@shumai-one/shumai 0.4.2 → 0.4.3

package/bin/chunk-cak32x57.js

@@ -0,0 +1,2 @@
+// @bun
+import{Ne}from"./chunk-rza4ae5z.js";var ye=new TextEncoder,q=new TextDecoder,re=new TextDecoder("utf-8",{fatal:!0});function A(...e){let t=e.reduce((o,{length:a})=>o+a,0),r=new Uint8Array(t),n=0;for(let o of e)r.set(o,n),n+=o.length;return r}function tt(e,t,r){if(t<0||t>=4294967296)throw RangeError(`value must be >= 0 and <= 4294967295. Received ${t}`);e.set([t>>>24,t>>>16,t>>>8,t&255],r)}function rt(e){let t=Math.floor(e/4294967296),r=e%4294967296,n=new Uint8Array(8);return tt(n,t,0),tt(n,r,4),n}function Te(e){let t=new Uint8Array(4);return tt(t,e),t}function b(e){let t=new Uint8Array(e.length);for(let r=0;r<e.length;r++){let n=e.charCodeAt(r);if(n>127)throw TypeError("non-ASCII string encountered in encode()");t[r]=n}return t}var Pe=(e,t="algorithm.name")=>TypeError(`CryptoKey does not support this operation, its ${t} must be ${e}`);function nt(e,t){if(t&&!e.usages.includes(t))throw TypeError(`CryptoKey does not support this operation, its usages must include ${t}.`)}function Ie(e,t){let{modulusLength:r}=t.algorithm;if(typeof r!=="number"||r<2048)throw TypeError(`${e} requires key modulusLength to be 2048 bits or larger`)}function k(e,t,r){let n=e.algorithm;if(n.name!==t.name)throw Pe(t.name);if(t.hash&&n.hash?.name!==t.hash)throw Pe(t.hash,"algorithm.hash");if(t.namedCurve&&n.namedCurve!==t.namedCurve)throw Pe(t.namedCurve,"algorithm.namedCurve");if(t.length!==void 0&&n.length!==t.length)throw Pe(t.length,"algorithm.length");nt(e,r)}function Ot(e,t,...r){if(r.length>2){let n=r.pop();e+=`one of type ${r.join(", ")}, or ${n}.`}else if(r.length===2)e+=`one of type ${r[0]} or ${r[1]}.`;else e+=`of type ${r[0]}.`;if(t==null)e+=` Received ${t}`;else if(typeof t==="function"&&t.name)e+=` Received function ${t.name}`;else if(typeof t==="object"&&t!=null){if(t.constructor?.name)e+=` Received an instance of ${t.constructor.name}`}return e}var B=(e,...t)=>Ot("Key must be ",e,...t),he=(e,t,...r)=>Ot(`Key for the ${e} algorithm must be `,t,...r);class x extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,t){super(e,t);this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}}class _ extends x{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,t,r="unspecified",n="unspecified"){super(e,{cause:{claim:r,reason:n,payload:t}});this.claim=r,this.reason=n,this.payload=t}}class Ti extends x{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,t,r="unspecified",n="unspecified"){super(e,{cause:{claim:r,reason:n,payload:t}});this.claim=r,this.reason=n,this.payload=t}}class ne extends x{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"}class m extends x{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"}class Oe extends x{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",t){super(e,t)}}class f extends x{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"}class w extends x{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"}class E extends x{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"}class _e extends x{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"}class De extends x{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"}class we extends x{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",t){super(e,t)}}class ot extends x{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",t){super(e,t)}}class it extends x{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",t){super(e,t)}}class at extends x{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",t){super(e,t)}}function Ue(e){if(!M(e))throw Error("CryptoKey instance expected")}var M=(e)=>{if(e?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return e instanceof CryptoKey}catch{return!1}},st=(e)=>e?.[Symbol.toStringTag]==="KeyObject",Re=(e)=>M(e)||st(e);var L=(e)=>crypto.getRandomValues(new Uint8Array(e.cekBits>>3));function _t(e,t){let r=e.byteLength<<3;if(r!==t)throw new f(`Invalid Content Encryption Key length. Expected ${t} bits, got ${r} bits`)}var Wr=(e)=>crypto.getRandomValues(new Uint8Array(e.ivBits>>3));function Dt(e,t){if(t.length<<3!==e.ivBits)throw new f("Invalid Initialization Vector length")}async function Ut(e,t,r){if(!(t instanceof Uint8Array))throw TypeError(B(t,"Uint8Array"));let n=e.cekBits>>1,o=await crypto.subtle.importKey("raw",t.subarray(n>>3),"AES-CBC",!1,[r]),a=await crypto.subtle.importKey("raw",t.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return[o,a,n]}async function Rt(e,t,r){return new Uint8Array((await crypto.subtle.sign("HMAC",e,t)).slice(0,r>>3))}async function Cr(e,t,r,n,o){let[a,i,s]=await Ut(e,r,"encrypt"),c=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},a,t)),p=A(o,n,c,rt(o.length*8)),d=await Rt(i,p,s);return{ciphertext:c,tag:d,iv:n}}async function vr(e,t){let r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign","verify"]),o=await crypto.subtle.sign(r,n,e);return crypto.subtle.verify(r,n,o,t)}async function Tr(e,t,r,n,o,a){let[i,s,c]=await Ut(e,t,"decrypt"),p=A(a,n,r,rt(a.length*8)),d=await Rt(s,p,c);try{if(await vr(o,d))return new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},i,r))}catch{}throw new Oe}async function Pr(e,t,r,n,o){let a=r instanceof Uint8Array?await crypto.