAdd(this, _flattened);
-          __privateSet(this, _flattened, new FlattenedEncrypt(plaintext));
+          __privateAdd(this, _plaintext2);
+          __privateAdd(this, _protectedHeader2);
+          __privateAdd(this, _cek);
+          __privateAdd(this, _iv);
+          __privateAdd(this, _keyManagementParameters);
+          assertUint8Array(plaintext, "plaintext");
+          __privateSet(this, _plaintext2, plaintext);
         }
         setContentEncryptionKey(cek) {
-          __privateGet(this, _flattened).setContentEncryptionKey(cek);
+          assertNotSet(__privateGet(this, _cek), "setContentEncryptionKey");
+          __privateSet(this, _cek, cek);
           return this;
         }
         setInitializationVector(iv) {
-          __privateGet(this, _flattened).setInitializationVector(iv);
+          assertNotSet(__privateGet(this, _iv), "setInitializationVector");
+          __privateSet(this, _iv, iv);
           return this;
         }
         setProtectedHeader(protectedHeader) {
-          __privateGet(this, _flattened).setProtectedHeader(protectedHeader);
+          assertNotSet(__privateGet(this, _protectedHeader2), "setProtectedHeader");
+          __privateSet(this, _protectedHeader2, protectedHeader);
           return this;
         }
         setKeyManagementParameters(parameters) {
-          __privateGet(this, _flattened).setKeyManagementParameters(parameters);
+          assertNotSet(__privateGet(this, _keyManagementParameters), "setKeyManagementParameters");
+          __privateSet(this, _keyManagementParameters, parameters);
           return this;
         }
         async encrypt(key, options) {
-          const jwe = await __privateGet(this, _flattened).encrypt(key, options);
+          const jwe = await createJWE([
+            __privateGet(this, _plaintext2),
+            __privateGet(this, _protectedHeader2),
+            void 0,
+            void 0,
+            void 0,
+            __privateGet(this, _cek),
+            __privateGet(this, _iv),
+            __privateGet(this, _keyManagementParameters),
+            void 0,
+            false
+          ], key, options);
           return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
         }
       };
-      _flattened = new WeakMap();
+      _plaintext2 = new WeakMap();
+      _protectedHeader2 = new WeakMap();
+      _cek = new WeakMap();
+      _iv = new WeakMap();
+      _keyManagementParameters = new WeakMap();
+    }
+  });
+
+  // ../node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
+  var _plaintext3, _protectedHeader3, _sharedUnprotectedHeader, _unprotectedHeader2, _aad2, _cek2, _iv2, _keyManagementParameters2, FlattenedEncrypt;
+  var init_encrypt3 = __esm({
+    "../node_modules/jose/dist/webapi/jwe/flattened/encrypt.js"() {
+      init_helpers();
+      init_jwe_encrypt();
+      init_type_checks();
+      FlattenedEncrypt = class {
+        constructor(plaintext) {
+          __privateAdd(this, _plaintext3);
+          __privateAdd(this, _protectedHeader3);
+          __privateAdd(this, _sharedUnprotectedHeader);
+          __privateAdd(this, _unprotectedHeader2);
+          __privateAdd(this, _aad2);
+          __privateAdd(this, _cek2);
+          __privateAdd(this, _iv2);
+          __privateAdd(this, _keyManagementParameters2);
+          assertUint8Array(plaintext, "plaintext");
+          __privateSet(this, _plaintext3, plaintext);
+        }
+        setKeyManagementParameters(parameters) {
+          assertNotSet(__privateGet(this, _keyManagementParameters2), "setKeyManagementParameters");
+          __privateSet(this, _keyManagementParameters2, parameters);
+          return this;
+        }
+        setProtectedHeader(protectedHeader) {
+          assertNotSet(__privateGet(this, _protectedHeader3), "setProtectedHeader");
+          __privateSet(this, _protectedHeader3, protectedHeader);
+          return this;
+        }
+        setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+          assertNotSet(__privateGet(this, _sharedUnprotectedHeader), "setSharedUnprotectedHeader");
+          __privateSet(this, _sharedUnprotectedHeader, sharedUnprotectedHeader);
+          return this;
+        }
+        setUnprotectedHeader(unprotectedHeader) {
+          assertNotSet(__privateGet(this, _unprotectedHeader2), "setUnprotectedHeader");
+          __privateSet(this, _unprotectedHeader2, unprotectedHeader);
+          return this;
+        }
+        setAdditionalAuthenticatedData(aad) {
+          __privateSet(this, _aad2, aad);
+          return this;
+        }
+        setContentEncryptionKey(cek) {
+          assertNotSet(__privateGet(this, _cek2), "setContentEncryptionKey");
+          __privateSet(this, _cek2, cek);
+          return this;
+        }
+        setInitializationVector(iv) {
+          assertNotSet(__privateGet(this, _iv2), "setInitializationVector");
+          __privateSet(this, _iv2, iv);
+          return this;
+        }
+        async encrypt(key, options) {
+          return createJWE([
+            __privateGet(this, _plaintext3),
+            __privateGet(this, _protectedHeader3),
+            __privateGet(this, _unprotectedHeader2),
+            __privateGet(this, _sharedUnprotectedHeader),
+            __privateGet(this, _aad2),
+            __privateGet(this, _cek2),
+            __privateGet(this, _iv2),
+            __privateGet(this, _keyManagementParameters2),
+            void 0,
+            false
+          ], key, options);
+        }
+      };
+      _plaintext3 = new WeakMap();
+      _protectedHeader3 = new WeakMap();
+      _sharedUnprotectedHeader = new WeakMap();
+      _unprotectedHeader2 = new WeakMap();
+      _aad2 = new WeakMap();
+      _cek2 = new WeakMap();
+      _iv2 = new WeakMap();
+      _keyManagementParameters2 = new WeakMap();
     }
   });
 
   // ../node_modules/jose/dist/webapi/lib/jws_sign.js
-  function unencodedPayload(protectedHeader) {
-    return protectedHeader?.b64 === false && Array.isArray(protectedHeader.crit) && protectedHeader.crit.includes("b64");
+  function serializeProtectedHeader(protectedHeader) {
+    if (protectedHeader === void 0)
+      return [void 0, ""];
+    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+    return [normalized[0], encode2(normalized[1])];
+  }
+  function validateSignatureHeader(protectedHeader, joseHeader, crit) {
+    validateCritDuplicates(JWSInvalid, protectedHeader);
+    return validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+  }
+  function signatureAlgorithm(joseHeader) {
+    const alg = joseHeader.alg;
+    if (typeof alg !== "string" || !alg) {
+      throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    return jwsAlgorithm(alg);
+  }
+  async function signSignature(protectedHeader, payload, entry, key) {
+    const data = concat(encode(protectedHeader), encode("."), payload);
+    const k = await prepareKey(entry, key, "sign");
+    return encode2(await sign(entry, k, data));
   }
-  async function createSignature(input, key) {
-    const { protectedHeader, unprotectedHeader } = input;
+  async function createSignature(input, key, assertB64) {
+    let { protectedHeader, unprotectedHeader } = input;
+    let protectedHeaderString;
+    [protectedHeader, protectedHeaderString] = serializeProtectedHeader(protectedHeader);
+    if (unprotectedHeader !== void 0) {
+      unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0];
+    }
     if (!protectedHeader && !unprotectedHeader) {
       throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
     }
@@ -38600,20 +38894,9 @@ return true;`);
       throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
