@suveren/gateway 0.4.1 → 0.6.0

package/node_modules/jose/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.2.4';
+    const VERSION = 'v6.2.7';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();
@@ -51,7 +51,7 @@ function isFreshJwksCache(input, cacheMaxAge) {
     }
     return true;
 }
-class RemoteJWKSet {
+class RemoteJWKSetImpl {
     #url;
     #timeoutDuration;
     #cooldownDuration;
@@ -67,12 +67,12 @@ class RemoteJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this.#url = new URL(url.href);
-        this.#timeoutDuration =
-            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
+        const opts = options ?? {};
+        this.#timeoutDuration = typeof opts.timeoutDuration === 'number' ? opts.timeoutDuration : 5000;
         this.#cooldownDuration =
-            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
-        this.#cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-        this.#headers = new Headers(options?.headers);
+            typeof opts.cooldownDuration === 'number' ? opts.cooldownDuration : 30000;
+        this.#cacheMaxAge = typeof opts.cacheMaxAge === 'number' ? opts.cacheMaxAge : 600000;
+        this.#headers = new Headers(opts.headers);
         if (USER_AGENT && !this.#headers.has('User-Agent')) {
             this.#headers.set('User-Agent', USER_AGENT);
         }
@@ -80,10 +80,11 @@ class RemoteJWKSet {
             this.#headers.set('accept', 'application/json');
             this.#headers.append('accept', 'application/jwk-set+json');
         }
-        this.#customFetch = options?.[customFetch];
-        if (options?.[jwksCache] !== undefined) {
-            this.#cache = options?.[jwksCache];
-            if (isFreshJwksCache(options?.[jwksCache], this.#cacheMaxAge)) {
+        this.#customFetch = opts[customFetch];
+        const cache = opts[jwksCache];
+        if (cache !== undefined) {
+            this.#cache = cache;
+            if (isFreshJwksCache(cache, this.#cacheMaxAge)) {
                 this.#jwksTimestamp = this.#cache.uat;
                 this.#local = createLocalJWKSet(this.#cache.jwks);
             }
@@ -92,15 +93,14 @@ class RemoteJWKSet {
     pendingFetch() {
         return !!this.#pendingFetch;
     }
+    #validFor(duration) {
+        return typeof this.#jwksTimestamp === 'number' && Date.now() < this.#jwksTimestamp + duration;
+    }
     coolingDown() {
-        return typeof this.#jwksTimestamp === 'number'
-            ? Date.now() < this.#jwksTimestamp + this.#cooldownDuration
-            : false;
+        return this.#validFor(this.#cooldownDuration);
     }
     fresh() {
-        return typeof this.#jwksTimestamp === 'number'
-            ? Date.now() < this.#jwksTimestamp + this.#cacheMaxAge
-            : false;
+        return this.#validFor(this.#cacheMaxAge);
     }
     jwks() {
         return this.#local?.jwks();
@@ -134,45 +134,36 @@ class RemoteJWKSet {
                 this.#cache.jwks = json;
             }
             this.#jwksTimestamp = Date.now();
-            this.#pendingFetch = undefined;
         })
-            .catch((err) => {
+            .finally(() => {
             this.#pendingFetch = undefined;
-            throw err;
         });
         await this.#pendingFetch;
     }
 }
 export function createRemoteJWKSet(url, options) {
-    const set = new RemoteJWKSet(url, options);
+    const set = new RemoteJWKSetImpl(url, options);
     const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
     Object.defineProperties(remoteJWKSet, {
         coolingDown: {
             get: () => set.coolingDown(),
             enumerable: true,
-            configurable: false,
         },
         fresh: {
             get: () => set.fresh(),
             enumerable: true,
-            configurable: false,
         },
         reload: {
             value: () => set.reload(),
             enumerable: true,
-            configurable: false,
-            writable: false,
         },
         reloading: {
             get: () => set.pendingFetch(),
             enumerable: true,
-            configurable: false,
         },
         jwks: {
             value: () => set.jwks(),
             enumerable: true,
-            configurable: false,
-            writable: false,
         },
     });
     return remoteJWKSet;

