@meshagent/meshagent-ts-auth 0.51.6 → 0.52.1

package/dist/browser/ma-auth.global.js

@@ -2976,7 +2976,7 @@ meshagent.auth = (() => {
           this.url = url;
           this.name = name;
         }
-        static unpack(header, _payload4) {
+        static unpack(header, _payload3) {
           return new _LinkContent({
             url: header["url"],
             name: header["name"]
@@ -3023,7 +3023,7 @@ meshagent.auth = (() => {
         constructor({ text }) {
           this.text = text;
         }
-        static unpack(header, _payload4) {
+        static unpack(header, _payload3) {
           return new _TextContent({
             text: header["text"]
           });
@@ -3043,7 +3043,7 @@ meshagent.auth = (() => {
         constructor({ json }) {
           this.json = json;
         }
-        static unpack(header, _payload4) {
+        static unpack(header, _payload3) {
           return new _JsonContent({ json: header["json"] });
         }
         pack() {
@@ -3062,7 +3062,7 @@ meshagent.auth = (() => {
           this.text = text;
           this.code = code;
         }
-        static unpack(header, _payload4) {
+        static unpack(header, _payload3) {
           const rawCode = header["code"];
           let code;
           if (typeof rawCode === "number" && Number.isInteger(rawCode)) {
@@ -3091,7 +3091,7 @@ meshagent.auth = (() => {
       };
       exports.ErrorContent = ErrorContent;
       var EmptyContent = class _EmptyContent {
-        static unpack(_header, _payload4) {
+        static unpack(_header, _payload3) {
           return new _EmptyContent();
         }
         pack() {
@@ -3113,7 +3113,7 @@ meshagent.auth = (() => {
           this.statusCode = method === "close" ? statusCode ?? ControlCloseStatus.NORMAL : statusCode;
           this.message = message2;
         }
-        static unpack(header, _payload4) {
+        static unpack(header, _payload3) {
           const method = header["method"];
           if (method !== "open" && method !== "close") {
             throw new Error(`Invalid control method: ${method}`);
@@ -5172,9 +5172,9 @@ meshagent.auth = (() => {
         let r = decoder2.arr[decoder2.pos++];
         let num = r & BITS6;
         let mult = 64;
-        const sign2 = (r & BIT7) > 0 ? -1 : 1;
+        const sign = (r & BIT7) > 0 ? -1 : 1;
         if ((r & BIT8) === 0) {
-          return sign2 * num;
+          return sign * num;
         }
         const len = decoder2.arr.length;
         while (decoder2.pos < len) {
@@ -5182,7 +5182,7 @@ meshagent.auth = (() => {
           num = num + (r & BITS7) * mult;
           mult *= 128;
           if (r < BIT8) {
-            return sign2 * num;
+            return sign * num;
           }
           if (num > MAX_SAFE_INTEGER) {
             throw errorIntegerOutOfRange;
@@ -21998,8 +21998,8 @@ ${err.toString()}`);
           const remainder = negative ? -(number % denominator) : number % denominator;
           const integerPart = (0, bigint_js_1.bigIntToNumber)(quotient);
           const fractionPart = `${remainder}`.padStart(scale, "0");
-          const sign2 = negative && integerPart === 0 ? "-" : "";
-          return +`${sign2}${integerPart}.${fractionPart}`;
+          const sign = negative && integerPart === 0 ? "-" : "";
+          return +`${sign}${integerPart}.${fractionPart}`;
         }
         return (0, bigint_js_1.bigIntToNumber)(number);
       }
@@ -23444,14 +23444,14 @@ ${err.toString()}`);
       function uint16ToFloat64(h) {
         const expo = (h & 31744) >> 10;
         const sigf = (h & 1023) / 1024;
-        const sign2 = Math.pow(-1, (h & 32768) >> 15);
+        const sign = Math.pow(-1, (h & 32768) >> 15);
         switch (expo) {
           case 31:
-            return sign2 * (sigf ? Number.NaN : 1 / 0);
+            return sign * (sigf ? Number.NaN : 1 / 0);
           case 0:
-            return sign2 * (sigf ? 6103515625e-14 * sigf : 0);
+            return sign * (sigf ? 6103515625e-14 * sigf : 0);
         }
-        return sign2 * Math.pow(2, expo - 15) * (1 + sigf);
+        return sign * Math.pow(2, expo - 15) * (1 + sigf);
       }
       exports.uint16ToFloat64 = uint16ToFloat64;
       function float64ToUint16(d) {
@@ -23459,7 +23459,7 @@ ${err.toString()}`);
           return 32256;
         }
         f64[0] = d;
-        const sign2 = (u32[1] & 2147483648) >> 16 & 65535;
+        const sign = (u32[1] & 2147483648) >> 16 & 65535;
         let expo = u32[1] & 2146435072, sigf = 0;
         if (expo >= 1089470464) {
           if (u32[0] > 0) {
@@ -23476,7 +23476,7 @@ ${err.toString()}`);
           expo = expo - 1056964608 >> 10;
           sigf = (u32[1] & 1048575) + 512 >> 10;
         }
-        return sign2 | expo | sigf & 65535;
+        return sign | expo | sigf & 65535;
       }
       exports.float64ToUint16 = float64ToUint16;
     }
@@ -36342,116 +36342,74 @@ return true;`);
 
   // ../node_modules/jose/dist/webapi/lib/buffer_utils.js
   function concat(...buffers) {
-    const size = buffers.reduce((acc, { length }) => acc + length, 0);
-    const buf = new Uint8Array(size);
+    const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);
     let i = 0;
-    for (const buffer of buffers) {
-      buf.set(buffer, i);
-      i += buffer.length;
-    }
+    for (const buffer of buffers)
+      buf.set(buffer, i), i += buffer.length;
     return buf;
   }
   function writeUInt32BE(buf, value, offset) {
-    if (value < 0 || value >= MAX_INT32) {
+    if (value < 0 || value >= MAX_INT32)
       throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);
-    }
     buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);
   }
   function uint64be(value) {
-    const high = Math.floor(value / MAX_INT32);
-    const low = value % MAX_INT32;
-    const buf = new Uint8Array(8);
-    writeUInt32BE(buf, high, 0);
-    writeUInt32BE(buf, low, 4);
-    return buf;
+    const high = Math.floor(value / MAX_INT32), low = value % MAX_INT32, buf = new Uint8Array(8);
+    return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;
   }
   function uint32be(value) {
     const buf = new Uint8Array(4);
-    writeUInt32BE(buf, value);
-    return buf;
+    return writeUInt32BE(buf, value), buf;
   }
   function encode(string) {
+    if (typeof string == "string" && string.length >= 128) {
+      if (NON_ASCII.test(string))
+        throw new TypeError("non-ASCII string encountered in encode()");
+      return encoder.encode(string);
+    }
     const bytes = new Uint8Array(string.length);
     for (let i = 0; i < string.length; i++) {
       const code = string.charCodeAt(i);
-      if (code > 127) {
+      if (code > 127)
         throw new TypeError("non-ASCII string encountered in encode()");
-      }
       bytes[i] = code;
     }
     return bytes;
   }
-  var encoder, decoder, strictDecoder, MAX_INT32;
+  function encodeBase64(input, url = false) {
+    if (Uint8Array.prototype.toBase64)
+      return input.toBase64({ alphabet: url ? "base64url" : "base64", omitPadding: url });
+    const CHUNK_SIZE = 32768, arr = [];
+    for (let i = 0; i < input.length; i += CHUNK_SIZE)
+      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    const encoded = btoa(arr.join(""));
+    return url ? encoded.replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") : encoded;
+  }
+  function decodeBase64(encoded, url = false) {
+    if (Uint8Array.fromBase64)
+      return Uint8Array.fromBase64(encoded, { alphabet: url ? "base64url" : "base64" });
+    if (url) {
+      if (encoded.includes("+") || encoded.includes("/"))
+        throw new TypeError("Invalid base64url");
+      encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+    }
+    const binary = atob(encoded), bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+      bytes[i] = binary.charCodeAt(i);
+    return bytes;
+  }
+  async function digest(algorithm, data) {
+    const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+    return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+  }
+  var encoder, decoder, strictDecoder, MAX_INT32, NON_ASCII;
   var init_buffer_utils = __esm({
     "../node_modules/jose/dist/webapi/lib/buffer_utils.js"() {
       encoder = new TextEncoder();
       decoder = new TextDecoder();
       strictDecoder = new TextDecoder("utf-8", { fatal: true });
       MAX_INT32 = 2 ** 32;
-    }
-  });
-
-  // ../node_modules/jose/dist/webapi/lib/crypto_key.js
-  function checkUsage(key, usage) {
-    if (usage && !key.usages.includes(usage)) {
-      throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-    }
-  }
-  function checkModulusLength(alg, key) {
-    const { modulusLength } = key.algorithm;
-    if (typeof modulusLength !== "number" || modulusLength < 2048) {
-      throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-    }
-  }
-  function checkCryptoKey(key, expected, usage) {
-    const algorithm = key.algorithm;
-    if (algorithm.name !== expected.name) {
-      throw unusable(expected.name);
-    }
-    if (expected.hash && algorithm.hash?.name !== expected.hash) {
-      throw unusable(expected.hash, "algorithm.hash");
-    }
-    if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) {
-      throw unusable(expected.namedCurve, "algorithm.namedCurve");
-    }
-    if (expected.length !== void 0 && algorithm.length !== expected.length) {
-      throw unusable(expected.length, "algorithm.length");
-    }
-    checkUsage(key, usage);
-  }
-  var unusable;
-  var init_crypto_key = __esm({
-    "../node_modules/jose/dist/webapi/lib/crypto_key.js"() {
-      unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-    }
-  });
-
-  // ../node_modules/jose/dist/webapi/lib/invalid_key_input.js
-  function message(msg, actual, ...types) {
-    if (types.length > 2) {
-      const last = types.pop();
-      msg += `one of type ${types.join(", ")}, or ${last}.`;
-    } else if (types.length === 2) {
-      msg += `one of type ${types[0]} or ${types[1]}.`;
-    } else {
-      msg += `of type ${types[0]}.`;
-    }
-    if (actual == null) {
-      msg += ` Received ${actual}`;
-    } else if (typeof actual === "function" && actual.name) {
-      msg += ` Received function ${actual.name}`;
-    } else if (typeof actual === "object" && actual != null) {
-      if (actual.constructor?.name) {
-        msg += ` Received an instance of ${actual.constructor.name}`;
-      }
-    }
-    return msg;
-  }
-  var invalidKeyInput, withAlg;
-  var init_invalid_key_input = __esm({
-    "../node_modules/jose/dist/webapi/lib/invalid_key_input.js"() {
-      invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
-      withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);
+      NON_ASCII = /[^\x00-\x7f]/;
     }
   });
 
@@ -36481,8 +36439,7 @@ return true;`);
         constructor(message2, options) {
           super(message2, options);
           __publicField(this, "code", "ERR_JOSE_GENERIC");
-          this.name = this.constructor.name;
-          Error.captureStackTrace?.(this, this.constructor);
+          this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);
         }
       };
       __publicField(JOSEError, "code", "ERR_JOSE_GENERIC");
@@ -36493,9 +36450,7 @@ return true;`);
           __publicField(this, "claim");
           __publicField(this, "reason");
           __publicField(this, "payload");
-          this.claim = claim;
-          this.reason = reason;
-          this.payload = payload;
+          this.claim = claim, this.reason = reason, this.payload = payload;
         }
       };
       __publicField(JWTClaimValidationFailed, "code", "ERR_JWT_CLAIM_VALIDATION_FAILED");
@@ -36506,9 +36461,7 @@ return true;`);
           __publicField(this, "claim");
           __publicField(this, "reason");
           __publicField(this, "payload");
-          this.claim = claim;
-          this.reason = reason;
-          this.payload = payload;
+          this.claim = claim, this.reason = reason, this.payload = payload;
         }
       };
       __publicField(JWTExpired, "code", "ERR_JWT_EXPIRED");
@@ -36601,187 +36554,6 @@ return true;`);
     }
   });
 
-  // ../node_modules/jose/dist/webapi/lib/is_key_like.js
-  function assertCryptoKey(key) {
-    if (!isCryptoKey(key)) {
-      throw new Error("CryptoKey instance expected");
-    }
-  }
-  var isCryptoKey, isKeyObject, isKeyLike;
-  var init_is_key_like = __esm({
-    "../node_modules/jose/dist/webapi/lib/is_key_like.js"() {
-      isCryptoKey = (key) => {
-        if (key?.[Symbol.toStringTag] === "CryptoKey")
-          return true;
-        try {
-          return key instanceof CryptoKey;
-        } catch {
-          return false;
-        }
-      };
-      isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
-      isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
-    }
-  });
-
-  // ../node_modules/jose/dist/webapi/lib/content_encryption.js
-  function checkCekLength(cek, expected) {
-    const actual = cek.byteLength << 3;
-    if (actual !== expected) {
-      throw new JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
-    }
-  }
-  function checkIvLength(enc, iv) {
-    if (iv.length << 3 !== enc.ivBits) {
-      throw new JWEInvalid("Invalid Initialization Vector length");
-    }
-  }
-  async function cbcKeySetup(enc, cek, usage) {
-    if (!(cek instanceof Uint8Array)) {
-      throw new TypeError(invalidKeyInput(cek, "Uint8Array"));
-    }
-    const keySize = enc.cekBits >> 1;
-    const encKey = await crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", false, [usage]);
-    const macKey = await crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
-      hash: `SHA-${keySize << 1}`,
-      name: "HMAC"
-    }, false, ["sign"]);
-    return [encKey, macKey, keySize];
-  }
-  async function cbcHmacTag(macKey, macData, keySize) {
-    return new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3));
-  }
-  async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-    const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, "encrypt");
-    const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-      iv,
-      name: "AES-CBC"
-    }, encKey, plaintext));
-    const macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8));
-    const tag2 = await cbcHmacTag(macKey, macData, keySize);
-    return { ciphertext, tag: tag2, iv };
-  }
-  async function timingSafeEqual(a, b) {
-    const algorithm = { name: "HMAC", hash: "SHA-256" };
-    const key = await crypto.subtle.generateKey(algorithm, false, ["sign", "verify"]);
-    const aHmac = await crypto.subtle.sign(algorithm, key, a);
-    return crypto.subtle.verify(algorithm, key, aHmac, b);
-  }
-  async function cbcDecrypt(enc, cek, ciphertext, iv, tag2, aad) {
-    const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, "decrypt");
-    const macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8));
-    const expectedTag = await cbcHmacTag(macKey, macData, keySize);
-    try {
-      if (await timingSafeEqual(tag2, expectedTag)) {
-        return new Uint8Array(await crypto.subtle.decrypt({ iv, name: "AES-CBC" }, encKey, ciphertext));
-      }
-    } catch {
-    }
-    throw new JWEDecryptionFailed();
-  }
-  async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-    const encKey = cek instanceof Uint8Array ? await crypto.subtle.importKey("raw", cek, "AES-GCM", false, [
-      "encrypt"
-    ]) : (checkCryptoKey(cek, enc.subtle, "encrypt"), cek);
-    const encrypted = new Uint8Array(await crypto.subtle.encrypt({
-      additionalData: aad,
-      iv,
-      name: "AES-GCM",
-      tagLength: 128
-    }, encKey, plaintext));
-    const tag2 = encrypted.slice(-16);
-    const ciphertext = encrypted.slice(0, -16);
-    return { ciphertext, tag: tag2, iv };
-  }
-  async function gcmDecrypt(enc, cek, ciphertext, iv, tag2, aad) {
-    const encKey = cek instanceof Uint8Array ? await crypto.subtle.importKey("raw", cek, "AES-GCM", false, [
-      "decrypt"
-    ]) : (checkCryptoKey(cek, enc.subtle, "decrypt"), cek);
-    try {
-      return new Uint8Array(await crypto.subtle.decrypt({
-        additionalData: aad,
-        iv,
-        name: "AES-GCM",
-        tagLength: 128
-      }, encKey, concat(ciphertext, tag2)));
-    } catch {
-      throw new JWEDecryptionFailed();
-    }
-  }
-  async function encrypt(enc, plaintext, cek, iv, aad) {
-    if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
-      throw new TypeError(invalidKeyInput(cek, "CryptoKey", "KeyObject", "Uint8Array", "JSON Web Key"));
-    }
-    if (iv) {
-      checkIvLength(enc, iv);
-    } else {
-      iv = generateIv(enc);
-    }
-    if (cek instanceof Uint8Array) {
-      checkCekLength(cek, enc.cekBits);
-    }
-    return enc.cbc ? cbcEncrypt(enc, plaintext, cek, iv, aad) : gcmEncrypt(enc, plaintext, cek, iv, aad);
-  }
-  async function decrypt(enc, cek, ciphertext, iv, tag2, aad) {
-    if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
-      throw new TypeError(invalidKeyInput(cek, "CryptoKey", "KeyObject", "Uint8Array", "JSON Web Key"));
-    }
-    if (!iv) {
-      throw new JWEInvalid("JWE Initialization Vector missing");
-    }
-    if (!tag2) {
-      throw new JWEInvalid("JWE Authentication Tag missing");
-    }
-    if (!enc.cbc && tag2.length !== 16) {
-      throw new JWEInvalid("Invalid Authentication Tag length");
-    }
-    checkIvLength(enc, iv);
-    if (cek instanceof Uint8Array) {
-      checkCekLength(cek, enc.cekBits);
-    }
-    return enc.cbc ? cbcDecrypt(enc, cek, ciphertext, iv, tag2, aad) : gcmDecrypt(enc, cek, ciphertext, iv, tag2, aad);
-  }
-  var generateCek, generateIv;
-  var init_content_encryption = __esm({
-    "../node_modules/jose/dist/webapi/lib/content_encryption.js"() {
-      init_buffer_utils();
-      init_crypto_key();
-      init_invalid_key_input();
-      init_errors();
-      init_is_key_like();
-      generateCek = (enc) => crypto.getRandomValues(new Uint8Array(enc.cekBits >> 3));
-      generateIv = (enc) => crypto.getRandomValues(new Uint8Array(enc.ivBits >> 3));
-    }
-  });
-
-  // ../node_modules/jose/dist/webapi/lib/base64.js
-  function encodeBase64(input) {
-    if (Uint8Array.prototype.toBase64) {
-      return input.toBase64();
-    }
-    const CHUNK_SIZE = 32768;
-    const arr = [];
-    for (let i = 0; i < input.length; i += CHUNK_SIZE) {
-      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-    }
-    return btoa(arr.join(""));
-  }
-  function decodeBase64(encoded) {
-    if (Uint8Array.fromBase64) {
-      return Uint8Array.fromBase64(encoded);
-    }
-    const binary = atob(encoded);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-      bytes[i] = binary.charCodeAt(i);
-    }
-    return bytes;
-  }
-  var init_base64 = __esm({
-    "../node_modules/jose/dist/webapi/lib/base64.js"() {
-    }
-  });
-
   // ../node_modules/jose/dist/webapi/util/base64url.js
   var base64url_exports = {};
   __export(base64url_exports, {
@@ -36789,58 +36561,31 @@ return true;`);
     encode: () => encode2
   });
   function decode(input) {
-    if (Uint8Array.fromBase64) {
-      try {
-        return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), {
-          alphabet: "base64url"
-        });
-      } catch (cause) {
-        throw new TypeError(invalid, { cause });
-      }
-    }
-    let encoded = input;
-    if (encoded instanceof Uint8Array) {
-      encoded = decoder.decode(encoded);
-    }
-    if (encoded.includes("+") || encoded.includes("/")) {
-      throw new TypeError(invalid);
-    }
-    encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
     try {
-      return decodeBase64(encoded);
-    } catch {
-      throw new TypeError(invalid);
+      return decodeBase64(typeof input == "string" ? input : decoder.decode(input), true);
+    } catch (cause) {
+      throw new TypeError(invalid, { cause });
     }
   }
   function encode2(input) {
-    let unencoded = input;
-    if (typeof unencoded === "string") {
-      unencoded = encoder.encode(unencoded);
-    }
-    if (Uint8Array.prototype.toBase64) {
-      return unencoded.toBase64({ alphabet: "base64url", omitPadding: true });
-    }
-    return encodeBase64(unencoded).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+    return encodeBase64(typeof input == "string" ? encoder.encode(input) : input, true);
   }
   var invalid;
   var init_base64url = __esm({
     "../node_modules/jose/dist/webapi/util/base64url.js"() {
       init_buffer_utils();
-      init_base64();
       invalid = "The input to be decoded is not correctly encoded.";
     }
   });
 
-  // ../node_modules/jose/dist/webapi/lib/type_checks.js
+  // ../node_modules/jose/dist/webapi/lib/validate.js
   function assertUint8Array(input, label) {
-    if (!(input instanceof Uint8Array)) {
+    if (!(input instanceof Uint8Array))
       throw new TypeError(`${label} must be an instance of Uint8Array`);
-    }
   }
   function isObject(input) {
-    if (typeof input !== "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]") {
+    if (typeof input != "object" || input === null || Object.prototype.toString.call(input) !== "[object Object]")
       return false;
-    }
     const prototype = Object.getPrototypeOf(input);
     return prototype === null || Object.getPrototypeOf(prototype) === null;
   }
@@ -36849,28 +36594,18 @@ return true;`);
   }
   function isDisjoint(...headers) {
     const parameters = /* @__PURE__ */ new Set();
-    for (const header of headers) {
-      if (!header)
-        continue;
-      for (const parameter of Object.keys(header)) {
-        if (parameters.has(parameter)) {
-          return false;
+    for (const header of headers)
+      if (header)
+        for (const parameter of Object.keys(header)) {
+          if (parameters.has(parameter))
+            return false;
+          parameters.add(parameter);
         }
-        parameters.add(parameter);
-      }
-    }
     return true;
   }
-  var init_type_checks = __esm({
-    "../node_modules/jose/dist/webapi/lib/type_checks.js"() {
-    }
-  });
-
-  // ../node_modules/jose/dist/webapi/lib/helpers.js
   function assertNotSet(value, name) {
-    if (value !== void 0) {
+    if (value !== void 0)
       throw new TypeError(`${name} can only be called once`);
-    }
   }
   function decodeBase64url(value, label, ErrorClass) {
     try {
@@ -36886,10 +36621,6 @@ return true;`);
       throw new ErrorClass(`The ${label} is not a valid base64url string`);
     }
   }
-  async function digest(algorithm, data) {
-    const subtleDigest = `SHA-${algorithm.slice(-3)}`;
-    return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
-  }
   function parseJoseHeader(b64, ErrorClass, message2) {
     let parsed;
     try {
@@ -36897,208 +36628,311 @@ return true;`);
     } catch {
       throw new ErrorClass(message2);
     }
-    if (!isObject(parsed)) {
+    if (!isObject(parsed))
       throw new ErrorClass(message2);
-    }
     return parsed;
   }
-  var unprotected;
-  var init_helpers = __esm({
-    "../node_modules/jose/dist/webapi/lib/helpers.js"() {
-      init_base64url();
-      init_buffer_utils();
-      init_type_checks();
-      unprotected = /* @__PURE__ */ Symbol();
-    }
-  });
-
-  // ../node_modules/jose/dist/webapi/lib/jwk_to_key.js
-  async function jwkToKey(entry, jwk) {
-    if (jwk.kty === "RSA" && "oth" in jwk && jwk.oth !== void 0) {
-      throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+  function validateAlgorithms(option, algorithms) {
+    if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != "string")))
+      throw new TypeError(`"${option}" option must be an array of strings`);
+    return algorithms === void 0 ? void 0 : new Set(algorithms);
+  }
+  function validateCritDuplicates(Err, protectedHeader) {
+    const { crit } = protectedHeader ?? {};
+    if (Array.isArray(crit) && new Set(crit).size !== crit.length)
+      throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values');
+  }
+  function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
+    if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)
+      throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
+    if (!protectedHeader || protectedHeader.crit === void 0)
+      return [];
+    if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != "string" || input.length === 0))
+      throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
+    const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
+    for (const parameter of protectedHeader.crit) {
+      if (!(parameter in recognized))
+        throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
+      if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)
+        throw new Err(`Extension Header Parameter "${parameter}" is missing`);
+      if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))
+        throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
     }
-    if (!entry.kty.includes(jwk.kty)) {
-      throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+    return protectedHeader.crit;
+  }
+  function validateB64(protectedHeader, extensions) {
+    if (extensions.includes("b64")) {
+      const b64 = protectedHeader.b64;
+      if (typeof b64 != "boolean")
+        throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+      return b64;
     }
-    const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle;
-    const isPrivate = !!(jwk.d || jwk.priv);
-    const keyData = { ...jwk };
-    if (keyData.kty !== "AKP") {
-      delete keyData.alg;
+    return true;
+  }
+  function serializeJoseHeader(Err, header) {
+    let serialized, parsed;
+    try {
+      serialized = JSON.stringify(header), parsed = JSON.parse(serialized);
+    } catch (cause) {
+      throw new Err("JOSE Header is not valid JSON", { cause });
     }
-    delete keyData.use;
-    return crypto.subtle.importKey("jwk", keyData, algorithm, jwk.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
+    if (!isObject(parsed))
+      throw new Err("JOSE Header is not a JSON object");
+    return [parsed, serialized];
   }
-  var init_jwk_to_key = __esm({
-    "../node_modules/jose/dist/webapi/lib/jwk_to_key.js"() {
+  var JWS_RECOGNIZED, JWE_RECOGNIZED;
+  var init_validate2 = __esm({
+    "../node_modules/jose/dist/webapi/lib/validate.js"() {
       init_errors();
+      init_base64url();
+      init_buffer_utils();
+      JWS_RECOGNIZED = { __proto__: null, b64: true };
+      JWE_RECOGNIZED = { __proto__: null };
     }
   });
 