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(k(r,e.subtle,"encrypt"),r),i=new Uint8Array(await crypto.subtle.encrypt({additionalData:o,iv:n,name:"AES-GCM",tagLength:128},a,t)),s=i.slice(-16);return{ciphertext:i.slice(0,-16),tag:s,iv:n}}async function Ir(e,t,r,n,o,a){let i=t instanceof Uint8Array?await crypto.subtle.importKey("raw",t,"AES-GCM",!1,["decrypt"]):(k(t,e.subtle,"decrypt"),t);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:a,iv:n,name:"AES-GCM",tagLength:128},i,A(r,o)))}catch{throw new Oe}}async function He(e,t,r,n,o){if(!M(r)&&!(r instanceof Uint8Array))throw TypeError(B(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(n)Dt(e,n);else n=Wr(e);if(r instanceof Uint8Array)_t(r,e.cekBits);return e.cbc?Cr(e,t,r,n,o):Pr(e,t,r,n,o)}async function ke(e,t,r,n,o,a){if(!M(t)&&!(t instanceof Uint8Array))throw TypeError(B(t,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new f("JWE Initialization Vector missing");if(!o)throw new f("JWE Authentication Tag missing");if(!e.cbc&&o.length!==16)throw new f("Invalid Authentication Tag length");if(Dt(e,n),t instanceof Uint8Array)_t(t,e.cekBits);return e.cbc?Tr(e,t,r,n,o,a):Ir(e,t,r,n,o,a)}var Md={};Ne(Md,{decode:()=>D,encode:()=>tr});function ct(e){if(Uint8Array.prototype.toBase64)return e.toBase64();let t=32768,r=[];for(let n=0;n<e.length;n+=t)r.push(String.fromCharCode.apply(null,e.subarray(n,n+t)));return btoa(r.join(""))}function Be(e){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(e);let t=atob(e),r=new Uint8Array(t.length);for(let n=0;n<t.length;n++)r[n]=t.charCodeAt(n);return r}var pt="The input to be decoded is not correctly encoded.";function D(e){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64(typeof e==="string"?e:q.decode(e),{alphabet:"base64url"})}catch(r){throw TypeError(pt,{cause:r})}let t=e;if(t instanceof Uint8Array)t=q.decode(t);if(t.includes("+")||t.includes("/"))throw TypeError(pt);t=t.replace(/-/g,"+").replace(/_/g,"/");try{return Be(t)}catch{throw TypeError(pt)}}function tr(e){let t=e;if(typeof t==="string")t=ye.encode(t);if(Uint8Array.prototype.toBase64)return t.toBase64({alphabet:"base64url",omitPadding:!0});return ct(t).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}function Z(e,t){if(!(e instanceof Uint8Array))throw TypeError(`${t} must be an instance of Uint8Array`)}function S(e){if(typeof e!=="object"||e===null||Object.prototype.toString.call(e)!=="[object Object]")return!1;let t=Object.getPrototypeOf(e);return t===null||Object.getPrototypeOf(t)===null}function Me(e){return S(e)&&Array.isArray(e.keys)&&Array.from(e.keys).every(S)}function Nt(...e){let t=new Set;for(let r of e){if(!r)continue;for(let n of Object.keys(r)){if(t.has(n))return!1;t.add(n)}}return!0}var Ht=Symbol();function Q(e,t){if(e!==void 0)throw TypeError(`${t} can only be called once`)}function W(e,t,r){try{return D(e)}catch{throw new r(`Failed to base64url decode the ${t}`)}}function dt(e,t,r){try{return b(e)}catch{throw new r(`The ${t} is not a valid base64url string`)}}async function $e(e,t){let r=`SHA-${e.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,t))}function F(e,t,r){let n;try{n=JSON.parse(re.decode(D(e)))}catch{throw new t(r)}if(!S(n))throw new t(r);return n}async function j(e,t){if(t.kty==="RSA"&&"oth"in t&&t.oth!==void 0)throw new m('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!e.kty.includes(t.kty))throw new m('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let r=e.resolve?.({kty:t.kty,crv:t.crv})??e.subtle,n=!!(t.d||t.priv),o={...t};if(o.kty!=="AKP")delete o.alg;return delete o.use,crypto.subtle.importKey("jwk",o,r,t.ext??!n,t.key_ops??e.usages[n?1:0])}function oe(e){return{__proto__:null,...e}}function Le(e){let t=oe(e);if(t.ext!==void 0&&typeof t.ext!=="boolean")throw TypeError('"ext" (Extractable) Parameter must be a boolean');if(t.key_ops!==void 0){let r=t.key_ops,n=Array.isArray(r)?[...r]:void 0;if(!n||n.some((o)=>typeof o!=="string")||new Set(n).size!==n.length)throw TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');t.key_ops=n}return t}var ft=(e)=>e[Symbol.toStringTag],Or=(e,t,r)=>{let{alg:n}=e;if(t.use!==void 0){let o=r==="sign"||r==="verify"?"sig":"enc";if(t.use!==o)throw TypeError(`Invalid key for this operation, its "use" must be "${o}" when present`)}if(t.alg!==void 0&&t.alg!==n)throw TypeError(`Invalid key for this operation, its "alg" must be "${n}" when present`);if(Array.isArray(t.key_ops)){let o=r==="encrypt"||r==="decrypt"?e.ops?.[r==="encrypt"?0:1]:r;if(o&&!t.key_ops.includes(o))throw TypeError(`Invalid key for this operation, its "key_ops" must include "${o}" when present`)}};function _r(e,t,r){let{alg:n,secret:o}=e,a=r==="decrypt"||r==="sign";if(o&&t instanceof Uint8Array)return[Bt,t];if(S(t)){let i=Le(t);if(typeof i.kty!=="string")throw TypeError(o?he(n,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):he(n,t,"CryptoKey","KeyObject","JSON Web Key"));if(!(o?i.kty==="oct"&&typeof i.k==="string":i.kty!=="oct"&&(a?i.kty==="AKP"&&typeof i.priv==="string"||typeof i.d==="string":i.d===void 0&&i.priv===void 0)))throw TypeError(o?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${a?"private":"public"} JWK`);return Or(e,i,r),[Lt,t,i]}if(!Re(t))throw TypeError(o?he(n,t,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):he(n,t,"CryptoKey","KeyObject","JSON Web Key"));if(o){if(t.type!