     }
     const joseHeader = { ...protectedHeader, ...unprotectedHeader };
-    validateCritDuplicates(JWSInvalid, protectedHeader);
-    const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, input.crit, protectedHeader, joseHeader);
-    let b64 = true;
-    if (extensions.includes("b64")) {
-      b64 = protectedHeader.b64;
-      if (typeof b64 !== "boolean") {
-        throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-      }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== "string" || !alg) {
-      throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    const entry = jwsAlgorithm(alg);
+    const b64 = validateSignatureHeader(protectedHeader, joseHeader, input.crit);
+    assertB64?.(b64);
+    const entry = signatureAlgorithm(joseHeader);
     let payloadS;
     let payloadB;
     if (b64) {
@@ -38626,20 +38909,8 @@ return true;`);
       payloadB = input.payload;
       payloadS = "";
     }
-    let protectedHeaderString;
-    let protectedHeaderBytes;
-    if (protectedHeader) {
-      protectedHeaderString = encode2(JSON.stringify(protectedHeader));
-      protectedHeaderBytes = encode(protectedHeaderString);
-    } else {
-      protectedHeaderString = "";
-      protectedHeaderBytes = new Uint8Array();
-    }
-    const data = concat(protectedHeaderBytes, encode("."), payloadB);
-    const k = await prepareKey(entry, key, "sign");
-    const signature = await sign(entry, k, data);
     const jws = {
-      signature: encode2(signature),
+      signature: await signSignature(protectedHeaderString, payloadB, entry, key),
       payload: payloadS
     };
     if (protectedHeader) {
@@ -38648,7 +38919,20 @@ return true;`);
     if (unprotectedHeader) {
       jws.header = unprotectedHeader;
     }
-    return jws;
+    return [jws, b64];
+  }
+  async function createCompactSignature(payload, inputProtectedHeader, inputCrit, key, rejectUnencoded) {
+    const [protectedHeader, protectedHeaderString] = serializeProtectedHeader(inputProtectedHeader);
+    if (!protectedHeader) {
+      throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+    }
+    const b64 = validateSignatureHeader(protectedHeader, protectedHeader, inputCrit);
+    if (!b64)
+      rejectUnencoded();
+    const entry = signatureAlgorithm(protectedHeader);
+    const encodedPayload = encode2(payload);
+    const signature = await signSignature(protectedHeaderString, encode(encodedPayload), entry, key);
+    return `${protectedHeaderString}.${encodedPayload}.${signature}`;
   }
   var init_jws_sign = __esm({
     "../node_modules/jose/dist/webapi/lib/jws_sign.js"() {
@@ -38663,16 +38947,47 @@ return true;`);
     }
   });
 
-  // ../node_modules/jose/dist/webapi/jws/flattened/sign.js
-  var _payload2, _protectedHeader3, _unprotectedHeader3, FlattenedSign;
+  // ../node_modules/jose/dist/webapi/jws/compact/sign.js
+  var _payload, _protectedHeader4, CompactSign;
   var init_sign = __esm({
+    "../node_modules/jose/dist/webapi/jws/compact/sign.js"() {
+      init_jws_sign();
+      init_helpers();
+      CompactSign = class {
+        constructor(payload) {
+          __privateAdd(this, _payload);
+          __privateAdd(this, _protectedHeader4);
+          if (!(payload instanceof Uint8Array)) {
+            throw new TypeError("payload must be an instance of Uint8Array");
+          }
+          __privateSet(this, _payload, payload);
+        }
+        setProtectedHeader(protectedHeader) {
+          assertNotSet(__privateGet(this, _protectedHeader4), "setProtectedHeader");
+          __privateSet(this, _protectedHeader4, protectedHeader);
+          return this;
+        }
+        async sign(key, options) {
+          return createCompactSignature(__privateGet(this, _payload), __privateGet(this, _protectedHeader4), options?.crit, key, () => {
+            throw new TypeError("use the flattened module for creating JWS with b64: false");
+          });
+        }
+      };
+      _payload = new WeakMap();
+      _protectedHeader4 = new WeakMap();
+    }
+  });
+
+  // ../node_modules/jose/dist/webapi/jws/flattened/sign.js
+  var _payload2, _protectedHeader5, _unprotectedHeader3, FlattenedSign;
+  var init_sign2 = __esm({
     "../node_modules/jose/dist/webapi/jws/flattened/sign.js"() {
       init_jws_sign();
       init_helpers();
       FlattenedSign = class {
         constructor(payload) {
           __privateAdd(this, _payload2);
-          __privateAdd(this, _protectedHeader3);
+          __privateAdd(this, _protectedHeader5);
           __privateAdd(this, _unprotectedHeader3);
           if (!(payload instanceof Uint8Array)) {
             throw new TypeError("payload must be an instance of Uint8Array");
@@ -38680,8 +38995,8 @@ return true;`);
           __privateSet(this, _payload2, payload);
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader3), "setProtectedHeader");
-          __privateSet(this, _protectedHeader3, protectedHeader);
+          assertNotSet(__privateGet(this, _protectedHeader5), "setProtectedHeader");
+          __privateSet(this, _protectedHeader5, protectedHeader);
           return this;
         }
         setUnprotectedHeader(unprotectedHeader) {
@@ -38690,50 +39005,21 @@ return true;`);
           return this;
         }
         async sign(key, options) {
-          return createSignature({
+          const [jws] = await createSignature({
             payload: __privateGet(this, _payload2),
-            protectedHeader: __privateGet(this, _protectedHeader3),
+            protectedHeader: __privateGet(this, _protectedHeader5),
             unprotectedHeader: __privateGet(this, _unprotectedHeader3),
             crit: options?.crit
           }, key);
+          return jws;
         }
       };
       _payload2 = new WeakMap();
-      _protectedHeader3 = new WeakMap();
+      _protectedHeader5 = new WeakMap();
       _unprotectedHeader3 = new WeakMap();
     }
   });
 
-  // ../node_modules/jose/dist/webapi/jws/compact/sign.js
-  var _flattened2, _protectedHeader4, CompactSign;
-  var init_sign2 = __esm({
-    "../node_modules/jose/dist/webapi/jws/compact/sign.js"() {
-      init_sign();
-      init_jws_sign();
-      CompactSign = class {
-        constructor(payload) {
-          __privateAdd(this, _flattened2);
-          __privateAdd(this, _protectedHeader4);
-          __privateSet(this, _flattened2, new FlattenedSign(payload));
-        }
-        setProtectedHeader(protectedHeader) {
-          __privateGet(this, _flattened2).setProtectedHeader(protectedHeader);
-          __privateSet(this, _protectedHeader4, protectedHeader);
-          return this;
-        }
-        async sign(key, options) {
-          if (unencodedPayload(__privateGet(this, _protectedHeader4))) {
-            throw new TypeError("use the flattened module for creating JWS with b64: false");
-          }
-          const jws = await __privateGet(this, _flattened2).sign(key, options);
-          return `${jws.protected}.${jws.payload}.${jws.signature}`;
-        }
-      };
-      _flattened2 = new WeakMap();
-      _protectedHeader4 = new WeakMap();
-    }
-  });
-
   // ../node_modules/jose/dist/webapi/jws/general/sign.js
   var _parent2, IndividualSignature, _payload3, _signatures, GeneralSign;
   var init_sign3 = __esm({
@@ -38792,19 +39078,21 @@ return true;`);
             payload: ""
           };
           const encoded = [];
+          let b64;
           for (let i = 0; i < __privateGet(this, _signatures).length; i++) {
             const signature = __privateGet(this, _signatures)[i];
             const [protectedHeader, unprotectedHeader, key, crit] = signature.state;