-  // ../node_modules/jose/dist/webapi/lib/jwk_metadata.js
+  // ../node_modules/jose/dist/webapi/lib/key.js
+  async function prepareKey(entry, key, usage) {
+    const { alg, secret } = entry, privateKey = usage === "decrypt" || usage === "sign";
+    if (secret && key instanceof Uint8Array)
+      return key;
+    let normalized, keyObject;
+    if (isObject(key)) {
+      if (normalized = normalizeJwk(key), typeof normalized.kty != "string")
+        throw invalidKeyType(alg, key, secret);
+      if (!(secret ? normalized.kty === "oct" && typeof normalized.k == "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv == "string" || typeof normalized.d == "string" : normalized.d === void 0 && normalized.priv === void 0)))
+        throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
+      if (jwkMatchesOp(entry, normalized, usage), normalized.kty === "oct")
+        return decode(normalized.k);
+      if (!Object.isFrozen(key)) {
+        const { key_ops } = key;
+        Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);
+      }
+    } else {
+      if (!isKeyLike(key))
+        throw invalidKeyType(alg, key, secret);
+      const expectedType = secret ? "secret" : privateKey ? "private" : "public";
+      if (key.type !== expectedType && (secret || ["secret", "public", "private"].includes(key.type)))
+        throw new TypeError(`${tag(key)} instances must be of type "${expectedType}" for the ${alg} algorithm`);
+      if (isCryptoKey(key))
+        return key;
+      if (keyObject = key, keyObject.type === "secret")
+        return keyObject.export();
+    }
+    cache || (cache = /* @__PURE__ */ new WeakMap());
+    const cacheKey = key;
+    let cached = cache.get(cacheKey);
+    if (cached?.[alg])
+      return cached[alg];
+    if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == "function") {
+      const isPublic = keyObject.type === "public", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;
+      return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);
+    }
+    return normalized ?? (normalized = keyObject.export({ format: "jwk" })), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);
+  }
+  function assertCryptoKey(key) {
+    if (!isCryptoKey(key))
+      throw new Error("CryptoKey instance expected");
+  }
+  function message(msg, actual, ...types) {
+    if (types.length > 2) {
+      const last = types.pop();
+      msg += `one of type ${types.join(", ")}, or ${last}.`;
+    } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;
+    return actual == null ? msg += ` Received ${actual}` : typeof actual == "function" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == "object" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;
+  }
+  function invalidKeyType(alg, actual, secret) {
+    const types = ["CryptoKey", "KeyObject", "JSON Web Key"];
+    return secret && types.push("Uint8Array"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));
+  }
+  function checkUsage(key, usage) {
+    if (usage && !key.usages.includes(usage))
+      throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+  }
+  function checkModulusLength(alg, key) {
+    const { modulusLength } = key.algorithm;
+    if (typeof modulusLength != "number" || modulusLength < 2048)
+      throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+  }
+  function checkCryptoKey(key, expected, usage) {
+    const algorithm = key.algorithm;
+    if (algorithm.name !== expected.name)
+      throw unusable(expected.name);
+    if (expected.hash && algorithm.hash?.name !== expected.hash)
+      throw unusable(expected.hash, "algorithm.hash");
+    if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)
+      throw unusable(expected.namedCurve, "algorithm.namedCurve");
+    if (expected.length !== void 0 && algorithm.length !== expected.length)
+      throw unusable(expected.length, "algorithm.length");
+    checkUsage(key, usage);
+  }
   function snapshotJwk(jwk) {
     return { __proto__: null, ...jwk };
   }
   function normalizeJwk(jwk) {
     const normalized = snapshotJwk(jwk);
-    if (normalized.ext !== void 0 && typeof normalized.ext !== "boolean") {
+    if (normalized.ext !== void 0 && typeof normalized.ext != "boolean")
       throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
-    }
     if (normalized.key_ops !== void 0) {
-      const value = normalized.key_ops;
-      const keyOps = Array.isArray(value) ? [...value] : void 0;
-      if (!keyOps || keyOps.some((operation) => typeof operation !== "string") || new Set(keyOps).size !== keyOps.length) {
+      const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;
+      if (!keyOps || keyOps.some((operation) => typeof operation != "string") || new Set(keyOps).size !== keyOps.length)
         throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
-      }
       normalized.key_ops = keyOps;
     }
     return normalized;
   }
-  var init_jwk_metadata = __esm({
-    "../node_modules/jose/dist/webapi/lib/jwk_metadata.js"() {
-    }
-  });
-
-  // ../node_modules/jose/dist/webapi/lib/key.js
-  function checkKeyType(entry, key, usage) {
-    const { alg, secret } = entry;
-    const privateKey = usage === "decrypt" || usage === "sign";
-    if (secret && key instanceof Uint8Array)
-      return [BYTES, key];
-    if (isObject(key)) {
-      const normalized = normalizeJwk(key);
-      if (typeof normalized.kty !== "string") {
-        throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
-      }
-      const valid = secret ? normalized.kty === "oct" && typeof normalized.k === "string" : normalized.kty !== "oct" && (privateKey ? normalized.kty === "AKP" && typeof normalized.priv === "string" || typeof normalized.d === "string" : normalized.d === void 0 && normalized.priv === void 0);
-      if (!valid) {
-        throw new TypeError(secret ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present` : `JSON Web Key for this operation must be a ${privateKey ? "private" : "public"} JWK`);
-      }
-      jwkMatchesOp(entry, normalized, usage);
-      return [JWK, key, normalized];
-    }
-    if (!isKeyLike(key)) {
-      throw new TypeError(secret ? withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key", "Uint8Array") : withAlg(alg, key, "CryptoKey", "KeyObject", "JSON Web Key"));
-    }
-    if (secret) {
-      if (key.type !== "secret") {
-        throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
-      }
-    } else {
-      if (key.type === "secret") {
-        throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
-      }
-      const expectedType = privateKey ? "private" : "public";
-      if ((key.type === "public" || key.type === "private") && key.type !== expectedType) {
-        const operation = usage === "sign" ? "signing" : usage === "verify" ? "verifying" : `${usage.slice(0, -1)}tion`;
-        throw new TypeError(`${tag(key)} instances for asymmetric algorithm ${operation} must be of type "${expectedType}"`);
-      }
-    }
-    return isCryptoKey(key) ? [CRYPTO, key] : [KEYOBJECT, key];
+  function validateExtractableOption(extractable) {
+    if (extractable !== void 0 && typeof extractable != "boolean")
+      throw new TypeError('"extractable" option must be a boolean');
+    return extractable;
   }
-  function cached(key, alg, value) {
-    cache || (cache = /* @__PURE__ */ new WeakMap());
-    const entry = cache.get(key);
-    if (value) {
-      if (entry) {
-        entry[alg] = value;
-      } else {
-        cache.set(key, { [alg]: value });
-      }
-    }
-    return value ?? entry?.[alg];
+  async function jwkToKey(entry, jwk, extractable) {
+    if (!entry.kty.includes(jwk.kty))
+      throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+    const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };
+    return keyData.kty !== "AKP" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey("jwk", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);
   }
-  async function prepareKey(entry, key, usage) {
-    const tagged = checkKeyType(entry, key, usage);
-    switch (tagged[0]) {
-      case BYTES:
-      case CRYPTO:
-        return tagged[1];
-      case JWK: {
-        const key2 = tagged[1];
-        const normalized = tagged[2];
-        if (normalized.kty === "oct") {
-          return decode(normalized.k);
-        }
-        if (!Object.isFrozen(key2)) {
-          const { key_ops } = key2;
-          if (Array.isArray(key_ops))
-            Object.freeze(key_ops);
-          Object.freeze(key2);
-        }
-        return handleJWK(key2, normalized, entry);
-      }
-      case KEYOBJECT: {
-        const keyObject = tagged[1];
-        if (keyObject.type === "secret") {
-          return keyObject.export();
-        }
-        if ("toCryptoKey" in keyObject && typeof keyObject.toCryptoKey === "function") {
-          return handleKeyObject(keyObject, entry);
-        }
-        return handleJWK(keyObject, keyObject.export({ format: "jwk" }), entry);
-      }
-    }
+  async function rawKey(key, expected, usage, extractable = false) {
+    return key instanceof Uint8Array && (key = await crypto.subtle.importKey("raw", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;
   }
-  var tag, jwkMatchesOp, BYTES, CRYPTO, KEYOBJECT, JWK, cache, nist, handleJWK, handleKeyObject;
+  var tag, jwkMatchesOp, cache, nist, isCryptoKey, isKeyObject, isKeyLike, invalidKeyInput, unusable;
   var init_key = __esm({
     "../node_modules/jose/dist/webapi/lib/key.js"() {
-      init_invalid_key_input();
-      init_is_key_like();
-      init_type_checks();
+      init_validate2();
       init_base64url();
-      init_jwk_to_key();
-      init_jwk_metadata();
+      init_errors();
       tag = (key) => key[Symbol.toStringTag];
       jwkMatchesOp = (entry, key, usage) => {
         const { alg } = entry;
         if (key.use !== void 0) {
           const expected = usage === "sign" || usage === "verify" ? "sig" : "enc";
-          if (key.use !== expected) {
+          if (key.use !== expected)
             throw new TypeError(`Invalid key for this operation, its "use" must be "${expected}" when present`);
-          }
         }
-        if (key.alg !== void 0 && key.alg !== alg) {
+        if (key.alg !== void 0 && key.alg !== alg)
           throw new TypeError(`Invalid key for this operation, its "alg" must be "${alg}" when present`);
-        }
         if (Array.isArray(key.key_ops)) {
           const expectedKeyOp = usage === "encrypt" || usage === "decrypt" ? entry.ops?.[usage === "encrypt" ? 0 : 1] : usage;
-          if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp)) {
+          if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))
             throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${expectedKeyOp}" when present`);
-          }
         }
       };
-      BYTES = 0;
-      CRYPTO = 1;
-      KEYOBJECT = 2;
-      JWK = 3;
       nist = {
         __proto__: null,
         prime256v1: "P-256",
         secp384r1: "P-384",
         secp521r1: "P-521"
       };
-      handleJWK = async (key, jwk, entry) => cached(key, entry.alg) ?? cached(key, entry.alg, await jwkToKey(entry, { ...jwk, alg: entry.alg }));
-      handleKeyObject = (keyObject, entry) => {
-        const hit = cached(keyObject, entry.alg);
-        if (hit)
-          return hit;
-        const isPublic = keyObject.type === "public";
-        const usages = entry.usages[isPublic ? 0 : 1];
-        const { asymmetricKeyType } = keyObject;
-        const crv = nist[keyObject.asymmetricKeyDetails?.namedCurve];
-        const params = entry.resolve?.({ crv, asymmetricKeyType }) ?? entry.subtle;
-        return cached(keyObject, entry.alg, keyObject.toCryptoKey(params, isPublic, usages));
+      isCryptoKey = (key) => {
+        if (key?.[Symbol.toStringTag] === "CryptoKey")
+          return true;
+        try {
+          return key instanceof CryptoKey;
+        } catch {
+          return false;
+        }
       };
+      isKeyObject = (key) => key?.[Symbol.toStringTag] === "KeyObject";
+      isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);
+      invalidKeyInput = (actual, ...types) => message("Key must be ", actual, ...types);
+      unusable = (name, prop = "algorithm.name") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+    }
+  });
+
+  // ../node_modules/jose/dist/webapi/lib/content_encryption.js
+  function checkCekLength(cek, expected) {
+    const actual = cek.byteLength << 3;
+    if (actual !== expected)
+      throw new JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
+  }
+  function checkIvLength(enc, iv) {
+    if (iv.length << 3 !== enc.ivBits)
+      throw new JWEInvalid("Invalid Initialization Vector length");
+  }
+  async function cbcKeySetup(enc, cek, usage) {
+    if (!(cek instanceof Uint8Array))
+      throw new TypeError(invalidKeyInput(cek, "Uint8Array"));
+    const keySize = enc.cekBits >> 1, encKey = await crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", false, [usage]), macKey = await crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
+      hash: `SHA-${keySize << 1}`,
+      name: "HMAC"
+    }, false, ["sign"]);
+    return [encKey, macKey, keySize];
+  }
+  async function cbcHmacTag(macKey, macData, keySize) {
+    return new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3));
+  }
+  async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
+    const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, "encrypt"), ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+      iv,
+      name: "AES-CBC"
+    }, encKey, plaintext)), macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8)), tag2 = await cbcHmacTag(macKey, macData, keySize);
+    return { ciphertext, tag: tag2, iv };
+  }
+  async function timingSafeEqual(a, b) {
+    const algorithm = { name: "HMAC", hash: "SHA-256" }, key = await crypto.subtle.generateKey(algorithm, false, ["sign", "verify"]), aHmac = await crypto.subtle.sign(algorithm, key, a);
+    return crypto.subtle.verify(algorithm, key, aHmac, b);
+  }
+  async function cbcDecrypt(enc, cek, ciphertext, iv, tag2, aad) {
+    const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, "decrypt"), macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8)), expectedTag = await cbcHmacTag(macKey, macData, keySize);
+    try {
+      if (await timingSafeEqual(tag2, expectedTag))
+        return new Uint8Array(await crypto.subtle.decrypt({ iv, name: "AES-CBC" }, encKey, ciphertext));
+    } catch {
+    }
+    throw new JWEDecryptionFailed();
+  }
+  async function encrypt(enc, plaintext, cek, iv, aad) {
+    if (!isCryptoKey(cek) && !(cek instanceof Uint8Array))
+      throw new TypeError(invalidKeyInput(cek, "CryptoKey", "KeyObject", "Uint8Array", "JSON Web Key"));
+    if (iv ? checkIvLength(enc, iv) : iv = generateIv(enc), cek instanceof Uint8Array && checkCekLength(cek, enc.cekBits), enc.cbc)
+      return cbcEncrypt(enc, plaintext, cek, iv, aad);
+    const encKey = await rawKey(cek, enc.subtle, "encrypt"), encrypted = new Uint8Array(await crypto.subtle.encrypt({
+      additionalData: aad,
+      iv,
+      name: "AES-GCM",
+      tagLength: 128
+    }, encKey, plaintext));
+    return { ciphertext: encrypted.subarray(0, -16), tag: encrypted.subarray(-16), iv };
+  }
+  async function decrypt(enc, cek, ciphertext, iv, tag2, aad) {
+    if (!isCryptoKey(cek) && !(cek instanceof Uint8Array))
+      throw new TypeError(invalidKeyInput(cek, "CryptoKey", "KeyObject", "Uint8Array", "JSON Web Key"));
+    if (!iv)
+      throw new JWEInvalid("JWE Initialization Vector missing");
+    if (!tag2)
+      throw new JWEInvalid("JWE Authentication Tag missing");
+    if (!enc.cbc && tag2.length !== 16)
+      throw new JWEInvalid("Invalid Authentication Tag length");
+    if (checkIvLength(enc, iv), cek instanceof Uint8Array && checkCekLength(cek, enc.cekBits), enc.cbc)
+      return cbcDecrypt(enc, cek, ciphertext, iv, tag2, aad);
+    const encKey = await rawKey(cek, enc.subtle, "decrypt");
+    try {
+      return new Uint8Array(await crypto.subtle.decrypt({
+        additionalData: aad,
+        iv,
+        name: "AES-GCM",
+        tagLength: 128
+      }, encKey, concat(ciphertext, tag2)));
+    } catch {
+      throw new JWEDecryptionFailed();
+    }
+  }
+  var generateCek, generateIv;
+  var init_content_encryption = __esm({
+    "../node_modules/jose/dist/webapi/lib/content_encryption.js"() {
+      init_buffer_utils();
+      init_key();
+      init_errors();
+      generateCek = (enc) => crypto.getRandomValues(new Uint8Array(enc.cekBits >> 3));
+      generateIv = (enc) => crypto.getRandomValues(new Uint8Array(enc.ivBits >> 3));
     }
   });
 
   // ../node_modules/jose/dist/webapi/lib/key_descriptor.js
   function table(entries) {
     const out = { __proto__: null };
-    for (const alg in entries) {
+    for (const alg in entries)
       out[alg] = { ...entries[alg], alg };
-    }
     return out;
   }
   var init_key_descriptor = __esm({
@@ -37110,22 +36944,22 @@ return true;`);
   function rsaes(bits) {
     return {
       kty: ["RSA"],
+      mode: "key-encryption",
       subtle: { name: "RSA-OAEP", hash: `SHA-${bits}` },
       usages: wrap,
       ops: ["wrapKey", "unwrapKey"]
     };
   }
-  function ecdh() {
+  function ecdh(mode) {
     return {
       kty: ["EC", "OKP"],
+      mode,
       subtle: { name: "ECDH" },
       resolve: ({ kty, crv, asymmetricKeyType }) => {
-        if (crv === "X25519" || asymmetricKeyType === "x25519") {
+        if (crv === "X25519" || asymmetricKeyType === "x25519")
           return { name: "X25519" };
-        }
-        if (kty === "OKP") {
+        if (kty === "OKP")
           throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-        }
         return { name: "ECDH", namedCurve: crv };
       },
       usages: derive,
@@ -37135,6 +36969,7 @@ return true;`);
   function aeskw(bits, gcm = false) {
     return {
       kty: ["oct"],
+      mode: "key-wrapping",
       secret: true,
       subtle: { name: gcm ? "AES-GCM" : "AES-KW", length: bits },
       usages: none,
@@ -37144,6 +36979,7 @@ return true;`);
   function pbes2() {
     return {
       kty: ["oct"],
+      mode: "key-wrapping",
       secret: true,
       subtle: { name: "PBKDF2" },
       usages: none,
@@ -37166,10 +37002,13 @@ return true;`);
     throw new JOSENotSupported(`Invalid or unsupported "${parameter}" (JWE ${name}) header value`);
   }
   function jweAlgorithm(alg) {
-    return (typeof alg === "string" ? JWE[alg] : void 0) ?? unsupported("alg", "Algorithm");
+    return (typeof alg == "string" ? JWE[alg] : void 0) ?? unsupported("alg", "Algorithm");
+  }
+  function isJWECEKTransport(algorithm) {
+    return algorithm.mode === "key-wrapping" || algorithm.mode === "key-encryption" || algorithm.mode === "key-agreement-with-key-wrapping";
   }
   function jweEncryption(enc) {
-    return (typeof enc === "string" ? ENC[enc] : void 0) ?? unsupported("enc", "Encryption Algorithm");
+    return (typeof enc == "string" ? ENC[enc] : void 0) ?? unsupported("enc", "Encryption Algorithm");
   }
   var wrap, derive, none, JWE, contentOps, ENC;
   var init_jwe_algorithms = __esm({
@@ -37185,6 +37024,7 @@ return true;`);
       JWE = table({
         dir: {
           kty: ["oct"],
+          mode: "direct-encryption",
           secret: true,
           subtle: { name: "AES-GCM" },
           usages: none,
@@ -37194,10 +37034,10 @@ return true;`);
         "RSA-OAEP-256": rsaes(256),
         "RSA-OAEP-384": rsaes(384),
         "RSA-OAEP-512": rsaes(512),
-        "ECDH-ES": ecdh(),
-        "ECDH-ES+A128KW": ecdh(),
-        "ECDH-ES+A192KW": ecdh(),
-        "ECDH-ES+A256KW": ecdh(),
+        "ECDH-ES": ecdh("direct-key-agreement"),
+        "ECDH-ES+A128KW": ecdh("key-agreement-with-key-wrapping"),
+        "ECDH-ES+A192KW": ecdh("key-agreement-with-key-wrapping"),
+        "ECDH-ES+A256KW": ecdh("key-agreement-with-key-wrapping"),
         A128KW: aeskw(128),
         A192KW: aeskw(192),
         A256KW: aeskw(256),
@@ -37222,68 +37062,39 @@ return true;`);
 