=="secret")throw TypeError(`${ft(t)} instances for symmetric algorithms must be of type "secret"`)}else{if(t.type==="secret")throw TypeError(`${ft(t)} instances for asymmetric algorithms must not be of type "secret"`);let i=a?"private":"public";if((t.type==="public"||t.type==="private")&&t.type!==i){let s=r==="sign"?"signing":r==="verify"?"verifying":`${r.slice(0,-1)}tion`;throw TypeError(`${ft(t)} instances for asymmetric algorithm ${s} must be of type "${i}"`)}}return M(t)?[Mt,t]:[$t,t]}var Bt=0,Mt=1,$t=2,Lt=3,ut,Dr={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function je(e,t,r){ut||=new WeakMap;let n=ut.get(e);if(r)if(n)n[t]=r;else ut.set(e,{[t]:r});return r??n?.[t]}var kt=async(e,t,r)=>je(e,r.alg)??je(e,r.alg,await j(r,{...t,alg:r.alg})),Ur=(e,t)=>{let r=je(e,t.alg);if(r)return r;let n=e.type==="public",o=t.usages[n?0:1],{asymmetricKeyType:a}=e,i=Dr[e.asymmetricKeyDetails?.namedCurve],s=t.resolve?.({crv:i,asymmetricKeyType:a})??t.subtle;return je(e,t.alg,e.toCryptoKey(s,n,o))};async function U(e,t,r){let n=_r(e,t,r);switch(n[0]){case Bt:case Mt:return n[1];case Lt:{let o=n[1],a=n[2];if(a.kty==="oct")return D(a.k);if(!Object.isFrozen(o)){let{key_ops:i}=o;if(Array.isArray(i))Object.freeze(i);Object.freeze(o)}return kt(o,a,e)}case $t:{let o=n[1];if(o.type==="secret")return o.export();if("toCryptoKey"in o&&typeof o.toCryptoKey==="function")return Ur(o,e);return kt(o,o.export({format:"jwk"}),e)}}}function ge(e){let t={__proto__:null};for(let r in e)t[r]={...e[r],alg:r};return t}var Rr=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],Nr=[[],["deriveBits"]],Ge=[[],[]];function ze(e){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:`SHA-${e}`},usages:Rr,ops:["wrapKey","unwrapKey"]}}function Ve(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:({kty:e,crv:t,asymmetricKeyType:r})=>{if(t==="X25519"||r==="x25519")return{name:"X25519"};if(e==="OKP")throw new m('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:t}},usages:Nr,ops:[void 0,"deriveBits"]}}function ie(e,t=!1){return{kty:["oct"],secret:!0,subtle:{name:t?"AES-GCM":"AES-KW",length:e},usages:Ge,ops:t?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function lt(){return{kty:["oct"],secret:!0,subtle:{name:"PBKDF2"},usages:Ge,ops:["deriveBits","deriveBits"]}}var mt=ge({dir:{kty:["oct"],secret:!0,subtle:{name:"AES-GCM"},usages:Ge,ops:["encrypt","decrypt"]},"RSA-OAEP":ze(1),"RSA-OAEP-256":ze(256),"RSA-OAEP-384":ze(384),"RSA-OAEP-512":ze(512),"ECDH-ES":Ve(),"ECDH-ES+A128KW":Ve(),"ECDH-ES+A192KW":Ve(),"ECDH-ES+A256KW":Ve(),A128KW:ie(128),A192KW:ie(192),A256KW:ie(256),A128GCMKW:ie(128,!0),A192GCMKW:ie(192,!0),A256GCMKW:ie(256,!0),"PBES2-HS256+A128KW":lt(),"PBES2-HS384+A192KW":lt(),"PBES2-HS512+A256KW":lt()}),Hr=["encrypt","decrypt"];function ae(e,t=!1){return{kty:["oct"],secret:!0,subtle:{name:t?"AES-CBC":"AES-GCM",length:e},usages:Ge,ops:Hr,cekBits:e,ivBits:t?128:96,cbc:t}}var kr=ge({A128GCM:ae(128),A192GCM:ae(192),A256GCM:ae(256),"A128CBC-HS256":ae(256,!0),"A192CBC-HS384":ae(384,!0),"A256CBC-HS512":ae(512,!0)});function jt(e,t){throw new m(`Invalid or unsupported "${e}" (JWE ${t}) header value`)}function R(e){return(typeof e==="string"?mt[e]:void 0)??jt("alg","Algorithm")}function ee(e){return(typeof e==="string"?kr[e]:void 0)??jt("enc","Encryption Algorithm")}function zt(e,t){if(e.algorithm.name!=="ECDH"&&e.algorithm.name!=="X25519")throw TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");nt(e,t)}async function Gt(e,t,r){let n=R(t).subtle,o=e instanceof Uint8Array?await crypto.subtle.importKey("raw",e,"AES-KW",!0,[r]):e;return k(o,n,r),o}async function yt(e,t,r){let n=await Gt(t,e,"wrapKey"),o=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",o,n,"AES-KW"))}async function ht(e,t,r){let n=await Gt(t,e,"unwrapKey"),o=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",o))}function Ft(e,t,r){k(t,R(e).subtle,r),Ie(e,t)}function Br(e,t){if(e instanceof Uint8Array)return crypto.subtle.importKey("raw",e,"PBKDF2",!1,["deriveBits"]);return k(e,R(t).subtle,"deriveBits"),e}async function Xt(e,t,r,n){if(!(e instanceof Uint8Array)||e.length<8)throw new f("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new f("PBES2 Count Input must be a positive integer");let o=A(b(t),Uint8Array.of(0),e),a=parseInt(t.slice(13,16),10),i={hash:`SHA-${t.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:o},s=await Br(n,t);return new Uint8Array(await crypto.subtle.deriveBits(i,s,a))}function wt(e){return A(Te(e.length),e)}async function Mr(e,t,r){let n=t>>3,o=32,a=Math.ceil(n/32),i=new Uint8Array(a*32);for(let s=1;s<=a;s++){let c=await $e("sha256",A(Te(s),e,r));i.set(c,(s-1)*32)}return i.slice(0,n)}async function Yt(e,t,r,n,o=new Uint8Array,a=new Uint8Array){zt(e),zt(t,"deriveBits");let i=A(wt(b(r)),wt(o),wt(a),Te(n)),s=new Uint8Array(await crypto.subtle.deriveBits({name:e.algorithm.name,public:e},t,e.algorithm.name==="X25519"?256:Math.ceil(parseInt(e.algorithm.namedCurve.slice(-3),10)/8)<<3));return Mr(s,n,i)}function qt(e){Ue(e);let t=e.algorithm.namedCurve;if(t!=="P-256"&&t!=="P-384"&&t!=="P-521"&&e.algorithm.name!=="X25519")throw new m("ECDH with the provided key is not allowed or not supported by your javascript runtime")}function Ee(e){if(e===void 0)throw new f("JWE Encrypted Key missing")}function Vt(e){if(e!