-            const { payload, ...rest } = await createSignature({
+            const [{ payload, ...rest }, signatureB64] = await createSignature({
               payload: __privateGet(this, _payload3),
               protectedHeader,
               unprotectedHeader,
               crit,
               encoded
             }, key);
-            if (i === 0) {
+            if (b64 === void 0) {
+              b64 = signatureB64;
               jws.payload = payload;
-            } else if (jws.payload !== payload) {
+            } else if (b64 !== signatureB64) {
               throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
             }
             jws.signatures.push(rest);
@@ -38818,130 +39106,71 @@ return true;`);
   });
 
   // ../node_modules/jose/dist/webapi/jwt/sign.js
-  var _protectedHeader5, _jwt, SignJWT;
+  var SignJWT_base, _protectedHeader6, SignJWT;
   var init_sign4 = __esm({
     "../node_modules/jose/dist/webapi/jwt/sign.js"() {
-      init_sign2();
       init_jws_sign();
       init_errors();
       init_jwt_claims_set();
-      SignJWT = class {
-        constructor(payload = {}) {
-          __privateAdd(this, _protectedHeader5);
-          __privateAdd(this, _jwt);
-          __privateSet(this, _jwt, new JWTClaimsBuilder(payload));
-        }
-        setIssuer(issuer) {
-          __privateGet(this, _jwt).iss = issuer;
-          return this;
-        }
-        setSubject(subject) {
-          __privateGet(this, _jwt).sub = subject;
-          return this;
-        }
-        setAudience(audience) {
-          __privateGet(this, _jwt).aud = audience;
-          return this;
-        }
-        setJti(jwtId) {
-          __privateGet(this, _jwt).jti = jwtId;
-          return this;
-        }
-        setNotBefore(input) {
-          __privateGet(this, _jwt).nbf = input;
-          return this;
-        }
-        setExpirationTime(input) {
-          __privateGet(this, _jwt).exp = input;
-          return this;
-        }
-        setIssuedAt(input) {
-          __privateGet(this, _jwt).iat = input;
-          return this;
+      init_helpers();
+      SignJWT_base = JWTClaimsBuilder;
+      SignJWT = class extends SignJWT_base {
+        constructor() {
+          super(...arguments);
+          __privateAdd(this, _protectedHeader6);
         }
         setProtectedHeader(protectedHeader) {
-          __privateSet(this, _protectedHeader5, protectedHeader);
+          assertNotSet(__privateGet(this, _protectedHeader6), "setProtectedHeader");
+          __privateSet(this, _protectedHeader6, protectedHeader);
           return this;
         }
         async sign(key, options) {
-          const sig2 = new CompactSign(__privateGet(this, _jwt).data());
-          sig2.setProtectedHeader(__privateGet(this, _protectedHeader5));
-          if (unencodedPayload(__privateGet(this, _protectedHeader5))) {
+          return createCompactSignature(jwtData(this), __privateGet(this, _protectedHeader6), options?.crit, key, () => {
             throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-          }
-          return sig2.sign(key, options);
+          });
         }
       };
-      _protectedHeader5 = new WeakMap();
-      _jwt = new WeakMap();
+      _protectedHeader6 = new WeakMap();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jwt/encrypt.js
-  var _cek2, _iv2, _keyManagementParameters2, _protectedHeader6, _replicateIssuerAsHeader, _replicateSubjectAsHeader, _replicateAudienceAsHeader, _jwt2, EncryptJWT;
+  var EncryptJWT_base, _cek3, _iv3, _keyManagementParameters3, _protectedHeader7, _replicateIssuerAsHeader, _replicateSubjectAsHeader, _replicateAudienceAsHeader, EncryptJWT;
   var init_encrypt4 = __esm({
     "../node_modules/jose/dist/webapi/jwt/encrypt.js"() {
-      init_encrypt3();
+      init_jwe_encrypt();
       init_jwt_claims_set();
       init_helpers();
-      EncryptJWT = class {
-        constructor(payload = {}) {
-          __privateAdd(this, _cek2);
-          __privateAdd(this, _iv2);
-          __privateAdd(this, _keyManagementParameters2);
-          __privateAdd(this, _protectedHeader6);
+      EncryptJWT_base = JWTClaimsBuilder;
+      EncryptJWT = class extends EncryptJWT_base {
+        constructor() {
+          super(...arguments);
+          __privateAdd(this, _cek3);
+          __privateAdd(this, _iv3);
+          __privateAdd(this, _keyManagementParameters3);
+          __privateAdd(this, _protectedHeader7);
           __privateAdd(this, _replicateIssuerAsHeader);
           __privateAdd(this, _replicateSubjectAsHeader);
           __privateAdd(this, _replicateAudienceAsHeader);
-          __privateAdd(this, _jwt2);
-          __privateSet(this, _jwt2, new JWTClaimsBuilder(payload));
-        }
-        setIssuer(issuer) {
-          __privateGet(this, _jwt2).iss = issuer;
-          return this;
-        }
-        setSubject(subject) {
-          __privateGet(this, _jwt2).sub = subject;
-          return this;
-        }
-        setAudience(audience) {
-          __privateGet(this, _jwt2).aud = audience;
-          return this;
-        }
-        setJti(jwtId) {
-          __privateGet(this, _jwt2).jti = jwtId;
-          return this;
-        }
-        setNotBefore(input) {
-          __privateGet(this, _jwt2).nbf = input;
-          return this;
-        }
-        setExpirationTime(input) {
-          __privateGet(this, _jwt2).exp = input;
-          return this;
-        }
-        setIssuedAt(input) {
-          __privateGet(this, _jwt2).iat = input;
-          return this;
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader6), "setProtectedHeader");
-          __privateSet(this, _protectedHeader6, protectedHeader);
+          assertNotSet(__privateGet(this, _protectedHeader7), "setProtectedHeader");
+          __privateSet(this, _protectedHeader7, protectedHeader);
           return this;
         }
         setKeyManagementParameters(parameters) {
-          assertNotSet(__privateGet(this, _keyManagementParameters2), "setKeyManagementParameters");
-          __privateSet(this, _keyManagementParameters2, parameters);
+          assertNotSet(__privateGet(this, _keyManagementParameters3), "setKeyManagementParameters");
+          __privateSet(this, _keyManagementParameters3, parameters);
           return this;
         }
         setContentEncryptionKey(cek) {
-          assertNotSet(__privateGet(this, _cek2), "setContentEncryptionKey");
-          __privateSet(this, _cek2, cek);
+          assertNotSet(__privateGet(this, _cek3), "setContentEncryptionKey");
+          __privateSet(this, _cek3, cek);
           return this;
         }
         setInitializationVector(iv) {
-          assertNotSet(__privateGet(this, _iv2), "setInitializationVector");
-          __privateSet(this, _iv2, iv);
+          assertNotSet(__privateGet(this, _iv3), "setInitializationVector");
+          __privateSet(this, _iv3, iv);
           return this;
         }
         replicateIssuerAsHeader() {
@@ -38957,36 +39186,37 @@ return true;`);
           return this;
         }
         async encrypt(key, options) {
-          const enc = new CompactEncrypt(__privateGet(this, _jwt2).data());
-          if (__privateGet(this, _protectedHeader6) && (__privateGet(this, _replicateIssuerAsHeader) || __privateGet(this, _replicateSubjectAsHeader) || __privateGet(this, _replicateAudienceAsHeader))) {
-            __privateSet(this, _protectedHeader6, {
-              ...__privateGet(this, _protectedHeader6),
-              iss: __privateGet(this, _replicateIssuerAsHeader) ? __privateGet(this, _jwt2).iss : void 0,