   // ../node_modules/jose/dist/webapi/lib/key_management.js
   function checkEcdhCryptoKey(key, usage) {
-    if (key.algorithm.name !== "ECDH" && key.algorithm.name !== "X25519") {
+    if (key.algorithm.name !== "ECDH" && key.algorithm.name !== "X25519")
       throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");
-    }
     checkUsage(key, usage);
   }
-  async function aeskwCryptoKey(key, alg, usage) {
-    const expected = jweAlgorithm(alg).subtle;
-    const cryptoKey = key instanceof Uint8Array ? await crypto.subtle.importKey("raw", key, "AES-KW", true, [
-      usage
-    ]) : key;
-    checkCryptoKey(cryptoKey, expected, usage);
-    return cryptoKey;
-  }
   async function aeskwWrap(alg, key, cek) {
-    const cryptoKey = await aeskwCryptoKey(key, alg, "wrapKey");
-    const cryptoKeyCek = await crypto.subtle.importKey("raw", cek, { hash: "SHA-256", name: "HMAC" }, true, ["sign"]);
+    const cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "wrapKey", true), cryptoKeyCek = await crypto.subtle.importKey("raw", cek, { hash: "SHA-256", name: "HMAC" }, true, ["sign"]);
     return new Uint8Array(await crypto.subtle.wrapKey("raw", cryptoKeyCek, cryptoKey, "AES-KW"));
   }
   async function aeskwUnwrap(alg, key, encryptedKey) {
-    const cryptoKey = await aeskwCryptoKey(key, alg, "unwrapKey");
-    const cryptoKeyCek = await crypto.subtle.unwrapKey("raw", encryptedKey, cryptoKey, "AES-KW", { hash: "SHA-256", name: "HMAC" }, true, ["sign"]);
+    const cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "unwrapKey", true), cryptoKeyCek = await crypto.subtle.unwrapKey("raw", encryptedKey, cryptoKey, "AES-KW", { hash: "SHA-256", name: "HMAC" }, true, ["sign"]);
     return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
   }
   function checkRsaKey(alg, key, usage) {
-    checkCryptoKey(key, jweAlgorithm(alg).subtle, usage);
-    checkModulusLength(alg, key);
-  }
-  function pbes2CryptoKey(key, alg) {
-    if (key instanceof Uint8Array) {
-      return crypto.subtle.importKey("raw", key, "PBKDF2", false, [
-        "deriveBits"
-      ]);
-    }
-    checkCryptoKey(key, jweAlgorithm(alg).subtle, "deriveBits");
-    return key;
+    checkCryptoKey(key, jweAlgorithm(alg).subtle, usage), checkModulusLength(alg, key);
   }
   async function deriveKey(p2s, alg, p2c, key) {
-    if (!(p2s instanceof Uint8Array) || p2s.length < 8) {
+    if (!(p2s instanceof Uint8Array) || p2s.length < 8)
       throw new JWEInvalid("PBES2 Salt Input must be 8 or more octets");
-    }
-    if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1) {
+    if (!Number.isSafeInteger(p2c) || Math.sign(p2c) !== 1)
       throw new JWEInvalid("PBES2 Count Input must be a positive integer");
-    }
-    const salt = concat(encode(alg), Uint8Array.of(0), p2s);
-    const keylen = parseInt(alg.slice(13, 16), 10);
-    const subtleAlg = {
+    const salt = concat(encode(alg), Uint8Array.of(0), p2s), keylen = parseInt(alg.slice(13, 16), 10), subtleAlg = {
       hash: `SHA-${alg.slice(8, 11)}`,
       iterations: p2c,
       name: "PBKDF2",
       salt
-    };
-    const cryptoKey = await pbes2CryptoKey(key, alg);
+    }, cryptoKey = await rawKey(key, jweAlgorithm(alg).subtle, "deriveBits");
     return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
   }
   function lengthAndInput(input) {
     return concat(uint32be(input.length), input);
   }
   async function concatKdf(Z, L, OtherInfo) {
-    const dkLen = L >> 3;
-    const hashLen = 32;
-    const reps = Math.ceil(dkLen / hashLen);
-    const dk = new Uint8Array(reps * hashLen);
+    const dkLen = L >> 3, hashLen = 32, reps = Math.ceil(dkLen / hashLen), dk = new Uint8Array(reps * hashLen);
     for (let i = 1; i <= reps; i++) {
       const hashResult = await digest("sha256", concat(uint32be(i), Z, OtherInfo));
       dk.set(hashResult, (i - 1) * hashLen);
@@ -37291,10 +37102,8 @@ return true;`);
     return dk.slice(0, dkLen);
   }
   async function ecdhesDeriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(), apv = new Uint8Array()) {
-    checkEcdhCryptoKey(publicKey);
-    checkEcdhCryptoKey(privateKey, "deriveBits");
-    const otherInfo = concat(lengthAndInput(encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
-    const Z = new Uint8Array(await crypto.subtle.deriveBits({
+    checkEcdhCryptoKey(publicKey), checkEcdhCryptoKey(privateKey, "deriveBits");
+    const otherInfo = concat(lengthAndInput(encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength)), Z = new Uint8Array(await crypto.subtle.deriveBits({
       name: publicKey.algorithm.name,
       public: publicKey
     }, privateKey, publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3));
@@ -37303,8 +37112,23 @@ return true;`);
   function assertEcdhKey(key) {
     assertCryptoKey(key);
     const curve = key.algorithm.namedCurve;
-    if (curve !== "P-256" && curve !== "P-384" && curve !== "P-521" && key.algorithm.name !== "X25519") {
+    if (curve !== "P-256" && curve !== "P-384" && curve !== "P-521" && key.algorithm.name !== "X25519")
       throw new JOSENotSupported("ECDH with the provided key is not allowed or not supported by your javascript runtime");
+  }
+  function partyInfo(joseHeader, name) {
+    const value = joseHeader[name];
+    if (value !== void 0) {
+      if (typeof value != "string")
+        throw new JWEInvalid(`JOSE Header "${name}" (Agreement Party${name === "apu" ? "U" : "V"}Info) invalid`);
+      return decodeBase64url(value, name, JWEInvalid);
+    }
+  }
+  function checkPartyInfo(apu, apv) {
+    if (!(apu === void 0 || apv === void 0 || apu.byteLength !== apv.byteLength)) {
+      for (let i = 0; i < apu.byteLength; i++)
+        if (apu[i] !== apv[i])
+          return;
+      throw new JWEInvalid('JOSE Header "apu" and "apv" values must be distinct');
     }
   }
   function assertEncryptedKey(encryptedKey) {
@@ -37315,300 +37139,158 @@ return true;`);
     if (encryptedKey !== void 0)
       throw new JWEInvalid("Encountered unexpected JWE Encrypted Key");
   }
-  async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, maxPBES2Count) {
-    const entry = jweAlgorithm(alg);
-    if (alg === "dir") {
-      assertNoEncryptedKey(encryptedKey);
-      return key;
-    }
-    switch (entry.subtle.name) {
+  function validateMaxPBES2Count(value) {
+    if (value !== void 0 && value !== 1 / 0 && (!Number.isSafeInteger(value) || value < 1))
+      throw new TypeError("maxPBES2Count must be a positive safe integer or Infinity");
+  }
+  async function decryptKeyManagement(entry, enc, key, encryptedKey, joseHeader, maxPBES2Count) {
+    const { alg } = entry, mode = entry.mode;
+    if (mode === "direct-encryption")
+      return assertNoEncryptedKey(encryptedKey), key;
+    const direct = mode === "direct-key-agreement";
+    switch (direct ? assertNoEncryptedKey(encryptedKey) : assertEncryptedKey(encryptedKey), entry.subtle.name) {
       case "ECDH": {
-        if (alg === "ECDH-ES")
-          assertNoEncryptedKey(encryptedKey);
-        if (!isObject(joseHeader.epk))
-          throw new JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);
+        const { epk } = joseHeader;
+        if (!isObject(epk) || ["d", "k", "p", "q", "dp", "dq", "qi", "oth", "priv"].some((parameter) => Object.hasOwn(epk, parameter)))
+          throw new JWEInvalid('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');
         assertEcdhKey(key);
-        const epk = await jwkToKey(entry, joseHeader.epk);
-        let partyUInfo;
-        let partyVInfo;
-        if (joseHeader.apu !== void 0) {
-          if (typeof joseHeader.apu !== "string")
-            throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
-          partyUInfo = decodeBase64url(joseHeader.apu, "apu", JWEInvalid);
-        }
-        if (joseHeader.apv !== void 0) {
-          if (typeof joseHeader.apv !== "string")
-            throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
-          partyVInfo = decodeBase64url(joseHeader.apv, "apv", JWEInvalid);
-        }
-        const sharedSecret = await ecdhesDeriveKey(epk, key, alg === "ECDH-ES" ? enc.alg : alg, alg === "ECDH-ES" ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
-        if (alg === "ECDH-ES")
+        const ephemeralPublicKey = await jwkToKey(entry, epk), partyUInfo = partyInfo(joseHeader, "apu"), partyVInfo = partyInfo(joseHeader, "apv");
+        checkPartyInfo(partyUInfo, partyVInfo);
+        const sharedSecret = await ecdhesDeriveKey(ephemeralPublicKey, key, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
+        if (direct)
           return sharedSecret;
-        assertEncryptedKey(encryptedKey);
-        return aeskwUnwrap(alg.slice(-6), sharedSecret, encryptedKey);
-      }
-      case "RSA-OAEP": {
-        assertEncryptedKey(encryptedKey);
-        assertCryptoKey(key);
-        checkRsaKey(alg, key, "decrypt");
-        return new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
+        key = sharedSecret;
+        break;
       }
+      case "RSA-OAEP":
+        return assertCryptoKey(key), checkRsaKey(alg, key, "decrypt"), new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
       case "PBKDF2": {
-        assertEncryptedKey(encryptedKey);
-        if (typeof joseHeader.p2c !== "number")
-          throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-        const p2cLimit = maxPBES2Count || 1e4;
+        if (typeof joseHeader.p2c != "number")
+          throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) missing or invalid');
+        validateMaxPBES2Count(maxPBES2Count);
+        const p2cLimit = maxPBES2Count ?? 1e4;
         if (joseHeader.p2c > p2cLimit)
-          throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
-        if (typeof joseHeader.p2s !== "string")
-          throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
+          throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');
+        if (typeof joseHeader.p2s != "string")
+          throw new JWEInvalid('JOSE Header "p2s" (PBES2 Salt) missing or invalid');
         const p2s = decodeBase64url(joseHeader.p2s, "p2s", JWEInvalid);
-        const derived = await deriveKey(p2s, alg, joseHeader.p2c, key);
-        return aeskwUnwrap(alg.slice(-6), derived, encryptedKey);
-      }
-      case "AES-KW": {
-        assertEncryptedKey(encryptedKey);
-        return aeskwUnwrap(alg, key, encryptedKey);
+        key = await deriveKey(p2s, alg, joseHeader.p2c, key);
+        break;
       }
       case "AES-GCM": {
-        assertEncryptedKey(encryptedKey);
-        if (typeof joseHeader.iv !== "string")
-          throw new JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
-        if (typeof joseHeader.tag !== "string")
-          throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
-        let iv;
-        iv = decodeBase64url(joseHeader.iv, "iv", JWEInvalid);
-        let tag2;
-        tag2 = decodeBase64url(joseHeader.tag, "tag", JWEInvalid);
+        if (typeof joseHeader.iv != "string")
+          throw new JWEInvalid('JOSE Header "iv" (Initialization Vector) missing or invalid');
+        if (typeof joseHeader.tag != "string")
+          throw new JWEInvalid('JOSE Header "tag" (Authentication Tag) missing or invalid');
+        const iv = decodeBase64url(joseHeader.iv, "iv", JWEInvalid), tag2 = decodeBase64url(joseHeader.tag, "tag", JWEInvalid);
+        if (iv.byteLength !== 12)
+          throw new JWEInvalid("Invalid Initialization Vector length");
+        if (tag2.byteLength !== 16)
+          throw new JWEInvalid("Invalid Authentication Tag length");
         return decrypt(jweEncryption(alg.slice(0, -2)), key, encryptedKey, iv, tag2, new Uint8Array());
       }
     }
+    return aeskwUnwrap(alg.slice(-6), key, encryptedKey);
   }
-  async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
-    let encryptedKey;
-    let parameters;
-    let cek;
-    const entry = jweAlgorithm(alg);
-    if (alg === "dir")
+  async function encryptKeyManagement(entry, enc, inputKey, joseHeader, providedCek, providedParameters = {}) {
+    const { alg, mode } = entry, transport = isJWECEKTransport(entry);
+    if (providedCek !== void 0 && !transport)
+      throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+    let key = await prepareKey(mode === "direct-encryption" ? enc : entry, inputKey, "encrypt");
+    if (mode === "direct-encryption")
       return [key, void 0, void 0];
+    const cek = transport ? providedCek ?? generateCek(enc) : void 0;
+    cek && checkCekLength(cek, enc.cekBits);
+    let encryptedKey, parameters;
     switch (entry.subtle.name) {
       case "ECDH": {
         assertEcdhKey(key);
-        const { apu, apv } = providedParameters;
-        if (apu !== void 0) {
-          assertUint8Array(apu, '"apu"');
-        }
-        if (apv !== void 0) {
-          assertUint8Array(apv, '"apv"');
-        }
+        const { apu: providedApu, apv: providedApv } = providedParameters;
+        providedApu !== void 0 && assertUint8Array(providedApu, '"apu"'), providedApv !== void 0 && assertUint8Array(providedApv, '"apv"');
+        const apu = providedApu ?? partyInfo(joseHeader, "apu"), apv = providedApv ?? partyInfo(joseHeader, "apv");
+        checkPartyInfo(apu, apv);
         let ephemeralKey;
-        if (providedParameters.epk !== void 0) {
-          ephemeralKey = await prepareKey(entry, providedParameters.epk, "decrypt");
-        } else {
-          ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, true, ["deriveBits"])).privateKey;
-        }
+        providedParameters.epk !== void 0 ? ephemeralKey = await prepareKey(entry, providedParameters.epk, "decrypt") : ephemeralKey = (await crypto.subtle.generateKey(key.algorithm, true, ["deriveBits"])).privateKey;
         const subtle = crypto.subtle;
         let exportableEpk = ephemeralKey;
         if (!exportableEpk.extractable) {
-          if (typeof subtle.getPublicKey !== "function") {
+          if (typeof subtle.getPublicKey != "function")
             throw new TypeError('CryptoKey for "epk" must be extractable');
-          }
           exportableEpk = await subtle.getPublicKey(ephemeralKey, []);
         }
-        const { x, y, crv, kty } = await subtle.exportKey("jwk", exportableEpk);
-        const sharedSecret = await ecdhesDeriveKey(key, ephemeralKey, alg === "ECDH-ES" ? enc.alg : alg, alg === "ECDH-ES" ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv);
-        parameters = { epk: { x, crv, kty } };
-        if (kty === "EC")
-          parameters.epk.y = y;
-        if (apu)
-          parameters.apu = encode2(apu);
-        if (apv)
-          parameters.apv = encode2(apv);
-        if (alg === "ECDH-ES") {
-          cek = sharedSecret;
-          break;
-        }
-        cek = providedCek || generateCek(enc);
-        const kwAlg = alg.slice(-6);
-        encryptedKey = await aeskwWrap(kwAlg, sharedSecret, cek);
+        const { x, y, crv, kty } = await subtle.exportKey("jwk", exportableEpk), direct = mode === "direct-key-agreement", sharedSecret = await ecdhesDeriveKey(key, ephemeralKey, direct ? enc.alg : alg, direct ? enc.cekBits : parseInt(alg.slice(-5, -2), 10), apu, apv), epk = { x, crv, kty };
+        if (kty === "EC" && (epk.y = y), parameters = { epk }, providedApu !== void 0 && (parameters.apu = encode2(providedApu)), providedApv !== void 0 && (parameters.apv = encode2(providedApv)), direct)
+          return [sharedSecret, void 0, parameters];
+        key = sharedSecret;
         break;
       }
       case "RSA-OAEP": {
-        cek = providedCek || generateCek(enc);
-        assertCryptoKey(key);
-        checkRsaKey(alg, key, "encrypt");
-        encryptedKey = new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP", key, cek));
+        assertCryptoKey(key), checkRsaKey(alg, key, "encrypt"), encryptedKey = new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP", key, cek));
         break;
       }
       case "PBKDF2": {
-        cek = providedCek || generateCek(enc);
         const { p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16)) } = providedParameters;
-        const derived = await deriveKey(p2s, alg, p2c, key);
-        encryptedKey = await aeskwWrap(alg.slice(-6), derived, cek);
-        parameters = { p2c, p2s: encode2(p2s) };
-        break;
-      }
-      case "AES-KW": {
-        cek = providedCek || generateCek(enc);
-        encryptedKey = await aeskwWrap(alg, key, cek);
+        key = await deriveKey(p2s, alg, p2c, key), parameters = { p2c, p2s: encode2(p2s) };
         break;
       }
       case "AES-GCM": {
-        cek = providedCek || generateCek(enc);
-        const { iv } = providedParameters;
+        const iv = providedParameters.iv === void 0 ? crypto.getRandomValues(new Uint8Array(12)) : providedParameters.iv;
+        if (!(iv instanceof Uint8Array))
+          throw new TypeError('"iv" must be an instance of Uint8Array');
         const wrapped = await encrypt(jweEncryption(alg.slice(0, -2)), cek, key, iv, new Uint8Array());
-        encryptedKey = wrapped.ciphertext;
-        parameters = { iv: encode2(wrapped.iv), tag: encode2(wrapped.tag) };
-        break;
+        encryptedKey = wrapped.ciphertext, parameters = { iv: encode2(wrapped.iv), tag: encode2(wrapped.tag) };
       }
     }
+    if (encryptedKey ?? (encryptedKey = await aeskwWrap(alg.slice(-6), key, cek)), !(encryptedKey instanceof Uint8Array) || !encryptedKey.byteLength)
+      throw new TypeError("JWE key management algorithm did not produce an Encrypted Key");
     return [cek, encryptedKey, parameters];
   }
   var init_key_management = __esm({
     "../node_modules/jose/dist/webapi/lib/key_management.js"() {
       init_base64url();
       init_key();
-      init_jwk_to_key();
       init_jwe_algorithms();
       init_errors();
-      init_helpers();
-      init_content_encryption();
-      init_type_checks();
-      init_crypto_key();
+      init_validate2();
       init_buffer_utils();
-      init_is_key_like();
-    }
-  });
-
-  // ../node_modules/jose/dist/webapi/lib/options.js
-  function validateAlgorithms(option, algorithms) {
-    if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
-      throw new TypeError(`"${option}" option must be an array of strings`);
-    }
-    if (!algorithms) {
-      return void 0;
-    }
-    return new Set(algorithms);
-  }
-  function validateCritDuplicates(Err, protectedHeader) {
-    const { crit } = protectedHeader ?? {};
-    if (Array.isArray(crit) && new Set(crit).size !== crit.length) {
-      throw new Err('"crit" (Critical) Header Parameter MUST NOT contain duplicate values');
-    }
-  }
-  function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-    if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) {
-      throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
-    }
-    if (!protectedHeader || protectedHeader.crit === void 0) {
-      return [];
-    }
-    if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input !== "string" || input.length === 0)) {
-      throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
-    }
-    const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };
-    for (const parameter of protectedHeader.crit) {
-      if (!(parameter in recognized)) {
-        throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-      }
-      if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0) {
-        throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-      }
-      if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0)) {
-        throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-      }
-    }
-    return protectedHeader.crit;
-  }
-  function validateB64(protectedHeader, extensions) {
-    if (extensions.includes("b64")) {
-      const b64 = protectedHeader.b64;
-      if (typeof b64 !== "boolean") {
-        throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-      }
-      return b64;
-    }
-    return true;
-  }
-  function serializeJoseHeader(Err, header) {
-    let serialized;
-    let parsed;
-    try {
-      serialized = JSON.stringify(header);
-      parsed = JSON.parse(serialized);
-    } catch (cause) {
-      throw new Err("JOSE Header is not valid JSON", { cause });
-    }
-    if (!isObject(parsed)) {
-      throw new Err("JOSE Header is not a JSON object");
-    }
-    return [parsed, serialized];
-  }
-  var JWS_RECOGNIZED, JWE_RECOGNIZED;
-  var init_options = __esm({
-    "../node_modules/jose/dist/webapi/lib/options.js"() {
-      init_errors();
-      init_type_checks();
-      JWS_RECOGNIZED = { __proto__: null, b64: true };
-      JWE_RECOGNIZED = { __proto__: null };
+      init_content_encryption();
     }
   });
 
   // ../node_modules/jose/dist/webapi/lib/deflate.js
   function validateZip(joseHeader, protectedHeader) {
-    if (joseHeader.zip !== void 0 && joseHeader.zip !== "DEF") {
+    if (joseHeader.zip !== void 0 && joseHeader.zip !== "DEF")
       throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
-    }
-    if (joseHeader.zip !== void 0 && !protectedHeader?.zip) {
+    if (joseHeader.zip !== void 0 && !protectedHeader?.zip)
       throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
-    }
   }
   function supported(name) {
-    if (typeof globalThis[name] === "undefined") {
+    if (typeof globalThis[name] > "u")
       throw new JOSENotSupported(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${name} API.`);
-    }
   }
-  async function compress(input) {
-    supported("CompressionStream");
-    const cs = new CompressionStream("deflate-raw");
-    const writer = cs.writable.getWriter();
+  async function transform(stream, input, maxLength = 1 / 0) {
+    const writer = stream.writable.getWriter();
     writer.write(input).catch(() => {
-    });
-    writer.close().catch(() => {
-    });
-    const chunks = [];
-    const reader = cs.readable.getReader();
-    for (; ; ) {
-      const { value, done } = await reader.read();
-      if (done)
-        break;
-      chunks.push(value);
-    }
-    return concat(...chunks);
-  }
-  async function decompress(input, maxLength) {
-    supported("DecompressionStream");
-    const ds = new DecompressionStream("deflate-raw");
-    const writer = ds.writable.getWriter();
-    writer.write(input).catch(() => {
-    });
-    writer.close().catch(() => {
+    }), writer.close().catch(() => {
     });
     const chunks = [];
     let length = 0;
-    const reader = ds.readable.getReader();
+    const reader = stream.readable.getReader();
     for (; ; ) {
       const { value, done } = await reader.read();
       if (done)
         break;
-      chunks.push(value);
-      length += value.byteLength;
-      if (maxLength !== Infinity && length > maxLength) {
+      if (chunks.push(value), length += value.byteLength, maxLength !== 1 / 0 && length > maxLength)
         throw new JWEInvalid("Decompressed plaintext exceeded the configured limit");
-      }
     }
     return concat(...chunks);
   }
+  async function compress(input) {
+    return supported("CompressionStream"), transform(new CompressionStream("deflate-raw"), input);
+  }
+  async function decompress(input, maxLength) {
+    return supported("DecompressionStream"), transform(new DecompressionStream("deflate-raw"), input, maxLength);
+  }
   var init_deflate = __esm({
     "../node_modules/jose/dist/webapi/lib/deflate.js"() {
       init_errors();
@@ -37618,55 +37300,41 @@ return true;`);
 