package/node_modules/jose/dist/webapi/jws/compact/sign.js

@@ -1,18 +1,21 @@
 import { FlattenedSign } from '../flattened/sign.js';
+import { unencodedPayload } from '../../lib/jws_sign.js';
 export class CompactSign {
     #flattened;
+    #protectedHeader;
     constructor(payload) {
         this.#flattened = new FlattenedSign(payload);
     }
     setProtectedHeader(protectedHeader) {
         this.#flattened.setProtectedHeader(protectedHeader);
+        this.#protectedHeader = protectedHeader;
         return this;
     }
     async sign(key, options) {
-        const jws = await this.#flattened.sign(key, options);
-        if (jws.payload === undefined) {
+        if (unencodedPayload(this.#protectedHeader)) {
             throw new TypeError('use the flattened module for creating JWS with b64: false');
         }
+        const jws = await this.#flattened.sign(key, options);
         return `${jws.protected}.${jws.payload}.${jws.signature}`;
     }
 }

package/node_modules/jose/dist/webapi/jws/compact/verify.js

@@ -1,21 +1,9 @@
-import { flattenedVerify } from '../flattened/verify.js';
-import { JWSInvalid } from '../../util/errors.js';
-import { decoder } from '../../lib/buffer_utils.js';
+import { prepareVerify, verifyCompact } from '../../lib/jws_verify.js';
 export async function compactVerify(jws, key, options) {
-    if (jws instanceof Uint8Array) {
-        jws = decoder.decode(jws);
-    }
-    if (typeof jws !== 'string') {
-        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');
-    }
-    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');
-    if (length !== 3) {
-        throw new JWSInvalid('Invalid Compact JWS');
-    }
-    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);
-    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    const verified = await verifyCompact(jws, prepareVerify(options), key);
+    const result = { payload: verified[0], protectedHeader: verified[1] };
     if (typeof key === 'function') {
-        return { ...result, key: verified.key };
+        return { ...result, key: verified[3] };
     }
     return result;
 }

package/node_modules/jose/dist/webapi/jws/flattened/sign.js

@@ -1,11 +1,4 @@
-import { encode as b64u } from '../../util/base64url.js';
-import { sign } from '../../lib/signing.js';
-import { isDisjoint } from '../../lib/type_checks.js';
-import { JWSInvalid } from '../../util/errors.js';
-import { concat, encode } from '../../lib/buffer_utils.js';
-import { checkKeyType } from '../../lib/check_key_type.js';
-import { validateCrit } from '../../lib/validate_crit.js';
-import { normalizeKey } from '../../lib/normalize_key.js';
+import { createSignature } from '../../lib/jws_sign.js';
 import { assertNotSet } from '../../lib/helpers.js';
 export class FlattenedSign {
     #payload;
@@ -28,62 +21,11 @@ export class FlattenedSign {
         return this;
     }
     async sign(key, options) {
-        if (!this.#protectedHeader && !this.#unprotectedHeader) {
-            throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
-        }
-        if (!isDisjoint(this.#protectedHeader, this.#unprotectedHeader)) {
-            throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
-        }
-        const joseHeader = {
-            ...this.#protectedHeader,
-            ...this.#unprotectedHeader,
-        };
-        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, this.#protectedHeader, joseHeader);
-        let b64 = true;
-        if (extensions.has('b64')) {
-            b64 = this.#protectedHeader.b64;
-            if (typeof b64 !== 'boolean') {
-                throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-            }
-        }
-        const { alg } = joseHeader;
-        if (typeof alg !== 'string' || !alg) {
-            throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-        }
-        checkKeyType(alg, key, 'sign');
-        let payloadS;
-        let payloadB;
-        if (b64) {
-            payloadS = b64u(this.#payload);
-            payloadB = encode(payloadS);
-        }
-        else {
-            payloadB = this.#payload;
-            payloadS = '';
-        }
-        let protectedHeaderString;
-        let protectedHeaderBytes;
-        if (this.#protectedHeader) {
-            protectedHeaderString = b64u(JSON.stringify(this.#protectedHeader));
-            protectedHeaderBytes = encode(protectedHeaderString);
-        }
-        else {
-            protectedHeaderString = '';
-            protectedHeaderBytes = new Uint8Array();
-        }
-        const data = concat(protectedHeaderBytes, encode('.'), payloadB);
-        const k = await normalizeKey(key, alg);
-        const signature = await sign(alg, k, data);
-        const jws = {
-            signature: b64u(signature),
-            payload: payloadS,
-        };
-        if (this.#unprotectedHeader) {
-            jws.header = this.#unprotectedHeader;
-        }
-        if (this.#protectedHeader) {
-            jws.protected = protectedHeaderString;
-        }
-        return jws;
+        return createSignature({
+            payload: this.#payload,
+            protectedHeader: this.#protectedHeader,
+            unprotectedHeader: this.#unprotectedHeader,
+            crit: options?.crit,
+        }, key);
     }
 }