-              sub: __privateGet(this, _replicateSubjectAsHeader) ? __privateGet(this, _jwt2).sub : void 0,
-              aud: __privateGet(this, _replicateAudienceAsHeader) ? __privateGet(this, _jwt2).aud : void 0
+          const plaintext = jwtData(this);
+          if (__privateGet(this, _protectedHeader7) && (__privateGet(this, _replicateIssuerAsHeader) || __privateGet(this, _replicateSubjectAsHeader) || __privateGet(this, _replicateAudienceAsHeader))) {
+            __privateSet(this, _protectedHeader7, {
+              ...__privateGet(this, _protectedHeader7),
+              iss: __privateGet(this, _replicateIssuerAsHeader) ? jwtClaim(this, "iss") : void 0,
+              sub: __privateGet(this, _replicateSubjectAsHeader) ? jwtClaim(this, "sub") : void 0,
+              aud: __privateGet(this, _replicateAudienceAsHeader) ? jwtClaim(this, "aud") : void 0
             });
           }
-          enc.setProtectedHeader(__privateGet(this, _protectedHeader6));
-          if (__privateGet(this, _iv2)) {
-            enc.setInitializationVector(__privateGet(this, _iv2));
-          }
-          if (__privateGet(this, _cek2)) {
-            enc.setContentEncryptionKey(__privateGet(this, _cek2));
-          }
-          if (__privateGet(this, _keyManagementParameters2)) {
-            enc.setKeyManagementParameters(__privateGet(this, _keyManagementParameters2));
-          }
-          return enc.encrypt(key, options);
+          const jwe = await createJWE([
+            plaintext,
+            __privateGet(this, _protectedHeader7),
+            void 0,
+            void 0,
+            void 0,
+            __privateGet(this, _cek3),
+            __privateGet(this, _iv3),
+            __privateGet(this, _keyManagementParameters3),
+            void 0,
+            false
+          ], key, options);
+          return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
         }
       };
-      _cek2 = new WeakMap();
-      _iv2 = new WeakMap();
-      _keyManagementParameters2 = new WeakMap();
-      _protectedHeader6 = new WeakMap();
+      _cek3 = new WeakMap();
+      _iv3 = new WeakMap();
+      _keyManagementParameters3 = new WeakMap();
+      _protectedHeader7 = new WeakMap();
       _replicateIssuerAsHeader = new WeakMap();
       _replicateSubjectAsHeader = new WeakMap();
       _replicateAudienceAsHeader = new WeakMap();
-      _jwt2 = new WeakMap();
     }
   });
 
@@ -39007,6 +39237,18 @@ return true;`);
     }
   });
 
+  // ../node_modules/jose/dist/webapi/lib/key_options.js
+  function validateExtractableOption(extractable) {
+    if (extractable !== void 0 && typeof extractable !== "boolean") {
+      throw new TypeError('"extractable" option must be a boolean');
+    }
+    return extractable;
+  }
+  var init_key_options = __esm({
+    "../node_modules/jose/dist/webapi/lib/key_options.js"() {
+    }
+  });
+
   // ../node_modules/jose/dist/webapi/lib/asn1.js
   function parseKeyHeader(state, keyFormat) {
     expectTag(state, 48, `Invalid ${keyFormat === "spki" ? "SPKI" : "PKCS#8"} structure`);
@@ -39022,7 +39264,10 @@ return true;`);
   function spkiFromX509(buf) {
     const state = createASN1State(buf);
     expectTag(state, 48, "Invalid certificate structure");
-    parseLength(state);
+    const certificateLength = parseLength(state);
+    if (certificateLength < 0 || state.pos + certificateLength > state.data.length) {
+      throw new Error("Unexpected end of ASN.1 input");
+    }
     expectTag(state, 48, "Invalid tbsCertificate structure");
     parseLength(state);
     if (buf[state.pos] === 160) {
@@ -39043,6 +39288,7 @@ return true;`);
       init_errors();
       init_key_algorithm();
       init_is_key_like();
+      init_key_options();
       formatPEM = (b64, descriptor) => {
         const newlined = (b64.match(/.{1,64}/g) || []).join("\n");
         return `-----BEGIN ${descriptor}-----
@@ -39143,6 +39389,7 @@ ${newlined}
         throw new Error("Unsupported named curve");
       };
       genericImport = async (keyFormat, keyData, alg, options) => {
+        const extractable = validateExtractableOption(options?.extractable);
         const entry = keyAlgorithm(alg, algArgument);
         if (entry.secret) {
           unsupportedAlg(algArgument);
@@ -39160,7 +39407,7 @@ ${newlined}
         } else {
           algorithm = entry.subtle;
         }
-        return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
+        return crypto.subtle.importKey(keyFormat, keyData, algorithm, extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
       };
       processPEMData = (pem, pattern) => {
         return decodeBase64(pem.replace(pattern, ""));
@@ -39238,10 +39485,13 @@ ${newlined}
   // ../node_modules/jose/dist/webapi/jwk/thumbprint.js
   async function calculateJwkThumbprint(key, digestAlgorithm) {
     let jwk;
-    if (isJWK(key)) {
-      jwk = key;
+    if (isObject(key)) {
+      jwk = snapshotJwk(key);
+      if (typeof jwk.kty !== "string") {
+        throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+      }
     } else if (isKeyLike(key)) {
-      jwk = await exportJWK(key);
+      jwk = snapshotJwk(await exportJWK(key));
     } else {
       throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
     }
@@ -39273,7 +39523,9 @@ ${newlined}
         components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
         break;
       case "oct":
-        check(jwk.k, '"k" (Key Value) Parameter');
+        if (typeof jwk.k !== "string") {
+          throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+        }
         components = { k: jwk.k, kty: jwk.kty };
         break;
       default:
@@ -39298,6 +39550,7 @@ ${newlined}
       init_type_checks();
       init_export();
       init_invalid_key_input();
+      init_jwk_metadata();
       check = (value, description) => {
         if (typeof value !== "string" || !value) {
           throw new JWKInvalid(`${description} missing or invalid`);
@@ -39315,8 +39568,20 @@ ${newlined}
     if (!isObject(joseHeader.jwk)) {
       throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
+    let jwk;
+    try {
+      jwk = normalizeJwk(joseHeader.jwk);
+    } catch (cause) {
+      throw new JWSInvalid("Invalid Embedded JWK", { cause });
+    }
     const entry = jwsAlgorithm(joseHeader.alg);
-    const key = await jwkToKey(entry, { ...joseHeader.jwk, ext: true });
+    if (jwk.use !== void 0 && jwk.use !== "sig") {
+      throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
+    }
+    if (jwk.alg !== void 0 && jwk.alg !== entry.alg) {
+      throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
+    }
+    const key = await jwkToKey(entry, { ...jwk, ext: true });
     if (key.type !== "public") {
       throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }
@@ -39328,88 +39593,74 @@ ${newlined}
       init_jws_algorithms();
       init_type_checks();
       init_errors();
+      init_jwk_metadata();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jwks/local.js
-  function signatureAlgorithm(alg) {
-    const entry = typeof alg === "string" ? JWS[alg] : void 0;
-    if (!entry || entry.secret) {
-      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-    return entry;
-  }
-  function isJWKSLike(jwks) {
-    if (!jwks || typeof jwks !== "object") {
-      return false;
-    }
-    const { keys } = jwks;
-    return Array.isArray(keys) && keys.every(isObject);
+  function isUsableJWK(jwk, entry, alg, kid) {
+    const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