   // ../node_modules/jose/dist/webapi/lib/jwe_decrypt.js
   function snapshotSharedJWE(jwe) {
-    const { aad, ciphertext, iv, protected: encodedProtected, tag: tag2, unprotected: unprotected2 } = jwe;
-    if (iv !== void 0 && typeof iv !== "string") {
+    const { aad, ciphertext, iv, protected: encodedProtected, tag: tag2, unprotected } = jwe;
+    if (iv !== void 0 && (typeof iv != "string" || !iv))
       throw new JWEInvalid("JWE Initialization Vector incorrect type");
-    }
-    if (typeof ciphertext !== "string") {
+    if (typeof ciphertext != "string")
       throw new JWEInvalid("JWE Ciphertext missing or incorrect type");
-    }
-    if (tag2 !== void 0 && typeof tag2 !== "string") {
+    if (tag2 !== void 0 && (typeof tag2 != "string" || !tag2))
       throw new JWEInvalid("JWE Authentication Tag incorrect type");
-    }
-    if (encodedProtected !== void 0 && typeof encodedProtected !== "string") {
+    if (encodedProtected !== void 0 && typeof encodedProtected != "string")
       throw new JWEInvalid("JWE Protected Header incorrect type");
-    }
-    if (aad !== void 0 && (typeof aad !== "string" || !aad)) {
+    if (aad !== void 0 && (typeof aad != "string" || !aad))
       throw new JWEInvalid("JWE AAD incorrect type");
-    }
-    if (unprotected2 !== void 0 && !isObject(unprotected2)) {
+    if (unprotected !== void 0 && !isObject(unprotected))
       throw new JWEInvalid("JWE Shared Unprotected Header incorrect type");
-    }
     return {
       aad,
       ciphertext,
       iv,
       protected: encodedProtected,
       tag: tag2,
-      unprotected: unprotected2 === void 0 ? void 0 : { ...unprotected2 }
+      unprotected: unprotected === void 0 ? void 0 : { ...unprotected }
     };
   }
   function snapshotRecipientJWE(recipient) {
-    let header;
-    let headerAlg;
+    let header, headerAlg;
     try {
       const { header: inputHeader } = recipient;
       if (isObject(inputHeader)) {
         headerAlg = inputHeader.alg;
         const parameters = Object.keys(inputHeader);
-        if (!parameters.includes("alg"))
-          headerAlg = void 0;
-        header = Object.fromEntries(parameters.map((parameter) => [
+        parameters.includes("alg") || (headerAlg = void 0), header = Object.fromEntries(parameters.map((parameter) => [
           parameter,
           parameter === "alg" ? headerAlg : inputHeader[parameter]
         ]));
-      } else {
+      } else
         header = inputHeader;
-      }
-    } catch (error) {
-      return [void 0, headerAlg, error];
-    }
-    try {
       const { encrypted_key: encryptedKey } = recipient;
       return [{ encrypted_key: encryptedKey, header }, headerAlg];
     } catch (error) {
@@ -37675,54 +37343,24 @@ return true;`);
   }
   function checkRecipient(jwe) {
     const { encrypted_key: encryptedKey, header } = jwe;
-    if (encryptedKey !== void 0 && typeof encryptedKey !== "string") {
+    if (encryptedKey !== void 0 && typeof encryptedKey != "string")
       throw new JWEInvalid("JWE Encrypted Key incorrect type");
-    }
-    if (header !== void 0) {
-      if (!isObject(header)) {
-        throw new JWEInvalid("JWE Per-Recipient Unprotected Header incorrect type");
-      }
-    }
-    if (jwe.protected === void 0 && header === void 0 && jwe.unprotected === void 0) {
+    if (header !== void 0 && !isObject(header))
+      throw new JWEInvalid("JWE Per-Recipient Unprotected Header incorrect type");
+    if (jwe.protected === void 0 && header === void 0 && jwe.unprotected === void 0)
       throw new JWEInvalid("JOSE Header missing");
-    }
   }
   function shareJWE(jwe) {
     const { protected: encodedProtected, ciphertext, iv, tag: tag2, aad } = jwe;
     let parsedProt;
-    if (encodedProtected !== void 0) {
-      parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, "JWE Protected Header is invalid");
-    }
-    const protectedHeader = encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array();
-    return [
+    return encodedProtected !== void 0 && (parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, "JWE Protected Header is invalid")), [
       parsedProt,
       decodeBase64url(ciphertext, "ciphertext", JWEInvalid),
       iv !== void 0 ? decodeBase64url(iv, "iv", JWEInvalid) : void 0,
       tag2 !== void 0 ? decodeBase64url(tag2, "tag", JWEInvalid) : void 0,
-      aad !== void 0 ? concat(protectedHeader, encode("."), encodeBase64url(aad, "aad", JWEInvalid)) : protectedHeader
+      encodeBase64url((encodedProtected ?? "") + (aad !== void 0 ? `.${aad}` : ""), "aad", JWEInvalid)
     ];
   }
-  function decryptResult(jwe, decrypted) {
-    const [plaintext, parsedProt, key, resolvedKey] = decrypted;
-    const { protected: encodedProtected, aad, unprotected: unprotected2, header } = jwe;
-    const result = { plaintext };
-    if (encodedProtected !== void 0) {
-      result.protectedHeader = parsedProt;
-    }
-    if (aad !== void 0) {
-      result.additionalAuthenticatedData = decodeBase64url(aad, "aad", JWEInvalid);
-    }
-    if (unprotected2 !== void 0) {
-      result.sharedUnprotectedHeader = unprotected2;
-    }
-    if (header !== void 0) {
-      result.unprotectedHeader = header;
-    }
-    if (resolvedKey) {
-      return { ...result, key };
-    }
-    return result;
-  }
   function prepareDecrypt(options) {
     return [
       options && validateAlgorithms("keyManagementAlgorithms", options.keyManagementAlgorithms),
@@ -37732,121 +37370,112 @@ return true;`);
       options?.maxDecompressedLength
     ];
   }
-  async function decryptRecipient(jwe, token, shared, key) {
-    const [parsedProt] = token;
-    const { header, unprotected: unprotected2 } = jwe;
+  async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
+    const [parsedProt, ciphertext, iv, tag2, additionalData] = token, { header, unprotected, aad } = jwe;
     let joseHeader;
-    if (header !== void 0 || unprotected2 !== void 0) {
-      if (!isDisjoint(parsedProt, header, unprotected2)) {
+    if (header !== void 0 || unprotected !== void 0) {
+      if (!isDisjoint(parsedProt, header, unprotected))
         throw new JWEInvalid("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");
-      }
-      joseHeader = { ...parsedProt, ...header, ...unprotected2 };
-    } else {
+      joseHeader = { ...parsedProt, ...header, ...unprotected };
+    } else
       joseHeader = parsedProt ?? {};
-    }
-    return decryptRecipientCore(jwe, token, shared, key, joseHeader);
-  }
-  async function decryptRecipientCore(jwe, token, shared, key, joseHeader) {
-    const [keyManagementAlgorithms, contentEncryptionAlgorithms, crit, maxPBES2Count, maxDecompressedLength] = shared;
-    const [parsedProt, ciphertext, iv, tag2, additionalData] = token;
-    const { encrypted_key: encodedKey } = jwe;
-    validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, parsedProt, joseHeader);
-    validateZip(joseHeader, parsedProt);
+    const [keyManagementAlgorithms, contentEncryptionAlgorithms, crit, maxPBES2Count, maxDecompressedLength] = shared, { encrypted_key: encodedKey } = jwe;
+    validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, parsedProt, joseHeader), validateZip(joseHeader, parsedProt);
     const { alg, enc } = joseHeader;
-    if (typeof alg !== "string" || !alg) {
+    if (typeof alg != "string" || !alg)
       throw new JWEInvalid("missing JWE Algorithm (alg) in JWE Header");
-    }
-    if (typeof enc !== "string" || !enc) {
+    const selected = JWE[alg];
+    if (encodedKey === "" && (!selected || !isJWECEKTransport(selected)))
+      throw new JWEInvalid("JWE Encrypted Key incorrect type");
+    const integrated = selected?.mode === "integrated-encryption";
+    if (!integrated && (typeof enc != "string" || !enc))
       throw new JWEInvalid("missing JWE Encryption Algorithm (enc) in JWE Header");
-    }
-    if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg) || !keyManagementAlgorithms && alg.startsWith("PBES2")) {
+    if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg) || !keyManagementAlgorithms && alg.startsWith("PBES2"))
       throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+    let encEntry;
+    if (integrated) {
+      if (enc !== void 0)
+        throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');
+      if (iv?.byteLength)
+        throw new JWEInvalid("JWE Initialization Vector must be empty for integrated encryption");
+      if (tag2?.byteLength)
+        throw new JWEInvalid("JWE Authentication Tag must be empty for integrated encryption");
+    } else {
+      if (contentEncryptionAlgorithms && !contentEncryptionAlgorithms.has(enc))
+        throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');
+      encEntry = jweEncryption(enc);
     }
-    if (contentEncryptionAlgorithms && !contentEncryptionAlgorithms.has(enc)) {
-      throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');
-    }
-    const encEntry = jweEncryption(enc);
     let encryptedKey;
-    if (encodedKey !== void 0) {
-      encryptedKey = decodeBase64url(encodedKey, "encrypted_key", JWEInvalid);
-    }
-    let resolvedKey = false;
-    if (typeof key === "function") {
-      key = await key(parsedProt, jwe);
-      resolvedKey = true;
-    }
-    const algEntry = jweAlgorithm(alg);
-    const k = await prepareKey(alg === "dir" ? encEntry : algEntry, key, "decrypt");
-    let cek;
-    try {
-      cek = await decryptKeyManagement(alg, encEntry, k, encryptedKey, joseHeader, maxPBES2Count);
-      if (encodedKey !== void 0 && cek instanceof Uint8Array && cek.byteLength << 3 !== encEntry.cekBits) {
-        cek = generateCek(encEntry);
+    if (encodedKey !== void 0)
+      try {
+        encryptedKey = decodeBase64url(encodedKey, "encrypted_key", JWEInvalid);
+      } catch (error) {
+        if (!selected || !isJWECEKTransport(selected))
+          throw error;
+        encryptedKey = new Uint8Array();
       }
-    } catch (err) {
-      if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
-        throw err;
+    let resolvedKey = false;
+    typeof key == "function" && (key = await key(parsedProt, jwe), resolvedKey = true);
+    const algEntry = selected ?? jweAlgorithm(alg);
+    isJWECEKTransport(algEntry) && encryptedKey === void 0 && (encryptedKey = new Uint8Array());
+    const k = await prepareKey(algEntry.mode === "direct-encryption" ? encEntry : algEntry, key, "decrypt");
+    let plaintext;
+    if (algEntry.mode === "integrated-encryption")
+      plaintext = await algEntry.decrypt(k, encryptedKey, ciphertext, additionalData, parsedProt, joseHeader);
+    else {
+      const encryption = encEntry;
+      let cek;
+      try {
+        cek = await decryptKeyManagement(algEntry, encryption, k, encryptedKey, joseHeader, maxPBES2Count), isJWECEKTransport(algEntry) && cek instanceof Uint8Array && cek.byteLength << 3 !== encryption.cekBits && (cek = generateCek(encryption));
+      } catch (err) {
+        if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported)
+          throw err;
+        cek = generateCek(encryption);
       }
-      cek = generateCek(encEntry);
+      plaintext = await decrypt(encryption, cek, ciphertext, iv, tag2, additionalData);
     }
-    let plaintext = await decrypt(encEntry, cek, ciphertext, iv, tag2, additionalData);
     if (joseHeader.zip === "DEF") {
       const decompressionLimit = maxDecompressedLength ?? 25e4;
-      if (decompressionLimit === 0) {
+      if (decompressionLimit === 0)
         throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
-      }
-      if (decompressionLimit !== Infinity && (!Number.isSafeInteger(decompressionLimit) || decompressionLimit < 1)) {
+      if (decompressionLimit !== 1 / 0 && (!Number.isSafeInteger(decompressionLimit) || decompressionLimit < 1))
         throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");
-      }
       plaintext = await decompress(plaintext, decompressionLimit).catch((cause) => {
-        if (cause instanceof JWEInvalid)
-          throw cause;
-        throw new JWEInvalid("Failed to decompress plaintext", { cause });
+        throw cause instanceof JWEInvalid ? cause : new JWEInvalid("Failed to decompress plaintext", { cause });
       });
     }
-    return [plaintext, parsedProt, k, resolvedKey];
-  }
-  async function decryptJWE(jwe, shared, key) {
-    return decryptRecipient(jwe, shareJWE(jwe), shared, key);
+    return {
+      plaintext,
+      ...parsedProt && { protectedHeader: parsedProt },
+      ...aad !== void 0 && {
+        additionalAuthenticatedData: decodeBase64url(aad, "aad", JWEInvalid)
+      },
+      ...unprotected && { sharedUnprotectedHeader: unprotected },
+      ...header && { unprotectedHeader: header },
+      ...resolvedKey && { key: k }
+    };
   }
   async function decryptCompact(jwe, shared, key) {
-    if (jwe instanceof Uint8Array) {
-      jwe = decoder.decode(jwe);
-    }
-    if (typeof jwe !== "string") {
+    if (jwe instanceof Uint8Array && (jwe = decoder.decode(jwe)), typeof jwe != "string")
       throw new JWEInvalid("Compact JWE must be a string or Uint8Array");
-    }
     const { 0: protectedHeader, 1: encryptedKey, 2: iv, 3: ciphertext, 4: tag2, length } = jwe.split(".");
-    if (length !== 5) {
+    if (length !== 5)
       throw new JWEInvalid("Invalid Compact JWE");
-    }
-    const flattened = {
+    return decryptJWE({
       ciphertext,
       iv: iv || void 0,
       protected: protectedHeader,
       tag: tag2 || void 0,
       encrypted_key: encryptedKey || void 0
-    };
-    const parsedProt = parseJoseHeader(protectedHeader, JWEInvalid, "JWE Protected Header is invalid");
-    const protectedBytes = encode(protectedHeader);
-    const token = [
-      parsedProt,
-      decodeBase64url(ciphertext, "ciphertext", JWEInvalid),
-      iv ? decodeBase64url(iv, "iv", JWEInvalid) : void 0,
-      tag2 ? decodeBase64url(tag2, "tag", JWEInvalid) : void 0,
-      protectedBytes
-    ];
-    return decryptRecipientCore(flattened, token, shared, key, parsedProt);
+    }, shared, key);
   }
   var init_jwe_decrypt = __esm({
     "../node_modules/jose/dist/webapi/lib/jwe_decrypt.js"() {
       init_content_encryption();
-      init_helpers();
+      init_validate2();
       init_errors();
-      init_type_checks();
       init_key_management();
       init_buffer_utils();
-      init_options();
       init_key();
       init_jwe_algorithms();
       init_deflate();
@@ -37855,12 +37484,7 @@ return true;`);
 
   // ../node_modules/jose/dist/webapi/jwe/compact/decrypt.js
   async function compactDecrypt(jwe, key, options) {
-    const decrypted = await decryptCompact(jwe, prepareDecrypt(options), key);
-    const result = { plaintext: decrypted[0], protectedHeader: decrypted[1] };
-    if (typeof key === "function") {
-      return { ...result, key: decrypted[2] };
-    }
-    return result;
+    return decryptCompact(jwe, prepareDecrypt(options), key);
   }
   var init_decrypt = __esm({
     "../node_modules/jose/dist/webapi/jwe/compact/decrypt.js"() {
@@ -37870,208 +37494,124 @@ return true;`);
 
   // ../node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
   async function flattenedDecrypt(jwe, key, options) {
-    if (!isObject(jwe)) {
+    if (!isObject(jwe))
       throw new JWEInvalid("Flattened JWE must be an object");
-    }
-    const shared = snapshotSharedJWE(jwe);
-    const [recipient, , error] = snapshotRecipientJWE(jwe);
+    const shared = snapshotSharedJWE(jwe), [recipient, , error] = snapshotRecipientJWE(jwe);
     if (!recipient)
       throw error;
     const snapshot = { ...shared, ...recipient };
-    checkRecipient(snapshot);
-    return decryptResult(snapshot, await decryptJWE(snapshot, prepareDecrypt(options), key));
+    return checkRecipient(snapshot), decryptJWE(snapshot, prepareDecrypt(options), key);
   }
   var init_decrypt2 = __esm({
     "../node_modules/jose/dist/webapi/jwe/flattened/decrypt.js"() {
       init_errors();
-      init_type_checks();
+      init_validate2();
       init_jwe_decrypt();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jwe/general/decrypt.js
   async function generalDecrypt(jwe, key, options) {
-    if (!isObject(jwe)) {
+    if (!isObject(jwe))
       throw new JWEInvalid("General JWE must be an object");
-    }
     const inputRecipients = jwe.recipients;
-    if (!Array.isArray(inputRecipients)) {
+    if (!Array.isArray(inputRecipients))
       throw new JWEInvalid("JWE Recipients missing or incorrect type");
-    }
     const recipients = Array.from(inputRecipients);
-    if (!recipients.every(isObject)) {
+    if (!recipients.every(isObject))
       throw new JWEInvalid("JWE Recipients missing or incorrect type");
-    }
-    if (!recipients.length) {
+    if (!recipients.length)
       throw new JWEInvalid("JWE Recipients has no members");
-    }
-    let shared;
-    let sharedJwe;
-    let token;
+    let shared, sharedJwe, token;
     try {
-      shared = prepareDecrypt(options);
-      sharedJwe = snapshotSharedJWE(jwe);
-      token = shareJWE(sharedJwe);
+      shared = prepareDecrypt(options), sharedJwe = snapshotSharedJWE(jwe), token = shareJWE(sharedJwe);
     } catch {
       throw new JWEDecryptionFailed();
     }
     const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
-    if (recipients.length > 1) {
+    if (recipients.length > 1)
       for (const [, headerAlg] of recipientSnapshots) {
-        const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg;
-        if (alg === "dir" || alg === "ECDH-ES") {
+        const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg, algEntry = typeof alg == "string" ? JWE[alg] : void 0;
+        if (algEntry && !isJWECEKTransport(algEntry))
           throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
-        }
       }
-    }
-    for (const [recipient] of recipientSnapshots) {
-      if (!recipient)
-        continue;
-      try {
-        const flattened = { ...sharedJwe, ...recipient };
-        checkRecipient(flattened);
-        return decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
-      } catch {
-      }
-    }
+    for (const [recipient] of recipientSnapshots)
+      if (recipient)
+        try {
+          const flattened = { ...sharedJwe, ...recipient };
+          return checkRecipient(flattened), await decryptJWE(flattened, shared, key, token);
+        } catch {
+        }
     throw new JWEDecryptionFailed();
   }
   var init_decrypt3 = __esm({
     "../node_modules/jose/dist/webapi/jwe/general/decrypt.js"() {
       init_jwe_decrypt();
       init_errors();
-      init_type_checks();
+      init_validate2();
+      init_jwe_algorithms();
     }
   });
 