==void 0)throw new f("Encountered unexpected JWE Encrypted Key")}async function Zt(e,t,r,n,o,a){let i=R(e);if(e==="dir")return Vt(n),r;switch(i.subtle.name){case"ECDH":{if(e==="ECDH-ES")Vt(n);if(!S(o.epk))throw new f('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');qt(r);let s=await j(i,o.epk),c,p;if(o.apu!==void 0){if(typeof o.apu!=="string")throw new f('JOSE Header "apu" (Agreement PartyUInfo) invalid');c=W(o.apu,"apu",f)}if(o.apv!==void 0){if(typeof o.apv!=="string")throw new f('JOSE Header "apv" (Agreement PartyVInfo) invalid');p=W(o.apv,"apv",f)}let d=await Yt(s,r,e==="ECDH-ES"?t.alg:e,e==="ECDH-ES"?t.cekBits:parseInt(e.slice(-5,-2),10),c,p);if(e==="ECDH-ES")return d;return Ee(n),ht(e.slice(-6),d,n)}case"RSA-OAEP":return Ee(n),Ue(r),Ft(e,r,"decrypt"),new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",r,n));case"PBKDF2":{if(Ee(n),typeof o.p2c!=="number")throw new f('JOSE Header "p2c" (PBES2 Count) missing or invalid');let s=a||1e4;if(o.p2c>s)throw new f('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');if(typeof o.p2s!=="string")throw new f('JOSE Header "p2s" (PBES2 Salt) missing or invalid');let c=W(o.p2s,"p2s",f),p=await Xt(c,e,o.p2c,r);return ht(e.slice(-6),p,n)}case"AES-KW":return Ee(n),ht(e,r,n);case"AES-GCM":{if(Ee(n),typeof o.iv!=="string")throw new f('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof o.tag!=="string")throw new f('JOSE Header "tag" (Authentication Tag) missing or invalid');let s;s=W(o.iv,"iv",f);let c;return c=W(o.tag,"tag",f),ke(ee(e.slice(0,-2)),r,n,s,c,new Uint8Array)}}}async function Qt(e,t,r,n,o={}){let a,i,s,c=R(e);if(e==="dir")return[r,void 0,void 0];switch(c.subtle.name){case"ECDH":{qt(r);let{apu:p,apv:d}=o;if(p!==void 0)Z(p,'"apu"');if(d!==void 0)Z(d,'"apv"');let u;if(o.epk!==void 0)u=await U(c,o.epk,"decrypt");else u=(await crypto.subtle.generateKey(r.algorithm,!0,["deriveBits"])).privateKey;let l=crypto.subtle,K=u;if(!K.extractable){if(typeof l.getPublicKey!=="function")throw TypeError('CryptoKey for "epk" must be extractable');K=await l.getPublicKey(u,[])}let{x:T,y:g,crv:h,kty:v}=await l.exportKey("jwk",K),y=await Yt(r,u,e==="ECDH-ES"?t.alg:e,e==="ECDH-ES"?t.cekBits:parseInt(e.slice(-5,-2),10),p,d);if(i={epk:{x:T,crv:h,kty:v}},v==="EC")i.epk.y=g;if(p)i.apu=tr(p);if(d)i.apv=tr(d);if(e==="ECDH-ES"){s=y;break}s=n||L(t);let J=e.slice(-6);a=await yt(J,y,s);break}case"RSA-OAEP":{s=n||L(t),Ue(r),Ft(e,r,"encrypt"),a=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",r,s));break}case"PBKDF2":{s=n||L(t);let{p2c:p=2048,p2s:d=crypto.getRandomValues(new Uint8Array(16))}=o,u=await Xt(d,e,p,r);a=await yt(e.slice(-6),u,s),i={p2c:p,p2s:tr(d)};break}case"AES-KW":{s=n||L(t),a=await yt(e,r,s);break}case"AES-GCM":{s=n||L(t);let{iv:p}=o,d=await He(ee(e.slice(0,-2)),s,r,p,new Uint8Array);a=d.ciphertext,i={iv:tr(d.iv),tag:tr(d.tag)};break}}return[s,a,i]}var se={__proto__:null,b64:!0},Fe={__proto__:null};function be(e,t){if(t!==void 0&&(!Array.isArray(t)||t.some((r)=>typeof r!=="string")))throw TypeError(`"${e}" option must be an array of strings`);if(!t)return;return new Set(t)}function Xe(e,t){let{crit:r}=t??{};if(Array.isArray(r)&&new Set(r).size!==r.length)throw new e('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}function N(e,t,r,n,o){if(o.crit!==void 0&&n?.crit===void 0)throw new e('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some((i)=>typeof i!=="string"||i.length===0))throw new e('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');let a=r===void 0?t:{__proto__:null,...r,...t};for(let i of n.crit){if(!(i in a))throw new m(`Extension Header Parameter "${i}" is not recognized`);if(!Object.hasOwn(o,i)||o[i]===void 0)throw new e(`Extension Header Parameter "${i}" is missing`);if(a[i]&&(!Object.hasOwn(n,i)||n[i]===void 0))throw new e(`Extension Header Parameter "${i}" MUST be integrity protected`)}return n.crit}function ce(e,t){if(t.includes("b64")){let r=e.b64;if(typeof r!=="boolean")throw new w('The "b64" (base64url-encode payload) Header Parameter must be a boolean');return r}return!0}function pe(e,t){let r,n;try{r=JSON.stringify(t),n=JSON.parse(r)}catch(o){throw new e("JOSE Header is not valid JSON",{cause:o})}if(!S(n))throw new e("JOSE Header is not a JSON object");return[n,r]}function Ye(e,t){if(e.zip!==void 0&&e.zip!=="DEF")throw new m('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(e.zip!==void 0&&!t?.zip)throw new f('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.')}function er(e){if(typeof globalThis[e]>"u")throw new m(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${e} API.`)}async function rr(e){er("CompressionStream");let t=new CompressionStream("deflate-raw"),r=t.writable.getWriter();r.write(e).catch(()=>{}),r.close().catch(()=>{});let n=[],o=t.readable.getReader();for(;;){let{value:a,done:i}=await o.read();if(i)break;n.push(a)}return A(...n)}async function nr(e,t){er("DecompressionStream");let r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(e).catch(()=>{}),n.close().catch(()=>{});let o=[],a=0,i=r.readable.getReader();for(;;){let{value:s,done:c}=await i.read();if(c)break;if(o.push(s),a+=s.byteLength,t!==1/0&&a>t)throw new f("Decompressed plaintext exceeded the configured limit")}return A(...o)}function or(e){return[e&&be("keyManagementAlgorithms",e.keyManagementAlgorithms),e&&be("contentEncryptionAlgorithms",e.contentEncryptionAlgorithms),e?.crit,e?.maxPBES2Count,e?.maxDecompressedLength]}async function $r(e,t,r,n,o){let[a,i,s,c,p]=r,[d,u,l,K,T]=t,{encrypted_key:g}=e;N(f,Fe,s,d,o),Ye(o,d);let{alg:h,enc:v}=o;if(typeof h!