+    const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+    return (ext === void 0 || typeof ext === "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation === "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid === "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
   }
   async function importWithAlgCache(cache2, jwk, entry) {
-    const cached2 = cache2.get(jwk) || cache2.set(jwk, { __proto__: null }).get(jwk);
-    if (cached2[entry.alg] === void 0) {
-      const key = await jwkToKey(entry, { ...jwk, alg: entry.alg, ext: true });
+    const cached2 = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk);
+    const { alg } = entry;
+    if (cached2[alg] === void 0) {
+      const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
       if (key.type !== "public") {
         throw new JWKSInvalid("JSON Web Key Set members must be public keys");
       }
-      cached2[entry.alg] = key;
+      cached2[alg] = key;
     }
-    return cached2[entry.alg];
+    return cached2[alg];
   }
   function createLocalJWKSet(jwks) {
-    const set = new LocalJWKSetImpl(jwks);
-    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperty(localJWKSet, "jwks", {
-      value: () => structuredClone(set.jwks())
+    let snapshot;
+    try {
+      snapshot = structuredClone(jwks);
+    } catch {
+    }
+    if (!isJwkSet(snapshot)) {
+      throw new JWKSInvalid("JSON Web Key Set malformed");
+    }
+    const cached2 = /* @__PURE__ */ new WeakMap();
+    const localJWKSet = async (protectedHeader, token) => {
+      const { alg, kid } = { ...protectedHeader, ...token?.header };
+      const entry = typeof alg === "string" ? JWS[alg] : void 0;
+      if (!entry || entry.secret) {
+        throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+      }
+      const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid));
+      const { 0: jwk, length } = candidates;
+      if (!length) {
+        throw new JWKSNoMatchingKey();
+      }
+      if (length !== 1) {
+        const error = new JWKSMultipleMatchingKeys();
+        error[Symbol.asyncIterator] = async function* () {
+          for (const jwk2 of candidates) {
+            try {
+              yield await importWithAlgCache(cached2, jwk2, entry);
+            } catch {
+            }
+          }
+        };
+        throw error;
+      }
+      return importWithAlgCache(cached2, jwk, entry);
+    };
+    return Object.defineProperty(localJWKSet, "jwks", {
+      value: () => structuredClone(snapshot)
     });
-    return localJWKSet;
   }
-  var _jwks, _cached, LocalJWKSetImpl;
   var init_local = __esm({
     "../node_modules/jose/dist/webapi/jwks/local.js"() {
       init_jwk_to_key();
       init_jws_algorithms();
       init_errors();
       init_type_checks();
-      LocalJWKSetImpl = class {
-        constructor(jwks) {
-          __privateAdd(this, _jwks);
-          __privateAdd(this, _cached, /* @__PURE__ */ new WeakMap());
-          if (!isJWKSLike(jwks)) {
-            throw new JWKSInvalid("JSON Web Key Set malformed");
-          }
-          __privateSet(this, _jwks, structuredClone(jwks));
-        }
-        jwks() {
-          return __privateGet(this, _jwks);
-        }
-        async getKey(protectedHeader, token) {
-          const { alg, kid } = { ...protectedHeader, ...token?.header };
-          const entry = signatureAlgorithm(alg);
-          const candidates = __privateGet(this, _jwks).keys.filter((jwk2) => entry.kty.includes(jwk2.kty) && (typeof kid !== "string" || kid === jwk2.kid) && (!(typeof jwk2.alg === "string" || jwk2.kty === "AKP") || alg === jwk2.alg) && (typeof jwk2.use !== "string" || jwk2.use === "sig") && (!Array.isArray(jwk2.key_ops) || jwk2.key_ops.includes("verify")) && (!entry.crv || jwk2.crv === entry.crv));
-          const { 0: jwk, length } = candidates;
-          if (length === 0) {
-            throw new JWKSNoMatchingKey();
-          }
-          if (length !== 1) {
-            const error = new JWKSMultipleMatchingKeys();
-            const _cached2 = __privateGet(this, _cached);
-            error[Symbol.asyncIterator] = async function* () {
-              for (const jwk2 of candidates) {
-                try {
-                  yield await importWithAlgCache(_cached2, jwk2, entry);
-                } catch {
-                }
-              }
-            };
-            throw error;
-          }
-          return importWithAlgCache(__privateGet(this, _cached), jwk, entry);
-        }
-      };
-      _jwks = new WeakMap();
-      _cached = new WeakMap();
+      init_jwk_metadata();
     }
   });
 
@@ -39438,46 +39689,114 @@ ${newlined}
       throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
     }
   }
-  function isFreshJwksCache(input, cacheMaxAge) {
-    if (typeof input !== "object" || input === null) {
-      return false;
-    }
-    if (!("uat" in input) || typeof input.uat !== "number" || Date.now() - input.uat >= cacheMaxAge) {
-      return false;
-    }
-    if (!("jwks" in input) || !isObject(input.jwks) || !Array.isArray(input.jwks.keys) || !Array.prototype.every.call(input.jwks.keys, isObject)) {
-      return false;
+  function isFreshFor(timestamp, duration) {
+    return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
+  }
+  function validateDuration(value, fallback, option) {
+    if (Number.isNaN(value)) {
+      throw new TypeError(`"${option}" option must not be NaN`);
     }
-    return true;
+    return typeof value === "number" ? value : fallback;
   }
   function createRemoteJWKSet(url, options) {
-    const set = new RemoteJWKSetImpl(url, options);
-    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperties(remoteJWKSet, {
+    if (!(url instanceof URL)) {
+      throw new TypeError("url must be an instance of URL");
+    }
+    const href = new URL(url.href).href;
+    const opts = options ?? {};
+    const timeoutOption = opts.timeoutDuration;
+    if (typeof timeoutOption === "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0)) {
+      throw new TypeError('"timeoutDuration" option must be a non-negative integer');
+    }
+    const timeoutDuration = typeof timeoutOption === "number" ? timeoutOption : 5e3;
+    const cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration");
+    const cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge");
+    const headers = new Headers(opts.headers);
+    if (USER_AGENT && !headers.has("User-Agent")) {
+      headers.set("User-Agent", USER_AGENT);
+    }
+    if (!headers.has("accept")) {
+      headers.set("accept", "application/json, application/jwk-set+json");
+    }
+    const fetchImpl = opts[customFetch];
+    const cache2 = opts[jwksCache];
+    let jwksTimestamp;
+    let pendingFetch;
+    let reloadSequence = 0;
+    let appliedSequence = 0;
+    let local;
+    if (cache2 && typeof cache2 === "object") {
+      const { uat, jwks } = cache2;
+      if (isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks)) {
+        jwksTimestamp = uat;
+        local = createLocalJWKSet(jwks);
+      }
+    }
+    const reload = async () => {
+      if (pendingFetch && isCloudflareWorkers()) {
+        pendingFetch = void 0;
+      }
+      if (!pendingFetch) {
+        const sequence = ++reloadSequence;
+        const current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+          const next = createLocalJWKSet(json);
+          if (sequence <= appliedSequence) {
+            return;
+          }
+          local = next;
+          const updatedAt = Date.now();
+          if (cache2) {
+            cache2.uat = updatedAt;
+            cache2.jwks = json;
+          }
+          jwksTimestamp = updatedAt;
+          appliedSequence = sequence;
+        }).finally(() => {
+          if (pendingFetch === current) {