   // ../node_modules/jose/dist/webapi/lib/jwe_encrypt.js
   function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
-    if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) {
+    if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader))
       throw new JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");
-    }
   }
-  function checkEncryptHeaders(input) {
+  function checkEncryptHeaders(input, options, sharedHeadersNormalized = false) {
+    if (!input[1] && !input[2] && !input[3])
+      throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");
+    options !== void 0 && (input[8] = options?.crit);
     let [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, aad, cek, iv, keyManagementParameters, crit] = input;
-    if (aad !== void 0) {
-      assertUint8Array(aad, "JWE Additional Authenticated Data");
-    }
-    if (cek !== void 0) {
-      assertUint8Array(cek, "JWE Content Encryption Key");
-    }
-    if (iv !== void 0) {
-      assertUint8Array(iv, "JWE Initialization Vector");
-    }
-    if (protectedHeader !== void 0) {
-      protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0];
-      input[1] = protectedHeader;
-    }
-    if (unprotectedHeader !== void 0) {
-      unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0];
-      input[2] = unprotectedHeader;
-    }
-    if (sharedUnprotectedHeader !== void 0) {
-      sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0];
-      input[3] = sharedUnprotectedHeader;
-    }
-    if (keyManagementParameters !== void 0 && !isObject(keyManagementParameters)) {
+    if (aad !== void 0 && assertUint8Array(aad, "JWE Additional Authenticated Data"), cek !== void 0 && assertUint8Array(cek, "JWE Content Encryption Key"), iv !== void 0 && assertUint8Array(iv, "JWE Initialization Vector"), !sharedHeadersNormalized && protectedHeader !== void 0 && (protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0], input[1] = protectedHeader), unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0], input[2] = unprotectedHeader), !sharedHeadersNormalized && sharedUnprotectedHeader !== void 0 && (sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0], input[3] = sharedUnprotectedHeader), keyManagementParameters !== void 0 && !isObject(keyManagementParameters))
       throw new TypeError("JWE Key Management Parameters must be an object");
-    }
     checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     const joseHeader = {
       ...protectedHeader,
       ...unprotectedHeader,
       ...sharedUnprotectedHeader
     };
-    validateCritDuplicates(JWEInvalid, protectedHeader);
-    validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader);
-    validateZip(joseHeader, protectedHeader);
+    validateCritDuplicates(JWEInvalid, protectedHeader), validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader), validateZip(joseHeader, protectedHeader);
     const { alg, enc } = joseHeader;
-    if (typeof alg !== "string" || !alg) {
+    if (typeof alg != "string" || !alg)
       throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    if (typeof enc !== "string" || !enc) {
+    const algEntry = JWE[alg];
+    if (algEntry?.mode === "integrated-encryption") {
+      if (enc !== void 0)
+        throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');
+      if (cek !== void 0)
+        throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+      if (iv !== void 0)
+        throw new TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+      return [joseHeader, void 0, algEntry];
+    }
+    if (typeof enc != "string" || !enc)
       throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
-    }
-    return [joseHeader, alg, enc, jweEncryption(enc)];
+    return [joseHeader, jweEncryption(enc), algEntry];
   }
   async function encryptJWE(input, checked, key) {
-    const [joseHeader, alg, , encEntry] = checked;
-    const [inputPlaintext, inputProtectedHeader, inputUnprotectedHeader, sharedUnprotectedHeader, aad, providedCek, inputIv, keyManagementParameters, , unprotectedParameters] = input;
-    let protectedHeader = inputProtectedHeader;
-    let unprotectedHeader = inputUnprotectedHeader;
-    if (providedCek && (alg === "dir" || alg === "ECDH-ES")) {
-      throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
-    }
-    const algEntry = jweAlgorithm(alg);
-    const k = await prepareKey(alg === "dir" ? encEntry : algEntry, key, "encrypt");
-    const [cek, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, providedCek, keyManagementParameters);
-    if (parameters) {
-      if (unprotectedParameters) {
-        unprotectedHeader = unprotectedHeader ? { ...unprotectedHeader, ...parameters } : parameters;
-      } else {
-        protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters;
-      }
-      checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
-    }
-    let protectedHeaderS;
-    let protectedHeaderB;
-    if (protectedHeader) {
-      protectedHeaderS = encode2(JSON.stringify(protectedHeader));
-      protectedHeaderB = encode(protectedHeaderS);
-    } else {
-      protectedHeaderS = "";
-      protectedHeaderB = new Uint8Array();
-    }
-    let additionalData;
-    let aadMember;
-    if (aad?.byteLength) {
-      aadMember = encode2(aad);
-      additionalData = concat(protectedHeaderB, encode("."), encode(aadMember));
-    } else {
-      additionalData = protectedHeaderB;
-    }
+    const [joseHeader, encEntry, selected] = checked, [inputPlaintext, inputProtectedHeader, inputUnprotectedHeader, sharedUnprotectedHeader, aad, providedCek, inputIv, keyManagementParameters, , unprotectedParameters] = input;
+    let protectedHeader = inputProtectedHeader, unprotectedHeader = inputUnprotectedHeader;
+    const algEntry = selected ?? jweAlgorithm(joseHeader.alg);
+    let encryptedKey, parameters, cek;
+    algEntry.mode === "integrated-encryption" ? cek = await prepareKey(algEntry, key, "encrypt") : [cek, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, providedCek, keyManagementParameters), parameters && (unprotectedParameters ? unprotectedHeader = unprotectedHeader ? { ...unprotectedHeader, ...parameters } : parameters : protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters, checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader));
+    const protectedHeaderS = protectedHeader ? encode2(JSON.stringify(protectedHeader)) : "", aadMember = aad?.byteLength ? encode2(aad) : void 0, additionalData = encode(aadMember ? `${protectedHeaderS}.${aadMember}` : protectedHeaderS);
     let plaintext = inputPlaintext;
-    if (joseHeader.zip === "DEF") {
-      plaintext = await compress(plaintext).catch((cause) => {
-        throw new JWEInvalid("Failed to compress plaintext", { cause });
-      });
-    }
-    const { ciphertext, tag: tag2, iv } = await encrypt(encEntry, plaintext, cek, inputIv, additionalData);
+    joseHeader.zip === "DEF" && (plaintext = await compress(plaintext).catch((cause) => {
+      throw new JWEInvalid("Failed to compress plaintext", { cause });
+    }));
+    let ciphertext, tag2, iv;
+    algEntry.mode === "integrated-encryption" ? [encryptedKey, ciphertext] = await algEntry.encrypt(cek, plaintext, additionalData, protectedHeader, joseHeader, keyManagementParameters) : { ciphertext, tag: tag2, iv } = await encrypt(encEntry, plaintext, cek, inputIv, additionalData);
     const jwe = {
       ciphertext: encode2(ciphertext)
     };
-    if (iv) {
-      jwe.iv = encode2(iv);
-    }
-    if (tag2) {
-      jwe.tag = encode2(tag2);
-    }
-    if (encryptedKey) {
-      jwe.encrypted_key = encode2(encryptedKey);
-    }
-    if (aadMember) {
-      jwe.aad = aadMember;
-    }
-    if (protectedHeader) {
-      jwe.protected = protectedHeaderS;
-    }
-    if (sharedUnprotectedHeader) {
-      jwe.unprotected = sharedUnprotectedHeader;
-    }
-    if (unprotectedHeader) {
-      jwe.header = unprotectedHeader;
-    }
-    return jwe;
+    return iv && (jwe.iv = encode2(iv)), tag2 && (jwe.tag = encode2(tag2)), encryptedKey?.byteLength && (jwe.encrypted_key = encode2(encryptedKey)), aadMember && (jwe.aad = aadMember), protectedHeader && (jwe.protected = protectedHeaderS), sharedUnprotectedHeader && (jwe.unprotected = sharedUnprotectedHeader), unprotectedHeader && (jwe.header = unprotectedHeader), jwe;
   }
   async function createJWE(input, key, options) {
-    if (!input[1] && !input[2] && !input[3]) {
-      throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");
-    }
-    if (options !== void 0) {
-      input[8] = options?.crit;
-      input[9] = options ? unprotected in options : false;
-    }
-    return encryptJWE(input, checkEncryptHeaders(input), key);
+    return encryptJWE(input, checkEncryptHeaders(input, options), key);
+  }
+  function compactJWE(jwe) {
+    return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
   }
   var init_jwe_encrypt = __esm({
     "../node_modules/jose/dist/webapi/lib/jwe_encrypt.js"() {
@@ -38079,56 +37619,36 @@ return true;`);
       init_content_encryption();
       init_key_management();
       init_errors();
-      init_type_checks();
+      init_validate2();
       init_buffer_utils();
-      init_options();
       init_key();
       init_jwe_algorithms();
       init_deflate();
-      init_helpers();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jwe/general/encrypt.js
-  function copyOptionalMembers(flattened, jwe, recipient) {
-    const { aad, protected: protectedHeader, unprotected: unprotected2, header } = flattened;
-    if (aad)
-      jwe.aad = aad;
-    if (protectedHeader)
-      jwe.protected = protectedHeader;
-    if (unprotected2)
-      jwe.unprotected = unprotected2;
-    if (header)
-      recipient.header = header;
-  }
   var _parent, IndividualRecipient, _plaintext, _recipients, _protectedHeader, _unprotectedHeader, _aad, GeneralEncrypt;
   var init_encrypt = __esm({
     "../node_modules/jose/dist/webapi/jwe/general/encrypt.js"() {
-      init_helpers();
+      init_validate2();
       init_errors();
       init_content_encryption();
-      init_key_management();
       init_base64url();
       init_jwe_encrypt();
-      init_key();
+      init_key_management();
       init_jwe_algorithms();
-      init_type_checks();
       IndividualRecipient = class {
         constructor(enc, key, crit) {
           __privateAdd(this, _parent);
           __publicField(this, "state");
-          __privateSet(this, _parent, enc);
-          this.state = [void 0, void 0, key, crit];
+          __privateSet(this, _parent, enc), this.state = [void 0, void 0, key, crit];
         }
         setUnprotectedHeader(unprotectedHeader) {
-          assertNotSet(this.state[0], "setUnprotectedHeader");
-          this.state[0] = unprotectedHeader;
-          return this;
+          return assertNotSet(this.state[0], "setUnprotectedHeader"), this.state[0] = unprotectedHeader, this;
         }
         setKeyManagementParameters(parameters) {
-          assertNotSet(this.state[1], "setKeyManagementParameters");
-          this.state[1] = parameters;
-          return this;
+          return assertNotSet(this.state[1], "setKeyManagementParameters"), this.state[1] = parameters, this;
         }
         addRecipient(...args) {
           return __privateGet(this, _parent).addRecipient(...args);
@@ -38152,62 +37672,26 @@ return true;`);
         }
         addRecipient(key, options) {
           const recipient = new IndividualRecipient(this, key, options?.crit);
-          __privateGet(this, _recipients).push(recipient);
-          return recipient;
+          return __privateGet(this, _recipients).push(recipient), recipient;
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader), "setProtectedHeader");
-          __privateSet(this, _protectedHeader, protectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _protectedHeader), "setProtectedHeader"), __privateSet(this, _protectedHeader, protectedHeader), this;
         }
         setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-          assertNotSet(__privateGet(this, _unprotectedHeader), "setSharedUnprotectedHeader");
-          __privateSet(this, _unprotectedHeader, sharedUnprotectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _unprotectedHeader), "setSharedUnprotectedHeader"), __privateSet(this, _unprotectedHeader, sharedUnprotectedHeader), this;
         }
         setAdditionalAuthenticatedData(aad) {
-          __privateSet(this, _aad, aad);
-          return this;
+          return __privateSet(this, _aad, aad), this;
         }
         async encrypt() {
-          if (!__privateGet(this, _recipients).length) {
+          if (!__privateGet(this, _recipients).length)
             throw new JWEInvalid("at least one recipient must be added");
-          }
           assertUint8Array(__privateGet(this, _plaintext), "plaintext");
-          if (__privateGet(this, _recipients).length === 1) {
-            const [unprotectedHeader, keyManagementParameters, key, crit] = __privateGet(this, _recipients)[0].state;
-            const flattened = await createJWE([
-              __privateGet(this, _plaintext),
-              __privateGet(this, _protectedHeader),
-              unprotectedHeader,
-              __privateGet(this, _unprotectedHeader),
-              __privateGet(this, _aad),
-              void 0,
-              void 0,
-              keyManagementParameters,
-              crit,
-              false
-            ], key);
-            const jwe2 = {
-              ciphertext: flattened.ciphertext,
-              iv: flattened.iv,
-              recipients: [{}],
-              tag: flattened.tag
-            };
-            if (flattened.encrypted_key)
-              jwe2.recipients[0].encrypted_key = flattened.encrypted_key;
-            copyOptionalMembers(flattened, jwe2, jwe2.recipients[0]);
-            return jwe2;
-          }
-          let enc;
-          let protectedHeader = __privateGet(this, _protectedHeader);
-          let sharedUnprotectedHeader = __privateGet(this, _unprotectedHeader);
-          const inputs = [];
-          const checked = [];
-          for (let i = 0; i < __privateGet(this, _recipients).length; i++) {
-            const recipient = __privateGet(this, _recipients)[i];
-            const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
-            const input = [
+          const multiple = __privateGet(this, _recipients).length > 1;
+          let enc, protectedHeader = __privateGet(this, _protectedHeader), sharedUnprotectedHeader = __privateGet(this, _unprotectedHeader);
+          const recipients = [];
+          for (const recipient of __privateGet(this, _recipients)) {
+            const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state, input = [
               __privateGet(this, _plaintext),
               protectedHeader,
               unprotectedHeader,
@@ -38217,55 +37701,35 @@ return true;`);
               void 0,
               keyManagementParameters,
               crit,
-              true
-            ];
-            const headers = checkEncryptHeaders(input);
-            inputs.push(input);
-            checked.push(headers);
-            if (i === 0) {
-              protectedHeader = input[1];
-              sharedUnprotectedHeader = input[3];
-            }
-            if (headers[1] === "dir" || headers[1] === "ECDH-ES") {
-              throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
-            }
-            if (!enc) {
-              enc = headers[2];
-            } else if (enc !== headers[2]) {
+              multiple
+            ], headers = checkEncryptHeaders(input, void 0, recipients.length > 0);
+            recipients.length || (protectedHeader = input[1], sharedUnprotectedHeader = input[3]), recipients.push([input, headers, key]);
+            const [{ alg, enc: recipientEnc }, , algEntry] = headers;
+            if (multiple && algEntry && !isJWECEKTransport(algEntry))
+              throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+            if (!enc)
+              enc = recipientEnc;
+            else if (enc !== recipientEnc)
               throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
-            }
           }
-          const cek = generateCek(checked[0][3]);
-          const jwe = {
-            ciphertext: "",
-            recipients: []
+          for (const [, headers] of recipients)
+            headers[2] ?? (headers[2] = jweAlgorithm(headers[0].alg));
+          const [firstInput, firstHeaders, firstKey] = recipients[0], cek = multiple ? generateCek(firstHeaders[1]) : void 0;
+          firstInput[5] = cek;
+          const { encrypted_key, header, ...shared } = await encryptJWE(firstInput, firstHeaders, firstKey), jwe = {
+            ...shared,
+            recipients: [{}]
           };
-          for (let i = 0; i < __privateGet(this, _recipients).length; i++) {
-            const recipient = __privateGet(this, _recipients)[i];
-            const [, keyManagementParameters, key] = recipient.state;
-            const target = {};
-            jwe.recipients.push(target);
-            if (i === 0) {
-              inputs[0][5] = cek;
-              const flattened = await encryptJWE(inputs[0], checked[0], key);
-              jwe.ciphertext = flattened.ciphertext;
-              jwe.iv = flattened.iv;
-              jwe.tag = flattened.tag;
-              target.encrypted_key = flattened.encrypted_key;
-              copyOptionalMembers(flattened, jwe, target);
-              continue;
-            }
-            const [, alg, , encEntry] = checked[i];
-            const unprotectedHeader = inputs[i][2];
-            const k = await prepareKey(jweAlgorithm(alg), key, "encrypt");
-            const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
-            target.encrypted_key = encode2(encryptedKey);
+          encrypted_key && (jwe.recipients[0].encrypted_key = encrypted_key), header && (jwe.recipients[0].header = header);
+          for (let i = 1; i < recipients.length; i++) {
+            const [input, [joseHeader, encEntry, algEntry], key] = recipients[i], unprotectedHeader = input[2], [, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, cek, input[7]), target = {
+              encrypted_key: encode2(encryptedKey)
+            };
             if (unprotectedHeader || parameters) {
-              const header = { ...unprotectedHeader, ...parameters };
-              if (parameters)
-                checkDisjoint(inputs[i][1], header, inputs[i][3]);
-              target.header = header;
+              const header2 = { ...unprotectedHeader, ...parameters };
+              parameters && checkDisjoint(input[1], header2, input[3]), target.header = header2;
             }
+            jwe.recipients.push(target);
           }
           return jwe;
         }
@@ -38278,45 +37742,13 @@ return true;`);
     }
   });
 
-  // ../node_modules/jose/dist/webapi/lib/signing.js
-  async function getSigKey(entry, key, usage) {
-    if (key instanceof Uint8Array) {
-      return crypto.subtle.importKey("raw", key, entry.subtle, false, [
-        usage
-      ]);
-    }
-    checkCryptoKey(key, entry.subtle, usage);
-    if (entry.minRsaBits)
-      checkModulusLength(entry.alg, key);
-    return key;
-  }
-  async function sign(entry, key, data) {
-    const cryptoKey = await getSigKey(entry, key, "sign");
-    const signature = await crypto.subtle.sign(entry.signing, cryptoKey, data);
-    return new Uint8Array(signature);
-  }
-  async function verify(entry, key, signature, data) {
-    const cryptoKey = await getSigKey(entry, key, "verify");
-    try {
-      return await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
-    } catch {
-      return false;
-    }
-  }
-  var init_signing = __esm({
-    "../node_modules/jose/dist/webapi/lib/signing.js"() {
-      init_crypto_key();
-    }
-  });
-
   // ../node_modules/jose/dist/webapi/lib/jws_algorithms.js
   function hmac(bits) {
     const subtle = { name: "HMAC", hash: `SHA-${bits}` };
     return { kty: ["oct"], secret: true, subtle, signing: subtle, usages: sig };
   }
   function rsa(bits, saltLength) {
-    const name = saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5";
-    const subtle = { name, hash: `SHA-${bits}` };
+    const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
     return {
       kty: ["RSA"],
       subtle,
@@ -38345,8 +37777,7 @@ return true;`);
     };
   }
   function mldsa(bits) {
-    const name = `ML-DSA-${bits}`;
-    const subtle = { name };
+    const subtle = { name: `ML-DSA-${bits}` };
     return {
       kty: ["AKP"],
       subtle,
@@ -38355,10 +37786,9 @@ return true;`);
     };
   }
   function jwsAlgorithm(alg) {
-    const entry = typeof alg === "string" ? JWS[alg] : void 0;
-    if (!entry) {
+    const entry = typeof alg == "string" ? JWS[alg] : void 0;
+    if (!entry)
       throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
     return entry;
   }
   var sig, JWS;
@@ -38391,70 +37821,32 @@ return true;`);
 
   // ../node_modules/jose/dist/webapi/lib/jws_verify.js
   function snapshotJws(jws, sharedPayload) {
-    const encodedProtected = jws.protected;
-    const inputHeader = jws.header;
-    const header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
+    const encodedProtected = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
     let payload = sharedPayload ? sharedPayload[0] : jws.payload;
-    if (!sharedPayload && payload instanceof Uint8Array) {
-      payload = new Uint8Array(payload);
-    }
-    const signature = jws.signature;
-    const snapshot = { payload, signature };
-    if (encodedProtected !== void 0)
-      snapshot.protected = encodedProtected;
-    if (inputHeader !== void 0)
-      snapshot.header = header;
+    !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));
+    const signature = jws.signature, snapshot = { payload, signature };
+    if (encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), encodedProtected === void 0 && header === void 0)
+      throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
+    if (encodedProtected !== void 0 && typeof encodedProtected != "string")
+      throw new JWSInvalid("JWS Protected Header incorrect type");
+    if (payload === void 0)
+      throw new JWSInvalid("JWS Payload missing");
+    if (typeof signature != "string")
+      throw new JWSInvalid("JWS Signature missing or incorrect type");
+    if (header !== void 0 && !isObject(header))
+      throw new JWSInvalid("JWS Unprotected Header incorrect type");
     return snapshot;
   }
-  function verifyResult(jws, verified) {
-    const [payload, parsedProt, , key, resolvedKey] = verified;
-    const result = { payload };
-    if (jws.protected !== void 0) {
-      result.protectedHeader = parsedProt;
-    }
-    if (jws.header !== void 0) {
-      result.unprotectedHeader = jws.header;
-    }
-    if (resolvedKey) {
-      return { ...result, key };
-    }
-    return result;
-  }
   function prepareVerify(options) {
     return [options && validateAlgorithms("algorithms", options.algorithms), options?.crit];
   }
-  function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid")) {
-    return parsedProtected;
-  }
-  function validateJwsHeaders(parsedProt, joseHeader, shared) {
-    const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
-    const alg = joseHeader.alg;
-    if (typeof alg !== "string" || !alg) {
-      throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    if (shared[0] && !shared[0].has(alg)) {
-      throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-    }
-    return [b64, alg];
-  }
-  function parseJwsHeaders(encodedProtected, header, shared, parsedProtected) {
-    const parsedProt = parseProtectedHeader(encodedProtected, parsedProtected);
-    let joseHeader;
-    if (header !== void 0) {
-      if (!isDisjoint(parsedProt, header)) {
-        throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-      }
-      joseHeader = { ...parsedProt, ...header };
-    } else {
-      joseHeader = parsedProt;
-    }
-    return [parsedProt, joseHeader, ...validateJwsHeaders(parsedProt, joseHeader, shared)];
+  function parseProtectedHeader(encodedProtected) {
+    return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, "JWS Protected Header is invalid");
   }
   function encodeJsonUnencodedPayload(payload) {
     const invalid2 = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
-    if (invalid2 !== void 0) {
+    if (invalid2 !== void 0)
       throw new JWSInvalid(/\p{Cs}/u.test(invalid2) ? "JWS Payload must be a well-formed Unicode string" : "JWS Payload must not contain unassigned Unicode code points");
-    }
     return encoder.encode(payload);
   }
   function encodeCompactUnencodedPayload(payload) {
@@ -38464,73 +37856,56 @@ return true;`);
       throw new JWSInvalid("JWS Compact Serialization payload must use only ASCII characters");
     }
   }
-  async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
-    let resolvedKey = false;
-    if (typeof key === "function") {
-      key = await key(parsedProt, jws);
-      resolvedKey = true;
-    }
-    const b64 = typeof signingPayload === "string";
-    const entry = jwsAlgorithm(alg);
-    const data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), b64 ? shared[2] ?? (shared[2] = encodeBase64url(signingPayload, "payload", JWSInvalid)) : signingPayload);
-    const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
-    const k = await prepareKey(entry, key, "verify");
-    if (!await verify(entry, k, signature, data)) {
-      throw new JWSSignatureVerificationFailed();
-    }
-    const payload = b64 ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload;
-    return [payload, parsedProt, b64, k, resolvedKey];
-  }
   async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
-    const { protected: encodedProtected, header, payload: inputPayload } = jws;
-    const [parsedProt, , b64, alg] = parseJwsHeaders(encodedProtected, header, shared, parsedProtected);
+    const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);
+    if (!isDisjoint(parsedProt, header))
+      throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+    const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;
+    if (typeof alg != "string" || !alg)
+      throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    if (shared[0] && !shared[0].has(alg))
+      throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
     if (b64) {
-      if (typeof inputPayload !== "string") {
+      if (typeof inputPayload != "string")
         throw new JWSInvalid("JWS Payload must be a string");
-      }
-    } else if (typeof inputPayload !== "string" && !(inputPayload instanceof Uint8Array)) {
+    } else if (typeof inputPayload != "string" && !(inputPayload instanceof Uint8Array))
       throw new JWSInvalid("JWS Payload must be a string or an Uint8Array instance");
+    const signingPayload = b64 || typeof inputPayload != "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
+    let resolvedKey = false;
+    typeof key == "function" && (key = await key(parsedProt, jws), resolvedKey = true);
+    const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode("."), typeof signingPayload == "string" ? shared[2] ?? (shared[2] = encodeBase64url(signingPayload, "payload", JWSInvalid)) : signingPayload), signature = decodeBase64url(jws.signature, "signature", JWSInvalid), k = await prepareKey(entry, key, "verify"), cryptoKey = await rawKey(k, entry.subtle, "verify");
+    entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);
+    let verified = false;
+    try {
+      verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);
+    } catch {
     }
-    const signingPayload = b64 || typeof inputPayload !== "string" ? inputPayload : encodeUnencodedPayload(inputPayload);
-    return verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload);
+    if (!verified)
+      throw new JWSSignatureVerificationFailed();
+    const result = { payload: typeof signingPayload == "string" ? decodeBase64url(signingPayload, "payload", JWSInvalid) : signingPayload };
+    return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];
   }
   async function verifyCompact(jws, shared, key) {
-    if (jws instanceof Uint8Array) {
-      jws = decoder.decode(jws);
-    }
-    if (typeof jws !== "string") {
+    if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != "string")
       throw new JWSInvalid("Compact JWS must be a string or Uint8Array");
-    }
     const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(".");
-    if (length !== 3) {
+    if (length !== 3)
       throw new JWSInvalid("Invalid Compact JWS");
-    }
-    const compactJws = { payload, protected: protectedHeader, signature };
-    const parsedProt = parseProtectedHeader(protectedHeader);
-    const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
-    const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
-    return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
+    return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);
   }
   var init_jws_verify = __esm({
     "../node_modules/jose/dist/webapi/lib/jws_verify.js"() {
-      init_signing();
       init_jws_algorithms();
       init_errors();
       init_buffer_utils();
-      init_helpers();
-      init_type_checks();
-      init_options();
+      init_validate2();
       init_key();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jws/compact/verify.js
   async function compactVerify(jws, key, options) {
-    const verified = await verifyCompact(jws, prepareVerify(options), key);
-    const result = { payload: verified[0], protectedHeader: verified[1] };
-    if (typeof key === "function") {
-      return { ...result, key: verified[3] };
-    }
+    const [result] = await verifyCompact(jws, prepareVerify(options), key);
     return result;
   }
   var init_verify = __esm({
@@ -38541,31 +37916,15 @@ return true;`);
 
   // ../node_modules/jose/dist/webapi/jws/flattened/verify.js
   async function flattenedVerify(jws, key, options) {
-    if (!isObject(jws)) {
+    if (!isObject(jws))
       throw new JWSInvalid("Flattened JWS must be an object");
-    }
-    const snapshot = snapshotJws(jws);
-    if (snapshot.protected === void 0 && snapshot.header === void 0) {
-      throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
-    }
-    if (snapshot.protected !== void 0 && typeof snapshot.protected !== "string") {
-      throw new JWSInvalid("JWS Protected Header incorrect type");
-    }
-    if (snapshot.payload === void 0) {
-      throw new JWSInvalid("JWS Payload missing");
-    }
-    if (typeof snapshot.signature !== "string") {
-      throw new JWSInvalid("JWS Signature missing or incorrect type");
-    }
-    if (snapshot.header !== void 0 && !isObject(snapshot.header)) {
-      throw new JWSInvalid("JWS Unprotected Header incorrect type");
-    }
-    return verifyResult(snapshot, await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload));
+    const snapshot = snapshotJws(jws), [result] = await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload);
+    return result;
   }
   var init_verify2 = __esm({
     "../node_modules/jose/dist/webapi/jws/flattened/verify.js"() {
       init_errors();
-      init_type_checks();
+      init_validate2();
       init_jws_verify();
     }
   });
@@ -38573,39 +37932,25 @@ return true;`);
   // ../node_modules/jose/dist/webapi/jws/general/verify.js
   function snapshotSignature(signature, payload) {
     try {
-      const jws = snapshotJws(signature, [payload]);
-      const { protected: encodedProtected, header, signature: encodedSignature } = jws;
-      if (encodedProtected === void 0 && header === void 0)
-        return void 0;
-      if (encodedProtected !== void 0 && typeof encodedProtected !== "string")
-        return void 0;
-      if (typeof encodedSignature !== "string")
-        return void 0;
-      if (header !== void 0 && !isObject(header))
-        return void 0;
-      const protectedHeader = parseProtectedHeader(encodedProtected);
-      const { b64, crit } = protectedHeader;
+      const jws = snapshotJws(signature, [payload]), protectedHeader = parseProtectedHeader(jws.protected), { b64, crit } = protectedHeader;
       return [
         jws,
         protectedHeader,
-        Array.isArray(crit) && crit.includes("b64") ? typeof b64 === "boolean" ? b64 ? 1 : 2 : 0 : 1
+        Array.isArray(crit) && crit.includes("b64") ? typeof b64 == "boolean" ? b64 ? 1 : 2 : 0 : 1
       ];
     } catch {
-      return void 0;
+      return;
     }
   }
   async function generalVerify(jws, key, options) {
-    if (!isObject(jws)) {
+    if (!isObject(jws))
       throw new JWSInvalid("General JWS must be an object");
-    }
     const { signatures, payload: inputPayload } = jws;
-    if (!Array.isArray(signatures)) {
+    if (!Array.isArray(signatures))
       throw new JWSInvalid("JWS Signatures missing or incorrect type");
-    }
     const signatureEntries = Array.from(signatures);
-    if (!signatureEntries.every(isObject)) {
+    if (!signatureEntries.every(isObject))
       throw new JWSInvalid("JWS Signatures missing or incorrect type");
-    }
     let shared;
     try {
       if (inputPayload === void 0)
@@ -38614,28 +37959,24 @@ return true;`);
     } catch {
       throw new JWSSignatureVerificationFailed();
     }
-    const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload;
-    const candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
+    const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload, candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
     let modes = 0;
-    for (const [, , mode] of candidates) {
-      modes |= mode;
-      if (modes === 3) {
+    for (const [, , mode] of candidates)
+      if (modes |= mode, modes === 3)
         throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
-      }
-    }
-    for (const candidate of candidates) {
+    for (const candidate of candidates)
       try {
-        return verifyResult(candidate[0], await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]));
+        const [result] = await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]);
+        return result;
       } catch {
       }
-    }
     throw new JWSSignatureVerificationFailed();
   }
   var init_verify3 = __esm({
     "../node_modules/jose/dist/webapi/jws/general/verify.js"() {
       init_jws_verify();
       init_errors();
-      init_type_checks();
+      init_validate2();
     }
   });
 