package/node_modules/jose/dist/webapi/jws/flattened/verify.js

@@ -1,14 +1,6 @@
-import { decode as b64u } from '../../util/base64url.js';
-import { verify } from '../../lib/signing.js';
-import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import { concat, encoder, decoder, encode } from '../../lib/buffer_utils.js';
-import { decodeBase64url } from '../../lib/helpers.js';
-import { isDisjoint } from '../../lib/type_checks.js';
+import { JWSInvalid } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
-import { checkKeyType } from '../../lib/check_key_type.js';
-import { validateCrit } from '../../lib/validate_crit.js';
-import { validateAlgorithms } from '../../lib/validate_algorithms.js';
-import { normalizeKey } from '../../lib/normalize_key.js';
+import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
 export async function flattenedVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
@@ -28,83 +20,5 @@ export async function flattenedVerify(jws, key, options) {
     if (jws.header !== undefined && !isObject(jws.header)) {
         throw new JWSInvalid('JWS Unprotected Header incorrect type');
     }
-    let parsedProt = {};
-    if (jws.protected) {
-        try {
-            const protectedHeader = b64u(jws.protected);
-            parsedProt = JSON.parse(decoder.decode(protectedHeader));
-        }
-        catch {
-            throw new JWSInvalid('JWS Protected Header is invalid');
-        }
-    }
-    if (!isDisjoint(parsedProt, jws.header)) {
-        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
-    }
-    const joseHeader = {
-        ...parsedProt,
-        ...jws.header,
-    };
-    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);
-    let b64 = true;
-    if (extensions.has('b64')) {
-        b64 = parsedProt.b64;
-        if (typeof b64 !== 'boolean') {
-            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-        }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
-    if (algorithms && !algorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-    }
-    if (b64) {
-        if (typeof jws.payload !== 'string') {
-            throw new JWSInvalid('JWS Payload must be a string');
-        }
-    }
-    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
-        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
-    }
-    let resolvedKey = false;
-    if (typeof key === 'function') {
-        key = await key(parsedProt, jws);
-        resolvedKey = true;
-    }
-    checkKeyType(alg, key, 'verify');
-    const data = concat(jws.protected !== undefined ? encode(jws.protected) : new Uint8Array(), encode('.'), typeof jws.payload === 'string'
-        ? b64
-            ? encode(jws.payload)
-            : encoder.encode(jws.payload)
-        : jws.payload);
-    const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);
-    const k = await normalizeKey(key, alg);
-    const verified = await verify(alg, k, signature, data);
-    if (!verified) {
-        throw new JWSSignatureVerificationFailed();
-    }
-    let payload;
-    if (b64) {
-        payload = decodeBase64url(jws.payload, 'payload', JWSInvalid);
-    }
-    else if (typeof jws.payload === 'string') {
-        payload = encoder.encode(jws.payload);
-    }
-    else {
-        payload = jws.payload;
-    }
-    const result = { payload };
-    if (jws.protected !== undefined) {
-        result.protectedHeader = parsedProt;
-    }
-    if (jws.header !== undefined) {
-        result.unprotectedHeader = jws.header;
-    }
-    if (resolvedKey) {
-        return { ...result, key: k };
-    }
-    return result;
+    return verifyResult(jws, await verifySignature(jws, prepareVerify(options), key));
 }