=="string"||!h)throw new f("missing JWE Algorithm (alg) in JWE Header");if(typeof v!=="string"||!v)throw new f("missing JWE Encryption Algorithm (enc) in JWE Header");if(a&&!a.has(h)||!a&&h.startsWith("PBES2"))throw new ne('"alg" (Algorithm) Header Parameter value not allowed');if(i&&!i.has(v))throw new ne('"enc" (Encryption Algorithm) Header Parameter value not allowed');let y=ee(v),J;if(g!==void 0)J=W(g,"encrypted_key",f);let P=!1;if(typeof n==="function")n=await n(d,e),P=!0;let H=R(h),O=await U(h==="dir"?y:H,n,"decrypt"),I;try{if(I=await Zt(h,y,O,J,o,c),g!==void 0&&I instanceof Uint8Array&&I.byteLength<<3!==y.cekBits)I=L(y)}catch(C){if(C instanceof TypeError||C instanceof f||C instanceof m)throw C;I=L(y)}let X=await ke(y,I,u,l,K,T);if(o.zip==="DEF"){let C=p??250000;if(C===0)throw new m('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(C!==1/0&&(!Number.isSafeInteger(C)||C<1))throw TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");X=await nr(X,C).catch((Y)=>{if(Y instanceof f)throw Y;throw new f("Failed to decompress plaintext",{cause:Y})})}return[X,d,O,P]}async function ir(e,t,r){if(e instanceof Uint8Array)e=q.decode(e);if(typeof e!=="string")throw new f("Compact JWE must be a string or Uint8Array");let{0:n,1:o,2:a,3:i,4:s,length:c}=e.split(".");if(c!==5)throw new f("Invalid Compact JWE");let p={ciphertext:i,iv:a||void 0,protected:n,tag:s||void 0,encrypted_key:o||void 0},d=F(n,f,"JWE Protected Header is invalid"),u=b(n),l=[d,W(i,"ciphertext",f),a?W(a,"iv",f):void 0,s?W(s,"tag",f):void 0,u];return $r(p,l,t,r,d)}function ar(e,t,r){if(!Nt(e,t,r))throw new f("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint")}function Lr(e){let[,t,r,n,o,a,i,s,c]=e;if(o!==void 0)Z(o,"JWE Additional Authenticated Data");if(a!==void 0)Z(a,"JWE Content Encryption Key");if(i!==void 0)Z(i,"JWE Initialization Vector");if(t!==void 0)t=pe(f,t)[0],e[1]=t;if(r!==void 0)r=pe(f,r)[0],e[2]=r;if(n!==void 0)n=pe(f,n)[0],e[3]=n;if(s!==void 0&&!S(s))throw TypeError("JWE Key Management Parameters must be an object");ar(t,r,n);let p={...t,...r,...n};Xe(f,t),N(f,Fe,c,t,p),Ye(p,t);let{alg:d,enc:u}=p;if(typeof d!=="string"||!d)throw new f('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof u!=="string"||!u)throw new f('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');return[p,d,u,ee(u)]}async function jr(e,t,r){let[n,o,,a]=t,[i,s,c,p,d,u,l,K,,T]=e,g=s,h=c;if(u&&(o==="dir"||o==="ECDH-ES"))throw TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${o}`);let v=R(o),y=await U(o==="dir"?a:v,r,"encrypt"),[J,P,H]=await Qt(o,a,y,u,K);if(H){if(T)h=h?{...h,...H}:H;else g=g?{...g,...H}:H;ar(g,h,p)}let O,I;if(g)O=tr(JSON.stringify(g)),I=b(O);else O="",I=new Uint8Array;let X,C;if(d?.byteLength)C=tr(d),X=A(I,b("."),b(C));else X=I;let Y=i;if(n.zip==="DEF")Y=await rr(Y).catch((Jr)=>{throw new f("Failed to compress plaintext",{cause:Jr})});let{ciphertext:Kr,tag:Pt,iv:It}=await He(a,Y,J,l,X),G={ciphertext:tr(Kr)};if(It)G.iv=tr(It);if(Pt)G.tag=tr(Pt);if(P)G.encrypted_key=tr(P);if(C)G.aad=C;if(g)G.protected=O;if(p)G.unprotected=p;if(h)G.header=h;return G}async function sr(e,t,r){if(!e[1]&&!e[2]&&!e[3])throw new f("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");if(r!==void 0)e[8]=r?.crit,e[9]=r?Ht in r:!1;return jr(e,Lr(e),t)}async function cr(e,t,r){if(t instanceof Uint8Array)return crypto.subtle.importKey("raw",t,e.subtle,!1,[r]);if(k(t,e.subtle,r),e.minRsaBits)Ie(e.alg,t);return t}async function pr(e,t,r){let n=await cr(e,t,"sign"),o=await crypto.subtle.sign(e.signing,n,r);return new Uint8Array(o)}async function dr(e,t,r,n){let o=await cr(e,t,"verify");try{return await crypto.subtle.verify(e.signing,o,r,n)}catch{return!1}}var Se=[["verify"],["sign"]];function gt(e){let t={name:"HMAC",hash:`SHA-${e}`};return{kty:["oct"],secret:!0,subtle:t,signing:t,usages:Se}}function de(e,t){let n={name:t?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${e}`};return{kty:["RSA"],subtle:n,signing:t?{...n,saltLength:t}:n,usages:Se,minRsaBits:2048}}function Et(e,t){return{kty:["EC"],crv:e,subtle:{name:"ECDSA",namedCurve:e},signing:{name:"ECDSA",hash:`SHA-${t}`},usages:Se}}function fr(){let e={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:e,signing:e,usages:Se}}function bt(e){let r={name:`ML-DSA-${e}`};return{kty:["AKP"],subtle:r,signing:r,usages:Se}}var Ae=ge({HS256:gt(256),HS384:gt(384),HS512:gt(512),RS256:de(256),RS384:de(384),RS512:de(512),PS256:de(256,32),PS384:de(384,48),PS512:de(512,64),ES256:Et("P-256",256),ES384:Et("P-384",384),ES512:Et("P-521",512),EdDSA:fr(),Ed25519:fr(),"ML-DSA-44":bt(44),"ML-DSA-65":bt(65),"ML-DSA-87":bt(87)});function qe(e){let t=typeof e==="string"?Ae[e]:void 0;if(!t)throw new m(`alg ${e} is not supported either by JOSE or your javascript runtime`);return t}function ur(e){return[e&&be("algorithms",e.algorithms),e?.crit]}function zr(e,t=e===void 0?{}:F(e,w,"JWS Protected Header is invalid")){return t}function Vr(e,t,r){let n=ce(e,N(w,se,r[1],e,t)),o=t.alg;if(typeof o!