@@ -38644,54 +37985,35 @@ return true;`);
     throw new TypeError("Invalid time period format");
   }
   function secs(str) {
-    if (typeof str !== "string") {
-      invalidDuration();
-    }
+    typeof str != "string" && invalidDuration();
     const matched = REGEX.exec(str);
-    if (!matched || matched[4] && matched[1]) {
-      invalidDuration();
-    }
-    const value = parseFloat(matched[2]);
-    const numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
-    if (!Number.isFinite(numericDate2)) {
-      invalidDuration();
-    }
-    if (matched[1] === "-" || matched[4] === "ago") {
-      return -numericDate2;
-    }
-    return numericDate2;
+    (!matched || matched[4] && matched[1]) && invalidDuration();
+    const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+    return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === "-" || matched[4] === "ago" ? -numericDate2 : numericDate2;
   }
   function validateInput(label, input) {
-    if (!Number.isFinite(input)) {
+    if (!Number.isFinite(input))
       throw new TypeError(`Invalid ${label} input`);
-    }
     return input;
   }
   function validateStringClaim(claim, value) {
-    if (typeof value !== "string") {
+    if (typeof value != "string")
       throw new TypeError(`"${claim}" claim must be a string`);
-    }
   }
   function validateAudienceClaim(value) {
-    if (typeof value !== "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member !== "string"))) {
+    if (typeof value != "string" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != "string")))
       throw new TypeError('"aud" claim must be a string or an array of strings');
-    }
   }
   function numericDate(value, label) {
-    if (typeof value === "number")
-      return validateInput(label, value);
-    if (value instanceof Date)
-      return validateInput(label, epoch(value));
-    return epoch(/* @__PURE__ */ new Date()) + secs(value);
+    return typeof value == "number" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);
   }
   function validateNumericDate(payload, claim, required = false) {
     const value = payload[claim];
-    if (value === void 0 && !required)
-      return void 0;
-    if (typeof value !== "number") {
-      throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+    if (!(value === void 0 && !required)) {
+      if (typeof value != "number")
+        throw new JWTClaimValidationFailed(`"${claim}" claim must be a number`, payload, claim, "invalid");
+      return value;
     }
-    return value;
   }
   function unexpectedClaim(payload, claim) {
     throw new JWTClaimValidationFailed(`unexpected "${claim}" claim value`, payload, claim, checkFailed);
@@ -38702,72 +38024,39 @@ return true;`);
       payload = JSON.parse(strictDecoder.decode(encodedPayload));
     } catch {
     }
-    if (!isObject(payload)) {
+    if (!isObject(payload))
       throw new JWTInvalid("JWT Claims Set must be a top-level JSON object");
-    }
     const { typ } = options;
-    if (typ !== void 0 && (typeof protectedHeader.typ !== "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+    if (typ !== void 0 && (typeof protectedHeader.typ != "string" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))
       throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, "typ", checkFailed);
-    }
-    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
-    const presenceCheck = [...requiredClaims];
-    if (maxTokenAge !== void 0)
-      presenceCheck.push("iat");
-    if (audience !== void 0)
-      presenceCheck.push("aud");
-    if (subject !== void 0)
-      presenceCheck.push("sub");
-    if (issuer !== void 0)
-      presenceCheck.push("iss");
-    for (const claim of new Set(presenceCheck.reverse())) {
-      if (!Object.hasOwn(payload, claim)) {
+    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];
+    maxTokenAge !== void 0 && presenceCheck.push("iat"), audience !== void 0 && presenceCheck.push("aud"), subject !== void 0 && presenceCheck.push("sub"), issuer !== void 0 && presenceCheck.push("iss");
+    for (const claim of new Set(presenceCheck.reverse()))
+      if (!Object.hasOwn(payload, claim))
         throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, "missing");
-      }
-    }
-    if (issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-      unexpectedClaim(payload, "iss");
-    }
-    if (subject !== void 0 && payload.sub !== subject) {
-      unexpectedClaim(payload, "sub");
-    }
-    if (audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience === "string" ? [audience] : audience)) {
-      unexpectedClaim(payload, "aud");
-    }
+    issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, "iss"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, "sub"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == "string" ? [audience] : audience) && unexpectedClaim(payload, "aud");
     const { clockTolerance } = options;
     let tolerance = 0;
-    if (typeof clockTolerance === "string") {
+    if (typeof clockTolerance == "string")
       tolerance = secs(clockTolerance);
-    } else if (clockTolerance !== void 0) {
-      if (typeof clockTolerance !== "number") {
+    else if (clockTolerance !== void 0) {
+      if (typeof clockTolerance != "number")
         throw new TypeError("Invalid clockTolerance option type");
-      }
       tolerance = clockTolerance;
     }
     validateInput("clockTolerance option", tolerance);
-    const { currentDate } = options;
-    const now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate));
-    const iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0);
-    const nbf = validateNumericDate(payload, "nbf");
-    if (nbf !== void 0) {
-      if (nbf > now + tolerance) {
-        throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
-      }
-    }
+    const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(payload, "nbf");
+    if (nbf !== void 0 && nbf > now + tolerance)
+      throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, "nbf", checkFailed);
     const exp = validateNumericDate(payload, "exp");
-    if (exp !== void 0) {
-      if (exp <= now - tolerance) {
-        throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
-      }
-    }
+    if (exp !== void 0 && exp <= now - tolerance)
+      throw new JWTExpired('"exp" claim timestamp check failed', payload, "exp", checkFailed);
     if (maxTokenAge !== void 0) {
-      const age = now - iat;
-      const max = validateInput("maxTokenAge option", typeof maxTokenAge === "number" ? maxTokenAge : secs(maxTokenAge));
-      if (age - tolerance > max) {
+      const age = now - iat, max = validateInput("maxTokenAge option", typeof maxTokenAge == "number" ? maxTokenAge : secs(maxTokenAge));
+      if (age - tolerance > max)
         throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, "iat", checkFailed);
-      }
-      if (age < -tolerance) {
+      if (age < -tolerance)
         throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, "iat", checkFailed);
-      }
     }
     return payload;
   }
@@ -38778,9 +38067,8 @@ return true;`);
     const payload = producerPayload(producer);
     for (const claim of ["iat", "nbf", "exp"]) {
       const value = payload[claim];
-      if (typeof value === "number" && !Number.isFinite(value)) {
+      if (typeof value == "number" && !Number.isFinite(value))
         throw new TypeError(`"${claim}" claim must be a finite number`);
-      }
     }
     return encoder.encode(JSON.stringify(payload));
   }
@@ -38792,7 +38080,7 @@ return true;`);
     "../node_modules/jose/dist/webapi/lib/jwt_claims_set.js"() {
       init_errors();
       init_buffer_utils();
-      init_type_checks();
+      init_validate2();
       epoch = (date) => Math.floor(date.getTime() / 1e3);
       multipliers = {
         s: 1,
@@ -38808,61 +38096,34 @@ return true;`);
         const normalized = value.toLowerCase();
         return value.includes("/") ? normalized : `application/${normalized}`;
       };
-      checkAudiencePresence = (audPayload, audOption) => {
-        if (typeof audPayload === "string") {
-          return audOption.includes(audPayload);
-        }
-        if (Array.isArray(audPayload)) {
-          return audOption.some((aud) => audPayload.includes(aud));
-        }
-        return false;
-      };
+      checkAudiencePresence = (audPayload, audOption) => typeof audPayload == "string" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : false;
       JWTClaimsBuilder = class {
         constructor(payload = {}) {
-          if (!isObject(payload)) {
+          if (!isObject(payload))
             throw new TypeError("JWT Claims Set MUST be an object");
-          }
-          ;
           (producerPayloads || (producerPayloads = /* @__PURE__ */ new WeakMap())).set(this, structuredClone(payload));
         }
         setIssuer(value) {
-          validateStringClaim("iss", value);
-          producerPayload(this).iss = value;
-          return this;
+          return validateStringClaim("iss", value), producerPayload(this).iss = value, this;
         }
         setSubject(value) {
-          validateStringClaim("sub", value);
-          producerPayload(this).sub = value;
-          return this;
+          return validateStringClaim("sub", value), producerPayload(this).sub = value, this;
         }
         setAudience(value) {
-          validateAudienceClaim(value);
-          producerPayload(this).aud = value;
-          return this;
+          return validateAudienceClaim(value), producerPayload(this).aud = value, this;
         }
         setJti(value) {
-          validateStringClaim("jti", value);
-          producerPayload(this).jti = value;
-          return this;
+          return validateStringClaim("jti", value), producerPayload(this).jti = value, this;
         }
         setNotBefore(value) {
-          producerPayload(this).nbf = numericDate(value, "setNotBefore");
-          return this;
+          return producerPayload(this).nbf = numericDate(value, "setNotBefore"), this;
         }
         setExpirationTime(value) {
-          producerPayload(this).exp = numericDate(value, "setExpirationTime");
-          return this;
+          return producerPayload(this).exp = numericDate(value, "setExpirationTime"), this;
         }
         setIssuedAt(value) {
           const payload = producerPayload(this);
-          if (value === void 0) {
-            payload.iat = epoch(/* @__PURE__ */ new Date());
-          } else if (typeof value === "string") {
-            payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value));
-          } else {
-            payload.iat = numericDate(value, "setIssuedAt");
-          }
-          return this;
+          return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == "string" ? payload.iat = validateInput("setIssuedAt", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, "setIssuedAt"), this;
         }
       };
     }
@@ -38870,16 +38131,11 @@ return true;`);
 
   // ../node_modules/jose/dist/webapi/jwt/verify.js
   async function jwtVerify(jwt, key, options) {
-    const verified = await verifyCompact(jwt, prepareVerify(options), key);
-    if (!verified[2]) {
+    const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+    if (!b64)
       throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-    }
-    const payload = validateClaimsSet(verified[1], verified[0], options);
-    const result = { payload, protectedHeader: verified[1] };
-    if (typeof key === "function") {
-      return { ...result, key: verified[3] };
-    }
-    return result;
+    const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+    return { ...verified, payload };
   }
   var init_verify4 = __esm({
     "../node_modules/jose/dist/webapi/jwt/verify.js"() {
@@ -38891,19 +38147,11 @@ return true;`);
 
   // ../node_modules/jose/dist/webapi/jwt/decrypt.js
   async function jwtDecrypt(jwt, key, options) {
-    const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key);
-    const protectedHeader = decrypted[1];
-    const payload = validateClaimsSet(protectedHeader, decrypted[0], options);
-    for (const claim of ["iss", "sub", "aud"]) {
-      if (protectedHeader[claim] !== void 0 && (claim === "aud" ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud) : protectedHeader[claim] !== payload[claim])) {
+    const { plaintext, ...result } = await decryptCompact(jwt, prepareDecrypt(options), key), { protectedHeader } = result, payload = validateClaimsSet(protectedHeader, plaintext, options);
+    for (const claim of ["iss", "sub", "aud"])
+      if (protectedHeader[claim] !== void 0 && (claim === "aud" ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud) : protectedHeader[claim] !== payload[claim]))
         throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, "mismatch");
-      }
-    }
-    const result = { payload, protectedHeader };
-    if (typeof key === "function") {
-      return { ...result, key: decrypted[2] };
-    }
-    return result;
+    return { payload, ...result };
   }
   var init_decrypt4 = __esm({
     "../node_modules/jose/dist/webapi/jwt/decrypt.js"() {
@@ -38914,332 +38162,196 @@ return true;`);
   });
 
   // ../node_modules/jose/dist/webapi/jwe/compact/encrypt.js
-  var _plaintext2, _protectedHeader2, _cek, _iv, _keyManagementParameters, CompactEncrypt;
+  var _input, CompactEncrypt;
   var init_encrypt2 = __esm({
     "../node_modules/jose/dist/webapi/jwe/compact/encrypt.js"() {
-      init_helpers();
-      init_type_checks();
+      init_validate2();
       init_jwe_encrypt();
       CompactEncrypt = class {
         constructor(plaintext) {
-          __privateAdd(this, _plaintext2);
-          __privateAdd(this, _protectedHeader2);
-          __privateAdd(this, _cek);
-          __privateAdd(this, _iv);
-          __privateAdd(this, _keyManagementParameters);
-          assertUint8Array(plaintext, "plaintext");
-          __privateSet(this, _plaintext2, plaintext);
+          __privateAdd(this, _input);
+          assertUint8Array(plaintext, "plaintext"), __privateSet(this, _input, [plaintext]);
         }
         setContentEncryptionKey(cek) {
-          assertNotSet(__privateGet(this, _cek), "setContentEncryptionKey");
-          __privateSet(this, _cek, cek);
-          return this;
+          return assertNotSet(__privateGet(this, _input)[5], "setContentEncryptionKey"), __privateGet(this, _input)[5] = cek, this;
         }
         setInitializationVector(iv) {
-          assertNotSet(__privateGet(this, _iv), "setInitializationVector");
-          __privateSet(this, _iv, iv);
-          return this;
+          return assertNotSet(__privateGet(this, _input)[6], "setInitializationVector"), __privateGet(this, _input)[6] = iv, this;
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader2), "setProtectedHeader");
-          __privateSet(this, _protectedHeader2, protectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _input)[1], "setProtectedHeader"), __privateGet(this, _input)[1] = protectedHeader, this;
         }
         setKeyManagementParameters(parameters) {
-          assertNotSet(__privateGet(this, _keyManagementParameters), "setKeyManagementParameters");
-          __privateSet(this, _keyManagementParameters, parameters);
-          return this;
+          return assertNotSet(__privateGet(this, _input)[7], "setKeyManagementParameters"), __privateGet(this, _input)[7] = parameters, this;
         }
         async encrypt(key, options) {
-          const jwe = await createJWE([
-            __privateGet(this, _plaintext2),
-            __privateGet(this, _protectedHeader2),
-            void 0,
-            void 0,
-            void 0,
-            __privateGet(this, _cek),
-            __privateGet(this, _iv),
-            __privateGet(this, _keyManagementParameters),
-            void 0,
-            false
-          ], key, options);
-          return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
-        }
-      };
-      _plaintext2 = new WeakMap();
-      _protectedHeader2 = new WeakMap();
-      _cek = new WeakMap();
-      _iv = new WeakMap();
-      _keyManagementParameters = new WeakMap();
+          return compactJWE(await createJWE([...__privateGet(this, _input)], key, options));
+        }
+      };
+      _input = new WeakMap();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
-  var _plaintext3, _protectedHeader3, _sharedUnprotectedHeader, _unprotectedHeader2, _aad2, _cek2, _iv2, _keyManagementParameters2, FlattenedEncrypt;
+  var _input2, FlattenedEncrypt;
   var init_encrypt3 = __esm({
     "../node_modules/jose/dist/webapi/jwe/flattened/encrypt.js"() {
-      init_helpers();
+      init_validate2();
       init_jwe_encrypt();
-      init_type_checks();
       FlattenedEncrypt = class {
         constructor(plaintext) {
-          __privateAdd(this, _plaintext3);
-          __privateAdd(this, _protectedHeader3);
-          __privateAdd(this, _sharedUnprotectedHeader);
-          __privateAdd(this, _unprotectedHeader2);
-          __privateAdd(this, _aad2);
-          __privateAdd(this, _cek2);
-          __privateAdd(this, _iv2);
-          __privateAdd(this, _keyManagementParameters2);
-          assertUint8Array(plaintext, "plaintext");
-          __privateSet(this, _plaintext3, plaintext);
+          __privateAdd(this, _input2);
+          assertUint8Array(plaintext, "plaintext"), __privateSet(this, _input2, [plaintext]);
         }
         setKeyManagementParameters(parameters) {
-          assertNotSet(__privateGet(this, _keyManagementParameters2), "setKeyManagementParameters");
-          __privateSet(this, _keyManagementParameters2, parameters);
-          return this;
+          return assertNotSet(__privateGet(this, _input2)[7], "setKeyManagementParameters"), __privateGet(this, _input2)[7] = parameters, this;
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader3), "setProtectedHeader");
-          __privateSet(this, _protectedHeader3, protectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _input2)[1], "setProtectedHeader"), __privateGet(this, _input2)[1] = protectedHeader, this;
         }
         setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-          assertNotSet(__privateGet(this, _sharedUnprotectedHeader), "setSharedUnprotectedHeader");
-          __privateSet(this, _sharedUnprotectedHeader, sharedUnprotectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _input2)[3], "setSharedUnprotectedHeader"), __privateGet(this, _input2)[3] = sharedUnprotectedHeader, this;
         }
         setUnprotectedHeader(unprotectedHeader) {
-          assertNotSet(__privateGet(this, _unprotectedHeader2), "setUnprotectedHeader");
-          __privateSet(this, _unprotectedHeader2, unprotectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _input2)[2], "setUnprotectedHeader"), __privateGet(this, _input2)[2] = unprotectedHeader, this;
         }
         setAdditionalAuthenticatedData(aad) {
-          __privateSet(this, _aad2, aad);
-          return this;
+          return __privateGet(this, _input2)[4] = aad, this;
         }
         setContentEncryptionKey(cek) {
-          assertNotSet(__privateGet(this, _cek2), "setContentEncryptionKey");
-          __privateSet(this, _cek2, cek);
-          return this;
+          return assertNotSet(__privateGet(this, _input2)[5], "setContentEncryptionKey"), __privateGet(this, _input2)[5] = cek, this;
         }
         setInitializationVector(iv) {
-          assertNotSet(__privateGet(this, _iv2), "setInitializationVector");
-          __privateSet(this, _iv2, iv);
-          return this;
+          return assertNotSet(__privateGet(this, _input2)[6], "setInitializationVector"), __privateGet(this, _input2)[6] = iv, this;
         }
         async encrypt(key, options) {
-          return createJWE([
-            __privateGet(this, _plaintext3),
-            __privateGet(this, _protectedHeader3),
-            __privateGet(this, _unprotectedHeader2),
-            __privateGet(this, _sharedUnprotectedHeader),
-            __privateGet(this, _aad2),
-            __privateGet(this, _cek2),
-            __privateGet(this, _iv2),
-            __privateGet(this, _keyManagementParameters2),
-            void 0,
-            false
-          ], key, options);
-        }
-      };
-      _plaintext3 = new WeakMap();
-      _protectedHeader3 = new WeakMap();
-      _sharedUnprotectedHeader = new WeakMap();
-      _unprotectedHeader2 = new WeakMap();
-      _aad2 = new WeakMap();
-      _cek2 = new WeakMap();
-      _iv2 = new WeakMap();
-      _keyManagementParameters2 = new WeakMap();
+          return createJWE([...__privateGet(this, _input2)], key, options);
+        }
+      };
+      _input2 = new WeakMap();
     }
   });
 