+            pendingFetch = void 0;
+          }
+        });
+      }
+      await pendingFetch;
+    };
+    const remoteJWKSet = async (protectedHeader, token) => {
+      if (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) {
+        await reload();
+      }
+      try {
+        return await local(protectedHeader, token);
+      } catch (err) {
+        if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) {
+          await reload();
+          return local(protectedHeader, token);
+        }
+        throw err;
+      }
+    };
+    return Object.defineProperties(remoteJWKSet, {
       coolingDown: {
-        get: () => set.coolingDown(),
+        get: () => isFreshFor(jwksTimestamp, cooldownDuration),
         enumerable: true
       },
       fresh: {
-        get: () => set.fresh(),
+        get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
         enumerable: true
       },
       reload: {
-        value: () => set.reload(),
+        value: reload,
         enumerable: true
       },
       reloading: {
-        get: () => set.pendingFetch(),
+        get: () => !!pendingFetch,
         enumerable: true
       },
       jwks: {
-        value: () => set.jwks(),
+        value: () => local?.jwks(),
         enumerable: true
       }
     });
-    return remoteJWKSet;
   }
-  var USER_AGENT, customFetch, jwksCache, _url, _timeoutDuration, _cooldownDuration, _cacheMaxAge, _jwksTimestamp, _pendingFetch, _headers, _customFetch, _local, _cache, _RemoteJWKSetImpl_instances, validFor_fn, RemoteJWKSetImpl;
+  var USER_AGENT, customFetch, jwksCache;
   var init_remote = __esm({
     "../node_modules/jose/dist/webapi/jwks/remote.js"() {
       init_errors();
@@ -39485,159 +39804,30 @@ ${newlined}
       init_type_checks();
       if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
         const NAME = "jose";
-        const VERSION = "v6.2.8";
+        const VERSION = "v6.2.10";
         USER_AGENT = `${NAME}/${VERSION}`;
       }
       customFetch = /* @__PURE__ */ Symbol();
       jwksCache = /* @__PURE__ */ Symbol();
-      RemoteJWKSetImpl = class {
-        constructor(url, options) {
-          __privateAdd(this, _RemoteJWKSetImpl_instances);
-          __privateAdd(this, _url);
-          __privateAdd(this, _timeoutDuration);
-          __privateAdd(this, _cooldownDuration);
-          __privateAdd(this, _cacheMaxAge);
-          __privateAdd(this, _jwksTimestamp);
-          __privateAdd(this, _pendingFetch);
-          __privateAdd(this, _headers);
-          __privateAdd(this, _customFetch);
-          __privateAdd(this, _local);
-          __privateAdd(this, _cache);
-          if (!(url instanceof URL)) {
-            throw new TypeError("url must be an instance of URL");
-          }
-          __privateSet(this, _url, new URL(url.href));
-          const opts = options ?? {};
-          __privateSet(this, _timeoutDuration, typeof opts.timeoutDuration === "number" ? opts.timeoutDuration : 5e3);
-          __privateSet(this, _cooldownDuration, typeof opts.cooldownDuration === "number" ? opts.cooldownDuration : 3e4);
-          __privateSet(this, _cacheMaxAge, typeof opts.cacheMaxAge === "number" ? opts.cacheMaxAge : 6e5);
-          __privateSet(this, _headers, new Headers(opts.headers));
-          if (USER_AGENT && !__privateGet(this, _headers).has("User-Agent")) {
-            __privateGet(this, _headers).set("User-Agent", USER_AGENT);
-          }
-          if (!__privateGet(this, _headers).has("accept")) {
-            __privateGet(this, _headers).set("accept", "application/json");
-            __privateGet(this, _headers).append("accept", "application/jwk-set+json");
-          }
-          __privateSet(this, _customFetch, opts[customFetch]);
-          const cache2 = opts[jwksCache];
-          if (cache2 !== void 0) {
-            __privateSet(this, _cache, cache2);
-            if (isFreshJwksCache(cache2, __privateGet(this, _cacheMaxAge))) {
-              __privateSet(this, _jwksTimestamp, __privateGet(this, _cache).uat);
-              __privateSet(this, _local, createLocalJWKSet(__privateGet(this, _cache).jwks));
-            }
-          }
-        }
-        pendingFetch() {
-          return !!__privateGet(this, _pendingFetch);
-        }
-        coolingDown() {
-          return __privateMethod(this, _RemoteJWKSetImpl_instances, validFor_fn).call(this, __privateGet(this, _cooldownDuration));
-        }
-        fresh() {
-          return __privateMethod(this, _RemoteJWKSetImpl_instances, validFor_fn).call(this, __privateGet(this, _cacheMaxAge));
-        }
-        jwks() {
-          return __privateGet(this, _local)?.jwks();
-        }
-        async getKey(protectedHeader, token) {
-          if (!__privateGet(this, _local) || !this.fresh()) {
-            await this.reload();
-          }
-          try {
-            return await __privateGet(this, _local).call(this, protectedHeader, token);
-          } catch (err) {
-            if (err instanceof JWKSNoMatchingKey) {
-              if (this.coolingDown() === false) {
-                await this.reload();
-                return __privateGet(this, _local).call(this, protectedHeader, token);
-              }
-            }
-            throw err;
-          }
-        }
-        async reload() {
-          if (__privateGet(this, _pendingFetch) && isCloudflareWorkers()) {
-            __privateSet(this, _pendingFetch, void 0);
-          }
-          __privateGet(this, _pendingFetch) || __privateSet(this, _pendingFetch, fetchJwks(__privateGet(this, _url).href, __privateGet(this, _headers), AbortSignal.timeout(__privateGet(this, _timeoutDuration)), __privateGet(this, _customFetch)).then((json) => {
-            __privateSet(this, _local, createLocalJWKSet(json));
-            if (__privateGet(this, _cache)) {
-              __privateGet(this, _cache).uat = Date.now();
-              __privateGet(this, _cache).jwks = json;
-            }
-            __privateSet(this, _jwksTimestamp, Date.now());
-          }).finally(() => {
-            __privateSet(this, _pendingFetch, void 0);
-          }));
-          await __privateGet(this, _pendingFetch);
-        }
-      };
-      _url = new WeakMap();
-      _timeoutDuration = new WeakMap();
-      _cooldownDuration = new WeakMap();
-      _cacheMaxAge = new WeakMap();
-      _jwksTimestamp = new WeakMap();
-      _pendingFetch = new WeakMap();
-      _headers = new WeakMap();
-      _customFetch = new WeakMap();
-      _local = new WeakMap();
-      _cache = new WeakMap();
-      _RemoteJWKSetImpl_instances = new WeakSet();
-      validFor_fn = function(duration) {
-        return typeof __privateGet(this, _jwksTimestamp) === "number" && Date.now() < __privateGet(this, _jwksTimestamp) + duration;
-      };
     }
   });
 
   // ../node_modules/jose/dist/webapi/jwt/unsecured.js
-  var _jwt3, UnsecuredJWT;
+  var UnsecuredJWT_base, UnsecuredJWT;
   var init_unsecured = __esm({
     "../node_modules/jose/dist/webapi/jwt/unsecured.js"() {
       init_base64url();
-      init_buffer_utils();
       init_helpers();
       init_errors();
       init_jwt_claims_set();
-      UnsecuredJWT = class {
-        constructor(payload = {}) {
-          __privateAdd(this, _jwt3);
-          __privateSet(this, _jwt3, new JWTClaimsBuilder(payload));
-        }
+      init_options();
+      UnsecuredJWT_base = JWTClaimsBuilder;
+      UnsecuredJWT = class extends UnsecuredJWT_base {
         encode() {
           const header = encode2(JSON.stringify({ alg: "none" }));
-          const payload = encode2(__privateGet(this, _jwt3).data());
+          const payload = encode2(jwtData(this));