=="string"||!o)throw new w('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(r[0]&&!r[0].has(o))throw new ne('"alg" (Algorithm) Header Parameter value not allowed');return[n,o]}function Gr(e){try{return b(e)}catch{throw new w("JWS Compact Serialization payload must use only ASCII characters")}}async function Fr(e,t,r,n,o,a,i){let s=!1;if(typeof r==="function")r=await r(o,e),s=!0;let c=typeof i==="string",p=qe(a),d=A(n!==void 0?b(n):new Uint8Array,b("."),c?t[2]??=dt(i,"payload",w):i),u=W(e.signature,"signature",w),l=await U(p,r,"verify");if(!await dr(p,l,u,d))throw new at;return[c?W(i,"payload",w):i,o,c,l,s]}async function lr(e,t,r){if(e instanceof Uint8Array)e=q.decode(e);if(typeof e!=="string")throw new w("Compact JWS must be a string or Uint8Array");let{0:n,1:o,2:a,length:i}=e.split(".");if(i!==3)throw new w("Invalid Compact JWS");let s={payload:o,protected:n,signature:a},c=zr(n),[p,d]=Vr(c,c,t),u=p?o:Gr(o);return Fr(s,t,r,n,c,d,u)}var xe=(e)=>Math.floor(e.getTime()/1000),Xr={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},Yr=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,fe="check_failed";function St(){throw TypeError("Invalid time period format")}function Ze(e){if(typeof e!=="string")St();let t=Yr.exec(e);if(!t||t[4]&&t[1])St();let r=parseFloat(t[2]),n=Math.round(r*Xr[t[3][0].toLowerCase()]);if(!Number.isFinite(n))St();if(t[1]==="-"||t[4]==="ago")return-n;return n}function ue(e,t){if(!Number.isFinite(t))throw TypeError(`Invalid ${e} input`);return t}function At(e,t){if(typeof t!=="string")throw TypeError(`"${e}" claim must be a string`)}function qr(e){if(typeof e!=="string"&&(!Array.isArray(e)||Array.from(e).some((t)=>typeof t!=="string")))throw TypeError('"aud" claim must be a string or an array of strings')}function xt(e,t){if(typeof e==="number")return ue(t,e);if(e instanceof Date)return ue(t,xe(e));return xe(new Date)+Ze(e)}var mr=(e)=>{let t=e.toLowerCase();return e.includes("/")?t:`application/${t}`},Qr=(e,t)=>{if(typeof e==="string")return t.includes(e);if(Array.isArray(e))return t.some((r)=>e.includes(r));return!1};function Kt(e,t,r=!1){let n=e[t];if(n===void 0&&!r)return;if(typeof n!=="number")throw new _(`"${t}" claim must be a number`,e,t,"invalid");return n}function Jt(e,t){throw new _(`unexpected "${t}" claim value`,e,t,fe)}function le(e,t,r={}){let n;try{n=JSON.parse(re.decode(t))}catch{}if(!S(n))throw new E("JWT Claims Set must be a top-level JSON object");let{typ:o}=r;if(o!==void 0&&(typeof e.typ!=="string"||mr(e.typ)!==mr(o)))throw new _('unexpected "typ" JWT header value',n,"typ",fe);let{requiredClaims:a=[],issuer:i,subject:s,audience:c,maxTokenAge:p}=r,d=[...a];if(p!==void 0)d.push("iat");if(c!==void 0)d.push("aud");if(s!==void 0)d.push("sub");if(i!==void 0)d.push("iss");for(let y of new Set(d.reverse()))if(!Object.hasOwn(n,y))throw new _(`missing required "${y}" claim`,n,y,"missing");if(i!==void 0&&!(Array.isArray(i)?i:[i]).includes(n.iss))Jt(n,"iss");if(s!==void 0&&n.sub!==s)Jt(n,"sub");if(c!==void 0&&!Qr(n.aud,typeof c==="string"?[c]:c))Jt(n,"aud");let{clockTolerance:u}=r,l=0;if(typeof u==="string")l=Ze(u);else if(u!==void 0){if(typeof u!=="number")throw TypeError("Invalid clockTolerance option type");l=u}ue("clockTolerance option",l);let{currentDate:K}=r,T=ue("currentDate option",xe(K===void 0?new Date:K)),g=Kt(n,"iat",p!==void 0),h=Kt(n,"nbf");if(h!==void 0){if(h>T+l)throw new _('"nbf" claim timestamp check failed',n,"nbf",fe)}let v=Kt(n,"exp");if(v!==void 0){if(v<=T-l)throw new Ti('"exp" claim timestamp check failed',n,"exp",fe)}if(p!==void 0){let y=T-g,J=ue("maxTokenAge option",typeof p==="number"?p:Ze(p));if(y-l>J)throw new Ti('"iat" claim timestamp check failed (too far in the past)',n,"iat",fe);if(y<-l)throw new _('"iat" claim timestamp check failed (it should be in the past)',n,"iat",fe)}return n}var yr;function z(e){return yr.get(e)}function me(e){let t=z(e);for(let r of["iat","nbf","exp"]){let n=t[r];if(typeof n==="number"&&!Number.isFinite(n))throw TypeError(`"${r}" claim must be a finite number`)}return ye.encode(JSON.stringify(t))}function Qe(e,t){return z(e)[t]}class te{constructor(e={}){if(!S(e))throw TypeError("JWT Claims Set MUST be an object");(yr||=new WeakMap).set(this,structuredClone(e))}setIssuer(e){return At("iss",e),z(this).iss=e,this}setSubject(e){return At("sub",e),z(this).sub=e,this}setAudience(e){return qr(e),z(this).aud=e,this}setJti(e){return At("jti",e),z(this).jti=e,this}setNotBefore(e){return z(this).nbf=xt(e,"setNotBefore"),this}setExpirationTime(e){return z(this).exp=xt(e,"setExpirationTime"),this}setIssuedAt(e){let t=z(this);if(e===void 0)t.iat=xe(new Date);else if(typeof e==="string")t.iat=ue("setIssuedAt",xe(new Date)+Ze(e));else t.iat=xt(e,"setIssuedAt");return this}}async function Sn(e,t,r){let n=await lr(e,ur(r),t);if(!n[2])throw new E("JWTs MUST NOT use unencoded payload");let a={payload:le(n[1],n[0],r),protectedHeader:n[1]};if(typeof t==="function")return{...a,key:n[3]};return a}async function Pl(e,t,r){let n=await ir(e,or(r),t),o=n[1],a=le(o,n[0],r);for(let s of["iss","sub","aud"])if(o[s]!==void 0&&(s==="aud"?JSON.stringify(o.aud)!==JSON.stringify(a.aud):o[s]!==a[s]))throw new _(`replicated "${s}" claim header parameter mismatch`,a,s,"mismatch");let i={payload:a,protectedHeader:o};if(typeof t==="function")return{...i,key:n[2]};return i}function en(e){if(e===void 0)return[void 0,""];let t=pe(w,e);return[t[0],tr(t[1])]}function tn(e,t,r){return Xe(w,e),ce(e,N(w,se,r,e,t))}function rn(e){let t=e.alg;if(typeof t!