   // ../node_modules/jose/dist/webapi/lib/jws_sign.js
-  function serializeProtectedHeader(protectedHeader) {
-    if (protectedHeader === void 0)
-      return [void 0, ""];
-    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
-    return [normalized[0], encode2(normalized[1])];
-  }
-  function validateSignatureHeader(protectedHeader, joseHeader, crit) {
-    validateCritDuplicates(JWSInvalid, protectedHeader);
-    return validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
-  }
-  function signatureAlgorithm(joseHeader) {
-    const alg = joseHeader.alg;
-    if (typeof alg !== "string" || !alg) {
-      throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  async function createSignature(input, key, rejectUnencoded) {
+    let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
+    if (protectedHeader !== void 0) {
+      const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+      protectedHeader = normalized[0], protectedHeaderString = encode2(normalized[1]);
     }
-    return jwsAlgorithm(alg);
-  }
-  async function signSignature(protectedHeader, payload, entry, key) {
-    const data = concat(encode(protectedHeader), encode("."), payload);
-    const k = await prepareKey(entry, key, "sign");
-    return encode2(await sign(entry, k, data));
-  }
-  async function createSignature(input, key, assertB64) {
-    let { protectedHeader, unprotectedHeader } = input;
-    let protectedHeaderString;
-    [protectedHeader, protectedHeaderString] = serializeProtectedHeader(protectedHeader);
-    if (unprotectedHeader !== void 0) {
-      unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0];
-    }
-    if (!protectedHeader && !unprotectedHeader) {
+    if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)
       throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
-    }
-    if (!isDisjoint(protectedHeader, unprotectedHeader)) {
+    if (!isDisjoint(protectedHeader, unprotectedHeader))
       throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
-    }
     const joseHeader = { ...protectedHeader, ...unprotectedHeader };
-    const b64 = validateSignatureHeader(protectedHeader, joseHeader, input.crit);
-    assertB64?.(b64);
-    const entry = signatureAlgorithm(joseHeader);
-    let payloadS;
-    let payloadB;
+    validateCritDuplicates(JWSInvalid, protectedHeader);
+    const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+    b64 || rejectUnencoded?.();
+    const { alg } = joseHeader;
+    if (typeof alg != "string" || !alg)
+      throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    const entry = jwsAlgorithm(alg);
+    let payloadS = "", payloadB = payload, data;
     if (b64) {
-      const encoded = input.encoded ?? (input.encoded = []);
-      encoded[0] ?? (encoded[0] = encode2(input.payload));
-      encoded[1] ?? (encoded[1] = encode(encoded[0]));
-      payloadS = encoded[0];
-      payloadB = encoded[1];
-    } else {
-      payloadB = input.payload;
-      payloadS = "";
+      const encoded = input[4];
+      encoded ? (payloadS = encoded[0] ?? (encoded[0] = encode2(payload)), payloadB = encoded[1] ?? (encoded[1] = encode(payloadS))) : (payloadS = encode2(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
     }
+    data ?? (data = concat(encode(protectedHeaderString), encode("."), payloadB));
+    const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
+    entry.minRsaBits && checkModulusLength(entry.alg, k);
     const jws = {
-      signature: await signSignature(protectedHeaderString, payloadB, entry, key),
+      signature: encode2(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
       payload: payloadS
     };
-    if (protectedHeader) {
-      jws.protected = protectedHeaderString;
-    }
-    if (unprotectedHeader) {
-      jws.header = unprotectedHeader;
-    }
-    return [jws, b64];
+    return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
   }
-  async function createCompactSignature(payload, inputProtectedHeader, inputCrit, key, rejectUnencoded) {
-    const [protectedHeader, protectedHeaderString] = serializeProtectedHeader(inputProtectedHeader);
-    if (!protectedHeader) {
-      throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
-    }
-    const b64 = validateSignatureHeader(protectedHeader, protectedHeader, inputCrit);
-    if (!b64)
-      rejectUnencoded();
-    const entry = signatureAlgorithm(protectedHeader);
-    const encodedPayload = encode2(payload);
-    const signature = await signSignature(protectedHeaderString, encode(encodedPayload), entry, key);
-    return `${protectedHeaderString}.${encodedPayload}.${signature}`;
+  async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
+    const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);
+    return `${jws.protected}.${jws.payload}.${jws.signature}`;
   }
   var init_jws_sign = __esm({
     "../node_modules/jose/dist/webapi/lib/jws_sign.js"() {
       init_base64url();
-      init_signing();
       init_jws_algorithms();
-      init_type_checks();
+      init_validate2();
       init_errors();
       init_buffer_utils();
-      init_options();
       init_key();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jws/compact/sign.js
-  var _payload, _protectedHeader4, CompactSign;
+  var _payload, _protectedHeader2, CompactSign;
   var init_sign = __esm({
     "../node_modules/jose/dist/webapi/jws/compact/sign.js"() {
       init_jws_sign();
-      init_helpers();
+      init_validate2();
       CompactSign = class {
         constructor(payload) {
           __privateAdd(this, _payload);
-          __privateAdd(this, _protectedHeader4);
-          if (!(payload instanceof Uint8Array)) {
-            throw new TypeError("payload must be an instance of Uint8Array");
-          }
-          __privateSet(this, _payload, payload);
+          __privateAdd(this, _protectedHeader2);
+          assertUint8Array(payload, "payload"), __privateSet(this, _payload, payload);
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader4), "setProtectedHeader");
-          __privateSet(this, _protectedHeader4, protectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _protectedHeader2), "setProtectedHeader"), __privateSet(this, _protectedHeader2, protectedHeader), this;
         }
         async sign(key, options) {
-          return createCompactSignature(__privateGet(this, _payload), __privateGet(this, _protectedHeader4), options?.crit, key, () => {
+          return createCompactSignature(__privateGet(this, _payload), __privateGet(this, _protectedHeader2), options?.crit, key, () => {
             throw new TypeError("use the flattened module for creating JWS with b64: false");
           });
         }
       };
       _payload = new WeakMap();
-      _protectedHeader4 = new WeakMap();
+      _protectedHeader2 = new WeakMap();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jws/flattened/sign.js
-  var _payload2, _protectedHeader5, _unprotectedHeader3, FlattenedSign;
+  var _input3, FlattenedSign;
   var init_sign2 = __esm({
     "../node_modules/jose/dist/webapi/jws/flattened/sign.js"() {
       init_jws_sign();
-      init_helpers();
+      init_validate2();
       FlattenedSign = class {
         constructor(payload) {
-          __privateAdd(this, _payload2);
-          __privateAdd(this, _protectedHeader5);
-          __privateAdd(this, _unprotectedHeader3);
-          if (!(payload instanceof Uint8Array)) {
-            throw new TypeError("payload must be an instance of Uint8Array");
-          }
-          __privateSet(this, _payload2, payload);
+          __privateAdd(this, _input3);
+          assertUint8Array(payload, "payload"), __privateSet(this, _input3, [payload]);
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader5), "setProtectedHeader");
-          __privateSet(this, _protectedHeader5, protectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _input3)[1], "setProtectedHeader"), __privateGet(this, _input3)[1] = protectedHeader, this;
         }
         setUnprotectedHeader(unprotectedHeader) {
-          assertNotSet(__privateGet(this, _unprotectedHeader3), "setUnprotectedHeader");
-          __privateSet(this, _unprotectedHeader3, unprotectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _input3)[2], "setUnprotectedHeader"), __privateGet(this, _input3)[2] = unprotectedHeader, this;
         }
         async sign(key, options) {
-          const [jws] = await createSignature({
-            payload: __privateGet(this, _payload2),
-            protectedHeader: __privateGet(this, _protectedHeader5),
-            unprotectedHeader: __privateGet(this, _unprotectedHeader3),
-            crit: options?.crit
-          }, key);
+          const input = [...__privateGet(this, _input3)];
+          input[3] = options?.crit;
+          const [jws] = await createSignature(input, key);
           return jws;
         }
       };
-      _payload2 = new WeakMap();
-      _protectedHeader5 = new WeakMap();
-      _unprotectedHeader3 = new WeakMap();
+      _input3 = new WeakMap();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jws/general/sign.js
-  var _parent2, IndividualSignature, _payload3, _signatures, GeneralSign;
+  var _parent2, IndividualSignature, _payload2, _signatures, GeneralSign;
   var init_sign3 = __esm({
     "../node_modules/jose/dist/webapi/jws/general/sign.js"() {
       init_jws_sign();
       init_errors();
-      init_helpers();
+      init_validate2();
       IndividualSignature = class {
         constructor(sig2, key, options) {
           __privateAdd(this, _parent2);
           __publicField(this, "state");
-          __privateSet(this, _parent2, sig2);
-          this.state = [void 0, void 0, key, options?.crit];
+          __privateSet(this, _parent2, sig2), this.state = [void 0, void 0, key, options?.crit];
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(this.state[0], "setProtectedHeader");
-          this.state[0] = protectedHeader;
-          return this;
+          return assertNotSet(this.state[0], "setProtectedHeader"), this.state[0] = protectedHeader, this;
         }
         setUnprotectedHeader(unprotectedHeader) {
-          assertNotSet(this.state[1], "setUnprotectedHeader");
-          this.state[1] = unprotectedHeader;
-          return this;
+          return assertNotSet(this.state[1], "setUnprotectedHeader"), this.state[1] = unprotectedHeader, this;
         }
         addSignature(...args) {
           return __privateGet(this, _parent2).addSignature(...args);
@@ -39254,163 +38366,116 @@ return true;`);
       _parent2 = new WeakMap();
       GeneralSign = class {
         constructor(payload) {
-          __privateAdd(this, _payload3);
+          __privateAdd(this, _payload2);
           __privateAdd(this, _signatures, []);
-          __privateSet(this, _payload3, payload);
+          __privateSet(this, _payload2, payload);
         }
         addSignature(key, options) {
           const signature = new IndividualSignature(this, key, options);
-          __privateGet(this, _signatures).push(signature);
-          return signature;
+          return __privateGet(this, _signatures).push(signature), signature;
         }
         async sign() {
-          if (!__privateGet(this, _signatures).length) {
+          if (!__privateGet(this, _signatures).length)
             throw new JWSInvalid("at least one signature must be added");
-          }
-          if (!(__privateGet(this, _payload3) instanceof Uint8Array)) {
-            throw new TypeError("payload must be an instance of Uint8Array");
-          }
+          assertUint8Array(__privateGet(this, _payload2), "payload");
           const jws = {
             signatures: [],
             payload: ""
-          };
-          const encoded = [];
+          }, encoded = [];
           let b64;
-          for (let i = 0; i < __privateGet(this, _signatures).length; i++) {
-            const signature = __privateGet(this, _signatures)[i];
-            const [protectedHeader, unprotectedHeader, key, crit] = signature.state;
-            const [{ payload, ...rest }, signatureB64] = await createSignature({
-              payload: __privateGet(this, _payload3),
-              protectedHeader,
-              unprotectedHeader,
-              crit,
-              encoded
-            }, key);
-            if (b64 === void 0) {
-              b64 = signatureB64;
-              jws.payload = payload;
-            } else if (b64 !== signatureB64) {
+          for (const signature of __privateGet(this, _signatures)) {
+            const [protectedHeader, unprotectedHeader, key, crit] = signature.state, [{ payload, ...rest }, signatureB64] = await createSignature([__privateGet(this, _payload2), protectedHeader, unprotectedHeader, crit, encoded], key);
+            if (b64 === void 0)
+              b64 = signatureB64, jws.payload = payload;
+            else if (b64 !== signatureB64)
               throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
-            }
             jws.signatures.push(rest);
           }
           return jws;
         }
       };
-      _payload3 = new WeakMap();
+      _payload2 = new WeakMap();
       _signatures = new WeakMap();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jwt/sign.js
-  var SignJWT_base, _protectedHeader6, SignJWT;
+  var SignJWT_base, _protectedHeader3, SignJWT;
   var init_sign4 = __esm({
     "../node_modules/jose/dist/webapi/jwt/sign.js"() {
       init_jws_sign();
       init_errors();
       init_jwt_claims_set();
-      init_helpers();
+      init_validate2();
       SignJWT_base = JWTClaimsBuilder;
       SignJWT = class extends SignJWT_base {
         constructor() {
           super(...arguments);
-          __privateAdd(this, _protectedHeader6);
+          __privateAdd(this, _protectedHeader3);
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader6), "setProtectedHeader");
-          __privateSet(this, _protectedHeader6, protectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _protectedHeader3), "setProtectedHeader"), __privateSet(this, _protectedHeader3, protectedHeader), this;
         }
         async sign(key, options) {
-          return createCompactSignature(jwtData(this), __privateGet(this, _protectedHeader6), options?.crit, key, () => {
+          return createCompactSignature(jwtData(this), __privateGet(this, _protectedHeader3), options?.crit, key, () => {
             throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
           });
         }
       };
-      _protectedHeader6 = new WeakMap();
+      _protectedHeader3 = new WeakMap();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jwt/encrypt.js
-  var EncryptJWT_base, _cek3, _iv3, _keyManagementParameters3, _protectedHeader7, _replicateIssuerAsHeader, _replicateSubjectAsHeader, _replicateAudienceAsHeader, EncryptJWT;
+  var EncryptJWT_base, _input4, _replicateIssuerAsHeader, _replicateSubjectAsHeader, _replicateAudienceAsHeader, EncryptJWT;
   var init_encrypt4 = __esm({
     "../node_modules/jose/dist/webapi/jwt/encrypt.js"() {
       init_jwe_encrypt();
       init_jwt_claims_set();
-      init_helpers();
+      init_validate2();
       EncryptJWT_base = JWTClaimsBuilder;
       EncryptJWT = class extends EncryptJWT_base {
         constructor() {
           super(...arguments);
-          __privateAdd(this, _cek3);
-          __privateAdd(this, _iv3);
-          __privateAdd(this, _keyManagementParameters3);
-          __privateAdd(this, _protectedHeader7);
+          __privateAdd(this, _input4, [void 0]);
           __privateAdd(this, _replicateIssuerAsHeader);
           __privateAdd(this, _replicateSubjectAsHeader);
           __privateAdd(this, _replicateAudienceAsHeader);
         }
         setProtectedHeader(protectedHeader) {
-          assertNotSet(__privateGet(this, _protectedHeader7), "setProtectedHeader");
-          __privateSet(this, _protectedHeader7, protectedHeader);
-          return this;
+          return assertNotSet(__privateGet(this, _input4)[1], "setProtectedHeader"), __privateGet(this, _input4)[1] = protectedHeader, this;
         }
         setKeyManagementParameters(parameters) {
-          assertNotSet(__privateGet(this, _keyManagementParameters3), "setKeyManagementParameters");
-          __privateSet(this, _keyManagementParameters3, parameters);
-          return this;
+          return assertNotSet(__privateGet(this, _input4)[7], "setKeyManagementParameters"), __privateGet(this, _input4)[7] = parameters, this;
         }
         setContentEncryptionKey(cek) {
-          assertNotSet(__privateGet(this, _cek3), "setContentEncryptionKey");
-          __privateSet(this, _cek3, cek);
-          return this;
+          return assertNotSet(__privateGet(this, _input4)[5], "setContentEncryptionKey"), __privateGet(this, _input4)[5] = cek, this;
         }
         setInitializationVector(iv) {
-          assertNotSet(__privateGet(this, _iv3), "setInitializationVector");
-          __privateSet(this, _iv3, iv);
-          return this;
+          return assertNotSet(__privateGet(this, _input4)[6], "setInitializationVector"), __privateGet(this, _input4)[6] = iv, this;
         }
         replicateIssuerAsHeader() {
-          __privateSet(this, _replicateIssuerAsHeader, true);
-          return this;
+          return __privateSet(this, _replicateIssuerAsHeader, true), this;
         }
         replicateSubjectAsHeader() {
-          __privateSet(this, _replicateSubjectAsHeader, true);
-          return this;
+          return __privateSet(this, _replicateSubjectAsHeader, true), this;
         }
         replicateAudienceAsHeader() {
-          __privateSet(this, _replicateAudienceAsHeader, true);
-          return this;
+          return __privateSet(this, _replicateAudienceAsHeader, true), this;
         }
         async encrypt(key, options) {
           const plaintext = jwtData(this);
-          if (__privateGet(this, _protectedHeader7) && (__privateGet(this, _replicateIssuerAsHeader) || __privateGet(this, _replicateSubjectAsHeader) || __privateGet(this, _replicateAudienceAsHeader))) {
-            __privateSet(this, _protectedHeader7, {
-              ...__privateGet(this, _protectedHeader7),
-              iss: __privateGet(this, _replicateIssuerAsHeader) ? jwtClaim(this, "iss") : void 0,
-              sub: __privateGet(this, _replicateSubjectAsHeader) ? jwtClaim(this, "sub") : void 0,
-              aud: __privateGet(this, _replicateAudienceAsHeader) ? jwtClaim(this, "aud") : void 0
-            });
-          }
-          const jwe = await createJWE([
-            plaintext,
-            __privateGet(this, _protectedHeader7),
-            void 0,
-            void 0,
-            void 0,
-            __privateGet(this, _cek3),
-            __privateGet(this, _iv3),
-            __privateGet(this, _keyManagementParameters3),
-            void 0,
-            false
-          ], key, options);
-          return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
-        }
-      };
-      _cek3 = new WeakMap();
-      _iv3 = new WeakMap();
-      _keyManagementParameters3 = new WeakMap();
-      _protectedHeader7 = new WeakMap();
+          __privateGet(this, _input4)[1] && (__privateGet(this, _replicateIssuerAsHeader) || __privateGet(this, _replicateSubjectAsHeader) || __privateGet(this, _replicateAudienceAsHeader)) && (__privateGet(this, _input4)[1] = {
+            ...__privateGet(this, _input4)[1],
+            iss: __privateGet(this, _replicateIssuerAsHeader) ? jwtClaim(this, "iss") : void 0,
+            sub: __privateGet(this, _replicateSubjectAsHeader) ? jwtClaim(this, "sub") : void 0,
+            aud: __privateGet(this, _replicateAudienceAsHeader) ? jwtClaim(this, "aud") : void 0
+          });
+          const input = [...__privateGet(this, _input4)];
+          return input[0] = plaintext, compactJWE(await createJWE(input, key, options));
+        }
+      };
+      _input4 = new WeakMap();
       _replicateIssuerAsHeader = new WeakMap();
       _replicateSubjectAsHeader = new WeakMap();
       _replicateAudienceAsHeader = new WeakMap();
@@ -39422,7 +38487,7 @@ return true;`);
     throw new JOSENotSupported(`Invalid or unsupported ${source} value`);
   }
   function keyAlgorithm(alg, source) {
-    return (typeof alg === "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
+    return (typeof alg == "string" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);
   }
   var algArgument;
   var init_key_algorithm = __esm({
@@ -39434,44 +38499,22 @@ return true;`);
     }
   });
 
-  // ../node_modules/jose/dist/webapi/lib/key_options.js
-  function validateExtractableOption(extractable) {
-    if (extractable !== void 0 && typeof extractable !== "boolean") {
-      throw new TypeError('"extractable" option must be a boolean');
-    }
-    return extractable;
-  }
-  var init_key_options = __esm({
-    "../node_modules/jose/dist/webapi/lib/key_options.js"() {
-    }
-  });
-
   // ../node_modules/jose/dist/webapi/lib/asn1.js
   function parseKeyHeader(state, keyFormat) {
-    expectTag(state, 48, `Invalid ${keyFormat === "spki" ? "SPKI" : "PKCS#8"} structure`);
-    parseLength(state);
-    if (keyFormat === "pkcs8") {
+    if (expectTag(state, 48, `Invalid ${keyFormat === "spki" ? "SPKI" : "PKCS#8"} structure`), parseLength(state), keyFormat === "pkcs8") {
       expectTag(state, 2, "Expected version field");
       const length = parseLength(state);
       state.pos += length;
     }
-    expectTag(state, 48, "Expected algorithm identifier");
-    parseLength(state);
+    expectTag(state, 48, "Expected algorithm identifier"), parseLength(state);
   }
   function spkiFromX509(buf) {
     const state = createASN1State(buf);
     expectTag(state, 48, "Invalid certificate structure");
     const certificateLength = parseLength(state);
-    if (certificateLength < 0 || state.pos + certificateLength > state.data.length) {
+    if (certificateLength < 0 || state.pos + certificateLength > state.data.length)
       throw new Error("Unexpected end of ASN.1 input");
-    }
-    expectTag(state, 48, "Invalid tbsCertificate structure");
-    parseLength(state);
-    if (buf[state.pos] === 160) {
-      skipElement(state, 6);
-    } else {
-      skipElement(state, 5);
-    }
+    expectTag(state, 48, "Invalid tbsCertificate structure"), parseLength(state), buf[state.pos] === 160 ? skipElement(state, 6) : skipElement(state, 5);
     const spkiStart = state.pos;
     expectTag(state, 48, "Invalid SPKI structure");
     const spkiContentLen = parseLength(state);
@@ -39480,34 +38523,29 @@ return true;`);
   var formatPEM, genericExport, toSPKI, toPKCS8, bytesEqual, createASN1State, readByte, parseLength, skipElement, expectTag, getSubarray, parseAlgorithmOID, parseECAlgorithmIdentifier, genericImport, processPEMData, fromPKCS8, fromSPKI, fromX509;
   var init_asn1 = __esm({
     "../node_modules/jose/dist/webapi/lib/asn1.js"() {
-      init_invalid_key_input();
-      init_base64();
+      init_key();
+      init_buffer_utils();
       init_errors();
       init_key_algorithm();
-      init_is_key_like();
-      init_key_options();
       formatPEM = (b64, descriptor) => {
-        const newlined = (b64.match(/.{1,64}/g) || []).join("\n");
+        const newlined = (b64.match(/.{1,64}/g) || []).join(`
+`);
         return `-----BEGIN ${descriptor}-----
 ${newlined}
 -----END ${descriptor}-----`;
       };
       genericExport = async (keyType, keyFormat, key) => {
         if (isKeyObject(key)) {
-          if (key.type !== keyType) {
+          if (key.type !== keyType)
             throw new TypeError(`key is not a ${keyType} key`);
-          }
           return key.export({ format: "pem", type: keyFormat });
         }
-        if (!isCryptoKey(key)) {
+        if (!isCryptoKey(key))
           throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject"));
-        }
-        if (!key.extractable) {
+        if (!key.extractable)
           throw new TypeError("CryptoKey is not extractable");
-        }
-        if (key.type !== keyType) {
+        if (key.type !== keyType)
           throw new TypeError(`key is not a ${keyType} key`);
-        }
         return formatPEM(encodeBase64(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
       };
       toSPKI = (key) => genericExport("public", "spki", key);
@@ -39515,18 +38553,16 @@ ${newlined}
       bytesEqual = (a, b) => {
         if (a.byteLength !== b.length)
           return false;
-        for (let i = 0; i < a.byteLength; i++) {
+        for (let i = 0; i < a.byteLength; i++)
           if (a[i] !== b[i])
             return false;
-        }
         return true;
       };
       createASN1State = (data) => ({ data, pos: 0 });
       readByte = (state) => {
         const byte = state.data[state.pos++];
-        if (byte === void 0) {
+        if (byte === void 0)
           throw new Error("Unexpected end of ASN.1 input");
-        }
         return byte;
       };
       parseLength = (state) => {
@@ -39534,32 +38570,28 @@ ${newlined}
         if (first & 128) {
           const lengthOfLen = first & 127;
           let length = 0;
-          for (let i = 0; i < lengthOfLen; i++) {
+          for (let i = 0; i < lengthOfLen; i++)
             length = length << 8 | readByte(state);
-          }
           return length;
         }
         return first;
       };
       skipElement = (state, count = 1) => {
-        while (count-- > 0) {
+        for (; count-- > 0; ) {
           state.pos++;
           const length = parseLength(state);
           state.pos += length;
         }
       };
       expectTag = (state, expectedTag, errorMessage) => {
-        if (readByte(state) !== expectedTag) {
+        if (readByte(state) !== expectedTag)
           throw new Error(errorMessage);
-        }
       };
       getSubarray = (state, length) => {
-        if (length < 0 || state.pos + length > state.data.length) {
+        if (length < 0 || state.pos + length > state.data.length)
           throw new Error("Unexpected end of ASN.1 input");
-        }
         const result = state.data.subarray(state.pos, state.pos + length);
-        state.pos += length;
-        return result;
+        return state.pos += length, result;
       };
       parseAlgorithmOID = (state) => {
         expectTag(state, 6, "Expected algorithm OID");
@@ -39568,15 +38600,12 @@ ${newlined}
       };
       parseECAlgorithmIdentifier = (state) => {
         const algOid = parseAlgorithmOID(state);
-        if (bytesEqual(algOid, [43, 101, 110])) {
+        if (bytesEqual(algOid, [43, 101, 110]))
           return "X25519";
-        }
-        if (!bytesEqual(algOid, [42, 134, 72, 206, 61, 2, 1])) {
+        if (!bytesEqual(algOid, [42, 134, 72, 206, 61, 2, 1]))
           throw new Error("Unsupported key algorithm");
-        }
         expectTag(state, 6, "Expected curve OID");
-        const curveOidLen = parseLength(state);
-        const curveOid = getSubarray(state, curveOidLen);
+        const curveOidLen = parseLength(state), curveOid = getSubarray(state, curveOidLen);
         if (bytesEqual(curveOid, [42, 134, 72, 206, 61, 3, 1, 7]))
           return "P-256";
         if (bytesEqual(curveOid, [43, 129, 4, 0, 34]))
@@ -39586,29 +38615,22 @@ ${newlined}
         throw new Error("Unsupported named curve");
       };
       genericImport = async (keyFormat, keyData, alg, options) => {
-        const extractable = validateExtractableOption(options?.extractable);
-        const entry = keyAlgorithm(alg, algArgument);
-        if (entry.secret) {
-          unsupportedAlg(algArgument);
-        }
+        const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);
+        entry.secret && unsupportedAlg(algArgument);
         const isPublic = keyFormat === "spki";
         let algorithm;
-        if (entry.resolve) {
+        if (entry.resolve)
           try {
             const state = createASN1State(keyData);
-            parseKeyHeader(state, keyFormat);
-            algorithm = entry.resolve({ crv: parseECAlgorithmIdentifier(state) });
+            parseKeyHeader(state, keyFormat), algorithm = entry.resolve({ crv: parseECAlgorithmIdentifier(state) });
           } catch {
             throw new JOSENotSupported("Invalid or unsupported key format");
           }
-        } else {
+        else
           algorithm = entry.subtle;
-        }
         return crypto.subtle.importKey(keyFormat, keyData, algorithm, extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
       };
-      processPEMData = (pem, pattern) => {
-        return decodeBase64(pem.replace(pattern, ""));
-      };
+      processPEMData = (pem, pattern) => decodeBase64(pem.replace(pattern, ""));
       fromPKCS8 = (pem, alg, options) => {
         const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);
         return genericImport("pkcs8", keyData, alg, options);
@@ -39631,51 +38653,38 @@ ${newlined}
   });
 
   // ../node_modules/jose/dist/webapi/key/export.js
-  function omitUndefinedProperties(jwk) {
-    return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== void 0));
+  function exportSPKI(key) {
+    return toSPKI(key);
+  }
+  function exportPKCS8(key) {
+    return toPKCS8(key);
   }
-  async function keyToJWK(key) {
-    if (isKeyObject(key)) {
-      if (key.type === "secret") {
+  async function exportJWK(key) {
+    if (isKeyObject(key))
+      if (key.type === "secret")
         key = key.export();
-      } else {
+      else
         return key.export({ format: "jwk" });
-      }
-    }
-    if (key instanceof Uint8Array) {
+    if (key instanceof Uint8Array)
       return {
         kty: "oct",
         k: encode2(key)
       };
-    }
-    if (!isCryptoKey(key)) {
+    if (!isCryptoKey(key))
       throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
-    }
-    if (!key.extractable) {
+    if (!key.extractable)
       throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
-    }
-    const { ext, key_ops, alg, use, ...jwk } = omitUndefinedProperties(await crypto.subtle.exportKey("jwk", key));
-    if (jwk.kty === "AKP") {
-      ;
-      jwk.alg = alg;
-    }
+    const jwk = await crypto.subtle.exportKey("jwk", key);
+    delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== "AKP" && delete jwk.alg;
+    for (const parameter of Object.keys(jwk))
+      jwk[parameter] === void 0 && delete jwk[parameter];
     return jwk;
   }
-  function exportSPKI(key) {
-    return toSPKI(key);
-  }
-  function exportPKCS8(key) {
-    return toPKCS8(key);
-  }
-  function exportJWK(key) {
-    return keyToJWK(key);
-  }
   var init_export = __esm({
     "../node_modules/jose/dist/webapi/key/export.js"() {
       init_asn1();
-      init_invalid_key_input();
+      init_key();
       init_base64url();
-      init_is_key_like();
     }
   });
 