package/node_modules/jose/dist/webapi/jws/general/sign.js

@@ -1,25 +1,21 @@
-import { FlattenedSign } from '../flattened/sign.js';
+import { createSignature } from '../../lib/jws_sign.js';
 import { JWSInvalid } from '../../util/errors.js';
 import { assertNotSet } from '../../lib/helpers.js';
 class IndividualSignature {
     #parent;
-    protectedHeader;
-    unprotectedHeader;
-    options;
-    key;
+    state;
     constructor(sig, key, options) {
         this.#parent = sig;
-        this.key = key;
-        this.options = options;
+        this.state = [undefined, undefined, key, options?.crit];
     }
     setProtectedHeader(protectedHeader) {
-        assertNotSet(this.protectedHeader, 'setProtectedHeader');
-        this.protectedHeader = protectedHeader;
+        assertNotSet(this.state[0], 'setProtectedHeader');
+        this.state[0] = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        assertNotSet(this.unprotectedHeader, 'setUnprotectedHeader');
-        this.unprotectedHeader = unprotectedHeader;
+        assertNotSet(this.state[1], 'setUnprotectedHeader');
+        this.state[1] = unprotectedHeader;
         return this;
     }
     addSignature(...args) {
@@ -47,16 +43,24 @@ export class GeneralSign {
         if (!this.#signatures.length) {
             throw new JWSInvalid('at least one signature must be added');
         }
+        if (!(this.#payload instanceof Uint8Array)) {
+            throw new TypeError('payload must be an instance of Uint8Array');
+        }
         const jws = {
             signatures: [],
             payload: '',
         };
+        const encoded = [];
         for (let i = 0; i < this.#signatures.length; i++) {
             const signature = this.#signatures[i];
-            const flattened = new FlattenedSign(this.#payload);
-            flattened.setProtectedHeader(signature.protectedHeader);
-            flattened.setUnprotectedHeader(signature.unprotectedHeader);
-            const { payload, ...rest } = await flattened.sign(signature.key, signature.options);
+            const [protectedHeader, unprotectedHeader, key, crit] = signature.state;
+            const { payload, ...rest } = await createSignature({
+                payload: this.#payload,
+                protectedHeader,
+                unprotectedHeader,
+                crit,
+                encoded,
+            }, key);
             if (i === 0) {
                 jws.payload = payload;
             }

package/node_modules/jose/dist/webapi/jws/general/verify.js

@@ -1,21 +1,41 @@
-import { flattenedVerify } from '../flattened/verify.js';
+import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
 import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
 export async function generalVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('General JWS must be an object');
     }
-    if (!Array.isArray(jws.signatures) || !jws.signatures.every(isObject)) {
+    const { signatures, payload } = jws;
+    if (!Array.isArray(signatures) || !signatures.every(isObject)) {
         throw new JWSInvalid('JWS Signatures missing or incorrect type');
     }
-    for (const signature of jws.signatures) {
+    let shared;
+    try {
+        if (payload === undefined)
+            throw new Error();
+        shared = prepareVerify(options);
+    }
+    catch {
+        throw new JWSSignatureVerificationFailed();
+    }
+    for (const signature of signatures) {
         try {
-            return await flattenedVerify({
-                header: signature.header,
-                payload: jws.payload,
-                protected: signature.protected,
-                signature: signature.signature,
-            }, key, options);
+            const { protected: encodedProtected, header, signature: encodedSignature } = signature;
+            if (encodedProtected === undefined && header === undefined)
+                throw new Error();
+            if (encodedProtected !== undefined && typeof encodedProtected !== 'string') {
+                throw new Error();
+            }
+            if (typeof encodedSignature !== 'string')
+                throw new Error();
+            if (header !== undefined && !isObject(header))
+                throw new Error();
+            return verifyResult(signature, await verifySignature({
+                header,
+                payload,
+                protected: encodedProtected,
+                signature: encodedSignature,
+            }, shared, key));
         }
         catch {
         }

package/node_modules/jose/dist/webapi/jwt/decrypt.js

@@ -1,10 +1,10 @@
-import { compactDecrypt } from '../jwe/compact/decrypt.js';
+import { prepareDecrypt, decryptCompact } from '../lib/jwe_decrypt.js';
 import { validateClaimsSet } from '../lib/jwt_claims_set.js';
 import { JWTClaimValidationFailed } from '../util/errors.js';
 export async function jwtDecrypt(jwt, key, options) {
-    const decrypted = await compactDecrypt(jwt, key, options);
-    const payload = validateClaimsSet(decrypted.protectedHeader, decrypted.plaintext, options);
-    const { protectedHeader } = decrypted;
+    const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key);
+    const protectedHeader = decrypted[1];
+    const payload = validateClaimsSet(protectedHeader, decrypted[0], options);
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
         throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
     }
@@ -17,7 +17,7 @@ export async function jwtDecrypt(jwt, key, options) {
     }
     const result = { payload, protectedHeader };
     if (typeof key === 'function') {
-        return { ...result, key: decrypted.key };
+        return { ...result, key: decrypted[2] };
     }
     return result;
 }