=="string"||!t)throw new w('JWS "alg" (Algorithm) Header Parameter missing or invalid');return qe(t)}async function nn(e,t,r,n){let o=A(b(e),b("."),t),a=await U(r,n,"sign");return tr(await pr(r,a,o))}async function hr(e,t,r,n,o){let[a,i]=en(t);if(!a)throw new w("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!tn(a,a,r))o();let c=rn(a),p=tr(e),d=await nn(i,b(p),c,n);return`${i}.${p}.${d}`}var on=te;class Nl extends on{#e;setProtectedHeader(e){return Q(this.#e,"setProtectedHeader"),this.#e=e,this}async sign(e,t){return hr(me(this),this.#e,t?.crit,e,()=>{throw new E("JWTs MUST NOT use unencoded payload")})}}var an=te;class Ol extends an{#e;#r;#n;#t;#o;#i;#a;setProtectedHeader(e){return Q(this.#t,"setProtectedHeader"),this.#t=e,this}setKeyManagementParameters(e){return Q(this.#n,"setKeyManagementParameters"),this.#n=e,this}setContentEncryptionKey(e){return Q(this.#e,"setContentEncryptionKey"),this.#e=e,this}setInitializationVector(e){return Q(this.#r,"setInitializationVector"),this.#r=e,this}replicateIssuerAsHeader(){return this.#o=!0,this}replicateSubjectAsHeader(){return this.#i=!0,this}replicateAudienceAsHeader(){return this.#a=!0,this}async encrypt(e,t){let r=me(this);if(this.#t&&(this.#o||this.#i||this.#a))this.#t={...this.#t,iss:this.#o?Qe(this,"iss"):void 0,sub:this.#i?Qe(this,"sub"):void 0,aud:this.#a?Qe(this,"aud"):void 0};let n=await sr([r,this.#t,void 0,void 0,void 0,this.#e,this.#r,this.#n,void 0,!1],e,t);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}var Wt='"alg" (Algorithm)';function Ct(e='JWK "alg" (Algorithm) Parameter'){throw new m(`Invalid or unsupported ${e} value`)}function Ke(e,t){return(typeof e==="string"?Ae[e]??mt[e]:void 0)??Ct(t)}function et(e){if(e!==void 0&&typeof e!=="boolean")throw TypeError('"extractable" option must be a boolean');return e}var Je=(e,t)=>{if(e.byteLength!==t.length)return!1;for(let r=0;r<e.byteLength;r++)if(e[r]!==t[r])return!1;return!0},sn=(e)=>({data:e,pos:0}),vt=(e)=>{let t=e.data[e.pos++];if(t===void 0)throw Error("Unexpected end of ASN.1 input");return t},We=(e)=>{let t=vt(e);if(t&128){let r=t&127,n=0;for(let o=0;o<r;o++)n=n<<8|vt(e);return n}return t};var Ce=(e,t,r)=>{if(vt(e)!==t)throw Error(r)},wr=(e,t)=>{if(t<0||e.pos+t>e.data.length)throw Error("Unexpected end of ASN.1 input");let r=e.data.subarray(e.pos,e.pos+t);return e.pos+=t,r},cn=(e)=>{Ce(e,6,"Expected algorithm OID");let t=We(e);return wr(e,t)};function pn(e,t){if(Ce(e,48,`Invalid ${t==="spki"?"SPKI":"PKCS#8"} structure`),We(e),t==="pkcs8"){Ce(e,2,"Expected version field");let r=We(e);e.pos+=r}Ce(e,48,"Expected algorithm identifier"),We(e)}var dn=(e)=>{let t=cn(e);if(Je(t,[43,101,110]))return"X25519";if(!Je(t,[42,134,72,206,61,2,1]))throw Error("Unsupported key algorithm");Ce(e,6,"Expected curve OID");let r=We(e),n=wr(e,r);if(Je(n,[42,134,72,206,61,3,1,7]))return"P-256";if(Je(n,[43,129,4,0,34]))return"P-384";if(Je(n,[43,129,4,0,35]))return"P-521";throw Error("Unsupported named curve")},fn=async(e,t,r,n)=>{let o=et(n?.extractable),a=Ke(r,Wt);if(a.secret)Ct(Wt);let i=e==="spki",s;if(a.resolve)try{let c=sn(t);pn(c,e),s=a.resolve({crv:dn(c)})}catch{throw new m("Invalid or unsupported key format")}else s=a.subtle;return crypto.subtle.importKey(e,t,s,o??i,a.usages[i?0:1])},un=(e,t)=>Be(e.replace(t,"")),gr=(e,t,r)=>{let n=un(e,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);return fn("pkcs8",n,t,r)};function ln(e){return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0))}async function mn(e){if(st(e))if(e.type==="secret")e=e.export();else return e.export({format:"jwk"});if(e instanceof Uint8Array)return{kty:"oct",k:tr(e)};if(!M(e))throw TypeError(B(e,"CryptoKey","KeyObject","Uint8Array"));if(!e.extractable)throw TypeError("non-extractable CryptoKey cannot be exported as a JWK");let{ext:t,key_ops:r,alg:n,use:o,...a}=ln(await crypto.subtle.exportKey("jwk",e));if(a.kty==="AKP")a.alg=n;return a}function Er(e){return mn(e)}var V=(e,t)=>{if(typeof e!=="string"||!e)throw new _e(`${t} missing or invalid`)};async function Dl(e,t){let r;if(S(e)){if(r=oe(e),typeof r.kty!=="string")throw TypeError(B(e,"CryptoKey","KeyObject","JSON Web Key"))}else if(Re(e))r=oe(await Er(e));else throw TypeError(B(e,"CryptoKey","KeyObject","JSON Web Key"));if(t??="sha256",t!=="sha256"&&t!=="sha384"&&t!=="sha512")throw TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":V(r.alg,'"alg" (Algorithm) Parameter'),V(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":V(r.crv,'"crv" (Curve) Parameter'),V(r.x,'"x" (X Coordinate) Parameter'),V(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":V(r.crv,'"crv" (Subtype of Key Pair) Parameter'),V(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":V(r.e,'"e" (Exponent) Parameter'),V(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":if(typeof r.k!=="string")throw new _e('"k" (Key Value) Parameter missing or invalid');n={k:r.k,kty:r.kty};break;default:throw new m('"kty" (Key Type) Parameter missing or unsupported')}let o=b(JSON.stringify(n));return tr(await $e(t,o))}function yn(e,t,r,n){let{kty:o,key_ops:a,ext:i,kid:s,alg:c,use:p,crv:d}=oe(e),u=Array.isArray(a)?[...a]:a;return(i===void 0||typeof i==="boolean")&&(u===void 0||Array.isArray(u)&&u.every((l,K)=>typeof l==="string"&&u.indexOf(l)===K)&&u.includes("verify"))&&t.kty.includes(o)&&(n===void 0||typeof n==="string"&&n===s)&&(c===void 0?o!