           return `${header}.${payload}.`;
         }
-        setIssuer(issuer) {
-          __privateGet(this, _jwt3).iss = issuer;
-          return this;
-        }
-        setSubject(subject) {
-          __privateGet(this, _jwt3).sub = subject;
-          return this;
-        }
-        setAudience(audience) {
-          __privateGet(this, _jwt3).aud = audience;
-          return this;
-        }
-        setJti(jwtId) {
-          __privateGet(this, _jwt3).jti = jwtId;
-          return this;
-        }
-        setNotBefore(input) {
-          __privateGet(this, _jwt3).nbf = input;
-          return this;
-        }
-        setExpirationTime(input) {
-          __privateGet(this, _jwt3).exp = input;
-          return this;
-        }
-        setIssuedAt(input) {
-          __privateGet(this, _jwt3).iat = input;
-          return this;
-        }
         static decode(jwt, options) {
           if (typeof jwt !== "string") {
             throw new JWTInvalid("Unsecured JWT must be a string");
@@ -39647,18 +39837,27 @@ ${newlined}
             throw new JWTInvalid("Invalid Unsecured JWT");
           }
           let header;
+          let b64;
           try {
-            header = JSON.parse(strictDecoder.decode(decode(encodedHeader)));
-            if (header.alg !== "none")
-              throw new Error();
-          } catch {
+            header = parseJoseHeader(encodedHeader, JWSInvalid, "JWS Protected Header is invalid");
+            const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, void 0, header, header);
+            b64 = validateB64(header, extensions);
+          } catch (cause) {
+            if (!(cause instanceof JWSInvalid)) {
+              throw cause;
+            }
+            throw new JWTInvalid("Invalid Unsecured JWT", { cause });
+          }
+          if (header.alg !== "none") {
             throw new JWTInvalid("Invalid Unsecured JWT");
           }
+          if (!b64) {
+            throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+          }
           const payload = validateClaimsSet(header, decodeBase64url(encodedPayload, "payload", JWTInvalid), options);
           return { payload, header };
         }
       };
-      _jwt3 = new WeakMap();
     }
   });
 
@@ -39685,31 +39884,33 @@ ${newlined}
     if (!isObject(jwk)) {
       throw new TypeError("JWK must be an object");
     }
-    alg ?? (alg = jwk.alg);
-    const ext = options?.extractable ?? jwk.ext;
-    if (jwk.kty !== "oct" && !alg) {
+    const normalized = normalizeJwk(jwk);
+    const extractable = validateExtractableOption(options?.extractable);
+    const { alg: jwkAlg } = normalized;
+    alg ?? (alg = jwkAlg);
+    const ext = extractable ?? normalized.ext;
+    if (normalized.kty !== "oct" && !alg) {
       throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
     }
-    switch (jwk.kty) {
+    switch (normalized.kty) {
       case "oct":
-        if (typeof jwk.k !== "string" || !jwk.k) {
+        if (typeof normalized.k !== "string") {
           throw new TypeError('missing "k" (Key Value) Parameter value');
         }
-        return decode(jwk.k);
-      case "RSA":
-        return jwkToKey(keyAlgorithm(alg), { ...jwk, alg, ext });
+        return decode(normalized.k);
       case "AKP": {
-        if (typeof jwk.alg !== "string" || !jwk.alg) {
+        if (typeof jwkAlg !== "string" || !jwkAlg) {
           throw new TypeError('missing "alg" (Algorithm) Parameter value');
         }
-        if (alg !== void 0 && alg !== jwk.alg) {
+        if (alg !== jwkAlg) {
           throw new TypeError("JWK alg and alg option value mismatch");
         }
-        return jwkToKey(keyAlgorithm(jwk.alg), { ...jwk, ext });
+        return jwkToKey(keyAlgorithm(alg), { ...normalized, ext });
       }
+      case "RSA":
       case "EC":
       case "OKP":
-        return jwkToKey(keyAlgorithm(alg), { ...jwk, alg, ext });
+        return jwkToKey(keyAlgorithm(alg), { ...normalized, alg, ext });
       default:
         throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
     }
@@ -39722,6 +39923,8 @@ ${newlined}
       init_key_algorithm();
       init_errors();
       init_type_checks();
+      init_key_options();
+      init_jwk_metadata();
     }
   });
 
@@ -39792,12 +39995,13 @@ ${newlined}
   // ../node_modules/jose/dist/webapi/key/generate_key_pair.js
   function getModulusLengthOption(options) {
     const modulusLength = options?.modulusLength ?? 2048;
-    if (typeof modulusLength !== "number" || modulusLength < 2048) {
+    if (typeof modulusLength !== "number" || !Number.isInteger(modulusLength) || modulusLength < 2048) {
       throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");
     }
     return modulusLength;
   }
   async function generateKeyPair(alg, options) {
+    const extractable = validateExtractableOption(options?.extractable);
     const entry = keyAlgorithm(alg, algArgument);
     if (entry.secret) {
       unsupportedAlg(algArgument);
@@ -39827,7 +40031,7 @@ ${newlined}
         modulusLength: getModulusLengthOption(options)
       } : entry.subtle;
     }
-    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, [
+    return crypto.subtle.generateKey(algorithm, extractable ?? false, [
       ...entry.usages[1],
       ...entry.usages[0]
     ]);
@@ -39835,12 +40039,14 @@ ${newlined}
   var init_generate_key_pair = __esm({
     "../node_modules/jose/dist/webapi/key/generate_key_pair.js"() {
       init_errors();
+      init_key_options();
       init_key_algorithm();
     }
   });
 
   // ../node_modules/jose/dist/webapi/key/generate_secret.js
   async function generateSecret(alg, options) {
+    const extractable = validateExtractableOption(options?.extractable);
     let length;
     let algorithm;
     let keyUsages;
@@ -39848,19 +40054,18 @@ ${newlined}
       case "HS256":
       case "HS384":
       case "HS512":
-        length = parseInt(alg.slice(-3), 10);
+        length = +alg.slice(-3);
         algorithm = { name: "HMAC", hash: `SHA-${length}`, length };
         keyUsages = ["sign", "verify"];
         break;
       case "A128CBC-HS256":
       case "A192CBC-HS384":
       case "A256CBC-HS512":
-        length = parseInt(alg.slice(-3), 10);
-        return crypto.getRandomValues(new Uint8Array(length >> 3));
+        return crypto.getRandomValues(new Uint8Array(+alg.slice(-3) >> 3));
       case "A128KW":
       case "A192KW":
       case "A256KW":
-        length = parseInt(alg.slice(1, 4), 10);
+        length = +alg.slice(1, 4);
         algorithm = { name: "AES-KW", length };
         keyUsages = ["wrapKey", "unwrapKey"];
         break;
@@ -39870,18 +40075,19 @@ ${newlined}
       case "A128GCM":
       case "A192GCM":
       case "A256GCM":
-        length = parseInt(alg.slice(1, 4), 10);
+        length = +alg.slice(1, 4);
         algorithm = { name: "AES-GCM", length };
         keyUsages = ["encrypt", "decrypt"];
         break;
       default:
         unsupportedAlg(algArgument);
     }
-    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
+    return crypto.subtle.generateKey(algorithm, extractable ?? false, keyUsages);
   }
   var init_generate_secret = __esm({
     "../node_modules/jose/dist/webapi/key/generate_secret.js"() {
       init_key_algorithm();
+      init_key_options();
     }
   });
 
@@ -39933,16 +40139,16 @@ ${newlined}
       init_decrypt();
       init_decrypt2();
       init_decrypt3();
-      init_encrypt2();
+      init_encrypt();
       init_verify();
       init_verify2();
       init_verify3();
       init_verify4();
       init_decrypt4();
+      init_encrypt2();