package/node_modules/jose/dist/webapi/jwt/sign.js

@@ -1,4 +1,5 @@
 import { CompactSign } from '../jws/compact/sign.js';
+import { unencodedPayload } from '../lib/jws_sign.js';
 import { JWTInvalid } from '../util/errors.js';
 import { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
 export class SignJWT {
@@ -42,9 +43,7 @@ export class SignJWT {
     async sign(key, options) {
         const sig = new CompactSign(this.#jwt.data());
         sig.setProtectedHeader(this.#protectedHeader);
-        if (Array.isArray(this.#protectedHeader?.crit) &&
-            this.#protectedHeader.crit.includes('b64') &&
-            this.#protectedHeader.b64 === false) {
+        if (unencodedPayload(this.#protectedHeader)) {
             throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
         }
         return sig.sign(key, options);

package/node_modules/jose/dist/webapi/jwt/unsecured.js

@@ -1,5 +1,6 @@
 import * as b64u from '../util/base64url.js';
-import { decoder } from '../lib/buffer_utils.js';
+import { strictDecoder } from '../lib/buffer_utils.js';
+import { decodeBase64url } from '../lib/helpers.js';
 import { JWTInvalid } from '../util/errors.js';
 import { validateClaimsSet, JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
 export class UnsecuredJWT {
@@ -50,14 +51,14 @@ export class UnsecuredJWT {
         }
         let header;
         try {
-            header = JSON.parse(decoder.decode(b64u.decode(encodedHeader)));
+            header = JSON.parse(strictDecoder.decode(b64u.decode(encodedHeader)));
             if (header.alg !== 'none')
                 throw new Error();
         }
         catch {
             throw new JWTInvalid('Invalid Unsecured JWT');
         }
-        const payload = validateClaimsSet(header, b64u.decode(encodedPayload), options);
+        const payload = validateClaimsSet(header, decodeBase64url(encodedPayload, 'payload', JWTInvalid), options);
         return { payload, header };
     }
 }

package/node_modules/jose/dist/webapi/jwt/verify.js

@@ -1,15 +1,15 @@
-import { compactVerify } from '../jws/compact/verify.js';
+import { prepareVerify, verifyCompact } from '../lib/jws_verify.js';
 import { validateClaimsSet } from '../lib/jwt_claims_set.js';
 import { JWTInvalid } from '../util/errors.js';
 export async function jwtVerify(jwt, key, options) {
-    const verified = await compactVerify(jwt, key, options);
-    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
+    const verified = await verifyCompact(jwt, prepareVerify(options), key);
+    if (!verified[2]) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
-    const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
-    const result = { payload, protectedHeader: verified.protectedHeader };
+    const payload = validateClaimsSet(verified[1], verified[0], options);
+    const result = { payload, protectedHeader: verified[1] };
     if (typeof key === 'function') {
-        return { ...result, key: verified.key };
+        return { ...result, key: verified[3] };
     }
     return result;
 }

package/node_modules/jose/dist/webapi/key/export.js

@@ -1,11 +1,44 @@
 import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from '../lib/asn1.js';
-import { keyToJWK } from '../lib/key_to_jwk.js';
-export async function exportSPKI(key) {
+import { invalidKeyInput } from '../lib/invalid_key_input.js';
+import { encode as b64u } from '../util/base64url.js';
+import { isCryptoKey, isKeyObject } from '../lib/is_key_like.js';
+function omitUndefinedProperties(jwk) {
+    return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== undefined));
+}
+async function keyToJWK(key) {
+    if (isKeyObject(key)) {
+        if (key.type === 'secret') {
+            key = key.export();
+        }
+        else {
+            return key.export({ format: 'jwk' });
+        }
+    }
+    if (key instanceof Uint8Array) {
+        return {
+            kty: 'oct',
+            k: b64u(key),
+        };
+    }
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'Uint8Array'));
+    }
+    if (!key.extractable) {
+        throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');
+    }
+    const { ext, key_ops, alg, use, ...jwk } = omitUndefinedProperties(await crypto.subtle.exportKey('jwk', key));
+    if (jwk.kty === 'AKP') {
+        ;
+        jwk.alg = alg;
+    }
+    return jwk;
+}
+export function exportSPKI(key) {
     return exportPublic(key);
 }
-export async function exportPKCS8(key) {
+export function exportPKCS8(key) {
     return exportPrivate(key);
 }
-export async function exportJWK(key) {
+export function exportJWK(key) {
     return keyToJWK(key);
 }