=="AKP":r===c)&&(p===void 0||p==="sig")&&(!t.crv||d===t.crv)}async function br(e,t,r){let n=e.get(t)||e.set(t,{}).get(t),{alg:o}=r;if(n[o]===void 0){let a=await j(r,{...t,alg:o,ext:!0});if(a.type!=="public")throw new De("JSON Web Key Set members must be public keys");n[o]=a}return n[o]}function Qc(e){let t;try{t=structuredClone(e)}catch{}if(!Me(t))throw new De("JSON Web Key Set malformed");let r=new WeakMap;return Object.defineProperty(async(o,a)=>{let{alg:i,kid:s}={...o,...a?.header},c=typeof i==="string"?Ae[i]:void 0;if(!c||c.secret)throw new m('Unsupported "alg" value for a JSON Web Key Set');let p=t.keys.filter((l)=>yn(l,c,i,s)),{0:d,length:u}=p;if(!u)throw new we;if(u!==1){let l=new ot;throw l[Symbol.asyncIterator]=async function*(){for(let K of p)try{yield await br(r,K,c)}catch{}},l}return br(r,d,c)},"jwks",{value:()=>structuredClone(t)})}function hn(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}var Tt;if(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))Tt="jose/v6.2.10";var Ar=Symbol();async function wn(e,t,r,n=fetch){let o=await n(e,{method:"GET",signal:r,redirect:"manual",headers:t}).catch((a)=>{if(a.name==="TimeoutError")throw new it;throw a});if(o.status!==200)throw new x("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await o.json()}catch{throw new x("Failed to parse the JSON Web Key Set HTTP response as JSON")}}var xr=Symbol();function ve(e,t){return Number.isFinite(e)&&Date.now()<e+t}function Sr(e,t,r){if(Number.isNaN(e))throw TypeError(`"${r}" option must not be NaN`);return typeof e==="number"?e:t}function Vc(e,t){if(!(e instanceof URL))throw TypeError("url must be an instance of URL");let r=new URL(e.href).href,n=t??{},o=n.timeoutDuration;if(typeof o==="number"&&(!Number.isInteger(o)||o<0))throw TypeError('"timeoutDuration" option must be a non-negative integer');let a=typeof o==="number"?o:5000,i=Sr(n.cooldownDuration,30000,"cooldownDuration"),s=Sr(n.cacheMaxAge,600000,"cacheMaxAge"),c=new Headers(n.headers);if(Tt&&!c.has("User-Agent"))c.set("User-Agent",Tt);if(!c.has("accept"))c.set("accept","application/json, application/jwk-set+json");let p=n[Ar],d=n[xr],u,l,K=0,T=0,g;if(d&&typeof d==="object"){let{uat:y,jwks:J}=d;if(ve(y,s)&&Me(J))u=y,g=Qc(J)}let h=async()=>{if(l&&hn())l=void 0;if(!l){let y=++K,J=l=wn(r,c,AbortSignal.timeout(a),p).then((P)=>{let H=Qc(P);if(y<=T)return;g=H;let O=Date.now();if(d)d.uat=O,d.jwks=P;u=O,T=y}).finally(()=>{if(l===J)l=void 0})}await l};return Object.defineProperties(async(y,J)=>{if(!g||!ve(u,s))await h();try{return await g(y,J)}catch(P){if(P instanceof we&&!ve(u,i))return await h(),g(y,J);throw P}},{coolingDown:{get:()=>ve(u,i),enumerable:!0},fresh:{get:()=>ve(u,s),enumerable:!0},reload:{value:h,enumerable:!0},reloading:{get:()=>!!l,enumerable:!0},jwks:{value:()=>g?.jwks(),enumerable:!0}})}var gn=te;class kp extends gn{encode(){let e=tr(JSON.stringify({alg:"none"})),t=tr(me(this));return`${e}.${t}.`}static decode(e,t){if(typeof e!=="string")throw new E("Unsecured JWT must be a string");let{0:r,1:n,2:o,length:a}=e.split(".");if(a!==3||o!=="")throw new E("Invalid Unsecured JWT");let i,s;try{i=F(r,w,"JWS Protected Header is invalid");let p=N(w,se,void 0,i,i);s=ce(i,p)}catch(p){if(!(p instanceof w))throw p;throw new E("Invalid Unsecured JWT",{cause:p})}if(i.alg!=="none")throw new E("Invalid Unsecured JWT");if(!s)throw new E("JWTs MUST NOT use unencoded payload");return{payload:le(i,W(n,"payload",E),t),header:i}}}async function Dg(e,t,r){if(typeof e!=="string"||e.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw TypeError('"pkcs8" must be PKCS#8 formatted string');return gr(e,t,r)}async function na(e,t,r){if(!S(e))throw TypeError("JWK must be an object");let n=Le(e),o=et(r?.extractable),{alg:a}=n;t??=a;let i=o??n.ext;if(n.kty!=="oct"&&!t)throw TypeError('"alg" argument is required when "jwk.alg" is not present');switch(n.kty){case"oct":if(typeof n.k!=="string")throw TypeError('missing "k" (Key Value) Parameter value');return D(n.k);case"AKP":{if(typeof a!=="string"||!a)throw TypeError('missing "alg" (Algorithm) Parameter value');if(t!==a)throw TypeError("JWK alg and alg option value mismatch");return j(Ke(t),{...n,ext:i})}case"RSA":case"EC":case"OKP":return j(Ke(t),{...n,alg:t,ext:i});default:throw new m('Unsupported "kty" (Key Type) Parameter value')}}function ko(e){let t;if(typeof e==="string"){let n=e.split(".");if(n.length===3||n.length===5)[t]=n}else if(typeof e==="object"&&e)if("protected"in e)t=e.protected;else throw TypeError("Token does not contain a Protected Header");let r="Invalid Token or Protected Header formatting";if(typeof t!=="string"||!t)throw TypeError(r);return F(t,TypeError,r)}function Zr(e){if(typeof e!=="string")throw new E("JWTs must use Compact JWS serialization, JWT must be a string");let{1:t,length:r}=e.split(".");if(r===5)throw new E("Only JWTs using Compact JWS serialization can be decoded");if(r!==3)throw new E("Invalid JWT");if(!t)throw new E("JWTs must contain a payload");let n;try{n=D(t)}catch{throw new E("Failed to base64url decode the payload")}let o;try{o=JSON.parse(re.decode(n))}catch{throw new E("Failed to parse the decoded payload as JSON")}if(!S(o))throw new E("Invalid JWT Claims Set");return o}export{Ti,tr,Md,Sn,Pl,Nl,Ol,Dl,Qc,Vc,kp,Dg,na,ko,Zr};