@@ -39683,46 +38692,31 @@ ${newlined}
   async function calculateJwkThumbprint(key, digestAlgorithm) {
     let jwk;
     if (isObject(key)) {
-      jwk = snapshotJwk(key);
-      if (typeof jwk.kty !== "string") {
+      if (jwk = snapshotJwk(key), typeof jwk.kty != "string")
         throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
-      }
-    } else if (isKeyLike(key)) {
+    } else if (isKeyLike(key))
       jwk = snapshotJwk(await exportJWK(key));
-    } else {
+    else
       throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
-    }
-    digestAlgorithm ?? (digestAlgorithm = "sha256");
-    if (digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512") {
+    if (digestAlgorithm ?? (digestAlgorithm = "sha256"), digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512")
       throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
-    }
     let components;
     switch (jwk.kty) {
       case "AKP":
-        check(jwk.alg, '"alg" (Algorithm) Parameter');
-        check(jwk.pub, '"pub" (Public key) Parameter');
-        components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+        check(jwk.alg, '"alg" (Algorithm) Parameter'), check(jwk.pub, '"pub" (Public key) Parameter'), components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
         break;
       case "EC":
-        check(jwk.crv, '"crv" (Curve) Parameter');
-        check(jwk.x, '"x" (X Coordinate) Parameter');
-        check(jwk.y, '"y" (Y Coordinate) Parameter');
-        components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+        check(jwk.crv, '"crv" (Curve) Parameter'), check(jwk.x, '"x" (X Coordinate) Parameter'), check(jwk.y, '"y" (Y Coordinate) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
         break;
       case "OKP":
-        check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter');
-        check(jwk.x, '"x" (Public Key) Parameter');
-        components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+        check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter'), check(jwk.x, '"x" (Public Key) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
         break;
       case "RSA":
-        check(jwk.e, '"e" (Exponent) Parameter');
-        check(jwk.n, '"n" (Modulus) Parameter');
-        components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
+        check(jwk.e, '"e" (Exponent) Parameter'), check(jwk.n, '"n" (Modulus) Parameter'), components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
         break;
       case "oct":
-        if (typeof jwk.k !== "string") {
+        if (typeof jwk.k != "string")
           throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
-        }
         components = { k: jwk.k, kty: jwk.kty };
         break;
       default:
@@ -39739,19 +38733,15 @@ ${newlined}
   var check;
   var init_thumbprint = __esm({
     "../node_modules/jose/dist/webapi/jwk/thumbprint.js"() {
-      init_helpers();
+      init_buffer_utils();
       init_base64url();
       init_errors();
-      init_buffer_utils();
-      init_is_key_like();
-      init_type_checks();
+      init_key();
+      init_validate2();
       init_export();
-      init_invalid_key_input();
-      init_jwk_metadata();
       check = (value, description) => {
-        if (typeof value !== "string" || !value) {
+        if (typeof value != "string" || !value)
           throw new JWKInvalid(`${description} missing or invalid`);
-        }
       };
     }
   });
@@ -39762,9 +38752,8 @@ ${newlined}
       ...protectedHeader,
       ...token?.header
     };
-    if (!isObject(joseHeader.jwk)) {
+    if (!isObject(joseHeader.jwk))
       throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
-    }
     let jwk;
     try {
       jwk = normalizeJwk(joseHeader.jwk);
@@ -39772,45 +38761,42 @@ ${newlined}
       throw new JWSInvalid("Invalid Embedded JWK", { cause });
     }
     const entry = jwsAlgorithm(joseHeader.alg);
-    if (jwk.use !== void 0 && jwk.use !== "sig") {
+    if (jwk.use !== void 0 && jwk.use !== "sig")
       throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
-    }
-    if (jwk.alg !== void 0 && jwk.alg !== entry.alg) {
+    if (jwk.alg !== void 0 && jwk.alg !== entry.alg)
       throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
-    }
-    const key = await jwkToKey(entry, { ...jwk, ext: true });
-    if (key.type !== "public") {
+    const key = await jwkToKey(entry, jwk, true);
+    if (key.type !== "public")
       throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
-    }
     return key;
   }
   var init_embedded = __esm({
     "../node_modules/jose/dist/webapi/jwk/embedded.js"() {
-      init_jwk_to_key();
+      init_key();
       init_jws_algorithms();
-      init_type_checks();
+      init_validate2();
       init_errors();
-      init_jwk_metadata();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jwks/local.js
   function isUsableJWK(jwk, entry, alg, kid) {
-    const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
-    const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
-    return (ext === void 0 || typeof ext === "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation === "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid === "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
+    const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
+    return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
   }
   async function importWithAlgCache(cache2, jwk, entry) {
-    const cached2 = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk);
-    const { alg } = entry;
-    if (cached2[alg] === void 0) {
-      const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
-      if (key.type !== "public") {
-        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
-      }
-      cached2[alg] = key;
+    const cached = cache2.get(jwk) || cache2.set(jwk, {}).get(jwk), { alg } = entry;
+    if (cached[alg] === void 0) {
+      const pending = jwkToKey(entry, jwk, true).then((key) => {
+        if (key.type !== "public")
+          throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+        return cached[alg] = key, key;
+      }).catch((error) => {
+        throw cached[alg] === pending && delete cached[alg], error;
+      });
+      cached[alg] = pending;
     }
-    return cached2[alg];
+    return cached[alg];
   }
   function createLocalJWKSet(jwks) {
     let snapshot;
@@ -39818,52 +38804,46 @@ ${newlined}
       snapshot = structuredClone(jwks);
     } catch {
     }
-    if (!isJwkSet(snapshot)) {
+    if (!isJwkSet(snapshot))
       throw new JWKSInvalid("JSON Web Key Set malformed");
-    }
-    const cached2 = /* @__PURE__ */ new WeakMap();
-    const localJWKSet = async (protectedHeader, token) => {
-      const { alg, kid } = { ...protectedHeader, ...token?.header };
-      const entry = typeof alg === "string" ? JWS[alg] : void 0;
-      if (!entry || entry.secret) {
+    const metadata = snapshot.keys.map((jwk) => {
+      const normalized = snapshotJwk(jwk);
+      return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+    }), cached = /* @__PURE__ */ new WeakMap();
+    return Object.defineProperty(async (protectedHeader, token) => {
+      const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
+      if (!entry || entry.secret)
         throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-      }
-      const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid));
-      const { 0: jwk, length } = candidates;
-      if (!length) {
+      const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
+      if (!length)
         throw new JWKSNoMatchingKey();
-      }
       if (length !== 1) {
         const error = new JWKSMultipleMatchingKeys();
-        error[Symbol.asyncIterator] = async function* () {
-          for (const jwk2 of candidates) {
+        throw error[Symbol.asyncIterator] = async function* () {
+          for (const jwk2 of candidates)
             try {
-              yield await importWithAlgCache(cached2, jwk2, entry);
+              yield await importWithAlgCache(cached, jwk2, entry);
             } catch {
             }
-          }
-        };
-        throw error;
+        }, error;
       }
-      return importWithAlgCache(cached2, jwk, entry);
-    };
-    return Object.defineProperty(localJWKSet, "jwks", {
+      return importWithAlgCache(cached, jwk, entry);
+    }, "jwks", {
       value: () => structuredClone(snapshot)
     });
   }
   var init_local = __esm({
     "../node_modules/jose/dist/webapi/jwks/local.js"() {
-      init_jwk_to_key();
+      init_key();
       init_jws_algorithms();
       init_errors();
-      init_type_checks();
-      init_jwk_metadata();
+      init_validate2();
     }
   });
 
   // ../node_modules/jose/dist/webapi/jwks/remote.js
   function isCloudflareWorkers() {
-    return typeof WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime !== "undefined" && EdgeRuntime === "vercel";
+    return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
   }
   async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
     const response = await fetchImpl(url, {
@@ -39872,14 +38852,10 @@ ${newlined}
       redirect: "manual",
       headers
     }).catch((err) => {
-      if (err.name === "TimeoutError") {
-        throw new JWKSTimeout();
-      }
-      throw err;
+      throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
     });
-    if (response.status !== 200) {
+    if (response.status !== 200)
       throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
-    }
     try {
       return await response.json();
     } catch {
@@ -39890,87 +38866,49 @@ ${newlined}
     return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
   }
   function validateDuration(value, fallback, option) {
-    if (Number.isNaN(value)) {
+    if (Number.isNaN(value))
       throw new TypeError(`"${option}" option must not be NaN`);
-    }
-    return typeof value === "number" ? value : fallback;
+    return typeof value == "number" ? value : fallback;
   }
   function createRemoteJWKSet(url, options) {
-    if (!(url instanceof URL)) {
+    if (!(url instanceof URL))
       throw new TypeError("url must be an instance of URL");
-    }
-    const href = new URL(url.href).href;
-    const opts = options ?? {};
-    const timeoutOption = opts.timeoutDuration;
-    if (typeof timeoutOption === "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0)) {
+    const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;
+    if (typeof timeoutOption == "number" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))
       throw new TypeError('"timeoutDuration" option must be a non-negative integer');
-    }
-    const timeoutDuration = typeof timeoutOption === "number" ? timeoutOption : 5e3;
-    const cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration");
-    const cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge");
-    const headers = new Headers(opts.headers);
-    if (USER_AGENT && !headers.has("User-Agent")) {
-      headers.set("User-Agent", USER_AGENT);
-    }
-    if (!headers.has("accept")) {
-      headers.set("accept", "application/json, application/jwk-set+json");
-    }
-    const fetchImpl = opts[customFetch];
-    const cache2 = opts[jwksCache];
-    let jwksTimestamp;
-    let pendingFetch;
-    let reloadSequence = 0;
-    let appliedSequence = 0;
-    let local;
-    if (cache2 && typeof cache2 === "object") {
+    const timeoutDuration = typeof timeoutOption == "number" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, "cooldownDuration"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, "cacheMaxAge"), headers = new Headers(opts.headers);
+    USER_AGENT && !headers.has("User-Agent") && headers.set("User-Agent", USER_AGENT), headers.has("accept") || headers.set("accept", "application/json, application/jwk-set+json");
+    const fetchImpl = opts[customFetch], cache2 = opts[jwksCache];
+    let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;
+    if (cache2 && typeof cache2 == "object") {
       const { uat, jwks } = cache2;
-      if (isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks)) {
-        jwksTimestamp = uat;
-        local = createLocalJWKSet(jwks);
-      }
+      isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));
     }
     const reload = async () => {
-      if (pendingFetch && isCloudflareWorkers()) {
-        pendingFetch = void 0;
-      }
-      if (!pendingFetch) {
-        const sequence = ++reloadSequence;
-        const current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
+      if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {
+        const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {
           const next = createLocalJWKSet(json);
-          if (sequence <= appliedSequence) {
+          if (sequence <= appliedSequence)
             return;
-          }
           local = next;
           const updatedAt = Date.now();
-          if (cache2) {
-            cache2.uat = updatedAt;
-            cache2.jwks = json;
-          }
-          jwksTimestamp = updatedAt;
-          appliedSequence = sequence;
+          cache2 && (cache2.uat = updatedAt, cache2.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;
         }).finally(() => {
-          if (pendingFetch === current) {
-            pendingFetch = void 0;
-          }
+          pendingFetch === current && (pendingFetch = void 0);
         });
       }
       await pendingFetch;
     };
-    const remoteJWKSet = async (protectedHeader, token) => {
-      if (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) {
-        await reload();
-      }
+    return Object.defineProperties(async (protectedHeader, token) => {
+      (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();
       try {
         return await local(protectedHeader, token);
       } catch (err) {
-        if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) {
-          await reload();
-          return local(protectedHeader, token);
-        }
+        if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))
+          return await reload(), local(protectedHeader, token);
         throw err;
       }
-    };
-    return Object.defineProperties(remoteJWKSet, {
+    }, {
       coolingDown: {
         get: () => isFreshFor(jwksTimestamp, cooldownDuration),
         enumerable: true
@@ -39998,12 +38936,8 @@ ${newlined}
     "../node_modules/jose/dist/webapi/jwks/remote.js"() {
       init_errors();
       init_local();
-      init_type_checks();
-      if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
-        const NAME = "jose";
-        const VERSION = "v6.2.10";
-        USER_AGENT = `${NAME}/${VERSION}`;
-      }
+      init_validate2();
+      (typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.12");
       customFetch = /* @__PURE__ */ Symbol();
       jwksCache = /* @__PURE__ */ Symbol();
     }
@@ -40014,45 +38948,34 @@ ${newlined}
   var init_unsecured = __esm({
     "../node_modules/jose/dist/webapi/jwt/unsecured.js"() {
       init_base64url();
-      init_helpers();
+      init_validate2();
       init_errors();
       init_jwt_claims_set();
-      init_options();
       UnsecuredJWT_base = JWTClaimsBuilder;
       UnsecuredJWT = class extends UnsecuredJWT_base {
         encode() {
-          const header = encode2(JSON.stringify({ alg: "none" }));
-          const payload = encode2(jwtData(this));
+          const header = encode2(JSON.stringify({ alg: "none" })), payload = encode2(jwtData(this));
           return `${header}.${payload}.`;
         }
         static decode(jwt, options) {
-          if (typeof jwt !== "string") {
+          if (typeof jwt != "string")
             throw new JWTInvalid("Unsecured JWT must be a string");
-          }
           const { 0: encodedHeader, 1: encodedPayload, 2: signature, length } = jwt.split(".");
-          if (length !== 3 || signature !== "") {
+          if (length !== 3 || signature !== "")
             throw new JWTInvalid("Invalid Unsecured JWT");
-          }
-          let header;
-          let b64;
+          let header, b64;
           try {
             header = parseJoseHeader(encodedHeader, JWSInvalid, "JWS Protected Header is invalid");
             const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, void 0, header, header);
             b64 = validateB64(header, extensions);
           } catch (cause) {
-            if (!(cause instanceof JWSInvalid)) {
-              throw cause;
-            }
-            throw new JWTInvalid("Invalid Unsecured JWT", { cause });
+            throw cause instanceof JWSInvalid ? new JWTInvalid("Invalid Unsecured JWT", { cause }) : cause;
           }
-          if (header.alg !== "none") {
+          if (header.alg !== "none")
             throw new JWTInvalid("Invalid Unsecured JWT");
-          }
-          if (!b64) {
+          if (!b64)
             throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-          }
-          const payload = validateClaimsSet(header, decodeBase64url(encodedPayload, "payload", JWTInvalid), options);
-          return { payload, header };
+          return { payload: validateClaimsSet(header, decodeBase64url(encodedPayload, "payload", JWTInvalid), options), header };
         }
       };
     }
@@ -40060,54 +38983,42 @@ ${newlined}
 
   // ../node_modules/jose/dist/webapi/key/import.js
   async function importSPKI(spki, alg, options) {
-    if (typeof spki !== "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0) {
+    if (typeof spki != "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
       throw new TypeError('"spki" must be SPKI formatted string');
-    }
     return fromSPKI(spki, alg, options);
   }
   async function importX509(x509, alg, options) {
-    if (typeof x509 !== "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0) {
+    if (typeof x509 != "string" || x509.indexOf("-----BEGIN CERTIFICATE-----") !== 0)
       throw new TypeError('"x509" must be X.509 formatted string');
-    }
     return fromX509(x509, alg, options);
   }
   async function importPKCS8(pkcs8, alg, options) {
-    if (typeof pkcs8 !== "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0) {
+    if (typeof pkcs8 != "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0)
       throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
-    }
     return fromPKCS8(pkcs8, alg, options);
   }
   async function importJWK(jwk, alg, options) {
-    if (!isObject(jwk)) {
+    if (!isObject(jwk))
       throw new TypeError("JWK must be an object");
-    }
-    const normalized = normalizeJwk(jwk);
-    const extractable = validateExtractableOption(options?.extractable);
-    const { alg: jwkAlg } = normalized;
-    alg ?? (alg = jwkAlg);
-    const ext = extractable ?? normalized.ext;
-    if (normalized.kty !== "oct" && !alg) {
+    const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
+    if (alg ?? (alg = jwkAlg), normalized.kty !== "oct" && !alg)
       throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
     switch (normalized.kty) {
       case "oct":
-        if (typeof normalized.k !== "string") {
+        if (typeof normalized.k != "string")
           throw new TypeError('missing "k" (Key Value) Parameter value');
-        }
         return decode(normalized.k);
       case "AKP": {
-        if (typeof jwkAlg !== "string" || !jwkAlg) {
+        if (typeof jwkAlg != "string" || !jwkAlg)
           throw new TypeError('missing "alg" (Algorithm) Parameter value');
-        }
-        if (alg !== jwkAlg) {
+        if (alg !== jwkAlg)
           throw new TypeError("JWK alg and alg option value mismatch");
-        }
-        return jwkToKey(keyAlgorithm(alg), { ...normalized, ext });
+        return jwkToKey(keyAlgorithm(alg), normalized, extractable);
       }
       case "RSA":
       case "EC":
       case "OKP":
-        return jwkToKey(keyAlgorithm(alg), { ...normalized, alg, ext });
+        return jwkToKey(keyAlgorithm(alg), normalized, extractable);
       default:
         throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
     }
@@ -40116,46 +39027,38 @@ ${newlined}
     "../node_modules/jose/dist/webapi/key/import.js"() {
       init_base64url();
       init_asn1();
-      init_jwk_to_key();
+      init_key();
       init_key_algorithm();
       init_errors();
-      init_type_checks();
-      init_key_options();
-      init_jwk_metadata();
+      init_validate2();
     }
   });
 
   // ../node_modules/jose/dist/webapi/util/decode_protected_header.js
   function decodeProtectedHeader(token) {
     let protectedB64u;
-    if (typeof token === "string") {
+    if (typeof token == "string") {
       const parts = token.split(".");
-      if (parts.length === 3 || parts.length === 5) {
-        ;
-        [protectedB64u] = parts;
-      }
-    } else if (typeof token === "object" && token) {
-      if ("protected" in token) {
+      (parts.length === 3 || parts.length === 5) && ([protectedB64u] = parts);
+    } else if (typeof token == "object" && token)
+      if ("protected" in token)
         protectedB64u = token.protected;
-      } else {
+      else
         throw new TypeError("Token does not contain a Protected Header");
-      }
-    }
     const invalid2 = "Invalid Token or Protected Header formatting";
-    if (typeof protectedB64u !== "string" || !protectedB64u) {
+    if (typeof protectedB64u != "string" || !protectedB64u)
       throw new TypeError(invalid2);
-    }
     return parseJoseHeader(protectedB64u, TypeError, invalid2);
   }
   var init_decode_protected_header = __esm({
     "../node_modules/jose/dist/webapi/util/decode_protected_header.js"() {
-      init_helpers();
+      init_validate2();
     }
   });
 
   // ../node_modules/jose/dist/webapi/util/decode_jwt.js
   function decodeJwt(jwt) {
-    if (typeof jwt !== "string")
+    if (typeof jwt != "string")
       throw new JWTInvalid("JWTs must use Compact JWS serialization, JWT must be a string");
     const { 1: payload, length } = jwt.split(".");
     if (length === 5)
@@ -40184,7 +39087,7 @@ ${newlined}
     "../node_modules/jose/dist/webapi/util/decode_jwt.js"() {
       init_base64url();
       init_buffer_utils();
-      init_type_checks();
+      init_validate2();
       init_errors();
     }
   });
@@ -40192,36 +39095,22 @@ ${newlined}
   // ../node_modules/jose/dist/webapi/key/generate_key_pair.js
   function getModulusLengthOption(options) {
     const modulusLength = options?.modulusLength ?? 2048;
-    if (typeof modulusLength !== "number" || !Number.isInteger(modulusLength) || modulusLength < 2048) {
+    if (typeof modulusLength != "number" || !Number.isInteger(modulusLength) || modulusLength < 2048)
       throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");
-    }
     return modulusLength;
   }
   async function generateKeyPair(alg, options) {
-    const extractable = validateExtractableOption(options?.extractable);
-    const entry = keyAlgorithm(alg, algArgument);
-    if (entry.secret) {
-      unsupportedAlg(algArgument);
-    }
+    const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);
+    entry.secret && unsupportedAlg(algArgument);
     let algorithm;
     if (entry.resolve) {
       const crv = options?.crv ?? "P-256";
-      switch (crv) {
-        case "P-256":
-        case "P-384":
-        case "P-521":
-          algorithm = { name: "ECDH", namedCurve: crv };
-          break;
-        case "X25519":
-          algorithm = { name: "X25519" };
-          break;
-        default:
-          throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
-      }
+      if (!["P-256", "P-384", "P-521", "X25519"].includes(crv))
+        throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
+      algorithm = entry.resolve({ crv });
     } else {
-      if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv) {
+      if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)
         throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);
-      }
       algorithm = entry.kty[0] === "RSA" ? {
         ...entry.subtle,
         publicExponent: Uint8Array.of(1, 0, 1),
@@ -40236,7 +39125,7 @@ ${newlined}
   var init_generate_key_pair = __esm({
     "../node_modules/jose/dist/webapi/key/generate_key_pair.js"() {
       init_errors();
-      init_key_options();
+      init_key();
       init_key_algorithm();
     }
   });
@@ -40244,16 +39133,12 @@ ${newlined}
   // ../node_modules/jose/dist/webapi/key/generate_secret.js
   async function generateSecret(alg, options) {
     const extractable = validateExtractableOption(options?.extractable);
-    let length;
-    let algorithm;
-    let keyUsages;
+    let length, algorithm, keyUsages;
     switch (alg) {
       case "HS256":
       case "HS384":
       case "HS512":
-        length = +alg.slice(-3);
-        algorithm = { name: "HMAC", hash: `SHA-${length}`, length };
-        keyUsages = ["sign", "verify"];
+        length = +alg.slice(-3), algorithm = { name: "HMAC", hash: `SHA-${length}`, length }, keyUsages = ["sign", "verify"];
         break;
       case "A128CBC-HS256":
       case "A192CBC-HS384":
@@ -40262,9 +39147,7 @@ ${newlined}
       case "A128KW":
       case "A192KW":
       case "A256KW":
-        length = +alg.slice(1, 4);
-        algorithm = { name: "AES-KW", length };
-        keyUsages = ["wrapKey", "unwrapKey"];
+        length = +alg.slice(1, 4), algorithm = { name: "AES-KW", length }, keyUsages = ["wrapKey", "unwrapKey"];
         break;
       case "A128GCMKW":
       case "A192GCMKW":
@@ -40272,9 +39155,7 @@ ${newlined}
       case "A128GCM":
       case "A192GCM":
       case "A256GCM":
-        length = +alg.slice(1, 4);
-        algorithm = { name: "AES-GCM", length };
-        keyUsages = ["encrypt", "decrypt"];
+        length = +alg.slice(1, 4), algorithm = { name: "AES-GCM", length }, keyUsages = ["encrypt", "decrypt"];
         break;
       default:
         unsupportedAlg(algArgument);
@@ -40284,7 +39165,7 @@ ${newlined}
   var init_generate_secret = __esm({
     "../node_modules/jose/dist/webapi/key/generate_secret.js"() {
       init_key_algorithm();
-      init_key_options();
+      init_key();
     }
   });
 
@@ -42054,8 +40935,8 @@ ${newlined}
           });
         }
         static async fromJwt(jwtStr, options = {}) {
-          const { token, verify: verify2 = true } = options;
-          if (verify2) {
+          const { token, verify = true } = options;
+          if (verify) {
             const verificationToken = token ?? getEnvValue("MESHAGENT_SECRET");
             if (verificationToken === void 0) {
               throw new Error("Failed to verify JWT: no token provided");