       init_encrypt3();
-      init_encrypt();
-      init_sign2();
       init_sign();
+      init_sign2();
       init_sign3();
       init_sign4();
       init_encrypt4();
@@ -42546,7 +42752,7 @@ ${newlined}
             }))
           }
         };
-        return { ...service, agents, container };
+        return { ...service, enabled: service.enabled ?? true, agents, container };
       }
       var ServiceTemplateSpec = class _ServiceTemplateSpec {
         constructor(template) {
@@ -42656,6 +42862,7 @@ ${newlined}
         };
         return pruneUndefinedValues({
           ...service,
+          enabled: service.enabled ?? true,
           container,
           agents
         });
@@ -42853,6 +43060,50 @@ ${newlined}
             annotations: annotations && typeof annotations === "object" ? annotations : {}
           };
         }
+        parseRoomStatus(data) {
+          if (!data || typeof data !== "object") {
+            throw new requirement_js_1.RoomException("Invalid room status payload");
+          }
+          const { status, allocated_at: allocatedAt, running_for_seconds: runningForSeconds } = data;
+          if (status !== "Allocated" && status !== "Unallocated") {
+            throw new requirement_js_1.RoomException("Invalid room status payload: unknown status");
+          }
+          if (allocatedAt != null && typeof allocatedAt !== "string") {
+            throw new requirement_js_1.RoomException("Invalid room status payload: allocated_at must be a timestamp");
+          }
+          if (runningForSeconds != null && typeof runningForSeconds !== "number") {
+            throw new requirement_js_1.RoomException("Invalid room status payload: running_for_seconds must be a number");
+          }
+          return {
+            status,
+            allocatedAt: allocatedAt == null ? null : new Date(allocatedAt),
+            runningForSeconds: runningForSeconds == null ? null : runningForSeconds
+          };
+        }
+        parseRoomLifecycleEvent(data) {
+          if (!data || typeof data !== "object") {
+            throw new requirement_js_1.RoomException("Invalid room lifecycle event payload");
+          }
+          const { id, room_name: roomName, session_id: sessionId, type, message: message2, severity, created_at: createdAt } = data;
+          if (typeof id !== "string" || typeof roomName !== "string" || typeof type !== "string" || typeof message2 !== "string" || typeof createdAt !== "string") {
+            throw new requirement_js_1.RoomException("Invalid room lifecycle event payload: missing required fields");
+          }
+          if (sessionId != null && typeof sessionId !== "string") {
+            throw new requirement_js_1.RoomException("Invalid room lifecycle event payload: session_id must be a string");
+          }
+          if (severity != null && typeof severity !== "string") {
+            throw new requirement_js_1.RoomException("Invalid room lifecycle event payload: severity must be a string");
+          }
+          return {
+            id,
+            roomName,
+            sessionId: sessionId == null ? null : sessionId,
+            type,
+            message: message2,
+            severity: severity == null ? null : severity,
+            createdAt: new Date(createdAt)
+          };
+        }
         parseGroup(data) {
           if (!data || typeof data !== "object") {
             throw new requirement_js_1.RoomException("Invalid group payload");
@@ -43010,7 +43261,7 @@ ${newlined}
         serializeAccessSubject(subject) {
           return {
             type: subject.type,
-            id: subject.id,
+            ...subject.id !== void 0 ? { id: subject.id } : {},
             ...subject.name !== void 0 ? { name: subject.name } : {},
             ...subject.firstName !== void 0 ? { first_name: subject.firstName } : {},
             ...subject.lastName !== void 0 ? { last_name: subject.lastName } : {},
@@ -43019,6 +43270,22 @@ ${newlined}
             ...subject.relation !== void 0 ? { relation: subject.relation } : {}
           };
         }
+        parseLlmDelegation(data) {
+          if (!data || typeof data !== "object" || typeof data.id !== "string" || typeof data.token !== "string" || typeof data.expires_at !== "string" || typeof data.project_id !== "string" || typeof data.max_budget !== "string") {
+            throw new requirement_js_1.RoomException("Invalid LLM delegation payload");
+          }
+          return {
+            id: data.id,
+            token: data.token,
+            expiresAt: data.expires_at,
+            projectId: data.project_id,
+            delegator: this.parseAccessSubject(data.delegator),
+            subject: this.parseAccessSubject(data.subject),
+            providers: Array.isArray(data.providers) ? data.providers : null,
+            models: Array.isArray(data.models) ? data.models.filter((value) => typeof value === "string") : null,
+            maxBudget: data.max_budget
+          };
+        }
         serializeAccessResource(resource) {
           return {
             type: resource.type,
@@ -43067,6 +43334,9 @@ ${newlined}
             metadata: parsedResource.metadata ?? {},
             annotations: parsedResource.annotations ?? {}
           };
+          if (!parsedSubject.id) {
+            throw new requirement_js_1.RoomException("Invalid room grant payload: missing subject id");
+          }
           return {
             resource: parsedResource,
             subject: parsedSubject,
@@ -44105,6 +44375,22 @@ ${newlined}
           });
           return this.parseRoom(data);
         }
+        async getRoomStatus(projectId, name) {
+          const roomName = this.encodePathComponent(name);
+          const data = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/status`, {
+            action: "get room status"
+          });
+          return this.parseRoomStatus(data);
+        }
+        async listRoomEvents(projectId, name, options = {}) {
+          const roomName = this.encodePathComponent(name);
+          const data = await this.request(`/accounts/projects/${projectId}/rooms/${roomName}/events`, {
+            query: { limit: options.limit ?? 100 },
+            action: "list room lifecycle events"
+          });
+          const events = Array.isArray(data?.events) ? data.events : [];
+          return events.map((event) => this.parseRoomLifecycleEvent(event));
+        }
         async updateRoom(projectId, roomId, name, options = {}) {
           const payload = { name };
           if (options.metadata !== void 0) {
@@ -44228,6 +44514,21 @@ ${newlined}
           });
           return this.parseAgentConnectionInfo(data);
         }
+        async connectLlm(params) {
+          const data = await this.request("/llm/connect", {
+            method: "POST",
+            headers: { "Meshagent-Project-Id": params.projectId },
+            json: {
+              subject: this.serializeAccessSubject(params.subject),
+              max_budget: params.maxBudget,
+              ...params.providers !== void 0 ? { providers: params.providers } : {},
+              ...params.models !== void 0 ? { models: params.models } : {},
+              ...params.expiresInSeconds !== void 0 ? { expires_in_seconds: params.expiresInSeconds } : {}
+            },
+            action: "connect LLM delegation"
+          });
+          return this.parseLlmDelegation(data);
+        }
         async listRooms(projectId, options = {}) {
           const { pageSize = 50, continuationToken, filter, view } = options;
           const data = await this.request(`/accounts/projects/${projectId}/rooms`, {